Cyber Resilience Analysis of SCADA Systems in Nuclear Power Plants

Aging plants, efficiency goals, and safety needs are driving increased digitalization in nuclear power plants (NPP). Security has always been a key design consideration for NPP architectures, but increased digitalization and the emergence of malware such as Stuxnet, CRASHOVERRIDE, and TRITON that specifically target industrial control systems have heightened concerns about the susceptibility of NPPs to cyber attacks. The cyber security community has come to realize the impossibility of guaranteeing the security of these plants with 100% certainty, so demand for including resilience in NPP architectures is increasing. Whereas cyber security design features often focus on preventing access by cyber threats and ensuring confidentiality, integrity, and availability (CIA) of control systems, cyber resilience design features complement security features by limiting damage, enabling continued operations, and facilitating a rapid recovery from the attack in the event control systems are compromised. This paper introduces the REsilience VeRification UNit (RevRun) toolset, a software platform that was prototyped to support cyber resilience analysis of NPP architectures. Researchers at Sandia National Laboratories have recently developed models of NPP control and SCADA systems using the SCEPTRE platform. SCEPTRE integrates simulation, virtual hardware, software, and actual hardware to model the operation of cyber-physical systems. RevRun can be used to extract data from SCEPTRE experiments and to process that data to produce quantitative resilience metrics of the NPP architecture modeled in SCEPTRE. This paper details how RevRun calculates these metrics in a customizable, repeatable, and automated fashion that limits the burden placed upon the analyst. This paper describes RevRun’s application and use in the context of a hypothetical attack on an NPP control system. The use case specifies the control system and a series of attacks and explores the resilience of the system to the attacks. The use case further shows how to configure RevRun to run experiments, how resilience metrics are calculated, and how the resilience metrics and RevRun tool can be used to conduct the related resilience analysis.

Research on Operating Strategy of Total Loss of Essential Service Water System With RHR Not Connected in PWR Unit

Essential Service Water System (WES) is part of the nuclear power plant cooling system which provides the final heat sink for nuclear power plants. Therefore, WES must operate stably, safely and reliably for a long time. The total loss of WES accident is a design extended condition and will result in the loss of the final heat sink of the unit. The consequences of the accident are severe. In order to deal with the accident quickly and effectively and ensure the safety and economics of the power plant in accident condition, it’s necessary to formulate corresponding treatment strategy to deal with the transient. This paper developed a strategy for dealing with the total loss of WES with Residual Heat Removal System (RHR) not connected condition in Generation III nuclear power plant. The structure of the WES system and the types of failures that may occur are analyzed, and thus the symptoms of the faults are obtained and the entry conditions for the operating strategy are determined. The effect of faults on unit equipment and safety functions and the impact on nuclear steam supply system (NSSS) control are analyzed in this paper. Combined with the unit design, the system and equipment for controlling and mitigating related safety functions are analyzed, and the mitigation method and the fallback strategy of the fault are determined. Thereby a complete operating strategy of total loss of WES with RHR not connected is obtained. In addition, this paper analyzes and evaluates the operating strategy by simulating thermal hydraulic calculation for the first time. The results show that without staff intervention Component Cooling System (WCC) temperature reached 55°C limits after running a few minutes. Based on the intervention of the operating strategy proposed in this paper, WCC temperature reached the 55°C limits when the unit was operated at about 4 hours and 55 minutes. The result shows that and the strategy can effectively alleviate the failure and provide sufficient intervention time for the operator to bring the unit to a safe state.

Development of Safety-Enhanced Fast Reactor by Using Minor Actinide Bearing Internal Blanket

For a 750MWe sodium-cooled fast reactor core using MOX fuel, safety-enhancement measures have been studied to reduce the risk of core damage under unprotected loss of flow (ULOF) and unprotected transient overpower (UTOP) accidents. As passive measures the followings are considered: 1) adoption of the axial heterogeneous core configuration with sodium plenum and Gas Expansion Modules (GEMs) to lower sodium void reactivity for ULOF, and 2) addition of minor actinides (MAs) as burnable absorber and fertile nuclides to the internal blanket in the inner core to reduce burnup reactivity for UTOP. In this study, configurations of the safety-enhanced core were optimized based on sensitivity studies as follows. Firstly, effects of 1) above on the sodium void reactivity were evaluated by changing the inner core height, B-10 content of the upper shield, GEMs, and standby position of the backup control rods, which are the dominant factors of core behavior in the event of ULOF. Secondly, the effects of 2) above on the burnup reactivity were evaluated by changing the MA content in the internal blanket and the burnup period, which are the dominant factors of UTOP. Finally, by utilizing sensitivity analysis results, the safety-enhanced core which satisfies the provisional design goals has been developed. This core has negative sodium void reactivity and burnup reactivity less than 1 $.

Effects of Pre-Crack Depth and Hydrogen Absorption on the Failure Strain of Zircaloy-4 Cladding Tubes Under Biaxial Strain Conditions

Fuel cladding may be subjected to biaxial tensile stress in axial and hoop directions during pellet-cladding mechanical interaction (PCMI) of a reactivity-initiated accident (RIA). Incipient crack in the hydride rim assisted by the scattered hydrides in the metal phase may lead to failure of the cladding at small hoop strain level during PCMI. To get insight of such phenomenon, biaxial-EDC tests under axial to hoop strain ratios ranging from 0 to 1 were performed with pre-cracked (outer surface) and uniformly hydrided Zircaloy-4 cladding tube samples with final heat-treatment status of cold worked (CW), stress relieved (SR) and Recrystallized (RX). Results showed dependencies of failure hoop strain on pre-crack depth, strain ratio, hydrogen content and final heat-treatment status on fabrication, but no apparent dependencies were observed on the distribution pattern of hydrides (with similar hydrogen contents and hydrides predominantly precipitated in hoop direction) and the heat-treatment process for hydrogen charging. J integral at failure seems to be available to unify the effect of pre-crack depth.

Development of Advanced Fire Zone Model Applicable to Fire PRA for Nuclear Power Plant

In implementing the fire PRA for nuclear power plants, a highly predictive fire model is required for more realistic fire scenarios and fire risk assessment. The fire simulation zone model BRI2002 developed in Japan has been continuously improved to allow analysis considering the characteristics of a compartment fire. In this study, a heat feedback phenomenon was introduced in BRI2002, in which combustion of a fire source can be accelerated by radiant heat transfer inside the compartment during a compartment fire. Not only the thermal radiation from the flame and smoke layers, but also radiation from the hot ceiling surface and the ceiling jet flame were considered when the flame impinges with the ceiling. In addition, in the zone model, the existing model for predicting the oxygen concentration in a compartment was improved so that the oxygen concentration could be predicted considering the vertical location of a fire source (height from the floor). The prediction results were verified by full-scale compartment fire test results. As a result of the calculation in which the fire source is installed at 2 m above the floor, the prediction results for the burning rate and zone temperature were well consistent with the test results.

Methodology Development for Transient Flow Distribution Analysis in High Temperature Gas-Cooled Reactor

In the thermal hydraulic design of the prismatic-type of the high temperature gas cooled reactor (HTGR), unintended flows such as gap flows between columns, cross flows between column layers and gap flows between permanent reflectors should be analyzed to minimizing the unintended flows. The flow distribution considering unintended flows in the reactor has been evaluated for steady and conservative condition. On the other hand, the transient thermal hydraulic analysis for satisfactorily realistic conditions will be helpful for the design improvement of prismatic-type HTGR. The present study aims to improve the thermal hydraulic system analysis code developed by Japan Atomic Energy Agency based on the RELAP5/MOD3 code and confirm its applicability for the transient flow distribution analysis for prismatic-type HTGRs during anticipated operational occurrences and accidents for its design improvement utilizing experiences on high temperature engineering test reactor (HTTR) design. The calculation model and code were developed and validated to evaluate the detailed flowrate distribution considering the unintended flows in the core and the molecular diffusion that is important to analyze beginning air ingress behavior in an air ingress accident triggered by a rupture of a primary coolant piping in HTGR. It is concluded that a prospect has confirmed to apply the improved thermal hydraulic system analysis code for transient flow distribution analysis for prismatic-type HTGRs.

Impact of Climate Change on EDF’s Nuclear Facilities: Climate Watch Approach

According to the Periodic Safety Review Process, the safety level is re-assessed every ten years, considering national and international operational feedback, evolution of knowledge and best available practices. Protection against natural hazards is part of this safety level re-assessment. In the current global change context, climate change impact has to be integrated in external natural hazards estimations, such as climatic hazards or external flooding. EDF has consequently implemented a climate watch approach. Undertaken approximately every 5 years, roughly in line with the publication of the assessment reports of the Intergovernmental Panel on Climate Change (IPCC) and with the update of safety licensing basis during Periodic Safety Reviews, this approach is intended to: - revisit the climatic hazards which present a plausible or certain upward trend, and could lead to an increased reference hazard level, - monitor the reach of target levels which should trigger a thorough analysis (concept of Major Climate Event) to ensure the robustness of the reference hazard level between two periodic reviews. This climate watch approach is developed in partnership with the scientific community and is based on the following activities: - compile and analyze datasets on hazards that are subject to changes with climate change (observed and modelled time series), - develop knowledge of associated climatic phenomena (models, projections). The application of this approach is presented in two steps: - the key implications of the last climate watch exercise carried out in 2015, which identified climatic hazards whose evolution is unfavorable and is plausible or certain for the sites of EDF NPPs: ○ High air and water temperatures (for the “heat wave” hazard) ○ Sea level (for the “external flooding” hazard for coastal or estuary sites) ○ Drought or « low flow » hazard for fluvial sites; - the results obtained for the 900 MW units, for which EDF started the 4th periodic safety review in 2019. Such an approach, which is closely linked to periodic reviews, ensures the robustness of nuclear power plants to the climatic hazards through the consideration of the updated hazard levels.

Reforms and Innovations in a Nuclear Engineering Course: Nuclear Power Plant Systems and Equipment

The Fukushima nuclear accident in Japan caused a significant impact on the nuclear power industry and public attitudes towards nuclear energy. The decreased public acceptance and the regulatory authorities’ stricter requirements of nuclear safety lead to the popularity of advanced safety technologies in scientific research and engineering projects. The demand for highly qualified human resources increases by the gradual recovery of the nuclear power field in China. In order to meet this demand, a series of course innovations are taken at Tsinghua University. Focusing on the course “Nuclear Power Plant Systems and Equipment,” the paper discusses the innovations of the course stimulated by the current industry trends and demands. A brief introduction to the special commissioned-student program at Tsinghua University is given. The paper investigates the meaning and function of the course in the frame of the curriculum plan for nuclear engineering students at Tsinghua University. The personal career plan, the industry outlook, and even the public attitudes contribute to senior students’ attitudes and demands for the course, which is tied closely to the effect of teaching. The paper addresses that the objective of the innovations is to develop a course fixing different students’ demands and help them build their ability to solve practical engineering problems in their future professional careers. The selection of teaching contents and the teaching strategy are discussed. This course takes Westinghouse AP1000 as the major point. And the nuclear power plant systems are taught in a divided way. One is the operation system, and the other is the safety system. This separation is based on the different functions and roles of these two parts and could have advantages in teaching effect. The paper explains the critical points of the systems and innovations of how to deal with course difficulties. There is a corresponding part of the safety system, and this part gets more challenges due to the industry trends. Lectures, group discussions, homework, and presentation projects are discussed. Besides, the paper considers possible efforts for further development of nuclear engineering courses.

Artificial Neural Network Model for Diagnosing the Performance and the Conditions of Air-Operated Valves

Air-operated valves (AOVs) are used to control or shut off the flow in the nuclear power plants. In particular, the failure of safety-related AOV could have significant impacts on the safety of the nuclear power plants and therefore, their performances have been tested and evaluated periodically. However, the current method to evaluate the performance needs to be revised to enhance the accuracy and to identify defects of AOV independently of personal skills. This paper introduce the ANN (Artificial Neural Network) model to diagnose the performance and the condition altogether. Test facilities were designed and configured to measure the signals such as supply pressure, control pressure, actuator pressure, stem displacement and stem thrust. Tests were carried out in various conditions which simulate defects with leak/clogged pipes, the bent stem and so on. First, the physical models of an AOV are developed to describe its behavior and to parameterize the characteristics of each component for evaluating the performance. Secondly, CNN (Convolutional Neural Network) architectures are designed considering the developed physical models to make a lead to the optimal performance of ANN. To train the ANN effectively, the measured signals were divided into several regions, from each of which the features are extracted and the extracted features are combined for classifying the defects. In addition, the model can provide the parameters of maximum available thrust, which is the key factor in periodic verification of AOV with the required accuracy and classify more than 10 different kinds of defects with high accuracy.

Level 2 PSA Overview of HPR1000 Nuclear Power Plant

Risk-informed design approaches are comprehensively implemented in the design and verification process of HPR1000 nuclear power plant. Particularly, Level 2 PSA is applied in the optimization of severe accident prevention and mitigation measures to avoid the extravagant redundancy of system configurations. HPR1000 preliminary level 2 PSA practices consider internal events of the reactor in the context of at-power condition. Severe accidents mitigation and prevention system and its impact on the overall large release frequency (LRF) level are evaluated. The results showed that severe accident prevention and mitigation systems, such as fast depressurization system, the cavity injection system and the passive containment heat removal system perform well in reducing LRF and overall risk level of HPR1000 NPP. Bypass events, reactor rapture events, and the containment bottom melt-through induced by MCCI are among the dominant factors of the LRF. The level 2 PSA analysis results indicate that HPR1000 design is reliable with no major weaknesses.