Westinghouse Atom Atom- 1 Design of Digital Safety Systems in NPP Improvements regarding: System Requirements, Engineering, Argumentation for a Safety Case

Westinghouse Atom Atom- 2 Projects on W Atom Nuclear Automation  General  Modernizations of NPP  Claes  Design of a new Reactor Protection System  2,5 years  Why Modernization?  Meet new reqirements  Advantages with the new technology

Westinghouse Atom Atom- 3  Reactor Protection System  Main Task  Supervise the plant during normal operation and automatically initiate safety functions. Functional Requirements ReactivityIsolationCooling ReactorSafety SystemsI&C RPS and acting upon events Logic for detecting

Westinghouse Atom Atom- 4 The I&C System - Characteristics  I&C = Instrumentation and Control  Includes I/O, controllers, operator stations, etc... (Advant platform)  Based upon Industrial Products  New in the nuclear business for safety critical systems  Advantages with conventional technology  Useful reference for ABB  Safety Review  Customer uses results from the qualification and the design in their argumentation to the authorities (SKi) One part of the I&C system RPS and acting upon events Logic for detecting

Westinghouse Atom Atom- 5 Qualification of the Category A I&C  Category A FSE  Safety critical according to IEC 1226  Designed according to IEC 880  Qualification Issues (”Safety Case”)  Design Bases and Design Descriptions  Codes and Standards (Compliance)  Product Software Qualification (Static analyses)  Product Hardware Qualification  Analysis (FMEA, PSA, SIL)  V&V (Design Process)  QA/QC Category A I&C system RPS and acting upon events Logic for detecting

Westinghouse Atom Atom- 6 Design Issues for a Category A I&C System  Results from the Qualification  Restrictions, safety concepts  DinD&D (Defence in Depth and Diversity)  The classic design principle for safety systems  Single Fault Criterion  Redundancy  Experience – Process Knowledge  The I&C system must fit with the process interface RPS and acting upon events Logic for detecting

Westinghouse Atom Atom- 7 Conceptual Design  Non-Functional Requirements  Structure  Four functionally and physically separated divisions  Logic and voting in two levels  Category A logic separated from other logic  Testability and Maintainability  Performance  Behaviour upon errors  Separation according to the process (safety systems)

Westinghouse Atom Atom- 8  Category A Topology  Four redundancies, (divisions)  Physical and functional separation  Diversification (functions and equipment) The Category A I&C Architecture RPS and acting upon events Logic for detecting

Westinghouse Atom Atom- 9 Entire Network Topology

Westinghouse Atom Atom- 10  Life Cycle Model  Sequential The Design Process for Category A I&C

Westinghouse Atom Atom- 11 Research Areas ”Optimization of the Design Process”  Requirements  Interactions between product requirements and system requirements  Verification of requirements (testable, reviewable)  Traceability from plant level requirement to implemented application software  Category A Design Process  Distinguish the design process for category A

Westinghouse Atom Atom- 12 Research Areas cont. ”Optimization of the Design Process”  Qualification  Make the qualification more cost efficent. More focus on technology...

Westinghouse Atom Atom- 13 Seminal Papers  IEC 880  European Commission Nuclear Science and Technology. Draft Report Revision 8. ”Licensing of safety critical software for NPP”,  IAEA-TECDOC-1066 ”Specification of Requirements...”,  Nancy G. Leveson ”System Safety and Computers”,1995.