Applying Priority-Informed STPA to a Nuclear I&C System

The transition from analog to digital instrumentation and control systems in nuclear power plants introduces increased complexity, and functionality and consequently new types of risks. Systems Theoretic Process Analysis (STPA) aims to uncover losses caused by inadequate control measures between system elements and could therefore help identify control flaws also in Instrumentation and control (I&C) systems. Our objective is to assess the method's effectiveness in the context of a nuclear power plant's digital feedwater control system use case. We highlight the completeness of the hierarchical control structure of the use case, as a substantial part of the analysis relies on its content. The perspective of STPA viewing safety as a control problem offers valuable insights into the instrumentation and control use case. Altogether more than 140 unsafe control actions and 400 loss scenarios were identified originating from 18 control actions. STPA generates numerous unsafe control actions and loss scenarios but lacks inherent prioritization. The absence of a distinction between important and minor hazards treats all findings equally in terms of criticality for safety requirements and system design considerations. As a result, we tested the risk priority number approach and recognized its utility in screening and prioritizing these findings. This proves beneficial when allocating resources for safety considerations in digital instrumentation and control systems within the nuclear domain.