Software of Safety Important I&C Systems - Nuclear Power Plant Instrumentation and Control Systems for Safety and Security - page 170

In this case, one can use special metrics, and the
evaluation overall can be carried out and presented
by means of radial metric diagrams.
The ratio of the number of software modules
(or subsystems), which have been developed us-
ing such methods, to the total number of modules
(subsystems) can be used as metrics for evaluat-
ing the fulfillment of requirements for the use of
formal methods.
The quality of software development, fulfill-
ment of requirements for the number of modules,
complexity of relations among them can also be
evaluated by using special metrics (for example,
the Halstead metric, McCabe metric and others
(Pressman,1997)).
It should be emphasized that evaluation of
the fulfillment of requirements for software by
nature is subordinate with respect to evalua-
tion of verification, because these requirements
are overall requirements for development and
verification, or are checked directly together with
evaluation of software verification. This pertains,
in particular, to evaluation of the development
results themselves, execution of requirements for
methods and tools.
Tasks and criteria of software verification
evaluation: The quality of conducting verification
of software is of great significance for reliability
and safety of the I&C system. The tasks of software
verification evaluation are: analysis of software
requirements based on requirements for the system
and general requirements, which are determined
by normative documents; check of the conformity
of task formulations for software development to
these requirements; quality check of the verifica-
tion plan, test methods and their completeness in
accordance with the tasks assigned to the software;
the quality check of verification reports and their
conformity to plans and methods.
One should note that these tasks, and also the
tasks of evaluating the quality of their solution
from the standpoint of fulfillment of requirements
for safety, are not easy to formalize. Usually the
verification analysis is accomplished by traditional

methods of documentation analysis, and individual
results can be checked by using specially devel-
oped tools. At the same time, considering the high
criticality and importance of a maximally objective
and complete evaluation of software verification,
one must find approaches to the development of
models that describe this process and allow one
to improve its quality.
The process of software verification evalua-
tion of I&C systems that are important for nuclear
power plant safety can be constructed by means
of (Kharchenko, 2000): formation and structur-
ing of the full set of requirements for software,
which must be checked in the verification process
at different stages of the lifecycle; development
of a system of criteria for evaluating software
verification; compilation of a system of verifica-
tion evaluation criteria and set of requirements
established for the software; formalization of the
verification analysis processes and its evaluation
for basic criteria; creation and use of tools for
support of software safety analysis during verifi-
cation, licensing and expert analysis.
Criteria for verification is similar to the criteria
of software evaluation represented above and in-
cludes the criteria of completeness, independence,
successfulness, documentation and accessibility.
Software verification corresponds to the
completeness criteria if during the verification
the conformity of software to all requirements
of specifications, standards and other normative
documents was tested.
Software verification corresponds to the inde-
pendence criteria in accordance with the software
safety class. Thus, for class 2 verification is con-
ducted by a group of specialists (organization),
which are administratively and/or financially
independent of the specialists (organization),
which developed the software.
Software verification corresponds to the cri-
terion of successfulness, if the verification was
finished completely prior to placing the system
in use, that is by this time all defects found were