SNL Material Monitoring System, The T-1 RF Seal, and the IAEA & KAMS

Transcription

1 IAEA-SM-367/7/02 SNL Material Monitoring System, The T-1 RF Seal, and the IAEA & KAMS Lawrence Desonier Sandia National Laboratories PO Box 5800, MS 1361 Albuquerque, NM Abstract Throughout the world, advanced monitoring systems are needed to help monitor nuclear material. These monitoring systems should be capable of supporting a variety of sensors and video equipment and operating in a multitude of configurations and modes. The Sandia National Laboratories (SNL) Material Monitoring System (MMS) fulfills these requirements and more. The SNL MMS can store and deliver sensor information from monitored sites to users anywhere in the world, enabling personnel to have a continuity-of-knowledge of the nuclear material. In addition, the SNL MMS supports various sensor types (e.g., RF and hardwired sensors) and video systems (e.g., still-frame video). The ultimate goal of the SNL MMS is to provide users with the capability of selecting from a variety of sensors and video, installing the MMS system, and running the system without needing to develop additional software to meet unique monitoring requirements. International Safeguards, as applied to storage and monitoring of nuclear materials, requires the application of seals to containment for verification that the material has not been diverted from its agreed upon configuration. At the heart of MMS is the T-1 Electronic Sensor Platform (ESP), which is a wireless containment sealing and monitoring device. The T-1 ESP is designed to satisfy the requirements of the International Safeguards regime as a radio frequency tamper indicating device (RFTID). However, the T-1 ESP concept presents far greater capabilities than a generic RFTID. The T-1 ESP can be configured to monitor a wide variety of digital and analog sensors that may be employed in containment monitoring. Its primary sensor is a fiber-optic loop that is applied to the material containment by passing the fiber through mechanical attachment points to prevent material removal without detection. This RFTID is to be used extensively for monitoring for the K-Area Material Storage (KAMS) project at the Savannah River Site (SRS). The T-1 ESP system has recently undergone an IAEA-directed vulnerability assessment and passed this assessment with favorable results. The assessment evaluated the T-1 ESP vulnerabilities represented by its performance in three main areas: environmental, mechanical, and authentication. Introduction The SNL MMS was originally designed and built to provide for a continuity-of-knowledge for material monitoring. The first system was built to demonstrate that a monitoring system could acquire data from both hardwired and RF sensors, store that data in a Structured Query Language (SQL) database, and allow for retrieval of the data and display to a user. To accomplish this, a flexible, hierarchical architecture was conceived that uses industry standards and an equipment arrangement that provides for data acquisition at the sensor location, possible storage at another location, and viewing at yet a third location. This architecture is represented in Figure 1.

2 MMS relies heavily on commercial applications for its operation. It is built to run under the Microsoft Windows NT 4.0 or Windows 2000 operating systems, store data in the Microsoft SQL Server 7.0 or 2000 Database server, use Ethernet as its communications medium, and rely heavily on the Microsoft Foundation Classes (MFC) in the base source code. The input for sensors also relies on commercially available platforms such as Echelon LonWorks and RS-485 or RS-232 serial input. While the MMS can interface to commercial hardwired sensor systems and various video subsystems one of the main data acquisition components is the T-1 ESP developed at Sandia National Laboratories. Using the flexible architecture, commercial additions, and SNL-developed applications has allowed for the extensibility, successful installation, and use of MMS at several sites around the world. One of the particular sites planning to use MMS is the KAMS at SRS. Figure 1. MMS Logical Layers and Architecture Material Monitoring System (MMS) As depicted in Figure 1 the MMS system consists of five separate layers. The first layer is the sensor layer where all events in the system are generated. The second level is the Data Collection Component (DCC) that gathers data from the sensors and sends that data to the third level, which is the Data Storage Component (DSC). The next level is the Data Dissemination Component, which is optional, and can perform functions such as filtering the data that goes to the final level, the Data Analysis and Review Component (DARC) or a standard web browser. The sensors in the MMS system provide the data for storage and display. The MMS supports many types of sensors including the T-1 ESP, Echelon LonWorks, the Neumann DCM14 video subsystem, and the Los Alamos National Labs (LANL) developed NTVision video system. The integration of all these sensors is shown in Figure 2. The MMS system provides for complete integration between these different subsystems by allowing one sensor system to trigger another. For example, a fiber-open event on a T-1 may trigger a video image to be taken with the DCM14 video system. The MMS design provides a well-defined

3 methodology for easily integrating other sensor subsystems into the MMS. Some of the future sensors include radiation sensors developed at the Remote Sensing Laboratory in Nevada and an AXIS 2100 web video subsystem. Figure 2. MMS System Showing Integration of All Sensor Systems The DCC provides the first level of data collection, data reduction, and data integration for the MMS system. It provides the hardware platform and interfaces for the various sensors. The DCC gathers the unique data from various sensors and translates that data into a Common Data Format (CDF). This allows for consistent data transmission and storage no matter what sensor system is used now and in the future. All data collected by the DCC is not only translated into the CDF, but is stored in its original format in the CDF. This allows for later authentication verification of any authenticated data. All data collected by the DCC is stored in a buffer until the data can be transferred to the DSC. This buffer can also be signed with an authentication signature. In addition to reporting the data collected from the sensors the DCC itself can act as a sensor and report on its condition. Such conditions as the clock being set, the state of the communication ports, and the adding of sensors to the system are some of the data items that can be reported by the DCC. The DCC can be a desktop computer, a rack-mounted computer, or a small low-power, embedded computer that collects sensor data, buffers the data, authenticates the data files, and connects to an Ethernet to forward that data to the DSC for storage. The DSC can reside on the DCC computer or on a separate computer on an Ethernet network where it receives and stores data from the DCC. The data is stored in a Microsoft SQL database. This type of storage provides for robust methods of retrieving data based on industry standard SQL queries. All original data is stored in the database along with the translated data. This allows access to the original sensor messages in order to perform authentication verification. The DSC also outputs web data files for use by a web server in displaying data to a user using a standard Internet browser. The DSC also allows for limited access from users employing a dedicated DARC.

4 The DDC is typically the web server. The server used for MMS is the Microsoft Internet Information Server (IIS) version 4.0 or version 5.0. By using IIS and the NTFS file system access permission in Windows NT/2000 the site can restrict those who may login and view the data. In addition, different login user accounts can have access to different parts of the data. The web browser interface allows users to access MMS historical data from any networked computer with any industry standard web browser. Web users may access the latest events from a site or look at data from previous days via a calendar control. The web pages list all sensor events and images. Event triggered images are linked to the corresponding events. The web interface allows for great flexibility since the user interface can be changed at the web server and the user automatically sees these changes the next time he connects to the server. If secure access to the web data is required over the Internet then a Virtual Private Network (VPN) may be employed using commercially available hardware. The VPN hardwire can also be set to both encrypt and authenticate any data that it forwards. Figure 3. A Map of one of the KAMS Storage Rooms The DARC, which is a customizable user interface, provides a real-time graphical interface to the MMS system. The DARC displays a map-based graphic interface that allows the user to navigate to any location at the site and retrieve information for any single sensor. An example of a map the user might see is shown in Figure 3. The user may request historical data from the site database. In addition, the user may request that authentication signatures be verified from the DARC. Some database queries are automatically generated as the user navigates through the DARC. However, the user is also allowed to pick from pre-generated queries and may make specific queries. The data returned from the query is automatically formatted for the user and displayed in a standard listing configuration. The user may then sort on any column by pointing to the column and clicking the mouse cursor. Data from all queries may be exported easily to the Microsoft Excel data file format. T-1 Electronic Sensor Platform The T-1 ESP is the latest RF-based sensor platform designed by SNL. Its main benefit over past RF sensor platforms is the addition of two-way RF communications capabilities. This provides for a more robust interface with the sensor platform. The T-1 has an internal

5 message buffer that provides storage for its last one hundred messages. Each T-1 has a unique identification number that is contained in every transmitted T-1 message. All messages contain the time the message is generated, obtained from an internal real-time clock. The T-1 authenticates every message with eight-byte signatures from the Tiny Encryption Algorithm (modified at SNL), which uses a 128-bit key. The T-1 has internal binary sensors including motion, tamper, and fiber optic seal. The T-1 supports additional binary sensors for future expansion. Three digital input/output lines allow the T-1 to control or monitor external logic devices. The T-1 supports eight internal 8- bit analog sensors; temperature and battery voltage are currently provided. The analog inputs can be programmed with high and low limits. The T-1 has a unique incrementing message counter for each message sent. In addition, the T-1 has an incrementing counter for each event it detects. Each binary and analog sensor has an event counter that is incremented each time a sensor changes state. Missed messages and events can be detected by monitoring the transmission and event counters. If a message is missed the T-1 can be asked to retransmit that message or messages by giving it the desired message numbers. If this is not desired the types of missed events can be determined by reading the counters for each sensor type. The T-1 transmits state-of-health (SOH) messages automatically at programmed intervals or when polled. On a polled SOH, the T-1 can be requested to transmit a normal SOH or a verbose state-of-health which contains the values for all sensor s counters. The T-1 transmits automatically when any sensor changes state. All messages in the internal buffer or a single message can be retransmitted from the T-1 when requested. The buffer read or single retransmission operation allows continuity-of-knowledge to be established when the original message transmissions have been missed. The interface to the T-1 is through the Interrogator-Transceiver (IT). The IT communicates with the DCC through an RS232 communications port on the computer. It converts the T-1 RF messages to RS-232 serial messages and converts T-1 commands into RF transmissions to the T-1. The IT monitors its internal SOH as well as the background RF noise level. When it detects a high level of background RF interference, the IT sends an event message indicating that a jamming signal may be present. The T-1 can be programmed to repeat transmissions multiple times in case of message collisions. The messages received from the T-1 are sensor-state messages and do not reflect what event caused that message to be transmitted. Therefore, the computer program interfacing to the T-1 must compare the current message with the previous message from that T-1 to determine what event(s) caused that message to be transmitted. In order for the T-1 to be initialized and its parameters set requires an external program to communicate directly with the T-1. This program also has the capability to load the authentication key into the T-1. This hardware interface is through an RS232 serial port on the T-1, which is located inside the battery compartment. The Electronic Sensor Platform Programmer (ESPP) is the additional required software program to connect to the T-1 and set the desired parameters. Some sites have required that individuals programming the T-1 not be allowed to select what parameters to set, but that the site parameters should be hard-coded into the programming software. This requirement and its solution will be discussed in the next section of this paper.

6 The T-1 ESP provides powerful capabilities for monitoring systems. Integration with the MMS adds more system capabilities that ensure continuity-of-knowledge for the storage monitoring applications. The T-1 has been submitted to the IAEA for evaluation. Several MMS systems have been provided for assistance with the evaluation. KAMS & the IAEA The MMS for KAMS at SRS will provide data for joint-use for both domestic purposes and by the IAEA. The use of the MMS by the IAEA at the KAMS facility at SRS has required the addition of features and capabilities to the MMS system. These additions include an IAEA Data Review Station (DRS) consisting of a Data Review Component (DRC), a Removable Key Management Component (RKMC), and a new communications interface between the DRS and the MMS. The interface between the two systems is shown in Figure 4. In addition, requirements include a blind T-1 programmer and a portable T-1 tester. Figure 4. Diagram Showing KAMS Interfaced to the IAEA DRS The new communications interface between the MMS and the DRS will provide for the passage of data from the MMS at SRS into the IAEA DRS installation. The data is stored in files on the MMS DSC and periodically transferred to the IAEA system. The MMS DSC may be set to pass the data automatically as it is received from the various DCCs in the SRS MMS. The MMS DSC will keep track of all information that is transmitted to the DRS to make sure that the data set is complete. The RKMC is designed to run on a laptop computer separate from the DRC. Since this is the case, the RKMC will be connected to the DRC through an RS232 serial interface. All T-1 messages are passed to the RKMC, and each message is authenticated to check signatures for data verification. Success or failure is signaled back to the DRC. The DRC is essentially a DARC, as discussed in an earlier section of this paper, with many added features. One of the new features is a calendar that reflects if there are event messages for the day in the MMS. In addition, the DRC will automatically display summary data to reflect the present SOH of all sensors in the system.

7 Two other special programs are being developed for support of interfacing the IAEA to the KAMS system. The first is the blind programmer. For the IAEA to be able to program the T-1 ESP with the authentication key requires a T-1 programmer. Since the system at SRS is a joint-use system the site operators have required that the domestic parameters be hardcoded into the programmer. The IAEA will only be able to program the key into the T-1 as the programmer inserts the site-required parameters. The last piece of software required by the IAEA for use with the T-1 is a T-1 quick tester. This will require that the T-1 antenna be hard-wired to the antenna of the Interrogator Transceiver. The program will run on a laptop and quickly test the interface to the T-1. It will be used to verify that it is indeed the T-1 that was just programmed, that the T-1 is operating within normal parameters, and that the messages coming from the T-1 authenticate properly. Conclusion The MMS uses a flexible, hierarchical architecture to provide for the near-real-time acquisition of data and display of that data virtually anywhere in the world. The use of commercially available components and various sensor configurations has allowed for the successful application of MMS at many different locations throughout the world and for many different projects. References J. Damico and L. Desonier, An Internet Based Object Oriented Hierarchical Information System for Material Monitoring, 39 th Annual Meeting, Proceedings of the Institute of Nuclear Materials Management, J. Damico and L. Desonier, Material Monitoring System Update: Enhancements and Applications, 40 th Annual Meeting, Proceedings of the Institute of Nuclear Materials Management, L. Desonier, SNL Material Monitoring System: Sensor Configurations and Latest Applications, 41 st Annual Meeting, Proceedings of the Institute of Nuclear Materials Management, J. Matter and R. Tzolov, The Two-way Radio-Frequency Seal (TRFS) and its Application for Joint Operator-IAEA Use, Symposium on International Safeguards: Verification and Nuclear Material Security, Vienna, Sandia is a multiprogram laboratory operated by Sandia Corporation, a Lockheed Martin Company, United States Department of Energy under contract DE-AC94AL85000.