Lessons learned from the U.S. nuclear regulatory commission's digital system risk research

For the past several years, the U.S. Nuclear Regulatory Commission and its contractors have been actively engaged in research to determine the capabilities and limitations of the state of the art of digital systems risk and reliability modeling. This program was developed to assess the capabilities of various modeling methods and to develop regulatory acceptance criteria for the use of digital system risk and reliability modeling in risk-informing digital system reviews. The program investigated both traditional and advanced modeling methods for the evaluation of digital system risk and reliability in the context of including these methods in current generation probabilistic risk assessments (PRAs). The methods investigated included traditional event tree/fault tree analysis, Markov modeling, and dynamic flow graph methodology. As part of the investigation into the capabilities of these methods, we have also reviewed the availability, capability, and practicality of the needed supporting data and analysis methods, including failure mode identification, data generation methods, and uncertainty analysis. The review indicated that for some digital systems traditional PRA modeling methods may be appropriate but that a number of potential issues exist that must be carefully evaluated in modeling these systems. Both the traditional and advanced modeling methods review found that the order of component failures can be important and that simulation either as part of the reliability model oras part of the supporting analysis is needed to determine the effects of combinations of component failures and the timing of digital system failures. Finally, the research showed that better data and models of fault-tolerant features of digital systems and software are needed to support more complete and accurate modeling of digital instrumentation and control for use in nuclear power plant PRAs.