Group F

Fatal Dose

If you have not already prepared for the Year 2000 problem, it is time to start cramming or risk a massive failure: computer crashes, accounting problems, lawsuits, maybe even patient deaths. First, hospitals need to make someone responsible for year 2000 compliance and give that person power, says Larry Martin, CEO of Data Dimensions in Bellevue, Washington. As part of the process, millennium bug hunters must decide which systems can be moved to the back burner. Suggestions include fund raising programs, transcription systems, and budgeting software. Materials management or scheduling systems may be strategically important, but if they crash, a hospital can revert to a manual system more easily than it could in the lab. Life-support machines, patient monitoring equipment, and infusion pumps should be given utmost attention.

Therac-25 is the name of the machine that was used to treat Katie Yarborough's cancer. At the time, in 1985, the machine was state-of-the-art equipment. By that time over 20,000 patients have already been treated with that machine. The machine would speed-up particles to convert a group of single electrons into a high-energy beam to destroy tumors on the skin or the same group of electrons could be converted to an x-ray beam to penetrate tumors under the skin.

Normally, when patients were treated, they were aimed at with this radioactive beam that cures the disease without producing any sensation to the patients. However, this was not the case with Katie Yarborough. This was her twelfth visit. Everything was fine before, but not this time. As soon as the technician turned on the electron beam, Katie felt a burning sensation at the spot where the radiation should have been aimed. When she complained to the technician, he denied the possibility of that happening. However, patient evidence (the victim’s skin) suggests otherwise.

In two weeks, Katie returned to the hospital because of tingling and increasing pain in her body. There was a red mark at the spot where the beam was aimed before. Yet, technicians still did not know how it was possible to burn anybody with the machine. "I can't understand what might have done it," said one of them. (Computers and Society, p 175) At first the doctors thought it was an overdose of the electron beam.

The effect of radiation depends on the dose that a person was exposed to and what organs were exposed. Therac-25 was supposed to expose Katie to 200 rads. One thousand rads can be fatal if it hits the entire body. Physicists later estimated that Katie received between 15,000 and 20,000 rads on that dime-sized space.

Yet, at that point the doctors were not sure what happened. The technician could not have done anything wrong because there were safety systems installed in the machine. Further tests of the machine showed that there was nothing wrong with it. There were a total of 5 machines in use at different hospitals. Moreover, manufacturers of the machine refused to address the problem. In addition to that, the manufacturers threatened the doctors not to complain about the problem unless they had good proof. The situation was made worse by the huge demand for machines of this sort. Thus, no one wanted to hear about problems.

"Over the next few weeks Katie Yarborough's body began to look as if a slow-motion gunshot had gone through her chest and out her back. The site where the beam had entered was now a hole. Over the next few months, surgeons tried to graft healthy skin over the wound but each time the grafted skin rotted and died. Her left arm became paralyzed except when it spasmed." (Computers and Society. P 176)

There was soon another accident involving another Therac-25 machine. Only seven weeks after the Yarborough's incident, another woman forty years of age received a dose that was estimated to be 17,000 rads to her hip. At this time, there was a larger patch of swelling and redness. The woman was hospitalized for her injury. Soon she died of cancer. However, an autopsy showed that if she had lived she would have needed a hip replacement. AECL, the producers of the machine, kept both of the accidents a secret.

An inspection was conducted on some machines to determine that a certain turntable mechanism was not working. "A revolving platform rotated by a motor, the turntable locks into two standard positions, one for an electron beam, one for an x-ray beam, and a third position, called the field-light position, which enables the technician to adjust the beam to a precise target. Once in place, micro switches let the computer know the turntable is properly positioned." (Computers and Society, p 176) During the inspection it was determined that the micro switches were not working properly. Thus, computer control was established over the switches to monitor their activity and confirm their state. Soon after, AECL distributed a letter praising the new and improved safety of their machine.

Three months later, Yakima Valley Memorial Hospital delivered a similar overdose of radiation to a hip of another woman. "This time the burn produced a striped pattern on the woman's body." (Computers and Society, p 176) Since the hospital was not aware of previous accidents, they started investigating the cause with other theories. The cause was not found due to AECL denial to disclose earlier cases. Therefore, the hospital decided to continue using the machine. However, physicists who used the machines kept in contact and were concerned with the problem. They wanted to get to the bottom of the problem. AECL was in their way.

Two more people died before anybody knew whom to blame for the accidents. Anybody in this class knows about computer bugs. Most common people know about them two. Funny stories about banks running bad computer programs brought us a good laugh. Once millions of dollars were charged to a person’s account who was deceased. However, when we are talking about programs that control people's lives, errors are not funny. On average a computer program will contain 1 error per 500 lines of code. Therac-25's program had 10,000 lines of code. That comes out to 20 errors. We depend on humans to write and test the programs and humans make mistakes.

The two deaths that resulted in the discovery of the error occurred one after another. The first victim was a patient treated for cancer after surgery. The machine that he went on was successfully used on 500 other patients before him. "Ray Cox lay on his stomach on the table in the treatment room, which was connected to the computer console room next door by an intercom and video monitor. On this day the intercom was broken and the video monitor was unplugged. The technician left the treatment room and shut the door. At the computer console she typed in the prescription data for an electron beam of 180 rads, then noticed she'd made an error by typing in command x (for x-ray treatments) instead of e (for electron). She ran the cursor up the screen to change the command x to e, as Cox's prescription required. She verified everything else and turned on the beam. The machine stopped and the computer screen flashed "Malfunction 54," a mysterious message not even mentioned in the Therac-25 manual. The technicians who operated the Therac-25 were used to computer glitches. Jonathan Jacky is a research scientist who has been developing software for a computer-controlled radiation machine at the University of Washington School of Medicine in Seattle. In a 1989 essay for The Sciences, he wrote that a therapist at Kennestone reported the Therac-25 typically issued up to forty error messages a day. It did so by displaying "Malfunction" plus a number, from 1 through 64. No explanation was offered by the computer nor was there any reference to the malfunction codes in the operator's manual. Technicians could, in most cases, bypass the irritating malfunctions simply by pressing the 'p' key, for 'proceed.' Doing so became a matter of habit. Inside the treatment room Cox was hit with a powerful shock. He knew from previous treatments this was not supposed to happen. He tried to get up. Not seeing or hearing him because of the broken communications between the rooms, the technician pushed the 'p' key, meaning 'proceed.' Cox was hit again. The treatment finally stopped when Cox stumbled to the door of the room and beat it with his fists. Cox's injury was similar to Katie Yarborough-a dime-sized dose of 16,500 to 25,000 rads. He was sent home but returned to the hospital a few weeks later spitting blood: the doctors diagnosed radiation overexposure. It later paralyzed his left arm, both legs, his left vocal chord, and his diaphragm. He died nearly five months later." (Computers and Society, p 177)

AECL told the hospital that the machine could not possibly overdose the patients and that they knew of no other accidents. Hospitals conducted investigations, but no matter how hard they tried they could not get the machine to do anything wrong. Thus, the therapy continued. Only four days after that "Malfunction 54" flashed again. The patient died three weeks later.

Two technicians stayed with the machine trying to recreate "Malfunction 54" by moving the cursor from the bottom line of the screen to the middle to change the treatment from 'x' to 'e'. Finally they got it. The speed with which instructions were entered into the machine made the difference. "Malfunction 54" meant that data was entered too fast. This meant that an x-ray beam would be started while the turntable was still in the electron position turning Therac-25 into a lethal weapon. AECL immediately notified all of the users not to use the cursor key without any explanations. The machine was still in use.

Therac-25 physicists met at a conference where they learned from one another about the problem and the previous accidents. AECL tried to edit the software to control the position of the cursor. However, the problem remained. Another patient was hit with 8,000-10,000 rads in the chest and the burn later formed the same striped pattern as in one of the previous accidents. The hospital stopped using the machine. It turned out that this and some previous accidents were cause by another software error. A part of the machine was supposed to regularly check the position of the turntable. "A zero on the counter indicated to the technician that the turntable was in the correct position. Any value other than zero meant that it wasn’t, and that treatment couldn't begin. The computer would then make the necessary corrections and the counter would reset itself to zero." The highest value the counter could register was 255. If the counter turned 256 that looked to the computer the same as zero. If the operator hits "proceed" at the moment when the counter was at 256, the patient would be hit with a raw beam without any filtering.

At this time AECL recommended that the machine should not be used. AECL proposed another software correction. However, doctors demanded that a hardware dose screen be installed that would spot the danger regardless of any other conditions. AECL made twenty-three software additions and installed a dose screen. The machine was tested and proven safe. However, some hospitals, upset by bitter experiences, refused to use the machine anyway. There have not been any accidents since. AECL was dissolved, renamed and is operating under a new name: Theratronics. (research)

Clearly until we invent some other technology for writing code, software glitches are inevitable. When a single person writes thousands of lines of code, the possibility for a minor error is very high. Code generation should be automated in some way. Visual compilers are achieving this to some degree. As a result of the above mentioned errors, the FDA now requires documentation on software developed for medical equipment. Safety standards have been established. However, human error will never end. Who knows what new errors have been made?