Multifragmentation Markov Modeling of a Reactor Trip System

Markov models (MM) are widely used in dependability assessment of complex safety-critical systems. The main computational difficulties while using MM are model size and stiffness. Selection of the solution approach (SA) and tool based on analysis of MM stiffness and complexity increases the assessment accuracy. This paper presents the safety assessment of NPP I&Cs: a two-channel FPGA-based Reactor Trip System with three parallel tracks on “2-out-of-3” logic. MM was build using multi-fragmentation approach and solved with several SAs and tools. The results analysis shows few application problems: importance of usability-oriented tool selection; achieving an accurate result; support the results verification. Journal of Nuclear Engineering and Radiation Science NERS-14-1037 Valentina Butenko 2 INTRODUCTION Dependability assessment of complex computer systems is an essential part of the development process as it either allows for demonstrating that relevant regulations have been met (e.g. as in safety critical applications) and/or for making informed decisions about the risks due to automation (e.g. in applications when poor dependability may lead to huge financial losses). Achieving these goals, however, requires an accurate assessment. Assessment errors may lead to wrong or suboptimal decisions. Dependability and safety of such complex systems as NPP I&Cs can be assessed through model-based evaluation [1]. Such model-based evaluation can be performed through discrete-event simulation (DES), analytic models or combining simulation and analytical approaches. The main advantage of DES is ability to consider detailed system behavior in the model, while the drawback is long execution time, when accurate solution is needed. Analytical models tend to be more abstract, but are easier to develop and faster to solve than a DES models. The main difficulty is a necessity to set additional assumptions to make the models tractable [1]. Analytical modeling techniques can be split into two groups: state space (Markov chains, Petri nets, etc.) and non-state space (RBD, FTA, etc.) techniques. Selection of the appropriate technique is provided based on measurements of interest, level of components detalization, etc. The state space models are always preferred to non-space model, because they can easily incorporate realistic system behavior such as imperfect fault coverage, multiple failure modes, hot-swap components [2]. The RTS presented in this paper contains such Journal of Nuclear Engineering and Radiation Science NERS-14-1037 Valentina Butenko 3 hot-swap components thus the non-state space models cannot be used. The MCs are mainly used for description of the processes for system physical components operation, interactions and interdependences. The software part in such models is usually assumed to provide correct functioning, because of the strongly managed by requirements and recommendations of international standards (see standard IEC 60880-2006, IEC 61508 2010) validation and verification (V&V) procedures. There are a lot of verification techniques applied during V&V process based on the documentation analysis, problem review, static analysis of code, testing and other [3]. Adding the aspect of software behavior into the research system MC can help to track its complex hardware-software interconnection. Evaluating the system transient measures, such as availability function, in some cases, can provide more useful information than steady-state measures. Use of MC apparatus for modeling the transient behavior of the complex system can lead to the number of description and computational difficulties. It is highly important to provide the correct verbal system presentation and use realistic assumptions and parameters. In case of modeling the system software components by MC the modeler has to introduce special assumptions [4, 5, 6, 7], which must keep the required abstraction level. One of the main computational difficulties is the size of the models (i.e. their largeness, structural complexity), which leads to problems in its construction, storage and solution. Adding the software component behavior into the Markov model (MM) increases its size rapidly. Because of models size the closed-form solutions of transient Journal of Nuclear Engineering and Radiation Science NERS-14-1037 Valentina Butenko 4 measures become infeasible, in this case, modeler can rely on the numerical methods or imitation modeling. Modeling components interaction enlarge the state space significantly, and results in sparse matrices of DE coefficients. A transient solution methods, which does not preserve sparsity is unacceptable for most large problems [8]. The next complexity in solving large models that effect on numerical solution results is the model stiffness [9]. It is an undesirable property of many practical MCs as it poses difficulties in finding transient solutions. In practice, stiffness in models of complex computer systems is caused by: (a) in case of repairable systems the rates of failure and repair differ by several orders of magnitude [10]; (b) fault-tolerant computer systems (CS) use redundancy. The rates of simultaneous failure of redundant components are typically significantly lower than the rates of the individual components [10]; (c) in models of reliability of modular software the modules’ failure rates are significantly lower than the rates of passing the control from a module to a module [10]. Several techniques were developed to deal efficiently with such MC largeness and stiffness [9, 10, 11] and a variety of tools can be used to find the MC solution [6, 12, 13]. Accurate selection of the solution approach and tool, based on analysis of the MC stiffness and complexity, increases the level of confidence for the assessment results [5]. This paper presents the case study for typical NPP I&C system, the Reactor Trip System (RTS) produced by RPC Radiy. This is a two-channel system with three parallel tracks on voting logic “2-out-of-3” in each channel. The multi-fragmental [7] approach was used to analyze and describe the ways how the software design faults can be Journal of Nuclear Engineering and Radiation Science NERS-14-1037 Valentina Butenko 5 introduced into the system MM. The availability function, which consider the RTS failure and repair processes, was used as the dependability and safety are assessment parameter. The state space models (i.e. MM, etc.) are recommended [14] for evaluation of availability function for systems, which are used in critical domains. Several solution techniques and tools were used to analyze and describe the main difficulties in case of solving the complex, stiff MM, and how they can be avoid. Analysis of case study results using different SPs allows to formulate few application problems: importance of usability-oriented SP selection in case of solving complex MM; achieving an accurate result for stiff MCs; support the results verification to ensure the needed level of confidence. The paper consist of the following sections: Section 1 provides the detailed research system description; Section 2 describe the RTS system MM taking into account only physical component, and both physical and software components; in Section 3 several solution techniques and software packages are used to solve the RTS MM. and verify the achieved results. 1. RESEARCHED SYSTEM DESCRIPTION This section presents the description of a studied NPP I&C system produced by RPC Radiy. This is Reactor Trip System (RTS) with two-channel, three-track architecture, on voting logic “2-out-of-3” for tracks in each channel and “1-out-of-2” between channels. The FPGA-based track is a basic component of observed RTS. Generally, each track can contain up to 7 module types: analogue and digital input modules (AIM, DIM); analogue and digital output modules (AOM, DOM); logic module (LM); optical Journal of Nuclear Engineering and Radiation Science NERS-14-1037 Valentina Butenko 6 communication module (OCM); and analogue input for neutron flux measurement module (AIFM). The modules can be placed in 16 different positions on the track (two reserved positions for LM), using LVDS and fiber optical lines for internal/external communications. Such flexible redundancy management helps to ensure the high availability of the system. Each channel independently receives information from sensors and other NPP systems. The channels, each being capable of forming a reactor trip signal, are independent. Each track, observed in this paper, consists of five modules: LM, DIM, DOM, AIM and AOM. The Figure 1 presents the structure diagram of a typical track. It is assumed that the corresponding components of all the tracks in the channels are identical, i.e. DIM on the 1st track is identical to the same module on other tracks in the channels, etc. The failure of the LM leads to the failure of the whole track, and failures of the DIM, DOM, AIM, AOM result in track malfunction. Therefore, it was assumed that failure of any module implies the general failed state of the track. Fig. 1. The structure diagram of a typical track The RTS reliability-block diagram is presented on Fig. 2. Reliability index Ppfi.j determines hardware reliability of the track Ti.j (defined by physical faults), where i indicates main (T1.j) or diverse (T2.j) channels, and j indicates the number of the track. Reliability index Pdfi determines software reliability of the main or diverse channels (defined by software faults), where i indicates channel. Reliability index Pmaj(i), determines reliability of the majority element maji, where ) 3 , 1 (  i . Fig. 2. Reliability-block diagram of two-channel three-track system Journal of Nuclear Engineering and Radiation Science NERS-14-1037 Valentina Butenko 7 Informally, the system operates as follows. Initially, all components (tracks) are working correctly and deliver the service as expected. If one of the tracks in main channel has failed, by majo