Therac-25: The Software that Killed

In the 1980s, a state-of-the-art radiation machine was supposed to save lives. But patients started coming back with burns that didn’t make sense… pain that shouldn’t have been possible… and symptoms doctors didn’t believe. The machine said everything was fine. It wasn’t. This is the story of the Therac‑25 — and what happens when we trust technology more than people.

Sources:

https://web.stanford.edu/class/archive/cs/cs240/cs240.1236/old//sp2014/readings/therac-25.pdf

http://sunnyday.mit.edu/papers/therac.pdf

Therac-25 - Wikipedia 

Transcript

SPEAKER_00 0:00

There are stories where things fail loudly, explosions, crashes, chaos, and then there are the ones that fail quietly, where danger isn't obvious until it's already too late. Welcome back to the Crash Lessons Podcast. I'm your host, Robin, and today's story is about a machine that was supposed to treat cancer, but instead became one of the most infamous medical disasters in history. Therac 25. What makes this story so unsettling isn't just what happened, it's how it happened. Patients went in for routine radiation therapy, something that's done safely thousands of times daily. But in these cases, something inside the machine went catastrophically wrong, and the worst part, at first no one believed it. Operators thought it was a malfunction, doctors thought it was impossible, and the system itself showed no clear signs that anything had gone wrong. But behind the scenes, hidden in the software, a series of flaws were quietly built building word disaster. So before we get into the incident themselves, we need to understand what the Therac 25 actually was, how it worked, and why so many people trusted it in the first place. Before I talk about the machine, we need to talk about what it was doing. Because radiation therapy isn't just another medical procedure, it's something most people already fear before anything goes wrong. Radiation therapy works by firing extremely high energy particles into the body. The goal is simple but brutal. Destroy cancer by damaging the DNA inside the tumor cells so they can't keep growing. But there's the uncomfortable truth. That same radiation doesn't know the difference between cancer and healthy tissue. Now imagine being a patient, you've been diagnosed with cancer, you're walking into a treatment room, maybe for the first time, there's a large machine waiting for you, cold, mechanical, quiet, you lie down, technicians leave the room, and then you're alone. A machine, something you don't understand, is about to deliver radiation directly into your body. You can't see it, you can't feel it working correctly, and you have no way to judge whether it's safe. You're trusting the doctors, the technicians, the engineers, and the machine itself completely. This kind of treatment requires a very specific kind of trust. Patients trust that the machine has been tested, the software is reliable, and that nothing inside it can fail in a way that harms them. Because if it does, they're completely defenseless. And that's what makes this story so disturbing. The Therac 25 didn't just fail as a piece of technology, it failed in a place where the margins are razor thin, the consequences are invisible until it's too late, and the patient has no control at all. When something went wrong, the patients didn't know why, the operators didn't understand what was happening, and the machine just kept running. That's the context you need to understand before we talk about Therac 25. It was just a software bug. Um it was a failure of tr sorry, it wasn't just a software bug, it was a failure of trust in one of the most high-stakes environments imaginable. So let's get into the machine itself. The Therac 25 was a computer-controlled radiation therapy machine produced by Atomic Energy of Canada Limited, or AECL, in 1982. Before the Therac 25, the French company CGR had collaborated with the AECL to create linear accelerators controlled by DEC PDP11 microcomputer. Don't worry, I'll explain what all this means and how things work because I was researching this and reading about this and was just had no idea myself what the heck I was reading. So a linear accelerator is a mechanical machine used in radiation therapy. What this machine does is accelerate, is it accelerates electrons to very high speeds to either use them directly or smash them into a target which creates high energy X-rays and will then be aimed at tumors to destroy cancer cells. DEC DPD11 was a computer from the 1970s to 80s made by a Digital Equipment Corporation. In regards to the Therac 25, the PDP-11 was to manage how much radiation was actually delivered, managed timing and beam intensity, took input from the operator, like the dosage settings, and coordinated safety checks. So linear accelerators controlled by DEP PDP-11, it's like that's a lot to say, were cancer treatment machines where a computer was in charge of controlling the radiation being delivered to the patient. So first came the Therac 6, which was which produced X-rays of up to 6 MeV, and then the Therac 20, which produced X-rays or electrons up to 20 MeV. Now MeV stands for mega electron volt, which is a unit used to measure energy. 1 MeV equals 1 million electron volts, so the higher the number, the more power. When they created Therac 20, they based it off of the first model, Therak 6, and used characteristics in the same thing when they created Therak 25. The earlier versions of the machine weren't perfect by any means and did have their own issues. Like anything that relies on technology really isn't perfect. The robots are going to take over one day, I'll die on that hill. But these issues were minor issues compared to the issue that came from Therak 25. And the difference being that when they created Therak 25, they completely got rid of the need for physical safety system. When I say physical safety systems, I am referring to anything not computer related as a safety guard. On the older Therac systems, they had physical switches that could be flipped if something were going wrong to shut down the whole machine. They also had beam blockers, which wouldn't allow radiation to come out unless everything was aligned perfectly. Position sensors were to detect if parts were where they should be physically, and hardwire shutdowns, which would automatically cut power if something unsafe happens. So with these physical safety systems in place, it meant that if the operator made a mistake or the machine was bugging out, then it wouldn't go. With creing the Therac 25, they completely removed these safety features, and that meant that if something was not right, the machine would still go because there was nothing there to stop it. Okay, now that we have gotten the technical terms out of the way and hopefully that made sense to everybody, let's talk about Therac 25 and what exactly went wrong. The system had a race condition or a timing bug, which meant that two things were happening at once and the system couldn't keep them in sync. Basically, the screen showed correct settings, x-ray mode, but the machine didn't fully move into the correct physical position. So the machine thought it was in safe X-ray mode, but it was actually still in electron beam mode. In X-ray mode, electrons are fired into a metal target, which creates high energy X-rays, and those X-rays go very deep and spread out safely. Electron beam mode uses electrons directly, so it uses a beam and doesn't go as deep into the body, which was used for skin cancer or tumors near the near the surface. When Therac 25 thought it was an X-ray mode, but it was actually an electron beam mode at full strength, a full strength concentrated electron beam was given to the patient instead of controlled X-ray beam. This is a lot. I saw a good analogy to explain the two. X-ray mode is like a shower and an electron beam is like a pressure washer. If they had the safety nets in place that the previous machines had, then this would have been this would not have been a problem because the machine would have detected no metal shield and it wouldn't fire. In 1976, the first prototype of Ferrac 25 was created, and then in 1982, it was put onto the market. There were six machines installed in Canada and five in the United States. For a while everything seemed fine, but the issue being the safety nets that once existed no longer did, and no one fully understood what that meant until the first real incident happened. So it's now June 3rd, 1985, at Kenstone Regional Oncology Center Marriott, Georgia? If I pronounce that right, a patient came in for what should have been a completely routine radiation treatment. At this point, she had already gone through multiple sessions, so going in nothing about this appointment felt unusual to her. 61-year-old Katie Yarbrough was supposed to receive a 10 MeV dose of electron therapy for her clavicle following her lepectomy. Lepectomy is it tumor removal? At the beginning, she had stated that she felt a tremendous force of heat, this red hot sensation. Before she was sent home, she told the technician that she burnt that she burned her, but was assured that wasn't the case and she was sent home anyways. Shortly after returning home, she had noticed reddening around the area that was treated, and then her shoulder became locked in place while also experiencing spasms. Within two weeks, the redness spread from her chest to her back, which had meant the radiation had gone through the body and indicated a radiation burn. These symptoms were deemed a normal treatment reaction, and no fingers were pointed towards the machine. I'm going to use another form of measurement here, which is rad RID, meaning the measure of absorbed radiation, which tells you how much damage the body is exposed to, not just how much radiation is present. After a little while, the hospital physicists did consult the AECL about this incident and figured out that she received a dose, a dose of 15,000 to 20,000 rad when she was only supposed to receive 200 rad. So she got 50 times what she was supposed to. Another thing to note here is that the dose of a thousand rad can be fatal. So that's a lot. She did end up suing the hospital and the AECL in 1985, but because the treatment printout function was not activated at the time of the treatment, there was no proof to show or say how much radiation she did receive, so an out-of-court settlement was reached. Due to the extremely high dose of radiation she was given, her breast had to be surgically removed, and arm and shoulder were immobilized, and she was in constant pain. This is just the first case. Just like the first case, in this next one, the machine was only in operation for six months before it fucked up. Now it's July 26, 1985, in Ontario, Canada. A 40-year-old patient was receiving her 24th treatment for cervical cancer of someone who has been through this a time or two and knows what to expect. When the machine operator hit the start button, an error displayed on the screen, H tilt, which paused the treatment and the dosimeter, showing that no radiation had been applied yet. So the operator pressed the proceed button, the machine stopped again, pressed the button again, and did this five times. Five times, guys. After she was finished, the operator did call a technician who found nothing wrong with the machine, and it was used on six other patients that day. The patient had complained of burning and swelling in the area and was hospitalized a few days later on July 30th when she was suspected of radiation overdose. No shit. The machine was taken out for a service and a technician suspected she received 13 to 17,000 RAD. And I'm going to reiterate that a thousand RAD can be fatal. Also, I'm not sure if you're supposed to pronounce RAD or rad. I don't know. You'll probably hear a mixture of both. Anyways, well, unfortunately, on November 3rd, 1985, she had passed away from cancer, but after the autopsy, it was revealed that she had not passed away. That if she had not passed away from the cancer, she would have had to get a hit replacement due to the damage caused by the radiation. The incident was reported to the FDA and the Canadian Radiation Protection Bureau. As well, there was testing done to the machine, and the ACL thought there was some thought there was something wrong with the micro switches inside that were supposed to tell the machine what position it was in. Basically, these switches were meant to confirm whether the machine was set up correctly before delivering radiation. When tests were done, they could not find clearly what had failed, so they ended up just making some changes to the machine without really knowing what exactly was wrong. They made it so that even if just one of those switches gave the wrong signal, the machine would still be able to catch it, and they modified the software to double check that the machine was actually in the correct position before starting. After these fixes, they said the machine was safer by five orders of magnitude, or in other terms, the machine was 100,000 times safer. Alright. Now we're gonna go into December of 1985. A woman had developed in um eryth erythema uh with a parallel band pattern after receiving treatment from Therac 25. Means it appears in striped lines. The staff at the hospital had sent a letter to the AECL about the incident in the following January, and they wrote back basically just saying it was impossible for the machine to give an overdose of radiation. So the hospital believed that the company who created the machine and continued. Sorry, so the hospital believed the company that created the machine said that there was nothing wrong, the machine couldn't possibly make a mistake. Um and they continued and they continued and then the same thing happened with other patients in the hospital. Um six months later, the initial patient that developed the initial patient had developed chronic ulcers under the skin due to tissue necrosis and required skin graphs. The patient survived, but was left with some lasting minor effects from the incident. We're now gonna go into March 21st, 1986, East Texas Cancer Center. The machine had been running for over two years and treated more than 500 patients when a patient came in for his ninth treatment for a tumor on his back. Another patient who has gone through the process before and knows what to expect, supposedly. They were supposed to get 22 MeV of electrons with a dose of 180 RAD with an accumulated radiation of 600 sorry 6,000 RAD over six weeks. The operator who had done this treatment time and time again entered all of the information into the machine. They accidentally entered an X for X-ray when they needed to enter an E for electron beam, but they just changed the letters and proceeded. When they hit the beam on key, the machine read an error, malfunction 54, which was a dose input 2 error, meaning the machine either delivered too high or too low of radiation. There was also a treatment pause message. The dosimeter showed six units were delivered when it was supposed to be 202 units, so the operator pressed continue and the machine again stopped with the same error. The patient had felt an electric shock and heard a crackle sound from the machine. And with this being his ninth session, they they knew something wasn't right. During this time, the surveillance cameras and intercoms in the room were down. Go figure. So the patient, knowing something wasn't right, went to get up at the same time the operator had hit the proceed button and felt a shock go through their arm, feeling like it had been ripped off. They got to the door and started begging on it to be let out of the room. They had called a technician right away and noticed lots of redness appearing around the shocked area on the patient, but they chalked it up to being just a simple shock. The patient was sent home and the physicist checked out the machine, but it was set to the correct specifications, so they continued using it to treat patients. What they didn't know was the patient had received between 16,500 and 25,000 RADs in less than a second over an area of one centimeter squared. The crackling sound the patient had heard was the sound of the machine sensors being overwhelmed, which made it incorrectly show the radiation dose given was very low. Over the next couple of weeks, the patient experienced paralysis of their left arm, nausea, and ended up being hospitalized with uh myelitis of the spinal cord, which is inflammation to the spinal cord. His legs, mid-dragram, and vocal cords became paralyzed, and he ended up dying five months after the incident. The machine was checked by the AECL, but again, they could not find a problem with the machine, and it was back to treating patients by April of 1986. This is now we're going on to accident number five. April eleventh, nineteen eighty-six. Also at East Texas Cancer Center, a patient came in for electron treatment for cancer on their face. They were supposed to receive 10 MeV for an area of 7 by 10 centimeters. The same operator as the previous incident was going to be performing this treatment as well. After filling in the information, they realized that they had to change the type of treatment. They changed the X for X-ray to E for electron. Seems a little familiar. They changed this information and hit the switch to proceed with the treatment. I want to note that it is stated the machine read beam ready before they proceeded, same as it did before the first time. When the machine fired, there was a loud crackling sound, which the operator heard. An error appeared on the screen, era 54. And when the operator entered the room, the patient complained of a burning sensation in the face. Less than three weeks after the incident in May, the patient passed away, and during the autopsy, it was found they had severe radiation damage to the right temporal lobe and brainstem. The hospital physicist again checked out the machine and notified the AECL of the issue. After looking into the problem, they were finally able to reproduce the Air 54 by changing the speed at which they had entered the information. By rapidly editing the treatment data, they could trigger the failure on demand. What the manufacturer had dismissed as a random glitch turned out to be a deadly timing bug. One that only showed itself when a human input outpaced the machine's ability to respond. The last incident I'm going to talk about was on January 17, 1987, at Yakima Valley Memorial Hospital. A patient was set to receive two small treatments of four and three RAD plus a 79 RAD full treatment for total exposure of 86 RAD. The treatment started normally. A small dose of radiation was delivered through a smaller opening. Then the machine was adjusted, the opening was widened, and another dose of radiation was given. At that point, everything seemed like it was going like it was going the way it was supposed to. The operator went into the room to reposition the machine the machine and adjust to reposition the patient and adjust the machine. But when they left, they accidentally forgot to remove the film plates that had been placed under the patient. Back in the control room, the machine showed beam ready. So they started the treatment again. About five seconds later, the machine suddenly stopped and displayed the same error message as the others, but it went away. Since the machine was paused, the operator pressed the proceed button. The machine stopped again, this time showing a different message, flatness. Then the operator heard the patient over the intercom but couldn't understand them, so they entered the room, and the patient told them that they had felt an intense burning sensation on their chest. But when the operator checked the screen, it showed that the patient had only received seven RAD, which was a normal dose and not enough to burn them. Only a few hours later, the patient started to get the appearance of burns on their skin, and in the next couple of days they got a strange striped pattern. We've heard something like this before. Again, they tried to look into this but could not find a problem. After the incident, the hospital physicist tried to figure out what had actually happened. He ran a series of tests using film plates, recreating the same setup as the treatment, including the machine being in the wrong position. What they found was that the pattern on the test film matched the film that had accidentally been left under the patient during the procedure. They realized that the patient hadn't received a small controlled dose of radiation. He had been exposed to somewhere between 8,000 and 10,000 RED when he when he was prescribed a dose of only 86. Over a hundred times more than intended. This time the patient didn't have complications, didn't just have complications, they died in April 1987 from the radiation overdose. Their family filed a lawsuit, which was eventually settled out of court. Up until this point, the story feels like a technical failure, a machine malfunctioned, a software bug, but this next part is where it becomes something else entirely because one of the most disturbing aspects of the Therac 25 incident isn't just what the machine did, it's how people responded to it. Patients were telling staff that something felt wrong. Not just uncomfortable, but painful. Some described it as an intense burning sensation, something that didn't match what they had been told to expect or what had gone through before, and yet they weren't believed, not right away at least. Because in a s in a subtle setting like this, the machine is supposed to be precise, reliable, safer than human judgment. So when the screen showed a normal dose and the system didn't report a major failure, the assumption wasn't that the machine was wrong. It was that the patient was wrong. And that creates a kind of psychological conflict. One in hand, you have a patient in pain. Sorry, on one hand, you have a patient in pain saying something is seriously wrong. On the other, you have a machine backed by science, engineering, and authorities saying everything is fine. And in that moment, people tend to trust the machine. There's also the pressure of working in a medical environment, admitting something is wrong, especially something you don't fully understand, can feel risky. It can mean questioning the system, your training, or even your own decisions. So instead that there's hesitation, doubt, maybe even a hope that there's just a one-off issue. But those small amounts of doubt, those delays in believing the patient, they matter. Because while everyone was trying to make sense of what they were seeing, the machine continued to be used. And the same thing just kept happening. And here's the part that makes it even worse. Because the machine wasn't just randomly blasting radiation, there was actually supposed to be a built-in safety step before the real treatment even started. Before giving the full dose, operators would run something called verification exposures. These were small, low dose bursts of radiation, basically like a test run, just to make sure everything was lined up properly and hitting the right spot. So nothing crazy. Just a quick check to confirm the machine was doing what it was supposed to do. In this case, the patient was supposed to get two of those checks, one at 4 AD and one at 3AD. Very small dose, not meant to treat anything, just confirming position. And then after that, the machine would move on to the actual treatment, what's called photon therapy. That's the real thing. There's a high energy radiation used to target tumors. In this situation, it was supposed to be 79 RED, so altogether everything would add up to 86 RED. Control it planned and completely normal for this type of treatment. But here's the where things start to break down. The machine had to switch between two modes to make this happen. The low power mode for those verification exposures and a high power mode for the actual treatment. And just like everything else with the Therac 25, that switch depended entirely on the software working perfectly. No backup, no physical safety system, nothing else checking behind it. So on the surface, everything looked fine. The screen showed normal values, no major errors, nothing that would make anyone want to stop and question what was happening. But underneath, the system wasn't always doing what it said it was doing. And in certain situations, especially when things were entered too quickly, the machine could end up in this weird in-between state where it thought it was delivering a small safe verification dose when in reality it was doing something completely different. So at this point, we already talked about how the physicist was eventually able to figure out how to trigger the error, specifically by entering or editing the data really quickly. And that right there ended up being one of the most important turning points in this entire story. Because before that everything was being treated like isolated incidents, random, unexplainable, something that couldn't be pinned down. But now it wasn't random anymore. They could reproduce it over and over again. And once you can recreate a problem like that, it stops being a mystery and starts becoming evidence. So after this that sixth case, the machine was finally taken seriously as a problem. Not just a possibility, but an actual risk. The Theric 25 was shut down, and the AECL started looking deeper into what was actually happening. This time focusing on the software, not just the hardware. And what they found was exactly what we talked about earlier: a race condition. Two things happening at once, and the system not being able to keep them in sync. So when an operator was moving quickly, correcting inputs and flipping between settings, the machine could basically get confused. It would split display one thing on the screen, but physically in a completely different state. But physically be in a completely different state. Meaning it could think it was delivering a safe, controlled treatment while actually firing a full strength beam. And the worst part is that there were no physical safety systems left to catch it. Nothing to stop the machine, nothing to double check it, just the software and the assumption that it was correct. After this, uh the machines were pulled out of service and investigations started happening, not just into what went wrong, but how something like this was ever allowed to happen in the first place. Because at this point, it's not just a bug in the system anymore. It's about trust, design decisions, and what happens when we real on technology technology without building um in a way for it to fail safely. So what was a crash lesson here? A machine designed to save lives was trusted more than the people it was hurting. The crash lesson here is that systems, no matter how advanced, can fail. And when they do, the danger isn't just the failure itself. It's how long it takes us to believe it. Because in this case, the machine didn't say anything was wrong, the people did, and no one listened. Well, that's it for today's episode of Crash Lessons Podcast. Uh, hope you guys liked it. Thanks for listening, and I will see you next week. Goodbye.