An Investigation of the Therac-25 Accidents
📜 Abstract
Computers are increasingly being introduced into safety-critical systems and, as a consequence, have been involved in accidents. Some of the most widely cited software-related accidents in safety-critical systems involved a computerized radiation therapy machine called the Therac-25. Between June 1985 and January 1987, six known accidents involved massive overdoses by the Therac-25—with resultant deaths and serious injuries. They have been described as the worst series of radiation accidents in the 35-year history of medical accelerators. With information for this article taken from publicly available documents, we present a detailed accident investigation of the factors involved in the overdoses and the attempts by the users, manufacturers, and the US and Canadian governments to deal with them.
✨ Summary
The paper presents a documented investigation of six Therac-25 radiation overdoses occurring between June 1985 and January 1987. It shows that the accidents were not attributable to a single programming defect or operator action. They resulted from interacting technical, human, organizational, and regulatory factors, including race conditions in concurrent software, inadequate handling of shared state, insufficient testing and documentation, unrealistic safety analyses, overconfidence in software, removal of hardware interlocks, and inadequate responses to incident reports.
The principal engineering conclusion is that safety-critical systems must be analyzed as complete systems rather than as isolated software components. Software should not become the sole barrier against hazardous behavior when independent hardware safeguards are practical. The paper also emphasizes explicit safety requirements, systematic testing, configuration and change control, independent verification, thorough failure analysis, trained software engineers, and effective regulatory and organizational oversight.
The paper has had identifiable influence in subsequent research and education. A later testing study used the Therac-25 as a case study for usage-model-based acceptance testing and reported that its method could generate the error-producing event sequence. (sciencedirect.com) The case has also been incorporated into software-safety guidance and transportation-software materials, including NASA software-engineering references and Federal Highway Administration software-safety material. (escholarship.org) University courses in operating systems, computer-system engineering, and software engineering continue to use the paper to teach concurrency, race conditions, hardware–software interfaces, and safety-critical development. (read.seas.harvard.edu)