{'fraction_non_alphanumeric': 0.029155453030885556, 'fraction_numerical': 0.007497116493656286, 'mean_word_length': 5.277956556717618, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
PRACTICAL ASPECTS OF OPERATING AND ANALYTICAL RELIABILITY ASSESSMENT OF FPGA-BASED I&C SYSTEMS

Operating reliability assessment of instrumentation and control systems (I&Cs) is always one of the most important activities, especially for critical domains such as nuclear power plants (NPPs). It is an important source of I&C reliability information preferable to lab testing data because it provides information on I&C reliability under real use conditions. That is the reason that now it is a common practice for companies to have an established process of collecting operating reliability data on a large variety of used components on regular basis, maintaining a database with failure information, total operation time, typical failure modes, etc. The intensive use of complicated components like field-programmable gate arrays (FPGAs) in I&C which appear in upgrades and newly-built nuclear power plants makes the task to develop and validate advanced operating reliability assessment methods that consider specific technology features very topical. Increased integration densities make the reliability of integrated circuits the most crucial point in modern NPP I&Cs. Moreover, FPGAs differ in some significant ways from other integrated circuits: they are shipped as blanks and are very dependent on the design configured into them. Furthermore, FPGA design could be changed during planned NPP outage for different reasons. Considering all possible failure modes of FPGA-based NPP instrumentation and control systems at the design stage is a quite challenging task. Therefore, operating reliability assessment is one of the most preferable ways to perform a comprehensive analysis of FPGA-based NPP I&Cs. Based on information in the literature and own experience, operational vs analytical reliability could be pretty far apart. For that reason, analytical reliability assessment using reliability block diagrams (RBD), failure modes, effects and diagnostics analysis (FMEDA), fault tree analysis (FTA), fault insertion testing (FIT), and other techniques and their combinations are important to meet requirements for such systems. The paper summarizes our experience in operating and analytical reliability assessment of FPGA based NPP I&Cs.


Introduction
For analytical reliability assessments Markov chain models, Reliability block diagrams (RBD) and Fault trees analysis (FTA) are typically used. Traditionally, application of such methods has been rather straightforward. However, with the implementation of modern I&Cs, there is no common practice on how to use them. In addition, challenges of application of such methods for complex systems like FPGA-based NPP I&Cs lie in fact that assessments are based on assumptions the influence of which on the results may be underestimated and not well understood.
Operating reliability assessment is used for verifying and completing analytical assessment. We compare results that were obtained by analytical calculations with results obtained from operation and propose unified reliability assessment approach.
In FPGA-based systems, a high-level design is implemented with the configurable logic blocks made available by a given FPGA chip. In order to attain a realistic model and satisfactory accuracy of the analysis, we propose to represent FPGA-based system at this implementation level.
There are a lot of reliability assessment techniques during development and operation stages described by standards MIL [1], IEEE [2], IEC [3] and industrial guides [4]. These techniques can be combined to analyze reliability and evaluate quantitative indicators [5]. Particularities of reliability and safety assessment for FPGA-based I&C are analyzed in [6].
Objective of the paper is to summarize experience on operating reliability analysis of FPGA based NPP I&Cs. In Section 2 we provide overview of analytical and operational reliability assessment methods used at RPC Radiy. Sections 3 and 4 provide details on operating and analytical assessments respectively. The results we obtained illustrate the proposed approach can assess the reliability of the FPGA-based NPP I&Cs reasonably. It also allows performing verification of obtained results by possibility of different methods usage.
Finally, in Sections 6 and 7 we provide an assessment case study and conclusions including future research directions.

Reliability Assessment of FPGA-based NPP I&C Systems: Approach
Reliability assessment activities are critical for maintaining system and customers' reliabilities during operation of FPGA-based NPP I&C systems. Reliability assessment typically covers both analytical and operational reliability assessment. RPC Radiy's approach is shown on Figure 1  Results obtained by analytical and operational assessments are being compared, and then conclusions are made, providing feedback for possibility of improvement of maintenance process (customer side) and reliability assessment techniques (I&C system supplier side).
During reliability assessment a lot of reliability data is being processed. Figure 2 provides classification of data sources, basic reliability data (obtained from field) and derived reliability data (obtained after performed calculations on basic data).
Thus, the approach is based on combining of the different techniques and data to assess and prove trustworthiness of the assessment results.

Operating Reliability Assessment
Reliability data on supplied I&C systems is collected from RPC Radiy customers on regular basis, not less than once in a quarter. Such information includes failure data that is used to calculate operational reliability and can be used for further improvements. Figure 3 shows toolbox used at RPC Radiy during operating reliability assessment.

Improve Reliability
Analyze Collect Data Fig. 3. RPC Radiy's toolbox for operating reliability assessment During analysis stage the following actions are performed:  classification of source information by accepted features (operating conditions, type of failed components etc);  identification of components that reduce the product reliability;  identification of failure causes;  efficiency estimation of design-engineering and (or) organizational measures;  estimation of reliability indices and statistical data processing;  data processing about usage of spare parts;  comparison of obtained data with analytical results;  analysis and classification of data about components failures;   generation of recommendations on elaboration for removal of detected defects and further improvement of items reliability.
Supply database contains information on supplied I&C systems, including information on beginning of commercial operation of I&C, manufacturing dates of it's parts, information on replacements etc. Figure 4 shows sample report from such database that provides total operation time of NPP I&C systems supplied by RPC Radiy.

Analytical Reliability Assessment
As we mentioned in the introduction, there are those areas and reliability assessment tasks that deal with completely new systems or platforms and first-ofits-kind equipment, for which no operating experience exists or it's not representative. For such cases analytical reliability assessment seems to be the only option.
Analytical reliability assessment includes:  qualitative analysis (identification of failure modes, effects, criticality etc.);  quantitative analysis (obtaining quantitative reliability indices by calculation);  evaluation of analysis results.  Figure 5 provides classification of mentioned analytical reliability assessment methods. Basing this classification different attributes of techniques are specified. Analysis technique of system reliability (no-failure operation) calculation basing on known reliability of its elements was used. Series reliability block diagram was constructed, i.e. failure of any element was considered as failure of the whole system. All failures were considered as independent. Possible software failures were not considered.
where k pprobability of no-failure operation of k -th element, n -number of elements in system.
The relation between failure rate and probability of no-failure operation is the following:  (1) and (2) the following expression for failure rate can be obtained: where k failure rate of k -th element, nnumber of elements in system.

Standards
FMEA is a systematic way to identify and evaluate the effects of different component failure modes, to determine what could eliminate or reduce the chance of failure, and to document the system in consideration. FMEDA (Failure Mode Effect and Diagnostic Analysis) is an extension of FMEA that combines standard FMEA techniques with the extension to identify automatic diagnostic techniques and the failure modes relevant to safety instrumented system design.
It is a technique recommended to generate failure rates for each important category (safe detected, safe undetected, dangerous detected, dangerous undetected, fail high, fail low, etc.) in the safety models. The format for the FMEDA is an extension of the standard FMEA format from MIL STD 1629A [1]. The FMEDAs are consistent the FMEA guidance of IEEE Std 352-2016 [2], Sections 4.5.2 and 5.2.
The failure rate data used for the FMEDAs are from the Electrical and Mechanical Component Reliability Handbook [4], which was derived using over ten billion unit operational hours of field failure data from multiple sources and failure data from various databases.
The rates were chosen in a way that is appropriate for safety integrity level verification calculations. It is expected that the actual number of field failures due to random events will be less than the number predicted by these failure rates. For hardware assessment according to IEC 61508 [3], only random equipment failures are of interest. It is assumed that the equipment has been properly selected for the application and is adequately commissioned such that early life failures may be excluded from the analysis.

FPGA Failures
The methods used to estimate the reliability of RadICS (FPGA-based I&C platform produced by RPC Radiy) Modules that are installed in a rack are based on the Electrical and Mechanical Component Reliability Handbook instead of MIL HDBK 217F [10], which is recommended in IEEE Std 352-2016 [2]. The Electrical and Mechanical Component Reliability Handbook provides more current data for modern electronic hardware than MIL HDBK 217F. The FMEDA for each RadICS Module considered the different groups of components that affected module functionality. The following groupings were evaluated: Common The portion of the RadICS Module that is always used. Input The portion of the RadICS Module used by one on-board input channel. Output The portion of the RadICS Module used by one on-board output channel.

LVDS
The portion of the logic module providing communication to one input/output module via low-voltage differential signaling.
The following definitions for the failure of the device were considered in order to judge the failure behavior of the RadICS Modules:

Fail-Safe State
State where all discrete outputs are deenergized.

Fail-Safe
Failure that causes the device to go to the defined fail-safe state without a demand from the process. (abbreviation: S).

Fail-Safe Detected
Failure that is detected by automatic self-diagnostics, which causes the output signal to go to the predefined failsafe state (i.e., output modules deenergized). (abbreviation: SD).

Fail-Safe Undetected
Failure that is safe and that is not diagnosed by automatic self-diagnostics.

Annunciati on Detected
Failure that does not directly impact safety but does impact the ability to detect a future fault (e.g., a fault in a diagnostic circuit) and that is detected by internal diagnostics. A Fail Annunciation Detected failure leads to a false diagnostic alarm. This condition leads to maintenance, and if the safety channel is not shut down (put into the safe state) during this maintenance, the time must be accounted for in any system level reliability calculation. (abbreviation: AD).

Annunciation Undetected
Failure that does not directly impact safety but does impact the ability to detect a future fault (e.g., a fault in a diagnostic circuit) and that is not de- The Annunciation failures are provided for those who wish to do reliability modeling more detailed than required by IEC 61508:2010. It is assumed that the probability model will correctly account for the Annunciation failures; otherwise the Annunciation Undetected failures have to be classified as Dangerous Undetected failures according to IEC 61508:2010 (worst-case assumption).

FPGA Failure Modes
FPGA-based systems are analyzed on different implementation level. For example, in [7] failure taxonomy is provided for system level, division level, I&C unit level, I&C module level, while in [8] failure modes are provided for FPGA itself. In order to attain a realistic model and satisfactory accuracy of the analysis, we propose to represent FPGA-based system at the following implementation level: configurable logic blocks made available by a given FPGA chip.
The following failure modes could be considered:

Tool Support
Reliability assessment complexity necessitates development of software tools that assist plant personnel and vendor engineers to manage reliability assessment activities and can provide solutions to various decision making issues.
As was discussed in [9], the following is to be considered during selection of software package:  types of data input (graphically, as a plain text, in a matrix form etc);  export (import) features;  supported analysis methods;  embedded feature of reports generation. At RPC Radiy we use our own developed tool called AXMEA ( Figure 6). So far it supports only FMEDA, but adding other methods and techniques to it is in progress.

80
For operational reliability assessment is a spreadsheet-based tool is used (Figure 7). This tool summariz-es data on all I&Cs supplied by RPC Radiy, providing information on system, module and component level.

Case Study
As an example we take Speed Measuring Device, which block diagram is shown on Figure 8.
Speed Measuring Device includes the following blocks:  Variable Reluctance Speed Sensor (A0);  DC/DC converters (A1, A7);  Variable Reluctance Speed Sensor interface device (A2);  optocouplers (A3, A5, A8);  AC/DC converter (A4);  logic solver (A6);  output converters (A9);  relay (A10). Blocks A3 and A10 are used only to switch device into testing mode and are not used during normal device operation, therefore they are not taken into reliability analysis. Figure 9 shows reliability block diagram for Speed Measuring Device. Since block A7 is identical to block A1, and block A8 to A5, they are shown on reliability block diagram as 2*A1 and 2*A5 accordingly. Calculated failure rate of A0 is 3.15E-09. Table 2 summarizes failures rates for all blocks.

Conclusions
In this paper we have introduced approach to assessment of FPGA-based NPP I&C systems which was implemented by RPC Radiy during last ten years. It is based on combining of the techniques of operational and analytical calculation and assessment of the systems. The most interesting and important points of this approach are renewing of the data for operational assessment and possibilities of comparing results using different techniques and different combinations of the techniques chains.
The future steps will be dedicated to development reliability assessment environment for NPP I&C systems using commercial off-the-shelf and RPC Radiy tools.