Å®ÉúСÊÓƵ

Safety software for the Sizewell B reactor on the Suffolk coast must
undergo at least three extra months of tests after apparently failing more
than half the 50 000 checks run on it over the past nine months.

Nuclear Electric, the state-owned nuclear power company that will operate
the country’s first pressurised water reactor, blames the failures on programs
written to test the safety software, not the safety software itself. However,
the Nuclear Installations Inspectorate (NII), which must approve the software
before the plant can begin operating, has insisted that it must be checked
again.

The software failure was revealed in an internal NII report in July,
which was leaked to the trade paper Computer Weekly last month. The Health
and Safety Executive – of which the NII is a part – has declined to publish
the report, saying that it would do so only if there was a question of ‘immediate
risk to public safety’.

The delay means that the software, which is intended to shut down the
reactor in an emergency, is extremely unlikely to be verified as safe before
January. The company had hoped to win permission to load fuel into the reactor
by February.

Independent experts in the field of safety-critical software point out
that even if the test programs are to blame, the failures are bound to shake
confidence in the safety software. ‘Nobody’s saying that there’s evidence
this software is unreliable. It’s just that there’s not enough evidence
that it is reliable,’ says one industry source.

Experts are also critical of the NII report on the tests, which appears
to contradict itself. It concludes that ‘we cannot be fully confident .
. . that the original integrity target for the system has been achieved’,
while describing the shortfall as ‘not unacceptable’.

The safety software was originally developed by the American company
Westinghouse in the 1970s. Nuclear Electric altered it substantially to
tailor it to Sizewell B. To test the new version against internationally
accepted standards, Nuclear Electric commissioned Rolls-Royce to develop
test software that would reproduce the variety of messages that the reactor
could conceivably send to the safety software.

This ‘test harness’ was then run to check that the safety software met
its specifications. In 48 per cent of the 50 000 tests run, the safety software
did not give the response that would be expected from its specification.
Nuclear Electric contends that this is because the harness did not mimic
the reactor properly.

‘Given that this was a new way to test software, it’s not surprising
that the harness didn’t work properly,’ says Victor Beckett, Nuclear Electric’s
engineering manager for Sizewell B. ‘The safety software hasn’t really
failed half the tests. In fact it hasn’t failed at all.’

But, one expert retorts: ‘If they can’t get the test harness right,
why do they think they can get the original software right? Writing the
software for the harness is, in a way, the inverse of writing the original
software. The problem here is that of the first 50 000 tests, they couldn’t
decide which answers were acceptable and which were not.’

The Sizewell B software will form the primary protection system for
the reactor, detecting problems and automatically shutting it down if necessary.
If the primary control system fails a secondary control system relying on
mechanical, rather than computerised, systems will come into play. This
system will be overseen by human operators.

The software for the primary system consists of more than 100 000 lines
of program code running on more than 300 microprocessors, plus another
100 000 lines of configuration code which sets the limits of acceptable
outputs from the reactor. Industry sources point out that this configuration
code is virtually impossible to check.

The issue has caused splits within professional organisations. In an
open letter written jointly with the Institution of Electrical Engineers,
the British Computer Society’s chief executive Gavin Kirkpatrick says he
believes there should be public debate about these issues. ‘Both BCS and
IEE have members who are expert in this subject and who would welcome the
opportunity to make a considered appraisal.’

However, Kirkpatrick refuses to give names of members of the BCS’s safety-critical
‘task force’, who meet occasionally and have often voiced criticism of the
Sizewell project.

The NII must approve the software before it gives Nuclear Electric permission
to start loading radioactive fuel into the reactor. The company also needs
the NII’s approval if it is to win a contract, thought to be worth up to
£1 billion, to build a nuclear power plant using the same software
at Lung Men in Taiwan. The company is bidding for the business with Westinghouse.
Nuclear Electric also plans to use the software in its proposed Sizewell
C plant.