Properties of Safety Important I&C Systems and their Components - Nuclear Power Plant Instrumentation and Control Systems for Safety and Security - page 84

• Voltage of main and redundant power
supply.
• Operability of transmission circuits of sig-
nals and commands.
• Reliability of analog and discrete input
signals.
• Accuracy of operation of all component
parts of SHC.
• Absence of errors during data exchange
between component parts of SHC.
• Absence of errors in messages, received
from other SHCs.
• Absence of software failures, causing ter-
mination of function performance.
• Other features (temperature rise and / or
smoke in the operating stand-alone com-
ponent parts of SHC, state of remote con-
trol circuits, operability of diagnostic hard-
ware, etc.)

failure is achieved and displayed (automatically
or on call) in the form that allows eliminating
the failure in the shortest possible time. Visual
and audible warning (general failure alarm) is
automatically generated for operational personnel
in the в main control room if operability failure
prevents performing main function(s) of SHC or
peripheral equipment of 2(А) or 3(В) safety class.
Performance of continuous automatic check
during the operation, search of operability failures
and generation of warnings, archiving and display
of diagnostic information and failures of built-in
diagnostic facilities do not have an influence on
performance of main safety important functions
of the I&C system.
Periodic check covers inspection of those
components and properties of the I&C system, for
which continuous automatic check during opera-
tion is impossible, unreasonable or not provided.
Periodic check is performed within a whole pe-
riod of operation of the I&C system - during the
regulated maintenance (when power unit operates
in operating modes) and each predictive and pre-
ventive maintenance (on a shutdown power unit).
During the regulated maintenance, the ac-
curacy of implementation of each category A
discrete function, sequentially simulating condi-
tions, which require its performance, is checked.
Deactivation for maintenance (periodic checking)
of a redundant channel of SHC, participating in
performance of emergency protection functions, is
followed by automatic transmission and retention
of each of its outputs in such a state that corre-
sponds to initiation of commands of protective ac-
tions. In SHC, taking part in performance of other
safety functions, each of outputs of deactivated
redundant channel is automatically determined
and retained in a state that corresponds to a lack
of control and/or alarm command. Checking is
executed without influencing actuating elements
of technological equipment, it does not have any
negative influence on operation and safety state of
the unit, does not prevent functions execution by
operational personnel and is finished by recovery

By agreement between the developer of SHC
and operating organization or customer, automatic
check of SHC, related to 3(С) safety class, can
be performed to a lesser extent. Possibility and
conditions of further use of SHC as intended in
case of detection of defects, required restrictions
and time period, within which operability of SHC
should be recovered, are regulated in Technical
Specification on Safe Operation.
After start-up and during the operation of
peripheral equipment, related to 2(А) and 3(В)
safety class, automatic check of operability (op-
eration accuracy) is performed by use of built-in
tests, provided by developers of these products
(for peripheral equipment, related to 3(С) safety
class, automatic check of operability is allowed
after power-up).
If during check of technical state after start-up
or during failure of, at least, one SHC or safety
important peripheral equipment is detected, a
relevant warning signal is automatically generated
for personnel that monitors the state and provides
maintenance and restoration of the I&C system. In-
formation on time, occurrence and type of detected