Diversity and Multi-Version Systems - Nuclear Power Plant Instrumentation and Control Systems for Safety and Security - page 201

versity combination based on the costs connected
with each diversity value.
Another approach is to provide a maximum
level of diversity. To achieve this, we need to
choose two feasible combinations from Table 6
having the maximum number of different diversity
values. It is possible to use other criteria or to
combine several such criteria to obtain the best
diversity structure of the system.
Application of the diversity allows a decrease in
the probability of common cause failure. This ap-
proach stipulates the necessity for the development
of a regular procedure for generation and choice
of diversity types and values. A new graphical
model is presented for different variants of the
diversity and can be used during the development
of safety-critical systems and selection of optimal
algorithms for diversity types based on a criterion
of a safety-reliability-cost. The model addresses
diversity types at different levels: complex elec-
tronic components (FPGA, etc.), printed circuit
boards, manufacturers, specification languages,
design and program languages, etc. It takes into
consideration the dependencies among diversity
types. The graphical model is developed using
the subgraph splitting algorithm, which has been
previously used for software test generation. A
path through the graph represents a set of fea-
sible diversity decisions, which are independent
within a given set. All paths describe all and only
feasible combinations of diversity. Based on this
representation, an optimal design decision during
system development can be selected.

• Check-list-based analysis of applicable
diversity types (CLD); initial data for the
CLD analysis are I&C design and docu-
mentation, a table of diversity types (sub-
types) was developed in advance; a result of
the CLD analysis is a formalized structured
information about used diversity types and
subtypes in analyzed I&C system;
• Metric-based assessment of diversity
(MAD); initial data for the MAD proce-
dure are results of the CLD analysis and
values of metrics and weight coeicients
for diversity types (subtypes) used in I&C
systems; a result of the MAD assessment is
a value of general diversity metric;

• RBD and Markovian model-based assess-

ment (RDM); initial data for the RDM pro-
cedure are I&C design and documentation,
results of the CLD and MAD analysis; re-
sults of the RDM procedure are values of
safety and dependability indicators.

General scheme of assessment based on the
proposed approach is shown on Figure 18. Table
of diversity types, values of metrics and weight
coefficients for different options of diversity types
and subtypes are formed according to results
previous analysis and research.
These components may be corrected after as-
sessment of each project.
Assessment of FPGA-based MVS: The main
stages and operations of the diversity analysis and
MVS assessment depend on the type of the evalu-
ated system. The following description takes into
account the peculiarities of FPGA-based systems.
The first stage is a Check-list-based analysis
of MVS design and documentation. This stage
contains two operations:

ASSESSEMENT OF MVS SAFETY

Metric-Probabilistic
Assessment of MVS Safety

1. Analysis of I&C specification and require-
ments to system, definition of system safety
class; requirements to the diversity (neces-
sary for diversity application).

General approach to metric-probabilistic assess-
ment: The proposed approach to assessment of
diversity level and MVS safety is based on the fol-
lowing basic procedures analysis and evaluation: