1. Documentation needed to support a software safety case P.-J. Courtois
Workshop on “Safety Demonstration and Justification of DI&C Systems in NPPs – State of the Practice and Challenges”
US NRC, Rockville MD, USA, 13th – 14th March, 2014. 
Struggle with safety plan
Constraints and limitations of licensee, regulator and supplier
Licensee focus on safety demonstration;
Documentation missing in the preliminaries of the demonstration
Exact timing for the safety plan
Halden Workshop Washington March 13-14, 2014

2. Halden Workshop Washington March 13-14, 2014
Issue at stake
The Safety demonstration of critical software based components in need of approval for use.
Should be provided by the licensee (entity responsible)
Contributions from the supplier entity (incl. system architect)
Accepted by the licensing body (safety authority, TS0) for approving use
Four actors at least
Licensee is under pressure:
Time , money., bits of evidence already available and reusable
Halden Workshop Washington March 13-14, 2014

3. Licensee constraints and boundaries
Always under pressure: time , operating conditions,outages, budget , …
Bits of (generic) evidence readily available and reusable; other (specific) evidence more expensive/hard to produce;
postponed until later requested.
Not primarily competent software engineering
Halden Workshop Washington March 13-14, 2014

4. I&C Supplier constraints and boundaries
Not necessarily competent in plant operations and safety,
Not familiar with licensing procedures, safety demonstration requirements.
Halden Workshop Washington March 13-14, 2014

5. Regulator constraints and boundaries
Is primarily concerned and competent with plant operations and safety
Not very much aware of (competent in) the software design and implementation.
Communication with I&C supplier only through licensee
Request for approval received under (too) short notice.
Halden Workshop Washington March 13-14, 2014

6. Halden Workshop Washington March 13-14, 2014
Consequences
Actors with relatively less overlapping between domains of competence than usually expected.
Yet, every actor assumes that what he knows is known by others.
The readily available evidence is first provided (too early).
Actors have little useful information to assess and begin with.
Bad start: bottom to top approach; ineffective and endless Q/A process begins…
Halden Workshop Washington March 13-14, 2014

7. What the regulator’s common position says
Safety plan:
A safety plan shall be agreed upon at the beginning of the project between the licensor and the licensee. This plan shall identify how the safety demonstration will be achieved. A safety plan is not necessarily a specific document.
The plan shall identify the types of evidence that will be used, its logical organisation, and how and when this evidence shall be produced. The following three different types of evidence shall be considered…..
In all their wisdom, me included…
Halden Workshop Washington March 13-14, 2014

8. Documentation recommended to support a software safety case
Four sets of documents:
Concept of Operations
System requirements
Safety Plan
Safety Demonstration
After some thinking, current state of our thoughts
Safety plan comes 3rd position
Halden Workshop Washington March 13-14, 2014

9. 1. Concept of Operations Document
Concept of Operations Document including :
Computer based system description (hardware, software, architecture)
Interfaces to environment and to other systems,with constraints
Modes of operations : how the system is to be used
User interface
Safety impact and properties
Halden Workshop Washington March 13-14, 2014

10. Halden Workshop Washington March 13-14, 2014
2. System Requirements
- System Functional Requirements specifications
- System Non Functional Requirements (dependability, performances,…) specifications
Halden Workshop Washington March 13-14, 2014

11. Halden Workshop Washington March 13-14, 2014
3. Safety Plan
Safety Plan including:
- identification of all software used (incl. pre-existing sw, firmware, programmable field devices etc…)
- demonstration strategy (based on guidance, on standards, claim-evidence paradigm, or else)
- main types of evidence (of the development process, of the product quality, of competences,…)
- schedule
Halden Workshop Washington March 13-14, 2014

12. 4. Safety Demonstration documentation
safety claims description
safety claims validation
arguments and elements of evidence
Halden Workshop Washington March 13-14, 2014