The Screen Showed a Minor Error. The Patient Said He Was Burning.

On March 21, 1986, a man lay face down for his ninth session at a cancer treatment centre in Tyler, Texas. He already knew the room, the hum of the machine and how long he had to remain still.

The operator left the shielded room and closed the door. At her keyboard, she quickly entered the prescribed settings. One letter was wrong: she had selected X-ray mode instead of electron mode. It was an ordinary error. She moved back up a line, corrected it, checked the rest and started the beam.

The machine stopped almost immediately. A terse message appeared on the screen: “Malfunction 54.” More importantly, the console indicated that the delivered dose was far below the requested one.

Minor stops were common on this machine. Until then, they had cost nothing but time. The operator pressed the key that allowed treatment to resume.

Inside the room, however, the patient had just felt a jolt and sudden heat in his back. He began to rise. The second activation shot through his arm. He rushed to the door and pounded on it.

That day, the video monitor was disconnected and the intercom did not work.

The message did not look serious enough to stop the day

When the door finally opened, the man was shaken. He described the sensation of hot coffee poured down his back. A doctor saw intense redness, but nobody yet imagined what had happened.

The hospital physicist checked the Therac-25’s calibration. Everything appeared normal. The available documentation did not clearly explain the code. A manufacturer’s technician would later say it could indicate a dose that was either too low or too high. At Tyler, the console showed an underdose.

So the machine treated other patients for the rest of the day.

The next day, engineers from Atomic Energy of Canada Limited, its manufacturer, came to run tests. They could not reproduce the failure. According to the Tyler physicist’s account, he was assured that an overdose was impossible.

The patient went home, then his condition deteriorated. Pain spread into his neck and shoulder. His left arm stopped working. The neurological damage progressed to paralysis. He died five months after the session.

Later simulations estimated that a tiny area of his body may have received, in less than a second, tens of times the dose prescribed for his entire treatment.

Three weeks later, the same operator saw the same number

On April 11, a second man was positioned for treatment of a skin cancer on the side of his face. The operator entered the data. Again, she quickly corrected X-ray mode to electron mode.

She started the beam. The machine made a noise loud enough to be heard through the intercom, repaired since the first accident. Then it stopped.

“Malfunction 54.”

The operator rushed into the room. The patient was groaning and tearing away the straps holding his head. He spoke of fire on his face, a flash and a sizzling sound like food in a frying pan. Again and again, he asked what had happened to him.

This time, physicist Fritz Hager immediately removed the Therac-25 from service. The patient died three weeks later after severe brain damage.

Hager did not stop at a calibration check. With the operator, he reconstructed the exact sequence of keystrokes. He tried, failed and tried again. Eventually one detail made the code appear at will: the data had to be corrected fast enough.

In other words, the failure was most likely to occur after the person using the machine had become extremely good at her job.

Eight seconds separated what the screen showed from what the machine prepared

The Therac-25 could deliver two different treatments. In electron mode, the beam was used directly at a suitable power. In X-ray mode, the machine had to place a metal target in its path and produce much higher energy.

When the operator changed modes very quickly after the first entry, the screen recorded the correction. But another part of the program continued preparing the old setting for a few seconds. The concurrent tasks did not all agree.

The console could therefore announce that the parameters had been verified while the hardware sat in an incompatible configuration. The very high-energy beam fired without the components meant to convert and spread it safely.

On the screen: a corrected line, a ready status and an obscure code. In the room: energy concentrated where it should never have reached.

The defect also existed in the software of an earlier model, the Therac-20. But the older machine retained independent physical interlocks. When a trainee entered a bad combination, fuses or breakers shut the machine down.

On the Therac-25, some of those hardware protections were gone. Software was no longer merely assisting the machine; it had become its main safety barrier.

Other patients had already delivered the same warnings

Tyler was not the beginning. Between June 1985 and January 1987, six known massive overdoses were associated with Therac-25 machines in the United States and Canada.

In Marietta, Georgia, a patient treated in 1985 felt terrible heat and insisted she had been burned. The manufacturer replied that the reported configuration could not occur. The woman suffered major injuries and eventually had a breast amputated.

In Hamilton, Canada, a console reported that no dose had been delivered. The operator resumed treatment several times. In Yakima, Washington, a patient developed a striped red mark. The cause remained unknown for months. The manufacturer wrote that the injury could not have resulted from either a Therac-25 malfunction or operator error.

The problem was not only that each hospital knew nothing about what had happened elsewhere. That ignorance became reassurance: since no other accident was known, the machine could not be responsible.

The signals existed. They simply arrived separately, and each was filed among the things the manufacturer considered technically impossible.

Making the machine acceptable took more than twenty changes

After the second Tyler accident, the manufacturer finally reproduced the failure. Its first instruction to users was startlingly crude: remove the keycap used to move back through the parameters and tape over its electrical contact.

The FDA judged the notice too weak and required a genuine corrective action. The final plan included more than twenty changes to hardware, software, manuals and procedures.

Error messages had to become understandable. Some faults that once permitted a simple restart would now suspend treatment. A circuit independent of the software was added to cut the beam after an abnormal signal. Testing and documentation were strengthened.

Yet another accident occurred in Yakima in January 1987. This time, the cause was different: a software counter reset to zero every 256 passes through a checking routine. If the operator acted at that exact moment, a position check could be skipped. The patient received another massive overdose.

The second defect destroyed the last comfortable explanation. The Therac-25 did not have one isolated piece of bad luck hidden in its keyboard. It had been designed so that several software errors could reach a human body directly.

The Therac-25 is still used today — but not to treat patients

The machine became a classic case study in critical-systems engineering. It is taught in computer science, medicine, ergonomics and safety because it shows what happens when a reassuring interface replaces real protection.

The Tyler operator did not enter an absurd value. She corrected a typo. The physicist did not neglect an obvious test. He checked what the instruments allowed him to check. The patients were not harmed by a machine that suddenly went mad, but by an entire system trained to treat its own warnings as noise.

“Malfunction 54” did not say what had just happened. The patients understood it before anyone else.

Read next

They Glowed in the Dark. Then Their Bones Began to Fail.
The Lake Never Overflowed. By Morning, Entire Villages Were Dead.
The War Had Been Over for 29 Years. He Was Still Waiting for Orders to Surrender.