¿ìè¶ÌÊÓƵ

Last month, a small computer consultancy in Worcester went the way of
many others in the current recession, and called in the liquidators.
But the closure of Charter Technologies is not just another hard-luck story:
it contains tough lessons for any company contemplating doing business with
the Ministry of Defence.

Charter Technologies was working with the MoD on the commercial exploitation
of what was a potentially brilliant breakthrough in computer technology:
a microprocessor designed by the MoD, known as the Viper, with a ‘proven
correct design’. When it transpired that the chip’s capabilities did not
live up to the original claims, the support of the MoD disappeared and Charter
was left holding a chip that was not what it said it was.

With the ministry under pressure from government to earn more from commercial
spin-offs from its home-grown technology, the story of Charter and the Viper
chip highlights the often callous treatment the MoD metes out to the companies
that it deals with, especially small ones. It also illustrates that there
is much more to converting defence-related research into commercial products
than taking a laboratory breakthrough and mass-producing it.

The story begins in the early 1980s, when computer technology was beginning
to be used in situations where fault-free operation was vital, such as railway
signalling systems, running nuclear power stations and controlling both
military and civilian aircraft.

Computer scientists began to worry about these applications: just how
reliable were all these systems? The fear was – and still is – that it may
be just a matter of time before unforeseen design faults appear, with catastrophic
results.

None was more concerned to develop so-called safety-critical systems
than the Ministry of Defence. Many high-technology weapons are triggered
or guided by computers, and more and more fighters rely on ‘fly-by-wire’
technology.

¿ìè¶ÌÊÓƵs at the MoD’s Royal Signals and Radar Establishment (now part
of the Defence Research Agency) in Malvern believed they had the answer
and that their techniques could be applied for civilian purposes as well
as military.

Since the early 1970s, a team at RSRE had been working on ways of mathematically
specifying and analysing computer software. Using these so-called ‘formal
methods’, computer scientists draw up an exact specification for the tasks
a software system must carry out. The software is then drawn up in such
a way that it is possible at the end of the process to prove that the software
system meets the specification exactly. The attraction of formal methods
is that they offer a way of checking that a computer program will behave
as it is designed to do and not spring any nasty surprises.

In 1983, the RSRE team decided to go a step further, and apply these
techniques to the design of a computer chip. Formal methods would, in theory
at least, enable the design of the chip to be verified right down to the
level of its individual logic gates. The Viper (the name is short for verified
integrated processor for enhanced reliability) was to be the first commercially
useful microchip to have its design proved free of errors.

To make this possible, Viper had to be a relatively unsophisticated
device: it has a reduced set of instructions for a programmer to use compared
to a normal chip, and it stops dead as soon as a problem like arithmetic
overflow occurs. It was nevertheless an ambitious project and it soon caught
the interest of the media.

In January 1988, Viper was publicly launched by the MoD. At the press
conference, John Cullyer, head of the RSRE design team, made no secret of
how important he thought Viper was. Unless something was done, computer-aided
disasters were inevitable. ‘Some time between 1991 and 1992 computers will
start to kill human beings in a way that will be noticed,’ he predicted.

There seemed no doubt that Viper would give Britain a world lead in
reducing the risks of failure in computer-controlled systems. The researchers’
enthusiastic claims were backed by the then director of RSRE, Nigel Hughes.
In his foreword to the promotional literature handed out after the launch
of the microchip, Hughes said: Viper is the first commercially available
microprocessor with a proven correct design.’

Like many others, Digby Dyke, managing director of Charter Technologies,
was impressed by the MoD’s work on Viper and signed a deal with the ministry
to provide the software ‘toolkits’ needed for Viper to meet a specific application.
The company was a regular defence contractor.

By the end of 1988, Charter had its rust customer with a safety-critical
application: the Australian National Railways Commission. The commission
was setting up a new railway signalling system, at a cost of A $20 million
(£10 million), and had contracted Teknis – now International Railroad
Systems – of Adelaide to develop it using Viper microprocessors. Charter
provided all the technical details needed to put Viper at the centre of
the new system.

But in September 1989, Dyke received a bombshell. It was delivered by
Cullyer himself, who had by then left RSRE to become a professor at the
University of Warwick. Cullyer revealed that he had just seen a technical
report on the verification of Viper’s design compiled by Computational Logic
of Austin, Texas. He said that the report highlighted errors in the proofs
of the chip’s design that would ‘kill Viper dead’. Cullyer advised Dyke
to ‘get out of Viper’ as quickly as possible.

The critical report had been commissioned by NASA, one of the organisations
chosen by the Mob to examine pre-production models of Viper. While the other
organisations had restricted themselves to comments about Viper’s rather
limited technical performance, NASA had decided to probe much deeper, and
look at the claim made about Viper’s designs.

The report detailed major gaps and a number of ‘blatant errors’ in the
proofs, stating bluntly: ‘We are not convinced that RSRE researchers have
formally verified the gate-level implementation of Viper’, adding that it
could never have been done using the RSRE approach. The report concluded
that while being an admirable effort, the Viper project served chiefly to
show up the need for better formal proving methods.

This offered absolutely no comfort whatsoever to Charter Technologies.
‘The proofs that Viper is error-free were either complete, or they weren’t,’
says Dyke. ‘With the gaps, Viper was of no commercial use.’

Alarmed by Cullyer’s revelations, Charter asked Phil Bennett, head of
the safety critical systems committee of the Institution of Electrical Engineers,
for an independent assessment of RSRE’s claims for Viper. In his final report
to Charter, Bennett mentioned a study of Viper carried out by Avra Cohn,
a formal methods expert at the University of Cambridge. This study again
cited errors in Viper’s original proofs, and warned that a chip whose proofs
contain as many gaps as Viper’s ‘does not seem significantly safer than
using any other design’. She added: ‘The use of the word ‘verified’ must
under no circumstances be allowed to confer a false sense of security.’

What the RSRE researchers had proved was a computer model of the chip
rather than the real physical chip itself. ‘It is possible to prove
the properties of models of a chip. What’s impossible is to prove the chip
itself,’ says Michael Gordon, reader in formal methods at the University
of Cambridge. ‘There will always be an issue of whether or not you have
got the correct model. You can always get a better model.’

What constitutes the proof of a microprocessor was irrelevant to the
plight of Charter Technologies, however. What was more important to the
company was that Cohn’s report had been commissioned by RSRE itself, and
that the date of her report – May 1988 – was just three months after the
launch of Viper. Dyke claims that RSRE therefore knew of the serious doubts
about its breakthrough for more than a year without informing him.

This left Charter open to legal action for misrepresenting Viper’s capabilities.
The company needed help from RSRE in defending Viper against the inevitable
questions that would soon be raised.

But by this time – April 1990 – RSRE was backtracking on its initial
statements about the microchip. The original claims of a ‘proven correct
design’ were no longer being made. In the words of the new director Stephen
Robinson, ‘Viper is still, to RSRE’s knowledge, the only microprocessor
for which a formal mathematical specification exists.’

After months of what it says were inconclusive meetings with RSRE, Charter
Technologies decided to issue a writ against the MoD in January this year
alleging misrepresentation, and claiming £285 000 damages.

The case never came to court. The MoD decided – without, according to
Charter, any explanation – not to renew two, completely separate contracts
crucial to the company. These contracts accounted for a large proportion
of Charter’s income, and without them it could not continue to trade.

But that is not the end of the Viper story. The ministry remains under
threat of legal action from the Australian National Railways Commission
and International Railroad Systems. Although both declined to comment (a
common reaction among all parties involved in the Viper affair), it is
understood that none of the estimated 300 Viper chips ordered by the Australians
have ever been used in anything other than prototype systems so far.

Charter’s liquidators have also written to Kenneth Carlisle, under-secretary
of state for defence procurement, using their legal powers to find out why
Charter’s other contracts were not renewed. They have yet to receive a reply.

Carlisle has also had to face awkward questions about Viper in the House
of Commons from Tam Dalyell, Labour MP for Linlithgow. Asked if steps were
being taken to discourage the use of Viper in safety critical systems, the
minister pointed out that despite the ‘debate among theoreticians’ over
what constituted a proof of a microprocessor, no errors had been found in
Viper’s design so far.

Carlisle admitted that his own ministry had yet to put a single Viper
chip into any of its own safety-critical systems. The MoD said this week
that it has nothing to add to Carlisle’s reply on the fate of the Viper.

Bennett, who assessed the chip for Charter, believes the growing pressure
on the MoD to commercialise its ideas may have led the Viper team to try
to get the chip out of the laboratory before it was ready. ‘Viper is undoubtedly
a good idea,’ he says. ‘But there’s an important step between the laboratory
version and a commercial product, and that’s a prototype.’

Dalyell sees in the Viper story worrying implications for all defence
contractors. He fears that any company invited to join the MoD to exploit
its research could suffer the same fate as Charter – and watch past assurances
disappear down the labyrinthine corridors of Whitehall as soon as problems
emerge.

Dalyell says that Charter is not the first to have bitterly regretted
its involvement with the MoD. He cites a company which signed a contract
to supply high-technology equipment to the MoD, only to find the civil servant
it dealt with had been replaced by someone directed to find budget cuts.
The contract was dropped, leaving the company with wasted investment running
into six figures.

He declines to name the company, saying that it feared ending up on
an MoD blacklist – every defence contractor’s nightmare. Some firms have
claimed to have been the victims of smear campaigns by the MoD after failing
to keep quiet.

Brian Lowe, director-general of the Defence Manufacturers Association,
says it is vitally important for any small company to know exactly what
it is entering into when signing up with the MoD, now under pressure from
both the recession and the end of the Cold War. ‘Caveat emptor is not a
bad bit of advice for companies,’ he says. ‘The ministry is holding very
much to the letter rather than the spirit of agreements in some instances.’

Dalyell believes that the MoD has to change the way it deals with its
commercial partners: ‘The MoD needs companies like Charter, and it really
must be far more sensitive in its dealing with such small firms. It seems
to me that had greater candour been displayed by those who had the knowledge
at an earlier stage, Viper might not have left the laboratory, and a great
deal of heartache could have been avoided.’

Robert Matthews is science correspondent of The Sunday Telegraph.