Analysis of Therac-25 Radiation Overdose Accidents between 1985 and 1987 - Case Study Example

?Analysis of Therac-25 Radiation Overdose Accidents between 1985 and 1987 Introduction Research indicates that computers have increasing been introduced into safety-critical systems over the past few decades. However, some have been involved in fatal accidents. One such system-related accident in safety-critical systems is the Therac-25 incident that took place between June 1985 and 1987 killing at least six patients through overdose (Leveson 1995, p. 18). The Therac-25 is a computerized radiation therapy machine used for therapy purposes. Report also indicates that several patients suffered serious injuries during the accident. In fact, the Therac-25 accident has been described as the worst ever series of radiation accidents in more than three decades of accelerator medical history (Leveson 1995, p. 18). This paper seeks to present a detailed analysis of the Therac-25 radiation overdose accident in light of technologies and equipments involved, what caused the accident and its consequences. The essay will also explore measures that ought to have been taken to prevent the accident. The Therac-25 radiation overdose accident of between June 1985 and January 1987 has been described as the worst ever radiation accident in the history of medical accelerators. The accidents resulted from the radiation overdose caused by the Therac-25 therapy machine. Report indicates that at least six patients were overdosed in a span of about 2 years due to faults of the machine. Report indicates that the radiation overdose was several times the normal therapeutic dose resulting in severe burns and death, in some cases (Leveson 1995, p. 18). The first complaint of an accident was reported on June 3, 1985, when a female patient was placed on a 10-MeV electron treatment to clavicle area. However, few minutes after turning on of the Therac-25 machine, the patient complained of extreme force of heat on the body. It is then that the patient complained of having been burned by the machine. However, when contacted, the technician replied that it was impossible. However, despite the fact that there were no marks on the patient’s body, the treatment area felt warm by the touch. This signaled that something was indeed at a mess (Nancy and Clark 1993, p.19). The patient later sued the company for the accident. Nevertheless, the company still failed to investigate whether Therac-25 burned the patients or not. Shortly afterwards, the patient developed reddening and swelling at the area treated by the machine. The pain increased to a level that shoulder began freezing as spasms continued to appear. The patient’s condition continued to worsen, clearly indicating that the patient had suffered from radiation (Nancy and Clark 1993, p.19). A second series of the accident occurred at Ontario Cancer Foundation in 1985 just a week after the first patient had been overdosed at Kennestone. Report indicates that the Therac-25 at the Hamilton clinic had been in use for about six months (Leveson, Turner and Sarin 1993). However, on July 26, 1985, a patient aged 40 years old visited the hospital for the treatment of carcinoma of the cervix. Leveson, Turner, and Sarin (1993) indicate that the Therac-25 machine shut down barely five minutes after activation. This time around, the machine indicated an “H-tilt” error message. It also displayed a “no dose” and ‘treatment pause” (Nancy and Clark 1993, p.19). Despite these warnings, the operator went ahead to press the proceed button expecting the Therac-25 machine to deliver the right does this time around. Despite this being, a normal procedure since the machine had shown such faults before the machine still failed to operate. The procedure was repeated several time, but the machine showed suspend. The operator continued with the treatment after which the patient began complaining of a burning sensation on the treatment area, which she described as an “electric tingling shock” (Leveson, Turner and Sarin 1993). Other patients were successfully treated that day without accidents. The 42-year-old patient came back to the clinic three days later complaining of burning, hip pain, and massive swelling on the treatment region. Report indicates that the Therac-25 machine was taken out of service due to suspicion of radiation overdose. The patient was admitted a day later after the injuries suffered clearly showed that it resulted from radiation overdose. Unfortunately, the patient passed on November 3, 1985. Despite the death being blamed on virulent cancer, investigation revealed that the patient received between 13,000 and 17,000 rads (Coira 2003, p.6). Causes of the accident Overdose is mostly blamed on operator error. However, in the case of Therac-25 radiation overdose accident the scenario was different. This is after findings showed that the accident resulted due to errors in the Therac-25’s software and the failure of the manufacturer to follow the due software engineering practices. Research has found that the accident must have been caused due to a number of reasons discussed hereunder (Coira 2003, p.6). Overconfidence in software Findings show that overconfidence in the software’s ability to ensure safety of the Therac-25 was a prime contributor of the accidents. Analysis of the accident showed that the Therac-20, which is the Therac-25’s predecessor, used autonomous protective circuits and mechanical interlocks to prevent the occurrence of overdose. This proved effective since no accident has ever been reported involving the Therac-20 machine. However, Therac-25 relied heavily on software, which marked the beginning of the failure leading to the accidents. Moreover, even after the manufacturer began receiving reports of accidents due to overdose, it failed to reproduce the accidents, ignored the accident faults, implemented minor fixes then giving the machine green light to continue offering treatment to patients. However, this turned out not to be since the machined continued providing patients with radiation overdose that severe injuries and deaths in some cases (Nancy and Clark 1993, p.39). Poorly designed software The analysis of the accidents also showed that the design of the software itself was risky. Leveson, Turner, and Sarin (1993) noted that the Therac-25 supported a multitasking setting while the software allowed simultaneous access to shared data. Such a shaky implementation of software usually causes a program failure under certain conditions as was witnessed in the Therac-25. Analysis of the accident also reveals that the software used lacked self-checks, error-detection and error-handling features, which would have assisted in detecting coding errors and other inconsistencies (Leveson, Turner and Sarin 1993). The audit trail was also limited due to lack of memory. Based on how the accident occurred, we realize that patient reaction was the only indicator that something was at a mess with the Therac-25. This was because there were no thorough and independent checks carried out on the machines and software to show whether they were in good condition (Leveson, Turner and Sarin 1993). Such very verifications need not be left at the hands of operators, as was the case in this accident. Furthermore, the operators were not provided with a means with which to detect any error in the machine or the software. As a result, the operators were cheated by the Therac-25 resulting in the accident. Furthermore, the machine itself had no capacity to detect that a massive overdose had occurred thereby increasing the severity of the accident (Leveson, Turner and Sarin 1993). The ion chambers on the Therac-25 had no capacity to handle the high density of ionization from the unscanned electron beam. As a result, they became highly saturated giving an indication of a low dosage as evident in the first two accidents described earlier. Unrealistic risk assessment The assessment of the risk was also unrealistic right from the beginning. The risk assessment conducted by the manufacturer focused only on the hardware failure and not the software. This is evident from the fact that manufacturer only listed the possibility of the computer picking the wrong energy or mode as 1e-11 and 4e-9 respectively. However, the manufacture failed to justify this numbers. The worst thing, however, was the fact that the company accepted this shoddy risk assessment thereby resulting in the accidents experienced (Nancy and Clark 1993, p.39). Inadequate follow-up on the accident report The follow-through on the reports of the accidents was also unacceptable. For instance, after the first accident that occurred at Kennestone, the manufacturer attempted to reproduce the conditions that took place at the treatment. However, after failing, the manufacture concluded that the hardware error caused the accident. As a result, the manufacturer just implemented a solution based on the false assumptions he made of the cause of the first accident. In this regard, the manufacture claimed that the system was undoubtedly safe. However, this turned out not to be the case as accidents continued to happen from the use of the Therac-25 machine (Dale and Lewis 2012, p.21). Complacency Complacency also contributed hugely to the accident caused by the Therac-25 radiation machine. It normally takes an accident to make people vigilant of the subsequent dangers. This is common in all fields as was witnessed after the accident. Here, we realize that it took the manufacturer and operators of the machine a unusually long time to realize that something was not right with the machines and software in use (Leveson, Turner and Sarin 1993). In fact, the manufacturer, the operator, and the government only began to respond actively after the fist death had been reported; otherwise, no positive response could have been witnessed. This shows complacency of the highest order among the manufacturer of the machine, the operator and the government (Miller 1987, p.4). Certainly, other casualties could have been prevented after the first report of radiation overdose were it, not because of complacency. Inadequate software engineering practices The accident of Therac-25 revealed violation of a number of software engineering principles that caused the accident. The first principle violated is that which maintains that specification and documentation of software need not be an afterthought. Second is the principle that maintains that precise software quality assurance standards and practices should be established. Third is the principle, which states that means of detecting errors or obtaining information such as an audit trail needs to form part of the software right from the start. Fourth is the principle that holds that designs should be as simple as possible and avoidance of risky coding practices (Dale and Lewis 2012, p.22). However, the accident did not only occur due to manufacturer’s errors, but also operator error. Analysis indicates that the reuse of code from Therac-20 was hugely responsible for the accident that occurred at Tyler, TX. This error was purely operational in nature. It is reported that the error occurred when the machine operator attempted to switch X-ray to electron beam followed by immediate treatment of the patient. Experts claim that in case the operator would have been quick enough, then the beam would have been activated after the removal of the beam flattener but before shutting down the X-Ray beam (Dale and Lewis 2012, p.22). Furthermore, the operators failed to stop using the machine after the first Therac-25 machine had overdosed a patient. Stopping the use of the machine by the operators would have prevented many patients from suffering pains due to subjection in the machine for treatment (Miller 1987, p.4). Consequences of the Therac-25 radiation overdose accident As earlier indicated, the Therac-25 radiation accident is the worst series radiation accident in the history of medical accelerator. This is due to the number of casualties of the accident. Report indicated that the accident resulted in the overdose of six patients subjected to the Therac-25 radiation machine, killing three of them. The three that survived the accident are said to have suffered permanent disability. However, the injuries and deaths that resulted from this accident leave a lot to be desired since it could have been prevented immediately after the first accident (Neumann 1994, p.56). The accident also resulted in a lawsuit where Atomic Energy of Canada Limited (ACEL) manufacture of the Therac-25 and the hospital where the accidents occurred were jointly sued for negligence that resulted in the accidents. This proved costly to the defendants of the case that had to pay large sums of money in compensation for the injuries and loss of lives (Leveson, Turner and Sarin 1993). In addition, the accident dented the reputation of Therac-25 manufacturing company. It is notable that ACEL has a good reputation concerning the quality of its equipment. However, the reputation faded immediately after the failure of the machines that resulted in the accidents. Therefore, the company’s equipment also lost the market share as many hospitals shied away from purchasing ACEL’s equipment. The same also applied to the hospitals where the accidents happened. This follows a report that showed that the reputation of the hospitals where the accidents occurred were negatively affected as patients shied from seeking services of these hospitals for fear of undergoing similar consequences (Neumann 1994, p.56). How the incident could have been prevented From the analysis of how the incident occurred, a number of strategies exist that could be employed to prevent the accident. Firstly, manufacturers should have tested the machines and software before releasing it out to hospital for usage. This would have prevented the incident. This is because engineers who designed the machine were overconfident about the software arguing that the software could not fail whatsoever (Leveson, Turner and Sarin 1993). This made them ignore early advice that the software had developed a problem resulting in the overdose. The accident could also have been prevented if the software could have been fitted with defensive designs such as self-check, error detection and error-handling features. This is because the defensive design features would have alerted the operators in time thereby preventing the accident. In fact, patient reaction was the only sign that something was wrong; otherwise the problems could not have come into limelight (Neumann 1994, p.56). The incident could have been prevented if a thorough risk assessment could have been conducted before implementing the program. This is because the accident occurred because the manufacturer conducted unrealistic risk assessment (Neumann 1994, p.55). The risk assessment conducted was probabilistic, which generated undue confidence in the machine making manufacturers ignore many aspects of the software that needed thorough analysis. Therefore, thorough risk assessment would have revealed all faults in the software and the machine, which would have been corrected in time thereby preventing accidents like those, witnessed in the Therac-25. Finally, the incident could have been effectively prevented if the manufacturer could have adhered to all the software engineering practices. This is because the accident is because the accident may occur due to failure to adhere to the software engineering practices in developing and operating the machine. Lessons learnt from the module The Therac-25 incident demonstrated that several microconceptions in the attitude of manufacturers caused accidents. The model also shows that overconfidence in the ability of software, poor software design, unrealistic risk assessment, complacency, and poor response to complaints by manufacturers are to blame for the overdose. All this are human errors that can be prevented if proper measures are taken. As a result, companies need to understand that failure analysis and rigorous testing of software design are necessary in preventing incidence similar to Therac-25 incidence. In addition, we learn from the module that the implementation of software design requires a professionally trained software engineer and not just a reasonably experienced engineer. References Coira, E 2003, Guide to health informatics. CRC Press, London, U.K. Dale, N. B., & Lewis, J 2012, Computer science illuminated. Jones & Bartlett Publishers, New York. Leveson, N 1995, Medical devices: The Therac-25. University of Washington. P. 1-49. Leveson, N.G., Turner, C.S., & Sarin, P.D 1993, “An Investigation of the Therac-25 Accidents.” Viewed on 3 May 2013 http://www.onlineethics.org/Resources/19049/therac25.aspx. Miller, E.D 1987, The Therac-25 experience. In Conference of the state radiation control program directors. Pp. 2-19. Nancy, G. L., & Clark, S.T 1993, An investigation of the Therac-25 accidents. IEEE Computer, 26(7): 18-41. Neumann, P. G 1994, Computer-related risks. Addison-Wesley Professional, London, U.K. Read More