Major Design Flaws in the Software Development of Therac-25

Randy Graebner
February 7, 1999


Code reuse has long been an accepted practice in software engineering. For decades, programmers have been finding ways to cut corners by incorporating old code into the system they are currently creating. In addition, programmers often view code reuse as an excuse to avoid testing and documenting particular parts of a system. This improper reuse can allow minor bugs to go undetected. Such was the case in the Therac-25 project. The programmer behind Therac-25 made two major mistakes while reusing code in the development of the system; the software neither underwent rigorous modular testing nor was it properly documented before its initial release.

The software for the Therac-25 system was subjected to insignificant amounts of testing on a simulator. The programmer should have thoroughly tested all of the code, both modularly and as an entire system, before its integration with the physical system. This testing could have prevented most, if not all, of the accidents. However, the programmer either failed to realize or ignored the fact that software must be tested and tested again during all stages of development. This is especially important when reusing code since there is no guarantee that the old code will interact with the rest of the system in the desired fashion. The programmer failed to see where mistakes were made and testing would have made these mistakes apparent.

Another way the programmer could have caught mistakes in the design and implementation of the system is by creating thorough documentation. Documenting the design and code would have forced the programmer to analyze his reasons for making certain decisions. The process of documenting the code forces the programmer to painstakingly examine the code and overall design thus dramatically increasing the chances of finding an error in the design or implementation of the system. In doing this, the programmer would also have evaluated how well the reused code was incorporated into the system. In addition, documentation would have allowed other individuals to easily review the software, again increasing the odds that a bug is found before the final release of the code.

Thorough testing and documentation of the code would have created a safer Therac-25 system. Had these proper steps been taken, the system using old code could have proven to be safer than rewriting the entire software package since the Therac-6 code was proven to be dependable and safe. In turn, this could have provided for an overall safer system and an avoidance of the major failure of the Therac-25 project.