Identification of the accident-related critical digital assets based on probabilistic safety analysis results

Abstract

Digital I&C systems have been developed and installed in nuclear power plants, and due to installation of the digital I&C systems, cyber security concerns are increasing in nuclear industry. However, there are too many critical digital assets (CDAs) to be inspected in digitalized NPPs. In order to reduce the inefficiency of regulation in nuclear facilities, the critical digital assets that are directly related to an accident are elicited by using the probabilistic safety assessment results. Target initial events are selected, and their heading are analyzed through event tree analysis. Among the headings, the headings that can be proceeded directly to the core damage by the cyber-attack are finally selected as the target of deriving the minimum cut-sets. Based on success criteria of each heading, we analyze the fault trees and derive the minimum set-cuts. In terms of original PSA, the value of probability for the cut-sets is important but the probability is not important in terms of cyber security of NPPs. The important factors is the number of basic events consisting of the minimal cut-sets that is proportional to vulnerability. Finally, the process for identifying accident-related CDAs is suggested based on PSA results. The results of this study are expected to be used to derive the linkage between cyber-attack and accident, and to develop the final core digital asset identification methodology and effective regulatory method.