Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fatal Dose – Radiation Deaths linked to AECL Computer Errors (1994)

ccnr.org

Post reply on HN
Print view View original

21–30 of 42 posts

Re: Fatal Dose – Radiation Deaths linked to AECL Computer Errors (1994)

#21

Post by kohanz »

lostlogin wrote: post #5

>>As a result of the Therac-25 accidents, the FDA now requires documentation on software for new medical and other products: a paper trail, in other words, that can be examined by an independent body and retraced for flaws. Anyone have any idea if this can be looked at by the end user? I'm not a radiation technologist of the flavour mentioned in the article, I'm on the diagnostic side. I use an MR scanner with numero…

I don't know if this makes you feel any better, but if the device manufacturer are indeed playing by FDA rules, the e-mails that you have sent should have triggered serious investigations into these bugs. That doesn't mean that they would be fixed, but they would be triaged to assess how and when they happen, and what risk they pose to patients.

This is known as the Corrective Action, Preventative Action (CAPA) process [0]. Note that the investigation into your complaint is an absolute requirement. Not just e-mails, but even phone conversations, or comments made in passing verbally - if any of them constitute a comment (positive or negative) on the device, this needs to be logged and, if the comment warrants it, an investigation must take place.

So either your comments have been or are in the process of being investigated, or the device manufacturer is not following the FDA rules.

[0] http://en.wikipedia.org/wiki/Corrective_and_preventive_actio...

Re: Fatal Dose – Radiation Deaths linked to AECL Computer Errors (1994)

#22

Post by kohanz »

lostlogin wrote: post #14
tokenadult wrote: post #13

Earlier quoted context omitted.

My son the hacker used to work in the medical device industry as a summer employee while he was a student. The code he wrote for a medical device user interface was to be submitted for a line-by-line code review by the FDA. He estimated that the product would actually come to market more than three years after the summer he worked on it. And maybe that is what you are encountering--the person at the company who built…

Thanks - this has been in the back of my mind and is a reason I'm trying to be patient. A 2 line message saying what was happening would remove my frustration. Usually I get a corporate speak reply with a suggestion it is my fault though. What does the FDA code review do? If it isn't catching bugs that take the scanner offline for hours at a time, what is the point?

I've worked on several FDA-regulated products and have never had the FDA review my code. I would guess this only happens in extenuating circumstances. The FDA does not have the resources to do this for most products out there.

We are required, however, to review our own code and maintain records of those reviews.

Re: Fatal Dose – Radiation Deaths linked to AECL Computer Errors (1994)

#23

Post by pathdependent »

merraksh wrote: post #20

The Therac-25's software program, relatively crude by today's standards, probably contained 101000 lines of code. At one error for every 500 lines, that works out to the possibility of twenty errors. I'd say 200, not twenty.

I think the article was OCR'd. There were a few other mistakes that were clearly misinterpreted characters. I think the 1 in the thousands place is actually a comma on the source.

Re: Fatal Dose – Radiation Deaths linked to AECL Computer Errors (1994)

#24

Post by spectre256 »

"A professor in computer engineering at the University of Toronto told me that, as a matter of course, his undergraduate students are warned about the risks of incrementing numbers in a computer program."

As someone with a computer science degree who was warned of such risks and studied the Therac-25 in my classes, this sentence made me realize how far we have to go as professionals. Something seemingly so simple as incrementing a number, one of the most common things done in a program, can cause serious problems (of course we have more help with this now than in the mid 80's). Other people must read things like that and cement any distrust they have in computers and computer programmers. And they're probably right to.

Re: Fatal Dose – Radiation Deaths linked to AECL Computer Errors (1994)

#25

Post by laurenstill »

kohanz wrote: post #22
lostlogin wrote: post #14

Earlier quoted context omitted.

Thanks - this has been in the back of my mind and is a reason I'm trying to be patient. A 2 line message saying what was happening would remove my frustration. Usually I get a corporate speak reply with a suggestion it is my fault though. What does the FDA code review do? If it isn't catching bugs that take the scanner offline for hours at a time, what is the point?

I've worked on several FDA-regulated products and have never had the FDA review my code. I would guess this only happens in extenuating circumstances. The FDA does not have the resources to do this for most products out there. We are required, however, to review our own code and maintain records of those reviews.

Compliance officer for a med device company, can confirm. Even vendor audits don't look at code, just SOPs and spreadsheets documenting that you have the processes in place to log the shit out of everything.

Re: Fatal Dose – Radiation Deaths linked to AECL Computer Errors (1994)

#26

Post by throwwit »

kohanz wrote: post #2

The Therac-25 case study is a tragic one, but fortunately it is not forgotten. I work on medical devices (and have worked on radiotherapy devices previously) and the standards for quality systems and regulatory hurdles (which I occasionally see bemoaned here on HN) are there with good reason. In fact, Therac-25 is often cited when training new hires on quality (as required with any ISO-13485 compliant QMS).

I hope there are sensor mechanisms that confirm and/or failsafe the exposures nowadays.

Re: Fatal Dose – Radiation Deaths linked to AECL Computer Errors (1994)

#27

Post by blabby »

At the time of Therac-25, FDA was only budgeted to investigate 6 percent of device applications.

Currently, the same mistakes made in the eighties with Therac-25 are being made in many radiation therapy devices. The two NY Times articles (Pulitzer Prize winning) in 2010 and 2011 describe some of the newer cases.

What's shocking to me is that the incidents are always reported in isolation. People become briefly outraged, then the furor dies down until the next death.

Many of the comments in this thread suggest that people can't or won't face the fact that this is a current, ongoing problem of great complexity.

A couple of comments mentioned the coverage of Therac-25 in schools. Very little of what is taught in schools makes it into the programming of radiation therapy devices. History has shown that schooling is not a sufficient solution.

Other comments claim (erroneously) that the FDA is attending to the problem. The FDA has been carefully defanged by the medical device lobby. The FDA has gotten smarter, but has nowhere near the funding to keep pace with its charge and never will.

I wish I could say that I see some hope but I don't see it.

Re: Fatal Dose – Radiation Deaths linked to AECL Computer Errors (1994)

#28

Post by cnvogel »

lostlogin wrote: post #5

>>As a result of the Therac-25 accidents, the FDA now requires documentation on software for new medical and other products: a paper trail, in other words, that can be examined by an independent body and retraced for flaws. Anyone have any idea if this can be looked at by the end user? I'm not a radiation technologist of the flavour mentioned in the article, I'm on the diagnostic side. I use an MR scanner with numero…

For future bugs:

Don't send random emails to people in the company, most people can't be held accountable for mishandling bug-reports (or ignoring them).

Look up the contact to send non-conformance reports in the user-manual of the device, there has to be a contact address, maybe even a (paper) form to fill out. Send it by paper-mail to the address (most likely the QA department). Request a classification of the issue (urgent, user-error, critical, ...) and an ID under which this issue is tracked. Set a deadline for replies to your inquiries.

If you really want to be serious, the FDA takes reports on defective medical products, here's a webpage on this process:

http://www.fda.gov/Safety/MedWatch/HowToReport/DownloadForms...

Re: Fatal Dose – Radiation Deaths linked to AECL Computer Errors (1994)

#29

Post by snom380 »

lostlogin wrote: post #14
tokenadult wrote: post #13

Earlier quoted context omitted.

My son the hacker used to work in the medical device industry as a summer employee while he was a student. The code he wrote for a medical device user interface was to be submitted for a line-by-line code review by the FDA. He estimated that the product would actually come to market more than three years after the summer he worked on it. And maybe that is what you are encountering--the person at the company who built…

Thanks - this has been in the back of my mind and is a reason I'm trying to be patient. A 2 line message saying what was happening would remove my frustration. Usually I get a corporate speak reply with a suggestion it is my fault though. What does the FDA code review do? If it isn't catching bugs that take the scanner offline for hours at a time, what is the point?

There's a difference between bugs that cause downtime and bugs that endanger the life of the patient, and I think the FDA is primarily concerned with the latter. I would think a bug that caused the wrong image to be captured and could cause doctors to make the wrong decisions would be taken very seriously.

Re: Fatal Dose – Radiation Deaths linked to AECL Computer Errors (1994)

#30

Post by lstamour »

blabby wrote: post #27

At the time of Therac-25, FDA was only budgeted to investigate 6 percent of device applications. Currently, the same mistakes made in the eighties with Therac-25 are being made in many radiation therapy devices. The two NY Times articles (Pulitzer Prize winning) in 2010 and 2011 describe some of the newer cases. What's shocking to me is that the incidents are always reported in isolation. People become briefly outrag…

Why hasn't the hardware failsafe for overdoses become mandatory? Why don't we apply defense-in-depth to all worst-case scenarios involving deadly things?

Of course, sometimes hospitals aren't logical, air circulation between rooms comes to mind. And here, I'm sure everyone just trusts the machines because they paid a lot of money for them and it's always worked in the past ...

Post reply on HN