Verification and Validation of ITER Interlock System Fast Architecture According to IEC 61508 Standard

The ITER interlock control system (ICS) requires the application of the IEC 61508 standard for all mission-critical (known as investment protection) control functions. Such functions must detect the events of the integrated physical processes and distribute them to the actuators with hard real-time constraints on the order of milliseconds or even microseconds. Systems able to achieve these timing requirements are often bespoke field-programmable gate array (FPGA)-based solutions, which are a well-known challenge to IEC 61508 processes. However, to minimize the variety of components and simplify the procurement process for an international supplier base, ITER decided to standardize the use of commercial off-the-shelf (COTS) devices. The COTS selected for the ICS was the FPGA-based CompactRIO National Instruments (NI) 9159 chassis (and several adapter I/O modules), provided by NI. This COTS requires the use of a high-level language (LabVIEW-FPGA) and the associated integrated development tools to develop the FPGA functionality. Therefore, it is necessary to ensure the required assurance that a COTS device is of sufficient quality, fit for purpose, and can be properly integrated into an investment protection control loop with the necessary level of systematic capability during the development process. This article describes in detail the method ITER uses to perform the verification and validation according to the IEC 61508 standard recommendations, for the logic configuration generated by LabVIEW-FPGA for these COTS, after the compilation of high-level language sources designed during the development.