Therac-25

Issues Assuming the software cannot be wrong Cryptic and unexplained error messages Documentation was an afterthought Inadequate testing Assuming reliability is safety No hardware safety locks Concurrency of tasks is not synchronised Too complicated and based on old code which relied on hardware safety locks Assumed that old software has been tested many times and will be safe, but the software was designed for different hardware

Software bugs Shared variables Dataent and MEOS (Mode Energy Offset). Solution: introduce another shared variable controlled by the keyboard handler that indicates entry is not complete Setting magnets takes 8 seconds, the subroutine that changes parameters only works in the first second Solution: change parameters after magnets instead of after ptime Shared variables Class3 and F$mal (overflow bug) Solution: each time Set Up Test runs set Class3 to a non-zero value instead of incrementing If keyboard handler sets the Data entry complete flag before operator changes data in MEOS then Dataent won’t detect changes

Solutions Meaningful error messages that highlight dose rate Software and hardware interlocks Machine resets and settings checked after error Potentiometer independent from software Safe interface instead of lazy interface Skipping entering data with carriage return Resume without checks after error with P Better to start again with clear design according to the hardware Can’t eliminate all errors but can handle them in a way that doesn’t jeopardise the patient