Research into propagation paths of software errors in software-based control technology in nuclear power plants

This report presents results that have been developed within the framework of a BMU-funded research project (Promotion Code 4717R01331). The focus of this project was to systematically investigate the effects and the propagation of software faults/errors within software-based I&C systems. For this purpose, a concept for performing a software failure mode and effects analysis (FMEA), in short Software-FMEA (SFMEA), on a software-based I&C system was developed with the aim to identify potential failures due to latent software errors in a software-based I&C system and to investigate their effects on the I&C functions (failure on demand, faulty operation, etc.). Such latent errors result, for example, from errors during operation, maintenance and modification of the system as well as signal paths that have not been tested during system tests. Since I&C functions of software-based I&C systems are typically specified on the basis of interconnected elementary function blocks (EFBs), the EFBs are defined in this project as the lowest level of abstraction for performing an FMEA. Consequently, in the SFMEA concept developed in the course of this work, the elementary function blocks are subjected to an FMEA in order to systematically identify their relevant failure modes. The effects of the identified failure modes of the elementary function blocks on the underlying I&C function can then be evaluated by means of dynamic simulation or fault tree analysis. For this purpose, an automation of the developed SFMEA method by means of dynamic simulations was elaborated within the framework of this project. On the basis of some selected application examples of the developed SFMEA concept, it was shown within the scope of the work that particular faulty states of the input signals (undetected failures of input signals or input signals identified as faulty but correct) essentially determine the identified failure modes of the elementary function blocks and consequently also co-determine the propagation of faulty states in a software-based I&C system and their effects on the correct functioning of the I&C system. Furthermore, the suitability of the developed SFMEA concept for determining the failure behaviour of I&C functions in the presence of faulty input signals (signal status and signal value) was tested using an example of an I&C function consisting of several elementary function blocks. Dynamic simulations performed to this end have shown that undetected input signal failures or incorrectly identified correct input signals can lead to faulty execution of the I&C function or non-execution of the I&C function.