Nuclear power plants - Instrumentation and control systems important to safety - Software aspects for computer-based systems performing category A functions

Provides requirements for the software of computer-based instrumentation and control (I&C) systems of nuclear power plants performing functions of safety category A as defined by IEC 61226. Provides requirements for the purpose of achieving highly reliable software. Addresses each stage of software generation and documentation, including requirements specification, design, implementation, verification, validation and operation.

Kernkraftwerke - Leittechnik für Systeme mit sicherheitstechnischer Bedeutung - Softwareaspekte für rechnerbasierte Systeme zur Realisierung von Funktionen der Kategorie A

Centrales nucléaires de puissance - Instrumentation et contrôle-commande importants pour la sûreté - Aspects logiciels des systèmes programmés réalisant des fonctions de catégorie A

Enonce des exigences pour les logiciels des systèmes d'instrumentation et de contrôle-commande (I&C) programmés des centrales nucléaires de puissance, réalisant des fonctions de catégorie A telle que définie par la CEI 61226. Enonce des exigences pour la production de logiciels de haute fiabilité. Prend en compte chaque étape de développement et de documentation du logiciel, c'est-à-dire la spécification des exigences, la conception, le développement, la vérification, la validation et l'exploitation.

Jedrske elektrarne - Merilna in nadzorna oprema za zagotavljanje varnosti - Značilnosti programske opreme računalniških sistemov, ki izvajajo kategorijo funkcij A (IEC 60880:2006)

Ta mednarodni standard predpisuje zahteve za programsko opremo računalniške merilne in nadzorne opreme jedrskih elektrarn, ki izvaja funkcije varnostne kategorije A, kot jih določa IEC 61226. V skladu z opredelitvijo v IEC61513 je merilna in nadzorna oprema varnostnega razreda 1 v osnovi namenjena podpori funkcij kategorije A, lahko pa podpira tudi funkcije nižjih kategorij. Zahteve za opremo so vedno določene glede na funkcijo najvišje uporabljene kategorije. Za programsko opremo merilne in nadzorne opreme, ki v jedrskih elektrarnah izvaja samo funkcije kategorije B in C, kot jih določa IEC 61226, veljajo zahteve in vodilo iz IEC 62138. Ta standard predpisuje zahteve za doseganje zelo zanesljive programske opreme. Obravnava vsako stopnjo nastajanja in dokumentiranja programske opreme, vključno z zahtevami za specifikacijo, načrtovanje, izvajanje, preverjanje, validacijo in delovanje.

General Information

Status
Published
Publication Date
07-Oct-2009
Drafting Committee
Parallel Committee
Current Stage
6060 - Document made available
Start Date
08-Oct-2009
Due Date
07-Nov-2009
Completion Date
08-Oct-2009

Buy Standard

Standard
EN 60880:2010
English language
112 pages
sale 10% off
Preview
sale 10% off
Preview
e-Library read for
1 day

Standards Content (sample)

SLOVENSKI STANDARD
SIST EN 60880:2010
01-januar-2010
-HGUVNHHOHNWUDUQH0HULOQDLQQDG]RUQDRSUHPD]D]DJRWDYOMDQMHYDUQRVWL
=QDþLOQRVWLSURJUDPVNHRSUHPHUDþXQDOQLãNLKVLVWHPRYNLL]YDMDMRNDWHJRULMR
IXQNFLM$ ,(&
Nuclear power plants - Instrumentation and control systems important to safety -
Software aspects for computer-based systems performing category A functions
Kernkraftwerke - Leittechnik für Systeme mit sicherheitstechnischer Bedeutung -
Softwareaspekte für rechnerbasierte Systeme zur Realisierung von Funktionen der
Kategorie A

Centrales nucléaires de puissance - Instrumentation et contrôle-commande importants

pour la sûreté - Aspects logiciels des systèmes programmés réalisant des fonctions de

catégorie A
Ta slovenski standard je istoveten z: EN 60880:2009
ICS:
27.120.20 Jedrske elektrarne. Varnost Nuclear power plants. Safety
SIST EN 60880:2010 en,fr

2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

---------------------- Page: 1 ----------------------
SIST EN 60880:2010
---------------------- Page: 2 ----------------------
SIST EN 60880:2010
EUROPEAN STANDARD
EN 60880
NORME EUROPÉENNE
October 2009
EUROPÄISCHE NORM
ICS 27.120.20
English version
Nuclear power plants -
Instrumentation and control systems important to safety -
Software aspects for computer-based systems
performing category A functions
(IEC 60880:2006)
Centrales nucléaires de puissance - Kernkraftwerke -
Instrumentation et contrôle-commande Leittechnik für Systeme
importants pour la sûreté - mit sicherheitstechnischer Bedeutung -
Aspects logiciels des systèmes Softwareaspekte für rechnerbasierte
programmés réalisant des fonctions Systeme zur Realisierung
de catégorie A von Funktionen der Kategorie A
(CEI 60880:2006) (IEC 60880:2006)

This European Standard was approved by CENELEC on 2009-07-01. CENELEC members are bound to comply

with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European Standard

the status of a national standard without any alteration.

Up-to-date lists and bibliographical references concerning such national standards may be obtained on

application to the Central Secretariat or to any CENELEC member.

This European Standard exists in three official versions (English, French, German). A version in any other

language made by translation under the responsibility of a CENELEC member into its own language and notified

to the Central Secretariat has the same status as the official versions.

CENELEC members are the national electrotechnical committees of Austria, Belgium, Bulgaria, Cyprus, the

Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia,

Lithuania, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain,

Sweden, Switzerland and the United Kingdom.
CENELEC
European Committee for Electrotechnical Standardization
Comité Européen de Normalisation Electrotechnique
Europäisches Komitee für Elektrotechnische Normung
Central Secretariat: Avenue Marnix 17, B - 1000 Brussels

© 2009 CENELEC - All rights of exploitation in any form and by any means reserved worldwide for CENELEC members.

Ref. No. EN 60880:2009 E
---------------------- Page: 3 ----------------------
SIST EN 60880:2010
EN 60880:2009 - 2 -
Foreword

The text of the International Standard IEC 60880:2006, prepared by SC 45A, Instrumentation and

control of nuclear facilities, of IEC TC 45, Nuclear instrumentation, was submitted to the formal vote

and was approved by CENELEC as EN 60880 on 2009-07-01 without any modification.
The following dates were fixed:
– latest date by which the EN has to be implemented
at national level by publication of an identical
national standard or by endorsement (dop) 2010-07-01
– latest date by which the national standards conflicting
with the EN have to be withdrawn (dow) 2012-07-01

CLC/TC 45AX experts draw attention to the readers of this European standard to the fact that it should

be read in conjunction with IAEA document INSAG-10, 1996, “Defence in Depth in Nuclear Safety”

which applies.
__________
Endorsement notice

The text of the International Standard IEC 60880:2006 was approved by CENELEC as a European

Standard without any modification.
__________
---------------------- Page: 4 ----------------------
SIST EN 60880:2010
- 3 - EN 60880:2009
Annex ZA
(normative)
Normative references to international publications
with their corresponding European publications

The following referenced documents are indispensable for the application of this document. For dated

references, only the edition cited applies. For undated references, the latest edition of the referenced

document (including any amendments) applies.

NOTE When an international publication has been modified by common modifications, indicated by (mod), the relevant EN/HD

applies.
Publication Year Title EN/HD Year
IEC 60671 - Nuclear power plants - Instrumentation - -
and control systems important to safety -
Surveillance testing
IEC 61069-2 1993 Industrial-process measurement and EN 61069-2 1994
control - Evaluation of system properties
for the purpose of system assessment -
Part 2: Assessment methodology
IEC 61226 - Nuclear power plants - Instrumentation - -
and control systems important to safety -
Classification of instrumentation and
control functions
1) 2)
IEC 61508-4 - Functional safety of EN 61508-4 2001
electrical/electronic/programmable
electronic safety-related systems -
Part 4: Definitions and abbreviations
IEC 61513 - Nuclear power plants - Instrumentation - -
and control for systems important
to safety - General requirements
for systems
ISO/IEC 9126 Series Software engineering - Product quality - -
IAEA guide NS-G-1.2 - Safety assessment and verification -
for nuclear power plants
IAEA guide NS-G-1.3 - Instrumentation and control systems - -
important to safety in nuclear power
plants
Undated reference.
Valid edition at date of issue.
---------------------- Page: 5 ----------------------
SIST EN 60880:2010
---------------------- Page: 6 ----------------------
SIST EN 60880:2010
NORME CEI
INTERNATIONALE
IEC
60880
INTERNATIONAL
Deuxième édition
STANDARD
Second edition
2006-05
Centrales nucléaires de puissance–
Instrumentation et contrôle-commande
importants pour la sûreté –
Aspects logiciels des systèmes programmés
réalisant des fonctions de catégorie A
Nuclear power plants –
Instrumentation and control systems
important to safety –
Software aspects for computer-based
systems performing category A functions
 IEC 2006 Droits de reproduction réservés  Copyright - all rights reserved

Aucune partie de cette publication ne peut être reproduite ni No part of this publication may be reproduced or utilized in any

utilisée sous quelque forme que ce soit et par aucun procédé, form or by any means, electronic or mechanical, including

électronique ou mécanique, y compris la photocopie et les photocopying and microfilm, without permission in writing from

microfilms, sans l'accord écrit de l'éditeur. the publisher.

International Electrotechnical Commission, 3, rue de Varembé, PO Box 131, CH-1211 Geneva 20, Switzerland

Telephone: +41 22 919 02 11 Telefax: +41 22 919 03 00 E-mail: inmail@iec.ch Web: www.iec.ch

CODE PRIX
PRICE CODE
Commission Electrotechnique Internationale
International Electrotechnical Commission
МеждународнаяЭлектротехническаяКомиссия
Pour prix, voir catalogue en vigueur
For price, see current catalogue
---------------------- Page: 7 ----------------------
SIST EN 60880:2010
60880  IEC:2006 – 3 –
CONTENTS

FOREWORD...........................................................................................................................7

INTRODUCTION...................................................................................................................11

1 Scope and object............................................................................................................17

2 Normative references .....................................................................................................17

3 Terms and definitions .....................................................................................................19

4 Symbols and abbreviations.............................................................................................29

5 General requirements for software projects ....................................................................29

5.1 General .................................................................................................................29

5.2 Software types ......................................................................................................33

5.3 Software development approach ...........................................................................35

5.4 Software project management ...............................................................................39

5.5 Software quality assurance plan ............................................................................39

5.6 Configuration management....................................................................................41

5.7 Software security...................................................................................................43

6 Software requirements....................................................................................................47

6.1 Specification of software requirements ..................................................................47

6.2 Self-supervision ....................................................................................................49

6.3 Periodic testing .....................................................................................................49

6.4 Documentation ......................................................................................................51

7 Design and implementation ............................................................................................51

7.1 Principles for design and implementation ..............................................................53

7.2 Language and associated translators and tools .....................................................57

7.3 Detailed recommendations ....................................................................................59

7.4 Documentation ......................................................................................................63

8 Software Verification ......................................................................................................63

8.1 Software verification process.................................................................................63

8.2 Software verification activities ...............................................................................65

9 Software aspects of system integration...........................................................................73

9.1 Software aspects of system integration plan..........................................................75

9.2 System integration ................................................................................................77

9.3 Integrated system verification................................................................................77

9.4 Fault resolution procedures ...................................................................................79

9.5 Software aspects of integrated system verification report ......................................79

10 Software aspects of system validation ............................................................................81

10.1 Software aspects of the system validation plan......................................................81

10.2 System validation ..................................................................................................81

10.3 Software aspects of the system validation report ...................................................83

10.4 Fault resolution procedures ...................................................................................83

11 Software modification .....................................................................................................83

11.1 Modification request procedure .............................................................................85

11.2 Procedure for executing a software modification....................................................87

11.3 Software modification after delivery.......................................................................89

---------------------- Page: 8 ----------------------
SIST EN 60880:2010
60880  IEC:2006 – 5 –

12 Software aspects of installation and operation................................................................91

12.1 On-site installation of the software ........................................................................91

12.2 On-site software security.......................................................................................91

12.3 Adaptation of the software to on-site conditions.....................................................93

12.4 Operator training ...................................................................................................93

13 Defences against common cause failure due to software................................................95

13.1 General .................................................................................................................95

13.2 Design of software against CCF ............................................................................97

13.3 Sources and effects of CCF due to software..........................................................97

13.4 Implementation of diversity....................................................................................99

13.5 Balance of drawbacks and benefits connected with the use of diversity.................99

14 Software tools for the development of software ..............................................................99

14.1 Introduction ...........................................................................................................99

14.2 Selection of tools.................................................................................................101

14.3 Requirements for tools ........................................................................................103

15 Qualification of pre-developed software........................................................................113

15.1 General ...............................................................................................................113

15.2 General requirements..........................................................................................113

15.3 Evaluation and assessment process....................................................................115

15.4 Requirements for integration in the system and modification of PDS ...................131

Annex A (normative) Software safety life cycle and details of software requirements .........133

Annex B (normative) Detailed requirements and recommendations for design and

implementation ...................................................................................................................137

Annex C (informative) Example of application oriented software engineering (software

development with application-oriented language)................................................................163

Annex D (informative) Language, translator, linkage editor ................................................171

Annex E (informative) Software verification and testing......................................................175

Annex F (informative) Typical list of software documentation .............................................191

Annex G (informative) Considerations of CCF and diversity ...............................................193

Annex H (informative) Tools for production and checking of specification, design and

implementation ...................................................................................................................201

Annex I (informative) Requirements concerning pre-developed software (PDS) .................207

Annex J (informative) Correspondence between IEC 61513 and this standard ...................211

---------------------- Page: 9 ----------------------
SIST EN 60880:2010
60880  IEC:2006 – 7 –
INTERNATIONAL ELECTROTECHNICAL COMMISSION
____________
NUCLEAR POWER PLANTS –
INSTRUMENTATION AND CONTROL SYSTEMS IMPORTANT TO SAFETY –
SOFTWARE ASPECTS FOR COMPUTER-BASED SYSTEMS PERFORMING
CATEGORY A FUNCTIONS
FOREWORD

1) The International Electrotechnical Commission (IEC) is a worldwide organization for standardization comprising

all national electrotechnical committees (IEC National Committees). The object of IEC is to promote

international co-operation on all questions concerning standardization in the electrical and electronic fields. To

this end and in addition to other activities, IEC publishes International Standards, Technical Specifications,

Technical Reports, Publicly Available Specifications (PAS) and Guides (hereafter referred to as “IEC

Publication(s)”). Their preparation is entrusted to technical committees; any IEC National Committee interested

in the subject dealt with may participate in this preparatory work. International, governmental and non-

governmental organizations liaising with the IEC also participate in this preparation. IEC collaborates closely

with the International Organization for Standardization (ISO) in accordance with conditions determined by

agreement between the two organizations.

2) The formal decisions or agreements of IEC on technical matters express, as nearly as possible, an international

consensus of opinion on the relevant subjects since each technical committee has representation from all

interested IEC National Committees.

3) IEC Publications have the form of recommendations for international use and are accepted by IEC National

Committees in that sense. While all reasonable efforts are made to ensure that the technical content of IEC

Publications is accurate, IEC cannot be held responsible for the way in which they are used or for any

misinterpretation by any end user.

4) In order to promote international uniformity, IEC National Committees undertake to apply IEC Publications

transparently to the maximum extent possible in their national and regional publications. Any divergence

between any IEC Publication and the corresponding national or regional publication shall be clearly indicated in

the latter.

5) IEC provides no marking procedure to indicate its approval and cannot be rendered responsible for any

equipment declared to be in conformity with an IEC Publication.

6) All users should ensure that they have the latest edition of this publication.

7) No liability shall attach to IEC or its directors, employees, servants or agents including individual experts and

members of its technical committees and IEC National Committees for any personal injury, property damage or

other damage of any nature whatsoever, whether direct or indirect, or for costs (including legal fees) and

expenses arising out of the publication, use of, or reliance upon, this IEC Publication or any other IEC

Publications.

8) Attention is drawn to the Normative references cited in this publication. Use of the referenced publications is

indispensable for the correct application of this publication.

9) Attention is drawn to the possibility that some of the elements of this IEC Publication may be the subject of

patent rights. IEC shall not be held responsible for identifying any or all such patent rights.

International Standard IEC 60880 has been prepared by subcommittee 45A: Instrumentation

and control of nuclear facilities, of IEC technical committee 45: Nuclear instrumentation.

This second edition cancels and replaces the first edition published in 1986 and IEC 60880-2

published in 2000. It constitutes a technical revision.
The revision of the standard is intended to accomplish the following:

• To take into account the fact that software engineering techniques advanced significantly

in the intervening years.

• To align the standard with the new revisions of IAEA documents NS-R-1 and NS-G-1.3.

This includes as far as possible adaptation of the definitions.
---------------------- Page: 10 ----------------------
SIST EN 60880:2010
60880  IEC:2006 – 9 –

• To replace, as far as possible, requirements associated with standards published since

the first edition of IEC 60880, especially IEC 61513, IEC 61226 edition 2, IEC 62138 and

IEC 60987.

• To fully integrate IEC 60880-2 published in 2000 as chapters 13, 14, 15 and annexes G,

H, I.

• To review the existing requirements and to update the terminology and definitions.

The text of this standard is based on the following documents:
FDIS Report on voting
45A/613/FDIS 45A/621/RVD

Full information on the voting for the approval of this standard can be found in the report on

voting indicated in the above table.

This publication has been drafted in accordance with the ISO/IEC Directives, Part 2.

The committee has decided that the contents of this publication will remain unchanged until

the maintenance result date indicated on the IEC web site under "http://webstore.iec.ch" in

the data related to the specific publication. At this date, the publication will be

• reconfirmed,
• withdrawn,
• replaced by a revised edition, or
• amended.
---------------------- Page: 11 ----------------------
SIST EN 60880:2010
60880  IEC:2006 – 11 –
INTRODUCTION
a) Technical background, main issues and organisation of the standard

Engineering of software based Instrumentation and Control (I&C) systems to be used for

nuclear safety purposes is a challenge due to the safety requirements to be fulfilled. The

safety software used in nuclear power plants (NPP) which are often required only in

emergency cases, have to be fully validated and qualified before being used in operation. In

order to achieve the high reliability required, special care has to be taken throughout the

entire life cycle, from the basic requirements, the various design phases and V&V procedures

for operation and maintenance. It is the main aim of this standard to address the related

safety aspects and to provide requirements for achieving the high software quality necessary.

The first edition of this standard was issued in 1986 to interpret the basic safety principles

applied so far in hardwired systems for the utilisation of digital systems — multiprocessor

distributed systems as well as larger scale central processor systems — in the safety systems

of nuclear power plants.

It has been used extensively within the nuclear industry to provide requirements and guidance

for software of NPP safety I&C systems.

Although many of the requirements within the first edition continued to be relevant, there were

significant factors which justified the development of this second edition:

– Since 1986, a number of new standards have been produced which address in detail the

general requirements for systems (IEC 61513), hardware requirements (IEC 60987) and a

standard to address software for I&C systems performing category B or C functions for

NPP systems important to safety (IEC 62138). The Safety Guide 50-SG-D3 of the IAEA

has been superseded by the guide NS-G-1.3. Additionally, IEC 60880-2 has been issued.

– Software engineering techniques have advanced significantly in the intervening years.

In this standard, utmost care has been taken to keep transparency with respect to the first

edition. Where possible, the phrasing of requirements has been kept, otherwise it has been

extended in a traceable way. In the same manner, IEC 60880-2 dealing with software aspects

of defence against common cause failures, use of software tools and pre-developed software

has been integrated, so that now this current standard covers entirely the software safety

issues to be addressed.

It is intended that the standard be used by systems developers, systems purchasers/users

(utilities), systems assessors and by licensors.

b) Situation of the current standard in the structure of the SC 45A standard series

IEC 60880 is directly referenced by IEC 61513 which deals with the system aspects of high

integrity computer-based I&C used in safety systems of nuclear power plants together.

IEC 60880 is the second level SC 45A document tackling the issue of software aspects for

I&C systems performing category A functions.
---------------------- Page: 12 ----------------------
SIST EN 60880:2010
60880  IEC:2006 – 13 –
Software for categories B and C functions is dealt with in IEC 62138.

IEC 60880 and IEC 62138 together cover the domain of the software aspects of computer-

based systems used in nuclear power plants to perform functions important to safety.

This second edition of IEC 60880 is to be read in conjunction with IEC 60987 and IEC 61226,

the appropriate SC 45A standards on computer hardware and on classification.

For more details on the structure of the SC 45A standard series see item d) of this

introduction.
c) Recommendation and limitation regarding the application of this standard

It is important to note that this standard establishes no additional functional requirements for

safety systems.

Aspects for which special requirements and recommendations have been produced, are:

1) a general approach to software development to assure the production of the highly reliable

software required including hardware and software interdependencies;

2) a general approach to software verification and to the software aspects of the computer-

based system validation;
3) procedures for software modification and configuration control;
4) requirements for use of tools;
5) procedures for qualification of pre-developed software.

It is recognised that software technology is continuing to develop at a rapid pace and that it is

not possible for a standard such as this to include references to all modern design

technologies and techniques.

To ensure that the standard will continue to be relevant in future years the emphasis has been

placed on issues of principle, rather than specific software technologies.

If new techniques are developed then it should be possible to assess the suitability of such

techniques by applying the safety principles contained within this standard.

d) Description of the structure of the SC 45A standard series and relationships with

other IEC documents and other bodies documents (IAEA, ISO)

The top level document of the SC 45A standard series is IEC 61513. This standard deals with

requirements for NPP I&C systems important to safety and lays out the SC 45A standards

series.

IEC 61513 refers directly to other SC 45A standards for general topics related to

categorization of functions and classification of systems, qualification, separation of systems,

defence against common cause failure, software aspects of computer-based systems,

hardware aspects of computer-based systems, and control room design. The standards

referenced directly at this second level should be considered together with IEC 61513 as a

consistent document set.
---------------------- Page: 13 ----------------------
SIST EN 60880:2010
60880  IEC:2006 – 15 –

At a third level, SC 45A standards not directly referenced by IEC 61513 are standards related

to specific equipment, technical methods or specific activities. Usually these documents,

which make reference to second level documents for general topics, can be used on their

own.

A fourth level extending the SC 45A standard series corresponds to the technical reports

which are not normative.

IEC 61513 has adopted a presentation format similar to the basic safety publication

IEC 61508 with an overall safety life-cycle framework and a system life-cycle framework and

provides an interpretation of the general requirements of IEC 61508 parts 1, 2 and 4, for the

nuclear application sector. Compliance with this standard will facilitate consistency with the

requirements of IEC 61508 as they have been interpreted for the nuclear industry. In this

framework, IEC 60880 and IEC 62138 correspond to IEC 61508, part 3 for the nuclear

application sector.

IEC 61513 refers to ISO standards as well as to IAEA 50-C-QA for topics related to quality

assurance.

The SC 45A standards series consistently implement and detail the principles and basic

safety aspects provided in the IAEA Code on the safety of nuclear power plants and in the

IAEA safety series, in particular the Requirements NS-R-1, “Safety of Nuclear Power Plants:

Design” and the Safety Guide NS-G-1.3, “Instrumentation and control systems important to

safety in Nuclear Power Plants”. The terminology and definitions used by SC 45A standards

are consistent with those used by the IAEA.
---------------------- Page: 14 ----------------------
SIST EN 60880:2010
60880  IEC:2006 – 17 –
NUCLEAR POWER PLANTS –
INSTRUMENTATION AND CONTROL SYSTEMS IMPORTANT TO SAFETY –
SOFTWARE ASPECTS FOR COMPUTER-BASED SYSTEMS PERFORMING
CATEGORY A FUNCTIONS
1 Scope and object

This International Standard provides requirements for the software of computer-based I&C

systems of nuclear power plants perf
...

Questions, Comments and Discussion

Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.