Why Are I&C Modernisations So Difficult: Experiences with Requirements Engineering And Safety Demonstration in Swedish NPPs

Control and protection functions are long lived in comparison with the lifetimes of the equipment technologies that implement them. This implies that changes will need to be made to the I&C systems and the associated safety demonstrations over the lifetime of the plant. Indeed, there is often no choice but to change; the renovation is unavoidably dictated by a variety of circumstances including declining reliability of old installed equipment, reduced availability of spare parts, inability to maintain existing equipment, or amended requirements from the licensing authority. It is therefore important to ensure that the required safety level can be maintained over the plant lifetime in the face of these changes. Several I&C modernisation projects have encountered issues and difficulties resulting in delays and overspend. This paper describes the work we have done with the aim of identifying the main issues that have been experienced in I&C modernization projects, and any lessons learnt during these projects. For this, we conducted a number of interviews in Swedish nuclear plants, focusing on the demonstration of safety and requirements engineering. The paper discusses the findings from our interviews, emphasising the problems associated with I&C projects in general, and with upgrades and modifications in particular. We present a brief discussion of these major problems, and suggest approaches to avoid them or ameliorate their effects. The lessons identified are applicable not just to I&C modernisation projects, but more generally to any I&C development projects. The consultation was followed by a series of workshops to discuss possible ways to address the difficulties that are often experienced by the industry.