An Investigation of the Therac-25 Accidents

Source note: This account is drawn from Nancy Leveson and Clark Turner, “An Investigation of the Therac-25 Accidents,” IEEE Computer, 26(7):18-41, July 1993 — as reproduced in the appendix “Medical Devices: The Therac-25” of Nancy Leveson’s book Safeware: System Safety and Computers (Addison-Wesley, 1995), the version hosted at the cited URL. The text below is a faithful condensation of that material, retaining direct quotations from the original documents (FDA memoranda, AECL correspondence, court depositions, user-group notes) wherever practical.

Introduction

Between June 1985 and January 1987, a computer-controlled radiation therapy machine called the Therac-25 massively overdosed six people. These accidents have been described as the worst in the 35-year history of medical accelerators. Because the accident was never officially investigated by a single body, the account is drawn from lawsuits and depositions, government records, and correspondence obtained from the U.S. Food and Drug Administration (FDA), which regulates such devices.

Background

Medical linear accelerators (“linacs”) accelerate electrons to create high-energy beams that destroy tumors with minimal impact on surrounding healthy tissue. Shallow tissue is treated directly with the electron beam; to reach deeper tissue, the electron beam is converted into X-ray photons.

In the early 1970s, Atomic Energy of Canada Limited (AECL) and a French company, CGR, jointly built linear accelerators: the Therac-6 (a 6 MeV, X-ray-only unit) and the Therac-20 (a 20 MeV, dual-mode unit), both computerized versions of older CGR machines and both retaining full, independent hardware safety interlocks alongside computer control — the computer merely added convenience.

When the AECL-CGR partnership lapsed in 1981, AECL used a new “double-pass” electron-acceleration design to build the Therac-25, a more compact, dual-mode (X-ray/electron) machine delivering photons at 25 MeV or electrons at various energies. Critically, the Therac-25 was designed from the outset to depend on the computer for safety, rather than retaining the Therac-20’s independent hardware protective circuits and mechanical interlocks. Software checks were substituted for many traditional hardware interlocks. Some Therac-25 code was reused or adapted from the Therac-6 and Therac-20 software; the AECL quality assurance manager was reportedly unaware that some Therac-20 routines were also present in the Therac-25 until a shared bug was later discovered in both.

Turntable and dual-mode hazard. An upper turntable rotates accessory equipment (target, flattening filter, ion chamber, scanning magnets) into the beam path for one of three positions: electron-therapy mode, X-ray (photon) mode, or a “field light” position used for patient alignment (in which no beam should be present). X-ray mode requires roughly 100 times the electron-beam current used in electron mode, because the beam must pass through an attenuating beam flattener to produce a uniform treatment field. If the machine produces a photon-mode beam with the flattener not in position, a very high, unattenuated dose reaches the patient directly — the basic hazard of any dual-mode machine. Historically, hardware interlocks confirmed correct turntable position; on the Therac-25, this was primarily a software responsibility.

Operator interface. Operators entered patient and treatment data (mode, energy, dose, dose rate, time, field size, gantry rotation, accessories) at a DEC VT100 terminal; the system compared these to values set on the physical machine and displayed “VERIFIED” if they matched. Because operators complained that data entry was slow, AECL modified the software so a quick series of carriage returns could copy prior values without re-typing them — a modification that figures in several of the accidents. Error handling had two levels: a “treatment pause” (minor; resumed with a single keystroke, the P/”proceed” key, up to five times before requiring a full reset) and a “treatment suspend” (serious; required a complete restart). Error messages were cryptic — merely “MALFUNCTION” followed by a number from 1 to 64 — and neither the operator’s manual nor the maintenance manual explained what most codes meant or that they could indicate patient risk. An operator involved in one accident testified she had become “insensitive” to malfunction messages, since dozens of low-consequence malfunctions occurred routinely and she had been taught there were “so many safety mechanisms” that overdosing a patient was “virtually impossible.”

Hazard analysis. A March 1983 AECL fault-tree safety analysis excluded software from consideration, assuming that “programming errors have been reduced by extensive testing” and that residual software errors need not be included. Probabilities such as 10⁻¹¹ for “computer selects wrong energy” were asserted without justification.

The Accidents

Eleven Therac-25 units were installed — five in the U.S., six in Canada. Six known accidents occurred between June 1985 and January 1987, when the machine was finally recalled for extensive redesign, including the addition of hardware safeguards against software errors. Related bugs were later found in Therac-20 software, but no injuries resulted there because the Therac-20 retained independent hardware interlocks.

Kennestone Regional Oncology Center, Marietta, Georgia — June 1985

A 61-year-old woman receiving follow-up electron treatment (10 MeV) to the clavicle area following a lumpectomy felt “a tremendous force of heat… this red-hot sensation” during treatment on June 3, 1985, and said, “You burned me.” The technician insisted this was impossible. She subsequently developed reddening and swelling at the treatment site, her shoulder “froze,” and a matching reddening later appeared on her back “as though a burn had gone right through her body,” with skin sloughing off in layers. A Kennestone physicist later estimated a dose of 15,000-20,000 rads against a prescribed dose in the low hundreds (typical single therapeutic doses run around 200 rads; 500 whole-body rads is the accepted LD-50 figure). Her breast eventually had to be removed because of the radiation burns, and her shoulder and arm were paralyzed. The incident was never formally investigated at the time; it only came to AECL’s attention via a lawsuit filed in late 1985, and it was not reported to the FDA until after later accidents in 1986 (reporting regulations at the time obligated manufacturers, not hospitals, to report). The suit was settled out of court.

Ontario Cancer Foundation, Hamilton, Ontario — July 1985

On July 26, 1985, a 40-year-old cervical cancer patient’s treatment triggered an HTILT error and a “treatment pause” reading NO DOSE. Believing no dose had been delivered, the operator repeated the “proceed” sequence five times, then the machine went into treatment suspend. The patient later complained of an “electric tingling shock” and returned days later with burning, hip pain, and swelling; she was hospitalized and the machine taken out of service. She died on November 3, 1985 of a virulent cancer; autopsy attributed death to the cancer, but noted that had she survived, a total hip replacement would have been required due to radiation overexposure — an AECL technician later estimated a dose of 13,000-17,000 rads. AECL could not reproduce the exact malfunction but suspected a transient turntable microswitch failure, redesigning the position-encoding logic to tolerate a single-bit switch error. The FDA classified this a Class II recall (temporary or medically reversible consequences, or remote probability of serious harm). AECL’s own report conceded it “cannot be firm on the exact cause of the accident but can only suspect.” The similarity of this accident’s presentation to the later second Yakima accident suggests the Hamilton overdose, too, was probably a software race condition rather than a hardware microswitch fault.

Yakima Valley Memorial Hospital, Washington — December 1985 (first incident)

A woman treated in December 1985 developed erythema in a striped pattern on her hip; the cause was not recognized as abnormal until January 1986, and various causes (a heating pad, blocking-tray slots, chemotherapy) were investigated and ruled out. AECL assured the hospital by letter that the “damage could not have been produced by any malfunction of the Therac-25 or by any operator error,” citing its own analysis that recent modifications had improved the hazard rate by “at least five orders of magnitude.” The case was closed as “cause unknown” until a second Yakima accident more than a year later prompted reinvestigation; the patient was found to have a chronic skin ulcer and tissue necrosis under the skin, requiring surgical repair and skin grafts. She survived with minor disability and scarring.

East Texas Cancer Center, Tyler, Texas — March 1986

On March 21, 1986, a man receiving his ninth of a series of 22 MeV electron treatments (following removal of a back tumor) was in position when the operator, an experienced typist, quickly entered prescription data, noticed she had typed “x” (X-ray) instead of “e” (electron) mode, used the cursor-up key to correct it, and completed the edit — all within about eight seconds. She pressed “B” for beam on. The machine displayed MALFUNCTION 54 (undocumented in the site’s manuals; an AECL technician later testified it signified a delivered dose “either too high or too low,” a message intended only for internal AECL development use) along with a substantial underdose reading — 6 monitor units delivered versus 202 requested. Accustomed to frequent, harmless malfunctions, she pressed “P” to proceed. The machine again halted with the identical error and underdose reading. The patient, isolated in a shielded room whose video monitor was unplugged and audio monitor broken, reported feeling “an electric shock” and hearing a buzzing sound, and got up to seek help just as the operator hit “P” again. In fact the patient had received a massive overdose concentrated in a roughly 1 cm area — post-accident simulations estimated 16,500 to 25,000 rads delivered in under one second. He subsequently lost function of his left arm, suffered radiation-induced myelitis of the cervical spinal cord causing paralysis of his left arm and both legs, left vocal cord paralysis, neurogenic bowel and bladder, and paralysis of the left diaphragm, plus a lung lesion and recurrent herpes infections. He died five months later from complications of the overdose. AECL engineers initially could not reproduce Malfunction 54 and told the hospital physicist, Fritz Hager, that overdose was impossible; an outside engineering firm ruled out an “electric shock” theory. Hager was put back into service.

East Texas Cancer Center — April 1986 (second Tyler incident)

Three weeks later, on April 11, 1986, the same technician prepared another patient (a skin-cancer case) for a 10 MeV electron treatment, again corrected an “x”-to-”e” mode-entry mistake via the cursor-up key, saw BEAM READY, and turned the beam on. The machine again shut down loudly with MALFUNCTION 54. The patient, hearing “fire” on the side of his face, described a flash of light and a sizzling sound “like frying eggs.” He died of the overdose on May 1, 1986, three weeks later, with disorientation progressing to coma, fever to 104°F, and neurological damage; autopsy showed acute high-dose radiation injury to the right temporal lobe and brain stem. This time the ETCC physicist, with the operator’s careful cooperation, discovered that entering the editing sequence rapidly (as an experienced operator naturally would) was the key trigger, and after practice was able to reproduce the error at will. AECL, informed of the exact reproduction steps, was then able to reproduce the fault too, and measured a dosage of about 25,000 rads at the center of the field; an AECL engineer explained the “frying” sound as the ion chambers being saturated. A “cursor up” editing problem had, in fact, already been reported in the Therac-25’s service mode at other clinics as early as February or March 1985, and AECL had believed it fixed both then and again in summer 1985.

Related Therac-20 finding. After hearing about the second Tyler accident, a physicist at the University of Chicago Joint Center for Radiation Therapy investigated whether the same fault existed in the center’s Therac-20, used to train students who made frequent, “creative” data-entry errors, and whose fuses and breakers had for some time been mysteriously tripping about three times a week. He confirmed the identical underlying computer bug was present in the Therac-20 as well — but on that machine it was merely a nuisance, because independent hardware protective circuits monitoring the electron-beam scanning prevented the beam from ever turning on unsafely. The Therac-20 relied on mechanical/hardware interlocks; the Therac-25 relied “largely on software.”

Yakima Valley Memorial Hospital — January 1987 (second incident)

On January 17, 1987, a patient scheduled for two film-verification exposures (4 and 3 rads) plus a 79-rad photon treatment (86 rads total) was set up; after the two film exposures the operator entered the treatment room, used a hand control to rotate the turntable to the field-light position to check alignment, then attempted to return the turntable to the treatment position (some confusion existed over whether he pressed the “set” button on the hand control or typed “set” at the console) — and, separately, forgot to remove the verification film from beneath the patient. The console displayed “beam ready,” and he pressed “B.” The beam came on but the console showed no dose or dose rate; after five or six seconds the unit paused, displaying a message that may have flashed by too quickly to read; since it was only a pause, he pressed “P” to proceed. It paused again showing FLATNESS. The patient reported over the intercom “feeling a burning sensation” in his chest, and the console showed only the total dose of the two film exposures (7 rads) — nothing more. A skin burn later developed over the entire treatment area in a striped pattern matching the blocking tray’s slots — visually similar to the 1985 Yakima “cause unknown” burn. AECL’s investigation, after a week of hardware checks turned up nothing, found a software flaw entirely distinct from the Tyler bug (described below); preliminary dose estimates were 4,000-5,000 rads for the first beam-on and possibly 8,000-10,000 rads total against the prescribed 86. The patient died in April from complications related to the overdose; a lawsuit alleging that the overdose hastened his death and caused unnecessary suffering (he had terminal cancer independently) was settled out of court, like all the others.

The Software Root Causes

A recurring point the paper stresses is that focusing on the specific bugs is not the way to make such a system safe — “there will always be another software bug” — but the two identified defects are instructive as illustrations of the underlying design failure: a system architecture that used unsynchronized shared variables across concurrent tasks with no true mutual exclusion.

Software architecture. The Therac-25 ran a custom real-time executive (no standard OS) on a 32K PDP-11/23, with a preemptive scheduler allocating cycles between critical tasks (Treat — the treatment monitor, driven by an eight-phase state variable “Tphase”; Servo; Housekeeper) and non-critical tasks (checksum processor, keyboard processor, screen processor, calibration processor, etc.), communicating via shared variables with no indivisible test-and-set — i.e., classic race-condition territory.

The Tyler (“data-entry”) bug. The Treat task’s Datent (data entry) subroutine communicates with a concurrently running keyboard-handler task via a shared “Data Entry Complete” flag and a 2-byte “Mode/Energy Offset” (MEOS) variable that encodes the selected mode/energy for use by other tasks (including one, “Hand,” that physically repositions the turntable/collimator). Setting the bending magnets to match a given mode/energy takes about eight seconds and is handled via a subroutine called Magnet, which repeatedly calls a delay routine, Ptime. Ptime checks for pending edits, but — due to a flag-clearing bug — only recognizes edits made during its first pass through, not on subsequent passes. If an operator (as the Tyler operator habitually did) edited the mode from X-ray to electron via the cursor-up key and returned to the command line quickly enough — within that roughly eight-second magnet-setting window, after Ptime’s first pass — the edit would go unrecognized by the magnet-setting logic even though it was correctly reflected on-screen and in the MEOS variable. The result: the high-current X-ray-mode electron beam parameters remained in effect on the accelerator hardware while the software believed (and displayed) electron mode, and the beam fired through an ion chamber and hardware not configured to spread and attenuate it — producing a lethal, highly concentrated, unscanned high-energy beam. The fix (part of the post-accident CAP) moved the “clear” of the pending-edit flag from the end of Ptime to the end of Magnet (after all magnets were set), and also added a second shared “cursor is off command line” variable so Datent could reliably tell whether prescription entry was genuinely complete.

The Yakima (“Set Up Test” / Class3 counter overflow) bug. This is distinct and involves the interaction between Treat’s “Set Up Test” subroutine and the concurrent Housekeeper task. During machine setup, Set Up Test is executed repeatedly (potentially hundreds of times) while it waits for other setup events to complete, and on every pass it increments a shared one-byte counter variable, “Class3,” used to signal the Housekeeper task’s Lmtchk routine to run a “Chkcol” (check collimator/upper-turntable-position) consistency check. Because Class3 is only one byte wide, it can hold a maximum value of 255 decimal — so on every 256th pass through Set Up Test, it silently overflows back to zero. Whenever Class3 reads zero, Lmtchk skips Chkcol entirely, meaning the upper-collimator/turntable position consistency check is not performed and any resulting fault is not flagged in the shared “F$mal” status variable that Set Up Test checks before allowing the treatment to proceed. If an operator happened to press the “set” button at the precise moment Class3 rolled over to zero — turntable still in the field-light position, with no target or beam flattener in the beam path and no scanning — Set Up Test would see F$mal as clear and permit the full, unattenuated 25 MeV beam to fire directly, unattenuated and unscanned, producing a massive, narrowly concentrated dose scattered and deflected only by a stainless-steel alignment mirror. AECL’s fix: instead of incrementing Class3 on each pass (allowing overflow), the variable was simply set to a fixed nonzero value every time through Set Up Test.

Corrective Action and Regulatory Response

Following the second Tyler accident, AECL’s April 1986 interim fix consisted only of instructing users to physically disable the cursor “UP” key with tape, forcing full prescription re-entry on any correction — a response the FDA’s Director of Compliance criticized as failing to describe the actual defect or hazard, with “tone… not commensurate with the urgency,” and demanded immediate renotification. The FDA declared the Therac-25 defective under the Radiation Control for Health and Safety Act and required a Corrective Action Plan (CAP), which went through five revisions between June 1986 and July 21, 1987. The final CAP included: routing all dosimetry-related faults to a treatment suspend rather than a resumable pause; a software single-pulse shutdown; an independent hardware single-pulse shutdown; a turntable potentiometer providing an independent, visible position signal; interlocking with the bending magnet to confirm target/flattener position in X-ray mode; disabling beam-on when the turntable is in field-light or any intermediate position; replacement of cryptic malfunction codes with meaningful, highlighted messages; restriction of editing to only cursor-up, backspace, and return keys; a motion-enable footswitch (deadman switch); and roughly twenty-three further software reliability and interlock changes. An FDA safety-analysis review later criticized AECL’s late-stage software test data as internally contradictory, and an internal FDA memo from February 1987 stated flatly: “It is impossible for CDRH to find all potential failure modes and conditions of the software… We cannot say that we are reasonably confident about the safety of the entire system to prevent or minimize exposure from other fault conditions.” The FDA ultimately classified the recall as Class I (reasonable probability of serious health consequences or death). No further Therac-25 accidents were reported after the final CAP was implemented.

Causal Factors and Lessons

The paper identifies several recurring, general lessons, echoed in later software-safety literature:

• Overconfidence in software. Nonsoftware engineers tend to assume software “cannot fail,” leading to complacency and overreliance on computer functions; the Therac-25’s original hazard analysis excluded software from its fault tree entirely, even though nearly full responsibility for safety rested on it.
• Confusing reliability with safety. The software ran correctly tens of thousands of times before ever overdosing anyone; AECL equated this reliability with safety, which is a distinct property.
• Lack of defensive design. The software contained no self-checks, audit trails, or other error-detection/handling features that might have caught the inconsistencies. Ion chambers, when saturated by an unscanned high-current beam, registered a low dose reading rather than flagging the anomaly — the system “lied” to its operators, and had no way to detect that a massive overdose had actually occurred.
• Failure to eliminate root causes. Fixing each individual bug as discovered did not solve the underlying safety problem, since the deeper cause — an architecture in which software was a single point of failure with no hardware backstop — remained. The Therac-20 had the identical software defect implicated in the Tyler deaths, but suffered no injuries because it retained independent hardware interlocks. The Hamilton accident was repeatedly assumed (without adequate evidence) to be a microswitch hardware fault, foreclosing a fuller investigation that might have found the software race condition years earlier.
• Complacency across the industry. A medical physicist quoted in the paper observed that the accelerator “industry” had grown complacent about safety, having been “spoiled” by a long, largely accident-free record.
• Unrealistic risk assessments. Probabilistic risk assessments — including AECL’s claim of a “five orders of magnitude” safety improvement after the Hamilton microswitch fix — generated false confidence; such analyses typically assume independence between components and struggle to quantify software’s contribution to risk, undercounting it relative to hardware failure modes that are easier to model.
• Inadequate investigation and followup. Companies building safety-critical systems need audit trails and rigorous incident-analysis procedures triggered by any hint of a problem; the first phone call from the Kennestone physicist, and certainly the first lawsuit, should have triggered a full investigation rather than reassurance letters.
• Inadequate software engineering practices. The paper lists specific violated principles: specifications and documentation should not be an afterthought; rigorous QA standards should be established; designs should be kept simple and dangerous coding practices avoided; error-detection/audit-trail mechanisms should be designed in from the start; software should undergo unit- and module-level testing and formal analysis, not merely system-level testing, with regression testing on all changes; and operator-facing displays, error messages, and manuals need careful design. AECL’s own claim that software was “tested and exercised… for 2,700 hours” turned out, under questioning, to mean only 2,700 hours of accumulated use in the field, not structured test coverage.
• Software reuse is not a safety guarantee. Reusing Therac-6/Therac-20 modules in the Therac-25 was assumed to confer safety through prior “exercise,” but safety is a property of the system as a whole, not of a software module in isolation — reused code can behave unsafely in a new context. Rewriting for a clean, simple design may sometimes be the safer choice.
• Safety versus friendly interfaces. Design choices intended purely to speed up data entry — such as allowing carriage-return “copy-through” of prior values, or fast, low-friction editing via a single cursor-up keystroke — directly enabled the race conditions that caused injury; ease of use and safety can conflict.
• User and government oversight. Once engaged, the FDA’s response was described as “impressive” given its limited prior experience with computer-controlled medical devices; the Therac-25 experience directly motivated later improvements to incident-reporting regulations (amended in 1990 to require health-care facilities, not just manufacturers, to report incidents) and to FDA review procedures for software-controlled devices. Pressure and technical input from the Therac-25 users’ group — which held its own meetings, shared information AECL had been slow to disseminate, and pushed a prioritized list of required fixes — was instrumental in getting the machine corrected.

References (as cited in the source document)

1. C.A. Bowsher. Medical device recalls: Examination of selected cases. GAO Report GAO/PEMD-90-6, U.S. Government Accounting Office, October 1990.
2. C.A. Bowsher. Medical devices: The public health at risk. GAO Report GAO/T-PEMD-90-2, U.S. Government Accounting Office, 1990.
3. M. Kivel, editor. Radiological Health Bulletin, volume XX:8. Center for Devices and Radiological Health, FDA, Rockville, Maryland, December 1986.
4. Nancy G. Leveson and Clark S. Turner. An investigation of the Therac-25 accidents. IEEE Computer, 26(7):18-41, July 1993.
5. Ed Miller. The Therac-25 experience. In Conference of State Radiation Control Program Directors, 1987.
6. J.A. Rawlinson. Report on the Therac-25. In OCTRF/OCI Physicists Meeting, Kingston, Ontario, May 1987.
7. R. Saltos. Man killed by accident with medical radiation. Boston Globe, June 20 1986.