Safety first: the golden rule for IT/OT convergence in nuclear power

Clearly, safety is the absolute, number one priority in the nuclear industry. A system malfunction or a cyber attack in this industry is really not about the financial loss, but the prospect of a major incident with catastrophic consequences.

In 2010 the Stuxnet worm was first identified. Initially, it was targeted at reprogramming industrial controllers, including those in Iranian nuclear power plants. Its emergence highlighted how OT could be vulnerable to cyber attacks when connected to information systems. And the more the borders between these two kinds of technologies are blurred, the greater the threats are; especially in the face of increasingly well-resourced hostile nation states and criminal gangs.

So is OT/IT convergence relevant at all in the nuclear industry?

Of course, IT isn’t totally banned from nuclear power plants. But it is confined only to certain areas. In industry, there are four levels of instrumentation and control: ranging from the sensors and actuators in direct contact with the production process at Level 0 (and the Level 1 automation that controls them) to the command and control room (Level 2) and the overall production and maintenance management functions at Level 3.

In most sectors you’ll now find ‘smart’ sensors right down to Level 0. But the nuclear industry takes a much more cautious approach. So while information systems are ubiquitous at Level 3, they are used more sparingly at Levels 2 and 1. Indeed, the safety requirements for some systems mandate the use of non-programmable technologies to ensure technical diversity, and you’ll rarely find them at Level 0. As a general rule, the closer you get to the reactor core and its safety functions, the more the plant is likely to rely on older, proven and robust technologies which operational personnel know like the backs of their hands. The precautionary principle applies: if it’s not broken, there’s no need to fix it.

However, IT solutions can be considered in the nuclear sector when they are the only way to meet evolving safety requirements (as existing technologies become obsolete) or when they open up new and useful possibilities. For example, the PSAD (predictive maintenance based on vibration monitoring) on-line monitoring system used in the French nuclear industry uses digital analysis of vibrations to detect failures in key components in the plant. This system in no way compromises safety: on the contrary, it facilitates earlier and more accurate maintenance activities.

Maintenance technicians can also use tablets and augmented reality to support their work. But on the other hand in the control room, where it might seem sensible to automate a range of tasks, it’s important not to over-automate operators tasks because it’s vital that they don’t lose sight of their role, and its context and vital importance. Wherever it might be used, the introduction of IT must not impact the nuclear generation process – to ensure that safety requirements are met – or increase exposure to potential cyber attacks. And it must deliver some kind of significant improvement, although the financial aspects are the lowest priority in this list of requirements.

SMRs and new nuclear installations: a whole new set of challenges

The development of Small Modular Reactors (SMRs), typically generating less than 300MW of power, will bring with it a number of new requirements in terms of IT/OT. Designed, for example, to replace coal-fired power stations or to supply off-grid installations such as factories, hydrogen electrolysers or desalination plants, SMRs need to be deployed in large numbers in order to be profitable. They will mainly be used in countries with little or no nuclear expertise, and in difficult-to-access locations. That will necessarily involve setting up remote control and automation systems, which will pose unprecedented cybersecurity and safety challenges.

At the same time, the global revival in nuclear power plant construction should free up budgets and shine a spotlight on suppliers, who can use this opportunity to boost R&D investment. Developing new solutions for nuclear power, whether or not they involve IT, is an extremely costly business because of the long and stringent qualification process involved: so companies are unlikely to take that risk if the market for those solutions is uncertain.

The answer is long-term partnership

With the renewed interest in nuclear power, the scene is set for increasing IT/OT convergence, often draw inspiration from proven Industry 4.0 solutions. This convergence must begin with the least mission-critical functions and it will only happen against a backdrop of rigorous respect for the safety constraints of nuclear installations, on the one hand, and the cybersecurity of critical systems on the other.

All this means that the organizations and businesses that operate in this sector will need to be supported by partners who not only have expertise in both nuclear safety and IT security, but also understand the potential vulnerabilities, how to safeguard against them and, most importantly, how to deliver this guarantee over the long term.

In the nuclear industry, maintenance programmes can span three decades or more: a far remove from the frenetic pace at which digital technologies typically evolve. So when it comes to IT/OT convergence, safety begins and ends with the supplier’s ability to make a genuine long-term commitment.

Topics

• Cybersecurity
• Digital transformation
• IoT and edge
• Industry insights