The Therac-25 was a computer-controlled radiation therapy machine produced by Atomic Energy of Canada Limited (AECL) in 1982 after the Therac-6 (neptune) and Therac-20 units (the earlier units had been produced in partnership with of France).
The Therac-25 was involved in at least six incident overdoses of radiation between 1985 and 1987, leading to patient death, and contending what was, at that time, described as "the worst series of radiation accidents in the 35-year history of medical accelerators". Because of concurrent programming errors (also known as race conditions), it sometimes gave its patients radiation doses that were up to 250 times higher than normal, resulting in death or serious injury. These accidents highlighted the dangers of software control of safety-critical systems.
The Therac-25 has become a case study in health informatics, software engineering, and computer ethics. The incidents highlight the dangers of engineer overconfidence after the engineers dismissed end user reports, leading to severe consequences.
History
The French company CGR, a subsidiary of Thomson-CSF, manufactured the Neptune and Sagittaire linear accelerators.
In the early 1970s, CGR and the Canadian Crown corporation Atomic Energy of Canada Limited (AECL) collaborated on the construction of linear accelerators controlled by a DEC PDP-11 minicomputer: the Therac-6, which produced X-rays of up to 6 MeV, and the Therac-20, which could produce X-rays or electrons of up to 20 MeV. CGR developed the software for the Therac-6 and reused some subroutines for the Therac-20. In contrast to the Therac-25, the Therac-20's software "merely added convenience to the existing hardware, which was capable of standing alone."
In 1981, the two companies ended their collaboration agreement. AECL developed a new double pass concept for electron acceleration in a more confined space, changing its energy source from klystron to magnetron. In certain techniques, the electrons produced are used directly, while in others they are made to collide against a tungsten anode to produce X-ray beams. This dual accelerator concept was applied to the Therac-20 and Therac-25, with the latter being much more compact, versatile, and easy to use. It was also more economical for a hospital to have a dual machine that could apply treatments of electrons and X-rays, instead of two machines.
The Therac-25 was designed as a machine controlled by a computer, with some safety mechanisms switched from hardware to software as a result. AECL decided not to duplicate some safety mechanisms, and reused modules and code routines from the Therac-20 for the Therac-25.
The first prototype of the Therac-25 was built in 1976 and was put on the market in late 1982.
The software for the Therac-25 was developed by one person over several years using PDP-11 assembly language. It was an evolution of the Therac-6 software. In 1986, the programmer left AECL. In a subsequent lawsuit, lawyers were unable to identify the programmer or learn about his qualification and experience.
Six machines were installed in Canada and five in the United States.
After the accidents, in 1988 AECL dissolved the AECL Medical section and the company Theratronics International Ltd took over the maintenance of the installed Therac-25 machines.
Design
The machine had three modes of operation, with a turntable moving some apparatus into position for each of those modes: either a light, some scan magnets, or a tungsten target and flattener. A "field light" mode, while not a treatment mode, allowed the patient and collimator to be correctly positioned by illuminating the treatment area with visible light. A mirror would be placed to guide the light through the treatment beam's path. Direct electron-beam therapy, in which a narrow, low-current beam of high-energy () electrons was scanned over the treatment area by magnets; Megavolt X-ray (or photon) therapy, which delivered a beam of 25 MeV X-ray photons. The X-ray photons are produced by colliding a high current, narrow beam of electrons with a tungsten target. The X-rays are then passed through a flattening filter, and then measured using an X-ray ion chamber. The flattening filter resembles an inverted ice-cream cone, and it shapes and attenuates the X-rays. The electron beam current required to produce the X-rays is about 100 times greater than that used for electron therapy.
The patient is placed on a fixed stretcher. Above them is a turntable to which the components that modify the electron beam are fixed. The turntable has a position for the X-ray mode (photons), another position for the electron mode and a third position for making adjustments using visible light. In this position an electron beam is not expected, and a light that is reflected in a stainless steel mirror simulates the beam. In this position there is no ion chamber acting as a radiation dosimeter because the radiation beam is not expected to function.
The turntable has some microswitches that indicate the position to the computer. When the plate is in one of the three allowed fixed positions a plunger locks it by interlocking. In this type of machine, electromechanical locks were traditionally used to ensure that the turntable was in the correct position before starting treatment. In the Therac-25, these were replaced by software checks.
Problem description
The six documented accidents occurred when the high-current electron beam generated in X-ray mode was delivered directly to patients. Several software faults were to blame. One was when the operator incorrectly selected X-ray mode then in 8 seconds quickly changing to electron mode, which allowed the electron beam to be set for X-ray mode without the X-ray target being in place. A second fault allowed the electron beam to activate during field-light mode, during which no beam scanner was active or target was in place.
Previous models had hardware interlocks to prevent such faults, but the Therac-25 had removed them, depending instead on software checks for safety.
The first fault was corrected, but accidents would not stop, because a bit flag was being incremented instead of being set to non-zero, and so integer overflow still allowed the electron beam to be set for X-ray mode without the X-ray target being in place.
The high-current electron beam struck the patients with approximately 100 times the intended dose of radiation, and over a narrower area, delivering a potentially lethal dose of beta radiation. The feeling was described by patient Ray Cox as "an intense electric shock", causing him to scream and run out of the treatment room. Several days later, radiation burns appeared, and the patients showed the symptoms of radiation poisoning; in three cases, the injured patients later died as a result of the overdose.
Radiation overexposure incidents
Kennestone Regional Oncology Center, 1985 A Therac-25 had been in operation for six months in Marietta, Georgia, at the Kennestone Regional Oncology Center when, on June 3, 1985, applied radiation therapy treatment following a lumpectomy was being performed on 61-year-old woman Katie Yarbrough. She was set to receive a 10-MeV dose of electron therapy to her clavicle. When therapy began, she stated she experienced a "tremendous force of heat...this red-hot sensation." The technician entered the room, to whom Katie stated, "you burned me." The technician assured her this was not possible. She returned home where, in the following days, she experienced reddening of the treatment area. Shortly after, her shoulder became locked in place and she experienced spasms. Within two weeks, the redness spread from her chest to her back, indicating that the source of the burn had passed through her, which is the case with radiation burns. The machine was not investigated for safety despite all of this as the patient's symptoms were deemed a "normal treatment reaction".Porrello, A. M. (2012). Death and denial: The failure of the therac-25, a medical linear accelerator. Death and Denial: The Failure of the THERAC-25, AMedical Linear Accelerator. The staff at the treatment center did not believe it was possible for the Therac-25 to cause such an injury, and it was treated as a symptom of her cancer. Later, the hospital physicist consulted AECL about the incident. He calculated that the applied dose was between 15,000 and 20,000 rad (150…200 Gy) when she should have been dosed with 200 rad (2 Gy). A full-body dose of 1000 rad (10 Gy) can be fatal. In October 1985, Yarbrough sued the hospital and the manufacturer of the machine. In November 1985, AECL was notified of the lawsuit. It was not until March 1986, after another incident involving the Therac-25, that AECL informed the FDA that it had received a complaint from the patient.
Due to the radiation overdose, her breast had to be surgically removed, her arm and shoulder were immobilized, and she was in constant pain. The treatment printout function was not activated at the time of treatment and there was no record of the applied radiation data. An out-of-court settlement was reached to resolve the lawsuit.
Ontario Cancer Foundation, 1985
The Therac-25 had been in operation in the clinic for six months when, on July 26, 1985, a 40-year-old patient was receiving her 24th treatment for cervical cancer. The operator activated the treatment, but after five seconds the machine stopped with the error message "H-tilt", the treatment pause indication and the dosimeter indicating that no radiation had been applied. The operator pressed the key (Proceed : continue). The machine stopped again. The operator repeated the process five times until the machine stopped the treatment. A technician was called and found no problem. The machine was used to treat six other patients on the same day.
The patient complained of burning and swelling in the area and was hospitalized on July 30. She was suspected of a radiation overdose and the machine was taken out of service. On November 3, 1985, the patient died of cancer, although the autopsy mentioned that if she had not died then, she would have had to undergo a hip replacement due to damage from the radiation overdose. A technician estimated that she received between 13,000 and 17,000 rad (130…170 Gy).
The incident was reported to the FDA and the Canadian Radiation Protection Bureau.
AECL suspected that there might be an error with three microswitches that reported the position of the turntable. AECL was unable to replicate a failure of the microswitches and microswitch testing was inconclusive. They then changed the method to be tolerant of one failure and modified the software to check if the turntable was moving or in the treatment position.
Afterward, AECL said that the modifications represented a five-order-of-magnitude increase in safety.
Yakima Valley Memorial Hospital, 1985
In December 1985 a woman developed an erythema with a parallel band pattern after receiving treatment from a Therac-25 unit. She continued to be treated by the Therac-25 unit January 6, 1986. Hospital staff sent a letter on January 31, 1986, to AECL about the incident. AECL responded in two pages detailing the reasons why radiation overdose was impossible on the Therac-25, stating both machine failure and operator error were not possible. Hospital staff believed that the erythema was not related to the treatments and continued to treat the patient despite this. Treatments to this particular patient continued through January 6, 1986, until the staff could not identify another way that this would occur in the patient except from a source of consistent radiation. However, despite these treatments were still given to other patients and these problems had to be addressed as these patients also had similar negative reactions.