Seems to me that medical devices should be programmed in the same style as the computers guiding the space shuttle. It's not exciting, but it works and keeps people alive.

I don't think that this is necessary. A medical devices just needs to shutdown if it is about to enter a potentially unsafe state. A space shuttle can't just shut down; it has to keep functioning no matter what. That's a much harder problem to solve, and would create unnecessary development expense. (Though some techniques are applicable; have a safety mechanism that shields the radiation-producer if the two CPUs disagree about a computation. If the two CPUs are running two different programs to calculate the 'next step', then this should prevent many random accidents.)

There was a great article posted about that here a bit back: http://www.fastcompany.com/node/28121/print

Bugs in things that radiation at people make headlines and people tend to remember them. It's called availability bias.

http://en.wikipedia.org/wiki/Availability_heuristic

All software is faulty.

Most of these sorts of devices (patient-facing medical devices) are divided into two physically separated pieces: the part that touches the patient and the part that interacts with the other device.

In the imaging case, the system that actually shoots radiation at the patient should have a hardware failsafe, opto-coupled i/o, clean power, etc. The software is usually written in C or something on an embedded RTOS. Data processing is usually done in Windows or some flavor of *nix running well-tested software.

> All software is faulty.

D. J. Bernstein would disagree probably... (yes - I know his soft is faulty too, but his code is a couple orders of magnitude better than 99.999% of other programmers' code and people needed years to find those bugs)