Availability analysis of safety grade multiple redundant controller used in advanced nuclear safety systems

We analyze the availability of the Safety Programmable Logic Controller (SPLC) having multiple redundant architectures. In the SPLC, input/output and processor module are configured as triple modular redundancy (TMR), and backplane bus, power and communication modules are configured as dual modular redundancy (DMR). The voting logics for redundant architectures are based on the forwarding error detection. It means that the receivers perform the voting logics based on the status information of transmitters. To analyze the availability of SPLC, we construct the Markov model and simplify the model adopting the system unavailability rate. The results show that the fault coverage factor should be ≥0.8 and Mean Time To Repair (MTTR) should be ≤100 h in order to satisfy the requirement that the availability of the safety grade PLC should be ≥0.995. Also we evaluate the availability of SPLC comparing to other PLCs such as simplex, processor DMR (pDMR) and independent TMR (iTMR) PLCs used in the existing nuclear safety systems. The availability of SPLC is higher than those of the simplex, pDMR but is lower than that of iTMR for one month which is the periodic off-line test and inspection. That's why the number of redundant modules used in PLC is more dominant to increasing the availability than the number of fault masking methods such as voting logics used in PLC on the assumption that operation time is in the early stage. But the availability of iTMR, which has many redundant modules but has only a voting logic fast decrease and eventually is the lowest after 8000 h. Also if the MTTR of each module in PLC is required to be increased to 200 h, the availability of SPLC would be better than iTMR.