Search NASA⌕ Search

SEARCH · Search NASA

Results for “Software Common Cause Failure”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2022

An Application of a Modified Beta Factor Method for the Analysis of Software Common Cause Failures

This paper presents an approach for modeling software common cause failures (CCFs) within digital instrumentation and control (I&C) systems. CCFs consist of a concurrent failure between two or more components due to a shared failure cause and coupling mechanism. This work emphasizes the importance of identifying software-centric attributes related to the coupling mechanisms necessary for simultaneous failures of redundant software components. The groups of components that share coupling mechanisms are called common cause component groups (CCCGs). Most CCF models rely on operational data as the basis for establishing CCCG parameters and predicting CCFs. This work is motivated by two primary concerns: (1) a lack of operational and CCF data for estimating software CCF model parameters; and (2) the need to model single components as part of multiple CCCGs simultaneously. A hybrid approach was developed to account for these concerns by leveraging existing techniques: a modified beta factor model allows single components to be placed within multiple CCCGs, while a second technique provides software-specific model parameters for each CCCG. This hybrid approach provides a means to overcome the limitations of conventional methods while offering support for design decisions under the limited data scenario.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2023

Analyzing Hardware and Software Common Cause Failures in Digital Instrumentation and Control Systems using Dual Error Propagation Method

This paper develops a methodology for quantifying software common cause failures (CCFs) in digital instrumentation and control (I&C) systems of nuclear power plants. To support the transition of analog I&C systems to digital in nuclear power plants, probabilistic risk assessment (PRA) techniques are used. The hardware components of the I&C systems have reliability databases that can be used in the PRA studies. However, the failure data for redundant software components of the systems is sparse. Failure of components constitutes a CCF, wherein two or more components or systems fail due to a single shared cause and coupling mechanism. This paper proposes a quantification approach that can simultaneously model hardware and software components, incorporate the CCFs of software systems in the models, and bridge the gap between the failure quantification of models and the development of CCF parametric databases. We demonstrate the dual error propagation method (DEPM) by developing I&C systems failure models for a representative digital reactor trip system. The DEPM models are built to simulate the control and data flows within the systems and can accommodate failure states. By expanding DEPM to software CCFs, we generated alpha factor parameter estimates for each of the modeled error propagation mechanisms.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2017

NRC technical basis for evaluation of its position on protection against common cause failure in digital systems used in nuclear power plants - 378

Digital technology has advantages over analog systems, including automated monitoring and alerts for standby safety functions, and predictive algorithms to maintain critical safety systems. Additionally, digital technology generally has higher reliability and can be designed to reduce single point vulnerabilities. For these reasons many nuclear plants have applied digital technology to safety and non-safety related applications, including reactor protection system, feedwater and turbine controls, etc. with a corresponding significant improvement in trip reduction. Nonetheless, digital instrumentation and control (I and C) systems also present potential new vulnerabilities that need to be assessed, including potential failures due to increased complexity of digital systems, the introduction of unique failure modes due to software (including software common cause failure (CCF)), and limited operating history of digital systems in nuclear safety related applications compared to analog systems. The fact that software is intangible means that common methods, such as analysis or testing, used for detecting CCF may not be effective when applied to software. Consequently, digital technology is perceived to pose a potential risk from the introduction of undetected systematic faults that could result in CCF. Despite the I and C system upgrades and modifications performed to date, the U.S. Nuclear Regulatory Commission (NRC) and industry stakeholders have identified the need to modernize the regulatory infrastructure to efficiently address risks associated with the use of digital technology for nuclear safety applications and address regulatory uncertainties. The NRC's current position on CCF is guided by the staff requirements memorandum (SRM) on SECY 93-087. The SRM provides specific acceptance criteria for the evaluation of CCF, which the staff implemented in the Branch Technical Position (BTP) 7-19. However, industry stakeholders have proposed using methods to characterize the likelihood of software CCF and eliminate it from further consideration in a defense-in-depth and diversity analysis. The NRC's current position does not consider these alternatives, and thus corresponding acceptance criteria is not currently available. The work discussed in this paper assesses the underlying technical basis associated with CCF, provides technical support for updating the NRC position and considers proposed methods for addressing potential CCF in digital systems while enhancing efficiency, clarity, and confidence. (authors)

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2014

Digital Actuator Technology

There are significant developments underway in new types of actuators for power plant active components. Many of these make use of digital technology to provide a wide array of benefits in performance of the actuators and in reduced burden to maintain them. These new product offerings have gained considerable acceptance in use in process plants. In addition, they have been used in conventional power generation very successfully. This technology has been proven to deliver the benefits promised and substantiate the claims of improved performance. The nuclear industry has been reluctant to incorporate digital actuator technology into nuclear plant designs due to concerns due to a number of concerns. These could be summarized as cost, regulatory uncertainty, and a certain comfort factor with legacy analog technology. The replacement opportunity for these types of components represents a decision point for whether to invest in more modern technology that would provide superior operational and maintenance benefits. Yet, the application of digital technology has been problematic for the nuclear industry, due to qualification and regulatory issues. With some notable exceptions, the result has been a continuing reluctance to undertake the risks and uncertainties of implementing digital actuator technology when replacement opportunities present themselves. Rather, utilities would typically prefer to accept the performance limitations of the legacy analog actuator technologies to avoid impacts to project costs and schedules. The purpose of this report is to demonstrate that the benefits of digital actuator technology can be significant in terms of plant performance and that it is worthwhile to address the barriers currently holding back the widespread development and use of this technology. It addresses two important objectives in pursuit of the beneficial use of digital actuator technology for nuclear power plants: 1. To demonstrate the benefits of digital actuator technology over legacy analog sensor technology in both quantitative and qualitative ways. 2. To recognize and address the added difficulty of digital technology qualification, especially in regard to software common cause failure (SCCF), that is introduced by the use of digital actuator technology.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
NASA NTRSDate not supplied

Historical Aerospace Software Errors Categorized to Influence Fault Tolerance

- Motivation - Very little literature exists characterizing software errors in real-time avionic systems - How, where, and why is software most likely to fail? - Purpose - Raise awareness of how software fails through historical study - Recommend improvements to software fault tolerant design based on historical study - Outline - Discuss Software Failures - Common Cause, Failure Classes, Mitigation strategies - Review NASA requirements for Software Fault Tolerance - Review Historical Software Failures - Analyze failures and provide statistics - Erroneous vs. fail-Silent - Reboot recoverability likelihood - Code Location - Missing or unknown code?

Flilght↗
DOE OSTI2017

Introduction of Diverse Manual Actuation Design for APR1400

APR1400 is an Advanced Light Water Reactor (ALWR) design with enhanced plant safety and advanced design features. One unit is in commercial operation and 11 are currently under construction, 4 abroad and 7 in Korea. APR1400 adopts full digitalized Man-Machine Interface System (MMIS) to perform the function of control, indication and alarming for safety and non-safety systems APR1400 MMIS is designed to operate the plant from the Main Control Room (MCR) under all anticipated operating conditions including design basis accidents. This advanced MMIS is designed to meet the latest codes, standards and regulatory requirements including the defense-in-depth and diversity requirements, which is intended to mitigate the consequence of a total failure of the digital safety system caused by a software Common Cause Failure (CCF) coupled with anyone of the Design Basis Events. The redundancy of the safety system could be defeated during this CCF condition and the protective function could be rendered inoperable.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2017

Diversity and defense-in-depth analysis for I and C systems of research reactors: A case study on two research reactors - 376

This paper provides the analysis results of the diversity and defense-in-depth (D3) applied to two research reactors designed by the Korea Atomic Energy Research Institute. The D3 assessments for instrumentation and control (I and C) systems of two research reactors are performed according to the guidelines documented in NUREG/CR-6303. The I and C systems are classified into four echelons of defense: control echelon, reactor trip echelon, engineered safety feature (ESF) actuation echelon, and monitoring and indication echelon. The diversity between the echelons of defense is assessed to determine that a single software common cause failure (CCF) does not impair the functions of multiple echelons of defense. In addition, the effects of a software CCF of the reactor protection system on the design basis events of the research reactors are analyzed by assuming that the automated reactor trip and ESF actuation functions of the reactor protection system are inoperable due to the software CCF. From the D3 analyses for the research reactors, it is verified that (1) adequate diversity has been provided, (2) adequate defense-in-depth has been provided, and (3) the displays and manual controls for critical safety functions initiated by operator action are diverse from digital systems used in the automatic portion of the protection system. (authors)

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2025

Bayesian And Human Reliability Analysis (hra)-aided Method For The Reliability Analysis Of Software (bahamas)

The purpose of the BAHAMAS code is to provide a simplified process for performing quantitative evaluations of software reliability. The Bayesian and Human Reliability Analysis (HRA)-Aided method for the Reliability Analysis of software (BAHAMAS) was developed specifically to perform quantification under limited data conditions, i.e., when limited testing or operational data are available, such as during early development stages. BAHAMAS essentially examines the quality of a software development life cycle to determine the probability of specific types of software failure. BAHAMAS will have modules to support user input for detailed and simplified analyses. The user interface will also support software common cause failure analysis.

Wang, Congjian (0000000207789927)↗
DOE OSTI2022

An Integrated Risk Assessment Process of Safety-Related Digital I&C Systems in Nuclear Power Plants

Upgrading the existing analog instrumentation and control (I&C) systems to state-of-the-art digital I&C (DI&C) systems will greatly benefit existing light water reactors. However, the issue of software common cause failure (CCF) remains an obstacle in terms of qualification for digital technologies. Existing analyses of CCFs in I&C systems mainly focus on hardware failures. With the application and upgrading of new DI&C systems, design flaws could cause software CCFs to become a potential threat to plant safety, considering that most redundancy designs use similar digital platforms or software in their operating and application systems. With complex multilayer redundancy designs to meet the single failure criterion, these I&C safety systems are of particular concern in U.S. Nuclear Regulatory Commission licensing procedures. In Fiscal Year 2019, the Risk-Informed Systems Analysis (RISA) Pathway of the U.S. Department of Energy’s Light Water Reactor Sustainability Program initiated a project to develop a risk assessment strategy for delivering a strong technical basis to support effective, licensable, and secure DI&C technologies for digital upgrades and designs. An integrated risk assessment for the DI&C process was proposed for this strategy to identify potential key digital-induced failures, implement reliability analyses of related digital safety I&C systems, and evaluate the unanalyzed sequences introduced by these failures (particularly software CCFs) at the plant level. Here this paper summarizes these RISA efforts in the risk analysis of safety-related DI&C systems at Idaho National Laboratory.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2021

INTEGRATED RISK ASSESSMENT OF DIGITAL I&C SAFETY SYSTEMS FOR NUCLEAR POWER PLANTS

Upgrading the existing analog instrumentation and control (I&C) systems to state-of-the-art digital I&C (DI&C) systems provides the foremost means to improve performance and reduce costs for existing light-water reactors (LWRs). However, qualification of digital technologies remains a challenge?especially the issue of software common cause failure (CCF), which has been difficult to address. Existing analyses of CCFs in I&C systems mainly focus on hardware failures. With the application and upgrading of new DI&C systems, software CCFs due to design flaws might become a potential threat to plant safety, considering that most redundancy designs use similar digital platforms or software in their operating and application systems. With complex multi-layer redundancy designs to meet the single failure criterion, these I&C safety systems are of particular concern in U.S. Nuclear Regulatory Commission (NRC) licensing procedures. In 2019, the Risk-Informed Systems Analysis (RISA) Pathway of the U.S. Department of Energy?s (DOE?s) Light Water Reactor Sustainability (LWRS) Program initiated a project to develop a risk assessment strategy for delivering a strong technical basis to support effective, licensable, secure DI&C technologies for digital upgrades/designs. An integrated risk assessment for the DI&C (RADIC) process was proposed for this strategy to identify potential key digital-induced failures, implement reliability analyses of related digital safety I&C systems, and evaluate the unanalyzed sequences introduced by these failures (particularly software CCFs) at the plant level. This paper summarizes these RISA efforts in the risk analysis of safety-related DI& systems at Idaho National Laboratory.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2015

Digital Sensor Technology

The nuclear industry has been slow to incorporate digital sensor technology into nuclear plant designs due to concerns with digital qualification issues. However, the benefits of digital sensor technology for nuclear plant instrumentation are substantial in terms of accuracy and reliability. This paper, which refers to a final report issued in 2013, demonstrates these benefits in direct comparisons of digital and analog sensor applications. Improved accuracy results from the superior operating characteristics of digital sensors. These include improvements in sensor accuracy and drift and other related parameters which reduce total loop uncertainty and thereby increase safety and operating margins. An example instrument loop uncertainty calculation for a pressure sensor application is presented to illustrate these improvements. This is a side-by-side comparison of the instrument loop uncertainty for both an analog and a digital sensor in the same pressure measurement application. Similarly, improved sensor reliability is illustrated with a sample calculation for determining the probability of failure on demand, an industry standard reliability measure. This looks at equivalent analog and digital temperature sensors to draw the comparison. The results confirm substantial reliability improvement with the digital sensor, due in large part to ability to continuously monitor the health of a digital sensor such that problems can be immediately identified and corrected. This greatly reduces the likelihood of a latent failure condition of the sensor at the time of a design basis event. Notwithstanding the benefits of digital sensors, there are certain qualification issues that are inherent with digital technology and these are described in the report. One major qualification impediment for digital sensor implementation is software common cause failure (SCCF).

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
DOE OSTI2019

An Integrated Risk Assessment Process for Digital Instrumentation and Control Upgrades of Nuclear Power Plants

Most of the existing nuclear power plants (NPPs) in the world rely on traditional analog instrumentation and control (I&C) systems for monitoring, control, and protection functions. With the industrial base largely moving to digital systems, the operation and maintenance of plants involves managing issues including lack of needed analog spare parts, increasing maintenance costs, and the loss of vendor support. Compared with existing analog I&C systems, digital I&C systems have significant functional advantages, such as reliable system performance in terms of accuracy and computational capability, high data handling and storage capabilities to fully measure and display operating conditions, and improved capabilities (e.g., fault tolerance, self-testing, signal validation, process system diagnostics). Therefore, the U.S. nuclear power industry has initiated the replacement of existing, aging analog systems with digital I&C technology, and is developing new designs for advanced plants using digital systems in integrated control rooms to provide modern control and protection systems. However, the qualification of digital I&C systems remains a challenge, especially the issue of software common cause failure (CCF), which has been difficult to address. A CCF is the malfunction of two or more plant components or functions due to a single failure source. CCFs have the potential to generate unanalyzed events or sequences that may not be bounded by previous plant accident analyses, therefore, to challenge the plant safety. Existing analyses on CCF in I&C systems are mainly focusing on hardware failures. With the application and upgrades of new digital I&C systems, software CCFs due to design flaws have become a potential threat to plant safety considering most redundancy designs are using the similar digital platforms or software in the operating and application systems. With complex multi-layer redundancy designs to meet the single failure criterion, these I&C safety systems are of a particular concern in the U.S. Nuclear Regulatory Commission (NRC) licensing procedures. Therefore, there is a need to develop an integrated risk assessment strategy with digital CCF and plant transient responses considered to assure the long-term safety and reliability of vital digital systems and reduce uncertainties in costs, time, and support integration of digital systems in the plant. The overall goal of this project is to deliver a strong technical basis to support effective, licensable, and secure digital I&C technologies for the digital upgrades to existing NPPs. To deal with the expensive licensing justifications from regulatory insights, this technical basis is instructive for nuclear vendors and utilities to effectively lower the costs associated with digital compliance and speed-up industry advances by: (1) defining an integrated risk-informed analysis process for digital I&C upgrades including hazard analysis, reliability analysis, and consequence analysis; (2) applying systematic and risk-informed tools to address CCFs and quantify responding failure probabilities for digital I&C technologies; (3) evaluating the impact of digital failures at the individual level, system level, and plant level; and (4) providing insights and suggestions on designs to manage the risks, thus to support the development, licensing, and deployment of advanced digital I&C technologies on NPPs. Upgrading digital I&C (safety and non-safety related) systems in existing NPPs within a cost-effective and regulatory acceptable way offers the foremost means of performance improvements and cost-reductions for existing NPPs. One key outcome of this project is to perform plant-specific risk assessment to provide a sustainable scientific support for enabling industry to balance the digital-related risks, costs, reliability, and safety.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗
DOE OSTI2017

SymPLe 1131: A novel architectural solution for the realization of verifiable digital I and C systems and embedded digital devices - 387

One of the main reasons for the increasing popularity of FPGAs in embedded systems and digital I and C systems is that they provide many of the advantages from both hardware and software components. FPGAs provide configurability approaching that of SW, while at the same time delivering deterministic behavior of pure hardware solutions. However, with regard to Software Common Cause Failures (CCF), the use of FPGAs in digital I and C platforms should not be seen as plug-in remedy for reduction or elimination of CCF. To address CCF, we argue that it is not enough to manage the complexity of an I and C device or system, but we must also have the ability to constrain complexity (as needed) and rigorously reason about execution and device functionality. This paper presents the work done regarding an FPGA overlay architecture called SymPLe. SymPLe is designed to reduce the gap between software and hardware approaches for digital I and C systems and increases deterministic behavior and verifiability of the application, architecture and safety-critical system while reasoning about CCF. (authors)

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
DOE OSTI2019

Technical Specification Surveillance Interval Extension of Digital Equipment in Nuclear Power Plants: Review and Research. Light Water Reactor Sustainability Program report

The nuclear industry has been slow to incorporate digital technology into nuclear plant designs for several reasons, including: The high cost of design change modifications to implement them, versus simply replacing them with like for like technology when the components fail; Digital technology qualification issues, particularly in safety related applications that are susceptible to software common cause failure. This is a concern both for current operating plants as well as new builds; and, General familiarity and comfort with the existing analog technology on the part of the nuclear plant engineering staff, in spite of the superior performance and reduced maintenance costs of the digital replacements. At the same time, the nuclear industry is under significant cost pressure in the electric marketplace due to the abundance of natural gas generation and renewables. The industry would benefit by investment in new technologies that could lower future operating costs while addressing obsolescence and reliability issues of the current analog technologies. However, the industry has been unable to formulate the business cases to take advantage of these labor savings and production reliability improvements. This paper discusses another potential cost savings benefit of a transition to digital technology, extending the surveillance intervals of technical specification required equipment.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
DOE OSTI2019

Achieving Verifiable and High Integrity Instrumentation and Control Systems through Complexity Awareness and Constrained Design. Final Report

While most process control industries have been able to embrace digital Instrumentation and Control (I&C) technology to improve performance, reliability, maintainability, and efficiency of production, the nuclear industry has been relatively slow to adopt digital I&C for safety critical plant functions. There are a variety of reasons for this, but in general the nuclear industry takes a conservative stance that new technologies must mature before adoption. A deeper underlying reason for not fully realizing digital I&C and automation in nuclear power is associated with the complexity that can manifest in software-based systems that is different in nature from the complexity of their analog predecessors. Accordingly, this research pursued the development of innovative architectures and methods to “constrain complexity” to enhance verifiability of digital I&C devices. These constraints can positively impact the reduction of Software Common Cause Failures (SCCF) and other systematic errors. The architectural concept developed in this research effort is called SymPLe. SymPLe is specifically aimed at safety critical functions within Nuclear Power Plants and other critical infrastructure where constraining device complexity to support verifiability and safety case arguments is important. The SymPLe architecture is designed to promote “accessible verification” between OEM/utility engineers and the regulatory agencies who review and license nuclear power plant I&C systems. The major contributions of this work to the nuclear industry are: Demonstration of SymPLe as a viable approach to “complexity aware” I&C systems and Embedded Digital Devices.Comprehensive use of model-based design and engineering to produce verifiable I&C systems for the nuclear industry with clear findings on the usability of model-based engineering. Employ comprehensive use of model-based engineering, testing, and verification in an IEC 61508 workflow in support of design assurance. Gathered evidence of “difficult to find” design flaws found using model-based design and testing methods. Detailed the nature of these SCCFs including where they were introduced, the triggers, and how they were found. Gathered evidence on the synergistic use of practical formal methods and testing and how these methods can be used to significantly increase assurance of reduction and avoidance of design flaws.

Testing↗
NASA NTRS2013

Practical Application of PRA as an Integrated Design Tool for Space Systems

This paper presents the application of the first comprehensive Probabilistic Risk Assessment (PRA) during the design phase of a joint NASA/NOAA weather satellite program, Geostationary Operational Environmental Satellite Series R (GOES-R). GOES-R is the next generation weather satellite primarily to help understand the weather and help save human lives. PRA has been used at NASA for Human Space Flight for many years. PRA was initially adopted and implemented in the operational phase of manned space flight programs and more recently for the next generation human space systems. Since its first use at NASA, PRA has become recognized throughout the Agency as a method of assessing complex mission risks as part of an overall approach to assuring safety and mission success throughout project lifecycles. PRA is now included as a requirement during the design phase of both NASA next generation manned space vehicles as well as for high priority robotic missions. The influence of PRA on GOES-R design and operation concepts are discussed in detail. The GOES-R PRA is unique at NASA for its early implementation. It also represents a pioneering effort to integrate risks from both Spacecraft (SC) and Ground Segment (GS) to fully assess the probability of achieving mission objectives. PRA analysts were actively involved in system engineering and design engineering to ensure that a comprehensive set of technical risks were correctly identified and properly understood from a design and operations perspective. The analysis included an assessment of SC hardware and software, SC fault management system, GS hardware and software, common cause failures, human error, natural hazards, solar weather and infrastructure (such as network and telecommunications failures, fire). PRA findings directly resulted in design changes to reduce SC risk from micro-meteoroids. PRA results also led to design changes in several SC subsystems, e.g. propulsion, guidance, navigation and control (GNC), communications, mechanisms, and command and data handling (C&DH). The fault tree approach assisted in the development of the fault management system design. Human error analysis, which examined human response to failure, indicated areas where automation could reduce the overall probability of gaps in operation by half. In addition, the PRA brought to light many potential root causes of system disruptions, including earthquakes, inclement weather, solar storms, blackouts and other extreme conditions not considered in the typical reliability and availability analyses. Ultimately the PRA served to identify potential failures that, when mitigated, resulted in a more robust design, as well as to influence the program's concept of operations. The early and active integration of PRA with system and design engineering provided a well-managed approach for risk assessment that increased reliability and availability, optimized lifecyc1e costs, and unified the SC and GS developments.

Kalia, Prince↗
DOE OSTI2017

Development of a diversity and defense-in-depth strategy for the TerraPower TWR-P Advanced nuclear power plant - 380

A Diversity and Defense in Depth (D3) analysis was performed for the Traveling Wave Reactor, which is a Generation IV fast reactor design. The analysis demonstrated that the current I and C design for TWR-P provides sufficient diversity in the reactor shutdown system, the engineered safety features, and the post-accident monitoring system. In addition, an analysis was performed for the Embedded Digital Devices (EDD) to ensure a postulated Software Common Cause Failure (SWCCF) will not affect the safety functions of the TWR-P I and C system. (authors)

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2016

Technical Basis for Evaluating Software-Related Common-Cause Failures

The instrumentation and control (I&C) system architecture at a nuclear power plant (NPP) incorporates protections against common-cause failures (CCFs) through the use of diversity and defense-in-depth. Even for well-established analog-based I&C system designs, the potential for CCFs of multiple systems (or redundancies within a system) constitutes a credible threat to defeating the defense-in-depth provisions within the I&C system architectures. The integration of digital technologies into the I&C systems provides many advantages compared to the aging analog systems with respect to reliability, maintenance, operability, and cost effectiveness. However, maintaining the diversity and defense-in-depth for both the hardware and software within the digital system is challenging. In fact, the introduction of digital technologies may actually increase the potential for CCF vulnerabilities because of the introduction of undetected systematic faults. These systematic faults are defined as a “design fault located in a software component” and at a high level, are predominately the result of (1) errors in the requirement specification, (2) inadequate provisions to account for design limits (e.g., environmental stress), or (3) technical faults incorporated in the internal system (or architectural) design or implementation. Other technology-neutral CCF concerns include hardware design errors, equipment qualification deficiencies, installation or maintenance errors, instrument loop scaling and setpoint mistakes.

97 MATHEMATICS AND COMPUTING↗