Spinline - FPGA and µprocessor based platform Taken and sharing advantages of both worlds

Transcription

1 Spinline - FPGA and µprcessr based platfrm Taken and sharing advantages f bth wrlds Julien BACH, Rlls-Ryce Civil Nuclear SAS AIEA FPGA wrkshp 2016 Lyn, France - Octber Rlls-Ryce Civil Nuclear SAS The infrmatin in this dcument is the prperty f Rlls-Ryce Civil Nuclear SAS and may nt be cpied r cmmunicated t a third party, r used fr any purpse ther than that fr which it is supplied withut the express written cnsent f Rlls-Ryce Civil Nuclear SAS. This infrmatin is given in gd faith based upn the latest infrmatin available t Rlls-Ryce Civil Nuclear SAS, n warranty r representatin is given cncerning such infrmatin, which must nt be taken as establishing any cntractual r ther cmmitment binding upn Rlls-Ryce Civil Nuclear SAS r any f its subsidiary r assciated cmpanies. Trusted t deliver excellence

2 Main bjectives 2 Spinline : the Rlls-Ryce I&C Sftware based nuclear safety platfrm dedicated fr categry A functins Overview f the sftware aspects Overview f embedded FPGAs aspects Licensing f Spinline in different Regulatry framewrks Octber, 2016

3 Spinline the 4 th digital generatin 50 years f I&C Analg. Nn-sftwarebased France 900MW plants P4 SPIN 8 bits micrprcessr France: 1300MW P4 plants N4 SPIN 16 bits micrprcessr France 1450MW N4 plants SPINLINE 3 32 bits micrprcessr Dukvany Tihange Metzamr Qinshan Kzlduy Fessenheim Bugey SPINLINE 32 bits micrprcessr - New gateway - Redesigned CPU bard - Increased signals management capabilities - Adaptable pwer supplies - NERVIA netwrks - Optical fiber - CLARISSE SSDE China CPR1000 prgram France VD3-1300MW prgram Finland ELSA prject Lviisa NP Octber, 2016

4 Spinline platfrm the Spinline cmpnents: The cmpnents f the generic platfrm sftware are: The standardized, Class 1E cnfigurable Operatinal System Sftware (OSS) The Class 1E applicatin-riented library f reusable sftware cmpnents, The Class 1E sftware embedded in intelligent bards A nn-class 1E set f tls integrated in a System and Sftware Develpment Envirnment ((CLARISSE), used t design and cnfigure the systems and equipment sftware. Spinline embedded FPGA fr electrnic functins 4 Spinline hardware bards, mdules, racks, cabinets Octber, 2016

5 Spinline prcessing rack 5 Interface bards Pwer surce Main bards: inputs/utputs UC25 N+ LSA Main bards: inputs/utputs

6 Spinline sftware 6 A Spinline sftware is cmpsed f tw parts: The Operatinal System Sftware (OSS) is standard, Is has been develped accrding t IEC and cmes as a sftware cmpnent t be used n the CPU bards f the prcessing units. It is ready fr use after a simple cnfiguratin t fit the needs f the custmer I&C systems. It prvides basic functins like cmmunicatin, data acquisitin r services t be used by the applicatin sftware The applicatin sftware is specific and must be develped by a dedicated team. It implements the Equipment Functinal diagrams (the plant specific applicatin)

7 Spinline sftware The sftware Installed n a Prcessing Unit 7 SENSORS NETWORKS INPUT BOARDS APPLICATION SOFTWARE OUTPUT BOARDS ACTUATORS NETWORKS OPERATIONAL SYSTEM SOFTWARE CPU BOARD Prcessing Unit

8 Spinline sftware Main characteristics : 8 n use f interrupts n dynamic memry allcatin n supprt fr event driven multi-tasking Mdular, structured and simple functins embedded restricted t the nly need f the peratin f the equipment and the I&C safety functins perfrm and manage self-tests include defensive prgramming where apprpriate ensure safety riented features (when a failure is detected) Entirely designed, verified and validated accrding t IEC 60880

9 Spinline sftware Sequential, cyclic and fully deterministic executin f functins 9 Cycle time management Initializatin Cyclical prcessing Test and Self tests Input bards and Nervia Netwrk Acquisitin Applicatin sftware Input data acquisitin Nervia netwrk acquistin Output bards and Nervia Netwrk emissin Lcal Display Unit

10 Spinline sftware The SW develpment prcess with Clarisse SDDE 10

11 Spinline sftware Plant specific applicatin develpment with Scade 11 cntrlled language : n lps, n interrupts, n dynamic memry allcatin includes semantics checks : cmpleteness, type cnsistency, initial data, deadlck used in critical systems (Airbus, Eurcpter, railways signalling) cmpliant with requirements f IEC60880

12 Spinline sftware CLARISSE SDDE - Sftware binary prductin 12 Secured peratin Defensive prgramming Write-prtected sftware Physical access t the CPU bard is needed fr mdificatins

13 Spinline sftware 13 Final characteristics fr assessments Safety and Transparency Size All safety sftware cmpnents are available and reviewable C language are cmmnly knwn and tls exist fr third parties evaluatin Functin blck diagrams descriptin are clse t specificatins and easy t ready N Safety sftware black bxes Octber, 2016

14 Histrical use f FPGA at Rlls-Ryce I&C 14 Transistrs TTL Lgic PAL devices CPLD FPGA CPLD FPGA

15 FPGA at Rlls-Ryce I&C 15 FPGAs used t prvide hardware design slutins ranking frm simple electrnic functins internal t hardware devices (in the cntext f dedicated hardware r prgrammed lgic bards) implementatin f cmplex applicatin functins In the design f electrnic bards : existing bards, bards freseen t be refurbished and additinal new bards. Higher level f cmplexity used fr specific nn safety equipment ex Implementatin f rd cntrl system cycler (France 900MW)

16 Design f electrnic bards fr class 1 equipment 32 Actuatr Bard design 16 Previus actuatr bard: 1 micrprcessr + lgic circuits; New actuatr bard (n the left): Electrnic functin implemented in an Actel FPGA gates Perfrms the fllwing functins : Bus interface Prcessr interface (registers) Surveillance f the utputs, using a shrt impulse test Bard self-tests All ther cmpnents n the bard are analg cmpnents FPGA

17 Design f electrnic bards fr class 1 equipment 16 analg inputs bard 17 Previus analg bard: 1 micrprcessr + lgic circuits; 6 analg channels per bard FPGA New analg bard: The electrnic functin is implemented int an Actel FPGA gates Perfrms the fllwing functins : Interface with the bus Interface with the prcessr (dual prted ram) Cntrl f acquisitin (16 inputs in 1 ms) Fr each input, prcessing f the input value fr gain and ffset adjustment, perfrmed by an Arithmetical and Lgic Unit Bard self-tests All ther cmpnents n the bard are analg cmpnents

18 Design f electrnic bards fr class 1 equipment FPGA Design Flw 18 Successfully used fr all electrnic functins design Cmpliant with IEC62566 Entirely and exclusively applied in the Hardware electrnic department Applied t mre than 15 class1 bards Bard Design Prcess : - simulatin, - prttypes tests (PROTO1, PROTO2, )

19 FPGA Thughts abut a Class 1 applicatin (R&D) 19 Tp level specificatin f a Diesel Generatr Lad Sequencer

20 FPGA Thughts abut a Class 1 applicatin (R&D) 20 Tp level specificatin f a Diesel Generatr Lad Sequencer Equivalent t an Operatinal System Sftware

21 FPGA thughts abut the use f the technlgy 21 Clear advantages fr electrnic functins Flexibility and ease fr implementing hardware functins Reductin f discrete cmpnents, higher bard reliability Replacement f sensible cmpnents (adjustment pt) Need fr skills attentin Design and test activities require dedicated skills with electrnic hardware backgrund rather than System r sftware backgrund Cding HDL differs significantly frm sftware cding Architecture f the FPGA and targeted design within the FPGA must be well understd and drives the design beynd the functins t implement Need fr technical attentin N ease fr flating pint frmat calculatin, develping an FPU is needed, n mathematic functins, n algebraic, n Elementary transcendental functins Embedded self tests, Definitin f safe states, Partitining, separatin, lcal specific redundancy, parallel prpagatin Design and testing tl behavir Parameter handling (cnditins fr updates)

22 Abut licensing f Spinline 22 3 cases: UNITED STATES, US NRC: Spinline : safety evaluatin f the Spinline generic platfrm, FRANCE, ASN/IRSN: EDF - VD3 1300MW : Plant specific prject 20 NPP refurbishment currently in deplyment phase, FINLAND, STUK, FORTUM - ELSA prject : Plant specific prject refurbishment f I&C systems at the Lviisa NPP in prgress

23 Spinline generic assessment - US NRC (1) 23 NRC RAIs LTR and dcumentatin reviews : The NRC staff submitted 3 sets f Requests fr Additinal Infrmatin (RAIs) representing 67 questins/cmments cvering: Prcess and prcedures : Technical clarificatin All tpics explained, understd and accepted by the NRC NRC Factry audit: NRC ne week audit with IRSN France as an invited party t share the audit cntent and utcmes aimed t mre cmmunicatins abut prcedures, cmplex technical infrmatin and access t lw-level details. US NRC audit reprt : The audit team lead indicated that all audit bjectives were satisfactrily met. N pen items r cncerns were identified.

24 Spinline generic assessment - US NRC (2) 24 the US NRC evaluatin in a nutshell: In 2009, Rlls-Ryce submitted the initial LTR fr the acceptance evaluatin In 2010, the evaluatin prject was launched by the US NRC The NRC staff submitted 3 sets f RAIs filled-in by Rlls-Ryce The NRC perfrmed hardware qualificatin audit and factry audit In September 2014, the NRC finalized the SER US/NRC : N generic pen items r unusual plant-specific pen items are needed t be addressed by an applicant r licensee referencing the tpical reprt

25 VD MW prject : EDF- IRSN/ASN (1) 25 Specific licensing aspects fr the sftware EDF fully independent sftware testing all final VD MW sftware surce cde quality assessment f the cde rbustness assessment f the cde 3 different departments f EDF invlved IRSN fully independent additinal sftware testing Selected final sftware testing dedicated purpses fr IRSN n critical issue are identified

26 VD MW prject : EDF- IRSN/ASN (2) 26 the VD MW prject in a nutshell: Rlls-Ryce started the prject at end f 2010 The verall licensing in 2 parts: the generic Spinline platfrm plant specific prject 180 dcuments licensing related, This prject is currently the wrld largest I&C mdernizatin prgram At the end f 2014, the final assessment f IRSN has been fficially published : IRSN : The Spinline platfrm is fully suitable fr the develpment f class 1 equipment and fr categry A functins.

27 LOVIISA ELSA prject : FORTUM - STUK (1) 27 Independent Type apprval f the Spinline platfrm: The type apprval prcess aims t get certificates frm a third party independent frm the supplier Accreditatin ISO 17020, ISO r IS Rlls-Ryce cntracted the activity with the German cmpany ISTec TUV Rheinland The assessment cvered in detail mre than 40 dcuments cmpleted by mre than 150 referenced dcuments It has started in mid 2014 and has been finalized fr all existing parts in September certificates : Hardware, Sftware, sftware tls, FPGA Cmpleted by the Type apprval reprt ISTec-TUV : The reprt cnfirms that the Spinline and the hardwired platfrm cnfrm t their specificatins, and that the design and manufacturing prcesses are adequate t ensure high quality I&C prducts fr implementatin in systems imprtant t safety in nuclear pwer plants.

28 Cnclusin 28 Bth wrlds, FPGA based r Sftware based, have their specific advantages and may be used t implement targeted functins, Bth can be used efficiently and cnsistently fr their mst relevant field. A platfrm initially and entirely designed fr nuclear I&C systems remains certainly a significant factr fr safety demnstratin. Spinline, including bth technlgies, has shwn t be fully licensable within different internatinal Regulatry framewrks The highest level f cnfidence stands certainly n the easiness: t prvide the safety evidences f the slutins t reach the best cmmn understanding amng the stakehlders.

29 Thank yu fr yur attentin! Cmments? Questins? Trusted t deliver excellence Octber, 2016