A testbed to assess digital instrumentation and control and cyber security of nuclear power plants

Existing nuclear power plants (NPPs) are switching from analog to digital control systems, and digital instrumentation and control (I&C) systems are expected to be used in all of the new NPPs. Digital I&C is expected to improve the performance of communication, maintenance, and signal processing. However, research needs to be done to ensure the nuclear-grade safety and reliability of these systems. The goals of this research project are to identify potential faults and to evaluate the resiliency of safety-critical digital I&C systems destined for use in NPPs. A test bed is developed for this purpose. This test bed consists of a model of a NPP, a main control room (MCR), and associated digital I&C controllers. The digital controller has a triple-modular redundant (TMR) architecture system. This device uses a two-out-of-three voting algorithm for the purpose of better reliability. A simple real-time NPP simulator is developed in LabVIEW using the point kinetics equation with feedback for the core. It also includes models for a pressurizer, a steam generator, and a pump. The test bed also includes a set of specialized fault injectors for injecting different types of faults into the system. A fault injection module is developed in LabVIEW in order to simulate sensor failures. The module contains a fault list manager (FLM), a fault injection manager (FIM), and a result analyzer (RA). This thesis describes the details of the test bed, the associated fault injection system, and the results of the fault injection studies which are carried out using this test bed to find critical sensor failures in NPPs. In addition, the performance of the RA module is also evaluated. Based on the results of the numerical experiments performed, conditions that require most care are when the faulty sensor data implies either steady state or sub-critical condition of the reactor. The RA module helps the operators in identifying, in some cases, if the sensor data is bad due to a faulty sensor. The most vulnerable scenario is when the reactor is under steady-state operation and faulty sensor is stuck at its value corresponding to that steady-state. The operators in this scenario will not become aware if the reactor goes through an unanticipated transient, unless the simulator mode is switched to “transient”