The Therac-25 was a radiation therapy machine made by AECL, a company owned by the Canadian government. Eleven were installed, five in the US and six in Canada. Between June 1985 and January 1987, six known accidents gave patients massive overdoses. Leveson and Turner pieced together why.
Older models had hardware interlocks that physically blocked unsafe operation. The Therac-25 leaned on software instead. Parts of its code came from the older machines, where hardware had hidden their bugs.
On 21 March 1986, at the East Texas Cancer Center in Tyler, an experienced operator typed "x" (X-ray) instead of "e" (electron), fixed it with the cursor-up key and turned the beam on. The machine stopped with "Malfunction 54", which the centre's manuals didn't explain, and showed an underdose. She pressed "P" to proceed, as she normally did. The patient had been massively overdosed. Three weeks later, so was a second. Both men died.
AECL couldn't reproduce it until the hospital physicist found the key: speed. Setting the beam's magnets takes about 8 seconds; an edit finished inside that window was never noticed by the part of the software that set up the treatment. A race condition, set off by a skilled typist.
In January 1987, in Yakima, a different bug: A setup check added one to a shared variable, Class3, on every pass, and zero meant "skip the collimator check". Class3 was one byte, so every 256th pass it rolled over to zero. Press "set" at that moment, and the machine fired a full 25 MeV beam with the target out of place. AECL's fix: set Class3 to a fixed non-zero value instead of counting.
- 6 known overdose accidents between June 1985 and January 1987
- About 8 seconds: the window for the Tyler race condition
- 1 byte: Class3 rolled over to zero on every 256th pass
- About 200 rads is a typical single dose; AECL measured 25,000 at Tyler
Why it matters: Safety that lives only in software is a single point of failure. Keep independent checks, and never use a counter as a yes/no flag.