Commissioning software for nuclear I&C upgrades where a digital replacement for an analogue safety system has to prove functional equivalence, not just that the new screen looks right.

Reactor protection and engineered safety features actuation system upgrades replace analogue relay logic with digital platforms carrying different failure modes, different response time characteristics and new cybersecurity attack surfaces that the original analogue design never had to consider.

When the original analogue setpoints and response times exist only in decades-old test records and the new digital platform's qualification testing happens in a completely separate vendor system, proving functional equivalence becomes a manual reconciliation exercise every time a reviewer asks a question.

Deskely holds the original analogue baseline and the new digital platform's qualification and site acceptance records against the same system tag, so functional equivalence is a documented comparison rather than an assertion in a modification package summary.

Functional equivalence testing exercises each protection channel against the original analogue setpoints and response time requirements, with pass/fail evaluated directly against the historical baseline rather than a fresh interpretation of the safety analysis.

Cybersecurity verification confirms network segmentation, access controls and configuration management controls are in place and tested, captured as its own gate independent of functional testing, because a functionally correct system that fails cybersecurity review cannot proceed to service.

Common-cause failure analysis findings and any diversity and defence-in-depth requirements are tracked against the specific channel or division they apply to, so the modification package's independent review has direct access to the test evidence supporting each claim.

The absence of physical construction on an I&C upgrade tempts a modification team into treating it as a software project with lighter QA than a mechanical scope, but a reactor protection or ESFAS replacement carries exactly the same licence condition compliance obligations as a physical system replacement, including hold points where the licensee or the regulator must witness a specific test before work proceeds to the next stage.

A factory acceptance test hold point on the digital platform, a site acceptance test hold point after installation and a pre-service functional test hold point before the system is declared operational each need independent witness and sign-off, and skipping the distinction between them because 'it's just software' is precisely the kind of shortcut an independent nuclear assurance review is designed to catch.

Deskely applies the same hold point, witness and disposition structure to an I&C modification's factory, site and pre-service test stages as it would to a mechanical system replacement, so the modification's licence condition compliance record looks like what the regulator expects to see, not like a vendor's internal software release notes.