THE THERAC-25 ACCIDENTS

Transcription

1 THE THERAC-25 ACCIDENTS Therac-25: computer-controlled radiation therapy, using linear accelerator, X-ray photons Made by Atomic Energy of Canada, Ltd. (AECL) June 85 - Jan. 87: Six accidents resulting in death and serious injury (worst in 35-year history) Previous Theracs used hardware safety mechanisms and interlocks, long safety records Therac-25: software responsible for safety, didn t duplicate the hardware mechanisms But, when AECL did safety analysis, excluded the software! (It had been tested a bit on a simulator) Installed eleven units Ð six major accidents Marietta, GA, June, 1985:

2 Breast cancer patient received 100 times overdose Result: Severe damage to chest, shoulder, back But damage internal, no external signs at first Returned with pain, swelling, redness, blamed treatment AECL said it was impossible to get wrong dose Oncologists thought it was disease symptoms, ordered more Therac treatments! AECL and machine operators refused to believe it could be caused by Therac Patient had to have dead tissue removed, lost all use of arm, shoulder, was in constant pain Sued and settled out of court

3 Turntable, with three positions for accessories (position monitored by microswitches) In each mode, ion chamber to monitor dosage delivered Light-only mode for aiming Electron mode Variable power controlled by computer Photon mode (X-ray) Beam runs at full power "Beam flattener" (metal plate in front of beam) attenuates output Hazard: If computer thinks it s doing X-ray treatment, but table in wrong position and beam flattener not in place

4 Ontario Cancer Foundation, Hamilton, July, 1985 Cervical cancer treatment Machine shut down with "H-tilt" error message, monitor said "no dose", "treatment pause" Operator pressed P (for Proceed); did this 4 more times Called service technician: found nothing wrong Patient complained of burning Machine taken out of service, Therac owners told to visually confirm turntable position Patient died in a month AECL: probably bad microswitch (plus signal encoding from switches had no error detection) Fixed this part of the design and declared that safety was improved 5 orders of magnitude!

5 Later evidence: problem was almost surely a software error Canadian Radiation Protection Bureau (CRPB) requested interlock on monitor positioning and turntable position indicator (potentiometer) AECL did not comply

6 Yakima Valley Memorial Hospital, Dec Another overdose, skin damage visible AECL sent two pages of technical reasons why overdose was impossible Hospital concluded with "unknown" cause A year later, second overdose then suspected the first case was overdose, too

7 East Texas Cancer Center, March 1986 No problems in treating 500 patients in 2 years Treatment of back tumor Operator sits in separate control room with video and audio monitoring, but this time audio was broken, video unplugged Radiation technician got patient on table and aimed beam in "light-only" mode Radiation technician used VT100 terminal to communicate with PDP-11 computer Typed "x" for mode, moved on to next entry in "form" on screen Realized error, should have entered "e" for electron beam treatment (no problem since treatment hadn t begun)

8 Used up-arrow to return to mode field and edited it to be an "e" Pressed "return" to get to bottom of screen, to wait for "beam ready" message Because she had done this many times, she was fast and did it all in less than 8 secs. That sequence and timing caused the software to go into a non-determinate state: It left the beam power on high, but removed the attenuator plate When she saw the "beam ready" message, she typed "b" and it fired. Shut down with "Malfunction 54"; only explanation in manual: "dose input 2" error Patient was supposed to get 180 rads; actually got 25,000 rads Felt thump on back, then "hot coffee" poured over him

9 Dosage monitor showed very low (it was saturated and gave "random" reading) Operator pressed P, for proceed; fired again With no video or audio to communicate, patient trying to get off table to go for help; got second shot in neck Fired again and got him in neck and shoulder

10 Got off table, made it to control room, stopped further firing Physicians decided he had gotten electric shock from the machine, continued using machine on other patients Patient got nausea; vomiting lost function of arm; got paralysis of arm, legs, bowel, bladder, diaphragm; and died AECL: Explained how it s not possible to give overdose and they knew of no overdose cases Hospital had machine checked thoroughly and put back in service

11 Face cancer treatment, three weeks later Shut down with "Malfunction 54" Rushed in to badly burned patient; also got 25,000 rads Went into coma and died Went back over every action by technician, eventually pieced it together Software fixed and the fix distributed Yakima Valley Memorial Hospital, Jan Still, another patient burned, died in April, suit settled out of court A different software error

12 The software? Written in assembly language with no documentation, no specifications, no test plan The programmers? All done by one person, who left in 1986 and never could be found No one knew even what kind of training he had Lessons learned: The software was inexcusably bad But despite software bugs, need to look at whole system for safety This design relied entirely on the software for safety Need systems engineering for proper overall design and development, anyway software engineering is not the whole show