1. no: 1 CEMSIS wp6_beg037_v0_2_fisa 2003 slides.ppt CEMSIS FIKS-CT-2000-00109 Cost-Effective Modernisation of Systems Important to Safety Deryk Pavey, Deryk Pavey,

2. no: 2 CEMSIS wp6_beg037_v0_1_fisa 2003 slides.ppt CEMSIS Objectives u Programmable Instrumentation and Control (I&C) l safety systems (e.g. protection) l safety-related systems (e.g. control, data presentation) u Common approach to development and safety justification l maximise safety l minimise cost u Modernisation/Refurbishment l analogue/discrete logic replacement with computer-based systems

3. no: 3 CEMSIS wp6_beg037_v0_1_fisa 2003 slides.ppt ‘Stakeholders’ in CEMSIS  Nuclear Plant Operators British Energy (co-ord.)UKelectricity generation Electricite  de FranceFelectricity generation British Nuclear FuelsUKnuclear fuel processing  Suppliers & System Integrators Framatome ANPDEC&I supplier CarlBro (Sycon International)SEsystem developer  Safety Authorities & Assessors AV NuclearBinspection & licensing AdelardUKsafety consultancy SKISEinspection & licensing  Academic: TU LundSEresearch & education

4. no: 4 CEMSIS wp6_beg037_v0_1_fisa 2003 slides.ppt Key Issues u Harmonisation & Structuring of Safety Justification approaches u Definition of Requirements for Systems Important to Safety u Use of Pre-Existing Software in Systems Important to Safety l potentially including class A systems u Use of Languages & Tools in Systems Important to Safety

5. no: 5 CEMSIS wp6_beg037_v0_1_fisa 2003 slides.ppt CEMSIS Modernisation Context Utility SupplierRegulator Project viability Pre-qualification (independent assessor) Key: = Work Package Number Final Licensing / Approval Safety Justification Regular communication and informed comment User requirements process Requirements document SIS requirements specification Tendering process Negotiation & Acceptance Amended SIS requirements Safety Justification Plan Discuss/ Agree Normal operation and maintenance Acceptance & Phased Introduction 2 2 2 2 11 Test and Verification SW Development SIS Implementation Decomposition & Design Validation Installation & Site Commissioning 4 4 4 4 4 4 4 4 3 3

6. no: 6 CEMSIS wp6_beg037_v0_1_fisa 2003 slides.ppt Work Packages and Deliverables Safety Justification Survey and Framework Safety Justification Framework WP1 Requirements Capture Survey and Lifecycle Requirements Capture Guidelines WP2 Pre-Existing S/W Strategy & Techniques Pre-Existing S/W Guidelines WP3 Languages & Tools Review and Evaluate WP4 WP0,6 Management and Dissemination WP5 Public Domain Example Report Case Studies: UK: fuel reprocessing F: PWR I&C replacement SE: safety monitoring + Public Domain Example

7. no: 7 CEMSIS wp6_beg037_v0_1_fisa 2003 slides.ppt Safety Justification Framework u Take account of current EU experience l EC NRWG Task Force on Safety Critical Software (ARMONIA) l Survey shows no systematic method used in Member States u Pragmatic framework for cost-effective safety justification l Elicit and organise disparate claims and evidence l Allow modularity and reuse of elements of previous cases l Deal with system models at different levels: — plant: hazards/threats identified in a valid manner — architecture and design: SIS correctly implements safety function — operation: SIS behaviour remains valid

8. no: 8 CEMSIS wp6_beg037_v0_1_fisa 2003 slides.ppt 0: initial claim 1: plant-SIS interface 2: architecture 3: design 4: operation claims evidence re-used justification

9. no: 9 CEMSIS wp6_beg037_v0_1_fisa 2003 slides.ppt Requirements Capture u Survey of requirements techniques, research and experience. l 84 available techniques identified & classified l in current use: interviews, documents, reviews, checklists u Requirements process for refurbishment guide l requirements engineering process - ‘modernisation oriented’ l claim-based view - link to safety justification framework l set of stakeholders or viewpoints - completeness

10. no: 10 CEMSIS wp6_beg037_v0_1_fisa 2003 slides.ppt Requirements Process

11. no: 11 CEMSIS wp6_beg037_v0_1_fisa 2003 slides.ppt Pre-existing Software u Including “COTS” (Commercial Off The Shelf) u Strategy: Two phases l “Pre-qualification” - reduce uncertainty and delay — provide evidence in advance for all applications l Application Qualification - some always needed — provide evidence specific to one application u Types of assessment l Functional - ensure features of product are adequate for safe use l Dependability - evidence that the product is sufficiently reliable — taking account of its safety class

12. no: 12 CEMSIS wp6_beg037_v0_1_fisa 2003 slides.ppt white-boxgrey-boxblack-box experience in operation no yes no yes yes no Class A Class B criticality high med low high med low complexity A-WB A-BB B-GB B-BB COTS taxonomy & strategies u Properties essential to safety: l characterisation l functional adequacy l correctness l robustness l maintenance Partially addressed during pre-qualification

13. no: 13 CEMSIS wp6_beg037_v0_1_fisa 2003 slides.ppt Application and Evaluation u Case Studies: l UK Nuclear fuel reprocessing plant controlBNFL l I&C replacement on a French PWREDF l Safety monitoring system on a Swedish NPPCarlBro l Public domain nuclear material transport exampleAdelard u Identify safety and cost-relevant aspects l safety requirements l implementation options l example arguments for safety justification u Evaluate and refine guidance documents

14. no: 14 CEMSIS wp6_beg037_v0_1_fisa 2003 slides.ppt Continuing Influence u Public and Limited Circulation Deliverables l Use within members organisations and member states l Dissemination by web-site http://www.cemsis.org u Post-FISA workshop no.4, 13 November u Members participation in international activities l International standards, e.g. IEC 60880 and 61508 revision l European Nuclear Regulators Working Group l Electric Power Research Institute (EPRI) u Continuing research, possibly under Framework VI

15. no: 15 CEMSIS wp6_beg037_v0_1_fisa 2003 slides.ppt Conclusion u On target to provide practical guidance illustrated with realistic examples. u Key audience: l Senior I&C engineers and managers of refurbishment projects l Development engineers and managers in the supply industry l SMEs and service companies in the refurbishment market l Regulators and policy makers u Impact on strategy: l Accelerate inter working in member states — between utilities, suppliers and regulators l Help to focus national R&D efforts