Therac-25 |
Therac-25 was a radiation therapy machine produced by Atomic Energy of Canada Limited. It was involved with at least six known accidents between 1985 and 1987, in which patients were given massive radiation poisoning of radiation, which were in some cases on the order of tens of thousands of rad_(unit). At least five patients died of the overdoses. These accidents highlighted the dangers of software control system of safety-critical systems.
=Problem description=
The machine had two treatment modes:
When operating in direct electron-beam therapy mode, a low-powered electron beam was emitted directly from the machine, then spread to safe concentration using scanning magnets. When operating in soft X-ray mode, the machine was designed to rotate three components into the path of the electron beam, in order to shape and moderate the power of the beam; a target, which converted the electron beam into X-rays, a flattening filter (also called a collimator), which shaped the X-ray beam, and an X-ray ion chamber, which measured the strength of the beam...
The accidents occurred when the high-energy electron-beam was activated without the target having been rotated into place; the machine s software did not detect that this had occurred, and did not thenceforth determine that the patient was receiving a potentially lethal dose of radiation, or prevent this from occurring. The very high energy electron-beam directly struck the patients causing the feeling of an intense electric shock and the occurrence of thermal and radiation burns. In some cases, the injured patients died later from radiation poisoning.
=Root causes=
Researchers who investigated the accidents found several contributing causes. These included the following institutional causes: *The software code was not independently code reviewed. *The software design was not documented with enough detail to support reliability modelling. *The system documentation did not adequately explain error codes. *AECL personnel were at first dismissive of complaints.
The researchers also found several Engineering issues: *The design did not have any hardware interlocks to prevent the electron-beam from operating in its high-energy mode without the target in place. *Software from older models had been code reuse without properly considering the hardware differences. **The older models had included hardware interlocks; when the bug manifested in these models, they shut down, which was seen as a mere annoyance and never investigated. *The software assumed that sensors always worked correctly, since there was no way to verify them. (see open loop) *The equipment control process (computing) did not properly Mutual exclusion with the operator interface task, so that race conditions occurred if the operator changed the setup too quickly. This was evidently missed during testing, since it took some practice before operators were able to work quickly enough for the problem to occur. *Arithmetic overflows could cause the software to bypass safety checks. *The software was written in assembly language. While this was more common at the time than it is today, assembly language is harder to debug than high-level languages.
The case of the Therac-25, and its causes, has become a standard case study in the history of computing and medicine.
=See also=
*Computer bug *Ariane 5 Flight 501
=External links=
*[http://sunnyday.mit.edu/papers/therac.pdf The Therac-25 Accidents (PDF)], by Nancy Leveson (the updated version of the IEEE Computer article mentioned below) *[http://courses.cs.vt.edu/~cs3604/lib/Therac_25/Therac_1.html An Investigation of the Therac-25 Accidents (IEEE Computer)]|
|