The control of a nuclear reactor using helium- 3 gas control elements
Control system for water moderated reactor using helium-3 gas
WATER MODERATED REACTOR↗
SEARCH · Search NASA
Results for “REACTOR CONTROL SYSTEMS”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Computer Security for I and C Systems at Nuclear Facilities - 116
Cyber-attacks on Instrumentation and Control (I and C) systems may jeopardize the safety and security of nuclear facilities by contributing to sabotage or aiding in the unauthorized removal of nuclear material. The effects of cyber-attacks on I and C systems important to safety to safety may result in a wide range of consequences, such as a temporary loss of process control or unacceptable radiological consequences. Public awareness of cyber-attacks that affect I and C systems may also undermine confidence in the safety and security of nuclear facilities. The International Atomic Energy Agency (IAEA) recognizes the need for the guidance on the protection of I and C systems that provide safety, security, or auxiliary functions at nuclear facilities from cyber-attacks. To meet this need, The IAEA has developed a new Nuclear Security Series publication with the provisional title Computer Security of Instrumentation and Control Systems at Nuclear Facilities which builds upon and expands the guidance published in Nuclear Security Series No. 17 Computer Security at Nuclear Facilities (2011) . This publication will be formally released in 2017 as Technical Guidance and will be the second international consensus publication dedicated to Computer Security at Nuclear Facilities. It was developed in parallel with the new IAEA Nuclear Safety publications providing recommendations on I and C systems at research reactors (RR) and nuclear power plants (NPP) . The purpose of this paper is to provide an overview of this publication and its application. The paper will also discuss its relation to other IAEA Nuclear Security Series (NSS) publications on computer security. (authors)
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Supervisory Control System for Multi-Modular Advanced Reactors
The proposed supervisory control system (SCS) may provide considerable benefits to advanced small modular reactors, including reduced plant staffing, optimized maintenance activities, greater plant availability, and higher operating efficiency. The SCS makes risk-informed decisions based on (1) a probabilistic assessment of the likelihood of success given the status of the plant/systems and component health, and (2) a deterministic assessment between plant operating parameters and reactor protection parameters to prevent unnecessary trips and challenges to plant safety system—one measure of SCS success. The probabilistic portion of the decision-making engine of the SCS is based on the control actions associated with an advanced liquid-metal reactor (ALMR) Power Reactor, Innovative, Small Module (PRISM). Within the SCS, the probabilistic assessment provides a ranking of viable control actions; however, certain instructions generated by the probabilistic model only include an abstract notion of action without specifications. For instance, one instruction may be to reduce power without specifying how much reduction is needed. The prognostic/diagnostic models incorporate the health of components into the decision-making process. Once the control options are identified and ranked based on the likelihood of success, the SCS transmits the options to the deterministic portion of the platform. The performance-based system models assess and rank each of the probabilistically identified control actions by taking into account the physical behavior (current and projected) of the system. The performance-based decision making module receives inputs from the probabilistic decision-making module and the ERM module to generate a single solution. Interfaces to these modules are defined later in the section. A utility theory algorithm factors into the decision making by estimating the distance from and approach to a trip setpoint for each control option. If the magnitude of a negative utility value increases rapidly as the system approaches the trip setpoint, that option is not likely to be the preferred option. This can lead to a re-ranking of the control options. The SCS then transmits a control signal(s) to a component or system and informs the operator of actions taken based on the action chosen. The SCS successfully coupled probabilistic and performance-based system models to arrive at optimal control decisions based on the actual status of the plant and components. The automatic, autonomous, and real-time performance requirements for a control system were met by the SCS. The value of coupling probabilistic and performance-based system models was demonstrated by the re-ranking of control options based on the use of a utility algorithm. The use of ERM monitors provides added value to the SCS as demonstrated by the re-ranking of control options based on a components degraded state.
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Model-based verification of I and C specifications - 184
In the field of nuclear I and C (Instrumentation and Control), the late detection of errors in the specifications and the design of I and C has a strong impact in terms of time and money. The early verification in the V cycle of I and C functions is a key issue to capture inconsistencies and errors before the implementation and on-site tests. EDF, in the framework of the collaborative project CONNEXION, has investigated methods based on simulation to formalize I and C requirements and to evaluate them at the conceptual and basic design phases. Behavioral models of the physic parts of the system and I and C functions, described as functional diagrams, are co-simulated in an integration environment based on the FMI (Functional Mockup Interface) standard. In this specific environment, test scenarios are performed on these models. These scenarios are defined on the basis of a high level model of the studied system that takes into account the states to cover (in normal and degraded situations). Requirements, once formalized, are translated into observers that evaluate their fulfillment during the simulations. Simulation logs are then a tool for the designer to analyze the causes of the possible non-fulfillment of requirements and to fix the corresponding errors in the specifications. The proposed methodology enables to detect errors in the specifications of I and C functions, to generate automatically functional test scenarios taking into account the coverage of the requirements and all the different operational modes of the system. (authors)
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Human factors and modeling methods in the development of control room modernization concepts - 315
Control room modernization is one of the most challenging and complex upgrade projects that a nuclear power plant can undertake. It can even have a bigger impact on operations than, for example, turbine replacement. The challenges of migrating an analog control system to a distributed control system are already well known and a number of nuclear utilities have embarked upon various levels of effort to upgrade some of the systems in the control room. When planning for control room upgrades, plants have to deal with a multitude of engineering and operational impacts. This will inevitably include several human factors considerations, including physical ergonomics of workstations, viewing angles, lighting, seating, new communication requirements, and new concepts of operation. In helping nuclear power utilities to deal with these challenges, the Idaho National Laboratory (INL) has developed human factors design and evaluation methods to be used in the development of an end-state control room concept and to manage the various phases of the upgrade life cycle. This included interactive sessions with operators in INL's Human System Simulation Laboratory, and three-dimensional modeling to visualize control board changes. To make the various upgrade phases as concrete and as visible as possible, the end-state concept includes a set of visual representations of the control room before and after various upgrade phases to provide the context and a framework within which to consider the various options in the upgrade. This includes the various control systems, human-system interfaces to be replaced, and possible changes to operator workstations. This paper describes how this framework helps to ensure an integrated and cohesive outcome that is consistent with human factors engineering principles and also provide substantial improvement in operator performance. The paper further describes the application of this integrated approach in the strategic modernization program at a nuclear power plant where legacy systems are upgraded to advanced digital technologies through a systematic process that links human factors principles to the systems engineering process. This approach results in an integrated control room architecture beyond what is possible for individual subsystem upgrades alone. (authors)
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Common cause failure (CCF): a path to quantitative success - 134
In the development of I and C systems for nuclear plants it is critical to validate a defense in depth strategy through a thorough and complete reliability analysis program. An emerging issue is how to define and use a quantitative estimation of CCF in a system analysis. Industry standards provide insight but not necessarily a comprehensive approach. One solution is to leverage existing modeling techniques with a unique insertion of CCF probabilities. A relatively simple approach will be provided using reliability block diagrams. Three specific areas that will be explored include: 1. Definition of hardware CCF; 2. Quantitative estimation in a simple system; 3. Quantitative estimation in a complex system. (authors)
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
A dynamic model of once-through steam generator (OTSG) for prototypical advanced reactor - 374
new design of Small Modular Reactor, the Prototypical Advanced Reactor (PAR), features two sodium primary systems each connected to dedicated steam generators (SGs) and sharing a balance of plant (BOP) system. PAR adopts once-through steam generators (OTSG) for its compact structure. The existence of superheated steam in a OTSG improves turbine design by eliminating the need of bulky moisture separator in SG. The two cores and SGs' design enable PAR to adjust power flexibly, as a result, introduce more challenges to the control. Therefore, a fast simulation model with high accuracy OTSG model is needed. In this paper, a dynamic model is built for OTSG of PAR based on the conservation of mass, momentum, and energy. The OTSG is simulated as lumped pipe and divided into subcooled, evaporating, and superheated regions by moving boundaries. SIMULINK is adopted to this OTSG simulation to be merged into existing PAR system models easily. The steady state results show that key parameters are rational. The 5% step increase of feedwater enthalpy transient demonstrates that the model is capable to respond to the perturbations. Since the basic laws and algebraic method used in this paper are suitable for other fluids, the model can be easily applied to any other OTSG. Future work will also focus on model optimization, merging and improved control. The final aim is to perform full scope realtime simulations for PAR under normal operational transients. (authors)
21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
Toward biologically inspired self healing digital embedded devices: BIO-SymPle - 388
One of the more interesting concepts being postulated for next gen power plants, is the notion of highly resilient and survivable I and C systems. While resilience and survivability are 'cross system attributes', resilience and robustness will rely on highly robust and fault resilient devices as a foundation. This paper presents a new self-healing digital I and C architecture inspired by the operation of two biological concepts: human immune system and embryonic stem cells. The purpose of this research is look at different bio-inspired paradigms for organizing system functions so that they become inherently resilient due to device organization and behaviors. Our current proposed approach (called BIO-SymPle) is organized in two levels: critical service layer, which is providing the intended service of critical application, and healing layer, that supervises the operation of all repair mechanisms. To facilitate coordination, organized behavior among cells we employ network-based topology structures which is comprised of four active cells, four pre-generated redundant cells, and one embryonic stem cell. Collectively, the ensemble represents the building block that executes the local functionality based on the expression for DNA genetic codes stored inside each cell. The four bio-operational active cells are protected by their neighboring spare cells that imitate how white blood cells are distributed around the antigens in their locations. Ultimately, the proposed multi-layer architecture is able to cover a significant number of coincident faults and we believe architectures like BIO-SymPLe can positively impact the next generation digital I and C system. (authors)
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Common Cause Failure Mitigation Experience on Digital I and C System in NPP
CCF is failures of redundant or separate structures, systems, or components due to a shared root cause. The CCF includes those are resulted from severe environments, design errors, calibration and maintenance errors, and consequential failures. In addition, digital I and C systems can be vulnerable to CCF caused by software errors or software developed logic, which could defeat the redundancy achieved by the hardware architecture. Therefore, diversity and defense in-depth (D3) has become an important issue to overcome the CCF of the safety I and C system. The U.S. NRC has established regulatory guidance addressing a method for assessing D3 provided by the safety I and C system architecture at a NPP. This method enables determination of whether vulnerabilities to CCF have been adequately addressed. The guidance is included in BTP 7-19 and Chapter 7 of NUREG-0800. The regulatory guidance provides a methodology for designing diversity. APR1400 establishes the mitigating strategies that consider the characteristics of digital I and C system that contribute to the potential for CCF. The diversity strategies consist of a combination of diversity attributes and associated criteria to address potential CCF vulnerabilities in digital safety I and C system. (authors)
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
SymPLe 1131: A novel architectural solution for the realization of verifiable digital I and C systems and embedded digital devices - 387
One of the main reasons for the increasing popularity of FPGAs in embedded systems and digital I and C systems is that they provide many of the advantages from both hardware and software components. FPGAs provide configurability approaching that of SW, while at the same time delivering deterministic behavior of pure hardware solutions. However, with regard to Software Common Cause Failures (CCF), the use of FPGAs in digital I and C platforms should not be seen as plug-in remedy for reduction or elimination of CCF. To address CCF, we argue that it is not enough to manage the complexity of an I and C device or system, but we must also have the ability to constrain complexity (as needed) and rigorously reason about execution and device functionality. This paper presents the work done regarding an FPGA overlay architecture called SymPLe. SymPLe is designed to reduce the gap between software and hardware approaches for digital I and C systems and increases deterministic behavior and verifiability of the application, architecture and safety-critical system while reasoning about CCF. (authors)
46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
IEC 62859: A new international standard on the coordination between safety and cybersecurity for nuclear I and C systems - 160
Cybersecurity requirements and controls for digital I and C systems are increasingly added to well-established safety-oriented provisions. Interactions and potential side-effects are possible and must be mastered, taking into account the nuclear I and C system specificities as well as their normative and regulatory contexts. The new international standard IEC 62859 'Nuclear power plants - Instrumentation and control systems - Requirements for coordinating safety and cyber security' aims to optimize the integration of cybersecurity provisions in nuclear I and C architecture and systems, to prevent conflicts between safety and cybersecurity provisions, and to aid the identification and the leveraging of the potential synergies between safety and cybersecurity. The paper presents the structure and the key aspects of this standard. IEC 62859 is structured along three main sections: one dealing with the overall I and C architecture, a second one focusing on the system level, a third one dealing with organizational and procedural issues. The paper also discusses related work in the nuclear industry, and in other sectors. (authors)
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Development of programmable logic in a rapid, automated, and repeatable fashion for safety-related applications - 385
Digital safety platform considerations for power plant modernization or new build efforts involve a burdensome task of implementing a large number of software-based functions onto a designated platform to match the plant's architecture. This problem is not unique to any particular safety-related platform solution, but is prevalent across the landscape of current Qualified and Licensed Safety-related Instrumentation and Control (I and C) Solutions. As an example when implementing a RG 1.97 compliant Post Accident Monitoring System (PAMS) solution with the Lockheed Martin Nuclear Protection and Control (NuPAC) safety platform, 72 unique software loads are needed to configure the Qualified Display System (QDS). Large scale development and customization efforts to upgrade existing plant functions or systems require the licensee to assume the cost and technical risk necessary to undergo a digital based upgrade. Often the cost, schedule, and technical risk outweighed the benefit of modernization efforts due to the unknown hurdles and past projects that overran cost and schedule projections. Lockheed Martin's Engineering Production Suite (EPS) minimizes the licensee risk and expense associated with modernization efforts through a developer's toolkit for rapid, automated, and repeatable development of Programmable Logic used to implement plant functions and architectures for use on the Lockheed Martin NuPAC platform. This paper describes a use case where by EPS can create system level representations, simulate system functions, partition logic designs to accommodate hardware constraints through logic partitioning, automate the assembly of Application Specific Programmable Logic (ASPL), generate system test cases, program the NuPAC hardware, and perform testing throughout the design workflow. (authors)
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Virtualized hardware environments for supporting digital I and C verification - 324
The technology of virtualized hardware testing platforms within the nuclear context in order to provide a framework for evaluating virtualized hardware/software approaches is discussed. To understand the applicability of virtualized hardware approaches, we have developed a virtual hardware model of an actual smart sensor using the Imperas product OVPsim development environment, as is seen in . An evaluation of the modeling effort required to create the digital I and C smart sensor is provided, followed by an analysis and findings on the various tools in the OVPsim environment for supporting testing, evidence collecting, and analysis. The analyzed tools include traditional input/output testing, model-based testing, mutation testing, and fault injection techniques. Finally, the goal of this research effort is to analyze virtual hardware platforms and present findings to the nuclear community on the efficacy and viability of this technology as a complementary means to actual hardware-in-the-loop testing Factory Acceptance Testing for Nuclear Power Plant (NPP) digital I and C systems. (authors)
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Analysis of, and defense against, spurious actuations and other incorrect behaviors of digital control systems - 390
Modern digital instrumentation and control (I and C) systems offer nearly unlimited functional capability. However, the complexity of their design (including their system software and application software) is significantly higher than that of conventional, hardwired systems, to the point that it is generally impossible to demonstrate that there are no residual design errors, even when the best development and verification techniques have been applied. When activated by specific conditions, design errors could result in systematic failures, i.e., failures that occur deterministically each time and wherever an activating condition is present. Redundancy could be defeated when the same design error affects multiple channels or systems, and the activating condition affects several of these channels or systems. In the case of safety I and C systems, most of the functions are poised protection functions that must be actuated when and only when a demand situation occurs in the plant. In nuclear power plants, the most dangerous failure mode for such functions generally is failure to actuate, and many measures are taken to protect from such failure mode. This paper considers the other failure modes of safety I and C functions, and also the failure modes of the other I and C functions that are less important to safety. It is not limited to poised functions, and considers other types of functions such as regulation functions or human interface functions. It proposes a framework for analyzing and providing defense against spurious actuations and other incorrect behaviors from digital I and C systems directly interacting with the plant process or with operators: these might be useful for example to justify that design bases for reactor protection are adequate, or to ensure plant performance and availability. (authors)
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Demonstrating and argumenting safety of I and C systems - Challenges and recent experiences - 180
Nuclear licensees are required to submit a documented justification of the safety of the plant and its systems to the local regulatory body. Developing this documentation is a hard task and requires a lot of effort from several stakeholders. It should be understandable, transparent, convincing and complete. Observations from the current practice indicate that the nuclear power industry would benefit from more structured, systematic and harmonized practices in engineering instrumentation and control (I and C) systems and justifying their safety. This paper describes recently recognized challenges in demonstrating the safety of digital I and C systems and suggests possible ways to solve them. Some of the proposed solutions are light improvements in the everyday documentation practices, working methods and utilization of computerized support tools, while others would involve fundamental changes in the design and documentation philosophy that are more demanding to implement. (authors)
46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
Development of a new IEC Standard on cybersecurity controls for I and C in Nuclear Power Plants - IEC 63096 - 158
Standards are promoting the enhancement of cybersecurity in Nuclear Power Plants (NPP). Standardizing processes and procedures are also crucial to achieve successful international collaboration. Many information security standards were developed in recent years; however, not many of them could be directly applied to NPPs. This paper provides an overview of the development of a new cybersecurity standard dealing with cybersecurity controls for nuclear power plants around the world. For I and C systems in NPPs, the new IEC 63096 standard targeted for issue in 2019, focuses specifically on the selection and application of cybersecurity controls from the included security controls catalogue. The role of selected and applied cybersecurity controls is to prevent, detect and react to digital attacks against computer-based I and C systems. This standard applies to the I and C of new nuclear power plants and to the I and C modernization in existing plants. It is being prepared and based on IEC 62645 , ISO/IEC 27000 series , IAEA , and country specific guidance in this expanding the technical and the security focus area. The Standard is intended to be used by designers and operators of NPPs (utilities), systems evaluators, vendors and subcontractors, and by licensors. While the development of international standards is essential it is also a lengthy process, taking multiple years. Especially with regard to cybersecurity, all involved stakeholders have to collaborate. (authors)
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Risk informed cyber security for nuclear power plants - 342
Nuclear power plants are increasingly adding digital components for plant operation, safety, and security. These digital components fill a gap with legacy equipment where replacement components no longer exist. They also benefit operation of the plant by increasing efficiency in power generation, monitoring of equipment and plant parameters, as well as aiding operator control. However, the addition of digital components and systems also adds cyber risks with previously unanalyzed failure modes and attack vectors are introduced with these new systems. These risks are difficult to identify, analyze, and mitigate due to the increasingly complex nature of the digital components and the integration of these components with additional plant processes and communication networks. The research presented in this paper develops a new method that addresses the cyber risk to inform appropriate levels of protection. EPRI and Sandia are working under a Cooperative Research and Development Agreement to develop an effective method of evaluating the cyber risk in production nuclear power facilities. The Cyber Hazards Analysis Risk Methodology (CHARM) focuses on ensuring adequate controls are in place for appropriate cyber protection of the plant from radiological release or generation risk. Existing plant hazards analyses (e.g., PRA, FTA) do not account for software deficiencies or adversarial intent. This method leverages existing plant analyses and MIT's Systems Theoretic Process Analysis (STPA) to create cyber informed fault trees. These new fault trees will provide the basis for comprehensive cyber risk analysis and help ensure potential gaps in cyber security controls are identified and corrected. (authors)
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Development of a bayesian belief network model for the software reliability assessment of nuclear digital I and C safety systems - 206
Since the digital instrumentation and control systems are expected to play an important role for the safety systems in nuclear power plants (NPPs), the need has emerged to not only establish a basis for incorporating software behavior into digital I and C system reliability models, but also to quantify the failure probability of the software used in NPP digital protection systems. In this study, a Bayesian belief network (BBN) model is developed to quantitatively assess software reliability by estimating the number of faults in a software program considering its software development life cycle (SDLC). The model structure and parameters are established based on the information applicable to NPP safety-related systems and the evidence used to construct and quantify the BBN model was collected from three stages of expert elicitation. The software failure probability is estimated from the number of residual defects in a software program at the end of SDLC phase. As a case study, the BBN model was applied to quantify the software reliability of a typical digital protection software having the size of 50 function points and having the Medium development and validation and verification (V and V) qualities. The developed model can be applied to estimate the failure probability for both developing and deployed safety-related NPP software, and such results can be used to evaluate the quality of the digital I and C systems in addition to estimating potential reactor risk due to software failure. (authors)
22 GENERAL STUDIES OF NUCLEAR REACTORS↗