Therac-25 — The Machine That Fired Blind

A computer-controlled radiotherapy linear accelerator delivered massive radiation overdoses to at least six patients across three clinics. Earlier models had hardware interlocks that physically prevented the high-energy beam from firing without its beam-spreading target in place. The Therac-25 removed them and trusted software alone. A fast edit of the treatment setup could leave the machine in a lethal state while the console reported a routine fault.

This is the canonical medical-device software catastrophe — the case every patient-safety and human-factors curriculum starts from. The definitive account is Leveson & Turner, 'An Investigation of the Therac-25 Accidents' (IEEE Computer, 1993). It shows how removing physical safeguards, cryptic error messaging, and unwarranted trust in software combine into fatal use error.

1. The operator selects X-ray (high-energy) mode, then quickly corrects the setup to electron mode.
2. A race condition in the concurrent software leaves the beam at full energy with no target in the path.
3. The console shows only 'Malfunction 54' and 'Treatment pause' — no warning that a massive dose was delivered.
4. Habituated to frequent harmless faults, and told overdoses were impossible, the operator presses P to proceed.
5. The patient receives roughly a hundred times the intended dose; the harm is not visible for hours to weeks.

Not a frequency — a landmark cluster of at least six overdose accidents between 1985 and 1987.

At least three patients died and others were gravely injured by radiation burns (a fourth death is attributed to overdose complications). Shown through the console, the beam-on indicator, and the empty treatment vault — never the patient.