 Radiation therapy machines are relied on in the battle against certain cancers. Many place their trust and hopes of survival on the effectiveness of such equipment. However, when harnessing ionising radiation, extreme caution needs to be exercised. This goes for the safe storage and disposal of units, but also and more regularly, in the actual dose used to treat the patients. If you like what we're doing here at Plain and Difficult, consider helping the channel grow by liking, commenting and subscribing. Let's get started. Today we're looking at the Pharaq25 Radiotherapy Unit and its victims. However, unlike other radiotherapy units on this channel, the death toll was equated to a fault with the unit's software, giving dangerous doses of radiation. Today I'm going to rate this subject here on the Plain and Difficult Disaster Scale. In the 21st century, we rely on computer control systems for almost everything, as the accuracy of the digital realm on the whole outperforms that of a human. However, in the mid to late 1980s, the reliance of the computer system for safety critical operations led to a deadly result. Unlike other radiotherapy units that use an active radioactive source, such as cobalt, the Pharaq25 was a medical linear accelerator. This type of machine accelerates electrons via a gun to create a high-energy beam. The beam is used for treating a small localized area, usually in the form of a tumour. The advantage is that the surrounding tissue is unaffected. Some cancers can respond well to small doses of radiation, in turn killing off the deadly cells, halting the spread of the disease. With the Pharaq machine, shallow treatments are dealt with accelerated electrons, whereas deeper targets are reached by converting the beam to x-ray photo beams. The Pharaq25 was a genesis born from a collaboration with AECL, the Atomic Energy of Canada Limited Company, and a French company called CGR. During the 1970s, several units were deployed and put into production, the first of which was the 6 million electron volt Pharaq6, followed by the 20MEV dual mode Pharaq20. Both these units used micro computers, but were developed versions of CGR designs. The computers used in these units only added the ease of use, and mechanical interlocks were still employed. Essentially these units were standalone and the machines they were derived from didn't make use of computers. During the 1970s, AECL developed a double pass system. The innovation of the Pharaq25 was that the designers found a way to fold the beam back and forth, so a very long accelerator could be fit into a smaller space. The 25MEV Pharaq25 made use of the new system. The unit could deliver 25MEV of photons or electrons at various levels. It also had a field light mode, which allowed the patient to be correctly positioned by illuminating the treatment area with visible light. The unit made use of the same PDP-11 computer as the 6 and 20. However, the computer was not just an addon, but instead had the whole unit controls designed around the computer system. With the extra reliance on the computer, mechanical interlockings were replaced with software. This meant that the safety was ensured within the computer. The software for the new unit was written using the code from the Pharaq6 as a base and had evolved to the 25 via the Pharaq20. The software was programmed only by one person. In depositions from later lawsuits, the company omitted to conducting small amounts of software testing in a simulator. During development, only around 2700 hours of operation was racked up. The software was responsible for machine status monitoring, inputting desired treatment and setting up the unit for treatment. The software also activated the beam depending on operator input and once treatment was complete, would also switch off the beam. This relied on system checks being carried out by the computer. The computer didn't make use of a standard operating system and instead used a proprietary real-time OS. The software had 4 major components, stored data, a scheduler, a set of critical and non-critical tasks and interrupt services. The software controlled interlocks were designed to remove power from the unit in the case of a failure. The system used a fault tree in the event of a hardware failure, however it did not consider computer software errors. The culture of the design of the unit thought that all areas in the system would only be linked to hardware failures. There were two ways that the unit software could shut down operation, treatment suspend or treatment pause. A treatment suspension hinted at a serious error and required a complete system restart. A treatment pause, which the system deemed as not serious, only required a single key command to restart the machine and all treatment parameters remained intact. The danger of this was that an operator could quickly override the system fault by just using the P key. In total, the system would allow five pauses before a total restart was needed. During development, AECL didn't have the software code independently reviewed. Issues within the software had not been highlighted on the FRAC 6 and 20 units due to their hardware interlocks, thus providing final safety. But the FRAC 25 had got rid of these and this would mean the bugs in the software could ignore key safety critical systems. In 1975, the prototype of the FRAC 25 was constructed and commercial availability began in 1982. In total, 11 units were installed with five in the USA and six in Canada. There were six incidents of incorrect high current electron beams generated in X-ray mode being delivered to patients. These happened over a two-year period between 1985 and 1987. The first incident took place in June 1985. A 61-year-old female patient was receiving follow-up treatment after removal of a tumour from one of her breasts. She was to receive treatment in the neighbouring lymph nodes. This particular machine had been operating for six months at Kennestone Regional Oncology Centre in Marietta, Georgia. The machine was set up for what was thought to be a 10 MeV electron dose. Upon commencement of treatment, the patient experienced a burning sensation on the treatment area. After treatment, the patient reported redness and swelling in the area. Her shoulder froze and began to experience spasms. After being admitted to hospital, her doctors continued to send her for FRAC 25 radiation treatments. AECL denied that the machine burned the patient and it was thought that her bodily reaction was normal in connection with a correct dose. Eventually, the patient's breast had to be removed and she completely lost the use of her shoulder and arm. In October, the patient filed suit against the hospital and the manufacture of the machine. The second incident was in July 1985 at the Ontario Cancer Foundation Clinic in Canada. The 40-year-old patient was on her 24th treatment from the FRAC 25. During the session, the unit initiated a treatment pause due to the computer indicating that no dose had been administered. The operator pushed the P button to override the error. The machine shut down a few more times, each incident being overridden by the operator. However, the patient complained of tingling in the treatment area and over exposure was suspected with the patient being hospitalised. They died three months later in relation to their cancer. The third incident happened at Yakima Valley Hospital in 1985. The patient, a woman, had developed red parallel strips on the treatment area on her hip. Her condition was thought to be normal and was sent back for more FRAC 25 sessions. Radiation over exposure was not considered until over a year later. Eventually, the patient received surgery and experienced minor disability and scarring. The East Texas Cancer Center in March 1986 would experience the fourth in this series of incidents. The patient, a male, was to receive therapy on his upper back during his ninth treatment with the machine. The machine had been in operation at the hospital for two years treating around 500 patients during that period. During setting up the session, the operator had typed in incorrect treatment information by indicating X-ray instead of electron mode. The operator edited this easy to make mistake by using the cursor up key. She had correctly filled in all other parameters, so once the X was changed to an E, after pressing enter, the terminal display indicated all parameters were verified. Next, the system prompted the operator to begin beam by pressing the B key. The machine shut down with a treatment pause and a malfunction 54 error was displayed on the screen. This error message indicated that either a dose too high or a dose too low had been delivered. The display terminal was showing a substantial underdose. The operator who was experienced with the machine thought it was just a usual quirk and pressed a P button to proceed. Again, a malfunction 54 message was displayed, however due to a malfunction in the software, two doses of the maximum of 25 MEV was administered. Meanwhile, inside the treatment room, the patient felt a burning sensation on his back upon the first attempt of delivery of a dose. He had attempted to get up from the treatment table before the second dose, which had hit him in his arm. After the second attempt, he made his way to the door of the treatment room, banging on it to get the attention of the operator. As an unfortunate turn in luck, the audio and video link between the two rooms was out of order that day, meaning that the operator had no way of seeing or hearing the patient. The patient eventually lost the use of his left arm and both legs, was unable to speak and had several other complications. He died five months later, linked to his incident in Nefrac 25. A month later, in April at the same centre, another incident with the same operator would take place. Much like the previous incident, the operator had incorrectly typed X instead of E and had gone to correct her mistake using the cursor up key. What was different this time was that the intercom was working and the operator heard a noise from the machine and had grown from the patient. The intended dose was 10 MEV to the face, however like before this was far exceeded. The patient was rushed to hospital where he fell into a coma and passed away three weeks later from severe neurological damage. The final incident occurred at Yakima Valley Hospital in January 1987. An operator placed the patient for small position verification doses. The total dose was to be 86 RADs which consisted of two verification doses and then a prescribed dose. After attempting to administer the dose, the machine shut down with a malfunction message and a treatment pause. The operator pushed the P button and the machine paused again. Like in every other case, the patient had felt a burning sensation in the treatment area which should not have been the case due to the dose being very low. This patient died three months later and it was thought that he had received up to 10,000 RADs. After each of the incidents, AECL denied that the units could have been the cause of the overexposure as the company had misplaced high levels of confidence in the software and hardware combination. As long as they had blind confidence in the unit, thoughts could not be identified and rectified as they presented themselves. It wasn't until the fifth instance of overdose that the company started to look into the system, although this might have been because the FDA was also launching a probe into the unit's safety systems. The key issue with the Fract25 was in its software. A strange quirk was once an operator entered information at the terminal outside the treatment room, the magnets used to filter and control radiation levels were set. Due to the number of magnets, this process took about 8 seconds. If an edit straight away in say under 1 second, the software would adjust accordingly. Similarly, if an edit was made after the magnets had been positioned, the edit would be registered. However, if an edit was made during the magnet alignment time, it would not be registered by the system. Once the magnets are set, no test is performed by the software to double check that the treatment information entered matches how the magnets are set. This issue is a direct result of the dual mode element of the machine. Much higher levels of radiation are needed in photon mode to produce the same levels of output in electron mode, meaning if the beam is set for photon mode but the turntable is set up for electron mode, a radiation overdose occurs and the operators were none the wiser. The same software glitch was in the programming of the Fract20, however the hardware interlocks prevented the overdose. And as described at the beginning of the video, these interlocks were not built into the 25. The other software glitch allowed the electron beam to activate during field light mode, during which no beam scanner was active or target was in place. Restringent and extensive testing was not undertaken by AECL as only one programmer was used. Limiting the amount of program testing that could be done during development and also as a result of stretch resources, code was copied from previous machines. It was assumed by the company that, as previous units had been safe, that adding to an already established computer system wouldn't need testing and proving. The poorly engineered software had led the operators and technicians to become complacent with the error messages displayed to them. This was because the units would regularly spew out confusing errors, eventually conditioning operators to not investigate spurious failures. Arguably the operators should have demanded equipment that could operate fault free, however AECL had sold them the lie that the system would not let an incident of overdose, even though this was proven to be false. AECL eventually set out a corrective action plan which included a hardware safety interlock and 20 other hardware and software changes. The Fract25 after these changes went back into service. I hope you enjoyed the video, if you'd like to support the channel financially you can on Patreon from $1 per creation, that gets you access to votes and early access to future videos. I have YouTube membership as well from 99 pence per month and that gets you early access to videos as well. Check me out on Twitter and also if you'd like to wear my merch you can purchase it at my Teespring store. And all that's left to say is thank you for watching.