1. no: 1 CEMSIS 1 WP3 - Use of pre-developed products Key issues N. Thuy EDF R&D

2. CEMSIS WP3_edf036_v01_FISA_November 2003 no: 2 Objectives u I&C systems based on off-the-shelf products l suitability for functions important to safety l cost-effectiveness u Application of safety framework (WP1) u Software aspects

3. CEMSIS WP3_edf036_v01_FISA_November 2003 no: 3 General approach u System properties essential to safety l what needs to be claimed and justified l application specific / generic properties u Product assessment l objective: state, justify generic claims —product claims reusable for justification of system claims —not a general safety label l functional, dependability assessments l ahead of projects, for a range of applications u System qualification l products used according to conditions of assessments l focus on application issues

4. CEMSIS WP3_edf036_v01_FISA_November 2003 no: 4 Main generic system properties essential to safety u Characterisation l of system and main sub-systems / components l identification, description / specification, integrity u Adequacy l of specification to real safety needs u Correctness l with respect to specification u Robustness l against postulated internal / external events u Maintenance of preceding properties over lifetime

5. CEMSIS WP3_edf036_v01_FISA_November 2003 no: 5 Generic product properties essential to safety u Refinement of main generic system properties l E.g., robustness —identification, characterisation of causes of non-nominal situations —intrinsic, passive robustness —detection of non-nominal situations —signaling of non-nominal situations —containment —graceful degradation to specified behavior —correct restoration of nominal service u « Projection » of system properties on products l may depend on nature of product, role assigned by system design l two main types of product properties: —functional properties —dependability properties

6. CEMSIS WP3_edf036_v01_FISA_November 2003 no: 6 Product taxonomies u Wide variety, one size does not fit all u Taxonomy for functional assessments l I&C platforms l communication equipment l « smart » devices u Taxonomy for dependability assessments l safety class l functional complexity l availability of technical information l amount of credible, applicable operational experience

7. CEMSIS WP3_edf036_v01_FISA_November 2003 no: 7 Functional assessment Overall process 3. Functional User Requirements Specification (cf. WP2) Product independent Product dependent 1. Functional Modeling Main typical functions, interactors for each functional type Investigation groups, guidelines Project independent Project dependent 2. Product Characterisation According to investigation groups and guidelines 4. Matching FURS and product characteristics

8. CEMSIS WP3_edf036_v01_FISA_November 2003 no: 8 Functional Modeling Example I&C platforms: function and interactors Operators Maintenance & servicing InstallationEngineeringInvestigation I&C system Other systems & equipment Process Instrumentation Self-surveillanceInterfaces I/O data processing, Automation & Control Event management, Management of RT data, Management of plant, system, procedures data HMI, AlarmsArchivingSystem testing Management of Errors & Failures Application dev. & Maintenance System configuration System monitoring

9. CEMSIS WP3_edf036_v01_FISA_November 2003 no: 9 Functional Modeling Example I&C platforms: Investigation groups u Influencing conditions l Architectures and configurations l Modes of behaviour l Avalanche conditions l Other influencing conditions u Functions supporting plant operation l HM dialogue l Alarm management l Automation & control l Management of events, time stamping l Management of real-time supervision data l Description of process, system, procedures u Technical interfaces l Interfaces with process instrumentation l Interfaces with other systems l Data processing u Performances l In nominal modes l In down-graded modes l In avalanche conditions l In other influencing conditions u System servicing l Data archiving l Self supervision l Error & failure management l System configuration l System testing u Application development & maintenance l Software tools l Process description, system, procedures l Algorithms l Functional validation l Internal communications

10. CEMSIS WP3_edf036_v01_FISA_November 2003 no: 10 Dependability assessment Main strategies White box without Experience White box with Experience Grey box without Experience Grey box with Experience Black box with Experience Black box without Experience A - Complex A - Medium A - Simple B - Complex B - Medium B - Simple AW AW / AB BG BG / BB AB BB u AW: white-box assessment for class A u AB: black-box assessment for class A u BG: grey-box assessment for class B u BB: black-box assessment for class B

11. CEMSIS WP3_edf036_v01_FISA_November 2003 no: 11 Rigor of justification u Justification may be based on l « rigorous proof » l sampling l operational experience l inspection l engineering processes u Properties of arguments l example: « rigorous proof » —applicability of proof principle —faithfulness of representation on which proof is performed —correct consideration of all relevant influencing factors —correctness of proof itself

12. CEMSIS WP3_edf036_v01_FISA_November 2003 no: 12 Safety, Cost- effectiveness u Off-the-shelf products usually more cost effective than bespoke solutions u Reduction of uncertainties l early identification of critical issues l solution for « new » issues l last minute questions costly in effort and delay l more open competition u Sharing of costs (and insights) among projects u I&C systems: main focus on applications