The People Who Keep Forty-Year-Old Software Running

The program that had stopped is one of 1,316 that run, in a fixed order, on one night each month. Between them they calculate and pay the salaries of 63,000 public employees, the pensions of 208,000 retired ones and their survivors, and the water bills of roughly 430,000 households, a third of the country’s total, billed in rotation.^* The run begins at 7 p.m. Its last job must finish by 6 a.m., when a set of payment files goes to the national clearing house; at eight, the money appears in bank accounts. If the files are late, the money is late. In 42 years the run has missed its deadline twice. Achterberg was in the building both times.

The software that does all this is called the Consolidated Accounts and Settlement System. Nobody calls it that.1 It was written between 1982 and 1984 in an old business language, and it has run every month since, through four changes of government, two currency reforms, a move across town, and the arrival of the internet, about which it knows nothing. It is 2.3 million lines long. It is maintained by six people. Four of them are younger than it is.

This is a story about those six people, and about a question that governments everywhere keep asking and answering badly: when a piece of old software holds up something important, do you replace it or look after it? The Service tried replacing it once. The attempt cost more than the Service had spent on itself in the previous decade and produced nothing that was ever switched on. Since then, it has looked after it. Over four months this year, including three month-end runs, I watched how.^†

A machine that is not old

The first thing to understand about the Service’s computer is that it isn’t old. The machine that runs Cass was installed in 2019, and it is the fifth to do the job. It is a black cabinet about the size of a large refrigerator, standing by itself in a hall built in 1976 for its ancestors, which filled the room. The raised floor still has square cut-outs where their cables came up, now covered with plywood. What is old is the software, which has been carried from machine to machine like a family moving its furniture, each new computer built to run the old programs exactly as the last one did.2

Those programs are written in a language designed at the end of the 1950s by a committee that wanted code to read like instructions to a clerk. Its statements come in capitals and whole sentences: add this to that, move that there, perform this paragraph until that condition holds. It is wordy, plain, and stubbornly literal, which is why it was chosen for payroll and pensions in the first place. It does its arithmetic in decimal, exactly, the way an accountant works on paper, rather than in the approximate binary fractions most modern languages prefer. A pension Cass calculated in 1985, recalculated tonight, comes to the same amount, to the last unit.

Cass is also a batch system, which means it does nothing while you watch. All month, changes pile up in files: a new hire at the tax office, a death in Norhaven, a widow’s change of address, a meter reading from a farm outside Little Varne. On run night the programs work through them one after another, each reading the files the previous one wrote, like stations on an assembly line. The order matters. Pensions cannot be paid until tax has been calculated; tax cannot be calculated until deductions are known; deductions depend on the water bills of the pensioners who have asked for their bills to be taken from their pensions, an arrangement introduced in 1993 and used today by 31,000 people. The dependencies form a map that Achterberg can draw from memory. Nobody else can.

In 2009 there were 19 people on the team that maintained Cass. Most of them have since retired. One, Walter Imrie, who taught Achterberg the job in 1982, died in 2019, five years into a retirement he spent, by her account, “mostly ringing me up to ask what had broken.” The six who remain are Achterberg; Gerrit Holm, 61, who looks after the machine itself and the layer of software that schedules the jobs; Teague, 41, who has watched the run from the same chair since 2011; Hana Kurtz, 40, and Joss Aldine, 33, both programmers; and Theo Brannock, 26, the apprentice. Miriam Osei, 46, who runs the Service as a whole, describes her own job as “making sure those six people are never all ill at once.”

The documentation went before the people did. In 2006, when the Service moved from the old Customs House to its present building on Tannery Street, 40 boxes of design documents were sent to a government records store. A retention schedule classed them as routine correspondence, and three years later they were pulped. Nobody at the Service was told until someone went looking for them.

What survived is the binder. Since 1986, every change made to Cass in a hurry—at night, during a run, against the clock—has been written up by hand on a numbered sheet and filed in it. There are now 413 entries, in at least 26 different hands, across three green binders, the first two of which have been retired to a fireproof cabinet. They record what broke, what was changed, and, crucially, why.3 Many of those reasons exist nowhere else.

What the code knows

Entry 301 is in Imrie’s handwriting, with Achterberg’s initials beside his. That night in 2003, PEN0417, the program that calculates survivors’ supplements, had stopped because a widow was owed arrears stretching back 101 months. The field that holds the number of months owed is two digits wide. In 1984 nobody imagined a back payment longer than eight years and three months; nobody imagined, either, the tribunal ruling that would produce one.4

The obvious fix is to make the field wider. The binder says not to, in capitals, and explains why. The layout of a pensioner’s record—which characters hold the name, which the date of birth, which the arrears—is described once, in a shared file that 340 programs copy into themselves, including programs that handle payroll and water. Widen one field and every position after it shifts by a character. Every one of those programs would have to be changed, rebuilt, and tested against every kind of record it reads. At one in the morning, Imrie did the sensible thing. He flagged the case for payment by hand, restarted the job, and left a note for whoever came next.

This September, whoever came next was Achterberg. The new case was a widow in Westmere whose supplement had been stopped in error in 2017 and restored by a tribunal in August, with 104 months of arrears. Achterberg read entry 301 twice, wrote the case number on a sticky note, and talked Teague through setting the payment code. The job restarted at 12:31 a.m. By then she had already gone back to the kitchen to put the kettle on. “It’s not a hard fix,” she said. “It’s a hard thing to know.”

That distinction is the whole difficulty with Cass. The code itself is not delicate. In 42 years it has been hit by every kind of input a country can produce: deaths on leap days, pensioners who turned out to be twins sharing one record, a marriage registered before the groom’s birth. Each left a mark in the code—an extra condition here, a special case there—and, usually, a note in the binder. “People think old code is fragile,” Achterberg said. “It isn’t. It’s been hit by everything. What’s fragile is what we know about it.”

What the code knows, in other words, is the law—or rather the law as it has actually been applied to 208,000 particular people, including every tribunal ruling, ministerial instruction, transitional arrangement, and quiet compromise since 1984. Much of that was never written down anywhere else in a form a programmer could use. Some of it was written down and then pulped. The only complete copy is the running program, and the only people who can read it fluently work in this building.

Meridian

The government did try, once, to get the law out of the code. In 2010 it announced Meridian, a project to replace Cass by 2014 with a new system written in a modern language and running on ordinary servers. The contract went to a consultancy called Fennick Rowe, with a budget of 38.4 million crowns, a figure the Service’s staff still say aloud with a kind of awe. Over the next three years Fennick Rowe’s analysts interviewed everyone at the Service who was still working there, and several people who were not, and produced a requirements document of 2,900 pages describing what Cass did. In the spring of 2013, Meridian ran in parallel with Cass for the first time, calculating the same month’s pensions from the same data. The two systems disagreed about 14,812 of them.^‡

Kurtz was 27 then, an analyst on Fennick Rowe’s team, and she spent most of that year tracing the disagreements back to their source. A few were bugs in the new system. The great majority were rules that Cass applied and nobody had told Meridian about, because nobody remembered them. A guarantee, dating from the closure of the Asterby mills in 1979, that former mill workers’ pensions would never fall below their 1979 value in real terms. A tribunal ruling in 1991 that widows’ supplements be rounded down rather than to the nearest unit. A cap, added in 1996, on the water bills of households where someone uses a home dialysis machine. A rule for people born on February 29, whose pension anniversaries Cass moves, in ordinary years, to March 1 rather than February 28, for reasons no surviving person can explain but which two pensioners have, at different times, written in to defend.

“We thought we were translating a program,” Kurtz said. “We were translating 30 years of legislation, rulings, ministerial letters, and favors, and the only copy was in the code. Every time we found one rule, there were two more behind it.” Meridian was canceled in March 2014, having spent 52.1 million crowns and delivered nothing that was switched on. The inspectorate that reviewed it concluded, with the restraint of its genre, that the project had “underestimated the volume of undocumented business logic.”

A year later, Kurtz took a job at the Service. Her former colleagues thought she had lost her mind. “I’d spent three years learning how Cass worked so that I could help kill it,” she said. “It seemed a waste not to use that.”5 She now leads what the team calls slicing: replacing Cass one small, well-understood piece at a time, rather than all at once on a date announced by a minister.

The apprentice

At 2 a.m. on run nights, when the jobs are ticking over and there is nothing to do but watch, Theo Brannock reads. He grew up in Asterby, where his grandmother worked at the mills until they closed, and spent five years supervising a parcel warehouse on the ring road outside Corran before answering an advertisement from the Service in 2024. He was its first apprentice since 1999, and he had never written a line of code. “The interview was mostly Ros asking whether I liked crosswords,” he said. “I said yes. I think that was the interview.”

Brannock learns from paper. The Service keeps a line printer, a loud machine the size of a chest freezer, which prints programs onto continuous folded paper with sprocket holes down both edges.6 On a screen, Cass’s programs appear about 50 lines at a time, and a jump from one part of a program to another can cross thousands of lines; following one by scrolling is, Brannock says, “like reading a novel through a letterbox.” On paper he can lay a program across the meeting-room floor, 40 pages end to end, and follow the logic on his knees with a finger. He annotates in pencil: green for what he understands, red for what he doesn’t, blue for what he thinks is wrong.

In two years he has read, by his own estimate, about 190,000 lines, less than a tenth of the system. Achterberg assigns him programs in the order she thinks he will need them, which is not the order in which they run. He started with the payroll tax tables, which change every year and are therefore well understood, and is now working through the pensions suite, which changes rarely and is not. His grandmother is one of the 208,000; her pension is among those still protected by the mill guarantee that Meridian’s analysts never found. He has not looked up her record. He admits he has thought about it.

In April, in a program that calculates the annual increase in pensions, he found two errors that cancel each other out: one introduced in 1988, and one added in 1993 by a programmer who had noticed the numbers were wrong and corrected them further down without, apparently, ever finding the cause. Brannock brought both pages to Achterberg in a state of some excitement. She looked at them for a long time and told him to leave them alone. “If you fix one, you break the other,” she said. “If you fix both, you’ve changed two programs that have given the right answer for 33 years so that they give the same answer more elegantly. Write it in the binder. That’s what the binder is for.” It was his first entry. He compares the experience to being allowed to sign the visitors’ book at a very old house.

Achterberg was supposed to retire in March 2024, when she turned 65. She wrote, by her own count, about a fifth of the original pensions code, in 1983 and 1984, in pencil on printed coding sheets that a pool of typists on the floor below punched onto cards. She postponed her retirement once to train Brannock, and again when Holm had a heart operation the following winter. Her current leaving date is March 31, 2027. Nobody on the team, including Achterberg, mentions it with total confidence. “I’m not irreplaceable,” she said, and then corrected herself, as she does whenever a sentence comes out imprecise. “I’m replaceable at a cost of about five years.”

The case for tending

It is tempting to read all this as a scandal, and from a certain distance it looks like one. A small country’s pensions depend on a cabinet the size of a refrigerator, a green binder, and the memory of a woman who would like to spend more time in her garden. Every few years a newspaper in Halbridge discovers this and runs a story with the word “ancient” in the headline, and every few years a minister promises to fix it.

Osei has heard the promise many times, and does not think the problem is the age of the software. “Age is the wrong measure,” she said. “The question is whether you understand it and whether you can change it safely. We can change Cass safely. We do it every month. What we can’t do is change all of it at once, and nobody can, with any system this size. Meridian didn’t fail because the new code was bad. It failed because it had to know everything on the same day.”

The arithmetic, as she lays it out, is not complicated. Tending Cass costs the Service about 4.9 million crowns a year, most of it salaries and the lease on the machine. The risk of tending is concentrated in people: if knowledge walks out of the door faster than it can be passed on, the system becomes unmaintainable, not because the code has rotted but because nobody can read it. That risk is real, and Osei is blunt that the Service allowed it to grow for 15 years. But it can be managed by hiring and teaching, slowly and cheaply. The risk of replacing Cass all at once is of a different order. It is the risk that on one particular morning, 208,000 pensions are wrong.

So the Service is replacing Cass the way you might replace the planks of a ship at sea. In 2023 the module that prints water bills moved to a new system, after running beside the old one for 14 months. Every bill the new system produced was compared with the bill Cass produced for the same household, and there were 2,206 disagreements. Kurtz’s rule was that Cass was presumed right until someone proved otherwise; in 2,191 cases, it was. The other 15 were genuine bugs in Cass, one of which had been overcharging a single farmhouse near Little Varne by a small amount every quarter since 1988.7 When Corran Water asked this spring how long it would take to add a lead-pipe charge to its customers’ bills, should the city decide to levy one, Kurtz built a working version in the new module in an afternoon.

The next slice, the payroll tax tables, is scheduled for 2028. At the current pace, Kurtz estimates, the last of Cass will be switched off around 2041. Achterberg will be 82. “I’ve said I’ll come in for it,” she said. “I’d like to see whether they find anything we didn’t.”

There is a version of this story in which the Service is a warning and a version in which it is a model, and the difference between them comes down to about six people. Old software runs payroll, pensions, benefits, and taxes for governments and banks all over the world, and the places where it causes trouble are, almost without exception, the places that stopped paying people to understand it. The Service nearly became one of them. For 2027, the government has funded three more apprenticeships, after Osei spent most of a budget hearing explaining, patiently, what would happen if Achterberg were hit by a bus.^§

The September run finished at 4:53 a.m., an hour and seven minutes inside the deadline. Teague sent the payment files to the clearing house at 5:12 and watched for the acknowledgment, which arrived 40 seconds later as a single line of text. Kurtz had gone home at three. Holm, whose doctor has banned him from run nights, was asleep in his own bed. Achterberg was asleep again on the kitchen sofa, the binder on the floor beside her.

Brannock wrote up the night. Entry 413: the date, the job, the case, the 104 months, a reference to entry 301, and, at the bottom, in the same capitals Imrie had used 23 years earlier, DO NOT WIDEN. He showed it to Achterberg when she woke. She read it, corrected the time of the restart by a minute, and handed it back. “Good,” she said. “Now file it.”

At 8 a.m. the money arrived. In Westmere, a widow received a letter telling her that her arrears would be paid by hand within the week. In Asterby, Brannock’s grandmother was paid the pension she has received on the 25th of every month since 1999, calculated by a program older than her grandson and watched over, that night, by him. She did not notice anything at all. That, everyone at the Service agrees, is the job.