On the 3rd of June, 1985, a woman entered the Kennestone Regional Oncology Center in
Georgia in the United States.
She was there to receive cancer treatment using a state-of-the-art machine – the Therac-25.
Unbeknownst to her, however, this machine had two hidden, fatal flaws; flaws which would
cause devastating injury to her and to five other patients before they were finally fixed.
Radiation has been used to treat cancer since the late 1800s, when it was noted that prolonged
exposure to x-rays resulted in skin burns.
Through a series of trial and error experiments, doctors discovered that it was possible to
target this burning effect to remove growths and treat lesions.
After much experimentation, medical professionals began to use targeted radiation to destroy
cancerous tumours.
Modern radiotherapy exposes cancerous cells to radiation, which damages their DNA, and
destroys these cells – resulting in the shrinking or complete destruction of tumours.
Radiation can also damage the healthy cells which surround a tumour, and so radiation
therapy is used in a highly targeted fashion to maximise damage to cancerous cells and
minimise damage to healthy ones.
The Therac-25 was a machine for administering radiation therapy, designed and built by Atomic
Energy of Canada Limited (or AECL).
It was preceded by the Therac-6 and Therac-20 – but was significantly more advanced than
either of those machines.
Those machines had mostly been operated manually, with technicians physically adjusting the
machine for each patient.
The Therac-25, by contrast, was fully computer controlled, allowing for much faster treatments
to be administered with less human error.
The Therac-25 had three modes of operation.
In its "field light" mode a mirror moved into position to direct a beam of light, which
could be used to ensure that the patient was positioned correctly.
In "electron" mode scanning magnets moved into position and spread an electron beam
over a wide area – ideal for treating cancers near the surface of the skin.
To treat tumours that were deeper within the body, "x-ray" mode would be used.
In this mode a tungsten target was placed in front of the electron beam in such a way
that when the beam made contact it would produce deeply penetrating x-ray photons aimed at
the patient.
On the 3rd of June, 1985, 61-year old Katie Yarborough was due to receive treatment using
the Therac-25 machine at the Kennestone Regional Oncology Center in Georgia.
She had already had a cancerous lump removed, successfully, from her left breast – this
treatment was to irradiate lymph nodes close to the area from which the lump had been removed,
in order to prevent her cancer returning.
When treatment began, Katie felt an intense burst of heat, causing her to complain to
the machine’s operator that she had been burned.
At the time there was no visible injury where the beam had hit, and so Katie was sent home.
Days later, she returned.
A coin-sized burn had appeared.
Over the course of weeks this injury worsened until it was an open wound that resembled
a severe radiation burn.
She suffered paralysis of her arm and constant pain.
Convinced that the Therac-25 had caused this injury, Katie began legal proceedings against
AECL, who denied any wrongdoing and settled out of court.
Katie died in a car crash in 1990.
On the 26th of July, 1985, a 40-year-old woman with cervical cancer was treated using a Therac-25
machine to target her hip at the Hamilton Regional Cancer Centre in Ontario.
During treatment, she experienced a burning sensation, which was followed by the slow
development of redness, swelling, and a wound that resembled a radiation burn.
She was admitted to hospital to treat this injury, and it was found that the damage to
her hip was so severe that it would have to be completely replaced.
The woman passed away from her cancer before this could happen.
AECL sent technicians to inspect the machine at the Hamilton Regional Cancer Centre, and
concluded that there was a problem with a turntable that placed one of three devices
in front of the beam – the mirror for “field light” mode, the scanning magnets for “electron”
mode and the tungsten target for “x-ray” mode.
If the turntable had been in the wrong position when the beam fired, this would explain the
massive overdose that the patient had received.
A fix was made, with hardware and software modifications made to the eleven Therac-25
machines across the US and Canada.
AECL confidently announced that the machine was now fixed, and safer than it ever had
been before.
Despite this fix, further accidents followed.
In December, 1985, a woman was burned by the Therac-25 machine at a clinic in Yakima, Washington,
and needed multiple skin grafts to close the wound.
Two further accidents took place at the East Texas Cancer Center in Tyler, Texas.
On the 21st of March, 1986, a male patient experienced such a strong and painful burning
sensation during treatment with the Therac-25 machine that he removed himself from the machine
and hammered on the door of the room, demanding to be let out.
He was hospitalised shortly afterwards, and died less than six months later.
On the 11th of April, 1986, another male patient was receiving treatment for skin cancer on
his ear.
He experienced a sudden, intense burning pain in his head and heard a sizzling sound.
Over the course of the next month his condition deteriorated, and he died from radiation burns
to his brain.
Following this fatal accident, AECL began an investigation, with their findings reported
to the Food and Drug Administration (or FDA).
They made little progress beyond the already-identified turntable issue.
It was only when East Texas Cancer Center physicist Fritz Hager started running tests
of his own that the issues underpinning the accidents were brought to light.
Hager spoke to the technician who had been using the machine when the accidents occurred,
and noted that each one had been preceded by the same error message: Error 54.
Hager started trying to recreate that error.
Rather than engaging in slow, careful, systematic testing, he used the machine as it might be
used on a day-to-day basis – inputting multiple prescriptions, making and correcting errors,
and – importantly – doing so as quickly as the average operator might.
He discovered that, should the operator select "x-ray" mode, then quickly go back and switch
to "electron" mode – the turntable would not correctly move into position, prompting
an Error 54 message.
A further complicating factor was that the Therac-25 often produced error messages.
These were almost always given as simple numbers with no explanation: Error 1, Error 2, Error
3 and so on.
Since most errors were minor, and not safety-critical, operators were in the habit of clearing error
messages and continuing with treatment whenever they occurred.
Error 54, though, was not trivial.
When it occurred, and when treatment continued anyway, the machine could produce an electron
beam with the turntable in the wrong position, risking a massive radiation overdose to the
patient.
This kind of catastrophic error had been impossible with the older Therac machines.
The Therac-6 and Therac-20 had relied on hardware interlocks – physical mechanisms that prevented
the machine from functioning if a dangerous situation existed – for example if the turntable
wasn’t properly in place.
With the Therac-25 these hardware interlocks were replaced with software-based safety checks…
which, tragically, failed.
It appeared that AECL had been overconfident in their software.
They had dedicated a lot of time and energy to testing the physical parts of the machine,
but very little to ensuring that the software worked as it should.
Indeed, the code was written in house by a single programmer, and was not reviewed by
anyone outside the company before it was put into operation.
It appeared almost as though AECL had not believed that software could malfunction.
Following these discoveries, the FDA declared the Therac-25 defective, and ordered that
it be taken out of operation until a fix had been implemented.
AECL worked to install software patches on all existing machines, while dealing with
multiple lawsuits from the families of those injured.
These lawsuits were settled out of court, and the machines returned to service in 1986.
One error had been fixed, but in January 1987 another, different issue came to light.
A counter in the machine’s code kept track of errors during set up – if the counter
contained any number other than zero, there was an error, and treatment could not start.
However, this counter had an upper limit – 255; the largest number that could be stored in
a single byte of data.
If the counter reached a value above 255, it would reset to zero, allowing treatment
to begin even if there were still errors.
In January 1987, this was exactly what happened.
A Therac-25 malfunctioned again, resulting in another patient death.
This final accident was the end for the Therac-25.
It was considered by most institutions to be too dangerous to carry on using, and the
majority of machines were soon retired.
Modern radiotherapy machines do not have the same flaws as the Therac-25 – they don’t
rely solely on software, and instead have mechanical interlocks that physically stop
the machine from activating if a dangerous condition exists.
All software for medical devices is subject to external review, and must conform to pre-agreed
standards.
The Therac-25 – a machine that was meant to heal, but which (in a small number of cases)
did the exact opposite – is now a case study for engineers around the world.
It demonstrates the importance of mechanical safety features, and the dangers of putting
too much faith in software.