no: 1 CEMSIS wp6_beg010_v0_1_fisa slides.ppt CEMSIS FIKS-CT Cost-Effective Modernisation of Systems Important to Safety Deryk Pavey, Deryk Pavey,

no: 2 CEMSIS wp6_beg010_v0_1_fisa slides.ppt CEMSIS Objectives u Programmable Instrumentation and Control (I&C) l safety systems (e.g. protection) l safety-related systems (e.g. control, data presentation) u Common approach to development and safety justification l maximise safety l minimise cost u Modernisation/Refurbishment l analogue/discrete logic replacement with computer-based systems

no: 3 CEMSIS wp6_beg010_v0_1_fisa slides.ppt ‘Stakeholders’ in CEMSIS u Nuclear Plant Operator l British Energy (co-ord.)UKelectricity generation l Electricite  de FranceFelectricity generation l British Nuclear FuelsUKnuclear fuel processing u Suppliers & System Integrators l Framatome ANPDEC&I supplier l Sycon InternationalSEsystem developer u Safety Authorities & Assessors l AV NuclearBinspection and licensing l AdelardUKsafety consultancy u Software Reliability Specialist l TU LundSEresearch & education

no: 4 CEMSIS wp6_beg010_v0_1_fisa slides.ppt Key Issues u Harmonisation & Structuring of Safety Justification approaches u Definition of Requirements for Systems Important to Safety u Use of Pre-Existing Software in Systems Important to Safety l potentially including class A systems u Use of Graphical Languages in Systems Important to Safety

no: 5 CEMSIS wp6_beg010_v0_1_fisa slides.ppt Work Package Tasks Safety Justification Survey and Framework Safety Justification Framework WP1 Requirements Capture Survey and Lifecycle Requirements Capture Guidelines WP2 Pre-Existing S/W Strategy & Techniques Pre-Existing S/W Guidelines WP3 Graphical Languages Review and Evaluate Graphical Languages Report WP4 WP0,6 Management and Dissemination Case Studies: UK: fuel reprocessing F: PWR I&C replacement SE: safety monitoring WP5

no: 6 CEMSIS wp6_beg010_v0_1_fisa slides.ppt Safety Justification Framework u Take account of current EU experience l EC NRWG Task Force on Safety Critical Software (ARMONIA) l Survey of practices in CEMSIS Member States u Synthesis of survey responses l Main trends and consensus l Problem areas to address in CEMSIS work packages — methods for structuring software safety cases — clarification of concepts such as ‘COTS’ — safety justification should take account of plant level risk analysis — how to make best use of diversity — how to evaluate software reliability (CMF the major factor)

no: 7 CEMSIS wp6_beg010_v0_1_fisa slides.ppt u Survey of requirements techniques, research and experience. u Requirements Lifecycle l Discovery l Analysis l Negotiation l Definition and Validation Requirements Capture u Taxonomy criticality, complexity, reuse, novelty, cost, timescales etc. Refurbishment levels (existing system, new needs, regulations, standards) (stakeholders: sponsors, users, designers, regulators etc.) (specification + rationale)

no: 8 CEMSIS wp6_beg010_v0_1_fisa slides.ppt Pre-existing Software u Including “COTS” (Commercial Off The Shelf) u Strategy: Two phases l “Pre-qualification” - reduce uncertainty and delay — provide evidence in advance for all applications l Application Qualification - some always needed — provide evidence specific to one application u Types of assessment l Functional - ensure features of product are adequate for safe use l Dependability - evidence that the product is sufficiently reliable — taking account of its safety class

no: 9 CEMSIS wp6_beg010_v0_1_fisa slides.ppt Pre-existing Software (2) u Taxonomy & Strategies for Dependability Assessments White box without Experience White box with Experience Grey box without Experience Grey box with Experience Black box with Experience Black box without Experience A - Complex A - Medium A - Simple B - Complex B - Medium B - Simple AW AW / AB BG BG / BB AB BB u AW: white-box assessment of class A products u AB: black-box assessment of class A products u BG: grey-box assessment of class B products u BB: black-box assessment of class B products

no: 10 CEMSIS wp6_beg010_v0_1_fisa slides.ppt Graphical Specification Languages u Functional Requirements - safety risk of: l error in formulation l omission l misunderstanding etc. u Integrity - safety risk of: l underlying inconsistency or ambiguity l invalid verification results or reasoning l incorrect transformation into code u Reports: l evaluation of available languages l advice on safety justification TempPress & Trip

no: 11 CEMSIS wp6_beg010_v0_1_fisa slides.ppt Application and Evaluation u Three Case Studies: l UK Nuclear fuel reprocessing plant controlBNFL l I&C replacement on a French PWREDF l Safety monitoring system on a Swedish NPPSycon u Identify safety and cost-relevant aspects l safety requirements l implementation options l example arguments for safety justification u Evaluate and refine guidance documents

no: 12 CEMSIS wp6_beg010_v0_1_fisa slides.ppt Conclusion u On target to provide practical guidance illustrated with realistic examples. u Key audience: l Senior I&C engineers and managers of refurbishment projects l Development engineers and managers in the supply industry l SMEs and service companies in the refurbishment market l Regulators and policy makers u Impact on strategy: l Accelerate inter working in member states — between utilities, suppliers and regulators l Help to focus national R&D efforts