SPIN
First Digital Protection System
Feedback of experience ….
….after 30 years
Michel Kosicki, Jose Pacuta, James Kamga, Jean-Pierre Burel
Rolls-Royce – Civil Nuclear Instrumentation and Control
© Rolls-Royce plc 2010
The information in this document is the property of Rolls-Royce plc and may not be copied or communicated to a third party, or used for any
purpose other than that for which it is supplied without the express written consent of Rolls-Royce plc.
This information is given in good faith based upon the latest information available to Rolls-Royce plc, no warranty or representation is given
concerning such information, which must not be taken as establishing any contractual or other commitment binding upon Rolls-Royce plc or
any of its subsidiary or associated companies.
2
Introducing the SPIN
Paluel – 4 x 1300MW
1984 : Rolls-Royce has
installed the first Digital
Integrated Protection
System (DIPS - SPIN)
on Paluel 1, the first of the
1300 MW series in France
Insert filename
Rolls-Royce data-strictly private
3
Introducing the SPIN
 In operation on 20 reactors.
 After 30 years , the system is still operated and maintained
 A method , an organization , a contractual agreement has been
set up to keep the system into operation :
 Spare parts (obsolescence management)
 Competences and skills
 Tools for manufacturing
 Training the system operators
 Technical Support
Insert filename
Rolls-Royce data-strictly private
Status of technologies
4
EDF NPPs safety I&C systems in France
1970
900 MW
- relays
- analogue
1980
1300 MW
P4
- 8 bits Motorola
microprocessor
- point-to-point links
- assembler
language
1990
1450 MW
N4
- 16 bits Motorola
microprocessor
- NERVIA networks
- Optical fibre
- SAGA SDE
IGNALINA
DUKOVANY
TIHANGE
FESSENHEIM, BUGEY
QINSHAN
METSAMOR
KOZLODUY
LIAONING
HONGYANHE,
FUJIAN NINGDE
2010
- 32 bits Motorola
microprocessor
- NERVIA networks
- Optical fibre
- CLARISSE SSDE
SPINLINE3
non software based
Reactor units
Cumulated operation
Rolls-Royce data-strictly private
software based
20 units
420 reactor-years
4 units
60 reactor-years
18 units
90 reactor-years
Insert filename
Architecture of the SPIN
5
Acquisition and processing : 4 divisions
Hardwired links
Trip
Optic fibre – Serial Asynchronous link - One way
Actuation : 2 trains
OU
ESFAS – train A
Rolls-Royce data-strictly private
ESFAS – train B
Insert filename
6
Acquisition and processing :
HARDWIRED
LOGIC
DIGITAL UNITS
PROCESSING
INSULATION
MODULES ANA
UF1
UF2
INSULATION
MODULES BIN
UF3
INH & PS
DIGITAL UNITS
COMMUNICATION
UES
UF4
PRISES
TEST CONNECTION
TEST
Digital
Hardwired
UF5
UF6
UF7
Insert filename
Rolls-Royce data-strictly private
7
Actuation (ESFAS) : Hardwired logic
Log
Y
Log
X
S1
2/2
S1
Rel.
S2
2/2
S2
Rel.
(dynamic logic – magnetic amplifiers – relays )
Insert filename
Rolls-Royce data-strictly private
8
Technology :
* 5 U boards
* Double layer
Insert filename
Rolls-Royce data-strictly private
9
Insert filename
Rolls-Royce data-strictly private
Technological concepts (end of 70’s)
10
 CPU :
 Motorola microprocessor : 6800 – 8 bits
 Co-processor for calculation : 6 x 2901 (6 x 4 bits)
 Clock :
1MHz (…!!!)
 Memories :
REPROM 20 Ko !

RAM
2 Ko !
 Communication between digital units :
 Shared memories
 Serial Asynchronous links
 Optic fibers
Insert filename
Rolls-Royce data-strictly private
Software development
11
 Technology
 Motorola 6800 8-bits microprocessor : (52 CPU's)
 absolute assembler language : 40,000 instructions
 Development Process
 software life cycle (V cycle)
 top down modular design (manual)
 V&V (manual)
 Tools
 absolute assembler + binary loader
 No existing standard at that time
Insert filename
Rolls-Royce data-strictly private
SPIN P4 Feedback – Software
12
 Operation : More than 500 years x reactor (satisfactory)
 Software :
 SPIN P4 : assembler + manual V&V :
- 22.3 faults per 10,000 loc during validation
 (SPIN N4 : with tools (SAGA))
- 2.6 faults per 10,000 loc during validation)
 0 major fault , 1 minor fault on site
 14 software releases for functional improvement
Insert filename
Rolls-Royce data-strictly private
13
SPIN P4 Feedback – Hardware
 Obsolescence management - Redesign of modules or boards :
 Optical Emitter/Receiver module
 Analogue and Binary Insulation board
 Dynamic logic cells
 Relays boards (improvement of relays)

The CPU is still the original one – possible manufacturing
 Hardware :
 Replacement of the automatic tester :
The original computer (Solar) has been replaced by a modern
industrial PC type computer with VXI racks
Insert filename
Rolls-Royce data-strictly private
A new automatic tester
14
Insert filename
Rolls-Royce data-strictly private
15
Long Term Operation
 Objective :
 To keep the system in operation as long as possible
 Combination of 2 strategies :
1. Maintenance and Repair (spare parts)
2. Modernization by System Replacement (complete or partial)
 Consequences :
 Dedicated team for maintenance (expertise, diagnostic , repairing,
spare parts , modification …)
 Guarantee skills and tools availability for a long period
 Long term agreement with customer
 Rolls-Royce has developed a dedicated organization
Insert filename
Rolls-Royce data-strictly private
16
Situation on French Fleet
 An agreement based on :
 Long term contractual relationship (25 years)
 Trust and transparency
 Mutual commitments
45
 Scope of Hardware
40
RPN-CP0
 Performance objectives
Pérennité Protocole application period
35
N4
30
2030
1300 MW
900 MW
2025
20
25
20
20
20
15
20
10
20
05
20
00
19
95
Pérennité Protocole signature
19
90
19
85
 Scope of services
25
 Obsolescence management
20
15
 Technical support
10
 Repairs
5
 Spares parts
0
 On-site maintenance
 Customer Training
 HW and SW modification
Insert filename
Rolls-Royce data-strictly private
Obsolescence management
Transistors
number
17
Next gen of COTS processors far more complex !
MPC 860
Nervia
10 000 000
Life cycle of
our processors
68040
1000 000
GR
100 000
Obsolescence management
68000
10000
Moore
law
6800
1000
100
1970
1980
1990
2000
2010
2020
2030
2040
Insert filename
Rolls-Royce data-strictly private
18
Obsolescence management
 3 stages : 1/3
Obsolescence monitoring
 Component sensitivity analysis
 Obsolescence identification and
assessment
15 000 supplier references tracked
A sensitivity for each supplier reference
5 000 component codes (RRCN codes)
a sensitivity assessment for each code
Insert filename
Rolls-Royce data-strictly private
19
Obsolescence management
3 stages : 2/3
Exchange meeting with EDF
 New obsolescence presentation
 Solution presentation, assessment,
technical, financial,
Quarterly meetings with the customer (EDF)
Presentation, sharing and solution orientations
Follow-up of progress
Insert filename
Rolls-Royce data-strictly private
20
Obsolescence management
3 stages : 3/3
Obsolescence management
 Design of new board or module
 Implementation (documentation)
Obsolescence management by
Strategic storage
Substitution
Re-design
Insert filename
Rolls-Royce data-strictly private
Obsolescence management
21
 Obsolescence management includes
 components, manufacturing processes, suppliers
 Solutions depend on
 Availability of equivalent components (suppliers)
 Interface complexity
 Solution robustness : shorter components life cycle
 Low volume of components
 New standards and technologies
 Keeping the same Qualification level as origin
 Seismic, vibration, EMI/RFI, … tests
 Acceptance by customer of major modifications
Insert filename
Rolls-Royce data-strictly private
Feedback gathering (REX)
22
 LTM Information System
Repairs
REX process
QUALEX
Techn
ical
supp
ort
Site assistance
QUALIS
HW database
Life cycle management
Management
Monitoring
Preventive
Strategic
process
process
storage
storage
EDF Spare
storage
EDF data
Rolls-Royce data-strictly private
Insert filename
23
SPIN Equipment overview
 Gives a global view of the criticality of an equipment
 System engineers shall analyse, comment and make
recommendations for each equipment/system
SPIN 1300 UATP
 The inputs :
Technical

support
Site data
Critical
To be followed
Non Critical
Insert filename
Rolls-Royce data-strictly private
24
Coming years ?
 The system is still capable to be operated for many years with the
same functions
BUT :
 New needs :
 New software application - needs for more :
- power for calculation ..
- memory capacity,

 The system has reached its limits
Then :
 A program got started to analyze the replacement of the digital parts
with an up to date technology (Rolls-Royce SPINLINE)
 The Hardwired parts will be kept (and will be operated for 30 more
years !!!)
Insert filename
Rolls-Royce data-strictly private
25
Conclusion
 After thirty years of operation, results are positive :


System is in correct operation and still maintained with spare
parts available
NO spurious trip or actuation due to the system itself
 A project for modernization is prepared to replace the digital part
with a new digital technology designed with today’s :



Components (SPINLINE 3)
methods and tools (Software development)
Standards (EMI/RFI – qualification)
in order to allow customer to add some new functional needs and
to keep the system in operation for thirty more years.
Insert filename
Rolls-Royce data-strictly private