Turner, university of california, irvine a thorough account of the therac 25 medical electron accelerator accidents reveals previously unknown details and suggests ways to reduce risk in the future. Thus, while the hardware interlocks on therac20 prevented software errors from causing problems, therac25 had no similar mechanism. On the surface, the primary reason that therac 20 killed far fewer people than therac 25 was the fact that therac 20 had hardware interlocks, while therac 25 did not. Therac6 and therac20 had histories of clinical use without computer control therac25 software had more responsibility for safety than in previous machines. Citeseerx document details isaac councill, lee giles, pradeep teregowda. The therac 25 accidents form the basis for what is often considered the bestdocumented software safety casestudy available. The investigation of aviation incidents and accidents is today recognised as a fundamentally important element of improving safety, and those responsible for investigations have come to be considered by national and international safety authorities as key partners, both on the policy and technical levels. She sat down at the terminal, and hit x to start the process. The aim is to concentrate atsbs resources on those investigations considered most likely to enhance aviation safety.
The therac25 accidents are the most healthy tissue. Therac25 was a medical tool used in cancer treatment. Accident investigation techniques outlines general terms, concepts and principles that will provide a solid foundation for conducting an effective accident investigation. A detailed accident investigation, drawn from publicly available docu ments, can be found. Accident investigation techniques provides an excellent roadmap how to conduct effective and meaningful accident investigations for those preparing to undertake their first accident investigation. However, in isolated events, where the accident causes appear to be unrelated to departmental management processes and controls, the bureau dasho may elect to use a trained investigator in lieu of the sait. The experience illustrates a number of principles that are vital to understanding how and why the design and analysis of safetycritical systems must be done in a methodical way according to established principles. A common mistake in engineering, in this case and in many others, is to put too much confidence in software. The machine administered radiation beams to destroy tumours without adversely affecting the treatment site. Yet consider this chilling description of an event involving the therac 25, a machine that performed both radiation treatment and xrays. Accidents and the most serious incidents, as defined by annex, have priority for investigation. Nancy leveson and clark turner, the investigation of the therac25 accidents, computer, 26, 7 july 1993 pp 1841. Essay on the therac 25 and its accident investigation school number june 2, introduction in 1983, a machine was released to help in the treatment of cancerous tumors through the use of high energy laser beams.
Between june 1985 and january 1987, the therac25 medical electron accelerator was involved in six massive radiation overdoses. A number of radiation accidents have occurred over the past 50 years involving radiation producing machines, radio. Raymond benjamin, secretary general, international civil aviation organization air safety through investigation journal of the international society of air safety. An investigation of the therac 25 accidents computer author. Therac 25 aecl designed therac 25 to use computer control from the start.
For accidents or incidents involving an aircraft of a maximum mass over 5 700 kg, states in charge of an annex investigation must make the final report available to icao. Investigation of crane accident and injury south timbalier. Nancy leveson and clark turner, the investigation of thetherac 25 accidents, computer, 26, 7 july 1993 pp 1841. The therac 25 software disaster the therac 25 is a computerized medical radiation therapy machine for cancer patients. The atsb investigates selectively, as do many equivalent organisations overseas. A detailed investigation of the factors involved in the softwarerelated overdoses and attempts by users, manufacturers, and government agencies to deal with the accidents is presented.
Many lessons can be learned from this series of accidents. The therac25 software disaster the therac25 is a computerized medical radiation therapy machine for cancer patients. Software in the therac6 and therac20 was reused in the therac25. The therac 25 was a computercontrolled radiation therapy machine produced by atomic energy of canada limited aecl in 1982 after the therac 6 and therac 20 units the earlier units had been produced in partnership with cgr of france. System compares manual settings with system values. Essay on the therac25 and its accident investigation school number june 2, introduction in 1983, a machine was released to help in the treatment of cancerous tumors through the use of high energy laser beams. A thorough account of the therac 25 medical electron accelerator accidents reveals previously unknown details and suggests ways to reduce risk in the future. Although the authors warn against drawing any oversimplified conclusions from these complex accidents, it appears clear to me that the root cause was the omission from the therac25 of the hardware safety interlocks of its safely operated predecessor, the therac 20, and the devices dependence for these functions on poorly written, hardly. The therac25 is a radiation therapy machine used during the mid80s. An investigation of the therac25 accidents cal poly computer.
A detailed accident investigation, drawn from publicly available docu. The machine namely therac25 was manufactured by a canadian company i. An investigation of the therac 25 accidents nancy g. With the aid of an onboard computer, the device could select multiple. Citeseerx an investigation of the therac25 accidents. Aircraft accident investigation bureau page 2 of 146 general remarks to this report in accordance with the agreement on international civil aviation icao annex the sole objective of the investigation of an accident or incident shall be the prevention of accidents and incidents. Investigation of crane accident and injury south timbalier block 185 ocsg 1569 march 21, 2000 gulf of mexico off the louisiana coast jack leezy freddie mosely david dykes u. The therac25 was a computercontrolled radiation therapy machine produced by atomic. Therac25 aecl designed therac25 to use computer control from the start. Thus, while the hardware interlocks on therac 20 prevented software errors from causing problems, therac 25 had no similar mechanism. The big picture the therac25 was a computerized radiation therapy machine 11 machines were installed us and canada in 19851987 there were 6 known accidents where massive overdoses were made patients died or suffered serious injuries these were traced to race conditions in reading operator input unique early investigation of safetycritical. Briefly, the therac 25 was a medical radiation therapy machine that was supposed to deliver controlled doses of radiation to cancer patients.
Air safety through investigation julyseptember 2014. I have received feedback from several junior safety professionals who have stated the book was a valueadded resource during the early stages in. Turner, university of california, irvine reprinted with permission, ieee computer, vol. Radiation accidents radiation accidents may be viewed as unusual exposure events which provide possible high exposures to a few people and, in the case of nuclear plant events, low exposures to large populations. Researchers who investigated the accidents found several contributing causes. Untitled the cognitive systems engineering laboratory at ohio. An investigation of the therac25 accidents part iv. A history of the introduction and shut down of therac25.
The therac 25 machine was a stateoftheart linear accelerator developed by the company atomic energy canada limited aecl and a french company cgr to provide radiation treatment to cancer patients. Atomic energy of canada limited aecl in conjunction with a french company. The technician got the patient set up on the table, and went down the hall to start the treatment. The term accident can be defined as an unplanned event that interrupts the completion of an activity, and that may or may not include injury or property damage. Cockpit voice recorder transcript of the december 12, 1999 accident of panda leasing iai 1124a westwind n50pl at gouldsboro, pa, usa. The therac25 was a computercontrolled radiation therapy machine produced by atomic energy of canada limited aecl in 1982 after the therac6 and therac20 units the earlier units had been produced in partnership with cgr of france it was involved in at least six accidents between 1985 and 1987, in which patients were given massive overdoses of radiation. An investigation of the therac25 accidents essay 10546 words. Professionalismtherac25 wikibooks, open books for an open.
Essay on the therac25 and its accident investigation instructor name school coursenumber june 2, 2015 introduction in 1983, a machine was released to help in the treatment of cancerous tumors through the use of high energy laser beams. It delivered two types of radiation beams, a lowpower electron beam and a highpower xray. The ambition of these guidelines is to reflect the state of the art in accident investigation as well to address its future challenges. An investigation of the therac25 accidents essay 10546. Turner, an investigation of the therac25 accidents, in ethics and computing. Use of formal methods for investigation of major accidents may support the investigators during the investigation process and in the presentation of results and recommendations. The second, higher energy mode, used the full power of the machine at 25 million electron volts. As noted earlier, the software for the therac 25 and therac 20 both evolved from the therac 6 software. Managing a major accident investigation in a small country.
Comparison of some selected methods for accident investigation snorre sklet the norwegian university of technology and science ntnusintef industrial management, n7465 trondheim, norway. The therac 25, like other medical linear accelerators including its predecessors therac 6 and therac 20, used highenergy electron beams to destroy tumors without damaging nearby healthy tissue. Department of the interior minerals management service new. An investigation of the therac25 accidents nancy g.
Scientific methods for accident investigation introduction most accident investigation authorities impose time and resource constraints, and we can all think of cases where the resulting pressure on investigators has caused poor quality reports. Computers are increasingly being introduced into safetycritical systems and, as a consequence, have been involved in accidents. It was involved in at least six accidents between 1985 and 1987, in which patients were given massive. Stories about the therac 25 have appeared in trade journals, newspapers, people magazine, and on televisions 2020 and mcneil lehrer news hour. Pdf investigation of alarmrelated accidents and incidents. The therac 25 was a computercontrolled radiation therapy machine produced by atomic energy of canada limited aecl in 1982 after the therac 6 and therac 20 units the earlier units had been produced in partnership with cgr of france it was involved in at least six accidents between 1985 and 1987, in which patients were given massive overdoses of radiation. Investigation of alarmrelated accidents and incidents in aviation article pdf available in international journal of aviation psychology 3. Accident investigation what was the status of their health.
Some jurisdictions provide guidance such as requiring that it must be conducted jointly, with both management and labour represented, or that the investigators. First, like the therac6 and the therac20, the therac25 is con. The book received favorable evaluations as the participants stated the book gave them the confidence to conduct a thorough accident investigation. Safety investigation of accidents is a field which is improving and expanding. Management management holds the legal responsibility for the safety of the workplace and therefore the role of supervisors and higher management and the role or presence. The case of the b737800, ethiopian flight 409, crashing off the coast of beirut lebanon january 25, 2010. Department of information and computer science authors. The therac25 and its accident investigation case study. The therac25 and its accident investigation case study 1. Therac 6 and therac 20 had histories of clinical use without computer control therac 25 software had more responsibility for safety than in previous machines.
Aug 08, 2010 the therac 25 is a radiation therapy machine used during the mid80s. The therac25 ion chambers could not handle the high density of ionization from the unscanned electron beam at highbeam current. Accident investigation practices results from a european study 2003 shaping public safety investigations of accidents in europe 2005 in addition, the esreda working group on accident investigation has organised two esreda seminars on accident investigation in 2003 jointly with jrcie in petten the. An investigation of the therac25 accidents nancy leveson, university of washington clark s. A brief summary of how therac25 actually operated is given as follows. This appendix is taken from nancy leveson, safeware. A regional distribution of the number of road accidents reveals that over half of all crashes occurred in khomas region 8,590 or 55. One of the serious mistakes that led to the multiple therac 25 accidents was the tendency to believe that the cause of an accident had been determined for example, a microswitch failure in the hamilton accident without adequate evidence to come to this conclusion and without looking at all possible contributing factors. Therac25 radiation therapy accidents ariane 5 rocket failure patriot missile system failure the therac25 accidents computerized radiation therapy machine designed in early 1980s resulted in six major accidents between june 1985 and january 1987 at least two deaths several serious injuries therac25 overview. A detailed accident investigation, drawn from publicly available docu ments, can. Aviation safety network accident investigation cvr. An investigation of the therac25 accidents part iii nancy leveson, university of washington clark s.
An investigation of the therac25 accidents computer author. Sait is the desired approach to investigation of serious accidents. The operators manual supplied with the machine does not ex. Manual of aircraft accident and incident investigation. Feb 17, 2014 the therac 25 accidents came at a time before many current practices were widespread, and serve as a cautionary tale for why such practices exist and are essential to creating safe systems. Therac25 radiation overdoses your expert root cause. Therac25, however, was developed by aecl alone when the two companies drifted apart after the joint development of therac20. Information and computer science, university of california, irvine, 1992.
The therac 25 was a computerized radiation therapy machine 11 machines were installed us and canada in 19851987 there were 6 known accidents where massive overdoses were made patients died or suffered serious injuries these were traced to race conditions in reading operator input unique early investigation of safetycritical. The therac25 software lied to the operators, and the machine itself could not detect that a massive overdose had occurred. Unfortunately, six accidents involving significant overdoses of radiation to. An investigation of the therac25 accidents computer. This provided the economic advantage of delivering two kinds of therapeutic radiation with one machine. Turner, university of california, irvine a thorough account of the therac25 medical electron accelerator accidents reveals previously unknown details and suggests ways to. Depending on whether the tumor was close to the skin or in deeper tissue, the therac 25 would operate in an electronbeam or xray mode. The user manual did not explain or even address the error codes, so the operator pressed the p.
The therac 25 was the most computerized and sophisticated radiation therapy machine of its time. As a result, several people died and others were seriously injured. On the surface, the primary reason that therac20 killed far fewer people than therac25 was the fact that therac20 had hardware interlocks, while therac25 did not. Turner, university of california, irvine a thorough account of the therac25 medical electron accelerator accidents reveals previously unknown details and suggests ways to reduce risk in the future. The therac25 machine was a stateoftheart linear accelerator developed by. An updated version of the original accident investigation paper by nancy leveson i have updated and changed slightly the original accident report. Information and computer science, university of california, irvine, 1992 59 pages. The therac25 software disaster essay 1293 words cram. The therac 25 accidents are the most serious computerrelated accidents to date at least nonmilitary and admitted and have even drawn the attention of the popular press. During the time span of june 1985 to january 1987, it was the source of six fatal or near fatal overdoses. Lawsuits were filed, and no investigations took place. Accident investigation forms part of the health and safety executives hse approach to health and safety management in its document hsg65 managing for health and safety. A thorough account of the therac25 medical electron accelerator accidents reveals previously unknown details and suggests ways to reduce risk in the future. An investigation of the therac 25 accidents volumes 92108 of technical report university of california, irvine.
The operators manual supplied with the machine does. Comparison of some selected methods for accident investigation. Therac25 accident historycontinued accidents continued in 1986 and 87 traced to operator behavior keyboard entry timing related several different software problems eventually implicated related to concurrency lack of lockingatomic operations for access to shared variables therac25 retrospective. This document promotes a plan, do, check, act approach, and the investigation of accidents and incidents is part of the check step and may highlight shortcomings in. Essay on the therac 25 and its accident investigation instructor name school coursenumber june 2, 2015 introduction in 1983, a machine was released to help in the studentshare our website is a unique platform where students can share their papers in a matter of giving an example of the work to be done. Accident investigation work processes, procedures, persons, and industrial relations environment of a particular situation. What is an accident and why should it be investigated. The first mode consisted of an electron beam of 200 rads that was aimed at the patient directly. It is not the purpose of this activity to apportion blame or liability. The therac 25 a case study in safety failure radiation therapy machine the most serious computerrelated accidents to date people were killed reference.
Osh basics what is an accident and why should it be. Turner slides adapted from the article and a graduate presentation by. The machine was developed by aecl,a canadian company that had worked which the french company, cgr, on the earlier therac models therac6 and therac20. After the tyler accidents, therac 20 users who had heard informally about the tyler accidents from therac 25 users conducted informal investigations to determine whether the same problem could occur with their machines. Software in the therac 6 and therac 20 was reused in the therac 25. An investigation of the therac 25 accidents nancy leveson, university of washington clark s. An investigation of the therac25 accidents stanford university.