BS EN 62340-2010 pdf download.Nuclear power plants Instrumentation and control systems important to safety Requirements for coping with common cause failure (CCF).
I&C systems with this design can fail if two or more redundant channels fall concurrently (CCF). The CCF can occur if a latent fault is systematically incorporated in some or all redundant channels and If by a specific event this fault is triggered to cause the coincidental failure of some or all channels. A redundant l&C system fails if the number of faulted channels exceeds its design limit.
Latent faults which are systematically incorporated in some or all redundant channels may originate from any phase of the life cycle of an l&C system. Latent faults may result from human errors which do not depend on the l&C technology or may result from the manufacturing process dependent on the l&C technology. At a comparatively high probability latent systematic faults are related to the design basis of an l&C system as e.g.:
• errors in the requirements specification of the safety functions, or
• an inadequate specification of the hardware design limits against environmental loadings (e.g. seismic loads or EMI). or
• technical design faults which could cause system failure by internally induced mechanisms.
Triggering events for CCF may be caused from outside of the l&C system by a common loading to all redundant channels such as from an input signal transient, from environmental stress or from specific real time or calendar dates. Additionally the existence of latent propagation mechanisms may be assumed such that corrupted data which are transferred from one faulty system to corresponding systems of the other redundancies may cause consequential failure of other redundant channels. Such a mode of failure propagation is relevant for computer-based l&C systems only.
5.3 Principal mechanisms for CCF of digital ISIC systems
In hard-wired technology, the functions important to safety within each redundant channel are generally implemented by chains of separate electronic components, while the hardware components of computer based systems typically process a group of assigned functions. Therefore the following considerations apply mainly to digital l&C systems.
Under normal operation conditions (without changes due to maintenance activities and without physical influence of the environment as listed in 7.8), processing of the input signal transients by the digital l&C system forms the main contribution to their signal trajectories. Specific signal trajectories which can cause a system failure may occur during safety demands from untested combinations of input signals or may result from specific system internal states. Such specific system internal states may be related to stored data from earlier input signal transients or to latent faults from earlier maintenance activities or could be caused by hardware faults.
— no response or an erroneous response is given compared to the required response although the l&C system keeps processing;
— the system is caused to stop its processing, so no response can be given.
5.4 Conditions to defend against CCF of Individual l&C systems
The CCF characteristics as given in 5.2 Indicate the following possibilities for reducing the likelihood of CCF:
a) to reduce the probability of latent systematic faults incorporated in the redundant channels of an individual l&C system, and
b) to reduce the probability that mechanisms exist which could trigger coincidentally latent systematic faults or which could cause a single failure in one channel to propagate to other channels (failure propagation).
The difficulty for an effective defence against CCF is caused by the fact that faults and triggering mechanisms of an l&C system are latent. The avoidance of latent systematic faults and triggering mechanisms requires therefore designing and analysing l&C systems under postulates which are related to the experience of CCF occurrences in NPPs and to the potential weaknesses of the selected l&C technology.
The experienced frequency of CCF occurrences is very low for l&C systems which perform category A functions. The reasons for this experience is partly based on the high quality level of design, manufacturing and maintenance which is applied to such l&C systems, however this is also based on the nature of CCF which can only occur at the combined probability of the existence of a latent systematic fault and the activation of a corresponding triggering mechanism by a signal trajectory. Therefore an effective defence against CCF has to assign the same importance to the avoidance of potential triggering mechanisms and to the avoidance of latent faults.
The experience of CCF occurrences in NPPs shows that the following types of causes are dominant:
a) latent faults which are related to faults in the requirements specification. The identification of errors In the requirements specification of l&C functions is difficult and such errors may propagate through subsequent design phases including the verification and system validation activities. Latent faults from this potential source can be detected by functional validation activities only (see 3.25);
b) latent faults which are introduced during maintenance because the possibility for analysing and testing modifications may be limited under plant constraints (e.g. modification of setpoints, use of revised versions of spare-parts or the up-grading of l&C system components): and.BS EN 62340-2010 pdf download.