Safety-critical Digital Systems Research Articles

Development of state-based integrated dependability model of RPS in NPPs considering CCF and periodic testing effects at the early design phase

In the design process of safety critical digital systems, the quantitative analysis of their dependability is essential step to enhance the safety of nuclear power plants. Earlier this analysis can be performed, higher safety can be achieved in a more cost effective manner. In this paper, we present an integrated dependability evaluation model of the reactor protection system in nuclear power plants based on the Markov model. The complex interrelationship among dependability parameters such as architecture, channel-level failure, repair, common cause failure and periodic surveillance test are modeled systematically, which cannot be achieved by using conventional static methods. To prevent the integrated dependability model of reactor protection system from exploding the state, we treat each channel as the hyper component of which failure rate is the channel-level failure rate studied in the previous work. Using this concept, we simplify the model by incorporating various dependability parameters into the model. Using the model, quantitative results for reliability, availability, safety and spurious trip probability of reactor protection system are presented depending on various channel configurations. From the results, we can obtain insight into which parameters have the greatest effect on dependability and guideline for how to optimize parameters to satisfy the system requirements at the early design phase.

Exhaustive test cases for the software reliability of safety-critical digital systems in nuclear power plants

Digital instrumentation and control (I&C) systems have several specific characteristics as compared with analog I&C systems. Although one critical feature of digital I&C systems is software, even after several years of research the quantification of software reliability remains an unresolved issue. This paper suggests a method to obtain an exhaustive set of test cases for safety-critical software. Without such a method, considering all combinations from the full range of software variables results in the number of test cases becoming so tremendous as to render testing physically impossible. In order to obtain a realistic number of test cases that still satisfies the “exhaustive” concept, the range of variables should be reasonably considered. In the developed method, all variables are first divided into plant variables and software internal variables. Input-profiles for the plant variables are obtained from the results of best-estimate thermal-hydraulics code, and for the internal variables, a gray-box analysis is conducted to identify the relationship between all internal variables. As an application to demonstrate the feasibility of this method, plant variables from the OPR-1000 were utilized to develop the input-profiles, and the internal variables of the bistable processors in the IDiPS-RPS were taken for a gray-box analysis. As a result, the novel method developed in this research yields an exhaustive yet realistic set of test cases for safety-critical digital software.

Fuzzy based ranking of software reliability measures

This research paper summarizes the results of an implementation of fuzzy multilevel methodology to rank software reliability measures. Of late, computer based systems are used largely for monitoring, protecting and to control safety critical systems like nuclear power plants, Aircraft etc. Reliability is an important factor for assessing the performance of such safety critical digital systems. The characteristics of such digital safety critical systems are explicitly or implicitly reflected by software engineering measures. Therefore, with the help of such measures, models can be built to predict the reliability of software applications that run on safety critical systems. It is not necessary that every software engineering measures contribute to predict the reliability, hence they need to be ranked based on their influence on reliability. Since sufficient practical data is not available in literature, expert opinion on the selected software engineering measures contributing to reliability based on criterion has been sought. These expert ratings are aggregated and ranked using Chen’s fuzzy logic based ranking method. As the data involved with this kind of problems are inherently imprecise and inexact, application of fuzzy set theory is very suitable for such situations. The top-ranked software engineering measures can be later used to develop a model to predict reliability of safety critical digital systems.

Plant Risk Effect Analysis Focusing on Digital I&C Equipment Failures

Safety-critical digital systems have been installed in nuclear power plants and thus their safety effect evaluation has become an emerging issue. The multi-tasking feature of digital instrumentation and control (I&C) equipment could increase the risk factor because the I&C equipment affects the actuation of the safety functions in several mechanisms. In this study, we quantify the safety of the digital plant protection system in Korean nuclear power plants based on probabilistic safety assessment (PSA) technology. Fifteen fault-tree models for the digital reactor-trip system and seven for the safety-feature actuation system are constructed and integrated into the plant safety assessment model. The result of the sensitivity study shows the boundaries of a plant risk and the effect of the digital equipment failures on the total plant risk.

Plant Risk Effect Analysis Focusing on Digital I&C Equipment Failures

Safety-critical digital systems have been installed in nuclear power plants and thus their safety effect evaluation has become an emerging issue. The multi-tasking feature of digital instrumentation and control (I&C) equipment could increase the risk factor because the I&C equipment affects the actuation of the safety functions in several mechanisms. In this study, we quantify the safety of the digital plant protection system in Korean nuclear power plants based on probabilistic safety assessment (PSA) technology. Fifteen fault-tree models for the digital reactor-trip system and seven for the safety-feature actuation system are constructed and integrated into the plant safety assessment model. The result of the sensitivity study shows the boundaries of a plant risk and the effect of the digital equipment failures on the total plant risk.

A method for evaluating fault coverage using simulated fault injection for digitalized systems in nuclear power plants

The fault coverage for digital system in nuclear power plants is evaluated using a simulated fault injection method. Digital systems have numerous advantages, such as hardware elements share and hardware replication of the needed number of independent channels. However, the application of digital systems to safety-critical systems in nuclear power plants has been limited due to reliability concerns. In the reliability issues, fault coverage is one of the most important factors. In this study, we propose an evaluation method of the fault coverage for safety-critical digital systems in nuclear power plants. The system under assessment is a local coincidence logic processor for a digital plant protection system at Ulchin nuclear power plant units 5 and 6. The assessed system is simplified and then a simulated fault injection method is applied to evaluate the fault coverage of two fault detection mechanisms. From the simulated fault injection experiment, the fault detection coverage of the watchdog timer is 44.2% and that of the read only memory (ROM) checksum is 50.5%. Our experiments show that the fault coverage of a safety-critical digital system is effectively quantified using the simulated fault injection method.

An analysis of safety-critical digital systems for risk-informed design

This paper quantitatively presents the results of a case study which examines the fault tree analysis framework of the safety of digital systems. The case study is performed for the digital reactor protection system of nuclear power plants. The broader usage of digital equipment in nuclear power plants gives rise to the need for assessing safety and reliability because it plays an important role in proving the safety of a designed system in the nuclear industry. We quantitatively explain the relationship between the important characteristics of digital systems and the PSA result using mathematical expressions. We also demonstrate the effect of critical factors on the system safety by sensitivity study and the result which is quantified using the fault tree method shows that some factors remarkably affect the system safety. They are the common cause failure, the coverage of fault tolerant mechanisms and software failure probability.

Applying formal verification to the AAMP5 microprocessor: A case study in the industrial use of formal methods

Formal specification combined with mechanical verification is a promising approach for achieving the extremely high levels of assurance required of safety-critical digital systems. However, many questions remain regarding their use in practice: Can these techniques scale up to industrial systems, where are they likely to be useful, and how should industry go about incorporating them into practice? This paper discusses a project undertaken to answer some of these questions, the formal verification of the microcode in the AAMP5 microprocessor. This project consisted of formally specifying in the PVS language a Rockwell proprietary microprocessor at both the instruction-set and register-transfer levels and using the PVS theorem prover to show the microcode correctly implemented the instruction-level specification for a representative subset of instructions. Notable aspects of this project include the use of a formal specification language by practicing hardware and software engineers, the integration of traditional inspections with formal specifications, and the use of a mechanical theorem prover to verify a portion of a commercial, pipelined microprocessor that was not explicitly designed for formal verification.