Biotech 4 November 2026 4 MIN READ
Therac-25: When Software Was the Only Safety Net
Six overdoses between 1985 and 1987 from a radiation machine whose safety rested on software. What the Leveson and Turner investigation found.
THE SHORT ANSWER
Between June 1985 and January 1987, six known accidents gave patients massive radiation overdoses from the Therac-25. Earlier models had hardware interlocks; this one relied on software, which hid flaws such as a race condition in data entry. The machine was recalled in 1987 for design changes.
On this page
A machine that had lost its safety net
The Therac-25 was a medical linear accelerator made by Atomic Energy of Canada Limited (AECL). It could treat tumours with an electron beam or, by converting that beam, with X-rays. Its predecessors, the Therac-6 and Therac-20, used a computer only for convenience: the underlying machines kept their industry-standard hardware safety interlocks. In the Therac-25 the computer took over control, and much of the safety rested on software.
The Leveson and Turner investigation, published in IEEE Computer in 1993, counts eleven Therac-25s installed, five in the US and six in Canada. Between June 1985 and January 1987 there were six known accidents with massive overdoses, which the authors describe as the worst series of radiation accidents in the 35-year history of medical accelerators. The machine was recalled in 1987 for extensive design changes, including hardware safeguards against software errors.
A safety analysis that left software out
AECL did a safety analysis in March 1983, in the form of a fault tree. According to the paper, it apparently excluded the software. Among its assumptions were that programming errors had been reduced by extensive testing and that software does not degrade with wear. The paper adds that the Therac-20 had similar software problems that went unnoticed, because its hardware interlocks stopped them from hurting anyone.
Six accidents
- Marietta, Georgia, June 1985. A patient was badly overexposed. The paper says the facts are sketchy because the accident was never carefully investigated. The physicist later estimated one or two doses in the 15,000 to 20,000 rad range; a typical single treatment is about 200 rads.
- Hamilton, Ontario, July 1985. An AECL technician later estimated that the patient received 13,000 to 17,000 rads. The machine had kept shutting down with a tilt error, and AECL suspected a failed microswitch. The patient died of cancer in November 1985.
- Yakima, Washington, December 1985. A patient developed a striped skin reaction after a treatment. The cause was recorded as unknown, and staff only suspected the Therac-25 in February 1987, after the later accident there.
- Tyler, Texas, 21 March 1986. The operator saw “Malfunction 54”, a cryptic message with no explanation in the manual, and a display showing an underdose. Operators were used to frequent harmless pauses, so she pressed the key to proceed. The patient died five months later of complications of the overdose.
- Tyler, Texas, 11 April 1986. A second patient died on 1 May 1986, three weeks after the accident.
- Yakima, Washington, 17 January 1987. Investigators traced this one to a one-byte counter that wrapped to zero on every 256th pass, so a position check was skipped. The paper notes speculation that Hamilton had the same cause, which could not be confirmed. The patient died in April of complications of the overdose but already had terminal cancer, and relatives filed suit; it was settled out of court.
The Tyler bug
The physicist at Tyler, Fritz Hager, reproduced the failure. Setting the machine’s bending magnets takes about eight seconds. An operator who typed a prescription, then moved the cursor up and corrected the mode or energy and returned to the command line within those eight seconds, changed what the screen showed but not what the hardware had been set to. The software never noticed the edit. The flaw was in how two tasks shared state, the data-entry task and the setup task, which the paper treats as a race condition.
What changed
The US Food and Drug Administration declared the Therac-25 defective and ordered AECL to notify buyers and submit a corrective action plan. The final plan had more than 20 changes to hardware and software. It included independent hardware interlocks and replacing cryptic messages with meaningful ones.
Why it matters
The software had bugs, as software does. The lasting lesson is that the bugs were allowed to be the last line of defence.
Our take: do not let one layer be the whole safety case. When a failure can hurt someone, keep an independent check that does not share the code, the assumptions or the people of the thing it checks.
Do you agree?
Take it to Chevlume: write your view, add your sources and let others answer. The closed alpha is by invitation.
Keep reading
The Slime Mould and the Tokyo Rail Map
A single cell with no brain grew a network like Tokyo's railways. What the 2010 experiment showed, what press releases added and the algorithm behind it.
SPACE / EXPLAINERWhy CubeSats Changed Access to Space
A standard 10 cm unit made small satellites cheap to build and launch. Where the idea came from, how NASA flies them and what still takes months.
AI / EXPLAINERWhat RLHF Does and Does Not Do
How reinforcement learning from human feedback works in the InstructGPT paper, what it improved, the alignment tax and what it leaves unsolved.
Sources
- An Investigation of the Therac-25 Accidents (Leveson and Turner, IEEE Computer, July 1993; MIT 6.033 copy) · IEEE Computer / MIT 6.033 · Accessed
- An Investigation of the Therac-25 Accidents (PDF reprint, UC Berkeley CS 61A) · IEEE Computer / UC Berkeley · Accessed
Published
Discuss on X