A Redundancy-Guided Approach for the Hazard Analysis of Digital Instrumentation and Control Systems in Advanced Nuclear Power Plants

Abstract

Digital instrumentation and control (I&C) upgrades are a vital research area for nuclear industry. Despite their performance benefits, deployment of digital I&C in nuclear power plants (NPPs) has been limited. Digital I&C systems exhibit complex failure modes including common cause failures (CCFs) which can be difficult to identify. This paper describes the development of a redundancy-guided application of the Systems-Theoretic Process Analysis (STPA) and Fault Tree Analysis (FTA) for the hazard analysis of digital I&C in advanced NPPs. The resulting Redundancy-guided System-theoretic Hazard Analysis (RESHA) is applied for the case study of a representative state-of-the-art digital reactor trip system. The analysis qualitatively and systematically identifies the most critical CCFs and other hazards of digital I&C systems. Ultimately, RESHA can help researchers make informed decisions for how, and to what degree, defensive measures such as redundancy, diversity, and defense-in-depth can be used to mitigate or eliminate the potential hazards of digital I&C systems.

Uncertainty quantification and software risk analysis for digital twins in the nearly autonomous management and control systems: A review

“…(1) framing the complexity of the redundancy problem in a detailed representation; (2) clarifying the redundancy level using FTA before applying STPA; (3) building a redundancy-guided multilayer control structure; and (4) locating software CCFs for different levels of redundancy. This approach has been demonstrated and applied for the hazard analysis of a four-division digital RTS [86] and a four-division, digital, engineered safety features-actuation system [87].…”

Systems-Theoretic Hazard Analysis of Digital Human-System Interface Relevant to Reactor Trip

“…Building upon the HAZCADS methodology, Idaho National Laboratory (INL) created redundancyguided systems-theoretic hazard analysis (RESHA) [13][14][15] to further address and clarify issues and potential sCCF across multiple redundant components. INL developed and demonstrated RESHA under a project initiated by the Risk-Informed Systems Analysis Pathway of the U.S. Department of Energy's Light Water Reactor Sustainability Program [16,17]. The aim of the project is to develop a strong technical basis for risk assessment strategies to support effective, reliable, and licensable DI&C technologies.…”

Integrated Risk Assessment of Digital I&C Safety Systems for Nuclear Power Plants

“…(3) building a redundancy-guided multilayer control structure; and (4) locating software CCFs for different levels of redundancy. This approach has been demonstrated and applied for the hazard analysis of a four-division digital RTS (Shorthill, et al 2020) and a four-division, digital, engineered safety features actuation system (Bao, Shorthill and Zhang, Hazard Analysis for Identifying Common Cause Failures of Digital Safety Systems using a Redundancy-Guided Systems-Theoretic Approach 1 December 2020).…”

“…Portions of FT for RTS and ESFAS failures with software failures are displayed in Figure 3. More details can be found in (Bao, Shorthill and Zhang, Hazard Analysis for Identifying Common Cause Failures of Digital Safety Systems using a Redundancy-Guided Systems-Theoretic Approach 1 December 2020) and (Shorthill, et al 2020).…”