Project Management 1

1. Project Management (1) Understanding the scope up front Particularly for upgrade projects Understand the sequencing of projects, and have a long term vision Need flexibility Need to consider things outside the control room (i.e., holistic view) Need to ensure feedback from the right people Particularly operators Some difficulties in scheduling busy people Should there be more of them (expensive)? �ownership� How soon? As early as possible Sell them on the ideas/possibilities

2. Project Management cont. (2) Need to look to the future w.r.t. planning for obsolescence and change Need to ensure that operators have input into priority of changes Need to ensure continuity Need flexibility Funding and scheduling Need to ensure that each phase has a useful deliverable that can be lived with on its own Must be able to discontinue a program after each project Do more while plant is at power � outage time is limited Parallel operation opportunities should be used when possible

3. Project Management cont. (3) Controlling cost Should focus on TCOO (Total Cost of Ownership)? Having trained managers manage projects Avoid �Responsibility without Authority� Best if the project manager has a say in the budget Need upper management support Need a trained project team Need the �right� resources Need stable, dedicated resources Many projects are cancelled due to cost overruns Strategic alliances with vendors Allow for iterations in requirements Allow for familiarization time Price point needs to be realistic for both groups Need long term plan for maintenance Get the requirements right Control the scope Go back to original requirements, rather than existing system specs

4. Project Management cont. (4) Do more while plant is at power � outage time is limited If redundant, soft displays should show a view consistent with the physical devices Specific to digital systems: Engineering is different Combination of paradigms (analog, digital) More focus on HF Different system behaviour � serial Need to manage tools (e.g., CAD tools) Often higher degree of integration required Sometimes in a very short period Need to focus on long-term configuration management Ensure that scope includes removal of old equipment/cables etc. Need to make a decision � don�t wait for the perfect system Reuse and share experience for up-front feed back, common equipment w.r.t. projects IAEA I&C database on modernization activities is one source Database should be grown to include case studies

5. Implementation (1) Validation continues into implementation � (JD) Need good document and configuration management for long term maintenance � (JD) Vendor support needs to be in place early on Rationale needs to be captured, not just current specs: Ref � presentation 11 Constraint � need to keep control of a plant, even during an outage � (JN) Need training on new control room devices for when they are in place � (JN) Aggravated by multiple units, with updates possibly years apart Possible licensing issue with limited training simulators, people trained for different configurations, etc. Timing of updating training simulator (desktop and full-scale) needs to be considered � may be on the critical path Need to consider freezing well before changes are implemented � add to the TOC � (RL) Test bed � needs to be part of every project? � (YZ) Needs to be high-fidelity to ensure no problems at the plant Good for training of maintenance engineers Ref � presentation 34

6. Implementation cont. (2) How much testing? � (MO) Guidance on level of testing based on situation should be included Graded approach Functions affected Complexity of the change Systems affected Standards that apply Change management and configuration management � (FD) Independent checks Audit trail Controlled process for updating digital documentation in the control room Need to include configuration data, documents (e.g., alarm sheets or procedures) as well as code

7. Implementation cont. (3) Handling control rooms that are �easier� to change? � (MF) What to �lock down�? What should the operators be allowed to personalize/customize? (e.g., trending) Different levels of security/access Need audit trail Organize the data workflow, traceability to analysis, paper trail for an audit Need to track who has access as roles change Who owns the data Rules for changes on control room systems

8. Implementation cont. (3a) Handling control rooms that are �easier� to change? � (MF) What to �lock down�? Generally all engineering and configuration data shall be locked out. Needed access has to specifically granted in adequate levels to clearly defined roles, eg. Maintenance, engineering, system administration. Operators and supervisors (shift engineers) shall only have access to the �operator workplace� and never to the I&C-system or operating system (e.g. Windows, UNIX) level What should the operators be allowed to personalize/customize? Operators and supervisors must be able to perform all necessary changes to control and monitor the plant via the �operator workplace� (in mimic displays, faceplates or specific masks/windows). This includes changing of operational setpoints, if necessary thresholds or limits and the possibility to create �ad hoc� trend displays by means of preconfigured (canned) trend templates. Also �ad hoc� calculations should be possible by means of predefined formulas resp. masks.

9. Implementation cont. (3b) Handling control rooms that are �easier� to change? � (MF) Different levels of security/access An at least two dimensional access right scheme must be implemented, which assigns specific access rights (read and/or write) to clear defined roles to the different applications and system levels. If possible, roles should be limited to specific physical work stations, e.g. logging in in the operator role should be only possible at work stations in the control room (operational security), logging in as an engineer should be only possible at desigbated engineering work stations in secured areas (cyber security). Need for audit trail, Need to track who has access as roles change The I&C system should automatically log all activities, e.g. operator actions on the workplace in the �event� list / protocol (in German: St�r- und Schaltprotokoll), configuration activities of maintenance personell should be logged in a maintenance protokol (if the system does not have such a capability a �log book� should be maintained on a specific node of the respective I&C system)

10. Implementation cont. (3c) Handling control rooms that are �easier� to change? � (MF) Organize the data workflow, traceability to analysis, paper trail for an audit A clear defined procedure (possibly computer supported but not in the I&C-system) must be established for all modifications on the system (base, application, mimics, setpoints other than operational setpoints (e.g. tuning constants) which influence the Rules for changes on control room (resp. I&C-systems) systems Only the assigned roles are to be allowed to do the modifications assigned to a role. Acces to the system must be in a secure way. In multitrain (redundant) safety systems access for chanching or downloading data must only be possible to one train at a time to avoid CCF. Access to a next train shall only be released if the previous accessed channel is back in nomal operational mode. Who owns the data The organizational unit which is responsible for the correctness and integrity of the data, e.g. engineering for engineering and configuration data, operation for process data incl. historical data etc.