1、raising standards worldwideNO COPYING WITHOUT BSI PERMISSION EXCEPT AS PERMITTED BY COPYRIGHT LAWBSI Standards PublicationNuclear power plants Instrumentation and controlimportant to safety Selection and use of industrial digital devices of limited functionalityBS IEC 62671:2013National forewordThis
2、 British Standard is the UK implementation of IEC 62671:2013.The UK participation in its preparation was entrusted to Technical CommitteeNCE/8, Reactor instrumentation.A list of organizations represented on this committee can be obtained onrequest to its secretary.This publication does not purport t
3、o include all the necessary provisions of acontract. Users are responsible for its correct application. The British Standards Institution 2013Published by BSI Standards Limited 2013ISBN 978 0 580 71956 1ICS 27.120.20Compliance with a British Standard cannot confer immunity fromlegal obligations.This
4、 British Standard was published under the authority of the StandardsPolicy and Strategy Committee on 31 March 2013.Amendments issued since publicationAmd. No. Date Text affectedBRITISH STANDARDBS IEC 62671:2013IEC 62671 Edition 1.0 2013-02 INTERNATIONAL STANDARD NORME INTERNATIONALE Nuclear power pl
5、ants Instrumentation and control important to safety Selection and use of industrial digital devices of limited functionality Centrales nuclaires de puissance Instrumentation et contrle-commande importants pour la sret Slection et utilisation des appareils numriques fonctionnalits limites INTERNATIO
6、NAL ELECTROTECHNICAL COMMISSION COMMISSION ELECTROTECHNIQUE INTERNATIONALE XA ICS 27.120.20 PRICE CODE CODE PRIX ISBN 978-2-83220-630-0 Registered trademark of the International Electrotechnical Commission Marque dpose de la Commission Electrotechnique Internationale Warning! Make sure that you obta
7、ined this publication from an authorized distributor. Attention! Veuillez vous assurer que vous avez obtenu cette publication via un distributeur agr. BS IEC 62671:2013 2 62671 IEC:2013 CONTENTS FOREWORD . 4 INTRODUCTION . 6 1 Scope . 9 1.1 General . 9 1.2 Background . 10 1.3 Use of this standard 10
8、 1.4 Framework 11 2 Normative references . 12 3 Terms and definitions . 13 4 Symbols and abbreviations . 19 5 General requirements . 19 5.1 General . 19 5.2 Application of this standard . 20 5.2.1 General . 20 5.2.2 Applicability criteria for this standard . 20 5.3 General requirements on the evalua
9、tion process . 21 5.3.1 Evaluation process 21 5.3.2 Evaluation and Application Plan (EAP) 22 5.3.3 Evaluation and Application Report (EAR) . 23 5.3.4 Application of clauses of this standard . 24 6 Criteria for functional and performance suitability . 25 6.1 General . 25 6.2 Functional competence of
10、the primary function 25 6.3 Ancillary functions . 26 6.4 Configurability . 26 6.5 Superfluous functions 27 6.6 Hardware robustness 28 6.7 Reliability, maintainability and testability . 28 6.8 Cyber security . 30 6.9 User documentation for safety . 30 7 Criteria for dependability Evidence of correctn
11、ess . 31 7.1 General . 31 7.2 Previous certification . 33 7.3 Avoidance of systematic faults 34 7.4 Evidence of quality in the design process 36 7.4.1 General . 36 7.4.2 Product designers QA program . 36 7.4.3 Design and development process 37 7.4.4 Design configuration management . 38 7.4.5 Design
12、change control . 38 7.4.6 Design documentation . 39 7.5 Evidence of quality in manufacturing . 40 7.6 Product stability . 41 7.7 Operating experience 42 7.8 Complementary testing and/or analysis (verification) . 43 BS IEC 62671:201362671 IEC:2013 3 7.9 Documentation improvement . 44 8 Criteria for i
13、ntegration into the application limits and conditions of use 45 8.1 General . 45 8.2 Restrictions on use 45 8.3 Modifications of the device required for the application 45 8.4 Modifications to the system to accommodate the device 46 8.5 Integration and commissioning of the device in the plant safety
14、 systems . 46 9 Considerations for preserving acceptability . 47 9.1 General . 47 9.2 Notifications by the device designer and manufacturer 47 9.3 Manufacturing and support lifetime of the current version 48 9.4 Preservation of maintenance tools and documentation 48 9.5 Recommendations for the end-u
15、ser . 48 Annex A (informative) Possible design features of a software system that could impact the dependability of the device 50 Bibliography 52 Figure 1 Selection and Evaluation Process 22 BS IEC 62671:2013 4 62671 IEC:2013 INTERNATIONAL ELECTROTECHNICAL COMMISSION _ NUCLEAR POWER PLANTS INSTRUMEN
16、TATION AND CONTROL IMPORTANT TO SAFETY SELECTION AND USE OF INDUSTRIAL DIGITAL DEVICES OF LIMITED FUNCTIONALITY FOREWORD 1) The International Electrotechnical Commission (IEC) is a worldwide organization for standardization comprising all national electrotechnical committees (IEC National Committees
17、). The object of IEC is to promote international co-operation on all questions concerning standardization in the electrical and electronic fields. To this end and in addition to other activities, IEC publishes International Standards, Technical Specifications, Technical Reports, Publicly Available S
18、pecifications (PAS) and Guides (hereafter referred to as “IEC Publication(s)”). Their preparation is entrusted to technical committees; any IEC National Committee interested in the subject dealt with may participate in this preparatory work. International, governmental and non-governmental organizat
19、ions liaising with the IEC also participate in this preparation. IEC collaborates closely with the International Organization for Standardization (ISO) in accordance with conditions determined by agreement between the two organizations. 2) The formal decisions or agreements of IEC on technical matte
20、rs express, as nearly as possible, an international consensus of opinion on the relevant subjects since each technical committee has representation from all interested IEC National Committees. 3) IEC Publications have the form of recommendations for international use and are accepted by IEC National
21、 Committees in that sense. While all reasonable efforts are made to ensure that the technical content of IEC Publications is accurate, IEC cannot be held responsible for the way in which they are used or for any misinterpretation by any end user. 4) In order to promote international uniformity, IEC
22、National Committees undertake to apply IEC Publications transparently to the maximum extent possible in their national and regional publications. Any divergence between any IEC Publication and the corresponding national or regional publication shall be clearly indicated in the latter. 5) IEC itself
23、does not provide any attestation of conformity. Independent certification bodies provide conformity assessment services and, in some areas, access to IEC marks of conformity. IEC is not responsible for any services carried out by independent certification bodies. 6) All users should ensure that they
24、 have the latest edition of this publication. 7) No liability shall attach to IEC or its directors, employees, servants or agents including individual experts and members of its technical committees and IEC National Committees for any personal injury, property damage or other damage of any nature wh
25、atsoever, whether direct or indirect, or for costs (including legal fees) and expenses arising out of the publication, use of, or reliance upon, this IEC Publication or any other IEC Publications. 8) Attention is drawn to the Normative references cited in this publication. Use of the referenced publ
26、ications is indispensable for the correct application of this publication. 9) Attention is drawn to the possibility that some of the elements of this IEC Publication may be the subject of patent rights. IEC shall not be held responsible for identifying any or all such patent rights. International St
27、andard IEC 62671 has been prepared by subcommittee 45A: Instrumentation and control of nuclear facilities, of IEC technical committee 45: Nuclear instrumentation. The text of this standard is based on the following documents: FDIS Report on voting 45A/898/FDIS 45A/907/RVD Full information on the vot
28、ing for the approval of this standard can be found in the report on voting indicated in the above table. This publication has been drafted in accordance with the ISO/IEC Directives, Part 2. BS IEC 62671:201362671 IEC:2013 5 The committee has decided that the contents of this publication will remain
29、unchanged until the stability date indicated on the IEC web site under “http:/webstore.iec.ch“ in the data related to the specific publication. At this date, the publication will be reconfirmed, withdrawn, replaced by a revised edition, or amended. BS IEC 62671:2013 6 62671 IEC:2013 INTRODUCTION a)
30、Technical background, main issues and organisation of the Standard This IEC standard specifically focuses on the selection and evaluation of pre-developed dedicated devices of limited, specific functionality and limited configurability for use in a nuclear power plant, where these devices incorporat
31、e either software or digital circuit designs specified using hardware description languages and where these devices have been produced to a recognized non-nuclear standard, but not to the SC 45A series of standards. It is intended that the Standard be used by designers of NPPs, operators of NPPs (ut
32、ilities), systems evaluators and by licensors. The focus of this standard is on two aspects that are not addressed by other standards in the IEC SC 45A series: Other standards address the hardware aspects of devices containing software, or address complex devices such as PLCs containing software whe
33、re that software has the potential to be much more complex1than in the devices covered by this standard, and Other standards focus on devices to be designed specifically for nuclear applications, whereas this standard focuses on the considerations necessary to apply devices in NPPs that have not bee
34、n designed for nuclear use. Designers of I such devices may be internally controlled by software or may consist of ASICs or FPGAs etc. that have been configured through the use of software. Note 2 to entry: Devices, equipment or systems that are controlled by software are described as “computer-base
35、d”, whereas “digital” is a broader term that encompasses any device using digital circuits to implement logic. Note 3 to entry: Digital devices developed for non-nuclear industries are called industrial digital devices. 3.9 equipment one or more parts of a system. An item of equipment is a single de
36、finable (and usually removable) element or part of a system Note 1 to entry: See also “component”, “I while the functionality to support changing the output scale or filtering of the outputs would be an ancillary function. Other functions which are not necessary to the selection of the device, such
37、as local display, or remote signalling via a network connection would be superfluous functions. Note 4 to entry: For example, a smart sensor may be capable of outputting a signal representing the flow or level via an analog output ranging from 4 mA to 20 mA or via a HART protocol. If the designer of
38、 the nuclear application opts to use the 4 mA to 20 mA signal for safety purposes, then this would be the primary function and the other output would be superfluous. 3.19 qualification process of determining whether a system or component is suitable for operational use. The qualification is performe
39、d in the context of a specific class of the I in a second step by the qualification of the integrated I and the faults may not be detected until the occurrence of an event which has an operational profile that has not been a test case. Hence, a major objective of this standard is to provide criteria
40、 for assessing the design of a digital device to provide a degree of assurance commensurate with the class of the intended application so that the device will not fail to perform its function when called upon under its conditions of use due to systematic faults. To achieve this, this standard identi
41、fies specific requirements in 5.2.2 that shall be met by a device so that this standard may be applied. This standard then defines the process and requirements for assessing the candidate device on the basis of the suitability of its functions and the level of confidence one may have in its design a
42、nd operation, and secondarily the confidence that the device design definition is stable. It is also recommended that the likelihood of long-term support be considered. 5.2 Application of this standard 5.2.1 General The object of this subclause is to provide assistance in the application of this sta
43、ndard to those charged with evaluating the suitability of an industrial device for use in an application important to safety in a nuclear power plant. This subclause describes the criteria to be used to decide whether this standard applies, and the principles involved in defining the applicability o
44、f this standard. 5.2.2 Applicability criteria for this standard A digital device to which this standard may be applied shall comply with the following criteria: a) The device is a pre-existing digital device that contains pre-developed software or programmed logic (e.g. an HPD) and is a candidate fo
45、r use in an application important to safety. b) The primary function performed is well-defined and applicable to only one type of application within an I safety category of the function of the target application and the class of the system involved in this target application; primary functionality r
46、equired of the device, including functional requirements and performance requirements such as response time, consistent with the criteria defined in 5.2.2; all the other specific safety properties and characteristics required of the product, as addressed in Clause 6. b) An Evaluation and Application
47、 Plan (EAP) shall be prepared that takes the documented functional and performance requirements into account according to 5.3.2 and 5.3.4, and where relevant defines the strategy to account for multiple uses of a candidate device (whether to perform a single evaluation to cover all the intended uses
48、 or to perform individual evaluations). As the EAP is followed, it may become necessary to revise the Plan in view of the results obtained or the availability of evidence of correctness. c) A candidate device shall be selected and evaluated under this standard only if it meets the requirements of 5.
49、2.2. 4While this standard applies to replacement of any device by a digital one, there are some particular concerns to consider when replacing analog devices with digital devices, such as the sampling rate and the sampling theorem, analog to digital quantization and least significant bit noise which can raise questions about a digital device not sensing an event, and on the other hand the possible advanced filtering possible with digital techniques that could allow
