Secure Video Surveillance System (SVSS) for Unannounced Safeguards Inspections

Transcription

1 1 IAEA-CN-184/124 Secure Video Surveillance System (SVSS) for Unannounced Safeguards Inspections M. Pinkalla a, E. Galdoz b a Sandia National Laboratories Albuquerque, New Mexico USA b Brazilian-Argentine Agency for Accounting and Control of Nuclear Materials (ABACC) Rio de Janeiro, Brazil mnpinka@sandia.gov Abstract. The Secure Video Surveillance System (SVSS) is a collaborative effort between the U.S. Department of Energy (DOE), Sandia National Laboratories (SNL), and the Brazilian-Argentine Agency for Accounting and Control of Nuclear Materials (ABACC). The joint project addresses specific requirements of redundant surveillance systems installed in two South American nuclear facilities as a tool to support unannounced inspections conducted by ABACC and the International Atomic Energy Agency (IAEA). The surveillance covers the critical time (as much as a few hours) between the notification of an inspection and the access of inspectors to the location in facility where surveillance equipment is installed. ABACC and the IAEA currently use the EURATOM Multiple Optical Surveillance System (EMOSS). This outdated system is no longer available or supported by the manufacturer. The current EMOSS system has met the project objective; however, the lack of available replacement parts and system support has made this system unsustainable and has increased the risk of an inoperable system. A new system that utilizes current technology and is maintainable is required to replace the aging EMOSS system. ABACC intends to replace one of the existing ABACC EMOSS systems by the Secure Video Surveillance System. SVSS utilizes commercial off-the shelf (COTS) technologies for all individual components. Sandia National Laboratories supported the system design for SVSS to meet Safeguards requirements, i.e. tamper indication, data authentication, etc. The SVSS consists of two video surveillance cameras linked securely to a data collection unit. The collection unit is capable of retaining historical surveillance data for at least three hours with picture intervals as short as 1sec. Images in.jpg format are available to inspectors using various software review tools. SNL has delivered two SVSS systems for test and evaluation at the ABACC Safeguards Laboratory. An additional proto-type system remains at SNL for software and hardware testing. This paper will describe the capabilities of the new surveillance system, application and requirements, and the design approach. 1. Introduction The Brazilian-Argentine Agency for Accounting and Control of Nuclear Materials (ABACC) and the International Atomic Energy Agency (IAEA) perform safeguards verification activities at nuclear installations in Brazil and Argentina. In particular, ABACC and IAEA require surveillance measures to support unannounced inspections. Currently, the EMOSS (EURATOM Multi-camera Optical Surveillance System), developed by EURATOM for the IAEA, is the surveillance technology employed. The EMOSS is out-of-date and no longer manufactured, which has presented difficulties in purchasing spare parts and performing system maintenance. It is increasingly prone to failure. The ABACC therefore desires a replacement system, specifically designed to fulfill unannounced inspections requirements. The IAEA has been developing its next-generation surveillance system ( XCAM ), which eventually will replace existing safeguards surveillance systems. However, XCAM is not yet in production, and it is not known when new units would replace the EMOSS in South American facilities.

2 The ABACC and the U.S. Department of Energy (DOE) therefore agreed to develop a system suitable to replace the ABACC EMOSS units with current commercial off-the-shelf (COTS) technology customized to comply with the specific requirements for the unannounced inspection application. The solution would ensure data redundancy, confidence, and system reliability, with a relatively low cost for development, construction, operation, and maintenance. 2. Application Requirements The safeguards approach for unannounced inspections requires that a specific field of view be kept under surveillance from the time inspectors request access to the time they finally arrive at the area of interest. Any surveillance collected before the unannounced inspection request may not be disclosed to the inspectorate. The facility operator must ensure that inspectors can reach the inspection location within two hours after the inspection request; thus, the surveillance system should never retain more than the previous few hours of images. Whenever inspectors are able to gain access more quickly, all images acquired prior to the inspection request must not be visible to the inspector. The goal of the video surveillance system is to collect images in rapid succession to ensure the video detection of short-duration activities. ABACC requires a Picture Taking Interval (PTI) of one second between successive surveillance frames. The ABACC and IAEA inspectors may review the surveillance record either jointly or independently during unannounced inspections. All review activities must take place on site and no images may be removed from the facility. The surveillance system must therefore provide the inspector with all software tools necessary to obtain a safeguards conclusion prior to leaving the facility. In case of inconclusiveness or doubt, it must be possible to store the images on external media, kept under joint seal (ABACC, IAEA, and operator). SVSS acquires images from two independently-positioned cameras that transmit via wire links of arbitrary length to a collection unit for storage and review. The links must be protected using authentication measures to ensure that the inspector can trust the image data. In addition, the camera housings and collection unit must include tamper indication. To increase system reliability, images must also be retained as backup within the camera s flash memory. The backup images would only be needed to recover surveillance in the event of a collection unit or transmission failure. Administrative procedures would be necessary in this case so that the inspector was able to access only the images required. The system must operate on mains power provided by a secured facility electrical line. An uninterruptable power supply (UPS) within the tamper-indicating enclosure is required to protect against short-term loss of power. The UPS will further ensure that the cameras have priority to operate autonomously. 3. Design Approach The design utilizes commercial, off-the-shelf (COTS) components suitably integrated in a system that complies with the stated requirements. A number of cameras with different features could be used for the intended purpose. A Sony network camera was selected for this application because of its availability, reliability, performance characteristics, and operational experience. The camera is capable of acquiring and collecting images via Ethernet at a one second or shorter PTI. It is also capable of storing images locally on removable flash memory. The images acquired by the camera modules are transmitted (pushed) to a collection computer or server. The data transmission is handled by an Ethernet connection between each camera and the server. To ensure that the images stored in the server for review are authentic and generated by the actual and originally configured camera, the transmission is encapsulated inside a VPN (Virtual Private Network) tunnel, implemented with VPN hardware devices already approved for safeguards purposes. To confirm that no tampering has occurred in the system, the camera enclosures and server cabinet are

3 sealed using Agency approved seals to permit independent access of only one agency (IAEA or ABACC) during inspections. The cabinet selected to enclose the server computer is a two compartment Hoffman enclosure, accessed by independent doors. The bottom door is sealed with a passive metallic seal intended for access to the main system components for maintenance purposes only. The top door is sealed with an electronic seal (VACOSS or EOSS), which allows the inspector to access the server computer during a surveillance review by using the supplied keyboard and monitor. The collection computer is an industrial PC running standard software for storage and review of the images, based on the storage requirements. Specific software operates on the server to maintain at least three hours of data, yet permits an inspector to review at most two hours of the most recently recorded data. The software also downloads the jpeg-format images from the camera(s) and converts the images into an AVI file for playback review during the inspection activities. In the event of a system failure, it is possible for an inspector to retrieve the images directly from the local removable flash memory in the camera for manual safeguards review. Safeguards technical data are also recorded on the system. System logs are continuously updated with information about any abnormality that may have occurred during the period between two consecutive inspections, e.g., dropped images, camera or server housing tamper events, high temperature alerts, etc. Inspectors can review these events in the system logs to assess the reliability and performance of the system. A UPS provides uninterruptable power to the system to ensure that a power outage does not cause an interruption of the surveillance process. The UPS is designed to provide power to the system continuously. If the power outage persists, the UPS will initiate shutdown of all hardware components except for the cameras, which will use the remaining battery power for image collection. Critical components are powered in a redundant configuration. Multiple DC power supplies provide power to the components. The cameras operate from parallel power sources; a DC power supply and a DC power converter. The DC power supply is powered directly from the facility mains power. If that fails, the DC power converter begins tapping power directly from the batteries of the UPS system. This will maximize camera operation during a power outage by utilizing the available battery power after UPS system switches off. The photograph in figure 1 shows the prototype cabinet with the inspector door opened and the closed cameras housings on top. The diagrams in figures 2 and 3 show the main components of the system and their interconnection. 4. Software Approach The system is designed using a client server model, where the cameras act as clients producing images and the server receives and stores the images pushed periodically by the client s cameras. A two-layer software platform operates in the server computer: -based layer receives and stores the images in the server hard disk. Images older than the time limit are removed at this level. System status events are also processed and recorded in this layer. -based layer operates as an interface to the inspector, and allows the image review. Both operating systems run on the same computer, by using virtualization software to share resources. The Linux operating system hosts the applications that comprise the SVSS software. Linux was chosen due to the availability of quality open-source software tools. These tools allowed the SVSS software to integrate off the shelf capabilities to meet the design and application requirements. State of health, event logging, construction of the dual image AVI file, and ftp server for camera image collection were capabilities obtained by the addition of open-source software. Custom Perl scripts were used as the integration glue code to allow the separate applications to act together as a system. All the software tools are accessible through the Windows side web browser. The Windows operating system is the user interface used by the inspector to access the SVSS software and

4 run the video review application. Currently, a standard utility is used to play AVI video files. An AVI file is created upon the receipt of a request for inspection. The inspection must fall within appropriate time constraints and is restricted to the period under surveillance only. The software will take the images stored and generate the AVI file. The Windows operating system also offers flexibility to run future applications. It is foreseen that software specifically designed for safeguards review of surveillance will be used, such as GARS, which can be modified to handle the images generated by SVSS cameras. Figure 1: Picture of SVSS Figure 2: Functional diagram of the camera modules

5 Tamper-protected enclosure Air Vent Flat Screen Monitor S1 Door Switch (Operations) Panel mounted to separate Inspector Review from Equipment & Service functions Keyboard/Mouse Inspector Review Fan Equipment and Service 12VDC to Cameras Data Collection Unit Hard Drive Fan Temp Sensor S1 S2 220VAC IN Diodes VPN I/O Device All external DC power and network cables to be inside flexible conduit DC to DC Converter To VPN, I/O and Switch To Fan and Camera VPN To Fan and Camera VPN Ethernet Switch To Monitor 220VAC S2 Door Switch (Maintenance) To Camera VPN devices ~ 5 minutes back-up ~ 6 hours back-up ~ 5 minutes back-up Battery UPS (220VAC) 220VAC IN Air Vent Figure 3: Functional diagram of cabinet

6 5. Conclusions The joint DOE/SNL-ABACC project has successfully assembled two SVSS units that have been delivered to ABACC, as well as an initial prototype unit kept at SNL. The systems have been set up for ongoing testing and evaluation. ABACC will decide if, when and where to deploy each of the delivered units. SNL will continue working with ABACC as required to support the system application. Utilizing commercially available, industrial grade components succeeded in producing a particular solution for this specific Safeguards application. The main advantage to the commercial equipment is availability and sustainability. Employing modular commercial components that are available worldwide allows for efficient maintenance necessitated by failures or upgrades. The software development and testing cycles of the project dealt successfully with various unforeseen challenges to the system integration. Software interdependencies, performance of individual components, and communications protocols presented occasional difficulties requiring special development attention. The extensive testing was therefore a critically important aspect of the project, and ultimately provides the necessary confidence in the system to both acquire and report safeguards information reliably. Acknowledgments Sandia is a multi-program laboratory operated by Sandia Corporation, a Lockheed Martin Company, for the United States Department of Energy under contract DE-AC04-94AL85000.