Systems-Theoretic Hazard Analysis of Digital Human-System Interface Relevant to Reactor Trip
Slides for 2021 ANS-NPIC-HMIT conference
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Engineering topics
Bao, Han
Publications and source records attributed to Bao, Han.
Sensitivity and Importance Measure Analyses for Various Design Architectures for High Safety-Significant Safety-Related Digital Instrumentation and Control Systems of Nuclear Power Plants
A transition from analog instrumentation and control (I&C) technologies to digital I&C technologies is taking place for license renewals of existing nuclear power plants and for operating licenses of new advanced reactors. This transition necessitates research on risk and economic assessments of digital I&C technologies to ensure the long-term safety and reliability of vital systems, reduce uncertainty in licensing costs in addition to timeline, support integration of digital I&C systems in the plant, and find the most efficient technology upgrades. Adding redundancy within systems or components is a common means of improving design safety; however, it can also make designs more prone to common-cause failures (CCFs). Introducing diversity into redundant systems or components is a way to mitigate and possibly eliminate CCFs, but it also increases plant complexity and may be costly. The balance between redundancy and diversity remains a challenge for digital I&C systems. This study performs sensitivity and importance analyses for four design architectures of two digital I&C systems—the reactor-trip system and the engineered safety features actuation system. For each system, two architectures are examined, including a redundant, non-diverse configuration and a redundant, diverse configuration. The sensitivity analysis will provide insights on the impact of introducing diversity to system reliability. The importance results will help identify risk-significant and risk-sensitive components and failure modes, which may be good candidates for future design improvement.
99 GENERAL AND MISCELLANEOUS↗
Summary of Technical Peer Review on the Risk Assessment Framework proposed in Report INL/RPT-22-68656 for Digital Instrumentation and Control Systems
This report summarizes the peer review activities initiated by Idaho National Laboratory (INL) during fiscal year (FY) 2023 for the evaluation and improvement of the methodology developed under the U.S. Department of Energy (DOE) Light Water Reactor Sustainability (LWRS) Program, Risk Informed Systems Analysis (RISA) Pathway, digital instrumentation and control (DI&C) risk assessment project. In FY 2019, the RISA Pathway initiated a project to develop a risk assessment strategy for delivering a technical basis to support effective and secure DI&C technologies for digital upgrades/designs. A framework was proposed for this strategy, which aims to (1) provide a best-estimate, risk-informed capability to quantitatively and accurately estimate the risk impact of plant modernization, considering the introduction of high safety-significant safety-related (HSSSR) DI&C systems, (2) support and supplement existing risk-informed DI&C design guides by providing quantitative risk information and evidence, (3) offer a capability of design architecture evaluation of various DI&C systems, (4) assure the long-term safety and reliability of HSSSR DI&C systems, and (5) reduce uncertainty in costs and support integration of DI&C systems in the plant. The R&D efforts of this project from FY 2019 through FY 2022 were focused on methodology improvement and demonstration of the proposed framework for the risk assessment and design optimization of safety-critical DI&C systems. Collaborations with the nuclear industry have been initiated to support the reliability and risk assessment of their DI&C systems by using the proposed framework. In FY 2023, the framework has reached to a point for a technical peer review and obtain stakeholder feedback. This peer review activity includes coordination of the reviews performed by a group of industry stakeholders, documentation of the peer review suggestions, providing resolutions and responses to the peer review comments. The objective of this technical peer review is to obtain representative feedback on the proposed framework to improve the technical qualities of its methodology and readiness for deployment to the industry. Feedback may identify potential areas for improvement and further development. The Subject Matter experts were invited to review the latest project report documenting the methodology developed in the project and provide evaluations of the technical qualities of the proposed framework and relevant methods. The reviewed project report is “An Integrated Framework for Risk Assessment of High Safety-significant Safety-related Digital Instrumentation and Control Systems in Nuclear Power Plants: Methodology and Demonstration” INL/RPT-22-68656 (short as “INL/RPT-22-68656” in this report). This peer review report documents the technical questions provided for technical peer review and introduces the technical peer reviewers from the stakeholders including nuclear utilities, regulators, and universities. Comments from technical peer reviewers and the resolutions and responses to these comments are outlined. Insights and lessons learned from the technical peer review are summarized in conclusions and future work. The primary audience of this report are DI&C designers, engineers, and probabilistic risk assessment (PRA) practitioners. This includes stakeholders, such as the nuclear utilities and regulators who consider the deployment and upgrade of DI&C systems, DI&C software developers and reviewers, and cybersecurity specialists.
99 GENERAL AND MISCELLANEOUS↗
Quantitative evaluation of common cause failures in high safety-significant safety-related digital instrumentation and control systems in nuclear power plants
Digital instrumentation and control (DI&C) systems at nuclear power plants (NPPs) have many advantages over analog systems. They are proven to be more reliable, cheaper, and easier to maintain given obsolescence of analog components. However, they also pose new engineering and technical challenges, such as possibility of common cause failures (CCFs) unique to digital systems. Here this paper proposes a Platform for Risk Assessment of DI&C (PRADIC) that is developed by Idaho National Laboratory (INL). A methodology for evaluation of software CCFs in high safety-significant safety-related DI&C systems of NPPs was developed as part of the framework. The framework integrates three stages of a typical risk assessment—qualitative hazard analysis and quantitative reliability and consequence analyses. The quantified risks compared with respective acceptance criteria provide valuable insights for system architecture alternatives allowing design optimization in terms of risk reduction and cost savings. A comprehensive case study performed to demonstrate the framework's capabilities is documented here in this paper. Results show that the PRADIC is a powerful tool capable to identify potential digital-based CCFs, estimate their probabilities, and evaluate their impacts on system and plant safety.
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
2022 FORCE Development Status Update
Integrated energy systems (IESs) are essential for decarbonizing electricity and industrial sectors and fully exploiting these systems requires sophisticated planning, scheduling, and dispatching tools to maximize their socio-economic benefits. The Framework for Optimization of Resources and Economics (FORCE) is a tool suite developed at Idaho National Laboratory and is dedicated to making robust analyses of IESs easier for analysts and researchers. The report summarizes the improvements and updates to FORCE during the most recent development cycle. Particularly, we demonstrate improvements to user accessibility, stochastic time-series analysis, and vertical integration with the software tools provided in FORCE.
97 MATHEMATICS AND COMPUTING↗
2022 FORCE Development Status Update
Due to the rapidly changing nature of the energy landscape in both the U.S. and abroad, including the increase in non-dispatchable variable renewable energy (VRE) deployment and the abundance of carbonbased dispatchable fuels, the Integrated Energy Systems (IES) program under the Department of Energy (DOE) has been engaged in determining whether IES could assist in providing nuclear power plants (NPPs) with a viable strategy for achieving future economic competitiveness. This includes enhanced dispatch flexibility for NPPs, thanks to thermal and electrical storage technology as well as the generation of ancillary commodities such as hydrogen, desalinated water, and synthetic fuels from the heat generated by NPPs. The technical and economic viability of these systems is of primary concern to the IES program, with the intent of providing insight to the wider nuclear energy community at large.
97 MATHEMATICS AND COMPUTING↗
An Integrated Framework for Risk Assessment of High Safety Significant Safety-related Digital Instrumentation and Control Systems in Nuclear Power Plants: Methodology and Demonstration
This report documents the activities performed by Idaho National Laboratory (INL) during Fiscal Year (FY) 2022 for the U.S. Department of Energy (DOE) Light Water Reactor Sustainability (LWRS) Program, Risk Informed Systems Analysis (RISA) Pathway, digital instrumentation and control (DI&C) risk assessment project. In FY 2019, the RISA Pathway initiated a project to develop a risk assessment strategy for delivering a technical basis to support effective and secure DI&C technologies for digital upgrades/designs. A framework was proposed for this strategy, which aims to (1) provide a best-estimate, risk-informed capability to quantitatively and accurately estimate the risk impact of plant modernization, considering the introduction of high safety-significant safety-related (HSSSR) DI&C systems, (2) support and supplement existing risk-informed DI&C design guides by providing quantitative risk information and evidence, (3) offer a capability of design architecture evaluation of various DI&C systems, (4) assure the long-term safety and reliability of HSSSR DI&C systems, and (5) reduce uncertainty in costs and support integration of DI&C systems in the plant. To achieve these technical goals, the framework provides a means to address relevant technical issues by: (1) defining a risk-informed analysis process for DI&C upgrade, that integrates hazard analysis, reliability analysis, and consequence analysis, (2) applying risk-informed tools to address common cause failures (CCFs) and quantify corresponding failure probabilities for DI&C technologies, particularly software CCFs, (3) evaluating the impact of digital failures at the component level, system level, and plant level, and (4) providing insights and suggestions on designs to manage the risks, thus to support the development and deployment of advanced DI&C technologies on nuclear power plant (NPPs).
21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
An Integrated Risk Assessment Process of Safety-Related Digital I&C Systems in Nuclear Power Plants
Upgrading the existing analog instrumentation and control (I&C) systems to state-of-the-art digital I&C (DI&C) systems will greatly benefit existing light water reactors. However, the issue of software common cause failure (CCF) remains an obstacle in terms of qualification for digital technologies. Existing analyses of CCFs in I&C systems mainly focus on hardware failures. With the application and upgrading of new DI&C systems, design flaws could cause software CCFs to become a potential threat to plant safety, considering that most redundancy designs use similar digital platforms or software in their operating and application systems. With complex multilayer redundancy designs to meet the single failure criterion, these I&C safety systems are of particular concern in U.S. Nuclear Regulatory Commission licensing procedures. In Fiscal Year 2019, the Risk-Informed Systems Analysis (RISA) Pathway of the U.S. Department of Energy’s Light Water Reactor Sustainability Program initiated a project to develop a risk assessment strategy for delivering a strong technical basis to support effective, licensable, and secure DI&C technologies for digital upgrades and designs. An integrated risk assessment for the DI&C process was proposed for this strategy to identify potential key digital-induced failures, implement reliability analyses of related digital safety I&C systems, and evaluate the unanalyzed sequences introduced by these failures (particularly software CCFs) at the plant level. Here this paper summarizes these RISA efforts in the risk analysis of safety-related DI&C systems at Idaho National Laboratory.
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Failure Mechanism Traceability and Application in Human System Interface of Nuclear Power Plants using RESHA
In recent years, there has been considerable effort to modernize existing and new nuclear power plants with digital instrumentation and control systems (DI&C). However, there has also been considerable concern both by industry and regulatory bodies for the risk and consequence analysis of these systems. Of particular concern are digital common cause failures (CCFs) specifically related to software defects. These “misbehaviors” by the software can occur in both the control and monitoring of a system. While many new methods have been proposed to identify potential software failure modes, such as Systems-theoretic Process Analysis (STPA), Hazard and Consequence Analysis for Digital Systems (HAZCADS), etc., these methods are focused primarily on the control action pathway of a system. In contrast, the information feedback pathway lacks unsafe control actions (UCAs), which are typically related to software basic events; thus, assessment of software basic events in such systems is unclear. In this work, we present the idea of intermediate processors and unsafe information flow (UIF) to help safety analysts trace failure mechanisms in the feedback pathway and how they can be integrated into a fault tree for improved assessment capability. The concepts presented are demonstrated in two comprehensive case studies, a smart sensor integrated platform for unmanned autonomous vehicles and another on a representative advanced human system interface (HSI) for safety critical plant monitoring. The qualitative software basic events are identified, and a fault tree analysis is conducted based on a modified Redundancy-guided Systems-theoretic Hazard Analysis (RESHA) methodology. The case studies demonstrate the use of UIF and intermediate processors in the fault tree to improve traceability of software failures in highly complex digital instrumentation feedback. The improved method can also clarify fault tree construction when multiple component dependencies are present in the system.
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Application of Orthogonal Defect Classification for Software Reliability Analysis
The modernization of existing and new nuclear power plants with digital instrumentation and control systems (DI&C) is a recent and highly trending topic. However, there lacks strong consensus on best-estimate reliability methodologies by both the United States (U.S.) Nuclear Regulatory Commission (NRC) and the industry. This has resulted in hesitation for further modernization projects until a more unified methodology is realized. In this work, we develop an approach called Orthogonal-defect Classification for Assessing Software Reliability (ORCAS) to quantify probabilities of various software failure modes in a DI&C system. The method utilizes accepted industry methodologies for software quality assurance that are also verified by experimental or mathematical formulations. In essence, the approach combines a semantic failure classification model with a reliability growth model to predict (and quantify) the potential failure modes of a DI&C software system. The semantic classification model is used to address the question: How do latent defects in software contribute to different software failure root causes? The use of reliability growth models is then used to address the question: Given the connection between latent defects and software failure root causes, how can we quantify the reliability of the software? A case study was conducted on a representative I&C platform (ChibiOS) running a smart sensor acquisition software developed by Virginia Commonwealth University (VCU). The testing and evidence collection guidance in ORCAS was applied, and defects were uncovered in the software. Qualitative evidence, such as condition coverage, was used to gauge the completeness and trustworthiness of the assessment while quantitative evidence was used to determine the software failure probabilities. The reliability of the software was then estimated and compared to existing operational data of the sensor device. It is demonstrated that by using ORCAS, a semantic reasoning framework can be developed to justify if the software is reliable (or unreliable) while still leveraging the strength of the existing methods.
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Failure Mechanism Traceability and Application in Human System Interface of Nuclear Power Plants using RESHA
In recent years, there has been considerable effort to modernize existing and new nuclear power plants with digital instrumentation and control systems (DI&C). However, there has also been considerable concern both by industry and regulatory bodies for the risk and consequence analysis of these systems. Of particular concern are digital common cause failures (CCFs) specifically related to software defects. These “misbehaviors” by the software can occur in both the control and monitoring of a system. While many new methods have been proposed to identify potential software failure modes, such as Systems-theoretic Process Analysis (STPA), Hazard and Consequence Analysis for Digital Systems (HAZCADS), etc., these methods are focused primarily on the control action pathway of a system. In contrast, the information feedback pathway lacks unsafe control actions (UCAs), which are typically related to software basic events; thus, assessment of software basic events in such systems is unclear. In this work, we present the idea of intermediate processors and unsafe information flow (UIF) to help safety analysts trace failure mechanisms in the feedback pathway and how they can be integrated into a fault tree for improved assessment capability. The concepts presented are demonstrated in two comprehensive case studies, a smart sensor integrated platform for unmanned autonomous vehicles and another on a representative advanced human system interface (HSI) for safety critical plant monitoring. The qualitative software basic events are identified, and a fault tree analysis is conducted based on a modified Redundancy-guided Systems-theoretic Hazard Analysis (RESHA) methodology. The case studies demonstrate the use of UIF and intermediate processors in the fault tree to improve traceability of software failures in highly complex digital instrumentation feedback. The improved method can also clarify fault tree construction when multiple component dependencies are present in the system.
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Common Cause Failure Evaluation of High Safety-significant Safety-related Digital Instrumentation and Control Systems
Digital instrumentation and control (DI&C) systems in nuclear power plants (NPPs) have many advantages over analog systems but also pose different engineering and technical challenges, such as potential threats due to common cause failures (CCFs). This paper proposes a Platform for Risk Assessment of DI&C (PRADIC) developed by Idaho National Laboratory for dealing with potential software CCFs in DI&C systems of NPPs. The methodology development of PRADIC on the quantitative evaluation of software CCFs in high safety-significant safety-related DI&C systems in NPPs is illustrated in this paper. In PRADIC, qualitative hazard analysis and quantitative reliability and consequence analysis are successively implemented to obtain quantitative risk information, compare with respective risk evaluation acceptance criteria, and provide suggestions for risk reduction and design optimization. A comprehensive case study was also performed and documented in this paper. Results show that PRADIC can effectively identify potential digital-based CCFs, estimate their failure probabilities, and evaluate their impacts to system and plant safety.
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Application of Orthogonal Defect Classification for Software Reliability Analysis
The modernization of existing and new nuclear power plants with digital instrumentation and control systems (DI&C) is a recent and highly trending topic. However, there lacks strong consensus on best-estimate reliability methodologies by both the United States (U.S.) Nuclear Regulatory Commission (NRC) and the industry. This has resulted in hesitation for further modernization projects until a more unified methodology is realized. In this work, we develop an approach called Orthogonal-defect Classification for Assessing Software Reliability (ORCAS) to quantify probabilities of various software failure modes in a DI&C system. The method utilizes accepted industry methodologies for software quality assurance that are also verified by experimental or mathematical formulations. In essence, the approach combines a semantic failure classification model with a reliability growth model to predict (and quantify) the potential failure modes of a DI&C software system. The semantic classification model is used to address the question: How do latent defects in software contribute to different software failure root causes? The use of reliability growth models is then used to address the question: Given the connection between latent defects and software failure root causes, how can we quantify the reliability of the software? A case study was conducted on a representative I&C platform (ChibiOS) running a smart sensor acquisition software developed by Virginia Commonwealth University (VCU). The testing and evidence collection guidance in ORCAS was applied, and defects were uncovered in the software. Qualitative evidence, such as condition coverage, was used to gauge the completeness and trustworthiness of the assessment while quantitative evidence was used to determine the software failure probabilities. The reliability of the software was then estimated and compared to existing operational data of the sensor device. It is demonstrated that by using ORCAS, a semantic reasoning framework can be developed to justify software reliability (or unreliability) while still leveraging the strength of the existing methods.
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
An Application of a Modified Beta Factor Method for the Analysis of Software Common Cause Failures
This paper presents an approach for modeling software common cause failures (CCFs) within digital instrumentation and control (I&C) systems. CCFs consist of a concurrent failure between two or more components due to a shared failure cause and coupling mechanism. This work emphasizes the importance of identifying software-centric attributes related to the coupling mechanisms necessary for simultaneous failures of redundant software components. The groups of components that share coupling mechanisms are called common cause component groups (CCCGs). Most CCF models rely on operational data as the basis for establishing CCCG parameters and predicting CCFs. This work is motivated by two primary concerns: (1) a lack of operational and CCF data for estimating software CCF model parameters; and (2) the need to model single components as part of multiple CCCGs simultaneously. A hybrid approach was developed to account for these concerns by leveraging existing techniques: a modified beta factor model allows single components to be placed within multiple CCCGs, while a second technique provides software-specific model parameters for each CCCG. This hybrid approach provides a means to overcome the limitations of conventional methods while offering support for design decisions under the limited data scenario.
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Exploring Advanced Computational Tools and Techniques with Artificial Intelligence and Machine Learning in Operating Nuclear Plants
This report presents the project Idaho National Laboratory conducted for Nuclear Regulatory Commission to explore the advanced computational tools and techniques, such as artificial intelligence (AI) and machine learning (ML), for operating nuclear plants. The report reviews the nuclear data sources, with the focus on the operating experience data, that could be applied by advanced computational tools and techniques. Plant-specific and generic (national and international) data from different sources are described. The report describes the relationships between statistics and AI/ML and then introduces the most widely used AI/ML algorithms in both supervised and unsupervised learning. The report reviews the recent applications of advanced computational tools and techniques in various fields of nuclear industry, such as reactor system design and analysis, plant operation and maintenance, and nuclear safety and risk analysis. Finally, the report presents the insights from the project on the potential applicability of AI/ML techniques in improving advanced computational capabilities, how the advanced tools and techniques could contribute to the understanding of safety and risk, and what information would be needed to provide meaningful insights to decision makers. The report also documents an NRC survey on the current state of commercial nuclear power operations relative to the use of AI and ML tools as well as the role of AI/ML tools in nuclear power operations was published by the NRC as in FRN NRC-2021-0048 in April 2021. A summary of the survey including the survey questions, survey participants, survey responses, and the conclusions and insights derived from the survey is provided in the report. Finally, the report investigates potential applications of using AI/ML in operating NPPs and advanced reactors (both advanced LWRs and advanced NLWRs) to improve nuclear plant safety and efficiency. Three main application fields are defined and discussed: (1) plant safety and security assessments; (2) plant degradation modeling, fault and accident diagnosis and prognosis; and (3) plant operation and maintenance efficiency improvement.
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Catalase protects against nonenzymatic decarboxylations during photorespiration in Arabidopsis thaliana
Abstract Photorespiration recovers carbon that would be otherwise lost following the oxygenation reaction of rubisco and production of glycolate. Photorespiration is essential in plants and recycles glycolate into usable metabolic products through reactions spanning the chloroplast, mitochondrion, and peroxisome. Catalase in peroxisomes plays an important role in this process by disproportionating H 2 O 2 resulting from glycolate oxidation into O 2 and water. We hypothesize that catalase in the peroxisome also protects against nonenzymatic decarboxylations between hydrogen peroxide and photorespiratory intermediates (glyoxylate and/or hydroxypyruvate). We test this hypothesis by detailed gas exchange and biochemical analysis of Arabidopsis thaliana mutants lacking peroxisomal catalase. Our results strongly support this hypothesis, with catalase mutants showing gas exchange evidence for an increased stoichiometry of CO 2 release from photorespiration, specifically an increase in the CO 2 compensation point, a photorespiratory‐dependent decrease in the quantum efficiency of CO 2 assimilation, increase in the 12 CO 2 released in a 13 CO 2 background, and an increase in the postillumination CO 2 burst. Further metabolic evidence suggests this excess CO 2 release occurred via the nonenzymatic decarboxylation of hydroxypyruvate. Specifically, the catalase mutant showed an accumulation of photorespiratory intermediates during a transient increase in rubisco oxygenation consistent with this hypothesis. Additionally, end products of alternative hypotheses explaining this excess release were similar between wild type and catalase mutants. Furthermore, the calculated rate of hydroxypyruvate decarboxylation in catalase mutant is much higher than that of glyoxylate decarboxylation. This work provides evidence that these nonenzymatic decarboxylation reactions, predominately hydroxypyruvate decarboxylation, can occur in vivo when photorespiratory metabolism is genetically disrupted.
59 BASIC BIOLOGICAL SCIENCES↗
TEAL Output Visualization
Tool for Economic Analysis (TEAL) is an open-source economics calculation package written and maintained by Idaho National Laboratory (INL). As a plugin of the Risk Analysis Virtual ENvironment (RAVEN), TEAL provides economics analysis models to RAVEN workflow users. In addition, TEAL is used in other RAVEN plugins such as LOGOS and the Holistic Energy Resource Optimization Network (HERON) to complement other analyses with economic calculations. This report documents the efforts in developing the capability of TEAL output visualization for users to better understand and investigate TEAL simulation results. In the past, outputs (e.g., various cash flows) were generated and printed to screen. According to the need and purpose for visualization, users can select various bar charts and donut charts to visualize the cash flows including inflows, outflows, and net cash flows in each year or in a selected time range, in addition to observing data stored in comma-separated value files (CSVs). The visualization capability is flexible and user-friendly by introducing several user-defined parameters, for instance, the start and the end project year of interest and the type of colors to be assigned to the cash flows.
29 ENERGY PLANNING, POLICY, AND ECONOMY↗
A Bayesian and HRA-Aided Method for the Novel Reliability Analysis of Software
Technological advancements and nuclear power plant modernization has inspired considerable research in the areas of safety and reliability, yet there remains a lack of consensus for the reliability assessment of digital instrumentation and control (I&C) systems. Motivated by the lack of consensus for reliability analysis methods, this work employs a novel framework that incorporates Bayesian, human reliability, and common-cause failure (CCF) modeling techniques. The novel framework allows the use of state-of-the-art or classical modeling techniques when accounting for human and CCF effects on system reliability. The Bayesian and HRA-Aided Method for the Reliability Analysis of Software (BAHAMAS) is demonstrated by a case study for the quantification of software hazards found in a previous analysis of a digital reactor trip system. The results demonstrate the ability of BAHAMAS to account for human activities during the software development life cycle and their influence on software reliability. BAHAMAS is a flexible tool for extending the coverage of conventional probabilistic risk assessments to include modernized digital I&C systems.
22 GENERAL STUDIES OF NUCLEAR REACTORS↗