1. Therac-25

2. Issues Assuming the software cannot be wrong
Cryptic and unexplained error messages
Documentation was an afterthought
Inadequate testing
Assuming reliability is safety
No hardware safety locks
Concurrency of tasks is not synchronised
Too complicated and based on old code which relied on hardware safety locks
Assumed that old software has been tested many times and will be safe, but the software was designed for different hardware

3. Software bugs Shared variables Dataent and MEOS (Mode Energy Offset).
Solution: introduce another shared variable controlled by the keyboard handler that indicates entry is not complete
Setting magnets takes 8 seconds, the subroutine that changes parameters only works in the first second
Solution: change parameters after magnets instead of after ptime
Shared variables Class3 and F$mal (overflow bug)
Solution: each time Set Up Test runs set Class3 to a non-zero value instead of incrementing
If keyboard handler sets the Data entry complete flag before operator changes data in MEOS then Dataent won’t detect changes

4. Solutions Meaningful error messages that highlight dose rate
Software and hardware interlocks
Machine resets and settings checked after error
Potentiometer independent from software
Safe interface instead of lazy interface
Skipping entering data with carriage return
Resume without checks after error with P
Better to start again with clear design according to the hardware
Can’t eliminate all errors but can handle them in a way that doesn’t jeopardise the patient