Diversity and Multi-Version Systems - Nuclear Power Plant Instrumentation and Control Systems for Safety and Security - page 192

weighted, when weights of versions ω(v ij ) are
additionally defined on majorization; (e) the
functional, when Z i S =f[z i (v ij )], where f - some
function of transforming output signals of every
version.
The model (6.2) describes system with n ver-

MVSs with temporal redundancy and р itera-
tions of algorithms are indicated as W(n,m,n,р) a
dividing number of parallel (structural) versions
n c , and sequential versions realized by using one
channel. Set Х may be decomposed for different
versions if:

a

∑ 1

sions that, n = n i . This model does not take

x = x ∪ , ∀ j j ∈ 1, n, j ≠

φ

j :

j 1 2 1 2

i =

j

into account the possibility of applying several
diversity types. A set of version redundancy kinds
R={r d , d=1,..., m} may be decomposed on subsets
for versions of products v prd (t j ) and processes
v prc (t j ): R=(

X ∩ X , X ∩ X = .

j1 j2 j1 j2

Such MVSs are called multi-version systems
with a naturally divided input alphabet:

∪ ∪

R prdj ) ∪ ( ∆ ∆ R prcj ), where ΔR prdj

j j

{ } and ΔR prcj - appropriate subsets.

Thus, different diversity types, r∈R, are ac-
cumulated in final versions of a multi-version
system. It is described by a special mapping Θ:
R → V. The mapping Θ may be presented by a
Boolean matrix ||θd j ||, d = 1, m; j = 1, n , where
θ dj =1, if diversity type r p is used in version v j ,
and if not θ dj = 0. Then a multi-version system W
(n,m) or a multi-diversion system is described by
the formula:

W = { , Y, Z, , V, Φ Ψ , R, Θ C , , Q . } (6)

NX j

If versions process data presented in different
notations, such MVSs are called multi-version
systems with an artificially divided input alphabet
WAХ. A special function-transformer Пх (Пхj)
should be specified in addition to alphabet Х:

{

}

W = X, { x j , Y,Z, , V, , R, , ,Q . }

Φ Ψ Θ C

NX

(7)

( )

W n,m = X, Y, Z, , V, { Φ Ψ , R,Q = }

(4)

Besides, I&Cs performing safety-critical
functions may be represented by a composition
of two interconnected subsystems - a monitoring
(checking) subsystem and a control subsystem
(monitoring and control automata). Monitoring
automaton ϑ C analyses output signals X from a
monitoring and control object (MCO) and forms
its status code Z C .
Control automaton ϑ U forms control signals Z
in accordance with signals Z C . Several options of
MVS architectures are possible for a FPGA-based
I&Cs. Those options may be classified according
to such attributes (see Figure 5):

( ) ( )

{ W n , R, Θ } = W 1 , V, { Ψ , R, Θ } .

It is important to describe a correspondence
between a set of versions V and a set of redundant
channels С={c q , q=1,..., l }. This correspondence
may be defined by a mapping Q:V→ C. This
mapping is presented by a Boolean matrix Q =
||ω jg ||, d = 1, m , g = 1, l , where ω gj = 1, if ver-
sion v i is realized by a channel c j , and if not ω gj =
0. Then a model of multi-version (multi-diversion)
system is the following:

( )

W n,m, l = { X, Y,Z, Φ , V, Ψ , R, Θ ,C,Q } =

• Degree of a diversity coverage (I&Cs with
a full ϑF and partial ϑP diversity).

{ }

( )

W n,m ,C,Q .

(5)