Open-Source BAHAMAS Tool Quantifies Software Failure Risk in Nuclear Plants

Software failures in nuclear power plants are among the most consequential engineering problems of the digital age, and for decades the industry has struggled to quantify them with anything approaching confidence. Now researchers at Idaho National Laboratory have released an open-source tool that promises to change that. Called BAHAMAS — short for BAyesian and Human reliability analysis Aided Method for the reliability Analysis of Software — the application generates data-driven software failure probabilities for digital instrumentation and control systems, replacing the overly conservative estimates that have long inflated the cost of nuclear plant modernization. The tool is described in a paper published in the journal SoftwareX, and its code is freely available under the GNU Lesser General Public License.

The timing is significant. Renewed interest in nuclear power, driven by clean energy goals and efforts to reinvigorate the nuclear industrial base, has made digital instrumentation and control upgrades a central strategy for improving plant safety and reliability. But these digital systems are complex, and regulators and operators demand robust, risk-informed evidence that they will perform safely before licensing them. When that evidence is insufficient, plant owners often fall back on costly backup analog systems, delaying deployment of modern digital technology by years and adding millions of dollars to project budgets.

The heart of the problem lies in how probabilistic risk assessment, or PRA, is performed. PRA commonly uses fault trees — logic diagrams built from AND and OR gates — to model how combinations of individual component failures, called basic events, can propagate into system-level failures. For hardware, engineers can draw on decades of operational data to assign realistic failure probabilities to these basic events. For software, particularly in safety-related systems, the historical record is thin. The current industry practice is to fall back on conservative generic estimates, such as those from the IEC 61508 functional safety standard, which tend to overstate failure likelihood and push designers toward overengineered, expensive architectures.

Existing alternatives each fall short in their own way. Reliability data from the Nuclear Regulatory Commission’s Standardized Plant Analysis Risk models reflects proprietary, as-built plant configurations that may not match novel applications or advanced reactor designs. The Military Handbook on electronic equipment reliability covers hardware but offers no software values. Regulatory reports such as NUREG/CR-7044 and NUREG/CR-7233 reviewed quantitative software reliability models and developed Bayesian approaches, but nearly all quantitative methods depend on testing or historical data that is not always available. The result, the INL team argues, is a significant gap in openly available quantitative fault tree assessment data for utilities and reactor developers planning digital upgrades.

BAHAMAS fills that gap with a Bayesian belief network that ingests information from every stage of a software development lifecycle — concept, requirements, design, implementation, testing, and installation and maintenance — and converts it into probabilities for predefined software failure modes. The insight underpinning the tool is that the quality of engineering practices at each lifecycle stage influences whether intentional or unintentional defects survive into the delivered product. By aggregating defect introduction and defect removal information across the lifecycle, BAHAMAS calculates the probability that specific failure modes will occur, rather than relying on generic best estimates.

Those failure modes are drawn from Systems Theoretic Process Analysis and are known as unsafe control actions. They come in four types: failing to actuate when needed, actuating at the incorrect moment such as a spurious signal, engaging too early or in the wrong sequence, and failing to engage long enough or being applied too long. To link defects to these failure modes, BAHAMAS employs orthogonal defect classification, an empirical method that sorts software defects into eight classes — assignment, checking, documentation, algorithm, function, timing, relationship, and interface. A correlation table built from more than 1,000 open-source defect reports assigns each defect class a probability of triggering each unsafe control action. A timing defect, for example, carries a 52.4 percent chance of producing a premature or out-of-sequence failure, while an assignment defect carries a 66.7 percent chance of a spurious actuation. Uncertainty in these correlations is propagated through the tool using truncated normal distributions.

On the input side, BAHAMAS borrows techniques from human reliability analysis to estimate how likely human errors are to introduce defects during each lifecycle task, whether requirements errors, coding mistakes, or installation blunders. Defect removal is assessed through two metrics: the number of times a task has been reviewed by an engineer or expert, and trigger coverage, which measures the percentage and type of tests conducted that cover scenarios known to reveal defects — such as backward compatibility checks, unit and integration testing, and startup or restart conditions. The Bayesian network then combines these parent nodes to compute the marginal probability that each defect type remains in the software, and ultimately the probability of each failure mode, complete with uncertainty distributions that can be fed directly into fault tree quantification.

The software itself is a standalone Python-based web application that runs on Windows, macOS, and Linux without requiring an internet connection. Users can work through a browser interface built with Streamlit, clone the repository from GitHub for customization, or run the calculation engine from the command line with configuration files specifying sampling parameters, input spreadsheets, and analysis type. Five functionalities are exposed through the side panel: a preliminary assessment that assumes global mean values for teams with immature development processes, a qualitative software quality survey for first-time users, a comprehensive assessment that exposes every configurable parameter, a common cause analysis that automatically generates common cause component groups for redundant systems using keyword matching on coupling factors, and a survey-based grouping tool for qualitative evaluation of those groups.

The tool has already been tested in an industrial setting. INL collaborated with the Pressurized Water Reactor Owners Group on a pilot application to quantify the failure probability of a digital safety actuation system. Researchers were given typical software development documents, including software requirement specifications and detailed design documents, along with proprietary logic and configuration files. The pilot demonstrated that BAHAMAS is compatible with existing industry workflows and produces failure probability estimates in ranges commensurate with IEC 61508, roughly 1E-5 to 1E-4. Crucially, by considering the quality of the software development lifecycle and systematic design information, BAHAMAS provided a defensible basis for preventing common cause failures from dominating the plant’s PRA model — something the original best-estimate value, which contained no development process information, could not do.

BAHAMAS complements rather than replaces existing fault tree tools such as SAPHIRE, CAFTA, and the open-source OpenPRA suite, which can quantify fault trees but still require users to supply basic event probabilities. By quantifying software basic events directly from lifecycle evidence, BAHAMAS closes that loop and reduces unnecessary conservatism in plant design. Under the Department of Energy’s Light Water Reactor Sustainability Program, the broader INL framework — which also includes the RESHA hazard analysis method and the ORCAS defect classification tool — offers a structured methodology of hazard identification, reliability quantification, and consequence evaluation. Together, these tools give the nuclear industry what it has lacked: an open, transparent, and reproducible way to demonstrate that modern digital control systems are safe enough to replace the analog equipment they are meant to succeed, potentially accelerating the deployment of modernized control systems across the existing fleet and the advanced reactors now on the drawing board.

Subject of Research: An open-source Bayesian belief network application for quantifying software failure probabilities in nuclear power plant digital instrumentation and control risk assessments.

Article Title: BAHAMAS: An open-source application for risk assessment of nuclear power plant digital systems

Article References: Chen, E., Shorthill, T., Wang, C., & Kim, J. (2026). BAHAMAS: An open-source application for risk assessment of nuclear power plant digital systems. SoftwareX, 36, Article 103004. https://doi.org/10.1016/j.softx.2026.103004

Image Credits: AI Generated

DOI: 10.1016/j.softx.2026.103004

Keywords: BAHAMAS, nuclear power plants, digital instrumentation and control, probabilistic risk assessment, software reliability, Bayesian belief network, fault tree analysis, common cause failure, orthogonal defect classification, Idaho National Laboratory, open-source software, unsafe control actions