The information and control systems of Nuclear Power Plant and other safety critical systems are considered as a set of three independent hardware channels including online testing system. Nuclear Power Plant information and control systems design on programmable platforms is rigidly tied to the V-model of the life cycle. Functional safety and availability during its life cycle are assessed using Markov and multi-fragmental models. Multifragmental models are used to assess the availability function and proof test period. The multi-fragmental model MICS31 contains an absorbing state in case of hidden faults and allows evaluating risks of “hidden” unavailability. The MICS41 model simulates the “migration” of states with undetected failures into states with detected faults. Results of multi-fragmental modeling (models MICS31 and MICS42) are compared to evaluate proof test period taking into account requirements for SIL3 level and limiting values of hidden fault probabilities.
1 Introduction For different classes of critical systems (medical equipment, banking systems, road, air, railway transport and nuclear power plants) very strict requirements have been developed. These requirements determine both the system characteristics from the group of non-functional requirements (availability, reliability, safety, etc.) and the content of the life cycle phases. During the development cycle, it is possible to change the architecture of the information and control system (ICS) of the Nuclear Power Plant (NPP) project and correct the parameters of its elements. Such actions require justification, which uses special mathematical models to confirm the fulfillment of design requirements.
This paper discusses the class of the information and control systems on
programmable platforms, which are used in the reactor protection system of NPP in
normal operation. This class of information and control system is based on the 2oo3
architecture without versioning with the control system and is described in detail in
[
Studies carried out in [
At first glance, the elimination of software faults may cause a desire to use the information and control system project with the initial high intensity of dangerous SW failures, because faults will be identified and eliminated over the time. But this decision should be justified by the results of the study of the corresponding models of the information and control system with the elimination of faults causing dangerous SW failures.
In this paper, multi-fragmental models of functioning of the information and control system under the conditions of manifestation of dangerous HW and SW failures and elimination of identified SW faults are studied. For each model, graduated and oriented graphs are constructed; using the Matlab functions, systems of Kolmogorov-Chapman differential equations are constructed and solved. As a result, the values of the proof test TAreq period for the SIL3 level and input parameters are obtained, at which the condition TAreq ≥ 3 years for industrial systems is satisfied.
2.1. Model Specification
In this paper we develop six models using Markov process theory as shown in
Table 1. Models MICS01 and MICS02 were studied at the papers [
- when diagnosing a part of dangerous failures, the intensity of detected dangerous
failures is λDD HW = λD HW * DCHW, and the intensity of undetected dangerous failures.
2.2. Multi-Fragmental Model for Evaluating the Functional Safety of the
Information and Control System with the Absorbing States
MICS31 multi-fragmental model is improved in comparison with MICS01 and
contains absorbing states in each fragment. The application of the multi-fragmental
principle [
In the new fragment, the system functions in the same way as described for
MICS01 model [
DSi DSi1 DS
Since design faults remain in the system, after manifestation and detection of the dangerous SW failure, the system restarts to eliminate its consequences of µS intensity, which is modeled by S41 → S25, S42 → S26, S44 → S28, S45 → S29,S47 → S31, S48 → S32, S49 → S33 transitions.
In all fragments of МICS31 model, there are absorbing states: S17 in F0 fragment and S42 in F1 fragment.
The availability function taking into account dangerous failures is defined as (2): A t P0 t P1 t P3 t P25 t P26 t P28 t .
Baseline conditions: t = 0, P0 (0) = 1, P1(0)…P49(0) = 0. (1) (2) 3λhDCh 2λhDCh µh 2λhDCh λs0(1-DCs) S1 2λh(1-DCh) S4 λh(1-DCh) λhDCh
µh λhDCh 2µh
2µh S0 3λh(1-DCh) S3 2λh(1-DCh) S6 λh(1-DCh) S8 µh 3λhDCh S9 µh
2λhDCh λs0(1-DCs)
λhDCh λs0(1-DCs)
µh 3λh(1-DCh) S12 2λh(1-DCh) S15 λh(1-DCh) S17 µh S2 S27 µsr µsr µsr µsr 2.3. Multi-Fragmental Model for Evaluating the Functional Safety of the Information and Control System with the Migration of Failures In MICS41 multi-fragmental model, the assumption of the “migration” of hidden failures into decisive ones, described earlier for MICS02 model, was adopted. There are no absorbing states on the graduated graph of the model (Fig. 2). Transitions from the undetected dangerous failure state are simulated without additional measures (proof test). This model also deals with the elimination of the decisive DC SW after its manifestation. This is modeled as in MICS31 model by S18 → S25, S19 → S26, S20 → S28, S21 → S29, S22 → S31, S23 → S32, S24 → S33 transitions with µSR 3λhDCh 2λhDCh 3λhDCh 2λhDCh µh S0 S1 S2 µh S25 S26 S27 intensity. In the last F1 fragment, system performed by restarting with µs intensity
recovery after the dangerous SW without its elimination. Fig. 2. МICS41 The number and nature of the states of the MICS41 model graph are identical to the previous MICS31 model. In addition to the МICS31 model, transitions have been added that simulate the migration of hidden HW failures: S3→S1, S4→S2, S6→S4, S7→S5, S8→S7, S12→S10, S13→S11, S15→S13, S16→S14, S17→S6; transitions that simulate the migration of hidden SW failures: S9→S18, S10→S19, S12→S20, S13→S21, S15→S22, S16→S23, S17→S24 (for initial fragme nt F0). For F1 fragment migration of hidden HW failures is presented in transitions S28→S26, S29→S27, S31→S29, S32→S30, S33→S32, S37→S35, S38→S36, S40→S38,
The calculation of the availability indicators is performed for the input data from
Table 2. To construct the matrix of the Kolmogorov-Chapman system of differential
equations, we use the matrix A function [
The availability function of MICS41 model is approaching to the stationary value of 0.9901, at that it goes into the established mode on 106 hours later than the result of the single-fragment MICS02 model. The decrease in the level of availability below 0.999 occurs after 14666 hours or 1.67 years. This value is worse than in MICS02 model and does not meet the standard for industrial systems in 3 years or 26298 hours.
For MICS31 and MICS41 models, the additional studies were conducted to determine the values of the input parameters at which TAreq ≥ 26298 hours. The intervals for changing the input parameters are the same as for MICS01 model and are shown in Table 3. Cyclic scripts for Matlab were built to calculate the models. The results of the research are shown as graphical dependences in Fig. 4 – Fig. 6.
a) b) The results of the influence of values of the input λD H parameter on the behavior of the availability function of MICS31 model are shown in Fig.4 (a). With the decrease in the intensity of dangerous failures of HW, the reduction in availability to zero slows down. But taking into account the scale on the horizontal axis (108 hours), this result is not applicable in practice.
The results of the influence of values of the input λ D H parameter on the established value of the function of MICS02 model are shown in Fig. 4 (b). With the decrease in the intensity of dangerous HW failures, Aconst increases insignificantly (6 decimal places), which cannot be used for practical application. The result presented in Fig. 4(b) is also practically not interesting since a change of λD H by two orders of magnitude does not allow assuring TAreq ≥ 26298 hours’ condition. The value of the input DC H parameter of MICS31 model affects the speed of the transition of the availability function to the established value: with the increase in DCH from 0.99 to 0.999, the descent of availability to zero slows down by 4 * 107 hours. The value of the input DCH parameter of MICS41 model practically does not affect the speed of the transition of the availability function to the established value. On the other hand, the change in DCH from 0 to 1 also causes a change in Aconst within [0...0.9902]. The result presented in Fig.5 (b) is also important for practice, since after modeling it becomes obvious that the increase in DCH to 1 does not allow to ensure TAreq ≥ 26298 hours’ condition (as in MICS31 model).
a) b) Fig. 6. Charts of availability function of MICS31 model (а), interval determination TAreq MICS41 model (b) for different values of the input parameter DCs The results of the influence of values of the input DCS parameter on the behavior of the availability function of MICS31 model are shown in Fig.6 (a). With the increase in the test coverage of dangerous SW failures by the order of magnitude (from DCS = 0.99 to DCS = 0.999, etc.), the availability function goes to zero level several times slower (from 5 * 107 to 6 * 107 hours). The following result is important for practice: starting from DCS = 0.9947 value, TAreq ≥ 26298 hours’ condition is provided.
The results of the influence of values of the input DCS parameter on the behavior of the availability function of the model are shown in Fig.6 (b). The dependence of Aconst on DCS for MICS41 model is linear and is not shown in the graph. With DCS = 1 → Aconst = 0.9999924. The value satisfying the requirements of SIL3 (Aconst = 0.99909) is achieved at DCS = 0.9991. Theoretically, this allows us to talk about systems without a proof test, but from the practical point of view, it is very difficult and costly to achieve such level of control completeness.
The results are shown in Fig.6 (b) illustrate the maintenance of TAreq ≥ 3 years’ condition starting from DCS = 0.9942 value. And what is more interesting, in Fig. 6(b) it is shown that in DCS = [0.998 ... 0.9991] interval the multi-fragmental MICS41 model over the proof test period significantly benefits the single-fragmental MICS02 model. 5
In the article, the multi-fragmental model architecture for information and control systems of NPP 2оо3 is presented with occurred HW and SW faults and eliminating of hidden faults.
Analysis of the obtained results of modeling the availability of the information and control systems of NPP architecture with partially eliminating of design faults has shown that:
a) for the multi-fragmental MICS31 model with absorbing the decrease in the availability function to zero is significant. For typical values of input parameters (Table 2), the fulfillment of SIL3 requirements is guaranteed in [0 ... 1.6 years] interval. The increase in the interest Tproof test interval of up to 3 years is possible with the increase in the control completeness to detect dangerous SW failures to DCS = 0.9947 level and higher;
b) the multi-fragmental MICS41 model is characterized by the decrease in the availability function to the stationary Aconst value. For typical values of input parameters (Table 2), the fulfillment of SIL3 requirements is guaranteed in [0 ... 1.67 years] interval. The increase in the interest Tproof test interval of up to 3 years is possible with the increase in the control completeness to detect dangerous SW failures to DCS = 0.9942 level. Starting from DCS = 0.9991, SIL3 requirements are guaranteed to be fulfilled without additional proof tests.
The developed mathematical models make it possible to assess the fulfillment of the requirements for the functional safety of the designed information and control system. Application of the developed models is advisable in specific time counts tied to the phases of the V-model of the project life cycle (and possibly to the separate layer of the V-model).
The future step includes: it is necessary to put in order and regulate the operations of choosing one of several models for the specific design phase, tight time reference to the beginning/end of the life cycle phase, substantiation of assumptions, changes in the structure and parameters of models in one method.