Diversity and Multi-Version Systems - Nuclear Power Plant Instrumentation and Control Systems for Safety and Security - page 204

• Using diversity for solving complex tasks
(Levels of complexity II and III), gain
turns to be larger than for simple ones
(more than 90%).

P dr2 : 1 - Q dr2 , where Q dr2 - a probability of fail-
ure caused by relative design faults of the
second version.
P dа : 1 - Q da , where Q da - a probability of failure
caused by absolute design faults (common
faults of the versions).

Probabilistic Assessment
of MVS Safety

Reliability of Diverse System is calculated by
the formula: Reliability models of MVS: Probabilistic assess-

ment is considered in terms of Two-channel
Reactor Trip System with three parallel tracks
(sub-channels) of a voting logic “2-out-of-3” in
each independent channel. A real system produced
by RPC Radiy was taken as a basis (Kharchenko
V., et al, 2008). Each of the channels of the system
independently receives inputs and form outputs.
A simplified diagram of components of this
system is shown in Figure 19, where T i.j is a track
j in channel i . A reliability block diagram of Two-
channel System that does not use diversity (channel
diversity) is shown in Figure 20, a. This diagram
does not take into account element of voting logic
“1-out-of-2” (element OR in the simplest case).
The reliability index P phi.j determines HW
reliability of the track Ti.j (defined, first of all, by
physical failures). The reliability index P d deter-
mines reliability defined by design faults, which
may be the main source of CCF. Majority elements
have reliability index P M . Reliability of the One-
version Majority Redundant System is repre-
sented by the following formula:

2

( )

P = − − P

2

− P P P

3

P (9) 1 1 3 2

D ph ph dr M da

2

We consider that P dr1 = P dr2 = P dr and majority
elements are equally reliable.
Diversity is usually applied in such a configura-
tion, where different channels are independently
implemented with different types of diversity.
However, this is not the only variant of the re-
dundant circuit. A variant of using redundancy
in tracks of one channel is shown in Figure 21.
Reliability block diagrams for the system,
represented in Figure 21, are shown in Figure 22.
Reliability of such system that uses one version
for redundancy (Figure 5, a) can be described by
the formula:

Figure 19. Simplified structure of two-channel
three-track system

2

( )

P = − − P

2

− P P

3

P (8) 1 1 3 2

D ph ph M d

1

If channels are implemented in different HW
and SW versions, value of P d will consist of three
components (see Figure 20, b):

P dr1 : 1 - Q dr1 , where Q dr1 - a probability of failure
caused by relative design faults of the first
version.