Software Dependability for Digital Instrumentation and Control Systems in Nuclear Power Plants - Lessons Learnt from a DOE Sponsored Project
This paper discusses the lessons learnt from a sponsored study undertaken under the sponsorship of the Department of Energy by a team of scientists at the Ohio State University in collaboration with Technology Resources and experts around the world. This paper makes recommendations for future research and studies based on these lessons learnt. The purpose of the research was to provide a software dependability quantification framework that would allow its evaluation along the software development life cycle for safety critical instrumentation and control systems (I and C) such as those found in nuclear power plants. A typical example of safety critical system is the reactor protection system. The research funded by the Department of Energy built on preliminary research carried out for the US NRC that had focused solely on software reliability quantification. Quantification of software dependability is important for safety critical I and C because the regulatory framework in use in the United States for nuclear power plants is risk informed. Quantification of risk requires quantification of all contributors to risk and those include instrumentation and control systems. The purpose of the study was to help developers of software-based I and C with an early evaluation of the potential risk an application would represent at different stages of the software development life cycle by building gates at the end of each life cycle phase. Life cycle phases of software development comprehend phases such as requirements, design, coding and test. The gates' function would be to stop development from moving forward if the assessed dependability objective for that phase were not met. Gates thresholds were to be defined based on measurements collected during the life cycle phase under evaluation and phases that preceded it and an understanding of the mechanisms that would lead to threatening the dependability objectives. The information contained in the gates would in addition help steer the development towards areas that needed improvement. The following are four high level conclusions to our study. First the study demonstrates a lack of consensus on mechanisms that will threaten the dependability attributes. This lack of consensus should be resolved. The lack of consensus appears for all measures to the exception of reliability. Second, measures should be developed for software availability and safety. Third, for all dependability attributes (with the exception of reliability) consistency of the measurement threads should evaluated and measurement-based development gates derived. Finally our ability to perform such type of research depends in a significant manner on access to vendor and/or utility data. The licensing environment and the first-of-a-kind nature of current software-based applications for nuclear I and C make it difficult to collect the relevant data. An approach which would either increase access to data by providing 'immunity' to the vendor or utility or the development of a software-based I and C for the sole purpose of data collection for research should be investigated. (authors)