Software failure 'may be behind ambulance crisis'

COMPUTER specialists yesterday said that the system blamed for this week's crisis at the London Ambulance Service appeared to ignore basic tenets for software where breakdown would put lives at risk.

The failure of the computer system over 36 hours on Monday and Tuesday, which was said to have cost between 10 and 20 lives, raised serious questions about the way it was designed and tested, experts said. Yesterday, the software company involved, Systems Options, refused to comment.

Leaders of London's ambulance staff last night revealed they had given the service's new chief executive three days to review the efficiency of the computer system.

Organisers of the public employees' union, Nupe, said they would have preferred the Computer Aided Dispatch system to have been shut down because it was a danger to the lives of patients.

But Chris Humphreys, the union's London regional organiser, said they had chosen to allow a short period of grace to Mark Gorham, the acting chief executive who replaced John Wilby after his resignation in the wake of an outcry over delays of up to 11 hours in the arrival of emergency vehicles.

However, Mr Humphreys refused to disclose what action the union planned to take if the management refused to meet its demands or arrive at a satisfactory compromise.

He emphasised that by reverting to the system in use prior to full computerisation on Monday and Tuesday, patients' lives were still at risk. Ambulance staff argue that the system of partial computerisation, used in conjunction with radio and telephone to send ambulances to emergency calls, had already led to 45 deaths in the capital because of delays.

However, Mr Gorham yesterday held out an olive branch when he met union leaders by promising to conduct a full investigation into the 20 deaths ambulance staff said were the result of delays and breakdown earlier in the week.

Robin Bloomfield, a consultant who advised the Government on a programme to promote the safety of computer-controlled systems, said it was a fundamental requirement for this kind of system to have several layers of defence against failure.

He said the ambulance service was asking a lot of its computer system. 'With about a million calls a year the system has to be more reliable than a nuclear reactor protection system. I would expect to see a detailed safety case for justifying its operation, and several different back-up systems.'

He said that as the system originally went into operation, the only back-up it appeared to have was the expectation that people would make their own arrangements if the system failed.

'Safety critical' software should always be passed to an independent assessor to make sure it does what it is supposed to, and passes safety checks. This is standard practice as part of the 'safety culture' of companies in the nuclear and transport industries which often use software on which people's lives depend.

Such software should have at least one back-up system which could be manual, electronic or even an administrative procedure, ready to switch into operation should something go wrong, Mr Bloomfield said. 'You would very rarely rely on a single system.'

Extra calls on Monday exacerbated the situation, but the computer system should have been designed to cope with this. Tom Anderson, a director of the Centre for Software reliability in Newcastle upon Tyne, said: 'If you are getting overload the system should go into a fall-back mode.'

More than a quarter of accident and emergency ambulances from the London Ambulance Service are failing to meet performance standards in the Patient's Charter, Tom Sackville, Under- Secretary of State at the Department of Health, said in a written Commons answer yesterday.

The charter sets a 14-minute response time as the standard for London. Latest statistics, for 1990- 91, show 26.3 per cent falling below it, even though in 11 per cent of cases ambulances were able to respond in just seven minutes.

Letter, page 18

(Photograph omitted)