Richard T. Wood

1
Diversity Approaches ForCommon Cause Failure
Mitigation

• Richard T. Wood
• Oak Ridge National Laboratory
• presented at
• IAEA Technical Meeting on Common Cause Failures
  in Digital IC Systems of Nuclear Power Plants
• Bethesda, Maryland
• June 19-21, 2007

The Oak Ridge National Laboratory (ORNL) is
managed for the U.S. Department of Energy by
UT-Battelle, LLC, under contract
DE-AC-05-00OR22725. This work is sponsored by
the U.S. Nuclear Regulatory Commission (NRC)
Office of Nuclear Regulatory Research. Opinions
and conclusions expressed by the author do not
necessarily represent positions endorsed by NRC.
2
Research Findings Contributed by a Diverse Team
of Subject Matter Experts

• Oak Ridge National Laboratory (ORNL)
• David Holcomb Kofi Korsah
• Andy Loebl Mike Muhlheim
• Jim Mullens Lou Qualls
• Thomas Wilson Richard Wood
• U.S. Nuclear Regulatory Commission (NRC)
• Mike Waterman

3
Four-point Diversity and Defense-in-Depth (D3)
Requirement Prescribes Diversity to Address
Common Cause Failure (CCF)

• If a postulated common-mode failure could disable
  a safety function, then a diverse means, with a
  documented basis that the diverse means is
  unlikely to be subject to the same common mode
  failure, shall be required to perform either the
  same function or a different function. The
  diverse or different function may be performed by
  a non-safety system if the system is of
  sufficient quality to perform the necessary
  function under the associated event conditions.

Staff Requirements Memorandum (SRM) on SECY
93-087
4
NUREG/CR-6303 Identifies Six Diversity Attributes
with Associated Criteria

• DESIGN
• Different technologies
• Different approaches within a technology
• Different architectures

• EQUIPMENT
• Different manufacturers of fundamentally
  different designs
• Different manufacturers of same design
• Different versions of the same design
• Different CPU architectures
• Different CPU versions
• Different printed circuit board designs
• Different bus architectures

• FUNCTION
• Different underlying mechanisms
• Different purpose, function, control logic, or
  actuation means
• Different response time scale

• SIGNAL
• Different reactor or process parameters sensed by
  different physical effects
• Different reactor or process parameters sensed by
  the same physical effect
• The same process parameter sensed by a different
  set of similar sensors

• LIFE CYCLE
• Different design organizations/companies
• Different management teams within the same
  company
• Different designers, engineers, and/or
  programmers
• Different testers, installers, or certification
  personnel

• SOFTWARE
• Different algorithms, logic, and program
  architecture
• Different timing or order of execution
• Different operating system
• Different computer languages

5
Investigation of Diversity Approaches Involved
Other Industries and International Experience
Foreign Nuclear Power Agencies and Licensees
Federal Railroad Administration
Federal Aviation Administration
Chemical Industry
Academia and Science Organizations
Department of Defense
National Aeronautics and Space Administration
Power Grids Petrochemical Power Grids
6
CCF Avoidance Relies on Hazard Assessment, High
Quality and Risk Minimizing Design
FAA Development Assurance Levels
DoD Hazard Risk Index

• FAA Recommended Mitigation Approaches
• Redundancy
• Dissimilarity

• Monitoring
• Partitioning

7
Other Industries Provide Examples of Diversity
Strategies
Strategies may not be industry-wide
8
NASA SPACE SHUTTLERedundancy, Monitoring
Synchronization, Reduced Functionality Backup
9
FAA AIRBUS 320 AVIONICS Independent teams,
Different CPU Architectures, Different Software
10
FAA BOEING 777 AVIONICS Different CPU
Architectures, Monitoring, Reduced Functionality
Backup
11
CENTER FOR CHEMICAL PROCESS SAFETYRisk
Identification and Vulnerability Mitigation
12
Diversity Approaches for International Reactor
Examples
13
CCF Mitigation Design Diversity Approaches Arise
From Vulnerability Analyses
Other Application Domains Have Demonstrated
Diversity Strategies

• Analog and Digital Implementations
• Inherent Equipment, Functional, Life Cycle
• Specified Signal
• Different Digital Technologies (?P and FPGA)
• Inherent Equipment, Life Cycle, Software
• Specified Functional and Signal
• Digital Technology Variation (Intel and Motorola)
• Inherent Equipment
• Specified Functional, Life Cycle, Signal, and
  Software
• Design Variance on Same Digital Platform
• Required Evidence that Platform CCF Addressed
• Specified Functional, Signal, Software
• and Life Cycle (application)