Multi-State Reliability Assessment Model of Base-Load Cyber-Physical Energy Systems (CPES) during Flexible Operation Considering the Aging of Cyber Components

Abstract

Cyber-Physical Energy Systems (CPESs) are energy systems which rely on cyber components for energy production, transmission and distribution control, and other functions. With the penetration of Renewable Energy Sources (RESs), CPESs are required to provide flexible operation (e.g., load-following, frequency regulation) to respond to any sudden imbalance of the power grid, due to the variability in power generation by RESs. This raises concerns on the reliability of CPESs traditionally used as base-load facilities, such as Nuclear Power Plants (NPPs), which were not designed for flexible operation, and more so, since traditionally only hardware components aging and stochastic failures have been considered for the reliability assessment, whereas the contribution of the degradation and aging of the cyber components of CPSs has been neglected. In this paper, we propose a multi-state model that integrates the hardware components stochastic failures with the aging of cyber components, and quantify the unreliability of CPES in load-following operations under normal/emergency conditions. To show the application of the reliability assessment model, we consider the case of the Control Rod System (CRS) of a NPP typically used for a base-load energy supply.

1. Introduction

Cyber-Physical Systems (CPSs) are systems that integrate cyber components within hardware systems in which physical processes take place [1]: when the processes relate to energy production, transmission and distribution, they are called Cyber-Physical Energy Systems (CPESs) [2]. With the penetration of Renewable Energy Sources (RESs) (e.g., wind, photovoltaic), CPESs are requested to provide flexible operation (e.g., load-following, frequency regulation) to adjust any sudden imbalance that may occur in the power grid, due to a high level of variability and uncertainty in the power generation by renewables [3]. This inevitably raises concerns on the reliability of CPESs traditionally used as base-load facilities, such as Nuclear Power Plants (NPPs). Indeed, given the stable steady-state energy supply demanded to the base-load CPESs, manoeuvring capabilities were designed for seldom operations, mainly triggered by safety needs (i.e., safe shutdowns) [4] and with limited safety margins or capabilities to satisfy flexible operation during frequent and fast-changing demand scenarios. Since the base-load CPESs are normally expected to operate under stable steady-state conditions, for which any change of the cyber part setting can be easily detected and corrected without losing control of the system [5,6,7], aging of cyber parts is not a concern, whereas under frequent, fast-changing transients, as it is in the case of load-following CPESs here considered, aging of the cyber part cannot be neglected [8].

Recently, dynamic reliability methods (e.g., Multi-State Physical Modelling (MSPM) [9], Petri Net [10], Bayesian Network [11]) based on dynamic models of CPSs are being increasingly developed to assess CPESs’ reliability. For base-load CPESs like traditional NPPs that were not designed for flexible operation, efforts have been focusing on assessing the contribution to unreliability due to aging and stochastic failures of the hardware components, without considering the degradation and aging of the cyber components. On the other hand, as already said, the cyber components of any Cyber-Physical System (CPS) are sensitive parts of CPSs, because they control the physical processes, as shown in [12,13,14]: disturbances on the cyber components of a CPS can strongly affect its performance, especially during flexible operations where its functions are most active. Assuming the functionalities of cyber components of a CPES is quite important given the long operation time of CPESs, and their reliability is threatened by aging processes typical of cyber systems. Then, to assess the reliability of CPESs accounting for the aging and degradation of cyber systems, in [15] we proposed a multi-state model for describing the aging process driven by memory leakage [16,17], which leads to service rate decrease and, eventually, data-jamming in the mission queue [18,19], which, in turn, increases the memory request; in such conditions, the cyber system blocks its function, significantly increasing the control delay [20,21], deteriorating the system stability and controllability during transients, when the amount of memory available cannot satisfy the demand of the mission queue. In this paper, we elaborate on this modelling approach to propose a framework of analysis for complete support to the reliability assessment of CPES for load-following.

To demonstrate the use of the reliability assessment framework, we consider the Control Rod System (CRS) of a typical NPP. We apply the multi-state model [15] that integrates the hardware components’ stochastic failures with the aging of cyber components, and quantify the unreliability of the CPS with respect to transients during load-following operations under normal/emergency conditions.

The remainder of paper is as follows: Section 2 presents the NPP case study considering both hardware components’ stochastic failures and the aging of cyber components in load-following operation scenarios; Section 3 presents relative modelling works of cyber aging and the proposed multi-state model accounting for the cyber aging process; the reliability assessment procedure, embedding the multi-state model of Section 3, is presented in Section 4; the results of the application of the reliability assessment of Section 4 to the case study of Section 2 are reported and discussed in Section 5; and in Section 6, conclusions are drawn.

2. The Control Rod System

2.1. Control Rod System Description

The Control Rod System (CRS) (Figure 1) is an important system of a NPP, whose function is to adjust the insertion and withdrawal of control rods in the reactor core, so as to control the thermal power and, thus, the electric power generated [22,23,24,25] with a closed-loop feedback control (Figure 2). The CRS elementary scheme comprises of a sensor, a controller, a connecting network, an actuator, and a motor for rod movement, where $r_k,u_k,y_k,e_k$ are the discrete reference, control, output, and error signals, respectively, at discrete time $t_k=kh$ [26], where h is the interval of sensor sampling and $k=0,1,2,\dots$ is a discrete integer variable as a data-sampling sequence number. The feedback control loop accounts for a total delay time $\tau$ that sums up the network transmission (${\tau }_{sc},{\tau }_{ca}$) and controller processing (${\tau }_c$) delay times.

Without loss of generality, the CRS here considered comprises of (i) a typical digital Instrumental & Control (I&C) platform in single-controller mode with one CPU (for the controller module), and (ii) a typical DC motor (for the motor used to control the position of the control rods [22,27]). For the convenience of simulation, we use the discrete form of the transfer function (Equations (1) and (2) below) proposed in [26] between the DC motor and controller (where u and y are the control signal output of the controller and control rod’s relative position controlled by the DC motor (considered as the percentage of energy output), respectively, and i is the index for the simulation step):

$$\begin{array}{c}\hfill y_i=1.944y_{i-1}-0.944y_{i-2}+0.004u_{i-1}+0.0039u_{i-2}\end{array}$$

(1)

$$\begin{array}{c}\hfill u_i=u_{i-1}+0.17e_i-0.163e_{i-1}\end{array}$$

(2)

2.2. Load-Following Operation of the CRS

By definition, load-following means adjusting the electricity generation to match the expected electricity load curve [28]. A complete load-following cycle consists of a power decrease from the normal power rate ($P_n$) of the CPES to a lower percentage of $P_n$ ($\%P_n$), followed by a ramp to re-establish the lower power level to $P_n$ [29]. As shown in Figure 3, different types of cycles can be envisaged in practical applications: “light cycles” with a limited power excursion (above $60\%P_n$) (dotted line); “deep cycles” with a large variation of power (below $60\%P_n$) (continuous line), and an “emergency cycle” with a large variation of power (below $50\%P_n$) by a high power change rate (dashed-dotted line). For these three types of cycles, the lower power plateau can be either long or short, depending on the changes of demand on the grid side. The rate of power change from $P_n$ to $\%P_n$ (and vice versa) depends on the energy CPS under analysis: in our case, we assumed a change rate of $5\%P_n$ per second for normal load-following conditions and $20\%P_n$ per second for a power decrease due to emergency conditions (compatible with the DC motor defined in Section 2.1) [4,22,27].

In

Table 1. PWR reactor load-following capability [30].

Load Cycle	Number of Load Cycles	Probability
100-90-100	100,000	$0.163$
100-80-100	100,000	$0.163$
100-60-100	15,000	$0.0245$
100-40-100	12,000	$0.0196$
100-20-100 (emergency)	100	$1.65\times {10}^{-4}$
No load-following	–	$0.6297$

[30], we can see that a typical PWR reactor is estimated to perform $\mathrm{100,000}$ “light cycles” to $90\%P_n$, $\mathrm{100,000}$ “light cycles” to $80\%P_n$, $\mathrm{15,000}$ “deep cycles” to $60\%P_n$, $\mathrm{12,000}$ “deep cycles” to $40\%P_n$, and 100 “emergency cycles” to $20\%P_n$ [4] during the plant lifetime. It results that the probability that a typical PWR NPP experiences any type of load-following cycle at each hour can be calculated (by the number of load cycles divided by total working hours in a NPP lifetime of 70 years), with results listed in the third column of Table 1.

3. Modelling of Cyber Systems Aging

In this Section, the multi-state model of the aging process of a CPS originally presented in [15] is briefly recalled and customized for application to the CRS of Section 2.

Aging of cyber systems manifests in performance degradation and failure rate increase of the software that drives the controller [17]. Cyber system aging is caused by some specific software faults/bugs, known as aging-related bugs [18] and activated by internal/external factors, causing errors that accumulate and propagate inside the system and finally lead to aging-related failures.

Memory leakage is a typical effect of cyber aging processes caused by internal errors, like unterminated processes that shrink the available amount of physical memory [18]. With memory leakage, data-jamming can occur, due to decreasing service rates that prevent the controller from processing or delivering data and tasks in due time, which results in (i) an accumulation of data in the mission queue, (ii) an increase of the memory request, and (iii) data packet loss, when the mission queue is full [19].

As a result, the cyber system becomes blocked when the amount of memory available cannot satisfy the demand of the mission queue, significantly increasing the control delay (${\tau }_c$) in processing data of the controller [20,31,32] and reducing controllability and stability of the controlled physical system [21], which increases risk of failure.

In the literature, modelling approaches of cyber aging are divided into two categories: measurement-based, and model-based [16,33]. With respect to measurement-based approaches, time-series analysis [34,35,36] and machine-learning methods [37,38] are used to forecast the system failure time by observing the performance degradation and resource consumption [39]. However, lacking in the generalization of systems, their data-driven characteristics make them hardly applicable to systems whose historical information is missing. With respect to model-based approaches, the cyber-aging system is commonly described as a Continuous-Time Markov Chain (CTMC) [6,40]. However, none comprehensively describes the causes, processes, and effects of cyber aging, such as service rate decrease and data-jamming.

In this work, we use CTMC to describe multiple performance degradation (i.e., service rate decrease) states embedded with a queueing model. With memory leakage, data-jamming has a higher probability of occurrence, and the system can be blocked more easily when the system cannot satisfy the memory demands, injecting high delays into the control loop which may make the system out of control. Thanks to its advantages over the mentioned approaches, (i) the chain of cyber aging phenomena is fully described; (ii) time-dependent blocking transition rates can be calculated by effects of memory leakage and the mechanism of data-jamming instead of constant transition rates with subjective assumptions, and (iii) considering the specialty of cyber aging, this model can be applied to simulate and explore system performances with high aging levels or under blocking conditions instead of directly assuming system failure.

3.1. Memory Leakage

The system performance deteriorates stochastically and eventually reaches a blocking state when the available memory cannot satisfy the demand from the mission process queue; as shown in Figure 4, the leakage degradation process can be modeled as a continuous-time Markov Chain with state space $L=\{S_0,S_1,\dots ,S_n,B\}$, where state $S_0$ is the normal state, in which the system has the maximum memory capacity and performance; states $S_1\sim S_n$ represent increasing degradation states of decreased memory available; state B is the blocking state; ${\lambda }_{i,i+1}(i=0,1,\dots ,n-1)$ is the transition rate between degradation states $S_i$ and $S_{i+1}$; ${\lambda }_{i,B}$ is the system-blocking transition rate from the i-th state $S_i$ to blocking state B (if $i<j$, then ${\lambda }_{i,B}<{\lambda }_{j,B}$, which means that the worse the degradation state, the larger the transition rate to the blocking state).

3.2. Data-Jamming

For each degradation state $S_i$, assuming a data arrival rate $\varphi$, an exponential service rate ${\mu }_i$ and a maximum capacity of task delivery queue equal to m, the continuous time Markov Chain of Figure 4 (below) can be used to model data-jamming, nested into the model of Figure 4 (above), where ${\mu }_i$ denotes the different service rates in different states $S_i(i=0,1,\dots ,k)$ (if $i<j$, then ${\mu }_i>{\mu }_j$), and the lowest service rate ${\mu }_B$ is that at blocking state B.

For each state $S_i$, the probability $P_{jam}(i,j)$ of j data-jamming in the queue at state $S_i$ is [41]:

$$\begin{array}{c}{P}_{jam}(i,j)=\frac{1-\varphi /{\mu }_i}{1-{(\varphi /{\mu }_i)}^{m+1}}{\left(\frac{\varphi }{{\mu }_i}\right)}^j\\ i=1,2,\dots ,nj=0,1,\dots ,m.\end{array}$$

(3)

3.3. Calculation of the System-Blocking Transition Rate

As mentioned in Section 3.1, the probability of system-blocking $P_{i,B}$ from state $S_i$, and the corresponding blocking transition rate ${\lambda }_{i,B}$, depend on the current available memory $M\left(t\right)$ and on the memory request of the mission queue, which can be calculated with the values of the model parameters listed in

Table 2. Parameters for cyber aging model.

Parameter	Description	Value
n	Number of degradation states	3
${\lambda }_{i,i+1}$	Transition rate between states $S_i$ and $S_{i+1}$	$5\times {10}^{-5}$ [h${}^{-1}]$
m	Maximum number of tasks	10
$\varphi$	Data coming rate	50 [s${}^{-1}]$
${\mu }_0$	Service rate in state $S_0$	100 [s${}^{-1}]$
${\mu }_1$	Service rate in state $S_1$	85 [s${}^{-1}]$
${\mu }_2$	Service rate in state $S_2$	70 [s${}^{-1}]$
${\mu }_3$	Service rate in state $S_3$	55 [s${}^{-1}]$
${\mu }_B$	Service rate in state Blocking	30 [s${}^{-1}]$
M	Total memory available	100 [Kb]
x	Memory request of each task	U(2,7) [Kb]
${\tau }_{sc},{\tau }_{ca}$	Transmission delay	N(13.1,5.7) [ms]

.

$M\left(t\right)$ is estimated by assuming the transition time between degradation states ($S_i$ and $S_{i+1}$) to be exponentially distributed with parameter ${\lambda }_{i,i+1}$ [16]. The Monte Carlo simulation is used to sample the transition times between states $S_i$ and $S_{i+1}$, starting from the initial state $S_0$, and the available memory in each state is recorded at each transition time; repeating the simulation $N_{mc}$ times, the mean value of the collected available memory at each time is taken as the available memory $M\left(t\right)$ at time t. Figure 5 shows one random trial of the simulation process (dashed line).

On the other hand, to estimate the memory request of the mission queue, we need to assume that each new data comes into the queue (with maximum capacity m) with a memory request which is a continuous random variable with density function $g\left(x\right)$ [40]: for any $0<j⩽m$, let $g^{\left[j\right]}\left(x\right)$ be the density function for the total amount of j-independent resource requests, which is equal to the j-fold convolution of g [42].

$$\begin{array}{cc}\hfill & g^{\left[1\right]}\left(x\right)=g\left(x\right),\hfill \\ \hfill & g^{[j+1]}\left(x\right)={\int }_0^x{g}^{\left[j\right]}\left(u\right)g(x-u)du,j⩾1\hfill \end{array}$$

(4)

Let $G^{\left[j\right]}\left(x\right)$ be the corresponding cumulative distribution function of $g^{\left[j\right]}\left(x\right)$, $G^{\left[j\right]}\left(x\right)={\int }_0^x{g}^{\left[j\right]}\left(u\right)du$. The conditional probability $\xi [j,M]$ that the system blocks with j data in the queue and M memory available upon the arrival of a new request can be calculated considering the system-blocking mechanism (i.e., the memory available cannot satisfy the memory request).

$$\begin{array}{cc}\hfill & \xi [0,M]=1-G^{\left[1\right]}\left(M\right),\hfill \\ \hfill & \xi [j,M]=1-\frac{G^{[j+1]}\left(M\right)}{G^{\left[j\right]}\left(M\right)},1⩽j⩽m-1\hfill \\ \hfill & \xi [m,M]=1-G^{\left[m\right]}\left(M\right)\hfill \end{array}$$

(5)

Combining the probability $P_{jam}(i,j)$ of j data-jamming in the queue at state $S_i$ shown in Section 3.2 and the conditional probability $\xi [j,M]$ of system-blocking with j data, the probability $P_{i,B}\left(M\right)$ of system-blocking at each state with M available memory can be calculated as in Equation (6) below. Remembering that $M\left(t\right)$ is specific to each system, we can calculate $P_{i,B}\left(t\right)$ and the corresponding blocking transition rate ${\lambda }_{i,B}\left(t\right)$ (Figure 6) as in Equations (7) and (8) below.

$$\begin{array}{cc}\hfill & P_{i,B}\left(M\right)=\sum _{j=0}^m{P}_{jam}(i,j)·\xi [j,M]i=1,2,\dots ,n\hfill \end{array}$$

(6)

$$\begin{array}{cc}\hfill & f_{i,B}\left(t\right)=\frac{d{P}_{i,B}\left(t\right)}{dt}\hfill \end{array}$$

(7)

$$\begin{array}{cc}\hfill & {\lambda }_{i,B}\left(t\right)=\frac{f_{i,B}\left(t\right)}{1-P_{i,B}\left(t\right)}\hfill \end{array}$$

(8)

3.4. Calculation of the Control Delay

The transmission delays ${\tau }_{sc}$ and ${\tau }_{ca}$ of Figure 2 are usually assumed constant for a specific network structure, whereas ${\tau }_c$ is dependent on the system state (blocking or non-blocking), and consists of the waiting time ${\tau }_{waiting}$ necessary for a data packet to be processed, and in the calculating time ${\tau }_{calculating}$. When the cyber system is in a non-blocking state $S_0\sim S_n$, the control delay equals to the sum of ${\tau }_{sc}$ and ${\tau }_{ca}$ (${\tau }_c$ can be neglected); whereas when the cyber system is in the blocking state B, the low service rate causes data packet accumulation in the mission queue, significantly increasing ${\tau }_c$, which results in an increase of the total control delay $\tau$ [43].

$${\tau }_c={\tau }_{waiting}+{\tau }_{calculating}$$

(9)

$$\tau =\left\{\begin{array}{ccc}\hfill & {\tau }_{sc}+{\tau }_{ca},\hfill & \hfill S_0\sim S_n\\ \hfill & {\tau }_{sc}+{\tau }_{ca}+{\tau }_c,\hfill & \hfill B\end{array}\right.$$

(10)

The signal delay calculation in a degraded CPS is sketched in Figure 7: the sensors sample the signals from the plant at the k-th sampling time; the control command signal finally reaches the actuator after delay $\tau$: when the cyber system is in a non-blocking state $S_0\sim S_n$, the total delay $\tau$ only accounts for ${\tau }_{sc}$ and ${\tau }_{ca}$, commonly less than h; whereas when the cyber system is in the blocking state B, $\tau$ also accounts for ${\tau }_c$, making $\tau$ larger than h.

4. Reliability Analysis of the CRS

In this Section, we show the procedure to calculate the reliability of the NPP CRS described in Section 2, while being used for flexible control during load-following operations. Cyber system aging is modelled as described in Section 3.3. The failure rates of the controller and DC motor are listed in

Table 3. Parameters for hardware stochastic failure.

Parameter	Description	Value
${\lambda }_{controller}$	Controller failure rate	$8.01\times {10}^{-6}$ [h${}^{-1}]$
${\lambda }_{motor}$	DC motor failure rate	$9.50\times {10}^{-6}$ [h${}^{-1}]$

[44,45]. It is worth mentioning that we assume failure rates of both the controller and DC motor to be constant (and their failure times exponentially distributed) even though, in the literature, the lifetime of DC motor failure times are shown to change with temperature and to obey a Weibull distribution [46]. This assumption is here justified by the fact that the CRS is assumed to operate at a constant temperature.

The CRS is considered to be failed when the system response (power output) is out of the control safety boundary, that assumed to be smaller or larger than $2\%P_n$. Figure 8 shows examples of normal (continuous line) and failing (dotted line) load-following operations, which are both assumed to start at $t=1$ s (the safety boundaries for a $100\%P_n$ to $60\%P_n$ power decrease are $[59.2\%P_n;60.8\%P_n]$ (dashed-dotted line)).

The CRS is considered to undergo maintenance during the refueling outage (every 18 months), as long as the components show decreasing performance [47]. In this paper, we assume (i) to maintain the controller and DC motor, alternately, every 18 months during the refueling outage, (ii) the maintenance activity on the controller clears all accumulated aging-related bug-caused errors (such as memory leakage) and aging-related cyber failures (as good as new (AGAN)).

The procedure for the reliability assessment proceeds as follows (sketched also in Figure 9):

• Calculate system-blocking transition rate ${\lambda }_B$ with the model described in [15] and the procedure summarized in Section 3.3;
• Set: initial time $t=0$, mission time $T_{miss}=$${10}^5$ h, simulation time step $dt=1$ h, maintenance period $T_m=12960$ h (18 months) and index of maintenance cycle $k_m=1$;
• Sample the DC motor and controller hardware failure times $T_{h,motor}$ and $T_{h,controller}$, respectively, from the exponential distributions whose rates are reported in Table 3;
• Set the system failure time $T_{hard}$ due to hardware stochastic failures: $T_{hard}=min(T_{h,motor},$$T_{h,controller})$;
• Check whether the system must undergo maintenance:
  • If $t=k_m{T}_m$:
    (i) alternately maintain the DC motor and controller (AGAN policy), and resample the corresponding hardware failure time, $T_{h,motor}$ or $T_{h,controller}$;
    (ii) reset the system hardware failure time $T_{hard}$ as step 4;
    (iii) set $k_m=k_m+1$;
• Check if the hardware stochastic failure time t exceeds $T_{hard}$:
  • If $t⩾T_{hard}$, record system failure time due to hardware stochastic failure in the failure time counter: $Cal\left(t\right)=Cal\left(t\right)+1$, and jump to step 9;
  • If $t<T_{hard}$:
    (i) sample load-following operation type L from the 3rd column in Table 1: if L is the index for which $F_{L-1}<R⩽F_L$, where $F_L={\sum }_{l=0}^L{P}_l$, $P_l$ is the load-following occurred probability and R is a random value sampled from the uniform distribution in $[0,1]$; the load-following operation type L is obtained;
    (ii) sample the system-blocking time $T_{blocking}=-ln\left(R\right)/{\lambda }_B(t-(k_m-1)T_m/2)$, where R is another random value sampled from the uniform distribution in $[0,1]$;
    (iii) if $T_{blocking}<dt$ (system transits to blocking state B), start to run the load-following simulation with the type sampled in i) as following steps (a) to (h):

    (a)

    Set: load-following simulation initial time $t^{\prime }=0$, mission time $T_{miss}^{\prime }=15$ s, time step $d{t}^{\prime }=0.002$ s, sample interval $h=0.2$ s and sample iteration number $k=1$, mission queue array Q with “first in first out” processing principle;

    (b)

    Set: initial system output $y_0=0$, error $e_0=1$ and control signals $u_0=0$;

    (c)

    Set: system reference input r according to different types of load-following operations (for example: $r=1.05-0.05t^{\prime }(1<t^{\prime }<9s)$ for load-following operations from $P_n$ to $60\%P_n$);

    (d)

    Set $t^{\prime }=t^{\prime }+d{t}^{\prime }$;

    (e)

    Calculate $y_i$ according to Equation (1)

    (f)

    Check whether new data are collected from the sensors.

    If $t^{\prime }=kh$:

    –

    Sample the calculation delay ${\tau }_{calculating}$ from the exponential distribution with parameter ${\mu }_B$ in Table 2;

    –

    Sample the transmission delay ${\tau }_{sc}$ and ${\tau }_{ca}$ from the Gaussian distributions with the parameters in Table 2;

    –

    Calculate the data waiting time ${\tau }_{waiting}=\sum Q_{\tau }\left[q\right]$, where q is the index of data waiting in the mission queue;

    –

    Calculate the total delay time $\tau$ for the k-th sample data $y_i$ according to Equations (9) and (10);

    –

    Save $y_i$ and $kh+\tau$ into mission queue Q as the k-th sample data and its processing end time;

    –

    Set $k=k+1$

    (g)

    Check whether the actuator time $t^{\prime }$ for getting the new control signal $Q_{y_i}$[1] (i.e., the first data in mission queue Q) exceeds the delay time $Q_{\tau }\left[1\right]$:

    –

    If $t^{\prime }⩾Q_{\tau }\left[1\right]$, set $e_i=r_i-Q_{y_i}\left[1\right]$, calculate $u_i$ according to Equation (2) and take the first data out of the mission queue;

    –

    If $t^{\prime }<Q_{\tau }\left[1\right]$, set $e_i=e_{i-1}$ and $u_i=u_{i-1}$

    (h)

    Check whether the system output $y_i$, which refers to the system power output, exceed $2\%$ of the power change above and below the reference values (i.e., the safety bounds):

    –

    If $|y_i-r_i|>2\%ofpowerchange$, record the cyber failure time in the failure time counter: $Cal\left(t\right)=Cal(t+1)$, and jump to step 9;

    –

    If $|y_i-r_i|⩽2\%ofpowerchange$, repeat $\left(d\right)$ to $\left(h\right)$ until time $t^{\prime }$ exceeds $T_{miss}^{\prime }$, and finish the simulation of load-following

• $t=t+dt$;
• Repeat steps 4 to 7 until time t exceeds $T_{miss}$ for one simulation run;
• Run $N_c$ (e.g., ${10}^6$ times) steps 2 to 8 and calculate the system unreliability simply as $Cal/N_c$.

5. Results

5.1. Normal Condition

For comparison, we assess the reliability of CRS under three different modelling assumptions under normal load-following conditions (without considering 5-th row of Table 1):

• Only hardware stochastic failures (i.e., by neglecting step 6 (i) to (iii) of the reliability assessment procedure described in Section 4);
• Only cyber aging (i.e., by neglecting steps $3,4$ and 5 (ii) of the reliability assessment procedure described in Section 4);
• Both hardware stochastic failures and cyber aging.

Figure 10 shows the result of the system unreliability estimation of normal load-following operations considering the three models mentioned above (only hardware stochastic failures in continuous line, only cyber aging in dashed lines and both hardware stochastic failures and cyber aging in the dashed-dotted line). It can be seen that:

• Hardware stochastic failures remain the principle cause of system failure;
• Each periodic maintenance (each 18 months) efficiently reduces the system unreliability;
• As CRS ages, longer delays are to be accommodated by the control loop, increasing the contribution of cyber aging to system failure, two years after the controller has undergone maintenance each time (with AGAN policy that clears all the aging-related errors);
• The largest contribution of cyber aging to system failure is recorded three years after maintenance.

Effects of cyber aging on CRS are, thus, not negligible and need to be accounted for in the reliability assessment. The difference between both stochastic and cyber aging (dashed-dotted) and only stochastic (continuous) curves clearly shows the contribution of cyber aging to the overall system reliability. Cyber aging is shown to account comparatively with hardware stochastic failures, and should be only in design and for operation. It should be noticed that it is thanks to the effective periodic (AGAN) maintenance assumed, that the unreliability is maintained to a low level. Additionally, it is important to notice that the mechanism of deterioration due to cyber aging (initially silent and negligible), abruptly becomes a priority to be addressed when implementing maintenance activities.

5.2. Emergency Condition

To show the effects of cyber aging in the emergency condition, we added an emergency cycle (5-th row in Table 1) into the same simulation framework presented in Section 5.1.

Figure 11 shows the system unreliability for load-following operations under emergency conditions. When considering emergency conditions, the effects of cyber aging are magnified, further showing the need to account for it in the reliability assessment of a CPES: in the Figure 11, the difference between the highest two curves shows the significant contribution of cyber aging to the system unreliability; with respect to Figure 10 (normal conditions), cyber aging (dashed line) has a larger contribution (around $0.28$ at 3 years) to the system unreliability (whereas in Figure 10 the value is around $0.08$); periodic maintenance (every 18 months) is still an efficient method to reduce the system unreliability; as CRS ages, longer delays are introduced into the control loop (as described in Section 3), which rapidly increase the contribution of cyber-aging-caused system failure (dashed line) that can be seen two years after each AGAN periodic maintenance.

Figure 12 further shows the results of system unreliability under an emergency condition (dashed line) compared with the normal condition (dotted line), both considering hardware stochastic failure and cyber aging. The results show that emergency conditions significantly increase the system unreliability and the CRS vulnerability to cyber aging, even if the occurrence of emergency transients is very rare. During emergency conditions, the large power change needs the CRS to be highly stable and controllable: in such rare conditions, the CPES integrity is undermined because the cyber aging makes the CRS more sensitive to delays that, under normal conditions, would have led to negligible effects.

6. Conclusions

In this paper, a previously proposed multi-state model that integrates memory leakage, data-jamming, and a control delay to describe cyber system aging processes of a CPS was considered within a MC-based reliability assessment framework for CPESs typically used as the base-load, to assess the effects of cyber aging when dealing with flexible operation (e.g., load-following).

We took the CRS of a NPP as a case study, which consists of a PI controller, a DC motor, and connecting network. The result shows that: hardware stochastic failure is the main reason for system failure; the periodic maintenance (assumed AGAN) can efficiently reduce the system unreliability, for both causes of stochastic failures and cyber aging; with gradual deterioration of the control rod system and larger delays in the control loop, cyber aging starts contributing significantly, up to at most about $27\%$ of system unreliability; the emergency condition with a lower occurrence probability contributes more than the normal condition and increases up to, at most, about $48\%$ of the system unreliability.

Cyber aging can, then, be an important, non-negligible cause of unreliability in base-load CPES used for flexible operation, especially during emergency conditions. Effective preventive maintenance on the cyber system must be planned to mitigate the aging effects, together with the effective control of an energy dispatch at different base-load CPESs with different aging profiles to avoid system failure during transients.