1、raising standards worldwideNO COPYING WITHOUT BSI PERMISSION EXCEPT AS PERMITTED BY COPYRIGHT LAWBSI Standards PublicationNuclear power plants Instrumentation and control systems important to safety Software aspects for computer-based systems performing category A functionsBS EN 60880:2009Licensed C
2、opy: Wang Bin, ISO/EXCHANGE CHINA STANDARDS, 13/04/2010 03:13, Uncontrolled Copy, (c) BSINational forewordThis British Standard is the UK implementation of EN 60880:2009. It is identi-cal to IEC 60880:2006. It supersedes BS IEC 60880:2006 which is withdrawn.The UK participation in its preparation wa
3、s entrusted to Technical CommitteeNCE/8, Reactor instrumentation.A list of organizations represented on this committee can be obtained onrequest to its secretary.This publication does not purport to include all the necessary provisions of acontract. Users are responsible for its correct application.
4、 BSI 2010ISBN 978 0 580 63962 3ICS 27.120.20; 35.080Compliance with a British Standard cannot confer immunity fromlegal obligations.This British Standard was published under the authority of the StandardsPolicy and Strategy Committee on 31 January 2010Amendments issued since publicationAmd. No. Date
5、 Text affectedBRITISH STANDARDBS EN 60880:2009Licensed Copy: Wang Bin, ISO/EXCHANGE CHINA STANDARDS, 13/04/2010 03:13, Uncontrolled Copy, (c) BSIEUROPEAN STANDARD EN 60880 NORME EUROPENNE EUROPISCHE NORM October 2009 CENELEC European Committee for Electrotechnical Standardization Comit Europen de No
6、rmalisation Electrotechnique Europisches Komitee fr Elektrotechnische Normung Central Secretariat: Avenue Marnix 17, B - 1000 Brussels 2009 CENELEC - All rights of exploitation in any form and by any means reserved worldwide for CENELEC members. Ref. No. EN 60880:2009 E ICS 27.120.20 English version
7、 Nuclear power plants - Instrumentation and control systems important to safety - Software aspects for computer-based systems performing category A functions (IEC 60880:2006) Centrales nuclaires de puissance - Instrumentation et contrle-commande importants pour la sret - Aspects logiciels des systme
8、s programms ralisant des fonctions de catgorie A (CEI 60880:2006) Kernkraftwerke - Leittechnik fr Systeme mit sicherheitstechnischer Bedeutung - Softwareaspekte fr rechnerbasierte Systeme zur Realisierung von Funktionen der Kategorie A (IEC 60880:2006) This European Standard was approved by CENELEC
9、on 2009-07-01. CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such national standards m
10、ay be obtained on application to the Central Secretariat or to any CENELEC member. This European Standard exists in three official versions (English, French, German). A version in any other language made by translation under the responsibility of a CENELEC member into its own language and notified t
11、o the Central Secretariat has the same status as the official versions. CENELEC members are the national electrotechnical committees of Austria, Belgium, Bulgaria, Cyprus, the Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Lux
12、embourg, Malta, the Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland and the United Kingdom. BS EN 60880:2009Licensed Copy: Wang Bin, ISO/EXCHANGE CHINA STANDARDS, 13/04/2010 03:13, Uncontrolled Copy, (c) BSIEN 60880:2009 - 2 - Foreword The text of the I
13、nternational Standard IEC 60880:2006, prepared by SC 45A, Instrumentation and control of nuclear facilities, of IEC TC 45, Nuclear instrumentation, was submitted to the formal vote and was approved by CENELEC as EN 60880 on 2009-07-01 without any modification. The following dates were fixed: latest
14、date by which the EN has to be implemented at national level by publication of an identical national standard or by endorsement (dop) 2010-07-01 latest date by which the national standards conflicting with the EN have to be withdrawn (dow) 2012-07-01 CLC/TC 45AX experts draw attention to the readers
15、 of this European standard to the fact that it should be read in conjunction with IAEA document INSAG-10, 1996, “Defence in Depth in Nuclear Safety” which applies. _ Endorsement notice The text of the International Standard IEC 60880:2006 was approved by CENELEC as a European Standard without any mo
16、dification. _ BS EN 60880:2009Licensed Copy: Wang Bin, ISO/EXCHANGE CHINA STANDARDS, 13/04/2010 03:13, Uncontrolled Copy, (c) BSI- 3 - EN 60880:2009 Annex ZA (normative) Normative references to international publications with their corresponding European publications The following referenced documen
17、ts are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. NOTE When an international publication has been modified by common modifications,
18、 indicated by (mod), the relevant EN/HD applies. Publication Year Title EN/HD Year IEC 60671 - 1)Nuclear power plants - Instrumentation and control systems important to safety - Surveillance testing - - IEC 61069-2 1993 Industrial-process measurement and control - Evaluation of system properties for
19、 the purpose of system assessment - Part 2: Assessment methodology EN 61069-2 1994 IEC 61226 - 1)Nuclear power plants - Instrumentation and control systems important to safety - Classification of instrumentation and control functions - - IEC 61508-4 - 1)Functional safety of electrical/electronic/pro
20、grammable electronic safety-related systems - Part 4: Definitions and abbreviations EN 61508-4 2001 2)IEC 61513 - 1)Nuclear power plants - Instrumentation and control for systems important to safety - General requirements for systems - - ISO/IEC 9126 Series Software engineering - Product quality - -
21、 IAEA guide NS-G-1.2 - 1)Safety assessment and verification for nuclear power plants - IAEA guide NS-G-1.3 - 1)Instrumentation and control systems important to safety in nuclear power plants - - 1)Undated reference. 2)Valid edition at date of issue. BS EN 60880:2009Licensed Copy: Wang Bin, ISO/EXCHA
22、NGE CHINA STANDARDS, 13/04/2010 03:13, Uncontrolled Copy, (c) BSI60880 IEC:2006 3 CONTENTS INTRODUCTION.11 1 Scope and object17 2 Normative references .17 3 Terms and definitions .19 4 Symbols and abbreviations.29 5 General requirements for software projects 29 5.1 General .29 5.2 Software types 33
23、5.3 Software development approach .35 5.4 Software project management .39 5.5 Software quality assurance plan39 5.6 Configuration management41 5.7 Software security.43 6 Software requirements47 6.1 Specification of software requirements 47 6.2 Self-supervision 49 6.3 Periodic testing .49 6.4 Documen
24、tation 51 7 Design and implementation 51 7.1 Principles for design and implementation 53 7.2 Language and associated translators and tools .57 7.3 Detailed recommendations 59 7.4 Documentation 63 8 Software Verification 63 8.1 Software verification process.63 8.2 Software verification activities .65
25、 9 Software aspects of system integration.73 9.1 Software aspects of system integration plan75 9.2 System integration 77 9.3 Integrated system verification77 9.4 Fault resolution procedures .79 9.5 Software aspects of integrated system verification report 79 10 Software aspects of system validation
26、81 10.1 Software aspects of the system validation plan81 10.2 System validation 81 10.3 Software aspects of the system validation report .83 10.4 Fault resolution procedures .83 11 Software modification .83 11.1 Modification request procedure .85 11.2 Procedure for executing a software modification8
27、7 11.3 Software modification after delivery.89 BS EN 60880:2009Licensed Copy: Wang Bin, ISO/EXCHANGE CHINA STANDARDS, 13/04/2010 03:13, Uncontrolled Copy, (c) BSI60880 IEC:2006 5 12 Software aspects of installation and operation91 12.1 On-site installation of the software 91 12.2 On-site software se
28、curity.91 12.3 Adaptation of the software to on-site conditions.93 12.4 Operator training .93 13 Defences against common cause failure due to software95 13.1 General .95 13.2 Design of software against CCF 97 13.3 Sources and effects of CCF due to software97 13.4 Implementation of diversity99 13.5 B
29、alance of drawbacks and benefits connected with the use of diversity.99 14 Software tools for the development of software 99 14.1 Introduction .99 14.2 Selection of tools.101 14.3 Requirements for tools 103 15 Qualification of pre-developed software113 15.1 General .113 15.2 General requirements113
30、15.3 Evaluation and assessment process115 15.4 Requirements for integration in the system and modification of PDS .131 Annex A (normative) Software safety life cycle and details of software requirements .133 Annex B (normative) Detailed requirements and recommendations for design and implementation
31、.137 Annex C (informative) Example of application oriented software engineering (software development with application-oriented language)163 Annex D (informative) Language, translator, linkage editor 171 Annex E (informative) Software verification and testing175 Annex F (informative) Typical list of
32、 software documentation .191 Annex G (informative) Considerations of CCF and diversity .193 Annex H (informative) Tools for production and checking of specification, design and implementation .201 Annex I (informative) Requirements concerning pre-developed software (PDS) .207 Annex J (informative) C
33、orrespondence between IEC 61513 and this standard .211 BS EN 60880:2009Licensed Copy: Wang Bin, ISO/EXCHANGE CHINA STANDARDS, 13/04/2010 03:13, Uncontrolled Copy, (c) BSI60880 IEC:2006 11 INTRODUCTION a) Technical background, main issues and organisation of the standard Engineering of software based
34、 Instrumentation and Control (I 2) a general approach to software verification and to the software aspects of the computer-based system validation; 3) procedures for software modification and configuration control; 4) requirements for use of tools; 5) procedures for qualification of pre-developed so
35、ftware. It is recognised that software technology is continuing to develop at a rapid pace and that it is not possible for a standard such as this to include references to all modern design technologies and techniques. To ensure that the standard will continue to be relevant in future years the emph
36、asis has been placed on issues of principle, rather than specific software technologies. If new techniques are developed then it should be possible to assess the suitability of such techniques by applying the safety principles contained within this standard. d) Description of the structure of the SC
37、 45A standard series and relationships with other IEC documents and other bodies documents (IAEA, ISO) The top level document of the SC 45A standard series is IEC 61513. This standard deals with requirements for NPP I top-down design methods; modularity; verification of each phase; clear documentati
38、on; auditable documents; validation testing. Additional guidance and information on how to comply with the requirements of the main part of this standard is given in Annexes A to I. 2 Normative references The following referenced documents are indispensable for the application of this document. For
39、dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. IEC 60671, Periodic tests and monitoring of the protection system of nuclear reactors BS EN 60880:2009Licensed Copy: Wang Bin, ISO/EXCHANGE CHIN
40、A STANDARDS, 13/04/2010 03:13, Uncontrolled Copy, (c) BSI60880 IEC:2006 19 IEC 61069-2:1993, Industrial-process measurement and control Evaluation of system properties for the purpose of system assessment Part 2: Assessment methodology IEC 61226, Nuclear power plants Instrumentation and control syst
41、ems important for safety Classification of instrumentation and control functions IEC 61508-4, Functional safety of electrical/electronic/programmable electronic safety-related systems Part 4: Definitions and abbreviations IEC 61513, Nuclear power plants Instrumentation and control for systems import
42、ant to safety General requirements for systems ISO/IEC 9126, Software engineering Product quality IAEA guide NS-G-1.2, Safety Assessment and Verification for Nuclear power Plant IAEA guide NS-G-1.3, Instrumentation and Control Systems Important to Safety in Nuclear Power Plants 3 Terms and definitio
43、ns For the purposes of this document, the following terms and definitions apply. 3.1 animation process by which the behaviour defined by a specification is displayed with actual values derived from the stated behaviour expressions and from some input values 3.2 application function function of an I
44、software quality assurance and quality control (5.5); software configuration management (5.6); software security (5.7); software verification (Clause 8). There are also activities involving selection of languages (7.2, Annex D), selection of software tools to support the development (Clause 14), pre
45、vention of CCF (Clause 13) and production of documentation (7.4, Annex F). The resulting software related activities in the system safety lifecycle and the supporting processes are shown below in Figure 2 (boxes in bold lines with reference to related subclauses in brackets). BS EN 60880:2009License
46、d Copy: Wang Bin, ISO/EXCHANGE CHINA STANDARDS, 13/04/2010 03:13, Uncontrolled Copy, (c) BSI60880 IEC:2006 33 System requirements specificationSuitability analysis of pre-developedsoftware (15.3)System detailed design and implementation Equipment (system softwareand hardware) procurementDevelopment
47、of new operationalsystem software (7) Application software development/generation(7) Selection of pre-developed software (15.2) Software aspects of systemintegration (9, 15.4) Software aspects of systemvalidation (10) Software aspects of systeminstallation (12.1) Software aspects of systemmodificati
48、on (11) Functional validation Software safety lifecycle Software quality assurance (5.5) Software verification (8) Software configuration management (5.6) Selection and use of software tools (14) Selection of languages (7.2) Software security (5.7) System specificationIEC 716/06 NOTE Boxes in thin d
49、otted lines represent system activities not addressed in this standard. Figure 2 Software related activities in the system safety lifecycle The approach to software development should be based on the traditional “V” model as this approach has been reflected and promulgated in other standards notably IAEA NS-G-1.3, but allowing necessary adjustments recognizing that some phases of the development can be done automatically by tools and that software development may
