systems
The machine that overdosed
It is 1986, and a radiation-therapy machine has burned a patient with a massive overdose — the second such accident, and the manufacturer keeps insisting the software cannot be at fault because it passed its tests. The truth is a race condition: an experienced operator typing fast enough outruns the safety interlock, and the software fires the beam unshielded. The hardware interlocks of the previous model were removed to save money; software was trusted alone. Reconstruct the failure, then design the discipline that would have prevented it — concurrency made analyzable, safety states verified unreachable-from, hardware backstops that do not trust the code, and an incident process that treats each anomaly as evidence. Get it wrong and the machine keeps killing patients while the logs show nothing.
Who this problem belongs to
The two figures whose methods fit it best, out of 44 in contention.
Dijkstra's invention of the semaphore and his rigorous analysis of mutual exclusion, developed specifically to prevent exactly this kind of hazard, two concurrent operations racing to touch shared state with no guaranteed ordering, is the direct technical answer to the Therac-25's actual failure: an operator typing fast enough to outrun the software's assumed sequencing, letting the beam fire before the safety interlock check completed. His insistence that concurrent correctness must be proven, not tested, is precisely the discipline this problem's 'concurrency made analyzable' demands, and his broader stance that testing shows the presence of bugs, never their absence, explains exactly why the manufacturer's claim that 'it passed its tests' was worthless. He died before Therac-25's 1985-1987 accidents, but his 1960s mutual-exclusion work already contained the fix.
Hoare's axiomatic approach to program correctness, and his rigorous framework for reasoning about concurrent processes, is exactly the formal machinery this problem's 'safety states verified unreachable-from' demands: prove, rather than merely test, that the beam-unshielded state can never be reached regardless of how fast an operator types or how the software's internal race unfolds. His famous later reflection that 'the billion-dollar mistake' of unchecked null references teaches a broader lesson directly applicable here, that trusting software's apparent behavior without formal verification of its safety properties is a catastrophic default. His concurrency-verification tools arrived in the same general era as the Therac-25 accidents, giving him deep technical and temporal proximity to exactly the discipline this problem's 'design the discipline that would have prevented it' requires.
44 figures are scored on this problem. Draw it in a battle to see where you land.