Å®ÉúСÊÓƵ

AFTER nearly a decade of deliberation, Britain’s Nuclear Installations
Inspectorate (NII) is still not satisfied with the software designed to
protect Britain’s latest generation of nuclear reactors from accidents.
Last week, leading experts in computerised safety systems raised their fears
with members of parliament about how the ‘safety-critical’ software to protect
the reactors at Sizewell B and Hinkley C from disaster is being written.

Martyn Thomas, who has been closely involved with work on standards
in this field for the Ministry of Defence, fears that the software, ordered
by the Central Electricity Generating Board from Westinghouse in the US,
does not meet standards that the MoD is due to publish in May.

Thomas, who is chairman of the committee on safety software at the British
Computer Society, says that Britain leads the world in designing, writing
and testing safety-critical software. Yet, the CEGB has failed to take account
of developments in this area in the software that it has chosen to protect
Sizewell B and Hinkley C. These will be the first nuclear power stations
to rely so heavily on computer systems to protect their reactor cores from
accidents.

‘In my view the MoD’s standard will have a powerful effect on the rest
of industry. Any responsible contractor would consider very, very carefully
whether the requirements in the standard should be met or not,’ Thomas says.
He was speaking on Monday last week to an audience of MPs concerned about
issues surrounding information technology, and specialists from the computer
industry.

Doubts about the CEGB’s choice of computer hardware and software have
persisted since the Sizewell B public inquiry. The hearing learnt that the
government’s nuclear inspectors had reservations about the protection system
that the CEGB intended to use. The inspectors wanted the software independently
validated.

The inspectors insist that the CEGB demonstrates the low probability
of a failure of its reactors. ‘The thrust of the defence standard is that
this probabilistic approach is not the right way to certify systems,’ says
Thomas. We don’t have adequate experience to make claims on the probability.
This is psychology, not engineering. Engineering judgment based on mathematical
reasoning has got to be better than pure judgment on its own, particularly
in an area of technology as new as this.’ The NII said this week that it
would insist on ‘state-of-the-art’ software.

The board confirmed last week that the issue was still under discussion:
‘The board is working to high British standards, which are well thought
of around the world, and to the NII’s requirements,’ a spokesman said. The
board wanted its Hinkley C plant to replicate that at Sizewell B. This will
keep down the cost.

In May, the MoD will publish for comment its new standards for safety
critical systems, called Def stan 0055. It will make it mandatory that any
software written for the MoD must adhere to a strict set of mathematical
rules, known as formal methods.

‘It is worrying that a set of standards should be promulgated as mandatory
by the MoD for systems that are a lot less safety critical (than nuclear
reactors),’ Thomas told New Å®ÉúСÊÓƵ. ‘The MoD is making a big statement
by saying that formal methods are necessary. I would have thought that it
was enough for the CEGB to publicly acknowledge this and to either say that
it agrees and is doing something about it, or disagrees and is not.’

One of the software engineers involved in the assessment of the safety
of the software for the Sizewell B reactor says that he is anxious to know
whether the software meets Def stan 0055. He told New Å®ÉúСÊÓƵ that the
last two or three years have seen huge advances in the development of approaches
to writing such software. Yet the CEGB does not intend to update its software
for Hinkley C. Its computer system is more or less a clone of that designed
five years ago for Sizewell B.

John Gittus, former director of the safety and reliability division
of the UK Atomic Energy Authority, says that he would expect the software
for Hinkley C to meet or exceed any standards written this year.

Ron Bell, who is leading the work on creating better standards for computer
systems at the Health and Safety Executive, says that the executive is in
the process of setting up a formal framework on safety-related software
which would take account of the MoD’s standard.

‘Usually, it is the specification or the design (of safety critical
software) that turns out to be wrong,’ says Thomas. ‘We are putting in systems
whose specification states that they should not fail more often than once
in 100 million reactor years; these are orders of magnitude beyond what
we can guarantee scientifically. Nobody knows how complex systems are, and
nobody is collecting statistically valid data on the types of faults that
occur. We do not know how bad it is today, so cannot estimate how bad it
will be tomorrow.’

He adds that ‘there must be levels of complexity in software and risks
beyond which it is not safe to go. There is no agreement within the industry
as to what those levels are, or how you would measure them.’