DOE OSTI2017
Modern digital instrumentation and control (I and C) systems offer nearly unlimited functional capability. However, the complexity of their design (including their system software and application software) is significantly higher than that of conventional, hardwired systems, to the point that it is generally impossible to demonstrate that there are no residual design errors, even when the best development and verification techniques have been applied. When activated by specific conditions, design errors could result in systematic failures, i.e., failures that occur deterministically each time and wherever an activating condition is present. Redundancy could be defeated when the same design error affects multiple channels or systems, and the activating condition affects several of these channels or systems. In the case of safety I and C systems, most of the functions are poised protection functions that must be actuated when and only when a demand situation occurs in the plant. In nuclear power plants, the most dangerous failure mode for such functions generally is failure to actuate, and many measures are taken to protect from such failure mode. This paper considers the other failure modes of safety I and C functions, and also the failure modes of the other I and C functions that are less important to safety. It is not limited to poised functions, and considers other types of functions such as regulation functions or human interface functions. It proposes a framework for analyzing and providing defense against spurious actuations and other incorrect behaviors from digital I and C systems directly interacting with the plant process or with operators: these might be useful for example to justify that design bases for reactor protection are adequate, or to ensure plant performance and availability. (authors)
22 GENERAL STUDIES OF NUCLEAR REACTORS↗