FATAL DOSE Radiation Deaths linked to

AECL Computer Errors

In 1985 a Canadian-built

radiation-treatment device began

blasting holes through patients' bodies. How a series of simple computer errors

sabotaged a state-of-the-art medical wonder.

- by Barbara Wade Rose from Saturday Night,

June 1994

Radiation Therapy Gone Wrong

On a day early in June, 1985, Katie Yarborough drove to the Kennestone Regional Oncology Center in Marietta, Georgia, for her twelfth cancer treatment. The sixty-one-year-old manicurist who worked at a local hair salon had had a lump successfully removed from her left breast a few months earlier. She needed a dose of radiation treatment in the adjacent lymph nodes to make sure there would be no recurrence. The machine being used to treat Yarborough was a recent acquisition at Kennestone: a state-of-the-art linear accelerator called the Therac-25, which had already successfully performed 20,000 irradiations on the region's cancer patients. Designed and developed by AECL Medical, a division of Atomic Energy of Canada Ltd., the Therac-25 could speed up electrons and turn them into a high-energy beam that destroyed surface tumours on the skin, or else convert the electrons into x-rays to penetrate tumours deeper in the body.

Yarborough took off her top and her bra and settled in the treatment room for an electron treatment beamed high on the left side of her chest. The usual treatment delivered a dose of around 200 rads: rads are the commonly accepted measurement of radioactive energy -- a chest x-ray, for example, gives off a fraction of one rad.

It would last only a few seconds, during which Yarborough would feel nothing. But this day, when the technician activated the machine, Yarborough said she immediately felt this red-hot sensation. "You burned me," she told the technician, who replied that it wasn't possible. Yarborough's oncologist and Tim Still, the medical physicist at Kennestone, both examined her. Yarborough's skin looked fine, although it felt slightly warm. "I can't understand what might have done it," Still said to her. But he did his duty, and telephoned AECL up in Ottawa to ask whether a Therac-25 could ever project the electron beam without spreading it properly as the machine was supposed to do. They said they'd get back to him. Not possible, he was told three days later.

Yarborough returned in two weeks. She said she felt tingling inside her body and growing pain. There was a red mark the size of a dime on her chest. There was also a larger pink circle of skin high on the left side of her back. Still's stomach turned over when he saw it. "That looks like the exit dose made by an electron beam," he said to Yarborough and her doctor. The damage done by radiation depends upon its strength, what proportion of the body is exposed, and whether it strikes any vital organs. One thousand rads can be fatal if it is spread over the entire body. Physicist Still later estimated that Yarborough probably received between 15,000 and 20,000 rads on that dime-sized space.

That night Still stayed late after work and tried to reproduce a beam that could have gone through a patient's body with such obvious force. He shot beams into water and into the air of the treatment room. Whenever he changed any component of Yarborough's prescribed treatment on the computer console, the beam collapsed, shut off by the Therac-25's safety system. So the technician couldn't have done anything wrong. The machine worked fine.

But Still, a forty-year-old Georgian with a broad southern drawl, describes himself as "a troublemaker. I make a lot of noise." He was already frustrated by what he saw as AECL's lack of interest in fixing problems he'd had with another of their medical machines and this time he let his colleagues and a professional organization, Pharmacopeia, know about the anomaly. There were, Still says, unpleasant results. "I got this intimidating phone call from AECL," he says. "I got told that this kind of talk was libel unless I had proof and that I'd better stop." At the time there were five Therac-25s installed in hospitals in the U.S. and six in Canada.

Over the next few weeks Katie Yarborough's body began to look as if a slow motion gunshot had gone through her chest and out her back. The site where the beam had entered was now a hole. Over the next few months surgeons twice tried to graft healthy skin over the wound but each time the grafted skin rotted and died. Her left arm became paralyzed except when it spasmed. Yarborough hired a Georgia lawyer named Bill Bird and sued AECL and the hospital in October of 1985. "We never got a good deal of information from AECL," Bird recalls. "We hadn't got a lot of response to our written questions so we filed notice of deposition -- where we could call them in and force them to respond to interviews with a court reporter present. At that point they settled." Bird describes Yarborough as "a remarkable woman" who continued to drive despite a useless left arm. She died in 1990 when her car was hit by a truck on the highway near Marietta.

Katie Yarborough was the first of the Therac-25 accidents.

Twice Burned, Once Shy

Radiation-treatment machines were in enormous demand in hospitals throughout North America, and AECL Medical's equipment was widely considered the best in a growing field. The Therac-25 looked like a giant version of one of those kitchen electric mixers, with a treatment table slid underneath in the bowl position. The machine was seven feet high and took up about twelve feet of space -- less than conventional linear accelerators. Just as technicians leave the room to operate x-ray equipment in hospitals and dentists' offices, operators ran the Therac-25 from a computer console outside the treatment area. There had been several earlier versions of Theracs -- the 6, the 20 -- developed by AECL in cooperation with a French company, CGR, in a business relationship that ended in 1981. But the Therac-25 was better. First of all, it was a double-pass accelerator, which meant the beam doubled back through an electromagnet and that streamlined the machine. Second, the Therac-25 used electricity as the power source for its beam rather than pellets of radioactive cobalt, which lose strength over time.

And the Therac-25 was controlled principally by software. Older Theracs relied on hardware to set the machine up for treatment, to position the beam, and to run the safety system. Hardware is the computer itself, its keyboard, casing, microchips, switches -- rusting, dusty, fallible, and mortal. Software is the thousands of lines of written code that allow the computer to do incredible things at a high speed, and that never breaks down -- invisible and immortal. Hardware and software; Mensch and óbermensch.

There was soon another kind of accident involving another Therac-25. Seven weeks after Katie Yarborough's overexposure, a forty-year-old woman with cervical cancer at the Hamilton Regional Cancer Centre in Ontario received a dose of what was later estimated to be as much as 17,000 rads to her hip. This time, there was a larger patch of swelling and redness, and the woman was hospitalized for her injury on July 30. She died in November from her cancer, but an autopsy report noted that, had she lived, she would have needed a hip replacement because of radiation overexposure. After the accident, AECL notified Therac-25 operators, the federal government's Canadian Radiation Protection Bureau, and the American Food and Drug Administration (FDA), which monitors medical equipment in the U.S., that there had been a problem with the Hamilton machine. Technicians, AECL said, should examine their machines during each treatment to be sure the positioning mechanism -- called the turntable -- was working properly. Patient injury wasn't mentioned, although hospital physicists in Ontario knew from discussions among themselves that an accident had occurred. None of them knew about the earlier accident in Georgia, and AECL didn't mention it.

Engineers from AECL had examined the Hamilton machine in July to determine whether there were problems with the way the Therac-25 turntable worked. A revolving platform rotated by a motor, the turntable locks into two standard positions, one for an electron beam, one for an x-ray beam, and a third position, called the field-light position, which enables the technician to adjust the beam to a precise target. Once in place, microswitches let the computer know the turntable is properly positioned. During its July, 1985, inspection, AECL decided the microswitches for the Therac-25 turntable weren't working properly and modified them. The software was altered within the machines to check continually on the microswitches, and a plunger that locked the turntable into place was modified so that the machine would no longer operate if the turntable was out of position. In September, 1985, in a letter to users, AECL pronounced the Therac-25 safe "with an improvement over the old system by at least five orders of magnitude."

Three months later, in December, 1985, a Therac-25 at Yakima Valley Memorial Hospital in Washington State, which had been modified according to AECL's July specifications, delivered a similar dose, in a way similar to the Hamilton accident, to the hip of another cervical-cancer patient. This time the burn produced a striped pattern on the woman's body. David Judd, a physicist at Yatima, remembers the "five orders safer" letter he had received from AECL before the accident. "Based on that letter we figured it couldn't be the machine," he told me in a telephone interview. Nor was he aware a patient had been injured in Hamilton, Ontario, when he and his colleagues began casting about for other explanations. "The woman said she regularly lay on a heating pad. So we investigated that."

An accident report was sent to AECL, which wrote back: "After careful consideration, we are of the opinion that this damage could not have been produced by a malfunction of the Therac-25 or by any operator error." Despite the earlier accidents, the letter also stated -- perhaps referring to the striped pattern of irradiated skin on the patient's hip -- that there had "apparently been no other instances of similar damage to this or other patients." The staff at Yakima decided they would never know the cause of the accident and, since the machine seemed to work, turned it back on.

After Hamilton and Yakima, the physicists who were working with Therac-25s at the various sites in Canada and the U.S. began to talk to one another by telephone and memo about their concerns. The physicists agreed they were perplexed by accidents on an otherwise high-quality machine and frustrated by a sense that someone needed to get to the bottom of the problems. Alan Rawlinson, a physicist at Princess Margaret Hospital in Toronto, which installed its Therac-25 in 1986, said that "these accidents really drew people together. AECL was also involved. But in retrospect the courses of action that were followed once these accidents were found and understood were driven largely by the medical-physics community." But it was confusing at first. Without much information forthcoming from AECL, "we were," says Tim Still of Marietta, "all flying blind."

Death through Software

There would be two more deaths before anyone thought to blame the software program and another still before the errors would be solved. Everyone who uses computers knows about glitches. Everyone has heard stories about the multimillion-dollar bank error or the credit-card charge to someone long deceased -- stories that would be funny if they weren't so annoying. The truth is that any software program will probably contain one error for every 500 lines of code. The Therac-25's software program, relatively crude by today's standards, probably contained 101000 lines of code. At one error for every 500 lines, that works out to the possibility of twenty errors. Errors occur partly because it's a human being who wrote the code, partly because it's almost impossible to account for all the ways in which a software program will behave when it is at work in the machine.

Unfortunately, the same tolerances for error acceptable in wiring the software for the computer on your desk are applied to the software used increasingly in equipment that can affect life and death: automobiles, hospital equipment, medical devices. Though the obvious safety-cricical software systems, for example, those in weapons, nuclear power, and airplanes, have always been subject to government approval, elsewhere there were fewer set rules. Instead we rely on the people use refer to colloquially as technowizards. To understand such sophisticated programs, they must be geniuses, mustn't they? That is to say, we place the same faith in technowizards as we did in the chemists of the 1950s.

Two accidents occurring in rapid succession provided the first clues to what was happening. On March 21, 1986, an oilfield worker named Ray Cox was being irradiated for the ninth time at the East Texas Cancer Center in Tyler, Texas, for a tumour that had been removed from his back. The centre's Therac-25 had already successfully treated more than 500 patients over a two-year period. Cox lay on his stomach on the table in the treatment room, which was connected to the computer console room next door by an intercom and video monitor. On this day the intercom was broken and the video monitor was unplugged. The technician left the treatment room and shut the door. At the computer console she typed in the prescription data for an electron beam of 180 rads, then noticed she'd made an error by typing in command x (for x-ray treatments) instead of e (for electron). She ran the cursor up the screen to change the command x to e, as Cox's prescription required. She verified everything else and turned on the beam. The machine stopped and the computer screen flashed "Malfunction 54," a mysterious message not even mentioned in the Therac-25 manual.

The technicians who operated the Therac-25 were used to computer glitches. Jonathan Jacky is a research scientist who has been developing software for a computer-controlled radiation machine at the University of Washington's School of Medicine in Seattle. In a 1985 essay for The Sciences, he wrote that a therapist at Kennestone reported the Therac-25 typically issued up to four error messages a day. It did so by displaying "Malfunction" plus a number, from 1 through 64. No explanation was offered by the computer nor was there any reference to the malfunction codes in the operator's manual. Technicians could, in most cases, bypass the irritating malfunctions simply by pressing the "p" key, for "proceed." Doing so became a matter of habit.

Inside the treatment room Cox was hit with a powerful shock. He knew from previous treatments this was not supposed to happen. He tried to get up. Not seeing or hearing him because of the broken communications between the rooms, the technician pushed the "p" key, meaning "proceed." Cox was hit again. The treatment finally stopped when Cox stumbled to the door of the room and beat it with his fists.

Cox's injury was similar to Jane Yarborough's -- a dime-sized dose of 16,000 to 15,000 rads. He was sent home but returned to the hospital a few weeks later spitting blood: the doctors diagnosed radiation overexposure. It later paralysed his left arm, both legs, his left vocal chord, and his diaphragm. He died nearly five months later.

Official Reassurances from AECL At the time of the accident, an AECL representative reportedly told the hospital that its modified Therac-25 could not overdose a patient and that AECL knew of no other accidents. "That's what really bothers me," says a source within the hospital who asked not to be identified. "There were [AECL] people sitting in our offices telling us it [the Therac-25] couldn't hurt anybody when they knew it could." AECL suggested Cox's accident might have been caused by an electrical shock. The hospital staff hired an independent investigator, who determined that the Therac-25 wasn't capable of delivering one. The machine was checked and tested repeatedly. Nobody, either from AECL or on the hospital staff, could make it do anything wrong. So treatment resumed on April 7, 1986.

Four days later,"Malfunction 54" flashed on the screen again during a treatment, this rime while a sixty-six-year-old bus driver, Verdon Kidd, was receiving therapy at the Tyler cancer centre for skin cancer on his face. He became disoriented and then comatose, and died three weeks later. Kidd's death, which preceded Cox's by nearly four months, made medical history -- the first fatality caused, according to Jacky's research, by an overdose during radiation treatment.

Treatment stopped on the Tyler Therac-25 the day of Verdon Kidd's accident, on a Friday. The hospital staff, physicist Fritz Hager, and his technician, who had worked the machine in both accidents, stayed at the console long after everybody else had gone home for the weekend, typing and retyping the prescription into the computer console, determined to re-create Malfunction 54. They went to the bottom of the screen and then moved the cursor up to change the treatment mode from x to e, over and over, for hours. Finally they did it.

The speed with which the instructions were entered made the difference. According to a computer system's analysis of FDA documents, the computer would not accept new information on a particular phase of treatment (in the case of both Tyler accidents, changing the x-ray mode to electron mode) if the technician made the changes within eight seconds after reaching the end of the prescription data. That's what Malfunction 54 meant. If the changes were made so soon, all the new screen data would look correct to the technician. But inside the computer, the software would already have encoded the old information.

That meant the beam on the Therac-25 would be set for the much stronger dose needed for an x-ray beam while the turn-table was in the electron position. The coded information within the computer apparently included no system to check that various parts of the prescription data agreed with one another.

That night, Hager telephoned AECL to let them know the accidents weren't random. He knew how to turn the Therac-25 into a lethal weapon.

A letter immediately went out from AECL to all the users. "Effective immediately, and until further notice, the key used for moving the cursor back through the prescription sequence must ... not be used for editing or any other purpose." The FDA, which was already investigating the safety of the Therac-25 as a result of the first Tyler accident, told AECL that wasn't enough: the letter didn't describe what would result if the "up" cursor was used or mention any of the accidents. "In fact," the FDA's director of compliance, Center for Devices and Radiological Health (CDRH), wrote in a report, "the letter implies the inconvenience to operators outweighs the need to disable the key." In May, 1986, the FDA requested a corrective-action plan (CAP) to eliminate the problem. But the Therac-25 remained in use. "To say 'don't use the machine,'" Gordon Symonds, a physicist with the Canadian Radiation Protection Bureau, told me, "was to say to a patient,'you can't have your treatment.'"

Facing the Music

An unhappy band of Therac-25 physicists attended the annual conference of the American Association of Physicists in Medicine, in Seattle, Washington, in August, 1986. Gradually, they learned from one another in greater depth about the various accidents, including the original one at Marietta, which had just come to light following the Tyler accidents. They found out that the staff at Princess Margaret Hospital in Toronto had decided to take their own precautions and muzzle their machine -- which had not yet been put into clinical use -- by installing a dose-per-pulse monitor, an electronic device that would measure all doses of radiation in the beam and, in a fraction of a second, stop excessive doses before they could reach the patient. The physicists decided to circulate their own newsletter, consolidating information and recommendations for safety strategy on the Therac-25.

In the meantime, AECL was trying to satisfy the demands of the FDA. AECL had submitted its CAP on June 13, 1986, and then revised it twice before the end of the year to satisfy the FDA's increasingly stringent demands. Part of the CAP involved reworked software that told the computer where the "up" cursor was, so that a Malfunction 54 wouldn't happen again. By the end of the year the machines were back in use.

On January 17, 1987. it became sickeningly apparent that the problems with the Therac-25 that had led to the Hamilton and Yakima accidents were not, in fact, fixed. A man went into the Yakima Valley Memorial Hospital for a low dose of eighty-six rads for his carcinoma. He was hit in the chest with 8,000 to 10,000 rads, and the burn later formed the same striped pattern as in the December, 1985, Yakima accident. David Judd, the physicist at Yakima, describes his staff's reaction as "totally paranoid." "We had had that [1985] letter from AECL saying the safety had been improved but still two patients got over-dosed," he says. "We just stopped using the machine." The man who proved to be the last Therac-25 victim died in April, 1987, from a combination of terminal cancer and complications from an overdose.

It turned our that both Yakima accidents, as well as the one at Hamilton, had been caused by another software error -- different from the Malfunction 54. On the Therac-25, the part of the computer program that is often referred to as the "house-keeper task" continuously checked to see whether the turntable was correctly positioned. A zero on the counter indicated to the technician that the turntable was in the correct position. Any value other than zero meant that it wasn't, and that treatment couldn't begin. The computer would then make the necessary corrections and the counter would reset itself to zero.

But the highest value the counter could register was 255. If the program reached 256 checks, the counter automatically clicked back to zero, the same way that a car odometer turns over to zero after you've driven more than 99,999.99 kilometres. For that split second, the Therac-25 believed it was safe to proceed when, in fact, it wasn't. If the technician hit the "set" button to begin treatment at that precise moment, the turntable would be in the wrong position and the patient would be struck by a raw beam.

So when AECL fixed the turntable and microswitch problems back in September, 1985, they were improving the machine but they weren't actually correcting the problem that caused these accidents. A professor in computer engineering at the University of Toronto told me that, as a matter of course, his undergraduate students are warned about the risks of incrementing numbers in a computer program.

After the second Yakima accident the FDA requested "that AECL immediately notify all purchasers and recommend that use of the device on patients for routine therapy be discontinued until such time that an amended CAP approved by CDRH is fully completed." The machine was to be used only "if the need for an individual patient's treatment outweighs the potential risk." The Health Protection Branch, a division of Canada's Health and Welfare ministry, directed AECL to tell its customers to discontinue use of the machine until its safe use could be guaranteed. The physicists clamoured for a face-to-face meeting with AECL officials. They all arranged to fly up to Toronto (at the expense of their respective institutions) and meet with AECL representatives at Princess Margaret Hospital in March, 1987. Fearful of lawsuits, some of the physicists were accompanied by lawyers, one having been told by his administration supervisor that the next victim of an accident "would own the centre" in which it occurred.

Putting Safety First

At the meeting each physicist described the accident or accidents in which he had been involved. AECL, which also brought along its legal staff, presented its plans for correction, all of which involved changing the software. The physicists passed a resolution that there needed to be a hardware solution to the problems of the Therac-25 regardless of what software changes were made. They wanted a dose-per-pulse monitor on all the machines. The physicists I interviewed remember the tremendous energy and determination of the meeting at Princess Margaret Hospital, a relief after their frustration and despair. "There was so much momentum," says Tim Still of Marietta. The physicists' recollections of the meeting tend to differ. "The Canadians wanted the machine up and running as quickly as possible," recalls David Judd. "That really upset me. The Americans were more conservative and wanted more changes." According to Alan Rawlinson of Princess Margaret Hospital, who helped set up the meeting, AECL "was looking for guidance from users. That meeting was a final pulling together of what needed to be done."

In the weeks that followed AECL acted swiftly. It sent the FDA two more revisions of its CAP, based largely on the decisions made at the March Princess Margaret Hospital meeting. On June 6, 1987, AECL informed users that the FDA had verbally approved the CAP and that all Therac-25s would be fixed by the end of the summer. The CAP included twenty-three software changes in addition to those needed to correct the causes of the accidents, and at least six mechanical safety features, including the dose-per-pulse monitor that had been insisted upon by the physicists. Old-fashioned hardware finally came to the rescue of the software-driven Therac-25.

David Judd and his team at Yakima waited until after the AECL engineering team had installed the full set of safety armour on their Therac-25 early that fall. Then he and an AECL representative tried to create an accident. They shot the beam into hard plastic placed on the treatment table. They disconnected the safety mechanisms one by one. They reactivated the "up" cursor key. They reloaded the old software. Even then, the dose-per-pulse monitor shut the machine down.

Since then the Therac-25 machines at Yakima, Princess Margaret Hospital, Marietta, and other hospitals have been in use without a single accident. (East Texas Cancer Center shipped its Therac-25 back to Canada for a refund. Regardless of what was done to their machine, the staff refused to use it.) They are now considered absolutely safe. The Therac-25 is "still an awesome machine," says Tim Still of Marietta. "Ten years since it was made we're not replacing it with anything better."

AECL dissolved AECL Medical in 1988 and renamed it Theratronics International Ltd. The Canadian government has been trying to sell Theratronics to private industry since 1990, without success, and has transferred ownership to a government holding company, Canada Development investment Corporation. Many of the staff who were with AECL Medical and who were involved with the Theracs and the other linear accelerators are still working at Theratronics.

No Comment from AECL

From the beginning of research for this article I tried to get interviews from staff at AECL in Ottawa or Theratronics in Kanata. Over a two-month period I left phone messages, made explanatory calls, and sent fares. AECL declined to give me any interviews. A spokesman, Egon Frech, said that AECL no longer had any responsibility for Theratronics, though he agreed that AECL should say something because at the time AECL Medical was their division. AECL faxed me a statement approved by their lawyers that was to be their definitive answer to questions about the Therac- 25 accidents.

"When accidents occurred with the Therac-25 during the 1986 to 1988 time-frame," the statement read in part, "AECL Medical reacted quickly to investigate and inform Health and Welfare Canada and the U.S. FDA." Note the phrase "during the 1986 to 1988 time frame." By 1986 three of the six Therac-35 accidents had already occurred.

The AECL statement took issue with an article about the Therac-25 accidents published last July by the Institute of Electrical and Electronics Engineers in the technical journal Computer (the source for much of the information in this story). It was written by the computer scientist Nancy Leveson, a professor at the University of Washington who served as an expert witness in two of the Therac-25 accident lawsuits, and a computer-science PhD candidate and lawyer, Clark Turner, of the University of California at Irvine, who specializes in legal liability issues involving software safety systems. In their article, Leveson and Turner noted that the Canadian Radiation Protection Bureau asked AECL by letter to install a mechanical interlock on the Therac-25 as early as November, 1985. Leveson and Turner bestowed upon the Therac-25 accidents the dubious distinction of being "the most serious computer-related accidents to date (at least nonmilitary and admitted)."

The AECL statement read, "The article in Computer magazine does not in places accurately describe the events or give appropriate credit to the fast response of AECL Medical at the time the accidents occurred." I telephoned Frech to ask AECL to be more specific about which parts of Leveson's and Turner's article were inaccurate. He declined. "The errors are in the area of detail which we really don't want to get into at this time," he replied. "This happened a long time ago. We regret that this occurred and don't want to rehash it"

Theratronics also declined to give interviews. After several weeks of not returning my calls, the president of Theratronics, Frank Garland, told me I would be sent another statement. It arrived less than a week after the AECL statement. "Theratronics currently provides service to installed Therac-25s as part of a contractual arrangement with AECL," it read. "The arrangement was put into place at the time AECL Medical was dissolved in 1988. Theratronics does not manufacture linear accelerators, and cannot add to the information already provided by AECL Medical."

Who was the programmer who actually wrote the software used on the Therac-25? What sort of experience did he have? According to Leveson and Turner, it was a man who left AECL in 1986, but neither they nor lawyers connected with any of the lawsuits against AECL were able to obtain further information from the corporation. I can't tell you who he is. So neither can I tell you where he's working now.

As a result of the Therac-25 accidents, the FDA now requires documentation on software for new medical and other products: a paper trail, in other words, that can be examined by an independent body and retraced for flaws. In January, 1995, the International Electrotechnical Commission will recommend software safety standards for medical equipment, standards developed partly as a result of the Therac-25 accidents. Engineers can find their productivity cut nearly in half by such requirements, and there have been complaints in the high-tech community that software documentation is hampering competitiveness. The University of Washington's Jonathan Jacky still feels it's better than relying on what he calls "the stereotype of the eccentric genius programmer." At least, he told me, "the chances of a hazard getting into the community are a lot less. This run of Therac-25 accidents made it clear how wrong thing could go." At the time of the accidents no educational standard was required of computer-software programmers. "That's still true," says Jacky. "The knowledge of people out there Is extremely variable -- some people working on these things are far better than others. That's what documentation on software is supposed to catch."

I asked Katie Yarborough's lawyer, Bill Bird, to reflect upon the accidents after nearly a decade. "The thing that amazes me," he said, "is that the people who develop these machines are surely some of the most brilliant people in the world. This machine was unbelievably sophisticated. Nobody would have got hurt if somebody had used common sense. It's almost as if you have a scientific genius design a car and then an ordinary auto mechanic has to tell him how to run it properly."

The FDA, having been seen as too soft on computer safety in the past, is trying to prove to the U.S. Congress that it is tough on high-tech companies. Even though Theratronics no longer makes linear accelerators and despite passing repeated Canadian safety inspections, the company has suffered through an FDA ban on all its medical equipment as a result of the Therac-25 malfunctions, beginning on July 19, 1991. Marc Schindler, Theratronics' marketing manager, criticized the ban in a 1991 Globe and Mail article. The ban was partially lifted that year and Theratronics received informal notice in April, 1994, that the rest of the ban will be lifted. Surprisingly, physicist Tim Still, the original troublemaker, sympathizes with the company. "After the FDA got rolling, they [Theratronics] got beaten to death." he says. "But their arrogance towards this whole Therac thing aggravated it. They brought it on themselves."