1. SAMCHANG 8 th JANUARY 2007 Kim, Yun Goo IEC 61508(61513) Vs. IEEE7432 ? The era of IEC/IEEE Dual logo Std.

2. Background  MGPi  NPIC&HMIT 2006  Licensing Issues for Advanced I&C Technologies. Regulatory Guidance for Lightning Protection in Nuclear Power Plants, R. A. Kisner,J. B. Wilgen, P. D. Ewing, K. Korsah (ORNL), C. E. Antonescu (NRC)  Cyber-Security and Wireless Applications.  IEEE/IEC 표준 연구회 Workshop  IEEE/IEC 소프트웨어 안전기준 비교 ( 이장수 KAERI)

3. Licensing Framework  Licensing Framework for Digital I&C for Nuclear Industry  IAEA-IEC framework  USNRC-IEEE framework  Harmonization of these two frameworks is critical  The Nuclear Industry is a world market  It requires too much engineering to comply with two sets.  IEEE, IEC Dual Logo Standard. 2004, 1 st IEC/IEEE standard (New Standard) Communication protocols for devices connected via IEEE 488 ™ buses

4. Code & Standard in NPP I&C 10 CFR Part 50, App. A, General Design Criteria for Nuclear Power Plants 10 CFR Part 50 App. B,Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants 10 CFR Part 52 Standard design certifications; and combined licenses for nuclear power plants ANSI/IEEE 603-1998 Standard Criteria for Safety Systems for Nuclear Power Generating Stations 1998 ANSI/IEEE 279 Standard Criteria for Protection Systems for Nuclear Power Generating Stations R.G. 1.152 Criteria for Digital Computers in Safety Systems of Nuclear Power Plants R.G. 1.53 Application of the Single-Failure Criterion to Nuclear Power Plant Protection Systems ANSI/IEEE ANS 7-4.3.2- 1993 IEEE Standard Criteria for Digital Computers in Safety Systems of Nuclear Power Generating Stations ANSI/IEEE 379 Standard Application of the Single-Failure Criterion to Nuclear Power Generating Safety Systems ANSI/IEEE 1012/1128 ASME/ANSI NQA-1 ASME/ANSI NQA-2 ANSI/IEEE 730,983 IEC-880 ANSI/IEEE 1058.1 ANSI/IEEE 828, 1042 ANSI/IEEE 830 ANSI/IEEE 1016 ANSI/IEEE 1063 ANSI/IEEE 829 ANSI/IEEE 1008 ANSI/IEEE 982.1,2 ANSI/ANS 10.4 FIPS 101,132 ANSI/IEEE 352 QualitySafety Planning DevelopmentTesting NUREG-0493, NUREG-0800 SRP, SECY-90-016, SECY-90-377 From 2003 Seminar Reference : ?

5. Licensing Framework of Safety Life Cycles  IEC 61508 Functional safety of electrical, electronic / programmable electronic safety-related systems (1998~2000)  IEC 61508-1, General requirements  IEC 61508-2, Requirements for E/E/PE safety-related systems  IEC 61508-3, Software requirements  IEC Nuclear Sector  IEC 61513, Nuclear Power Plants-Instrumentation and control for systems important to safety – General requirements for systems (2001)  IEC 60880, Nuclear Power Plants – I&C systems important to safety – Software aspects for computer-based systems performing category A function (2005)  NRC-IEEE Framework  IEEE Std. 7-4.3.2-2003, IEEE Standard Criteria for Digital Computers in Safety Systems of Nuclear Power Generating Stations.  IEEE Std. 1228-1994, IEEE Standard for Software Safety Plan  NUREG 0800-1997 Section 7.0 BTP-HICB 14, Guidance on Software Review for Digital Computer-Based Instrumentation and Control Systems  NUREG-CR 6430-1995, Software Safety Hazard Analysis

6. Licensing Framework of Safety Life Cycles

7. Over View of IEC 61508

8. 61508 : Overall Safety Lifecycle 1.Concept 2.Overall scope definition 3.Hazard and risk analysis 4.Overall safety requirement 5.Safety requirements allocation 6.Overall operation and maintenance planning 7.Overall safety validation planning 8.Overall installation and commissioning planning 9.E/E/PE safety-related systems : realisation 10.Other technology safety-related systems : realisation 11.External risk reduction facilities : realisation 12.Overall installation and commissioning 13.Overall safety validation 14.Overall operation and maintenance and repair 15.Overall modification and retrofit 16.Decommissioning or disposal 17.Verification 18.Functional safety assessment

9. Scope of E/E/PES system E/E/PES device Input devices e.g. sensor Output devices e.g. actuators interface E/E/PES: electrical, electronic, programmable electronic systems

10. E/E/PES safety lifecycle

11. Software Safety Lifecycle

12. SIL in IEC61508  Safety integrity levels: target failure measures for a safety function, allocated to an E/E/PE safety-related system operating in low demand mode of operation Safety integrity level SIL Low demand mode of operation (Average probability of failure to perform its design function on demand) High demand or continuous mode of operation (Probability of a dangerous failure per hour) 410-5 to < 10-410-9 to < 10-8 310-4 to < 10-310-8 to < 10-7 210-3 to < 10-210-7 to < 10-6 1 10-2 to < 10-1 10-6 to < 10-5

13. Recommendation Technique/MeasureSIL1SIL2SIL3SIL4 Data flow diagramsRRRR Finite state machinesRHR Formal methodRHR Performance modelingRHR Time Petri netsRHR Prototyping/animationRRRR Structure diagramsRRRHR Technique/MeasureSIL1SIL2SIL3SIL4 Computer-aided specification tools RRHR Semi-formal methodRRHR Formal methodRRHR  SW Safety Requirements Specification (Table A.1)  Modeling (Table B.5)

14. IEC 61508: V- model

15. IEC SC45A (sub committee)  Instrumentation and control for nuclear facilities from 2003 May  Technical Committee 45  Chairman, R. Schomberg (France)  Secretary, S. Shumov (Russian Federation)  Sub-Committee 45A (I&C of nuclear facilities) Chairman, E. Corte (USA) Secretary, J. P. Bouard (France)  Sub-Committee 45B (Radio-protection) Chairman, I. Thompson (UK) Secretary, J. C. Thevenin (France)  150 SC45A experts  20 SC45A standards at draft stage (average number)  60 SC45A standard portfolio

16. IEC SC45A (sub committee)  7 Working Groups  WG A2:Instruments and Sensors, Mr. Burel (France)  WG A3:Application of digital processors to safety in NPP, Mr. Lindner (Germany)  WG A5:Special process measurements, Mr. Reisch (Sweden)  WG A7:Reliability of electrical equipment in reactor safety systems, Mr. Wall (UK)  WG A8:Control rooms, Mr. Fujita (Japan)  WG A9:Instrumentation systems, Mr. Quinn (USA)  WG A10:Upgrading and modernization of I&C systems in NPP, Mr. Artaud (USA)

17. IEC SC45A : Global  20 countries participating & voting in the SC45A activities … Belgium and Norway joined  Belgium, Canada, P.R. of China, Czech Republic, Egypt, Finland, France, Germany, Italy, Japan, Norway, Rep. of Korea, Romania, Russian Federation, South Africa, Sweden, Switzerland, United States, Ukraine, United Kingdom  Development of IEC/IEEE dual logo documents in technical domains not already covered by IEC … and in the future IEC/IEEE dual logo documents likely for revised documents  Establishment of a new liaison between IEC/SC45A/WG9 (Instrumentation systems) and IEEE/NPEC (Nuclear Power Engineering Committee)  Enforcement of a SC45A presentation and terminology policy to garantee consistency between IAEA documents and SC45A documents

18. IEC SC45A : standard series  IEC 61513 General requirements, 2001  IEC 61226 Classification of I&C functions, 2005  IEC 60709 Separation, 2005,  IEC 60880 SW of CB systems performing A functions, end 2005  IEC 62138 SW of CB systems performing B and C functions, 2004

19. What’s new – IEC 60880, end 2005  Revision of the original 1986 version, referenced in many contracts, used by SA as reference in many countries …  Taking into account the recent advances of software engineering techniques  Integration of the IEC 60880 part 2 requirements on defense against SW CCF, SW tools and pre developped SW  Alignment with IAEA documents NS-R-1 (Design) and NS-G-1.3 (I&C)  Consistency with IEC 61513, IEC 61226, IEC 60709, IEC 62138, IEC 60987

20. IEEE 7-4.3.2 1. Scope. 2. References. 3. Definitions and abbreviations 4. Safety system design basis. 5. Safety system criteria 6. Sense and command features—functional and design requirements. 7. Execute features—functional and design requirements. 8. Power source requirements Annex A (informative) Mapping of IEEE Std 603-1998 to IEEE Std 7-4.3.2-2003. Annex B (informative) Diversity requirements determination Annex C (informative) Dedication of existing commercial computers. Annex D (informative) Identification and resolution of hazards. Annex E (informative) Communication independence. Annex F (informative) Computer reliability Annex G (informative) Bibliography.

21. IEC/IEEE Differences in Safety Lifecycles  IEC Generic(61508)  Hazard Analysis in early phase to derive safety function requirement  Risk Assessment in early phase to derive Safety Integrity Requirements (Safety Integrity Level)  Safety Validation Plan  Functional Safety Assessment shall be applied to the all phases throughout the overall, E/E/PES and software safety lifecycles(61508-1, 8.2.3)  Software Functional Safety Assessment : Failure Analysis (FTA,FMECA)  IEC Nuclear Sector (61513, 60880)  Hazard Analysis is outside the scope of IEC 61513  (Software) Functional Assessment is not required in the Standard  No Safety Validation Plan  NRC-IEEE Framework  IEEE Std. 1228-1994, Software Safety Plan  It defines the software safety analysis in each phase of the software lifecycle  IEEE Std. 7-4.3.2-2003, Digital Computers in Safety Systems of NPP  Annex D. Identification of Resolution of Hazards in each phase of the system lifecycle  NRC Regulation  NUREG 0800-1997 BTP-14, Software Safety Analysis in each phase of the software lifecycle  NUREG-CR 6430-1995, Software Safety Hazard Analysis in each phase of the software lifecycle

22. IEC/IEEE Differences in Security Criteria  IEC Generic(61508) 1998~2000  Security is out of scope of 61508 IEC 61508 dose not cover the precautions that may be necessary to prevent unauthorized persons damaging Because the 61508 is focusing only to the Functional Safety  IEC Nuclear Sector  IEC61513 - 2001 Overall Security plan and systems security plan  IEC 60880 - 2005 Security Analysis Security Design User authentication Security during development  NRC-IEEE Framework  IEEE Std. 7-4.3.2-2003, Digital Computers in Safety Systems of NPP  No security requirement  IEEE Std. 1228-1994, Software Safety Plan  No software security requirement  Reg. Guide 1.152 rev2 2006  Concepts Security  Requirement Security  Design Security  Implementation Security  Test Security  Installation, Checkout and Acceptance Testing Security  Operation Security  Maintenance Security  Retirement Security

23. Summary  OVERVIEW of IEC Std.  IEC 61508  IEC SC45A  IEC 60080  Comparison of IEC and IEEE  Harmonization of these two frameworks is current issue.  IEEE, IEC Dual Logo Standard.

24. SAMCHANG

25. Contents 0. Background 1. IEC 61508 2. IEC SC45A, IEC 60080 3. Comparison of IEC and IEEE