Incident: Reused code trusted a missing safety check
Module 6 · Incident file · About 30 minutes
What happened
The Therac-25 was a radiation therapy machine. Between 1985 and 1987, patients treated with it were given overdoses of radiation. In 1993 Nancy Leveson and Clark Turner published their investigation of the accidents, "An Investigation of the Therac-25 Accidents", in the journal IEEE Computer.
One of their findings is the one this module's skills speak to. The Therac-25 reused software from earlier machines. Those earlier machines had hardware safety interlocks: physical checks that stopped the machine when something was wrong. The reused software had been written for machines that had them, and it assumed they were there. The Therac-25 did not have those interlocks. The software's hidden assumption had nothing left to rest on.
+ hardware interlocks
a fault is stopped
by the hardware
no such interlocks
the assumption remained
with nothing behind it
This file keeps to those facts. The paper describes much more, and is worth reading in full. What matters here is the shape of the failure: code that was correct where it was written, moved somewhere new, still trusting a check that lived outside it.