M.I.T. DEPARTMENT OF EECS

6.033 - Computer System Engineering Recitation 3 - Tuesday, February 10, 2004

Read the article An Investigation of the Therac-25 Accidents by Leveson and Turner (reading #4) and also the following two brief reports that are available only on-line:

Although there are many cases in which software design and failure has led to the loss of life, the case of the Therac-25 is among the best known and most widely cited because of the depth of analysis that was performed by professor Nancy Leveson and her graduate student Clark Turner. The Leveson paper is quite long, and not all parts are equally important. This is a good opportunity for you to begin practicing how to get the interesting stuff out of a paper without getting bogged down in minor detail:

Now ask yourself why it was assigned as a 6.033 reading, and with that in mind, start working your way through the meat of the paper. Some sections can be skimmed quickly, while other parts require careful study. Not surprisingly, there is also some redundant information that you can ignore.

As you read the paper, try to distinguish solid technical facts from higher-level statements that the authors are trying to make about process, procedures and policy. You might find it useful to note the places where you agree or disagree with the authors' analysis.

Finally, don't be dismayed by unfamiliar technical jargon; make a guess about what it means and move on. The authors may explain it two paragraphs later, or two pages later, or perhaps never get around to it. There is a good chance that you will discover that it didn't actually matter. But if it does, you have something to ask about in recitation.


After reading the Leveson paper, write a one-page reading report that addresses the following question:

The design of the Therac-25 system was reviewed at many different times by many different individuals and organizations. Engineers and management at Atomic Energy of Canada Limited must have reviewed the initial designs. Regulators at both the Food and Drug Administration and the Health Protection Branch of Canada reviewed AECL's application to market the machine as a medical device. Medical facilities evaluated the machine before purchasing it. And when problems started appearing, AECL hired outside consultants to perform a safety review. Yet many problems remained undiscovered even after patients were seriously injured. Choose the vantage point of an individual or organization and discuss a warning sign that was missed. Discuss how this warning was indicative of one or more design flaws; explain these flaws and how they should have been addressed. Leveson and Turner assert that it is not possible to make a system safe by focusing on particular bugs, and that critical flaws may exist in software that has been used for years without incident. Do you agree? If so, then how can safety-critical software ever be created?

Remember, use no more than one sheet of paper for your report. (Consult the 6.033 FAQ for formatting specifications.) We care about conciseness more than the amount of content. You will not be able to address every issue in one page, so you will have to make your best argument and judiciously choose supporting facts for this one-pager.

This assignment is due at the beginning of recitation.

You can browse these excellent reports from previous years for examples of good writing on one-page reading reports.


Go to 6.033 Home Page