AECL Therac-25 made software-dependent interlocks a medical-device safety accountability test

Summary

• Six known Therac-25 accidents involving massive radiation overdoses occurred between June 1985 and January 1987. The surviving record documents severe injuries and deaths, but it does not support treating every later death as caused solely by the overdose or assigning one exact dose to each patient.
• Two distinct software paths are well established. Rapid editing of treatment mode and energy could leave displayed prescription data inconsistent with machine setup in the Tyler accidents. In the second Yakima accident, an 8-bit counter could roll over to zero and bypass a collimator-position check. The exact software path for the first three accidents remains unknown.
• The deeper control failure was architectural. Earlier Therac machines retained independent protective circuits and mechanical interlocks. The Therac-25 gave software greater safety responsibility and did not duplicate all of those protections, allowing a software error and associated system state to become a path to catastrophic exposure.
• Detection failed at several layers. Cryptic messages classified hazardous conditions as treatment pauses, dose monitors could saturate and display an apparent underdose, frequent nonhazardous interruptions trained operators to resume, treatment audit records were incomplete, and reports from different hospitals did not become a timely shared incident picture.
• AECL controlled the design, reused code, software documentation, hazard analysis, customer warnings and corrective-action plan. Hospitals controlled local operation, patient observation, equipment withdrawal and escalation. Regulators controlled defect findings, recall classification and approval of corrective action, but the United States reporting regime then depended heavily on manufacturers and did not impose the later user-facility duties.
• Repair evidence is substantial but bounded. The final corrective-action plan added computer-independent shutdown and turntable interlocks, changed pauses to suspends, improved messages, constrained editing, fixed known defects and required further testing and safety analysis. The public record does not contain a complete modern validation package, source history, all test results or long-term field-performance dataset.
• The durable lesson is not that medical devices must avoid software. It is that software must not be allowed to make a catastrophic condition reachable through one uncontrolled path. Independent barriers, hazard-led requirements, realistic interaction testing, actionable alarms, audit trails, rapid cross-site reporting and independently reviewable corrective-action evidence are all part of the safety case.

The famous bugs are evidence, not the whole explanation

Therac-25 is remembered because code and patient harm can be connected unusually clearly. That clarity is useful, but it can distort accountability if the investigation begins and ends with a race condition or an overflowing variable. A defect explains how a particular execution path behaved. It does not by itself explain why one path could place a high-energy beam in an unsafe configuration, why the physical system lacked an independent stop, why a console could report little or no dose after a massive exposure, why a trained operator was invited to proceed, or why warnings from several facilities did not promptly converge.

Nancy Leveson and Clark Turner's original investigation, published in IEEE Computer in 1993 and built from FDA material, Canadian regulatory records, letters and lawsuit depositions, is unusually explicit about its evidentiary limits. The authors could document six known accidents, two software mechanisms and a long corrective-action sequence. They could not obtain complete information about AECL's development management, quality controls or every event. Their account therefore supports a system-level finding without supporting every allegation that has accumulated around the case.

The official recall record provides an important independent anchor. The U.S. General Accounting Office's examination of selected device recalls lists the Therac-25 as a Class I recall involving five U.S. accelerators, dated 3 June 1987, and identifies two software defects capable of causing massive radiation overdoses. That record is narrower than the complete accident history. Leveson and Turner reported eleven installed machines, five in the United States and six in Canada. The GAO quantity should therefore be understood as the U.S. recall population in its dataset, not as the number of Therac-25 units worldwide.

This distinction points to the central accountability question. A manufacturer cannot promise that safety-critical software will contain no defects. It can decide whether one defect is enough to produce catastrophic energy, whether a separate physical mechanism checks the machine state, whether the interface conveys danger, whether field evidence is retained and combined, and whether a corrective action addresses the class of hazard rather than only the most recently reproduced input sequence. Those were controllable design and governance choices.

The architecture transferred a physical safety function into software

The Therac-25 was a dual-mode medical linear accelerator. It could use accelerated electrons for shallower treatment or produce X-rays for deeper treatment. In photon mode, the machine needed a target and beam-flattening equipment in the beam path. In electron mode, it needed scanning and other equipment to spread and control the beam. A rotating turntable moved the relevant equipment into position. The physical danger was straightforward even if the implementation was complex: high beam power combined with the wrong turntable or collimator state could concentrate energy that should have been shaped, measured or blocked.

The turntable description preserved by MIT shows why an interlock was a safety barrier rather than a convenience feature. Three microswitches reported position to the computer. The computer positioned and checked the turntable. In the field-light position, a mirror used for patient alignment sat in the beam path and no ion chamber was expected because no treatment beam should be present. Traditional electromechanical interlocks had been used to prevent operation in an incompatible state. In Therac-25, software checks substituted for many of them.

That substitution represented a material change from the lineage on which AECL relied. Therac-6 and Therac-20 added computer control to machines that could operate independently and retained industry-standard hardware protections. Therac-25 was designed around computer control. Its software had greater responsibility for monitoring safe operation, while not all prior protective circuits were duplicated. The older Therac-20 later provided an accidental comparison: a related editing defect could trip fuses or breakers, but independent protective circuits prevented beam activation and no comparable patient exposure resulted.

Code reuse was not inherently the error. AECL reused structure and routines from earlier machines, and reuse can preserve tested behavior. The problem was that assumptions from a system with independent hardware protection crossed into a system where software had become part of the primary safety boundary. The surviving software-development account says the program evolved from Therac-6 code, was written in PDP-11 assembly language, and used a custom real-time executive with concurrent tasks and interrupt handlers. It also records sparse documentation and an FDA reviewer's concern that specifications and a software test plan were missing.

In a benign application, inherited assumptions may produce inconvenience. In a medical accelerator, they become hazardous when the new system removes the independent component that previously contained them. The relevant lifecycle question is not simply whether reused code had run for years. It is whether every safety assumption was re-established against the new hardware, new control authority, new operator workflow and new failure consequence. The public record does not show that such an integrated assumption review occurred before clinical use.

The pre-accident safety analysis did not test the new source of control

AECL performed a fault-tree safety analysis in March 1983. According to the investigation, it assumed that programming errors had been reduced through extensive testing and excluded residual software defects. It treated computer execution errors principally as consequences of hardware faults or random disturbances. Yet software now carried safety functions that hardware had carried in earlier machines. The analysis therefore gave little useful attention to the component whose authority had increased most.

This was not merely a quantitative problem. Assigning an extremely low probability to a vaguely described computer event cannot demonstrate that unsafe states have been identified. Deterministic software defects do not appear randomly like a worn component; they recur whenever the required state and timing align. If the analysis does not model rapid editing, shared-variable interactions, counter rollover, stale machine configuration, saturated monitors or contradictory displays, a small numerical result says little about those paths.

The later Therac-25 safety-analysis summary is evidence of a more serious review after the accidents. It used failure-mode and effects analysis, fault-tree analysis and software examination. It identified safety-critical functions including scanning, energy selection, beam shutoff and calibration, and it led to recommendations for computer-independent interlocks. Even that later analysis was candid about limits: code inspection could not provide high confidence in complex scanning and energy-selection functions. That uncertainty supported adding barriers rather than claiming that inspection had proved the code complete.

The supported inference is that the original safety case was structurally mismatched to the design. The public evidence does not establish who approved each assumption, what internal objections were raised, or whether cost was the decisive reason not to duplicate hardware protection. It does establish that the analysis excluded residual software errors while software was being trusted to prevent unsafe physical configurations. That is enough to locate the accountability issue at the system-design level without inventing a private motive.

Six accidents became one incident only after repeated harm

The chronology matters because each event changed what could reasonably be known. The consolidated event timeline begins on 3 June 1985 at Kennestone Regional Oncology Center in Marietta, Georgia. A patient receiving electron treatment reported intense heat and later developed severe radiation injury. The treatment printout was disabled, leaving no hard-copy treatment record. The hospital physicist asked AECL whether the machine could operate in electron mode without scanning; AECL replied that it could not. Accounts differed about when AECL received formal notice, but the company had official notice of litigation by November 1985. No timely investigation established the machine path.

On 26 July 1985, a patient at the Ontario Cancer Foundation clinic in Hamilton experienced repeated treatment pauses and an H-tilt message. The display indicated no dose, and the operator used the permitted proceed command several times. The patient suffered a major local overdose. AECL could not reproduce the event and suspected a microswitch fault. It redesigned the switch logic and made a very large safety-improvement claim even though its own account could not be firm about the cause.

Canadian officials and an independent consultant called for stronger changes, including an independent turntable-position check and treatment suspension for relevant malfunctions. AECL did not install the requested independent interlock at that stage.

In December 1985, a patient at Yakima Valley Memorial Hospital developed a striped skin reaction after treatment. Staff investigated other explanations and wrote to AECL on 31 January 1986. AECL replied on 24 February that neither a machine malfunction nor operator error could have produced the injury and referred to the absence of similar incidents. The first Yakima account shows why information control mattered: the facility did not know the full cross-site history and relied on the manufacturer's technical confidence. Only after the second Yakima accident did the first injury become recognized as a likely overdose.

On 21 March 1986, the first Tyler patient received electron treatment after an experienced operator rapidly corrected an initial X-ray entry. The machine displayed Malfunction 54, classified the condition as a treatment pause and showed an apparent underdose. The operator followed the normal workflow and proceeded. Audio and video links to the shielded treatment room were not functioning that day, delaying recognition of the patient's distress. AECL engineers initially could not reproduce the malfunction and again considered an electrical explanation.

After testing found no grounding problem, the clinic returned the machine to service on 7 April.

On 11 April, a second Tyler patient experienced the same Malfunction 54 after the same operator rapidly edited mode. This time the intercom worked and the operator stopped. The clinic physicist, Fritz Hager, took the machine out of service and worked with the operator until he could reproduce the sequence. Speed was the missing condition. Once AECL was told that the edit had to be performed rapidly, it reproduced the malfunction and measured a massive output. AECL filed an accident report with FDA on 15 April. FDA declared the device defective on 2 May and required a corrective-action plan.

On 17 January 1987, a second Yakima patient was exposed while the turntable was associated with the field-light setup. The console showed no treatment dose beyond earlier film exposures, the machine paused, and the operator could proceed. This was a different software path. AECL's preliminary reconstruction estimated thousands of rads per attempt, but exact delivered dose remains uncertain. The event showed that a Tyler-specific correction was not a complete safety case. FDA and Canadian authorities moved in February to recommend discontinuing routine use until permanent modifications were completed.

The chronology does not support a claim that one person ignored six identical alarms. The accidents occurred in different facilities, produced different messages and were not all technically understood at the time. It does support a finding that incident information remained fragmented, early conclusions of impossibility were too strong, and corrective action initially followed suspected components rather than the hazard class. Each additional event should have reduced confidence in the premise that software and existing checks made overdose impossible.

Tyler exposed a timing-sensitive inconsistency between screen and machine

The Tyler trigger was not simply that the operator typed too fast. The operator entered a treatment mode, moved to the command line, returned to edit mode and changed the entry from X-ray to electron within the period in which the machine was setting bending magnets. The screen reflected the correction. Concurrent software tasks did not reliably propagate the edited state to all machine parameters.

The detailed Tyler software reconstruction describes shared variables used by the keyboard handler, data-entry routine and treatment-control tasks. A completion flag indicated that the cursor had reached the command line, not that editing had truly finished. Another flag associated with magnet setup was cleared too early, so later edits could escape recognition. The low and high bytes of a mode-and-energy variable could influence different tasks. Under the required timing, turntable or collimator positioning could follow the edited value while other operating parameters remained derived from the earlier X-ray selection.

The direct trigger can therefore be stated narrowly: a rapid edit within a specific window allowed inconsistent state to pass into treatment. The defect was reproducible only when the workflow was performed at realistic expert speed. A slow engineer following a written sequence could miss it. This is why the clinic physicist's reconstruction mattered. He treated operator expertise as a test condition rather than as evidence of misuse.

The unsafe outcome required more than the race. The software did not perform a final independent consistency check between displayed treatment, machine configuration and beam parameters. Hardware did not independently block the incompatible configuration. The ion chambers saturated under the intense pulse and could report a low value. The machine labeled the event as a pause and made a one-key restart available. The operator had been conditioned by many harmless pauses to use that command. In the first Tyler event, broken room monitors removed a last human detection channel.

Calling the operator action the cause would reverse the control relationship. The interface intentionally supported fast entry and editing because operators had requested efficiency. The proceed key was the specified response to a pause. The operator's speed and familiarity were foreseeable characteristics of the intended use environment. They triggered a defect, but AECL controlled whether that interaction could create a dangerous machine state and whether the state would be independently stopped.

Yakima exposed a different path through counter overflow

The second Yakima mechanism occurred later in the control logic. A one-byte variable used in repeated setup checks was incremented on each pass. Because it could represent only 256 states, it rolled over to zero on every 256th pass. Zero was also used to mean that no upper-collimator inconsistency required checking. If the operator issued the set command at the rollover moment, the position check could be skipped and treatment could proceed with the turntable still in an unsafe field-light-related state.

The original reconstruction of the Yakima flaw distinguishes this from Tyler. The concurrent Housekeeper task would perform the collimator check only when the shared Class3 variable was nonzero. Set-Up Test incremented that variable hundreds of times while waiting for machine setup. At rollover, the software bypassed the check. AECL's immediate code correction was to set the variable to a fixed nonzero value instead of incrementing it.

Again, the coding change fixed the identified trigger but did not by itself establish safety. A safety-critical status value shared between concurrent tasks should not silently combine a counter and an authorization state. More importantly, no independent physical barrier prevented beam activation while the turntable configuration was wrong. The final corrective action therefore needed both a code correction and a turntable interlock that did not rely on the same software path.

The surviving record does not identify the exact code path for Kennestone, Hamilton or the first Yakima event. There was contemporary speculation that Hamilton may have resembled the second Yakima mechanism, but Leveson and Turner marked that as speculation. It remains possible that unknown races or other defects were involved. A disciplined account should not retrofit the two later mechanisms to every earlier injury merely because the physical outcome looked similar.

That unknown is not exculpatory and should not be filled with certainty. It shows why the architecture mattered. When several unknown software paths can reach the same catastrophic state, proving and patching one defect at a time is an inadequate control strategy. An independent barrier can contain both known and unknown paths. This is the practical value of defence in depth: it reduces the safety case's dependence on complete knowledge of software behavior.

The interface converted contradictory danger signals into routine work

The Therac-25 operator interface distinguished between a treatment suspend, which required a reset, and a treatment pause, which allowed a one-key proceed command. It also generated frequent malfunctions that were ordinarily associated with inconvenience or underdose. Operators learned from repeated experience that pausing and proceeding was normal. Training reinforced confidence that multiple safety mechanisms made overdose virtually impossible.

In the accidents, that operating model failed in several ways. Malfunction numbers were cryptic and were not adequately explained in available manuals. A severe dose-related condition could be presented with low priority. Saturated monitoring hardware could report an apparent underdose precisely when output was dangerously high. The console could show verified or beam ready even though the physical configuration and internal parameters were inconsistent. The machine allowed repeated exposure without forcing a new prescription or an independent check.

These are not separate cosmetic defects. An alarm is a control only if it helps the operator distinguish a hazardous state and take the correct action. A low-priority pause that permits immediate continuation is an authorization. A display that understates delivered dose changes the operator's decision. A verified message is a safety claim. When those signals conflict with a patient's report of burning or with a physical monitor, the system must direct users toward the more conservative interpretation.

The IAEA's later lessons from accidental radiotherapy exposures formalize this principle without making a retroactive legal finding about AECL. They call for investigating inconsistent signals, assuming the more serious indication until disproved, designing and testing for the clinical human-machine environment, training staff to interpret abnormal displays, and using multiple protective layers. Therac-25 demonstrates why those elements belong to the engineering system rather than being left as personal vigilance.

Practical control was distributed, but it was not equal

AECL had the widest preventive control. It selected the hardware and software architecture, chose which interlocks to retain, controlled source code and documentation, set the meaning and priority of alarms, designed the restart behavior, performed the initial hazard analysis, received field reports, issued customer notices and proposed corrective action. It also controlled whether users and regulators received a complete cross-site picture. Those powers made the manufacturer the principal owner of systemic design and incident-learning risk.

That does not make hospitals passive. Facilities controlled whether room audio and video worked, whether treatment printouts and audit functions were enabled, how recurring faults were logged, when equipment was withdrawn, how quickly a medical physicist investigated, and what was reported to state or federal authorities. The first Tyler event shows a local detection failure: the audiovisual link was unavailable and treatment later continued. The second Tyler event shows effective local control: the operator escalated, the physicist stopped use and the facility reconstructed the trigger.

The first Yakima investigation shows the limit of local expertise when the manufacturer denied that the device could produce the observed harm and other sites' evidence was unavailable.

Operators controlled data entry, patient setup and the immediate decision to proceed after a pause, but they did not control the hidden concurrency model, alarm classification, saturated dose-monitor behavior or missing independent interlocks. Their actions should be assessed against intended workflow and available information. A trained user rapidly correcting a common entry error is not an unforeseeable adversarial input. Pressing the command the interface offers for a treatment pause is not proof that the user accepted an undisclosed overdose risk.

Medical physicists had important diagnostic power. Hager's work in Tyler supplied the reproducible sequence that neither routine service testing nor an initially slower engineering reconstruction had found. Users also formed a group, exchanged information and pressed for hardware changes, better messages, independent software review and an audit trail. Yet they lacked source access and did not receive a complete record early enough to act as a coordinated safety network.

Regulators controlled legal findings and the corrective-action gate. FDA could declare the radiation-emitting product defective, require purchaser notification and review AECL's corrective-action plan. Canadian radiation authorities could demand compliance and recommend discontinuing use. They did not operate the treatment rooms or write the software, and the U.S. reporting system did not yet require user facilities to report as later law would. Their accountability concerns whether warnings were collected, authority was used promptly, proposed fixes were challenged and closure depended on evidence rather than assertion.

Patients had the most direct evidence of harm and the least system control. Several immediately reported heat, burning or shock-like sensations that contradicted machine displays. They could not inspect machine state, obtain a cross-site incident history or disable a design feature. A safety system that treats patient testimony as less credible than a display known to be capable of saturation places evidentiary power with the least reliable signal.

Detection failed before response failed

It is useful to separate detection from response. Detection failure occurred when the system did not preserve or interpret evidence that an unsafe event had happened. Missing hard-copy treatment data at Kennestone, saturated ion chambers, low or zero displayed dose, cryptic malfunction codes, incomplete manuals, disabled room monitoring and inability to reproduce timing-sensitive sequences all reduced observability. Cross-site fragmentation meant that each clinic could appear to be experiencing an isolated anomaly.

Response failure began when available evidence did not trigger a sufficiently broad precaution. After Hamilton, AECL addressed suspected microswitch logic and reduced the number of permitted retries, but did not install the requested independent position interlock or convert all relevant pauses to suspends. After the first Yakima report, the company stated that machine malfunction and operator error could not have caused the injury. After the first Tyler accident, failure to reproduce Malfunction 54 supported an electrical hypothesis and the machine returned to use.

Those actions were understandable only if the existing safety model was trusted more than the adverse evidence.

The sequence reveals a recurring epistemic error: inability to reproduce was treated too much like proof of impossibility. Timing-sensitive concurrent software can be deterministic and still evade a test that does not recreate timing, workload and expert interaction. A negative result should reduce or redirect a hypothesis, not close the hazard when consequences are severe and physical injury is consistent with excess exposure.

Communication was itself a control. A user who knew about Kennestone, Hamilton and Yakima would evaluate Malfunction 54 differently from a user told there were no overdose events. A regulator that received timely manufacturer and facility reports could identify a pattern sooner. A service engineer with exact audit logs could distinguish a configuration mismatch from an electrical transient. The absence of that shared evidence increased the time during which unsafe operation remained plausible.

The supported inference is that earlier aggregation and conservative escalation could have shortened exposure to the hazard. The public record cannot determine whether any specific later accident would certainly have been prevented, because the exact early mechanisms remain unknown and treatment needs differed. It can show that the institutions with information and control had opportunities to stop routine use, add independent barriers or issue stronger warnings before January 1987.

The reporting regime was a contributing condition, not a complete excuse

At the time of the first accidents, U.S. medical-device reporting depended heavily on manufacturers and importers. Hospitals and health professionals were not yet subject to the later federal user-facility reporting duty. The Tyler reports reached FDA through the Texas health department before AECL's detailed medical-device report. That structure made the federal early-warning system vulnerable to local uncertainty and manufacturer information flow.

The weakness was not merely theoretical. GAO's contemporaneous 1986 review of medical-device underreporting found serious gaps in how hospitals, manufacturers and FDA communicated device problems and recommended stronger reporting relationships. Its later review of FDA's medical-device reporting implementation found deficiencies in compliance assessment, data processing and documentation of how reports led to corrective action. A 1989 GAO congressional testimony concluded that the reporting system did not provide the intended early warning and that FDA's statutory authority over recalls was limited.

Congress changed the framework after the accidents. The Safe Medical Devices Act of 1990 required device user facilities to report information reasonably suggesting that a device caused or contributed to a patient death or serious injury, established reporting deadlines, and expanded correction, removal and recall authorities. That law is evidence of a later policy response to broad surveillance weaknesses. It should not be described as a judicial finding that the Therac-25 accidents caused every provision, nor should its later duties be applied retroactively to hospitals in 1985.

Canadian authority operated through a different structure. The Radiation Emitting Devices Act prohibited sale, lease or import of devices that failed applicable standards or created specified radiation risks and provided inspection, notification and regulatory powers. The Canadian Radiation Protection Bureau requested hardware and software changes after Hamilton and later coordinated with FDA on discontinuing routine use. The record still shows delay between the first requested independent interlock and installation through the final corrective action.

Regulatory fragmentation also matters in the United States. The NRC's current description of radiation jurisdiction explains that states regulate radiation-producing machines such as X-ray machines and particle accelerators, while federal agencies have distinct roles. Therac-25 therefore involved hospitals, state radiation authorities, FDA and Canadian bodies. Distributed jurisdiction is not necessarily defective, but it requires an explicit route for a local treatment anomaly to become a national and cross-border product signal.

Root cause, contributing conditions and triggers must remain separate

The direct Tyler trigger was rapid editing within a timing window. The direct second Yakima trigger was a set action at the moment an 8-bit variable rolled over to zero. Those events selected unsafe paths in the software. They are not the root cause because neither explains why the path had authority to activate hazardous energy without an independent stop.

The central root-cause proposition supported by the record is architectural and organizational: safety responsibility shifted from independent hardware interlocks toward software without a hazard analysis, software lifecycle, integrated validation, interface design and incident-learning system commensurate with the possible harm. The design allowed one software-controlled chain to set configuration, judge consistency, present status and authorize treatment. Common dependence defeated the appearance of multiple checks.

Contributing engineering conditions included reused routines whose assumptions were not shown to have been revalidated in the new architecture; shared variables and concurrent tasks with unsafe state semantics; lack of a final consistency check; monitors that could saturate; malfunction handling that allowed restart; cryptic messages; sparse software documentation; and test practices that initially failed to include realistic expert-speed editing. The original fault tree's treatment of software reduced the chance that these paths would be examined before deployment.

Contributing operational conditions included frequent benign pauses, operator training that emphasized the abundance of safety mechanisms, missing or disabled audit and room-monitoring channels, and facilities' limited ability to compare incidents. A local decision to resume operation mattered, but it occurred inside an information environment designed and influenced by the manufacturer.

Contributing governance conditions included weak incident follow-through, strong claims of impossibility or enormous safety improvement without a reproduced root cause, incomplete propagation of adverse information, corrective-action submissions that lacked requested software detail and test plans, and delay in converting recommendations for independent hardware protection into installed barriers. The FDA record quoted in the investigation shows repeated requests for documentation, interaction analysis, meaningful messages and installation testing.

Response failure should also be separated from recovery failure. Response was slow when machines continued routine clinical use while the hazard remained uncertain. Recovery became a separate challenge when multiple CAP revisions were required and modifications identified new uncovered subsystems. A fix that cannot be installed, tested and verified consistently across every unit is not yet a recovered fleet.

Impact cannot be reduced to one dose or one death count

The confirmed impact is severe. Six known accidents involved massive overdoses. Patients experienced radiation injury, disability, prolonged pain and deaths in temporal and, in some cases, medically documented association with the exposures. Two Tyler patients died from overdose-related injury according to the investigation. The second Yakima patient had terminal cancer before the accident and died after suffering overdose complications; survivors alleged that exposure shortened life and increased suffering, and the claim settled.

The Hamilton patient died from an aggressive cancer, while the autopsy record identified serious radiation damage that would otherwise have required major treatment.

Exact dose claims must remain qualified. The machine's ion chambers saturated, different facilities reproduced different outputs, pulse rates varied, and some sessions lacked hard-copy data. Post-event simulations produced ranges rather than direct measurements. The article therefore does not convert every estimate into a measured patient dose or compare local exposure with whole-body lethality as if the biological effects were equivalent.

The operational impact extended beyond the six patients. Eleven facilities depended on a device whose safe state could not be established from its own display. Clinics had to suspend or constrain treatment, inspect machines, change workflows, join user meetings and manage patients needing ongoing therapy. Operators and physicists carried the burden of reconstructing behavior without source access or complete incident information. Regulators and users spent more than two years moving from the Tyler discovery to the final safety analysis.

Legal and financial impact is less measurable. The source investigation records several lawsuits and out-of-court settlements, but the public primary record reviewed here does not provide a merits judgment allocating liability, complete settlement terms, insurer payments or aggregate damages. A settlement confirms dispute resolution, not adjudicated negligence or an admission. It would be misleading to turn private outcomes into a precise corporate cost or legal holding.

The broader systemic impact was a change in what evidence medical-device safety required. Later law strengthened adverse-event reporting and recall authority. Later regulation added design controls. Modern guidance demands risk-based software documentation, validation and human-factors work. Therac-25 is relevant to those controls, but relevance is not proof that one accident series alone produced the entire modern regime.

Corrective action moved from a keycap workaround to independent barriers

AECL's first post-Tyler user instruction focused on disabling the cursor-up key, including physically preventing its use, so that operators would re-enter the entire prescription. FDA rejected that notice as inadequate because it did not explain the defect or hazard and its tone did not communicate urgency. This is an accountability distinction between an operating workaround and a safety repair. A workaround can reduce one trigger while leaving users unable to judge residual risk.

The first formal corrective-action plan in June 1986 went further. It proposed fixing the Tyler behavior, changing pulse monitoring, turning many malfunctions from pauses into suspends, adding a circuit to inhibit the modulator after an excessive pulse, limiting edit keys and revising manuals. FDA agreed with the direction but repeatedly requested more software documentation, interaction analysis and a detailed test plan. AECL initially responded that no single software test plan and report existed because hardware and software had been exercised over years.

The regulatory and user-response record shows why the CAP required five revisions. FDA objected to retaining pause behavior for dose-rate and beam-tilt faults, required meaningful messages and wanted rigorous testing of every future software modification. After the second Yakima accident, the agency concluded that software alone could not assure safe operation. Canadian authorities reached a parallel position. Routine use was discouraged while permanent changes were developed.

User participation materially improved the plan. At a March 1987 meeting, users, AECL, FDA, Canadian regulators and technical representatives reviewed all six accidents. Users asked for independent software evaluation, source access, a hard-copy audit trail and additional hardware modifications. The record says source code was not provided and memory constraints were cited against an audit option. Those decisions left some transparency gaps, but the meeting created a direct mechanism to test AECL's proposal against clinical experience.

The final CAP in July 1987 changed the architecture and operation. Dosimetry interruptions became suspends rather than resumable pauses. Operators had to re-enter parameters. Single-pulse shutdown protection was added, including hardware protection described earlier in the process. Turntable-position and bending-magnet interlocks were added. Beam activation was blocked when the turntable was in field-light or an intermediate position.

Cryptic malfunction codes were replaced with meaningful messages, editing behavior was constrained, known Tyler and Yakima defects were fixed, manuals were revised and numerous other software changes addressed faults found during review.

FDA approval was conditional on final test results, an independent safety analysis, revised documentation and installation completion. The later safety analysis identified additional safety-critical subsystems not fully covered by an earlier CAP revision, demonstrating the value of reviewing the hazard beyond the reproduced bugs. Its recommendations added computer-independent protection for scanning and energy selection and continued software maintenance into later releases.

The GAO recall record classifies the U.S. action as Class I, the category reserved for a reasonable probability of serious adverse health consequences or death. It dates the recall to 3 June 1987, while the narrative shows a process extending before and after that administrative date. A recall date, CAP approval, installation and final safety-analysis report are different milestones. Treating any one as the instant of repair would obscure how long assurance took to assemble.

Repair evidence is real, but a modern reader cannot reproduce the full safety case

The strongest repair evidence is the change from common software dependence to independent physical protection. A hardware shutdown after one excessive pulse and independent checks of turntable, scanning and energy-selection state can contain software defects that have not been discovered. Suspends prevent an operator from repeatedly authorizing an unresolved dosimetry condition. Better messages improve detection. Installation testing and future modification protocols reduce the chance that a correct design is copied or configured incorrectly.

Regulatory challenge is another form of evidence. FDA did not accept the first user notice or first CAP as sufficient. It requested specifications, test plans, interaction analysis, clearer diagrams, future-modification testing and installation verification. It identified contradictory test data and required an independent safety analysis. Canadian authorities and users pressed for hardware barriers. This record is stronger than a manufacturer announcement standing alone.

The public record nevertheless stops short of a complete reproducible assurance package. It does not expose the full source tree and version history, all pre- and post-modification requirements, every test input and expected result, coverage of timing and rollover states, independence analysis for each interlock, installation records for every unit, unresolved defect log, or long-term field data by software and hardware version. The final analysis summary itself says inspection could not provide high confidence for some complex functions.

Absence of another publicly documented Therac-25 catastrophe after retrofit is consistent with effective repair, but it is not a controlled test. The fleet was small, use changed, machines aged out and public reporting was imperfect. The defensible conclusion is that the CAP materially strengthened the system and specifically blocked the known catastrophic paths. The stronger claim that every hazardous software path was found and eliminated is neither necessary nor supported.

Later law and standards show what evidence was missing, not what was legally required in 1985

The United States did not have the later design-control framework when Therac-25 entered use. The 1990 statute expanded reporting and recall mechanisms. FDA's 1996 Quality System final rule, effective in 1997, added preproduction design controls after studies found design deficiencies behind a substantial share of recalls and software-related failures. Those later rules should not be presented as requirements AECL violated before they existed. They are a benchmark for identifying the control categories that the historic record lacked.

FDA's General Principles of Software Validation later described validation as lifecycle evidence rather than a final test event. The agency's current premarket guidance for device software functions calls for documentation proportionate to risk, including architecture, requirements, hazard analysis, verification and validation, revision history and unresolved anomalies. The purpose of citing these documents is comparative: they make visible the artifacts a present-day reviewer would expect but cannot find in the surviving Therac-25 record.

Modern human-factors expectations also address the interface path. FDA's human factors and usability guidance treats intended users, use environments, critical tasks and use-related hazards as design inputs. Under that approach, fast correction by an experienced operator, frequent pauses, ambiguous messages and a one-key proceed command would be tested as part of the safety problem, not dismissed as behavior outside engineering control.

FDA recognizes IEC 62304 as a medical-device software lifecycle standard. Its process framework does not guarantee safe software and does not validate a final device by itself. It does require a maintained development and maintenance process that makes requirements, risk controls, configuration, problem resolution and change impact more auditable. That is directly relevant to code inherited across Therac generations and later patched through several CAP revisions.

As of the article's publication date, FDA's Quality Management System Regulation has been effective since 2 February 2026 and incorporates ISO 13485:2016 by reference. It gives current regulators a broader quality-management and inspection framework, including design and development, complaint investigation and records. It is evidence of the current accountability baseline, not proof of what an inspection would have found at AECL four decades earlier.

The reporting framework is also now more explicit. FDA's MDR regulation history traces the post-1990 expansion to user facilities, and its current reporting overview distinguishes manufacturer, importer and facility duties. Better rules improve the chance that one hospital's anomaly becomes a product signal. They still depend on staff recognizing that an event may be device-related and preserving enough evidence to investigate it.

Liability cannot be inferred from technical control alone

Practical control is a disciplined way to investigate responsibility, but it is not a substitute for a court's application of law. AECL's design authority, knowledge and corrective-action role support strong engineering accountability. Hospitals' operation and reporting powers support examination of local decisions. Regulators' authority supports scrutiny of timing and sufficiency. None of those observations establishes the elements of negligence, causation, product defect, statutory breach or damages in a particular jurisdiction and case.

The original investigation drew on depositions and reported that several claims settled out of court. A settlement may reflect litigation cost, uncertainty, insurance, confidentiality, compassion or risk allocation. Without public terms and adjudicated findings, it cannot establish an admission or aggregate loss. No publicly accessible merits judgment resolving the principal Therac-25 injury claims appears in the primary record used here.

Corporate identity also requires care. AECL was a Canadian Crown corporation, and its medical business later changed names and ownership. The manifest subject is Atomic Energy of Canada Limited because AECL controlled the product during the accident and CAP period. Later entities should not automatically inherit factual knowledge or legal responsibility without transaction and corporate records establishing that connection.

Accountability remains possible without overclaiming liability. The article can identify who could prevent, detect, limit and repair a hazard; compare those powers with actual actions; and preserve uncertainty about legal outcomes. That produces a more useful result than declaring guilt from a software defect or treating confidential settlements as exoneration.

Earlier counterfactuals are more useful than a perfect-code fantasy

The weakest counterfactual is that better programmers would have written flawless code. It is untestable and sets the wrong standard. Concurrent real-time software can contain defects despite competent work. A safety case should assume that some defects survive and prevent a single one from reaching catastrophic energy.

The strongest counterfactual begins in architecture. If Therac-25 had retained independent scanning and turntable interlocks comparable to the Therac-20 protections, the shared editing defect might have caused a shutdown rather than exposure. This is supported by the later discovery of the same class of defect on Therac-20 without patient injury and by the independent barriers selected in the final CAP. It does not prove that every one of the six accidents would have been prevented, because the first three exact paths are unknown.

A second counterfactual begins after Kennestone. If the physicist's question, patient injury and lawsuit notice had entered a formal hazard log shared with all users and regulators, later facilities would have had a reason to distrust an apparent underdose and claims of impossibility. The machine could have been restricted while scanning and interlock behavior were tested under worst-case states. The record cannot prove that evidence available in June 1985 was sufficient for a definitive recall, but it was sufficient for a conservative, documented investigation.

A third begins after Hamilton. Canadian officials and an independent consultant recommended an independent position interlock and non-resumable handling of dose-rate faults. Installing those changes across the fleet before routine use resumed would have addressed the class of unsafe configuration more broadly than modifying microswitch logic. The later CAP adopted closely related controls. It is therefore reasonable to infer that earlier implementation could have reduced risk, while avoiding the claim that it certainly would have blocked an unknown Kennestone or first Yakima mechanism.

A fourth begins at first Tyler detection. A rule that any serious dose contradiction requires treatment suspend, patient assessment, preserved machine state and vendor-regulator escalation would have prevented immediate one-key continuation. Functioning audio and video would have improved human detection. Neither control fixes the software, but both limit repeated exposure and improve evidence. After the first event, retaining the machine out of clinical service until Malfunction 54 was reproduced would likely have prevented the second Tyler exposure on that unit.

A fifth concerns testing. Replaying expert-speed editing, randomizing task timing, forcing byte rollover, injecting stale and contradictory shared state, saturating measurement inputs and verifying final physical configuration against prescription would have had a better chance of exposing the known paths than ordinary repeated use. The inference is supported by how the Tyler physicist reproduced the defect and how Yakima was ultimately explained. Public evidence cannot show which technique would have found which defect before release.

Confirmed facts, supported inference and public unknowns

Confirmed facts include the six known accidents; the greater safety role assigned to Therac-25 software; the absence of some independent protections retained in earlier machines; the 1983 analysis's exclusion of residual software errors; the Tyler timing-dependent editing path; the Yakima counter-overflow path; misleading or cryptic interface behavior; fragmented incident communication; FDA's defect finding and repeated CAP objections; Canadian demands for change; the Class I U.S. recall; and final corrective action adding independent hardware protection, software changes, stronger suspension behavior and revised documentation.

It is also confirmed that the FDA record did not accept several AECL assurances at face value. The agency rejected an inadequate initial user notice, requested more detail and testing, questioned data that did not support the claimed fix, required changes beyond the Tyler defect and conditioned CAP approval on final results and independent analysis. Users and Canadian officials contributed to the final control set. Repair was therefore negotiated and tested across several institutions, not delivered as one uncontested patch.

Supported inference begins where those facts interact. Earlier independent barriers probably would have prevented at least some catastrophic exposures because the same kind of software inconsistency was contained by hardware on Therac-20 and because the final CAP selected those barriers. A shared hazard log and prompt cross-site warning probably would have accelerated recognition because each facility's belief in impossibility depended partly on missing incident information. More realistic integrated testing could have exposed timing and rollover conditions.

These conclusions are probable control effects, not reconstructed alternate history.

Several facts are disputed or uncertain. The timing and completeness of AECL's early knowledge differed across company, hospital and litigation accounts. The Hamilton mechanism was never firmly reproduced. The first three accidents cannot be assigned to a particular software defect from public evidence. Exact patient doses vary by reconstruction and machine conditions. For some patients, cancer and radiation injury both affected outcomes, so a simple death count cannot express medical causation. The private reasoning behind design choices and the allocation of corporate authority among named individuals are not public.

Legal and financial unknowns are substantial. Settlement amounts and terms are not available in the core primary record. There is no public merits decision allocating liability across AECL, hospitals, clinicians or service organizations. Insurance coverage, indemnities, legal expense and compensation totals are unavailable. The absence of those records does not mean there was no cost or responsibility; it prevents precise claims.

Repair unknowns remain as well. Public sources do not provide every CAP test result, full independent review workpaper, all unit installation records, source-control history or longitudinal incident rate. They do not prove how every modified machine behaved until retirement. The later regulatory and standards framework demonstrates what a current evidence package would contain, but it cannot retroactively manufacture missing artifacts.

Evidence that could alter the conclusion includes a complete AECL hazard log, source and change history, original requirements and safety analyses, internal review records, all facility service logs, regulator correspondence not reproduced in the investigation, complete CAP test data, installation acceptance results and declassified settlement or court records. Such material could refine who knew what and when. It would not change the basic physical fact that independent barriers were absent before the accidents and added during repair, but it could materially change the allocation and timing of organizational responsibility.

A durable accountability test for software-dependent medical safety

The first test is hazard ownership. For every hazardous energy state, is there one named organizational owner with authority over requirements, architecture, validation, field monitoring and corrective action? Does that owner maintain the hazard across product generations and reused components? A hazard that is divided among hardware, software and clinical teams without one accountable integration point is likely to fall between them.

The second test is barrier independence. Can a single software defect, stale shared variable, corrupted configuration or mistaken command defeat both the control action and its check? A second software routine on the same processor, reading the same state and using the same assumptions, may be redundant in code but not independent in safety. Catastrophic energy requires a barrier whose failure is not caused by the same path: physical position sensing, hardwired cutoff, independent monitoring or another demonstrably separated mechanism.

The third test is assumption control across reuse. Does every reused routine carry documented assumptions about hardware interlocks, timing, numeric range, scheduler behavior, sensor validity and operator workflow? Are those assumptions revalidated when software moves into a new product? A long operating history in a protected predecessor is not field evidence for a successor that removes the protection.

The fourth test is hazard-led software evidence. Do requirements begin with unsafe physical states and required constraints, or with features and expected behavior? Can reviewers trace each hazard to requirements, architecture, code, tests, residual risk and field monitoring? Are unresolved anomalies evaluated for worst credible consequence rather than frequency alone? Passing ordinary treatments does not exercise rare state combinations.

The fifth test is realistic interaction testing. Are expert users observed performing common corrections at full speed? Are interruption timing, rapid edits, repeated pauses, rollover boundaries, task preemption and contradictory sensor values injected deliberately? Does testing include the fastest and most experienced operator, not only a slow scripted sequence? Intended efficiency must be treated as part of the operating environment.

The sixth test is conservative human-machine authority. Does the display communicate the hazard in language the operator can act on? Does a serious contradiction default to suspend? Is restart blocked until state is re-established and independently checked? Are frequent nuisance alarms measured and reduced before they normalize unsafe continuation? An alarm system that teaches users to ignore it has consumed its own safety margin.

The seventh test is truthful measurement. Can monitors represent the worst credible output without saturation or misleading fallback? When independent indications conflict, does the system preserve both and assume the more hazardous state? Are raw readings, range limits and sensor validity retained? A displayed zero is dangerous when it means the instrument exceeded its capacity rather than that nothing occurred.

The eighth test is an auditable incident record. Does every treatment retain prescription, edits, software and configuration versions, physical interlock states, beam commands, monitor readings, alarms, restarts and clock synchronization? Can a physicist reconstruct the sequence without relying on memory? Is the record protected from routine disabling and sized for the product's life? Investigation becomes speculation when the system discards the state that matters.

The ninth test is cross-site escalation. Can any facility report a suspected serious event without first proving the device caused it? Are reports aggregated by product and hazard across countries, service organizations and corporate departments? Do users receive prompt factual warnings that distinguish confirmed mechanisms from unresolved risk? A manufacturer should not wait for identical injuries when the common outcome is catastrophic.

The tenth test is corrective-action breadth. Does the response fix only the reproduced trigger, or does it identify all paths to the hazardous state? Are interim workarounds labelled as such, with residual risk and expiration? Does final repair include change-impact analysis, regression tests, independent review, installation verification and postmarket monitoring? A keycap restriction can buy time; it cannot close a safety case.

The eleventh test is regulator-ready evidence. Can the manufacturer provide requirements, specifications, test plans, results, anomaly records and installation data when requested, or must it reconstruct them after injury? Do regulators have authority and a reporting network that lets them act before the manufacturer has perfect certainty? Does approval specify conditions and proof of completion? Safety assurance weakens when documentation follows the repair rather than governing it.

The twelfth test is durable verification. Are independent barriers periodically challenged under realistic fault conditions? Are software changes assessed against the original hazards, even after staff and ownership change? Are nuisance alarms, field anomalies and near misses trended? Does the organization publish enough aggregate evidence for hospitals and regulators to know that the control remains embedded? The absence of reported catastrophe is not equivalent to proof of performance.

Therac-25 should therefore not be reduced to a morality tale about careless coding or inattentive operators. It was a control system in which software authority expanded while independent protection, observability and institutional learning did not expand with it. The known defects made that imbalance visible. The earlier unproven mechanisms and incomplete records show why accountability cannot depend on finding every bug after harm.

The repair moved in the right direction because it changed who and what could stop the beam. Independent interlocks, one-pulse shutdown, non-resumable safety faults, clearer messages, broader analysis and regulator-tested corrective action made the system less dependent on perfect code and perfect interpretation. The remaining lesson is evidentiary: a safety-critical manufacturer must be able to show, before deployment and after every serious signal, that no single hidden path can convert ordinary clinical work into catastrophic exposure.