Context
In the early 1980s, the Therac-25 was marketed as a cutting-edge medical breakthrough—a radiation therapy machine controlled almost entirely by software.
It was faster, more efficient, and required fewer hardware safety mechanisms than its predecessors.
It was also dangerously flawed.
What Happened
Between 1985 and 1987, in hospitals across North America, something unthinkable began to happen.
Patients undergoing routine radiation therapy started reporting intense burning sensations - far beyond anything expected.
Operators saw nothing unusual. The machine displayed normal readings. No alarms. No warnings.
But inside the system, a hidden race condition was being triggered.
Under specific sequences of rapid input by operators, the machine’s software would enter an inconsistent state-silently disabling safety checks and firing a concentrated, lethal dose of radiation directly into patients.
Massive overdoses-hundreds of times the intended level-were delivered in seconds.
Some patients died. Others suffered catastrophic injuries.
And for a long time, no one could explain why.
Root Cause
Undetected race conditions in concurrent software
Complete reliance on software without hardware safety interlocks
Poor testing and dismissal of early warning signs
Impact
Multiple patient deaths and severe injuries
Lawsuits and widespread fear of software-controlled medical systems
One of the most infamous failures in the history of engineering
Fix
The system was eventually redesigned with:
- Hardware safety interlocks reinstated
- Extensive software validation and testing
- Stronger regulatory oversight in medical devices
Lessons Learned
- Software failures can be physically deadly in real-world systems
- Race conditions are subtle but catastrophic
- User interfaces can dangerously misrepresent reality
- Ignoring early anomalies leads to disaster
Prevention
- Always implement hardware fail-safes in safety-critical systems
- Conduct independent and adversarial testing
- Design systems to default to safe states on failure
- Ensure transparency between system state and operator feedback
