The OT cybersecurity community has largely focused on IT/OT convergence and cyberattacks as the primary cybersecurity concerns. However, the recent Hatch nuclear plant scram (forced shutdown) illustrates a broader engineering issue. The scram occurred within four minutes after installation of a new network switch that experienced a broadcast storm. According to the NRC report, the broadcast storm simultaneously caused the turbine control valves to close, the turbine control displays to freeze, and alarms to be suppressed. Based on industry experience, similar incidents have occurred in other industries but have generally not been publicly reported. The Hatch incident demonstrates that digital communications are no longer merely supporting infrastructure. They have become safety-critical components of industrial and manufacturing processes. Any facility that depends on digital communications to monitor, control, or protect physical processes faces the same challenge: ensuring that communications remain reliable, deterministic, and trustworthy because communications failures can directly affect equipment operation, operator situational awareness, and facility safety. Protecting these facilities therefore requires more than defending against cyberattacks. It also requires treating digital communications with the same engineering rigor applied to process sensors, actuators, controllers, and other safety-critical equipment. Where appropriate, facilities should employ independent process sensor monitoring that acquires sensor data through communications paths separate from the primary control network, providing operators with trusted process information even when the control network is degraded or unavailable.
Tue, Jul 28
When Digital Communications Became Safety-Critical: How a Network Switch Failure Affected Control System Logic and Operator Situational Awareness
1