A third “field-light” mode allowed the patient to be correctly positioned by illuminating the treatment area with visible light. The six documented accidents occurred when the high-current electron beam generated in X-ray mode was delivered directly to patients. One, when the operator incorrectly selected X-ray mode before quickly changing to electron mode, allowed the electron beam to be set for X-ray mode without the X-ray target being in place. A second fault allowed the electron beam to activate during field-light mode, during which no beam scanner was active the gift of fire sara baase pdf target was in place.
Previous models had hardware interlocks to prevent such faults, but the Therac-25 had removed them, depending instead on software checks for safety. The feeling was described by patient Ray Cox as “an intense electric shock”, causing him to scream and run out of the treatment room. A commission concluded that the primary reason should be attributed to the bad software design and development practices, and not explicitly to several coding errors that were found. Researchers who investigated the accidents found several contributing causes. AECL did not consider the design of the software during its assessment of how the machine might produce the desired results and what failure modes existed. The system noticed that something was wrong and halted the X-ray beam, but merely displayed the word “MALFUNCTION” followed by a number from 1 to 64.
The user manual did not explain or even address the error codes, so the operator pressed the P key to override the warning and proceed anyway. AECL personnel, as well as machine operators, initially did not believe complaints. This was likely due to overconfidence. AECL had never tested the Therac-25 with the combination of software and hardware until it was assembled at the hospital. 25 MeV Electron mode, then “Enter”, all within eight seconds. This sequence of keystrokes was improbable, and so the problem did not occur often and went unnoticed for a long time. These models had hardware interlocks that masked their software defects.