1. IAEA – Safety Demonstration of Advanced Water Cooled Nuclear Power Plants Session: Consideration on New Design Safety Principles Topic: Safety Classification for I&C Systems in NPPs – Current Status & Difficulties
Pickelmann Johannes
AREVA NP
June 2017, Vienna

2. 1
Introduction 2
Current Status & Difficulties 3
Upcoming Actions – WNA CORDEL DICTF

3. 1
Introduction 2
Current Status & Difficulties 3
Upcoming Actions – WNA CORDEL DICTF

4. Safety Classification (SC) - Introduction IAEA SSR-2/1 (2016)
Requirement 22: Safety Classification
All items important to safety shall be identified and shall be classified on the basis of their function and their safety significance.

5. SC - Introduction IAEA SSG-30 (2014)
In 1979, IAEA issued the Safety Series No. 50-SG-D1: “Safety Guide on Safety Functions and Component Classification for BWRs, PWRs and PTRs”.  It was withdrawn in 2000 as not complying with NS-R-1 In 2014, SSG-30 “Safety Classification of Structures, Systems and Components in Nuclear Power Plants” has been released.

6. SC - Introduction Basis for Categorization of Functions
IAEA SSG The functions … should be categorized on the basis of their safety significance. The significance … is determined by … the factors:
The consequences of failure to perform the function;  Criteria: “severity of consequences”
The frequency of occurrence of the postulated initiating event for which the function will be called upon;  Criteria: “plant states” (regarding PIEs)
The significance of the contribution of the function in achieving either a controlled state or a safe state  Criteria: “plant states” (regarding physical condition of the plant)
Severity of consequences: The following three levels have been identified (if the failure of the function could…):
High  release of radioactive material for DBA – OR – values of key physical parameter exceed acceptance criteria for DBA
Medium  release of radio. Material for AOO – OR – values of key physical parameter exceed acceptance criteria for AOO
Low  doses to worker above authorized limits
Plant states (regarding PIEs)
Design Base Conditions (DBC1-4 – incl. normal operation / AOO / Design basis accident)
Design Extension Conditions (DEC-A / -B) without significatn fuel degradation / with core melt
Plant states (regarding physical condition of the plant)
Controlled State
Safe State
 not used anymore „non-hazardous stable state“

7. SC - Introduction Relationship: Functions to manage PIE – Safety Category
In 2016, IAEA published the TECDOC-1787 (as supplement to SSG-30): “Application of the Safety Classification of Structures, Systems and Components in Nuclear Power Plants”
The objectives are:
Assisting a comprehensive safety classification
Guidance to capture all SSCs to be classified and to assign to the appropriate safety class
Indication of the inputs for starting the classification including examples
SSG-30 – Table 1: Relationship between functions credited in the analysis of PIE and Safety Categories

8. SC - Introduction Classification of SSCs
Once the safety categorization of the functions is completed, the SSCs performing these functions should be assigned to a safety class.
Factors for (reassessment) of components safety classification:
The safety function(s) to be performed by the item;
The consequences of failure to perform a safety function;
The frequency with which the item will be called upon to perform a safety function;
The time following a postulated initiating event at which, or the period for which, the item will be called upon to perform a safety function.

9. 1
Introduction 2
Current Status & Difficulties 3
Upcoming Actions – WNA CORDEL DICTF

10. SC – Current Status and Difficulties WNA – CORDEL DICTF
In 2015, WNA (World Nuclear Association) published the position paper:
“Safety Classification for I&C Systems in Nuclear Power Plants – Current Status & Difficulties”
The paper was elaborated by the CORDEL Digital Instrumentation & Control Task Force (DICTF).
Objectives:
Identify topics that create difficulty for CORDEL members when developing and applying safety classification for I&C systems in nuclear power plants.
Link:

11. SC– Current Status and Difficulties Comparison of I&C Classification – main intern. SDOs
6 IEEE/NRC does not have a name for items that are important to safety, but not safety.
7 EUR is being revised to follow the SSG-30 principles.
Note: The table is taken from DICTF working paper – including updates provided by MDEP DICWG

12. SC – Current Status and Difficulties Comparison of I&C Classification – Nuclear states
6 IEEE/NRC does not have a name for items that are important to safety, but not safety.
8 South Africa: Normally safety classification of the country of SSC supplier is adopted.
Note: The table is taken from DICTF working paper – including updates provided by MDEP DICWG

13. SC - Current Status and Difficulties Causes of Classification Difficulties
CORDEL DICTF has identified in its paper the following difficulties:
Inconsistency between international standards and local regulations
Ambiguous requirements for safety classification
Incomplete rules for I&C function categorization
Inconsistent requirements for systems provided specifically as diverse backup to protection systems

14. SC - Current Status and Difficulties Ambiguous requirements for safety classification
If a requirement is not clearly identified, there is room for interpretation.
Codes and standards with ambiguous requirements could be interpreted in different ways by the vendor, the utility and the authority.
The following key words frequently may cause trouble in interpretation of requirements:
Defence-in-depth and diversity
Separation
Redundancy
Reliability/availability
Spurious activation
DiD & D  Assignment of different I&C systems and provision of diversity within and between systems to reduce the likelihood that common cause failures within the I&C system will cause failure of safety functions
Separation  Physical separation / electrical isolation / functional independence / independence of communication
Redundancy  level of required redundancy e.g. for N+1 / N+2
Reliability/availability  limits for digital I&C systems
Spurious activation  inadvertent actuation of I&C functions
The working paper on “comparison of I&C keywords definition provided by MDEP member states”, provides further insights into the issue of differences in definitions of key words used internationally, as identified in the “Safety classification for I&C Systems in Nuclear Power Plants – Current Status & Difficulties” working paper.
WNA will soon publish a paper on:
“Comparison of I&C keywords definition provided by MDEP member states”

15. SC - Current Status and Difficulties Incomplete rules for I&C function categorization
The existing codes and standards are focused on the I&C functions required for main process variables.
As I&C is widely spread in nuclear plants, rules and regulations are also required to categorize functions important to safety outside of this focus (‘other I&C functions’).
Criteria for the categorization of ‘other I&C functions’ are currently not well documented, such as:
I&C Functions for Support Service Systems Power Supply, HVAC, fire/smoke detection, Communication system, etc.
Support Service Functions for Electrical/Mechanical Systems Electrical Systems: Component protection (e.g. torque), self-monitoring, etc. Mechanical Systems (Self-Standing Systems): Polar Crane, etc.
I&C Service Functions for Main I&C Systems realized by built-in features / self-standing systems for fault monitoring, alarm processing, periodic testing or maintenance

16. SC - Current Status and Difficulties Criteria for Diverse Backup Systems
The requirements for a DiD Level 3b I&C system are mostly based on the discussion of the postulated CCF of the DiD Level 3a realized by a digital I&C system platform.
Consequently, so-called Diverse Actuation System (DAS) are required for the DiD Level 3.b.
To ensure adequate independence between DiD Level 3a and 3b or between level 3 and 4, several aspects must be taken into account:
Diversity
Physical separation – structural or by distance
Functional isolation
However, depending on where a system is assigned to level 3b or level 4, the requirements for a DAS may be very different in regard to:
Scope of functions.
Type of I&C platform (hardware versus software).
Safety classification.
This leads to some of the inconsistencies between regulators
 See MDEP Generic Common Position: DICWG No.1 – next slide

17. SC - Current Status and Difficulties MDEP – Common Position on treatment of CCF caused by SW
OECD MDEP (Multinational Design Evaluation Programme) – DICWG (Digital I&C Working Group) issued in June 2013 the MDEP Generic Common Position – No. DICWG-01 with the title:
“Common position on the treatment of Common Cause Failure by software within Digital Safety Systems”
 MDEP member states could NOT harmonize their regulatory positions regarding:
Quality and classification of Diverse backup systems and
Use of manual actions to mitigate against potential CCF caused by SW

18. 1
Introduction 2
Current Status & Difficulties 3
Upcoming Actions – WNA CORDEL DICTF

19. Achievements and Future
What Industry Asked For:
Extensive survey at the start of the pilot project identified four topics:-
Safety Classification for I&C
Defence in Depth & Diversity (D3)
Field Programmable Gate Arrays (FPGA): Criteria for Acceptance
Reliability Predictions
What We have Delivered:
Report on the Safety Classification of I&C Systems – Current Status & Difficulties (published)
Report on the Defence in Depth & Diversity (D3) (to be published in 2017)
Report on comparison of I&C keywords definition provided by MDEP member states (to be published in 2017)
Near Future:
Update of report on Safety Classification – Current Status & Difficulties (MDEP DICWG feedback)
Safety Classification for I&C - Methodology for function specification process
I&C Modernization – Current Status and Difficulties
Update of CORDEL DICTF Outlook Paper

20. Interactions with Stakeholders
IEC SC45A:
Collection and submittal of DICTF comments on IEC Ed.4 (CD1/CD2) via national organization
DICTF participation to IEC Conference Korea (March 2016)
MDEP-DICWG:
Official submittal of DICTF position paper on safety classification  set of comments provided in 2016 (new revision scheduled for 2017/2018)
Exchange with MDEP-DICWG in Dec 2018 (Paris) on Safety Classification / Defence-in-Depth and Diversity
Invitation as panellist to upcoming 4th MDEP Conference on New Reactor Design Activities (Sep.2017)
IAEA:
DICTF chairman involved in elaboration of new IAEA NE Series Report - “Architectural approaches in the design of nuclear power plant instrumentation and control systems”

21. Safety Classification for I&C – Methodology for Function Specification Process
Draft
The process for I&C function specification (including the categorization of I&C functions) is an integral part of the I&C function specification process. Imprecisely and alternating method of specification of I&C functions is one of the main causes for rework during project execution, as the specification and identification of the I&C functions forms the main input for the design of I&C systems in NPPs. Depending on the destination of the plant and the responsible authority codes and standards are in place which provides guidelines how specific types of functions have to be specified. As this weakness leads to difficulties for the nuclear industry during the project execution, this paper shall identify potential solutions for the realization of the I&C function specification process. Dec 2017: CORDEL WG approval of Task Jan/Feb 2018: Issue first draft April 2018: Review meeting September 2018: Incorporate comments and re-issue for review August 2019: Approval and publication of report