Implementing Successful Software for Digital Instrumentation and Controls at the High Flux Isotope Reactor

The High Flux Isotope Reactor (HFIR) is an 85 megawatt research reactor operated at the Oak Ridge National Laboratory for the US Department of Energy. Beginning operation in 1965 for isotope production, its primary role now is to support thermal and cryogenic neutron scattering in addition to isotopes production, material irradiation, and neutron activation analysis. Under the HFIR original design, its safety and operation incorporated the most advanced analog instrumentation available with a large percentage designed and built at ORNL for HFIR specific use. While this high degree of instrumentation specialization was a benefit at initial operation, it is now more of an impediment as analog parts and human expertise in the nuances of the original HFIR analog design are no longer available. As a result, the HFIR has begun a transition from analog to digital instrumentation for several systems. In our preparation for designing digital systems for the HFIR, our investigations into software engineering found that although the efforts to standardize terminology, develop software life cycles, and define guidelines and professional standards were extensive, designers and regulators continued to struggle with developing "error-free" software with most problems residing not in the hardware but the software. Statistics aggregated on the topic of software errors show that defects from a variety of sources are to be expected throughout the software development process. The HFIR software engineering group has developed a software development process that incorporates all expected software quality assurance documentation and includes a rigorous matrix of training and project management guidance; requirements definition and code development tools; and structured reviews and testing. Since 2007, the meticulous application of our process has resulted in only nine software defects of low severity significance and zero defects of high severity significance in 135,000 hours of operation of four systems with complete analog-to digital replacement. (author)