Strategy for Safety-Related Digital I&C Qualification

Abstract

Digital instrumentation and control (I&C) qualification continues to be a major impediment to addressing the reliability and obsolescence issues of the legacy analog I&C systems of the operating light water reactor (LWR) fleet. In particular, the issue of digital common cause failure (CCF) has been difficult to address and has been the reason some nuclear plant operators have deferred upgrades of these critical plant systems, opting rather to maintain them with costly engineering and maintenance efforts. This has now become far more difficult in the face of declining analog technology suppliers and dwindling availability of spare parts and technical support for critical plant components. At the same time, the nuclear fleet must now reduce its operating costs to remain competitive in a market of low cost gas generation and heavily-subsidized renewables. Digital technology's inherent capabilities of integration, interconnectivity, and standardization offer the foremost means of implementing performance improvements and cost reductions for this purpose. This has been demonstrated over and over again in other industry sectors, as well as in conventional electric generation facilities. However, these digital technologies present certain I&C qualification barriers that must be addressed to enable full deployment where cost-beneficial. This report presents an assessment of digital I&C qualification issues and addresses gaps in qualification methods and processes that would potentially benefit from Department of Energy (DOE) sponsored research and development. Two new qualification methods are described that are recommended for further investigation. They are 1) Testability-the exhaustive (100%) testing of certain digital devices accounting for all combinations of inputs and internal states to ensure there are no digital defects, and 2) Elimination of CCF triggers-ensuring that any latent digital defects are not concurrently triggered in multiple digital functions that are assumed to be independent (e.g., redundant safety systems).

Hazard analysis for identifying common cause failures of digital safety systems using a redundancy-guided systems-theoretic approach

“…It should be noted that the difference between the Type 1 and Type 2 (or between Type 3 and Type 4) CCF is the location of the failure source-whether it is an internal defect or external disturbance. According to the previous efforts described in (Thomas and Scarola, 2018) and (EPRI, 2016), several potential sources exist that may lead to the occurrence of a CCF:…”

“…Considering that the application of new digital technology also introduces new potential software-based hazards in critical safety and control functions, underlying technical infrastructure and regulatory frameworks require some changes because much of the experience from analog technology may not be suitable for the applications of digital I&C. Some technical problems have been identified from the applications of digital I&C in NPPs, such as common-cause failure (CCF) in software, commercial dedication of hardware and software, and the possible lack of on-site plant experience with the new technology and systems (U. NRC, 2018, Thomas and Scarola, 2018, IAEA, 2016 .…”

“…For these reasons, the nuclear industry and academics have concentrated considerable efforts on addressing the technical and regulatory aspects of issues in digital deployment and upgrades, especially digital-based CCFs. CCFs have the potential to generate an unanalyzed event or sequence that may not be bounded by previous plant-accident analyses and, thus, to challenge plant safety (Thomas and Scarola, 2018). A general conclusion from probabilistic risk assessments (PRAs) of commercial NPPs is that CCFs are significant contributors to the unavailability of safety systems (Wierman et al, 2007).…”

Enabling Business-Driven Innovation Through Human Factors Engineering In Nuclear Power Plants

“…For instance, during a LWRS workshop, an industry attendee from a larger utility mentioned that the poorly integrated electronic work package required substantial rework and negatively impacted its perceived value to the business (Kovesdi et al, 2019). With licensing and regulatory concerns, utilities have traditionally taken a conservative approach such as by undergoing modifications to non-safety systems as opposed to safety systems due to many concerns, with one notably being common cause failure (Thomas & Scarola, 2018). Relatedly, management of possible threats associated with cyber security has also been a continued concern with digital upgrades in the nuclear industry .…”