Introduction12 CaseNarrative_1 SummaryofOperatorInterview AccidentAccounts2 OperatorInterface student-mcs-part4-fulldefense1 TheMachine3
The ethical defense is on the decision and actions of CMC which made the therac machine.
The document with instructions for the paper is “student-mcs-part4-fulldefense (1) ”
Introductionto the Therac-25 Major Case Study
This case study is designed to get you to think critically about the
ethical issues inherent in our general use of and reliance on
technology. This semester-long activity will help reinforce these
concepts better than short look we take at other cases during the
course. The case study is designed to force students to evaluate peer
work, as well as their own, with regards to ethical reasoning and
analysis (something that is stressed throughout the course). To
accomplish this goal, we are going to use the example of the Therac
25 machine, which was used for treating certain cancers. Early in the
Therac 25’s use, patients in the U.S. and Canada were reporting burns
from the machine. Ultimately, some deaths occurred. Here is how the
major case study will work:
1. You will choose a client to defend: CMC, FDA, Hospitals, or
Operators. See the note below about defending the Hospitals or
the Operators. The choice will be made during week 3 of the
course.
2. You will be tasked with defending the viewpoint of your client in
the Therac case. An outline of your defense will be due at the
end of week 6.
3. During week 8 you will write a critique of a defense of one of the
other clients. The defense will be in the form of a Power Point
presentation that will be provided along with the week 8 course
materials. Please note that you are NOT creating a Power Point.
You are writing a critique of an existing PP from a previous
semester.
4. Your full defense will be a paper that you will submit at the end
of the 2nd to last week of the course. The paper must, at a
minimum, include:
a. General background information on your client
b. The problem or issue that involved your client with regards
to the Therac-25 machine
c. A detailed proposal regarding what can and should be done
to prevent this problem from happening (remedies)
d. An ethical analysis using Spinello’s Framework. This is the
place where you stress that your client acted ethically.
e. A list of additional references, beyond the materials
provided in the course.
What you will find out as you investigate this case study and delve into
the inner workings are what really happened and why, and how the
ethical issues, and how they were approached by all interested parties,
shifted and blurred. The outcomes of the Therac 25 law suites are well
known and documented. The point of this case study is not to
necessarily change that outcome but rather, it is to increase your
ability to conduct an analysis of the ethical issues given in any
circumstance in the real world.
To get a solid understanding of the Therac 25 problem and the ethical
issues involved, read the chapter sections from both of your textbooks
for this course that deal specifically with the Therac case. Additional
resources are provided in other sections for the Major Case Study. As
an aside, we use the case of the Therac machine because it is well
documented and easy to understand. There are of course other cases
out there that are engaging and very interesting as well. The problem
is that many of these cases, such as cases that deal with free speech
issues for instance, are difficult to argue because these cases are not
so cut and dried. Legislation is constantly being introduced that would
make it difficult to collect and analyze the necessary data to present a
convincing and conclusive argument within the time frame of this
course and within the legal skills necessary to make sense of the
information. The interesting part of this case (with regards to our
course) is how you decide to build your case, and how well you argue
and present it.
NOTE: If you are defending the Hospitals or the Operators, you need
to defend them all. You don’t have to make your defense sound as
though there was only one Hospital, or only one Operator, but, you
can not just ignore one or several Hospitals or Operators to help your
defense.
NOTE: Much of the material used in the presentation of this case
study were created by C. Huff, et. al, atSt. Olaf College under a grant
from the National Science Foundation. The material is used under the
Education Fair Use Act.
Therac-25Abstract
Therac-25 was a new generation medical linear accelerator for treating cancer. It
incorporated the most recent computer control equipment. Therac-25’s computerization
made the laborious process of machine setup much easier for operators, and thus allowed
them to spend minimal time in setting up the equipment. In addition to making setup
easier, the computer also monitored the machine for safety. With the advent of computer
control, hardware based safety mechanisms were transferred to the software. Hospitals
were told that the Therac-25 medical linear accelerator had “so many safety mechanisms”
that it was “virtually impossible” to overdose a patient.
Normally, when a patient is scheduled to have radiation therapy for cancer, he or she is
scheduled for several sessions over a few weeks and told to expect some minor skin
discomfort from the treatment. The discomfort is described as being like a mild sunburn
over the treated area. But in this case on safety critical software, you will find that some
patients received much more radiation than prescribed
Therac-25 for Treating Cancer
Therac-25: A computer controlled medical linear accelerator for treating
cancer
Normally, when a patient is scheduled to have radiation therapy for cancer, he or she is
scheduled for several sessions over a few weeks and told to expect some minor skin
discomfort from the treatment. The discomfort is described as being like a mild sunburn
over the treated area.
Therac-25 was a new generation machine that incorporated the most recent computer
control equipment. The machine targeted electron or X-ray beams on cancerous tissue to
destroy it. Electron beams were used to treat shallow tissue, while X-ray beams could
penetrate with minimal damage to treat deep tissue.
When a doctor decides that a patient needs radiation therapy, that patient is given a
prescription that indicates to the medical linear accelerator operator how many rads
(radiation absorbed dose) the patient should receive over how many total treatments. In
addition, the prescription indicates the location where the radiation should be applied.
The patient schedules a time (or times) to receive treatment.
Standard procedures then determine whether, on any particular appointment, the operator
is to set up the equipment for electron or X-ray beam treatment. The patient is asked to lie
in the appropriate position on the treatment table and the table is rotated to place the
diseased part of the patients’ body in the path of, and at the appropriate distance from, the
radiation beam. The operator then does whatever mechanical setup is required and leaves
the room to program the treatment data into the machine. After doing this, the operator
presses the button that actuates the treatment routine. The patient is then helped off the
treatment table and ushered out. After the appropriate forms have been filled out, the next
patient is admitted.
Therac-25’s computerization made this laborious process much easier for operators, and
allowed them to spend minimal time in setting up the equipment. Operators were thus
freed to spend more time talking with and helping the patient.
In addition to making setup easier, the computer also monitored the machine for safety.
Previous machines had safety devices as a part of the hardware of the machine. Among
other things, these safety devices kept the machine from delivering doses of radiation that
were too high. So, with the advent of computer control, these hardware based safety
mechanisms were transferred to the software. Hospitals were told that the Therac-25
medical linear accelerator had “so many safety mechanisms” that it was “virtually
impossible” to overdose a patient.
How Radiation Therapy Works
What Radiation Therapy Is
Radiation therapy for cancer is the exposure of cancerous tissue to ionizing radiation.
This is usually done by what is called “external” therapy, using electron, X-rays or
gamma rays to treat the tissue. This therapy may occur either before or after surgery, or in
the place of surgery.
Therac-25 was a 3rd generation radiation therapy machine for external radiation therapy.
It used either electron beam or X-rays to treat tissue.
Why Radiation Therapy Works
Cancer cells usually multiply faster than most other cells in the body. Tissue composed of
these quickly-dividing cells can be shrunken by disabling its genetic material. By doing
this, ionizing radiation interferes with the cancerous tissue’s ability to grow.
Unfortunately, the radiation makes no distinction between cancerous cells and other
rapidly dividing body tissues. Skin and hair are some of the most noticeably hurt tissues
after treatment, and treatment may produce skin lesions and hair loss. These tissues have
cells that rapidly divide and the radiation halts their development. But they are usually
able to recover from this assault and return to normalcy. Nevertheless, skin lesions and
hair loss are not an unusual side effect of radiation therapy.
What a Treatment Session is Like
Radiation therapy is usually done in a series of sessions occurring over several weeks,
allowing the effect of the radiation to build up over time. The treating doctor will
determine the specific number of treatments, the dosage at each treatment, and the
schedule. During treatment, the doctor will usually see the patient once a week to check
on general health, side effects, and the progress of the treatment.
Before the series of treatments occurs, a radiation therapy technician will outline the
specific area to be treated with a marking pen, indelible ink or silver nitrate.
Depending on the body area to be treated, the patient would need to remove his or her
clothing and put on a hospital gown. After going to the radiation therapy room, they
would then either lie on a treatment table or sit in a special chair (Therac-25 had a table).
The marks on the skin are used to guide the machine operator in locating the precise area
to be treated. Once the machine is set up, the operator leaves the room for a control room
nearby. This protects the operator from prolonged exposure to low-level radiation that
might scatter from the machine (an operator may treat as many as 30 patients in a day).
From there, the operator will turn on the treatment machine while he/she watches. With
the Therac-25, this was accomplished by means of a television camera and monitor.
During radiation therapy, the treatment machine makes a buzzing noise. Treatments are
typically brief and painless, normally lasting 1 to 5 minutes. Total time in the treatment
room will usually be 5 to 15 minutes.
Summaryof Operator Interview
The following article is the result of an interview we conducted with a Registered
Therapy Technologist who has extensive experience operating medical linear
accelerators. This individual currently manages a Radiation Therapy Department at a
major United States hospital, and trains technicians to operate radiation therapy
machinery. For privacy purposes, the true identity of this person will remain anonymous,
and for the remainder of the article, we will refer to our interviewee as “Susan.”
Susan operated a Therac-4 linear accelerator machine in the mid 1980’s. At the time,
Susan had recently graduated and was working at a University where the radiation
therapy technology was fairly advanced. She enjoyed operating CMC’s Therac machine
because it was one of the first computerized linear accelerators. Looking back, Susan
remembered that while operating the machines, she did not think much about whether
there could be computer software “bugs” in the system. The technology was new, and she
remembered trusting the machine’s components and its designers.
When recalling the advantages of the new computerized machine, Susan reported being
able to move more patients through during the day. She also remembered feeling good
about the extra time she had to talk with patients when she was working with a
computerized machine.
Susan learned about the Therac-25 incidents while attending a national radiation therapy
conference in 1990. A radiation therapist who was also a lawyer gave a lecture on the
Therac-25 accidents. He handed out newspaper articles about the incidents and spoke
about how many times the therapists involved in the accidents attempted to resume
treatment in spite of the error messages they received from the computer. The lecture
focused on the question of how many attempts to resume treatment is too many? The
lecturer and the participants discussed the possibility of establishing institutional policies
and limits on the number of times an operator could resume treatment after having
received an error message, such as the cryptic “malfunction 54” messages that the
operator received during the two fatal accidents in Texas.
The problem, Susan reported, is that back in 1990, and today, there are no industry-wide
standards or rules for these types of situations. Susan felt that she had been lucky to have
always worked where there was a physicist available to provide help with the many error
messages operators received. She also felt that in other clinics, where this kind of
assistance is not available, there was, and still is, a great deal more pressure on therapists
to just keep going despite the error messages. An operator might attempt, for example, to
deliver the prescribed dose in 12 increments instead of 1 by continually clearing the faults
generated by the computer. Susan stated that this type of activity happens all the time in
medical radiation therapy, particularly in clinics where there is more pressure from the
administration to keep patients moving through quickly.
Although Susan had been working with a CMC Therac machine at the time of the
accidents, she did not remember receiving warning notices from CMC about the Therac-
related accidents. Susan believes that this is one aspect of the industry that has changed,
possibly, in part due the Therac-25 accidents. At the present time Susan receives notices
from the manufacturers of the linear accelerators used at her hospital whenever there is a
linear accelerator malfunction, or even if there is a malfunction that almost occurred, but
was prevented.
Perhaps part of the reason that Susan did not hear of the Therac-25 incidents until much
later was that the hospital where she worked got rid of the Therac-4, moved their
facilities, and bought a new set of linear accelerators. Susan estimated the average life of
the linear accelerator to be between 5 and 10 years. After that, she said, the accelerator
tends to act somewhat like an old car in which the engine light is coming on all the time.
The accelerator’s computer generates many faults that can become a nuisance to the
operators and to the patients. Responsible operators will continue to report these faults to
the physicist, when one is available, and eventually, the machine is replaced.
Susan feels that one of the biggest problems in her industry today is the lack of rigorous
industry-wide standard certification and education for operators. Susan reported that there
are about 102 radiation schools in the country, and that there are also different types of
schools. Students are able to receive a certificate from a certificate program, usually
about 12 months in length. Students are also able to receive a four-year bachelor’s degree
from certain schools. The American Registry of Radiologic Technologists (ARRT)
provides a test that graduates of these programs may then take in order to be considered
licensed entry level technicians. The ARRT also requires that therapists maintain their
training through continuing education. Therapists must have 24 credits in two years
before they may re-register their licenses.
In spite of the fact that the ARRT provides these guidelines for licensure, many states in
the U.S. do not require hospitals or clinics to hire licensed radiation therapists. Some
states require very basic exams, but, according to Susan, that in essence means that in
many states anyone off the street could learn how to operate a machine, take one of these
basic exams, and then be qualified to operate radiation therapy machines.
Susan and many of her colleagues continue to fight for mandatory standard certification
of radiation therapists. The safety of patients depends on all of the elements of their
systems of treatment working together correctly. The more operators are trained to know
about the process, the more they will be able to help prevent accidents. Well-trained
operators can double-check radiation dose prescriptions and question doctors when
something does not seem right. With the benefit of extensive training, operators have a
better sense of when it is alright to over-ride a fault message from the computer.
Well trained technicians will also be better equipped to stand up to hospital
administrations that attempt to put pressure on technicians to push large numbers of
patients through treatment in spite of possible dangers. Though Susan does not feel this
kind of pressure from her own administration, she knows that other technicians in other
clinics definitely do, especially at “free-standing” clinics that operate for profit. Susan is
aware that at these clinics there is a tremendous amount of pressure put on machine
operators to get patients through treatment.
Susan also described incidents in which technicians left institutions because they didn’t
feel that the institutions’ radiation therapy practices were safe for patients. Because there
is no federal law regulating how many times an operator can re-attempt therapy after the
computer displays a fault or shuts down, some operators allegedly use jumper cables that
continuously override their computer’s emergency shut down mechanism. Susan cited a
lack of regulation, lack of training, and lack of adequate funding as reasons for these
procedures.
Another issue in the radiation therapy industry that worries Susan is the fact that linear
accelerator manufacturers charge large fees for operator training sessions, software
upgrades, and machine maintenance contracts. When a radiation therapy machine is
purchased, it comes with many binders full of information provided by the company. The
clinic is given the option to buy service contracts and send physicists and operators to the
company headquarters for training. Susan reported that in many clinics where money is
tight, administrators are forced to choose between machine servicing contracts, software
upgrades, and training.
According to Susan, mistakes are still made in the radiation therapy treatment of patients.
Much of the information and calibration is still done by human beings and subject to
human error. As an instructor, Susan teaches her students to anticipate every angle of the
treatment, and then to check, and re-check their work. Susan also mentioned that while
she teaches her students not to trust wholly in the machinery and its software, operators
are largely dependent on manufacturers and hospital physicist teams to keep the machines
running correctly.
Susan has a positive outlook regarding the radiation therapy industry. She knows that
thousands of patients benefit greatly from radiation therapy technology. While Susan
continues to push for operator certification legislation, she focuses on training her own
staff well. Susan and her administration also focus heavily on quality patient care.
When asked if she thought it would be important for the designers of the software that
runs the machines to know what it is like to do her job, Susan’s reply was an emphatic
yes, though she doubted many of the software designers of her machinery had spent
much time observing a radiation treatment facility.
AccidentAccounts
Linda Knight: June 3,1985
61-year old Linda Knight had been receiving follow-up treatment at the Kennestone
Regional Oncology Center (Marietta, GA) for the removal of a malignant breast tumor.
On June 3, staff at Kennestone prepared Knight for electron treatment to the clavicle area,
using the Therac-25 machine.
Knight had been through the process before, which was ordinarily uneventful. This time,
when the machine was turned on, Knight felt a “tremendous force of heat… this red-hot
sensation.” When the technician re-entered the therapy room, Knight said, “you burned
me.” The technician replied that that was “not possible.”
Back home, the skin above Knight’s left breast began swelling. The pain was so great that
she checked in at Atlanta’s West Paces Ferry Hospital a few days after the Therac
incident. For a week, doctors at West Paces Ferry continued to send Knight back to
Kennestone for Therac treatment, but when the welt on her chest began to break down
and lose layers of skin, Knight refused to undergo any more radiation treatment.
About two weeks later, the physicist at Kennestone noticed that Knight had a matching
burn on her back, as though the burn had gone through her body. The swelling on her
back had also begun to slough off skin. Knight was in great pain, and her shoulder had
become immobile. These clues led the physicist to conclude that Knight had indeed
suffered a major radiation burn. Knight had probably received one or two radiation doses
in the 20,000-rad (radiation absorbed dose) range, well above the typical prescribed
dosage of around 200-rads. The physicist called CMC and, without telling of the
accident, asked questions about the likelihood of radiation overexposure from the Therac
25 machine: Could Therac 25 operate in electron mode without scanning to spread the
beam? Three days later CMC engineers called back to say this was not possible.
Linda Knight was in constant pain, lost the use of her shoulder and arm, and her left
breast had to be removed because of the radiation burns.
Donna Gartner: July 26,1985
Donna Gartner, a 40-year old cancer patient, was at the Ontario Cancer Foundation clinic
in Hamilton, Ontario, Canada for her 24th Therac treatment for carcinoma of the cervix.
The Therac-25 operator activated the machine, but after 5 seconds, the Therac-25 shut
down and showed an “H-tilt” error message. The computer screen indicated that no dose
had been given, so the operator hit the “P” key for the “proceed” command. The Therac
shut down in the same manner as before, reading “no dose,” so the operator repeated the
process a total of four times after the initial try.
After the fifth try, a hospital service technician was called but found no problems with the
machine. Donna Gartner left the clinic and the Therac was used with six other patients
that day without any incidents. However, despite the fact that the Therac had indicated
that no radiation dose had been given during Donna Gartner’s five therapy attempts that
day, Gartner complained of a burning sensation she described as an “electric tingling
shock” in the treated area of her hip.
Gartner returned for treatment three days later, on July 29, and was hospitalized for
suspected radiation overexposure. She had considerable burning, pain and swelling in the
treatment region of her hip.
The Hamilton clinic took the Therac-25 machine out of service and informed CMC of the
incident. This was the first time CMC had heard from a clinic about an overdose problem
with the Therac-25 machine. CMC sent a service engineer to investigate.
CMC reported to a range of stakeholders that there was a problem with the operation of
Therac 25. The FDA, the Canadian Radiation Protection Board (the parallel Canadian
agency to the FDA), and other Therac-25 users were all notified. Users were instructed to
visually confirm that the Therac turntable was in the correct position for each use.
Because of the Hamilton accident, CMC issued a voluntary recall of the Therac-25
machines and the FDA audited CMC’s modifications to the Therac. CMC could not
reproduce the malfunction that had occurred but suspected some hardware errors in a
switch that monitored the turntable position. A failure of this switch could result in the
turntable being incorrectly positioned, and an unmodified electron beam striking the
patient. The company redesigned the mechanism used to lock the turntable into place,
redesigned the switch to detect position and it accompanying software. They then
reported in November 1985 that this redesign was complete and that, given their safety
analyses, the machine was now at least 10,000 times safer than before.
Donna Gartner died on November 3, 1985 from cancer. An autopsy revealed that had the
cancer not killed Gartner, a total hip replacement would have been necessary because of
the radiation overexposure.
Janis Tilman: December 1985
Janis Tilman was being treated with the Therac-25 machine at the Yakima Valley
Memorial Hospital in Yakima, Washington. After one treatment in December 1985, her
skin in the treatment area, her right hip, began to redden in a parallel striped pattern. The
reddening did not immediately follow treatment with the Therac-25 because it generally
takes at least several days before the skin reddens and/or swells from a radiation
overexposure.
Tilman continued Therac treatment until January 6, 1986 despite the reddening, since it
was not determined that the reddening was an abnormal reaction. Hospital staff
monitored the skin reaction and searched unsuccessfully for possible causes for the
striped marks.
The hospital sent a letter to CMC and spoke on the phone with CMC’s technical support
supervisor, who later sent a written response stating, “After careful consideration, we are
of the opinion that this damage could not have been produced by any malfunction of the
Therac-25 or by any operator error.” The hospital staff dismissed the skin/tissue problem
as “cause unknown,” partly due to the response from CMC, and partly because they knew
CMC had already installed additional safety devices to their Therac-25 machine in
September 1985.
Upon investigation in February 1987, the Yakima staff found Tilman to have a chronic
skin ulcer, dead tissue, and constant pain in her hip, providing further evidence for a
radiation overexposure. Tilman underwent surgery and skin grafts, and overcame the
incident with minor disability and some scarring related to the overdose.
Isaac Dahl: March 22, 1986
At the East Texas Cancer Center (ETCC) in Tyler, Texas, 33-year old Isaac Dahl was to
receive his ninth Therac-25 radiation therapy session after a tumor had been successfully
removed from his left shoulder. By this time the Therac 25 had been in successful
operation at Tyler for two years, and 500 patients had been treated with it.
The Therac-25 operator left the radiation room to begin the treatment as usual. As she
was typing in values, she made a mistake and used the “cursor up” key to correct it. Once
the values were correct, she hit the “B” key to begin treatment, but the Therac-25
machine shut down after a moment, and the message “Malfunction 54” showed on the
control room monitor. The machine indicated that only 6 of the prescribed 202 units of
radiation had been delivered. The screen of the console showed that this shut down was a
“treatment pause” which indicated a problem of low priority (since little radiation had
been delivered). The operator hit the “P” key to proceed with the therapy, but after a
moment of activity, “Malfunction 54” appeared on the Therac control screen again.
The operator was isolated from Dahl because the Therac-25 operates from within a
shielded room. On this day at the ETCC, the video monitor was unplugged and the audio
monitor was broken, leaving no way for the operator to know what was happening inside.
Isaac Dahl had been lying on the treatment table, waiting for the usually uneventful
radiation therapy, when he saw a bright flash of light, heard a frying, buzzing sound, and
felt a thump and heat like an electric shock.
Dahl, knowing from his previous 8 sessions that this was not normal, began to get up
from the treatment table when the second “attempt” at treatment occurred. This time the
electric-like jolt hit him in the neck and shoulder. He rolled off the table and pounded on
the treatment room door until the surprised Therac-25 operator opened it. Dahl was
immediately examined by a physician, who observed reddening of the skin but suspected
only an electric shock. Dahl was discharged and told to return if he suffered any further
complications.
The hospital physicist was called in to examine the Therac-25, but no problems were
found. The Therac-25 was shut down for testing the next day, and two CMC engineers,
one from Texas and one from the home office in Canada, spent a day at the ETCC
running tests on the machine but could not reproduce a Malfunction 54. The home office
engineer explained that the Therac-25 was unable to overdose a patient and also said that
CMC had no knowledge of any overexposure accidents by Therac-25 machines. No
electrical problems were found with the ETCC’s Therac machine, and it was put back into
use on April 7, 1986.
Isaac Dahl’s condition worsened as he lost the use of his left arm and had constant pain
and periodic nausea and vomiting spells. He was later hospitalized for several major
radiation-induced symptoms (including vocal cord paralysis, paralysis of his left arm and
both legs, and a lesion on his left lung). Dahl died in August of 1986 due to
complications from the radiation overdose.
Daniel McCarthy : April 11,1986
Technicians could find nothing wrong with the Therac-25 unit at the East Texas Cancer
Center (ETCC), after the “Malfunction 54” incident that had injured Isaac Dahl. The
machine was reinstated.
Four days later, Daniel McCarthy was being treated for skin cancer on the side of his
face. The same Therac operator who had treated Isaac Dahl was treating McCarthy. As
the operator prepared to administer the Therac treatment from the control room, she used
the “cursor up” key to correct an error in the treatment settings. She then began treatment
using the “B” key.
The Therac-25 shut down within a few seconds, making a noise audible through the
newly repaired intercom. The Therac monitor read “Malfunction 54.” The operator
rushed into the treatment room and found McCarthy moaning for help. He said that his
face was on fire. The hospital physicist was called. McCarthy said that something had hit
the side of his face, and that he had seen a flash of light and heard a sizzling sound.
After this second accident at the hospital, the ETCC physicist took the Therac-25 out of
service and called CMC. He worked with the Therac operator who had been
administering treatment to both Dahl and McCarthy when the accidents occurred. The
physicist and the operator were eventually able to reproduce a Malfunction 54. They
found that the malfunction occurred only if the Therac-25 operator rapidly corrected a
mistake.
The ETCC physicist notified CMC of this discovery and CMC was eventually able to
reproduce the error. CMC advised Therac-25 users to physically remove the up-arrow
key as a short-term solution. CMC also filed a report with the United States FDA as
required by law, and began work on fixing the software bug.
The FDA worked in conjunction with CMC to identify the software problem and correct
it. The FDA also requested that CMC change the machine in several other ways to clarify
the meaning of malfunctions error messages and to shut down treatment after any single
large radiation pulse or interrupted treatment so that multiple overdoses were less likely.
Over the next three weeks Daniel McCarthy became very disoriented and then fell into a
coma. He had a fever as high as 104 degrees and had suffered neurological damage. He
died on May 1, 1986.
Anders Engman: January 17, 1987
Anders Engman was at the Yakima Valley Memorial Hospital on January 17, 1987 to
receive three sets of radiation treatment from the Therac-25.
The first two treatments went as planned. Engman received 7 rads (radiation absorbed
dose), 4 rads followed by 3 rads of radiation to take pictures of internal structure. The
Therac-25 operator then entered the room and used the Therac-25’s hand control to verify
proper beam alignment on Engman’s body. Engman’s final dose of the day was to be a
moderate 79-rad photon treatment.
The operator pressed a button to command the Therac to move its turntable to the proper
position for treatment. Outside the treatment room, the Therac-25’s control console read
“beam ready,” and the operator pressed the “B” key to turn the beam on. The beam
activated, but the Therac-25 shut down after about 5 seconds. The console indicated that
no dose had been given, so the operator pressed “P” to proceed with the treatment.
The Therac-25 shut down again, listing “flatness” as the reason for treatment pause.
Engman said something over the intercom, but the operator couldn’t understand him. The
operator went into the treatment room to speak with Engman. Engman told the operator
that he had felt a “burning sensation” in the chest. The operator’s console displayed only
the total dose of the two earlier treatments (7 rads).
Later that day, Engman developed a skin burn over the treatment area. Four days later the
burn was striped in a manner similar to that of Janis Tilman’s burn after she had been
treated at Yakima the year before.
CMC investigated the accident. All users were again told to visually confirm turntable
setting before proceeding with any treatment. Given the information, it was suspected
that the electron beam had come on when the turntable was in the field light position.
CMC could not reproduce the error.
Later that week, CMC sent an engineer to Yakima to investigate. The hospital physicist
had also been running tests. They eventually discovered a software flaw and fixed it.
CMC engineers estimated that Engman received between 8,000 and 10,000 rads instead
of the prescribed 86.
Anders Engman died in April 1987. He had been suffering from a terminal form of
cancer before the Therac accident, but it was determined that his death was primarily
caused by complications related to the radiation overdose, not the cancer.
Thematerial on this page is reprinted from N.G. Leveson, & C.S. Turner. “An Investigation of the Therac-25 Accidents.” Computer, Vol. 26,
No. 7, July 1993, pp. 18-41. Copyright © 1993 Institute of Electrical and Electronics Engineers. This material is posted here with permission of
IEEE. Such permission of the IEEE does not in any way imply IEEE endorsement of any of St. Olaf College’s products or services. Internal or
personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for
creating new collective works for resale or redistribution must be obtained from the IEEE by sending a blank email message to pubs-
permissions@ieee.org. By choosing to view this document, you agree to all provisions of the copyright laws protecting it.
The Operator Interface
The Therac-25 operator controls the machine with a DEC VT100 terminal. In the general
case, the operator positions the patient on the treatment table, manually sets the treatment
field sizes and gantry rotation, and attaches accessories to the machine. Leaving the
treatment room, the operator returns to the VT100 console to enter the patient
identification, treatment prescription (including mode, energy level, dose, dose rate, and
time), field sizing, gantry rotation, and accessory data. The system then compares the
manually set values with those entered at the console. If they match, a “verified” message
is displayed and treatment is permitted. If they do not match, treatment is not allowed to
proceed until the mismatch is corrected. Figure A. shows the screen layout.
Figure A. Operator interface screen layout
When the system was first built, operators complained that it took too long to enter the
treatment plan. In response, the manufacturer modified the software before the first unit
was installed so that, instead of reentering the data at the keyboard, operators could use a
carriage return to merely copy the treatment site data [Miller]. A quick series of carriage
returns would thus complete data entry. This interface modification was to figure in
several accidents.
The Therac-25 could shut down in two ways after it detected an error condition. One was
a treatment suspend, which required a complete machine reset to restart the machine. If a
treatment pause occurred, the operator could press the “P” key to “proceed” and resume
treatment quickly and conveniently. The previous treatment parameters remained in
effect, and no reset was required. This convenient and simple feature could be invoked a
maximum of five times before the machine automatically suspended treatment and
required the operator to perform a system reset.
Error messages provided to the operator were cryptic, and some merely consisted of the
word “malfunction” followed by a number from 1 to 64 denoting an analog/digital
channel number. According to an FDA memorandum written after one accident:
The operator’s manual supplied with the machine does not explain nor
even address the malfunction codes. The [Maintenance] Manual lists the
various malfunction numbers but gives no explanation. The materials
provided give no indication that these malfunctions could place a patient
at risk.
The program does not advise the operator if a situation exists wherein the
ion chambers used to monitor the patient are saturated, thus are beyond the
measurement limits of the instrument. This software package does not
appear to contain a safety system to prevent parameters being entered and
intermixed that would result in excessive radiation being delivered to the
patient under treatment.
An operator involved in an overdose accident testified that she had become insensitive to
machine malfunctions. Malfunction messages were commonplace — most did not
involve patient safety. Service technicians would fix the problems or the hospital
physicist would realign the machine and make it operable again. She said, “It was not out
of the ordinary for something to stop the machine…It would often give a low dose rate in
which you would turn the machine back on…They would give messages of low dose
rate, V-tilt, H-tilt, and other things; I can’t remember all the reasons it would stop, but
there [were] a lot of them.” The operator further testified that during instruction she had
been taught that there were “so many safety mechanisms” that she understood it was
virtually impossible to overdose a patient.
A radiation therapist at another clinic reported an average of 40 dose-rate malfunction,
attributed to underdoses, occurred on some days.
Reference: E. Miller, “The Therac-25 Experience,” Proc. Conf. State Radiation Control
Program Directors, 1987.
INFO460 – Computer Ethics
Major Case Study
Part 4 – full defense (35 points)
Your full defense, as outlined in the description of the Major Case
Study, is due this week. Please be sure you have included all parts of
the defense. Make sure that you title each part. It needs to be crystal
clear to me where each part of your defense begins and ends. For
example:
Background information
…
The issue
…
Proposal
…
Ethical analysis
…
References
…
Howa Medical Linear Accelerator Works
Generating an Electron Beam
Early radiation therapy machines used a radioactive source like cobalt to produce the
ionizing radiation needed to treat cancerous tissue. Some machines still use an active
radiation source. But most radiation therapy today is done with a linear accelerator. In
principle, a linear accelerator works just like the computer monitor you are probably
using to read this web page. The electrons are accelerated by the gun in the back of the
monitor and directed at the inside of the screen, where phosphors absorb the electrons
and produce light. A medical linear accelerator produces a beam of electrons about 1,000
times more powerful than the standard computer monitor. The longer a linear accelerator
is, the higher the energy of the beam it can produce. The innovation of Therac 25 was
that the designers found a way to fold the beam back and forth so a very long accelerator
could be fit into a smaller space. Thus powerful beams could be produced, but within a
reasonable amount of space
Getting the Beam into the Body
Patients can be treated directly with the resulting electron beam, as long as the beam is
spread out by scanning magnets to produce a safe level of radiation. The medical linear
accelerator spreads and directs the beam at the
appropriate place for treatment. The picture below
shows a typical medical linear accelerator in
operation.
But a difficulty with the electron beam is that it
diffuses rapidly in tissue and cannot reach deeper
tissue for treatment. The picture below is a
simulation (produced by the Stanford Linear
Accelerator Center) of an electron beam traveling
through air and entering human tissue. You can see
the beam quickly diffuses and therefore does not
penetrate deeply.
To solve this problem, Therac-25 and many other
machines can switch to a mode in which X-ray
photons are used for treatment. These penetrate much
more deeply without harming intervening tissue. To do this, the electron beam is greatly
increased in intensity and a metal foil followed by a beam “flattener” is placed in the path
of the electron beam. This transforms the electron beam into an X-ray (called photons in
some literature). This process is inefficient and requires a high intensity electron beam to
produce enough X-ray intensity for treatment. Therac-25 used a 25 MeV electron beam to
produce an X-ray for treatment. 25 MeV is 25 million electron volts (eV — an eV is the
energy needed to move one electron through a potential of one volt).
Therac-25 was what was called a dual-mode machine. It could
produce the low energy electron beams for surface treatment
and it could also produce a very high intensity electron beam
that would be transformed into an X-ray by placing the metal
foil in the path of the beam. The serious danger in a dual mode
machine is that the high-energy beam might directly strike the
patient if the foil and flattener were not placed in its way.
Radiation Absorbed Dose
Although MeVs are used to measure the strength of the electron beam, the measure used
for therapeutic uses is the radiation absorbed dose (rad). This is a measure of the radiation
that is absorbed by tissue in a treatment. Standard single radiation treatments are in the
range of 200 rads. 500 rads is the accepted level of radation that, if the entire body is
exposed to it, will result in the death of 50% of the cases. The unprotected electron beam
in the Therac-25 is capable of producing between 15,000 and 20,000 rads in a single
treatment. The unprotected beam is never aimed directly at a patient. It is either spread to
a safe concentration by scanning magnets or turned into X-rays and reduced by a beam
flattener.
How Therac-25 worked
A Short History of Therac
There were two previous versions of Therac machines, each produced by CMC in
collaboration with a French company, CGR. Therac 6 and Therac 20 (each named for the
MeV they could produce) were based on earlier design from CGR. By the time Therac-25
was released for sale, CMC had 13 years of experience with production of medical linear
accelerators. Therac-25 was based on these previous versions. Its main innovations were
(1) a “double pass” electron beam so the machine could produce more energy in less
space, and (2) the addition of extensive computer control of the machine. This latter
innovation allowed CMC to move much of the checking for hazardous conditions into the
software.
The Therac-25’s ancestors, Therac-20 and Therac-6, had used a minicomputer (a DEC
PDP-11) to add some convenience to the standard hardware of a medical linear
accelerator. They both could work without computer control. CMC determined to make
its new model, Therac-25, a tightly-coupled combination of software and hardware.
Therac-25 software was not written from scratch, but was built up from components that
were borrowed from the earlier versions of Therac.
The Machine in the Room
Therac-25 is not just a machine, but an installation consisting of the machine, the PDP-11
that controlled the machine, the shielded room the machine sits in, and the monitoring
and control station.
The control console and printer etc. are all located outside the heavily shielded treatment
room. Thus, when pressing the key to begin the treatment, the operator does not have any
direct access to the machine or the patient. All the occurrences in the treatment room
must be observed through the TV monitor and the intercom. The intercom works both
ways, that is, the patient can hear the operator (if the operator presses a switch) and the
operator can hear the patient. The patient, however, cannot see anything outside the
treatment room, while the operator can look in using the TV monitor.
Switching Between Modes: The Turntable
Therac-25 is a dual mode machine. This means that it can treat the patient with relatively
low energy electron beams or with X-ray beams. In addition, Therac-25 had a “field
light” position that allowed a standard light beam to shine in the path of treatment to help
the operator in setting up the machine. Thus there were three modes in which the Therac-
25 could operate: electron beam and X-ray for treatment, and field light for setup.
Even though they are relatively low energy, the electron beams are too powerful in their
raw form to treat the patient. They need to be spread thinly enough to be the right level of
energy. To do this, Therac-25 placed what are called scanning magnets in the way of the
beam. The spread of the beam (and also it power) could be controlled by the magnetic
fields generated by these magnets. Thus for electron beam therapy, the scanning magnets
needed to be placed in the path of the beam.
X-ray treatment requires a very high intensity electron beam (25 MeV) to strike a metal
foil. The foil then emits X-rays (photons). This X-ray beam is then “flattened” by a
device below the foil, and the X-ray beam of an appropriate intensity is then directed to
the patient. Thus, X-ray therapy requires the foil and the flattener to be placed in the path
of the electron beam.
The final mode of operation for Therac-25 is not a treatment mode at all. It is merely a
light that illuminates the field on the surface of the patient’s body that will be treated with
one of the treatment beams. This “field light” required placing a mirror in place to guide
the light in a path approximating the treatment beam’s path. This allowed accurate setup
of the machine before treatment. Thus, for field light setup, the mirror needed to be
placed in the path where one of the treatment beams would eventually go.
In order to get each of these three assemblies (scanning magnets or X-ray target or field
light mirror) in the right place at the right time, the Therac-25 designer placed them on a
turntable. As the name suggests, this is a rotating assembly that has the items for each
mode placed on it. The turntable is rotated to the correct position before the beam is
started up. This is a crucial piece of the Therac-25 machine, since incorrect matching of
the turntable and the mode of operation (e.g. scanning magnets in place but Electron
beam turned on high for X-ray) could produce potentially fatal levels of radiation.
Setup and Actuation
The Therac-25 operator sets up the patient on the table using the field light to target the
beam. In doing this, treatment parameters must be entered into the machine directly in the
treatment room.
He or she then leaves the room and uses the computer console to confirm the treatment
parameters (electron or X-ray mode, intensity, duration, etc.). The parameters initially
entered in the treatment room appear on the console and the operator simply presses
return to confirm each one.
The computer then makes the appropriate adjustments in the machine (moving the
turntable, setting the scanning magnets, setting beam intensity etc.). This takes several
seconds to do. If the operator notices an error in the input parameters, he or she can,
during the setup, edit the parameters at the console without having to start all over again
from inside the treatment room.
When the computer indicates that the setup has been done correctly, the operator presses
the actuation switch. The computer turns the beam on and the treatment begins. There are
three possible outcomes at this point, and they all depend on sensors on the machine. If
the sensors indicate no trouble, the treatment concludes successfully. If the sensors
indicate a minor problem, like the beam being slightly out of tune, the computer turns the
beam off immediately. The operator can then press a “proceed” key to retry the treatment
up to 5 times. If the sensors indicate a more serious malfunction, like the beam being
significantly stronger or weaker, the computer turns the beam off immediately and
requires the machine to be completely setup from the beginning.
What Therac-25 Software Did
Real-time Software
The software that ran the Therac-25 was real-time software. What does that mean?
Real-time software is software that interacts with the world on the world’s schedule, not
the software’s. For instance, software to keep a radio tuner on the signal of a drifting
station could take two approaches. It might simply update the signal every 0.1 seconds,
searching for the strongest signal within some bandwidth. Another approach is to include
a sensor that detects when the signal loses strength and only then search for a stronger
signal nearby. This latter approach is real-time. If senses the world and responds to
changes in the world when those changes occur.
This sort of software (even the simple system just described) is difficult to write and
maintain. First, it involves the software in reading and responding to sensors about the
state of “the world.” With Therac-25, these sensors indicated things like the intensity of
the beam, the position of various parts of the machine (e.g. the turntable) and commands
entered at the console by the operator. Sensors, of course, can go bad, or give incorrect
readings. When they do, the software needs to be able to detect these problems and
respond accordingly, or at least fail in a graceful manner that doesn’t endanger life.
In addition, when real-time software has to monitor more than one thing, changes in one
area may occur while the software is responding to changes in another. This is like the
situation of trying to divide your limited attention to all the things you need to monitor
when you are driving a car. While you are watching a red light up ahead, a car may have
slipped into your blind spot without you seeing it.
So, Therac software needed to track and respond to several things in real-time without
dropping any important balls. What those things are is described in the next section
Design of Software
The main tasks for which the software is responsible include:
Operator
o Monitoring input and editing changes from an operator
o Updating the screen to show current status of machine
o Printing in response to an operator commands
Machine
o monitoring the machine status
o placement of turntable
o strength and shape of beam
o operation of bending and scanning magnets
o setting the machine up for the specified treatment
o turning the beam on
o turning the beam off (after treatment, on operator command, or if a
malfunction is detected)
The Therac-25 software is designed as a real-time system and implemented in machine
language (a low level and difficult to read language). The software segregated the tasks
above into critical tasks (e.g. setup and operation of the beam) and non-critical tasks (e.g.
monitoring the keyboard). A scheduler handled the allocation of computer time to all the
processes except those handled on an interrupt basis (e.g. the computer clock and
handling of computer-hardware-generated errors).
As explained above, the difficulty with this kind of software is the handling of things that
might be occurring simultaneously. For example, the computer might be setting the
magnets for a particular treatment already entered (which can take 8 seconds) while the
operator has changed some of the parameters on the console screen. If this change is not
detected an incorrect treatment can be given. More dangerous is the possibility that the
change only affects the portion of the software that handles beam intensity, while the
portion of the software that checks turntable position is left thinking that the old treatment
parameters are still in effect.
Sensors on the Machine
The sensors in the machine reported on, among other things, the placement of the
turntable and the strength and shape of the beam. In the diagram below, you can see the
“transmission monitors” directly below the metal foils designed to produce X-rays. A
different monitor was required for X-rays than for the electron beam, and so these
monitors (they were ion chambers) were attached to
the turntable underneath either the X-ray foil of the
electron beam scanning magnets. No monitor was
placed below “field light assembly” and so no
measurement can be made of a beam in this position.
System Safety
Machine-Based Safety Mechanisms
As the diagram indicates, the Therac-25 linear accelerator was isolated in a heavily
shielded room. This shielding protected the operator (who might do as many as 30
treatments in one day) from the low-level radiation that might scatter from the machine.
In addition, the machine itself was shielded in many ways to reduce the amount of
scattered radiation it would emit. CMC was particularly proud of this innovation in
machine shielding, and even published a paper in a technical journal on its design.
Software Based Safety Mechanisms
Previous versions of Therac (Therac-6 and Therac-20) used software to make the hand
operation of the machine more convenient. But Therac-25 was completely software
controlled. In addition and safety checking was made the job of the software many of the
hardware safety interlocks were removed. Thus, the safe operation of the machine
became almost completely the responsibility of the software.
For example, intensity of the beam is monitored by ion chambers placed on the turntable.
There were two different ion chambers, one located beneath the scanning magnets that
spread the electron beam and one located beneath the foil that turned a high intensity
electron beam into X-rays. These chambers monitored the amount of radiation that was
being delivered to the patient in each mode (electron beam or X-ray) and each could
measure the beam intensity only within the expected range from the beam with which it
was paired. If the chamber detected a dose that was different from that assigned to the
patient, the software immediately suspended treatment.
If the difference was a minor amount or if the beam intensity was measured as hardly
there, the software might allow the operator to retry the treatment up to 5 times before
shutting down completely. This retry facility was added to the software because it was a
regular occurrence for the beam to be slightly “out of tune” and for the software to
suspend treatment.
If the beam intensity was detected to be quite different from the assigned intensity, the
software shut the machine down completely and required all the treatment parameters to
be entered again.
Safety Analysis of the System
In 1983, just after CMC made the Therac-25 commercially available, CMC performed a
safety analysis of the machine using Fault Tree Analysis. This involves calculating the
probabilities of the occurrence of varying hazards (e.g. an overdose) by specifying which
causes of the hazard must jointly occur in order to produce the hazard.
In order for this analysis to work as a safety analysis, one must first specify the hazards
(not always easy), and then be able to specify the all possible causal sequences in the
system that could produce them. It is certainly a useful exercise, since it allows easy
identification of single-point-of-failure items and the identification of items whose failure
can produce the hazard in multiple ways. Concentrating on items like these is a good way
to begin reducing the probabilities of a hazard occurring.
In order to be useful, a Fault Tree Analysis needs to specify all the likely events that
could contribute to producing a hazard. In addition, if one knows the specific
probabilities of all the contributing events, one can produce a reasonable estimate of the
probability of the hazard occurring.
Since much of the software had been taken from the Therac-6 and Therac-20 systems,
and since these software systems had been running many years without detectable errors,
the analysts assumed there were no design problems in the software. The analysts did
consider software failures like “computer selects wrong mode” but assigned them
probabilities like 4 x 10**-9. These sorts of probabilities are likely assigned based on the
remote possibility of random errors produced by things like electromagnetic noise. They
do not take into account the possibility of design flaws in the software.
