Therac-25
[2]: 425 Because of concurrent programming errors (also known as race conditions), it sometimes gave its patients radiation doses that were hundreds of times greater than normal, resulting in death or serious injury.
In the early 1970s, CGR and the Canadian public company Atomic Energy of Canada Limited (AECL) collaborated on the construction of linear accelerators controlled by a DEC PDP-11 minicomputer: the Therac-6, which produced X-rays of up to 6 MeV, and the Therac-20, which could produce X-rays or electrons of up to 20 MeV.
AECL developed a new double pass concept for electron acceleration in a more confined space, changing its energy source from klystron to magnetron.
The Therac-25 was designed as a machine controlled by a computer, with some safety mechanisms switched from hardware to software as a result.
AECL decided not to duplicate some safety mechanisms, and reused modules and code routines from the Therac-20 for the Therac-25.
In a subsequent lawsuit, lawyers were unable to identify the programmer or learn about his qualification and experience.
In this type of machine, electromechanical locks were traditionally used to ensure that the turntable was in the correct position before starting treatment.
[6] The six documented accidents occurred when the high-current electron beam generated in X-ray mode was delivered directly to patients.
Previous models had hardware interlocks to prevent such faults, but the Therac-25 had removed them, depending instead on software checks for safety.
The feeling was described by patient Ray Cox as "an intense electric shock", causing him to scream and run out of the treatment room.
[8] A Therac-25 had been in operation for six months in Marietta, Georgia at the Kennestone Regional Oncology Center when, on June 3, 1985, applied radiation therapy treatment following a lumpectomy was being performed on 61-year-old woman Katie Yarbrough.
Due to the radiation overdose, her breast had to be surgically removed, an arm and shoulder were immobilized, and she was in constant pain.
They then changed the method to be tolerant of one failure and modified the software to check if the turntable was moving or in the treatment position.
[3] In December 1985 a woman developed an erythema with a parallel band pattern after receiving treatment from a Therac-25 unit.
The AECL responded in two pages detailing the reasons why radiation overdose was impossible on the Therac-25, stating both machine failure and operator error were not possible.
The experienced operator entered the session data and realized that she had written an “x” for ‘x-ray’ instead of an “e” for ‘electron beam’ as the type of treatment.
The machine stopped again with the message "Malfunction 54" (error 54) and the dosimeter indicated that it had delivered fewer units than required.
A physician was immediately called to the scene, where they observed intense erythema in the area, suspecting that it had been a simple electric shock.
The hospital physicist checked the machine and, because it was calibrated to the correct specification, it continued to treat patients throughout the day.
The technicians were unaware that the patient had received a massive dose of radiation between 16,500 and 25,000 rads in less than a second over an area of one cm2.
The crackling of the machine had been produced by saturation of the ionization chambers, which had the consequence that they indicated that the applied radiation dose had been very low.
Over the following weeks the patient experienced paralysis of the left arm, nausea, vomiting, and ended up being hospitalized for radiation-induced myelitis of the spinal cord.
From the day after the accident, AECL technicians checked the machine and were unable to replicate error 54.
After filling in all the treatment data she realized that she had to change the mode from X to E. She did so and pressed ↵ Enter to go down to the command box.
They determined that speed in editing the data entry was a key factor in producing error 54.
The AECL stated they could not reproduce the error and they only got it after following the instructions of the physicist so that the data entry was very rapid.
Four days later the reddening of the area had a banded pattern similar to that produced in the incident the previous year, and for which they had not found the cause.
The hospital physicist conducted tests with film plates to see if he could recreate the incident, which involved two X-ray parameters with the turntable in field-light position.
[3] A commission attributed the primary cause to generally poor software design and development practices, rather than singling out specific coding errors.
: Safeware, [48] [additional citation(s) needed] Researchers who investigated the accidents found several contributing causes.
