Fault, error, and failure

Abstract

The sequence and terminology are crucial: cyclically, through causation, a fault activates, triggering an error. Error propagates as errors. When an error is observed in the external environment, it becomes a failure. This failure can subsequently cause a fault in the system it serves, and the cycle continues.

Understanding systems and their boundaries is essential because the definitions of fault, error, and failure can vary based on whether they are internal or external to a system. A system is an entity that interacts with other entities, including hardware, software, humans, and the physical world. It is composed of components, each of which can be another system, creating a recursive structure that stops when a component is considered atomic. The system boundary is crucial as it defines the common frontier between the system and its environment, determining the inputs and outputs of the system. A fault can occur within this boundary, which is the cause of an error. This error propagates through the system's internal states and may eventually become visible as a failure in the system's external state. This failure, perceived at the service interface, can act as an external fault for another system, initiating a new cycle of fault, error, and failure. The line between error detection and error observation is subtle but significant. While error detection refers to identifying discrepancies internally within a system, error observation occurs when these discrepancies manifest externally, leading to an observable failure state.

From a safety perspective, if humans are involved in the system, failures can be categorized as follows: If a failure does not affect the human, it is considered a near miss. If failure affects humans but causes no harm, it is classified as an incident. If failure results in harm, it is deemed an accident.^{5, 6}

Figure 1 provides a summary of these definitions. It illustrates the relationship between fault, error, and failure. The graph suggests that functional safety applies primarily to engineering or technical domains when no patient is involved. If a patient is engaged, functional safety falls under the broader category of patient safety.

The human factor covers the entire system and timeline. Human errors happen in just a short amount of time or an instance.⁷

Figure 2 illustrates an example of a wrong couch density override to demonstrate that the fault creates an error, which propagates to the patient. If the error is observed, it becomes a failure and, depending on the beam intensity is categorized as a near miss, incident, or accident (adverse event). Detailed scenarios of the case are summarized in Table 1.

Daily QA trending serves as a helpful example. For instance, the beam output deviates from the baseline every day. These daily deviations are observed but are not termed errors or failures, as we define an error as any deviation beyond the 5% threshold. If the deviation exceeds 5%, it is an error until a physicist examines the monitor and identifies the error beyond 5%. At that moment, it is externally observed and termed as a failure. If physicists do not look at the monitor, the error remains in the system as an error and continues to propagate until it ultimately manifests as a failure in patient outcome observations.

Within our community, we often refer to “preventing error”.³ As we discussed earlier, when we refer to an initial error, we mostly mean human error, where the root cause lies within the human factor, requiring the creation of conditions that minimize the likelihood of human error. What reports such as 394 refer to is what we call “preventing error propagation” here. Besides, “preventing error” carries a negative load and implies that errors are intrinsically evil. This is invalid in today's dynamic and adaptive systems. Errors are essential for a learning organization, as report 394 is indeed utilizing them for training and learning.⁸ Modern terms such as “managing errors” seem more suitable.

The author was solely responsible for the conception, design, analysis, and writing of this manuscript.

The author declares no conflicts of interest.

This study did not involve human or animal subjects and, therefore did not require ethics approval.