THERAC – 25 MEDICAL ACCELERATORSix people massively overdose between 1985 and 1987 as the results of the Therac-25 accidents werethree of them death and the others got a severe injury. This machine was a computer-based radiationtherapy machine manufactured by Atomic Energy of Canada Limited (AECL). For 35-year history ofmedical accelerators, this serial accident has famous as the worst incident . Figure 1. The Therac-25The first accident occurred in Kennestone Regional Oncology Center, June 3, 1985. According toLeveson (1995), the details are insufficient. Kennestone facility has operating a Therac-25 about sixmonths when they handled treatment for a 61-year-old woman in Marietta, Georgia. The therapy was afollow up medication after removed a malignant breast tumor. She got an overdose when later,Kennestone physicist estimated it about one or two doses of radiation in the 15,000 to 20,000 rad(radiation-absorbed dose) range. Due to the incident, the manufacturer and machine operator stillrefused to believe that it cause by the Therac-25.
Following that, the second accidents happened in Hamilton, Ontario (Canada) on July 26, 1985. Aforty-year-old patient doing the carcinoma of the cervix therapy when the Therac-25 shut down by itself with H-TILT error message and no dose displayed. The machine paused and the operator pressingthe proceed command. This activity repeated for four times where the machine shut down again and onthe fifth pause the therapy suspend.The patient told the operator that she felt burning sensation during that time. On the next treatment, shestill complained and on November 3, 1985, she died with an extremely virulent cancer condition. Later,the AECL technician estimated that she received between 13,000 and 17,000 rads. On the report,AECL claimed a hardware failure (microswitch) as the caused and modified the machine.Next accidents involved a woman who has treated during December 1985 (after the Therac-25modified, in response to Hamilton accident) at Yakima Valley Memorial Hospital, Washington. Herskin become excessive reddening after the treatment and by the time the reaction become abnormal.Response for this case when the hospital staff sent a letter to AECL they replay that was impossible itcaused by the Therac-25 by attach two pages of technical reasons to support.On March 21, 1986, the fourth incident occurred in Tyler, Texas (East Texas Cancer Center). Anoilfield worker, Ray Cox, felt he had a jolt of searing heat during doing the treatment. In other side, themachine operator got a “Malfunction 54” message displayed on the Therac-25 computer terminal .Cox’s condition become worst over the weeks of the accident and died from complications of theoverdose in Dallas Hospital, September 1986. After simulation, revealed that the patient got a massiveoverdose (16,500 to 25,000 rads in less than 1 second over an area of about 1 cm).About a month later, April 11, 1986, a 66-year-old bus driver has to treat his skin cancer in the sameplace as Ray Cox, ETCC in Tyler, Texas. Another accident occurred, again “Malfunction 54” occurredby the same technician as Tyler case before. Verdon Kidd, the patient moaning for help and on May 1,1986 he died from the overdose. An autopsy showed an acute high-dose radiation injury to the righttemporal lobe of the brain and the brain stem.The last serial accident for the Therac-25 was on January 17, 1987 in Yakima, Washington. Acarcinoma patient has to receive 86 rads total exposure for his treatment. During the activity, theoperator gets some unclear point of the message, displayed on the machine, and the unit shut downwith a pause. The operator proceed it again by pressing one key (proceed command) but after that she
heard the patient speak on the intercom. The patient died in April from complications related to theoverdose.The Therac-25 developed by AECL since in the mid-1970s with fully computer controlled. Software inthe Therac-25 based from previous machine, the Therac-6 and the Therac-20. Different with theTherac-25, both previous machines had hardware safety interlocks mechanism independent of thecomputer . “They assumed that the software of the previous version of the accelerator was free oferrors and that it would function properly without the previous design’s mechanical interlocks” .However, this assumption was wrong where the Therac-20 also have problem with the machine buthardware safety mechanism doing their job well.Refer to the facts in the Leveson (1995) investigation that the Therac-25 works on the reusablesoftware where race condition has occurred when implement a multitasking played (concurrentprogramming). This bug has been occurring since the Therac-20 where the protection devices do notallow the beam to turn on and prevent the patient from overdose. In addition, there were a number ofweaknesses in the user interface such as just using one key for proceeds command where it made worstcondition during the machine operation.Testing process and documentations also have to responsibility in this case. On the Therac-25 user’smeeting, the manufacturer delegation clarified that they just doing the testing part for “2700 hours ofuse”. For this process, they just have sketchy documentation that meant testing does not done well.Overall, this case gives two main points as a lesson for the developer especially the software industrywhere:Place trust in people, process, systems, and tools without good cause. Because of success with the previous product, it does not mean can do so now with new technology without the need to re-assess the risks . If another part of the development has done well such as testing or maintenance, these problems perhaps never happen.Lack of documentation will lead to another problem. In the investigation report found that AECL just have very little documentation during the process such as software specification and test plan. However, a good documentation will helpful for monitoring, controlling and maintaining the software without create another problem such as the first Yakima incident.
References LEVESON, Nancy G. Safeware: System Safety and Computers. Addison-Wesley, 1995. KLING, Rob. (ed.) Computerization and Controversy. Academic Press, 1996. Baase, Sara. A Gift of Fire. Prentice Hall, 2003. POPOVIC, Dobrivoje & Ljubo Vlacic. (ed.) Mechatronics in Engineering Design andProduct Development. Marcel-Dekker Inc, 1999. Redmill, Felix & Tom Anderson. (ed.) Safety-critical Systems. Chapman & Hall, 1993.