Therac-25 Case Computingcases.org Safeware Start with what was known Therac-25 is a medical linear accelerator for use in treating cancer. At four of the hospitals using this machine, a series of mysterious complaints developed Hospital physicists and operators were informed by the manufacturer that these problems were either imagined by the patients or the result of operator error. For example, hospital physicist, Fritz Hager (East Texas Cancer Center in Tyler, Texas) received a complaint from a patient and consulted with engineers from AECL, the manufacturer of the T-25 He was told that there was no design flaw in the T-25 machine A few days after the unit was put back into operation, another patient complained of being burnt.
Hager said later in an interview that he thought he was going to lose his job. Something was clearly wrong and he had no idea of what it was. He sat down with the operator again to see if they could reproduce the sequence of events that led to the accident. Your job Practice decision-making from the standpoint of hospital administrators, hospital physicists, government regulatory agencies, and machine operators. Try to make this decision under the cloud of uncertainty before all the facts are in In this case, your decision is going to rest on whether to take a risk, which kind of risk to take, and where the burden of uncertainty accompanying the risk is distributed.
Cast of Characters Manufacturers Interest: reputation, financial gain Role: Design, tested, prepared for approval, manufactured, sold Therac units Atomic Energy of Canada Limited (AECL) Quality Assurance Manager Home office engineer Local (Tyler) engineer Software Programmer (licensed?) CGR (France) Dropped out after production of 20 unit in 1981
Cast of Characters Regulatory Agencies FDA (Food and Drug Administration) CRPB (Canadian Radiation Protection Bureau) Gordon Symonds head of advanced X-ray Systems Interest (Maintaining integrity in public eye) Role (Regulate new products for safety) Cast of Characters Hospitals
Kennestone facility in Marietta, GA (ETCC) East Texas Cancer Center, Tyler, TX (2) Hamilton, Ontario Hospital Yakima Valley Memorial Hospital (2) Interest Maintain good reputation; promote patient values of health and well being; maintain financial solvency Role Provide treatment options for patients; staff hospitals with doctors and nurses; equip with adequate medical technology Cast of Characters User Groups (Operators)
Put out user group newsletters Hospital Physicists Tim Still (Physicist at Kennestone) Eight problems with Therac-25 Poor screen-refresh subroutines Is programming safety relying too much on the software interlock routines? Fritz Hager (Physicist at ETCC) Consulted with AECL on suspected overdoses Helped operator reconstruct sequence that produced race condition Leveson, p. 539 Interest: job, reputation, professional dignity and integrity
Role: maintain treatment machines; supervise operators; respond to patient complaints Cast of Characters AECL engineers Designed and tested new units But not really responsible for maintenance (This was performed by hospital physicists) Sent to investigate complaints about units Quality Assurance Manager Software Programmer Are they responsible for collecting information on the use-history of the machines they designed?
Cast of Characters Cancer Patients Receive radiation therapy Shallow tissue is treated with accelerated electrons Deeper tissue is treated with X-ray photons Six patients received massive overdoses Three died directly from overdose Health and Well Being Some issues at this point Who is responsible for testing the software and hardware of the Therac-25 unit? What constitutes reasonable or normal efforts at testing and probing for errors?
Who is responsible for monitoring the operating history of these machines and collecting and coordinating possible complaints? Who is responsible for regulating these machines and other devices? Who is responsible for teaching operators how to use machines and maintenance? How can machines be operated in an efficient way without sacrificing patient health, safety, and well being? The Machine: Therac-25 Medical linear accelerators (linacs) Earlier Models: Therac-6 and 20 Therac-25 First prototype in 1976 Marketed in late 1982
What it does Leveson: Medical linear accelerators accelerate electrons to create high-energy beams that can destroy tumors with minimal impact on surrounding healthy tissue 515 Shallow tissue is treated with accelerated electrons the scanning magnets [were] placed in the way of the beam The spread of the beam (and thus its power) could be controlled by the magnetic fields generated by these magnets (Huff/Brown) Deeper tissue is treated with X-ray photons
Huff: The X-ray beam is then flattened by a device below the foil, and the ex-ray beam of an appropriate intensity is then directed to the patient. (requires foil and flattener) Beams kill (or retard the growth of) the cancerous tissue Therac-25 Hardware Features (Leveson 516517) Double Pass Electron Accelerator needs much less space to develop comparable energy levels folds the long physical mechanism required to accelerate the electrons Dual Mode
Turntable allows aligning equipment/accessories in different ways One alignment produces X-rays Another alignment produces electrons Third alignment (field light position) is used for targeting machine More computer control Speeds up alignment of turntable (equipment to accessories) Speeds up data entry (patient/dose/data) More patients/more time per patient Therac-25: Hardware controls to software
controls Machine functions that software had to monitor Monitoring the machine status Placement of turntable Strength and shape of beam Operation of bending and scanning magnets Setting the machine up for the specified treatment
Turning the beam on Turning the beam off (after treatment, on operator command, or if a malfunction is detected) Two features of Therac-25 to save time Retry Facility Controls pause treatment if there is a minor discrepancy between machine setting and dose entered Up to 5 retries are allowed before machine completely shuts itself down (in event of small discrepancies) Shut Down Facility If there is a major discrepancy, then the machine shuts itself down To restart, the operator must reenter all the treatment parameters Some operators used jumper cables to bypass this shutdown
feature Software Responsibilities Monitoring machine status Accepting treatment input Setting up machine for treatment Two Basic Operational Modes Treatment mode Service mode Software Components Stored data Calibration parameters for accelerator setup Patient treatment data
Scheduler Controls sequencing of all noninterrupt events and coordinates all concurrent processes Set of critical and noncritical tasks Critical: treatment monitor, servo task (gun emission, dose rate, machine motions), housekeeper task (system status, interlocks, displays messages) Noncritical: checksum, treatment console keyboard processor, treatment console screen processor, service keyboard processor, snapshot, hand control processor, calibration processor
Interrupt services Programming Issues Real-time software interacts with the world on the worlds schedule, not the softwares. Software is required to monitor several activities simultaneously in real time Interaction with operator Monitoring input and editing changes from an operator Updating the screen to show the current status of machine Printing in response to an operator commands
Chronology Modified from Computing Cases Chronology to the point where Hager has to make a decision. Chronology picked up at end of presentation. Date Event Early 1970s AECL and a French Company (CGR) collaborate to build Medical
Linear Accelerators (linacs), Therac 6 and 20. 1976 AECL develops the revolutionary double pass accelerator the basis of theTherac-25 model 1981 AECL and CGR end working relationship. March 1983 AECL performs a safety analysis of Therac-25, excluding analysis
of software. (Software assumed safer than hardware so safety functions delegated to software and hardware controls removed) July 29, 1983 Canadian Consulate General announces the introduction of the new Therac-25 machine December Marietta Georgia, Kennestone Reginal Oncology Center implements newT-25 unit 1984 Date
Event June 3, 1985 Marietta Georgia, KennestonePossible patient overdosed. Tim Still, hospital physicist calls AECL (Is overdose possible? AECL informs that it is not) July 26, 1985 Hamilton, Ontario--possible patient overdose. AECL is informed and sends service engineer to investigate. No coordination between Georgia and Ontario
Nov 3, 1985 Hamilton patient dies of cancer. But burn received in treatment would have eventually required hip replacement. Nov 6, 1985 Letter from CRPB to AECL requesting hardware interlocks and software changes. Letter also requested automatic treatment termination in event of malfunction with no option to proceed with single keystroke. Nov 18,
1985 Kennestone (possible) overdose victim files suit against AECL and Kennestone. AECL informed officially of lawsuit Dec 1985 Yakima Hospital (Washington) patient develops erythema on hip after one of treatments Date Event
Yakima staff sends letter to AECL and speaks with AECL technical support advisor. Still no coordination between different hospitals Feb 24, AECL technical support supervisor sends written response to 1986 Yakima claiming that T-25 unit not responsible for patient injuries. March Patient at East Texas Cancer Center (Tyler) receives possible 21-22, overdose. Fritz Hager calls AECL and arranges for Randy 1986 Rhodes and Dave Nott to test T-25. Nothing found. Jan 31, 1986
April 7 T-25 put back into operation after ETCC finds no electrical problem April 11 Second possible overdose at ETCC. Operator reproduces Malfunction 54. Hager informs AECL of results April 14 AECL files report with FDA. Sends letter to T-25 users with suggestions including removal of up-arrow editing key and to cover contact with electrical tape
The Socio-Technical System The Machine Supporting Systems (video, audio, etc.) Hardware Software Systems Hospitals and Clinics Doctors, Medical Physicists Management, User Groups Operators, Reporting Procedures Atomic Energy Canada, Limited Government Medical Device
Regulation Management, Reporting Procedures, Food and Drug Administration Design Teams, Sales Staff, Support and Field Engineers Canadian Radiation Protection Bureau Reporting Procedures Therac-25: STS Hardware/Software Medical linear accelerators (linacs)
Software takes over hardware controls and system safety Physical Surroundings Inside treatment room: Therac-25 unit; treatment table; intercom & TV camera; room constructed to contain radiation Outside treatment room: turntable position monitor; control console; printer; TV monitor; display terminal + keyboard; motion enable footswitch General hospital environment Therac-25 STS
People (individuals, groups, roles) Hospital physicists Unit operators (User groups) Cancer Patients Hospital Manufacturers: AECL and CRG Regulators: FDA/CRPB Engineers Lawyers (civil lawsuits) Therac-25: STS Procedures
Patient treatment procedures Data entry procedures including machine configuration Notification in case of patient complaint or lawsuit Correcting data input errors and re-inputing data Responding to treatment pauses and other interruptions of service Testing machines for safety (faulty tree analysis) Software testing and debugging) Laws and regulations Regulatory procedures: pre-market approval, pre-market
equivalence, and response to defective products Product recalls and Corrective Action Plans Data and Data Structures Entering treatment data Notification procedures in case of accidents FDA Pre-Market Approval Class I general controls provide reasonable reassurance of safety and effectiveness Class II require performance standards in addition to general controls
Class III Undergo premarket approval as well as comply with general controls Used earlier Therac models to show pre-market equivalence But this covered over three key changes: removal of hardware safety controls, delegation of safety from hardware to software, No testing of additional programming for Therac-25 layered on programming for 6 and 20 units FDA couldnt recall defective products Ask for information from a manufacturer Require a report from the manufacturer Declare a product defective and require a corrective
action plan (CAP) Publicly recommend that routine use of the system on patients be discontinued Publicly recommend a recall Testing the Machine for Safety 1983Fault Tree Analysis Specify hazards Specify causal sequences to produce hazards Software not included Software added onto existing software used in prior units Since these did not fail, assumed software was not subject to failure
Interview with Therac Unit Operator Did not consider possibility of software bugs Appreciated added speed of operation (more patients, more time with patient) Unclear error messages No industry-wide standards on whether, how, and how many times operators could override error messages Interview Lack of industry-wide certification of radiation unit operators ARRT provides test and licensing procedure But many hospitals hire non-ARRT certified operators
Operators pressured by many hospital administrators to push through a large number of patients Manufacturers charge large fees for Operator training sessions Software upgrades Machine maintenance contracts Decision Point A Physicists Dilemma The Therac-25 unit has been operating for several months now. Four concerns have arisen during this period. (1) The newest machine has dismantled many hardware safety controls and replaced them with software controls. AECL has provided assurance that this makes the machine safer because software safety controls are always more reliable than hardware
controls. But operators have protested that they would prefer more control over the configuration and operation of the machine. (2) At most hospitals, the patient and the machine are located in one room, but the operator works from another room when providing radiation treatments. This is safer for operators but is difficult to monitor treatment. Audio and video systems aid monitoring but past experience has shown that when these systems break down and the hospital is slow in getting them repaired. (3) Software controls have also reduced the time required to set up the machine for giving proper dosage. This time saved could be used to spend more time with the patients, but for hospital administrations, time is money they would prefer treating more patients. (4) Finally, operators argue that the computer interface with the Therac-25 unit does not provide inadequate information to guarantee safe patient treatment. For example, when a treatment pause occurs, only a generic error message flashes on the screen. Information on why the controls have paused treatment are never
given. Decision Point You supervise the radiation unit at your hospital. A patient has complained that he has received a radiation overdose during a treatment session caused by the malfunctioning of the Therac-25 unit. Construct an argument for or against the continued operation of the therac-25 units while investigating complaints. Integrate ethical, social and financial considerations into your argument. How does the informed consent of the patients enter into this situation? What role do safety and risk play?
Sources Nancy G. Leveson, Safeware: System Safety and Computers, New York: Addison-Wesley Publishing Company, 515-553 Nancy G. Leveson & Clark S. Turner, An Investigation of the Therac-25 Accidents, IEEE Computer, 26(7): 18-41, July 1993 www.computingcases.org (materials on case including interviews and supporting documents) Sara Baase, A Gift of Fire: Social, Legal, and Ethical Issues in Computing, Upper Saddle River, NJ: Prentice-Hall, 125-129 Chuck Huff and Richard Brown. Integrating Ethics into a Computing Curriculum: A Case Study of the Therac-25 Available at www.computingcases.org (http://computingcases.org/case_materials/therac/supporting_docs/Huff.Brown.pdf) Accessed Nov 10, 2010
Samuel Moore "Sam" Walton was an American businessman and entrepreneur born in Kingfisher, Oklahoma. He is best known for founding the retailers Walmart and Sam's Club. Have students discuss what they believe Sam Walton meant by this statement.
Ghetto residents frequently engaged in so-called illegal activities, such as smuggling food, medicine, weapons or intelligence across the ghetto walls. Some Jewish councils and some individual council members tolerated or encouraged the illicit trade because the goods were necessary to...
War on Poverty was the Economic Opportunity Act of 1964, to oversee a variety of antipoverty programs registration and voting. 1965 Elementary and Secondary School Act: Gave federal aide to public schools. The Social Security Act of 1965 authorized Medicare...
Tratamiento Intravitreal injection of bevacizumab in Eales disease. Küçükerdönmez C, Akova YA, Yilmaz G. Intravitreal bevacizumab may be effective as an adjunctive treatment of retinal neovascularization in patients with Eales disease. Ocul Immunol Inflamm. 2008 Jan-Feb;16(1):63-5.
An object's mass compared to its volume. On Earth we can sometimes use weight for mass. IV Density Facts. Things with HIGH Density: Bowling Ball Shot put. Big Marble. Things with LOWDensity: Soccer Ball Soft Ball. Ping Pong Ball. I...
Times New Roman Bradley Hand ITC Default Design Slide 1 Edouard Manet Boating Impressionism Slide 3 Paul Gaugain Tahitian Women on the Beach Post-Impressionism Slide 5 Claude Monet Waterlillies, Green Reflection Impressionism Slide 7 Vincent van Gogh Starry Night Post-Impressionism...
ethnorelativism. Vocabulary. We learn foundations of 'managing people' in IHRM: Issues related to approaches to staffing foreign ops. Reasons for international assignments. Types of international assignments.