Therac-25

From Wikipedia, the free encyclopedia
Jump to navigation Jump to search

The Therac-25 was a computer-controlled radiation therapy machine produced by Atomic Energy of Canada Limited (AECL) in 1982 after the Therac-6 and Therac-20 units (the earlier units had been produced in partnership with CGR of France).

It was involved in at least six accidents between 1985 and 1987, in which patients were given massive overdoses of radiation.[1]:425 Because of concurrent programming errors, it sometimes gave its patients radiation doses that were hundreds of times greater than normal, resulting in death or serious injury.[2] These accidents highlighted the dangers of software control of safety-critical systems, and they have become a standard case study in health informatics and software engineering. Additionally the overconfidence of the engineers[1]:428 and lack of proper due diligence to resolve reported software bugs are highlighted as an extreme case where the engineers' overconfidence in their initial work and failure to believe the end users' claims caused drastic repercussions.

Accidents[edit]

There have been 6 accidents caused by the Therac-25, 2 people survived with life-long injuries while 4 people have died.[3]

The first incident took place in Marietta, Georgia in June of 1985 when a 61-year old patient undergoing her final treatment for breast cancer at the Kennestone Regional Oncology Center, the machine was going to be targeting her lymph nodes with 10 MeV of radiated power, after the radiation, the patient complained about a red-hot burning sensation on the left side of her breast, the doctor said “That it wasn't possible for the machine to burn a patient.“

The patient returned to the Kennestone Regional Oncology Centre 2 weeks later, she complained about swelling on her left breast and that the red-hot burning sensation was now the size of a dime, 2 weeks later the patient came back again, this time the red-hot burning sensation was now a hole, a hole in her left breast, the doctor said that the hole looked like an exit dose of an electron beam. Later, the doctor tried various ways to get the machine to create the same dosage but the computer's safety system prevented him to apply the dosage. He called the Atomic Energy of Canada Limited's Medical department, he was ignored because there was no proof. The patient ended up suing Kennestone and Atomic Energy of Canada Limited's Medical department but the case went to deposition.

The first patient died in 1990.

The second incident happened in Hamilton, Ontario on July 29th, a 40-year old cervical cancer patient was being treated by the machine. The computer had trouble delivering the dosage and displayed the infamous “Malfunction 54” error several times, the “Malfunction 54” error is not even shown in the machine's manual so most doctors hit the P key to proceed the dosage. The patient then came back the next day complaining about severe swelling to her hip. She eventually died in November of 1985, it turns out that her cancer was the cause of death, not the radiation. However, if she had still lived her hip would have been needed to be replaced because of the massive amounts of radiation poisoning, if the poisoning was unable to cause death.

There were two incidents of the machine at a hospital in Yakima, Washington, the first incident happened in December of 1985, with yet again, another cervical cancer patient. After the operation, she developed patterned burn marks on her back, the doctor wanted to know how the patient got such marks on her back and the patient replied that she used a heating pad often. This woman was left with severe scarring and minor disability and she is still living to this day. The other incident that happened in Yakima was the final incident in January of 1987, when a patient was undergoing carcinoma treatment, when the treatment was finished he had the same burn marks as the 1st incident in Yakima. The patient died in April of a combination of terminal cancer and complications of an overdose.

The 2 accidents between both Yakima accidents, happened in a hospital in Tyler, Texas, both patients were male. The first male patient, a 56-year old oilfield worker was going for treatment on March 21st, 1986, for a tumor on his back. He lied face down and got shocked twice. The patient tried to get up after the first shock but got shocked again after the doctor hit the P key to proceed the treatment, after that the patient got up and banged on the doors for help, he looked shaken and upset. He felt a tense electric shock or as if someone spilled hot coffee down his back. At the time, the video monitor was unplugged and the audio monitor was broken. The first patient went to the hospital 2 weeks later after spitting up blood, he suffered many injuries which left him paralyzed, a paralyzed left arm, paralyzed legs, his left vocal cord and his diaphragm, he died 5 months later. The next accident took place four days later to a 66-year old bus driver. This time the communications between the doctor and the patient were fixed. The patient was being treated for skin cancer on his face. After the operation, the patient moaned and talked to the doctor about “fire” on his face as well as the machine buzzing and making sounds reminiscent to him as someone frying eggs. He later became comatose, had a high fever of 105°F (40.5°C) and died after radiation exposure to his brain.

Design[edit]

The machine offered two modes of radiation therapy:[4]

  • Direct electron-beam therapy, in which a narrow low-current beam of high-energy (5 MeV to 25 MeV) electrons was scanned over the treatment area by magnets;
  • Megavolt X-ray (or photon) therapy, which delivered a fixed width beam of X-rays, produced by colliding a narrow 100-times higher current beam of 25 MeV electrons with a target, then passing the emitted X-rays through both a flattening filter and a collimator.

It also included a "Field light" mode, which allowed the patient to be correctly positioned by illuminating the treatment area with visible light.

Problem description[edit]

The Therac-25 user interface

The six documented accidents occurred when the high-current electron beam generated in X-ray mode was delivered directly to patients. Two software faults were to blame.[4] One, when the operator incorrectly selected X-ray mode before quickly changing to electron mode, which allowed the electron beam to be set for X-ray mode without the X-ray target being in place. A second fault allowed the electron beam to activate during field-light mode, during which no beam scanner was active or target was in place.

Previous models had hardware interlocks to prevent such faults, but the Therac-25 had removed them, depending instead on software checks for safety.

The high-current electron beam struck the patients with approximately 100 times the intended dose of radiation, and over a narrower area, delivering a potentially lethal dose of beta radiation. The feeling was described by patient Ray Cox as "an intense electric shock", causing him to scream and run out of the treatment room.[5] Several days later, radiation burns appeared, and the patients showed the symptoms of radiation poisoning; in three cases, the injured patients later died as a result of the overdose.[6]

Root causes[edit]

A commission concluded that the primary reason should be attributed to the bad software design and development practices, and not explicitly to several coding errors that were found. In particular, the software was designed so that it was realistically impossible to test it in a clean automated way.[4]

Researchers who investigated the accidents found several contributing causes. These included the following institutional causes:

  • AECL did not have the software code independently reviewed.
  • AECL did not consider the design of the software during its assessment of how the machine might produce the desired results and what failure modes existed. These form parts of the general techniques known as reliability modeling and risk management.
  • The system noticed that something was wrong and halted the X-ray beam, but merely displayed the word "MALFUNCTION" followed by a number from 1 to 64. The user manual did not explain or even address the error codes, so the operator pressed the P key to override the warning and proceed anyway.
  • AECL personnel, as well as machine operators, initially did not believe complaints. This was likely due to overconfidence.[1]:428
  • AECL had never tested the Therac-25 with the combination of software and hardware until it was assembled at the hospital.

The researchers also found several engineering issues:

  • The failure occurred only when a particular nonstandard sequence of keystrokes was entered on the VT-100 terminal which controlled the PDP-11 computer: an "X" to (erroneously) select 25 MeV photon mode followed by "cursor up", "E" to (correctly) select 25 MeV Electron mode, then "Enter", all within eight seconds.[4]
  • The design did not have any hardware interlocks to prevent the electron-beam from operating in its high-energy mode without the target in place.
  • The engineer had reused software from older models. Such methods manifest in so called cargo cult programming where there is blind reliance on previously created code that is poorly understood and may or may not be applicable. These models had hardware interlocks that masked their software defects. Those hardware safeties had no way of reporting that they had been triggered, so there was no indication of the existence of faulty software commands.
  • The hardware provided no way for the software to verify that sensors were working correctly (see open-loop controller). The table-position system was the first implicated in Therac-25's failures; the manufacturer revised it with redundant switches to cross-check their operation.
  • The equipment control task did not properly synchronize with the operator interface task, so that race conditions occurred if the operator changed the setup too quickly. This was missed during testing, since it took some practice before operators were able to work quickly enough to trigger this failure mode.
  • The software set a flag variable by incrementing it, rather than by setting it to a fixed non-zero value. Occasionally an arithmetic overflow occurred, causing the flag to return to zero and the software to bypass safety checks.

The software was written in assembly language that might require more attention for testing and good design. However the choice of language by itself is not listed as a primary cause in the report. The machine also used its own operating system.

Leveson notes that a lesson to be drawn from the incident is to not assume that reused software is safe: "A naive assumption is often made that reusing software or using commercial off-the-shelf software will increase safety because the software will have been exercised extensively. Reusing software modules does not guarantee safety in the new system to which they are transferred..."[4] This blind faith in poorly understood software coded paradigms is known as cargo cult programming. Similar unvalidated reuse of software from an earlier product caused the failure of the first launch of the Ariane 5 rocket. In response to incidents like those associated with Therac-25, the IEC 62304 standard was created, which introduces development life cycle standards for medical device software and specific guidance on using software of unknown pedigree.[7]

See also[edit]

Notes[edit]

  1. ^ a b c Baase, Sara (2008). A Gift of Fire. Pearson Prentice Hall.
  2. ^ Leveson, Nancy G.; Turner, Clark S. (July 1993). "An Investigation of the Therac-25 Accidents" (PDF). IEEE Computer. 26 (7): 18–41.
  3. ^ Template:Www.ccnr.org/fatal dose.html
  4. ^ a b c d e Levenson, Nancy (1995). "Safeware: System Safety and Computers. Appendix A: Medical Devices: The Therac-25" (PDF). Addison-Wesley.
  5. ^ Casey, Steven. Set Phasers On Stun - Design and Human Error. Aegean Publishing Company. pp. 11–16.
  6. ^ Rose, Barbara Wade. "Fatal Dose - Radiation Deaths linked to AECL Computer Errors". www.ccnr.org. Retrieved 14 June 2016.
  7. ^ Hall, Ken (June 1, 2010). "Developing Medical Device Software to IEC 62304". MDDI - Medical Device and Diagnostic Industry. Retrieved 2016-12-12.

Further reading[edit]