Search

Instrumentation and control systems in nuclear power plants have been digitalized for the purpose of maintenance and precise operation. This digitalization, however, brings out issues related to cyber security. In the most recent past, international standard organizations, regulatory institutes, and research institutes have performed a number of studies addressing these systems cyber security.. In order to provide information helpful to the system designers in their application of cyber security for the systems, this paper presents methods and considerations to define attack vectors in a target system, to review and select the requirements in the Regulatory Guide 5.71, and to integrate the results to identify applicable technical security control requirements. In this study, attack vectors are analyzed through the vulnerability analyses and penetration tests with a simplified safety system, and the elements of critical digital assets acting as attack vectors are identified. Among the security control requirements listed in Appendices B and C to Regulatory Guide 5.71, those that should be implemented into the systems are selected and classified in groups of technical security control requirements using the results of the attack vector analysis. For the attack vector elements of critical digital assets, all the technical security control requirements are evaluated to determine whether they are applicable and effective, and considerations in this evaluation are also discussed. The technical security control requirements in three important categories of access control, monitoring and logging, and encryption are derived and grouped according to the elements of attack vectors as results for the sample safety system.

The applications of computers and communication system and network technologies in nuclear power plants have expanded recently. This application of digital technologies to the instrumentation and control systems of nuclear power plants brings with it the cyber security concerns similar to other critical infrastructures. Cyber security risk assessments for digital instrumentation and control systems have become more crucial in the development of new systems and in the operation of existing systems. Although the nstrumentation and control systems of nuclear power plants are similar to industrial control systems, the former have specifications that differ from the latter in terms of architecture and function, in order to satisfy nuclear safety requirements, which need different methods for the application of cyber security risk assessment. In this paper, the characteristics of nuclear power plant instrumentation and control systems are described, and the considerations needed when conducting cyber security risk assessments in accordance with the lifecycle process of instrumentation and control systems are discussed. For cyber security risk assessments of instrumentation and control systems, the activities and considerations necessary for assessments during the system design phase or component design and equipment supply phase are presented in the following 6 steps: 1) System Identification and Cyber Security Modeling, 2) Asset and Impact Analysis, 3) Threat Analysis, 4) Vulnerability Analysis, 5) Security Control Design, and 6) Penetration test. The results from an application of the method to a digital reactor protection system are described.

This paper is a technical review of the research and development results of the Korea Nuclear Instrumentation and Control System (KNICS) project and Nu-Tech 2012 program. In these projects man-machine interface system architecture, two digital platforms, and several control and protection systems were developed. One platform is a Programmable Logic Controller (PLC) for a digital safety system and another platform is a Distributed Control System (DCS) for a non-safety control system. With the safety-grade platform PLC, a reactor protection system, an engineered safety feature-component control system, and reactor core protection system were developed. A power control system was developed based on the DCS. A logic alarm cause tracking system was developed as a man-machine interface for APR1400. Also, Integrated Performance Validation Facility (IPVF) was developed for the evaluation of the function and performance of developed I&C systems. The safety-grade platform PLC and the digital safety system obtained approval for the topical report from the Korean regulatory body in February of 2009. A utility and vendor company will determine the suitability of the KNICS and Nu-Tech 2012 products to apply them to the planned nuclear power plants.

This paper describes the application of a software fault tree analysis (FTA) as one of the analysis techniques for a software safety analysis (SSA) at the design phase and its analysis results for the safety-critical software of a digital reactor protection system, which is called the KNICS RPS, being developed in the KNICS (Korea Nuclear Instrumentation & Control Systems) project. The software modules in the design description were represented by function blocks (FBs), and the software FTA was performed based on the well-defined fault tree templates for the FBs. The SSA, which is part of the verification and validation (V&V) activities, was activated at each phase of the software lifecycle for the KNICS RPS. At the design phase, the software HAZOP (Hazard and Operability) and the software FTA were employed in the SSA in such a way that the software HAZOP was performed first and then the software FTA was applied. The software FTA was applied to some critical modules selected from the software HAZOP analysis.

A method for identifying the impact location of a loose part is described in this paper. This method draws the signal envelope from an impact time signal. And the arrival time of the impact signal can be determined conveniently by identifying the maximum point on the selected pulse or ridge of the signal envelope. The group velocity of an impact signal is obtained from the fact that the duration of the selected envelope pulse is equal approximately to the impact contact time. The estimation method is applied to impact signals obtained from an experimental facility of a metal plate and to the data from impact calibration tests in a component structure of nuclear power plants (NPPs). The estimation results are satisfactory for both experimental and field-tested impact signals.

We consider the Poisson equation where the functions involved are periodic including the solution function. Let R = [0, 1] × [0, 1] × [0, 1] be the region of interest and and let φ(x, y, z) be an arbitrary periodic function defined in the region R such that φ(x, y, z) satisfies φ(x + 1, y, z) = φ(x, y + 1.z) = φ(x, y, z + 1) = φ(x, y, z) for all x, y, z. We describe a very simple method for solving the equation ▽²u(x, y, z) = φ(x, y, z) based on the cubic spline interpolation of u(x, y, z); using the requirement that each interval [0, 1] is a multiple of the period in the corresponding coordinates, the Laplacian operator applied to the cubic spline interpolation of u(x, y, z) can be replaced by a square matrix. The solution can then be computed simply by multiplying φ(x, y, z) by the inverse of this matrix. A description on how the storage of nearly a Giga byte for 20 × 20 × 20 nodes, equivalent to a 8000 × 8000 matrix is handled by using the fuzzy rule table method and a description on how the shape preservation property of the Laplacian operator will be affected by this approximation are included.

The safety analysis of requirements is a key problem area in the development of software for the digital protection systems of a nuclear power plant. When specifying requirements for software of the digital protection systems and conducting safety analysis, engineers find that requirements are often known only in qualitative terms and that existing fault-tree analysis techniques provide little guidance on formulating and evaluating potential failure modes. A framework for the requirements engineering process is proposed that consists of a qualitative method for requirements specification, called the qualitative formal method (QFM), and a safety analysis method for the requirements based on causality information, called the causal requirements safety analysis (CRSA). CRSA is a technique that qualitatively evaluates causal relationships between software faults and physical hazards. This technique, extending the qualitative formal method process and utilizing information captured in the state trajectory, provides specific guidelines on how to identify failure modes and the relationship among them. The QFM and CRSA processes are described using shutdown system 2 of the Wolsong nuclear power plants as the digital protection system example.

Generally, it is known that loose parts in the reactor coolant systems (RCS) bring serious damage into the system components and impede the normal function of the system. So, it is necessary to rapidly respond when the impact event has occurred. This paper presents a realization of automatic diagnosis algorithm for LPMS (Loose Parts Monitoring System) and application results to the impact test data at YongGwang Nuclear Power Plant Unit 3 (YGN3), Kori Nuclear Power Plant Unit 4 (KNU4) and the real data at YongGwang Nuclear Power Plant Unit 1 (YGN1). The integrated diagnosis algorithm is composed of three parts; prefiltering, impact location and mass estimation. The prefiltering is needed to reject low frequency background noises. To estimate the impact location, the starting points of impact are detected from the filtered signals and compared to produce the time differences, and then the modified triangular method is applied. To estimate the mass and energy of a loose part, we automatically compute the maximum amplitude and the initial half period. Additionally, a modified impact theory considering amplitude and energy attenuation effects is applied. To show the effectiveness of the proposed diagnostic method, the real impact test data at YGN3, KNU4 and the real impact data at YGN 1 is used. The analysis results show that the location estimation error is on average below 7.5%, and the average mass estimation is within 40%.

In this article, a transient identification method based on a stochastic approach with the hidden Markov model (HMM) has been suggested and evaluated experimentally for the classification of nine types of transients in nuclear power plants (NPPs). A transient is defined as when a plant proceeds to an abnormal state from a normal state. Identification of the types of transients during an early accident stage in NPPs is crucial for proper action selection. The transient can be identified by its unique time-dependent patterns related to the principal variables. The HMM, a double-stochastic process, can be applied to transient identification that is a spatial and temporal classification problem under a statistical pattern-recognition framework. The trained HMM is created for each transient from a set of training data by the maximum-likelihood estimation method which uses a forward-backward algorithm and the Baum-Welch re-estimation algorithm. The transient identification is determined by calculating which model has the highest probability for given test data using the Viterbi algorithm. Several experimental tests have been performed with normalization methods, clustering algorithms, and a number of states in HMM. There are also a few experimental tests that have been performed, including superimposing random noise, adding systematic error, and adding untrained transients to verify its performance and robustness. The proposed real-time transient identification system has been proven to have many advantages, although there are still some problems that should be solved before applying it to an operating NPP. Further efforts are being made to improve the system performance and robustness in order to demonstrate reliability and accuracy to the required level. © 2002 Wiley Periodicals, Inc.

In this paper Automatic Startup Intelligent Control System (ASICS) that automatically controls the PWR plant from cold shutdown to 5% of reactor power and Alarm and Diagnosis-Integrated Operator Support System (ADIOS) that is integrated with alarms, process values, and diagnostic information to an expert system focused on alarm processing are described. Nuclear Power Plant is manually controlled from cold shutdown to 5% according to the general operation procedures for startup operation of nuclear power plant. Alarm information is the primary sources to detect abnormalities in nuclear power plants or other process plants. The conventional hardwired alarm systems, characterized by one sensor-one indicator may lead the control room operators to be confused with avalanching alarms during plant transients. ASICS and ADIOS are designed to reduce the operator burden. The advances in computer software and hardware technology and also in information processing provide a good opportunity to improve the control systems and the annunciator systems of nuclear power plants or other similar process plants. It is very important to test and evaluate the performance and the function of the computer- or software-based systems like ASICS and ADIOS. The performance and the function of ASICS and ADIOS are evaluated with the real-time functional test facility and the results have shown that the developed systems are efficient and useful for operation and operator support.

The identification of the type of accident during the early stages of an accident in a nuclear power plant is crucial for the selection of the appropriate response actions. A plant accident can be identified by its time-dependent patterns, related to the principal variables. The Hidden Markov Model (HMM) can be applied to accident identification, which is a spatial and temporal pattern-recognition problem. The HMM is created for each accident from a set of training data by the maximum-likelihood estimation method, which uses an algorithm that employs both forward and backward chaining, and a Baum–Welch re-estimation algorithm. The accident identification is decided by calculating which model has the highest probability for the given test data. The optimal path for each model at the given observation is found by the Viterbi algorithm, and the probability of the optimal path is then calculated. The system uses a left-to-right HMM, including six states and 22 input variables, to classify eight types of accidents and a normal state. The simulation results show that the proposed system identifies the accident types correctly. It is also shown that the identification is performed well for incomplete input observations caused by sensor faults or by the malfunctioning of certain equipment.

Testing and validation of the functions and performance of the digital instrumentation and control (I&C) system should be done prior to installation in nuclear power plants. The objective of the I&C Functional Test Facility (FTF) is to test and validate the functions of developed digital control and various monitoring systems. The FTF provides the simulated testing environment as an experimental test bed. The FTF software consists of a mathematical modeling program which simulates a three-loop 993 MWe pressurized water reactor and a supervisory program that comprises all the instructions necessary to run the FTF. The hardware equipment provides an interface between a host computer and a simple test panel or the developed target systems to be tested. The graphical user interface supports an easy and friendly interface between the FTF and users. It is implemented through a Picasso-3 graphic tool developed by the Halden Reactor Project. The FTF is applied to an advanced I&C system prototype, such as an automatic start-up intelligent control system, dynamic alarm system, accident identification system, and intelligent logic tracking system, to test its algorithm or performance. The results of the test show good operational performance of the FTF in normal and transient conditions.

The water level control system of the steam generator in a pressurized water reactor and its control problems are analysed. In this work, a stable control strategy during low power operation and transient states is studied. The control strategy employs substitutional information using the bypass valve opening instead of incorrectly measured signal at the low flow rate as the fuzzy variable of the flow rate during low power operation, and includes the flexible scale adjusting method for fast response at a large transient. A practical self-tuning algorithm based on the control performance and the descent method is also suggested and applied to tuning the membership function scale of the flow error.

A real-time operating system (RTOS) is an Operating System (OS) intended for real-time applications. Benchmarking is a point of reference by which something can be measured. AQNX is a kind of RTOS developed by QSSL (QNX Software Systems Ltd.) in Canada. ELMSYS is the brand name of a commercially available Personal Computer (PC) for such applications as Cabinet Operator Module (COM) of a Digital Plant Protection System (DPPS) and COM of a Digital Engineered Safety Features Actuation System (DESFAS). ELMSYS PC hardware is undergoing qualification procedure by KTL (Korea Testing Lab.) for use as a Cabinet Operator Module (COM). The QNX RTOS dedication is being researched by Korea Atomic Energy Research Institute (KAERI). This paper describes the outline and benchmarking test results of Priority Inversion, Deadlock, Context Switching, Message Passing, Synchronization and Deadline Violation of QNX RTOS under an ELMSYS PC platform.

A strategy and relating activities of a software safety analysis (SSA) are presented for the software of a digital reactor protection system where software modules in the design description are represented by function blocks (FBs). The SSA, as a part of the verification and validation activities, was activated at each phase of the software lifecycle. For the SSA of the FB modules, the software HAZOP was performed and then the SFTA (Software Fault Tree Analysis) was applied. Both methods are redundant and complementary because the software HAZOP is a forward broad-thinking analysis method and the SFTA is a backward step-by-step local analysis method. The software HAZOP with qualitative properties for a deviation evaluated all the software modules and identified various hazards. The SFTA with well-defined FB fault tree templates was applied to some critical modules selected from the software HAZOP analysis and it identified some hazards that had not been identified in the prior processes of the document evaluation and the formal verification.

In the Korea Nuclear instrumentation and control (I&C) System (KNICS) project, a digital safety system including Reactor Protection System (RPS) and Engineered Safety Features-Component Control System (ESF-CCS) is developed. It is based on a safety grade Programmable Logic Controller (PLC) as a platform for the safety critical I&C systems. The software used in the digital safety system is classified as safety-critical, and it is qualified according to an appropriate lifecycle. This lifecycle includes design and qualification activities for the components and the system. In the KNICS project a defense-in-depth organizational structure for qualification is implemented based on different teams including 3rd party review teams. Each team uses diverse techniques, methods, and tools for their qualification tasks. Using the Korean KNICS project as an example, the results of Defence-in-Depth and Diversity (D3) qualification of safety-critical software are presented.

This paper describes the relationship between the overall safety lifecycle and the software safety lifecycle during the development of the software based safety systems of Nuclear Power Plants. This includes the design and evaluation activities of the components as well as the system. This paper also compares the safety lifecycle and planning activities defined in IEC 61508 with those in IEC 61513, IEC 60880, IEEE 7-4.3.2, and IEEE 1228. Using the Korean KNICS (Korean Nuclear Instrumentation and Control System) project as an example, the software safety lifecycle is described by comparing it to the software development, testing, and safety analysis processes of international standards. The safety assessment of the software for the KNICS Reactor Protection System and Programmable Logic Controller is a joint Korean/German project. The assessment methods applied in the project and the experiences gained from this project are presented.

A time-frequency analysis (TFA) is applied to the analysis of the vibration signals from a pipe where some chemical corrosion is likely to occur by an acidic material being mixed in the coolant of nuclear power plants. The spalling out of internal material pieces by the so-called flow-accelerated corrosion (FAC) is expected to change the structural vibration of a local point in the pipe, but this effect is too tiny to be recognized in the result of the Fourier transform. From the analysis by TFA, it is identified that the TFA can provide important information such as the amplitude fluctuations in the instantaneous frequency of each characteristic frequency. The analysis results show that the peak or ridge pattern of the TFA varied according to the status of the chemical corrosion within the pipe.

In light of the need to improve MMIS of NPPs, the advanced I&C research team of KAERI has embarked on developing an Alarm and Diagnosis-Integrated Operator Support System, called ADIOS. ADIOS was composed of two modules such as alarm process module and fault diagnostic module. The alarm process module can offer key alarms to operator using dynamic alarm filtering methods and the fault diagnostic module was able to diagnose the component failure caused by a sensor fault and a hardware fault. ADIOS has been built in an object-oriented AI environment of G2 expert system software tool. In the G2 environment, every alarm and diagnostic component have been treated as an object of class. The attributes of each alarm object include activation status, alarm message, process value, activated time, priority, acknowledgment state, interlocked equipment and caused alarm. If an alarm is activated, its icon color on an overview process mimic diagram changes corresponding to its priority, which can be set initially or determined dynamically by reasoning rules and procedures. The process conditions, such as plant or equipment status and correlated alarms’ states have determined the priority of the activated alarm and the fault diagnostic condition. The knowledge base and the inference engines of ADIOS have been constructed by process analysis of the plant and discussion with operators and nuclear plant experts.

In this chapter, a transient identification based on a hidden Markov model (HMM) has been suggested and evaluated experimentally for the classification of transients in nuclear power plants. The transient can be identified by its unique time dependent patterns related to the principal variables. The HMM, a double stochastic process, can be applied to transient identification which is a spatial and temporal classification problem under a statistical pattern recognition framework. The HMM is created for each transient from a set of training data by the maximum-likelihood estimation method. The transient identification is determined by calculating which model has the highest probability for the given test data. Several experimental tests have been performed with normalization methods, clustering algorithms, and a number of states in HMM. Several experimental tests have been performed including superimposing random noise, adding systematic error, and untrained transients. The proposed real-time transient identification system has many advantages, however, there are still a lot of problems that should be solved to apply to a real dynamic process. Further efforts are being made to improve the system performance and robustness to demonstrate reliability and accuracy to the required level.