Other safety relevant systems

Any other systems that are claimed to have a safety function, that may assist or support a safety system or that may influence the performance of a safety system should be described under this heading. 

---

At Zaporozhe NPP, the Units 5 and 6 have one additional diesel per unit to back up the makeup pumps and other safety relevant systems. This measure is also being planned for other Ukrainian NPPs. In addition, alternative sources of electrical power, e.g. transportable diesel generators, are being investigated. 

The comprehensive work contfol system should include any authorizations, permits and certificates necessary to help ensure safety in the work area and to prevent maintenance activities from affecting other safety relevant areas. The following specific matters should be considered in the work control system ... 

The demand rate is determined by the characteristics of the associated equipment under control (EUC) in combination with the reliability of the EUC control system. The hazard rate is determined by the risk considered to be tolerable in the particular application, taking into account the risk reduction provided by any other safety-related systems or risk reduction measures relevant to the hazard being considered. 

This addresses elements in general and does not somehow restrict as in flie list directly related to the analysis of dependent failure. It could be that it asks for the definition of internal and external interfaces of safety relevant elements in order to avoid adverse safety relevant effects on other safety relevant elements. However, without an analysis, this requirement cannot be met. This requirement can be found in part 4, which addresses the system development. However, there is no limitation for which elements this requirement should be applied. Positively seen, this requirement refers to previous example with the capacitor and transistor, since electronic components are also elements according to ISO 26262. On the other hand, this would mean that all electronic components, even the smallest software units, would need to be checked for troublesome, harming influences of other elements. The intended function and their safety mechanism need dependencies in case of failure of the intended function, but if the safety mechanism negatively affects the intended function, the safety mechanism weakens the system. But this is again a matter of design and realization, therefore a general question, why is the analysis of dependent failure only required for ASIL C and ASIL D functions or elements ... 

Also, the test procedure (protocol) is fundamental because it allows comparing results from different laboratories and from different experimental sets. Moreover, selected test protocol could affect the interpretation of the results, the information content and its application in the safety evaluation process, as stated by Frazer if the biological system is exposed to a test chemical for 24 h and the endpoint assay is immediately conducted, the data produced would be most relevant to the acute toxicity of the test material. If, on the other hand, the system is exposed to material for 24 h and the system is cultured in the absence of the test material for additional 48 h before the endpoint assay is conducted, the data would be more relevant to recovery from toxicity rather than acute toxicity [7]. 

Record information from the facility s computerized maintenance management system (CMMS) Collect copies of relevant job safety analyses (JSAs), hazards analyses, and other safety evaluations. 

The Worksheet is, in a sense, an audit form. As will be shown in Chapter 21, ZIO, Other Safety Standards and Guidelines, and VPP Certification, the VPP safety management system requirements have great similarity with the ZIO provisions. However, there are differences. Some of the VPP requirements are not as specific as comparable provisions in ZIO. Those provisions are identified below along with cross-references to the relevant chapter in this text ... 

The classic triple constraints of time, cost and functionality are well known in projects, but other constraints can be imposed. One interesting class that is particularly relevant in safety-critical systems development is standards. Quite often the use of a standard is described as a requirement but it isn t. What a standard does is constrain a project, possibly in multiple ways. The types of things standards impose on projects include process, tools, resourcing, product characteristics and governance activities, and essentially impact on the product produced. 

For certification of the products, tools like FMEDA and Markov models are used. An FMEDA extends the FMEA techniques to include online diagnostic techniques and identify failure modes relevant to safety-instrumented system design. These PFD calculations may be carried out by commercial software tools (e.g., SILence by HIMA). In all these cases, bottom-up approaches were undertaken. Also it has been found tbat there has been a serious lack of reliable failure rate data and their variations among lab specifications, lab/field and field specifications. There are wide variations in the data obtained from these different sources. Therefore it is suggestive to use a band of data instead of discrete PFD and other failure rate data [5]. 

Operability requirements should be stated for the reactor protection system and for instrumentation and logic for other safety systems, together with limits on response times, instrument drift and accuracy, where appropriate. Interlocks teqnired by the safety analysis report should be identified and relevant operability reqnire-ments should be stated. 

The key elements of a health and safety management system are as relevant to these as to any other hazards ... 

The computer systems described so far were all intended for use in nuclear power plants. The safety requirements are particularly high there, but the basic principles applied to computer qualification for nuclear applications can, of course, be used in other areas too a lower degree of safety relevance will result in a less rigorous qualification procedure. 

For an item, it must be specified which SACs of other items are relevant and have to be fulfilled. It is obvious to specily this in the Safety Concept, System Concept or in the Preliminary Architecture document. 

This subsection should provide relevant information on any other plant auxiliary system whose operation may influence plant safety and that has not been covered in any other part of the SAR for example, the communication systems, the lighting systems, the cooling water system, the starting system, the lubrication system and the combustion air intake and exhaust system for the diesel generator. 

If we consider these recommendations we often end up with separate C files, which realize the desired functionalities and others that realize the safety mechanisms. By using partitioning (separation of functions and functions monitoring by safety mechanisms), which can also already be implemented in the system architecture level, the complexity can be strongly reduced. A mix of safety relevant functions and non-safety relevant functions at the software design level, which is inside of a SW unit, is actually not considered in ISO 26262. The SW-Unit would have to be developed according to the highest ASEL. This could then lead to an issue with ASIL D, since at this point redundancies or an implementation of diversity software is recommended. 

Because camera monitor systems are safety-relevant electronic systems, ISO 16505 generally requires their functional safety needs to be covered within the development process. ISO 16505 therefore refers to other existing standards that address functional safety. 

---