nuclear-news

At a lab on the campus of Purdue University, researchers are testing something that has never been done before in the U.S. energy industry, but has potentially huge implications for the future of nuclear power. They are attempting to demonstrate how to operate a nuclear reactor with all-digital, network-connected instruments and controls, while, at the same time, mitigating the cybersecurity risk of someone hacking into those digital systems.

Earlier this year, federal regulators granted Purdue University Reactor Number One, a research reactor that has been running since 1962, a license to go entirely digital, eschewing the analog wires and tubes that were state-of-the-art at the start of the atomic age and continue to dominate many of the nuclear power reactor fleet’s most important safety systems.

At Purdue, researchers are using the safety of the laboratory to take the exact opposite approach. The digital controls will have wireless connections that the researchers assume can be hacked so they can test how a digital control room can maintain the safety of the reactor even in the face of a cyber threat. “Can we detect that there was an intrusion and how does that affect the rest of the facility?” Clive Townsend, the reactor’s supervisor, explained to Utility Dive.

This research comes at a time when the U.S. nuclear industry is seeking to go further than they have before with digitization. The reactor fleet is getting old and, for the most part, not being replaced by new reactors. If nuclear power is going to continue generating anywhere near the more than half of U.S. CO2 emissions-free electricity that it provides now, extending the life of existing nuclear plants is necessary. As a result, the nuclear industry has been stressing the advantages of digital systems for life extension, including the ability to more easily replace digital equipment as it ages compared to analog equipment that may be decades-old and no longer available.

“By narrowing [the cybersecurity guidance for nuclear plants], you are assuming you know exactly what the adversary is going to do, and that’s a mistake.”

“We are evaluating converting several analog systems to digital” at Surry, Dominion spokesman Kenneth Holt told Utility Dive. Those systems include the annunciators — the panels in the control room full of indicators that light up with warning signs about the reactor status — and the equipment that shows the position of control rods within the reactor core.

Strict rules on cybersecurity, however, pose a challenge to the goal of introducing more digital equipment into a plant. Any digital device or piece of software that the NRC has determined is connected to the systems meant to prevent radiological sabotage undergoes rigorous and continual scanning, updates and other actions to ensure it has not been and cannot be compromised by cybersecurity threats. In addition, any plant employee who has access to this equipment must undergo regular background checks, tests for reliability and trustworthiness and psychological assessments.

There has been some disagreement between the industry and regulators as to which digital equipment should be subjected to the highest level of scrutiny. The NRC’s broad application of its cybersecurity rules has “resulted in reactor licensees having to implement cyber security controls on hundreds to thousands of digital assets, most of which have no direct relationship to radiological sabotage,” like digital indicators on non-safety-related equipment, fax machines, hand-held calibration devices, radios, pagers and calculators NEI wrote in its petition. The group is asking the NRC to narrow its application to only those digital assets that, if compromised in a cyber attack, “would be inimical to the health and safety of the public.”

But NEI filed that petition in June 2014, kicking off an NRC review that is still ongoing. As reactors continue to age, the NRC is conducting cybersecurity inspections of the country’s nuclear plants. Those inspections will likely be likely wrapped up by the fourth quarter of 2020, according to a recent NRC update.

The NRC’s caution about changing the cybersecurity rules is appropriate, according to Edwin Lyman, the acting director of the Nuclear Safety Project at the Union of Concerned Scientists. In an interview, Lyman said the unpredictability of cybersecurity threats means that regulators should keep the guidance for what equipment is subject to the strongest cybersecurity protections as broad as possible.

“By narrowing [the guidance], you are assuming you know exactly what the adversary is going to do, and that’s a mistake,” Lyman said.

A piece of equipment that may not initially appear to be directly related to radiological sabotage could become critical if a cyber attack is combined with a physical attack, according to Lyman. For example, a hack of digital communications devices used by plant security could not lead to a radiological accident by itself, but if the devices were hacked while a physical attack threatened the reactor core, security’s ability to respond and prevent the attack could be compromised. ….

despite the benefits, some plant operators have found these types of digital upgrades to be difficult to justify due to the upfront cost and the time and effort spent going through the regulatory process to get NRC approval for the changes.  …….

NEI officials point out, however, that the test reactor is a tiny fraction of the size of an operating power reactor, so the results of its work with all-digital systems may not always apply to the industry at large. ……. https://www.utilitydive.com/news/as-nuclear-plants-look-to-digitize-controls-and-enhance-performance-cyber/566478/