Impacts of common cause failure regulatory requirements on protection system architectures - 304
Regulatory-based design considerations for potential common cause failures (CCF) in digital instrumentation and control (I and C) systems have evolved over time and have impacted the development of protection system I and C architectures. The single failure criterion used to be the main design driver for a protection system I and C architecture and resulted in the familiar four-fold and three-fold system architectures. The single failure criterion has now been replaced by the conservative assumptions associated with digital CCF concerns (i.e., assumed digital CCF coincident with an anticipated operational transient or postulated accident) which are classified as 'beyond design basis events' by regulatory authorities. It is unusual for a beyond design basis event to be the controlling factor for a safety system design but that is now the reality for I and C system designers. The preferred regulatory solution is to introduce diversity into I and C system designs to guard against the general concern of digital CCF. However, the lack of clear criteria on how to define sufficient diversity (i.e., how much, what kind, and whether it is linked to identified digital CCF vulnerabilities) had led to more complex I and C architectures. The trend has been towards lengthy and more difficult reviews for the treatment of digital CCF vulnerabilities and I and C system architectures because of the subjective definition of digital CCF vulnerabilities and the lack of clear acceptance criteria for diversity strategy. Improvement in the treatment of digital CCF is needed to reverse the trend of increased I and C system architecture complexity and longer regulatory reviews. (authors)