Properties of Safety Important I&C Systems and their Components - Nuclear Power Plant Instrumentation and Control Systems for Safety and Security - page 83

Maintainability is standardized and estimated
for devices recoverable on operating site. Main-
tainability measures is a mean time to repair
(MTTR), required for detection of inoperative
component part of restorable (usually operating
sand-alone) device, carrying out of preparatory
operations (mounting of bypasses, disconnec-
tion of circuits, etc), replacement of inoperative
component part to reserve and further checking
of operation accuracy of the I&C system, SHC
or device, execution of required final operations
- recovery of circuits, removal of bypasses, etc.
(MTTR does not include delays required for
call and arrival of repair personnel, delivery of
operable component part on an operating site of
the device, paper work before and after recovery
competition). Required values of MTTR are
determined by agreement between a designer of
the I&C system (developer of SHC or peripheral
equipment) and NPP (customer) for all recoverable
devices, taking part in performance of category А
and В functions. They are usually supplemented
with qualitative requirements for diagnostic, test-
ability, checking automation, etc.
Design estimate of reliability and maintainabil-
ity of SHC and peripheral equipment are executed
till their procurement to the customer on the basis
of estimations and / or results of reliability tests.
Reliability and maintainability of main functions
of the I&C system are preliminary calculated on
the basis of data of components' reliability, par-
ticipating in their performance, and main clarify
by results obtained during trial operation.
Durability is standardized for I&C systems,
SHC and peripheral equipment. As durability
measure used mean life, defining time after which
updating of the I&C system, replacement of SHC
and / or peripheral equipment are executed, or a
decision about possibility to continue operation
within a new regulated period is made and agreed
in accordance with the established procedure.
Mean life of new and updated I&C systems
and SHC - are not less than 30 years. Within this
period replacement of component parts of SHC

and / or peripheral equipment, for which a mean
life restricted by their suppliers is exceeded (not
less than 15 years) is allowed.

Technical Diagnostic

Internal (“embedded”) technical diagnostic fa-
cilities automatically control technical state and
detect operability failures of removable component
parts and redundant channels of SHC, peripheral
equipment, command and signal transmission
lines. Technical state control is executed after
energization, continuously during operation and
periodically.
After energization of SHC automatic checking
is executed:

• Compliance of composition and conigura-
tion to design characteristics.
• Compliance of loaded software version to
composition and coniguration of SHC.
• Absence of distortions of in programs and
data in read-only memory.
• Connection of all standard connectors.
• Up state of component parts of SHC.
• Operability of signal and command trans-
mission circuits if it is possible.
• Accuracy of data transmission.
• Accuracy of exchange of messages be-
tween component parts of SHC with adja-
cent SHCs in a composition of the same
and / or another I&C system.

SHC is considered operable and can be used as
intended without any restrictions only after elimi-
nation of all defects detected during monitoring.
Before elimination of defects a possibility and
conditions of use of SHC as intended, required
restrictions ad time, during which operability
should be recovered, are regulated in Technical
Specification on Safe Operation.
In the process of SHC operation, related to
2(А) and 3(В) safety class, continuous automatic
control is performed for: