ML091330023

Meeting Slides, Successful Licensing of the Als Fpga Based Safety Related I&C Platform

ML091330023
Person / Time
Site:	Wolf Creek
Issue date:	05/13/2009
From:	Wolf Creek
To:	Office of Nuclear Reactor Regulation
Stewart Bailey, NRR/DIG I&C, 415-1321
References
Download: ML091330023 (13)

Text

Successful Licensing of the ALS FPGA Based Safety Related I&C Platform Wolf Creek Nuclear Operating Corporation

Introduction

• Wolf Creek Nuclear Operating Corporation (WCNOC) to install first implementation of the Advanced Logic System (ALS) during fall 2009 refueling outage

• For WCNOC and CS Innovations (CSI) (CSI), installation is culmination of five year development and 24 month licensing effort Wolf Creek Non-Proprietary Page 2

Safety Related I&C Platform Study

• ALS project was born out of immediate need to solve reliability and obsolescence issues

- WCNOC conducted study of challenges faced by all USNPPs replacing their existing safety related I&C systems.

- Found that original manufacturers of existing equipment are in most cases out of business or no longer support the product lines.

- Situation typically leads to two approaches, each with their own challenges:

1 Reverse engineer existing system/maintain as obsolescence and failures occur 1.

- Short Short--term fix for long long--term problem

- Offers little benefit from advancements in system integrity, diagnostics, and testability

- Updated version subject to same obsolescence problems, multiplied due to number of components required to replace or update all safety related I&C systems

- Requires specific experts and specific training

2. Replace the system with a Commercial-Commercial-OffOff--The Shelf System (COTS)

- Complex system, designed targeted for more complex industrial control apps

- COTS platforms are rapidly advancing, thus shortening the obsolescence cycle.

This creates a cost model the NPP is unable to justify

- Cost and effort to upgrade physical and procedural infrastructure provides little benefit Wolf Creek Non-Proprietary Page 3

Safety I&C Platform Goals

• Common Platform for Safety I&C Architecture

• Mitigate Impact of Future Obsolescence

• Increase Integrity

• Increase Reliability

• Minimize Cost and Effort to Retrofit

• Advanced Testing and Diagnostics

• No Additional Diverse Actuation Systems

• Approval for RPS/ESFAS Applications Wolf Creek Non-Proprietary Page 4

Status of Project

• SER Approved!!!

• Overall Review Consisted of Multiple Reviews

- Generic Topical

- Applications Specific

- Generic G i AApplication li i

• MSFIS Equipment Designed, Built, Tested.. Ready for Install

• Install Fall 2009 Wolf Creek Non-Proprietary Page 5

Overview of the SER

• First time an FPGA platform used for safety- safety-related applications

• Review was similar to the review of a microprocessor platform

• ALS platform overview

• Development process review

• Pl tf Platform review i

• Life cycle planning review

• Equipment qualification review

• Diversity and Defense Defense--in in--Depth review

• IEEE 603-603-1991 review

• IEEE 7-7-4.3.2 4.3.2--2003 review Wolf Creek Non-Proprietary Page 6

SER Conclusions

• Development process was of a high quality to ensure design correctness of the application

• ALS platform meets the requirements of:

- IEEE 603-603-1991

- IEEE 7-7-4.3.2-4.3.2-2003

• ALS platform meets or exceeds all equipment qualification requirements

• ALS platform meets the guidance provided in:

- ISG ISG--01, ISG-ISG-02, ISG-ISG-04

• Generic approval of ALS process documentation

• Generic approval of ALS hardware documentation

• Generic approval of ALS FPGA programming documentation

• Future use of the ALS platform will require minimal information to be submitted Lets review the goals of the project and how they were met!

Wolf Creek Non-Proprietary Page 7

Meeting the Goals Common Platform for Safety I&C

• ALS architecture is scalable, from single system replacement to full safety I&C replacement

• ALS is architected with dedicated and redundant control modules, which are designed for reliability and integrity attributes critical to safety systems Mitigate Future Obsolescence

• Fewer components and common components - one FPGA per board incorporates all di it l circuits, digital i it filters, filt anddbbus communication i ti ((no chip hi set t IC ICs required) i d)

• For the primary critical component (FPGA), obsolescence is mitigated by utilizing portable RTL design which supports targeting to a new technology if required in the future Increase Integrity

• ALS is capable of detecting failures while the system is operational

• ALS performs corrective action upon detection of a failure

• The ALS utilizes redundancy and/or Digital BIST for all critical circuits

• ALS Incorporates dedicated integrity logic and provides run- run-time detection of a changed device and/or board behavior Wolf Creek Non-Proprietary Page 8

Meeting the Goals - 2 Increase Reliability

• Increased reliability and robustness by implementing an appropriate level of design complexity, which results in fewer active components, and translates directly to a lower system failure rate

• ALS utilizes only proven design practices and methodologies for implementation of the hardware

• ALS utilizes distributed monitoring of the integrity and validity of signals, and provides the p

capability y to take action on exceptions p

Minimize Cost of Retrofit

• Installation is simplified due to reduced hardware and wiring, maintenance is simple, efficient, and reliable translating to lower on-on-going costs to maintain

• The ALS provides simple, efficient, and reliable maintenance with a high degree of visibility into the system, where all boards are easily replaceable, reusable, and hot hot--

swappable

• Training for plant personnel is reduced due to simplicity of the system and the ability to implement multiple applications with a common platform Advanced Testing and Diagnostics

• Provides deterministic testing, maintaining the same behavior

• A run-run-time test strategy provides exhaustive self- self-testing to validate system integrity

• Advanced diagnostics are provided utilizing the ASU and Built Built--in Self Self--test (BIST)

Wolf Creek Non-Proprietary Page 9

No Additional Diverse Actuation ISG #2 - Diversity and defense in depth

• The ALS architecture implements key design attributes which are sufficient to eliminate the consideration of Common Cause Failure (CCF)

- This conclusion is based on the guidance provided in U.S. NRC document DI&C- DI&C-ISG--02 Task Working Group #2: Diversity and Defense-ISG Defense-in in--Depth Issues, Revision 1, September 2007

• DI&C--ISG DI&C ISG--02 states in section 5 There There are two design attributes that are sufficient to eliminate consideration of CCF:

- Staff position 1 states that if sufficient diversity exists in the protection system such common cause failures within channels can be considered to be fully addressed without further action, no additional diversity would be necessary in the safety system.

- Since there is adequate diversity, no DAS or manual actions were necessary Wolf Creek Non-Proprietary Page 10

Compliance with ISG #1 and #4 ISG #1 - Cyber Security

• There is no inbound communications, so there is no path for cyber attack

• Logic configuration can only be changed by removal of board while the channel is off off--line, so no changes are possible while the channel is performing the safety function

• There is no operational software, so there can be no unintended functions within the software, and no operational software changes

• All hardware circuits are traced to state machines used by requirements requirements. There are no unneeded circuits

• The design life cycle considered cyber security as required by RG 1.152 ISG #4 - Communications

• The only two two--way communications with non-non-safety is with the ASU

• Section 1. There is no interdivisional communications

• Section 2. The command prioritizations is between automatic and manual safety related signals, and the command to isolate takes priority. All inputs are safety safety--related. There are no non-non-safety inputs during operation. Since the command is processed by a finite state machine, verification is simplified.

• Section 3. There are no multidivisional control and display stations Wolf Creek Non-Proprietary Page 11

Whats Next at Wolf Creek Wolf Creek Safety I&C Architecture (RPS/ESFAS)

Wolf Creek Safety I&C Replacement Plan

-MSFIS (RF17, Fall 2009)

-LSELS (RF19, Fall 2012)

-BOP ESFAS (RF19, Fall 2012)

-SSPS

-TC/CCM (On-line, 2010)

-RVLIS Wolf Creek Non-Proprietary Page 12

Gregg Clarkson Project Manager, Safety I&C Wolf Creek Nuclear Operating Corporation (620) 364-8831 x4438 grclark@wcnoc.com Steen Sorensen President CS Innovations, LLC (480) 612-2040 steen@cs-innovation.com