Digital Twin-Based Lifecycle Methodology for Ensuring Safety of NPP/SMR I&C Systems

Abstract

This paper presents a digital twin-based lifecycle framework aimed at improving the safety and security of instrumentation and control (I&C) systems for nuclear power plants and small modular reactors. The approach formalizes DT components, functions, and stakeholder interactions across the entire lifecycle, enabling continuous V&V, accelerated commissioning, proactive fault detection, cyber-resilience, and faster and safer modification of I&C algorithms. The methodology is validated through case studies involving DT-supported V-model testing and Markov-based modeling of the intelligent diagnostic system of an NPP pump. The results show that the proposed DT-enabled lifecycle methodology increases test coverage, shortens verification time, and enhances proactive safety and security capabilities of I&C systems. The study outlines future research directions toward adaptive, explainable, and regulation-ready DTs for next-generation nuclear systems.

1. Introduction

1.1. Motivation

Complex electromechanical systems and instrumentation and control (I&C) systems, particularly those that are part of the equipment for nuclear power plants (NPPs) and small modular reactors (SMRs), are subject to exceptionally high requirements for reliability, safety, and the transparency of their functions. Furthermore, these systems require rigorous oversight from both national and international regulatory bodies. Consequently, every phase of the lifecycle (LC) involves significant effort in planning, design, development, decommissioning, monitoring, and verification and validation (V&V). Inadequate pre-investigation, preparation, monitoring, and, in particular, insufficient V&V of changes introduced to the control algorithms of an already operational plant can lead to catastrophic consequences. For this reason, modifications to algorithms during the operation phase are often either blocked entirely or require a substantial amount of time to implement. Simultaneously, there is a growing need for periodic changes, both for optimization and for adaptation to new operating conditions. Sometimes, the necessity for such changes arises under severe time constraints. A case in point is the situation of nuclear power plants in Ukraine during the war, following significant damage to the energy infrastructure. The rapid modification of control algorithms for NPPs became a necessity, serving both to improve reactor control and safety and to maintain the operability of the country’s main source of electricity. Thus, there is an urgent need for research into methods and tools to accelerate the introduction and V&V of changes in the algorithms of I&C systems for NPPs and SMRs without compromising quality.

A digital twin (DT) [1,2] of a current (real) or future technological process—which is particularly relevant for SMRs based on novel principles—will enhance the efficiency of the validation and verification (V&V) process for developed and manufactured I&C systems. This is achieved because the DT allows the system to be tested using a greater quantity and variety of test stimuli (input data sets). These input data sets will also be fed to the I&C system at varying rates of change, corresponding to different states of the technological process or processes. Automating the testing process will enable the complete system functionality to be tested within a short period, thus potentially achieving 100% test coverage. This is especially critical whenever changes are introduced to the I&C system algorithms. Consequently, the use of a DT can significantly reduce the time required for V&V and allow for the detection of more faults before the start of the pilot run (or experimental operation), which, in turn, substantially decreases the cost of rectifying the identified faults.

For an already deployed I&C system, combined with accumulated operational and real-time data, the DT can provide (a) the improvement of algorithms due to parameter changes or the detection and elimination of faults and vulnerabilities and (b) the adaptation of algorithms resulting from changes in operating and environmental conditions. In all these cases, algorithmic changes must be implemented, and testing must confirm that all modifications have been executed correctly. It is anticipated that the I&C cabinets, which typically employ a 2oo3 or 2oo4 configuration, would be connected to the DT to perform 100% testing within a compressed timeframe.

Thus, urgent challenges necessitate formalized methodological and technological solutions. These solutions should establish the principles for using DTs across various stages of the NPP and SMR I&C system lifecycle, particularly for design and for V&V processes, as well as for accelerating the introduction of changes to control algorithms and the development of flexible approaches that allow for DT integration even under limited budget and modernization timelines.

1.2. Objectives and Structure

The goal of the study is to increase the availability of I&C system of NPP/SMR by improving test coverage and decreasing risk of latent failed states due to the application of a digital twin.

The objectives of the study are to develop a flexible and cost-effective methodology for utilizing digital twins to enhance the comprehensiveness and quality of verification and validation, to accelerate the implementation of changes to control algorithms during operation, and to ensure the proactive and resilient performance of instrumentation and control systems for small modular reactors throughout their entire lifecycle.

The structure of the paper is as follows. Section 2 (State of the Art) provides an overview of current research and publications on the application of DTs in nuclear energy, focusing on V&V and predictive maintenance tasks. Section 3 (Methodology) details the proposed methodology, including a set-theoretic model and a description of the DT architecture and functions for each lifecycle stage. Section 4 presents the set-theoretic model describing the DT system for SMR I&C. Section 5 formulates the detailed structure and architecture for using the DT across different stages of the SMR lifecycle. Section 6 (Practical Cases) introduces two practical case studies: the integration of the DT into the V-model lifecycle of an existing I&C modernization project, and a multi-fragment Markov-based model of an intelligent diagnostics system for an SMR pump during the operation stage. Section 7 (Discussion) discusses the principles of DT evolution and cybersecurity issues, proposes metrics for implementation effectiveness, and analyzes the research results. Section 8 (Conclusions) summarizes the results and outlines directions for future research.

2. State of the Art

The concept of the DT was presented in 2002 with the aim of creating a product lifecycle management (PLM) center [1]. There are many definitions from various institutions, companies, and consortia, and standards are still in the process of active development. For example, the glossary from the Digital Twin Consortium writes the following [2]—A digital twin is an integrated data-driven virtual representation of real-world entities and processes, with synchronized interaction at a specified frequency and fidelity. However, it is still necessary here to explicitly consider such important aspects as the lifecycle and the possibility of using integrated physical, rule-based, and other models. Thus, the harmonized definition sounds like this: A digital twin can be considered a digital representation of a physical object or process based on the integration of various statistical, data-driven, and physical models that are synchronized with the physical object in real time via a two-way channel and can be used for monitoring, predicting various types of failures, optimizing operating costs, and determining what-if scenarios at different stages of the physical object’s lifecycle.

The use of DT for industrial systems and critical infrastructure facilities is becoming increasingly relevant, particularly for small modular reactors and nuclear power plants. At each stage of the critical infrastructure lifecycle, DT can support various operations to improve the reliability or speed of procedures in the design, implementation, operation, and decommissioning of equipment [3,4,5,6,7,8,9].

Publications in this area are appropriately divided into several groups:

• DT for NPP and SMR reactors and systems;
• DT for the V&V of industrial control systems (ICS) and I&C systems for NPPs and SMRs;
• DT for predictive maintenance.

2.1. DT for NPP and SMR Reactors and Systems

Several works are devoted to facilitating certification procedures and regulation at each stage of the lifecycle of MMPs and NPPs using a DT [3,4,9].

For example, in [3], when researching advanced approaches to implementing SMR, the authors recommend paying attention to the adaptive regulatory framework. They propose using AI to review documents and model hazard scenarios, which will make it possible to speed up and improve the certification process during design and make monitoring more transparent and visual. Regulatory authorities should develop guidelines for the submission of digital twins and maintain constant feedback with developers and operators.

Article [4] discusses digital twins for the operation of nuclear-powered ships. It also emphasizes that the digital twin of a ship’s SMR will improve the interaction between stakeholders and regulatory agencies at every stage of the equipment’s lifecycle. First, it improves resilience by using insights from the DT. Monitoring, simulations, analysis, and testing of scenarios for both the NPP itself and related equipment allow for more proactive maintenance and operational changes. Second, models and data obtained from past use of the SMR in operation can be used for feedback during the design of future versions of the SMR. Third, the DT can serve as a testing ground for improving maintenance prediction algorithms and for increasing operational efficiency and reliability. It should be noted that the process of building accurate models is particularly complex in the nuclear industry, which in turn leads to significant investments for such projects.

Ref. [9] focuses on the use of DT to ensure the safe operation of nuclear facilities. Such a DT-based tool can perform accurate diversion pathway analysis, determine pathway indicators, develop the necessary sensors to detect these parameters, and monitor facilities in real time using critical data flows that leverage the advantages of this “safeguards-by-design” approach. DT can be integrated into the design and operation of nuclear power plants to simultaneously ensure safety, security, and safeguards (3S by design). By embedding sensors and virtual monitoring systems early in the design phase, DT can provide continuity of knowledge, help detect anomalies or potential deviations, and assist inspectors in real time. This proactive integration helps reduce the need for costly upgrades and improves the efficiency and reliability of nuclear facility oversight. The authors in [5] consider the application of DT with uncertainty estimates for nuclear power plants. Due to the specificity of the domain, it is believed that the development of a DT model should primarily rely on model-based mechanistic methods in order to leverage extensive experience and understanding of these systems, and only then apply non-model-based methods to selectively and correctively address the limitations of the former. Among the advantages are real-time monitoring, which provides automation and preventive maintenance, accelerated development, improved risk assessment, and optimization of various aspects of the system.

Ref. [8] addresses the problem of data synchronization in the DT due to the complexity of the reactor and the number of sensors. They use DT for studying nuclear reactor dynamics, focusing on solving SMR stability problems. A method for creating a reactor DT is proposed, which includes a data-based state synchronization method and an online calibration method based on model predictive control. Additionally, ref. [5] proposes a partial solution to this problem by dividing the DT into submodels that should operate in real time and more complex models for high-precision checks and simulations.

Ref. [10] investigates a system for detecting transient processes at nuclear power plants using zero-shot learning based on DT. In this work, the digital twin performs simulations of the expected behavior of nuclear power plant parameters under normal conditions. Detection is performed by comparing the expected behavior with the behavior predicted by AI. The authors also note the problem of data availability for AI training. In [11], a detailed real-time digital twin (RTDT) for a sodium-cooled fast reactor (SFR) is proposed, implemented on a field-programmable gate array (FPGA) and allowing high-speed simulations for HIL testing. The digital test bed serves as a tool for the V&V of new SMR designs and their control systems.

A detailed overview of the properties, features, and challenges of digital twins for nuclear reactors is provided in [12]. Key properties of DT, such as real-time response, accuracy, and safety, are analyzed, and their use for design optimization, intelligent operation, staff training, and decision support is discussed. The paper highlights the unique challenges of the nuclear industry, such as high safety requirements and system complexity, which affect the development and implementation of DT.

Ref. [13] analyzes the use of DT to improve safety management in various industries, including nuclear energy. The authors highlight the following main areas: monitoring and detection of anomalies, predictive analysis, accident simulation and reconstruction, decision support, staff training, predictive maintenance, and the improved effectiveness of inspections in order to prevent failures. The problems include data integration and complexity, data security, system development complexity, standardization issues, high initial cost, and working with trust and explainability for using the technology in critical decision-making. In systematic review [14], similar applications and challenges are highlighted. In addition, lifecycle management is defined as one of the applications for the energy sector. Problems with real-time data synchronization and the complexity of DT validation are pointed out.

The use of DT can play a critical role in improving safety and reliability in nuclear power, especially for advanced reactors such as small modular reactors from the design stage to the decommissioning stage [15,16]. According to [15], DT offers significant opportunities for physical inventory management by tracking materials and modeling various scenarios to ensure regulatory compliance. In addition, they can automate perimeter intrusion detection systems (PIDAS), which helps classify false alarms, predict sensor failures, and comply with regular testing requirements. Crucially, DT promotes the concept of security-by-design, helping to identify weaknesses and prepare for future threats. Ref. [16] emphasizes the need for synergy between the principles of functional safety, information security, and safeguarding, i.e., physical security (3S). Similar to [15], it emphasizes the importance of proactive implementation, which can be described by the concept of 3S-by-design. This helps identify vulnerabilities and optimize protective measures, increasing system resilience at the planning and design stage. However, the security of the DT itself should not be forgotten. Thus, in [17], a methodology for assessing the cyber hygiene of the digital twin of the occupational safety management system of engineering and technical personnel of civil aviation was created.

Separately, it is worth highlighting the possibility of using UAVs as a tool for technical inspection and creation of DT power stations [18]. These can also be used as platforms for sensors to ensure the current status of the DT.

In addition to DT-based solutions, the use of AI in nuclear energy is being actively researched [6,7]. In [6], a CNN–LSTM–attention neural network was specially developed for diagnosing and detecting faults in SMRs, which improved diagnostic accuracy by 7%. The model is based on an attention mechanism. This increases the weight of critical information while reducing the influence of irrelevant data. Ref. [7] discusses achievements in the field of condition assessment and the application of AI in structural and mechanical systems, from piping equipment to concrete structures.

The use of digital twins in nuclear energy, particularly for SMRs and NPPs, offers advantages by enabling accelerated certification and regulation [3,4,9], optimized operation and increased reliability [4,5,12,13], improved forecasting and maintenance [4,13], and increased safety of nuclear facilities [9,13]. They enable real-time monitoring [5,13], accumulation of operational data [4,5,9,14], detection of transient processes [10], and HIL simulations [11]. However, their implementation faces challenges such as the complexity of processing and protecting large amounts of data [4,5,13], the need for additional tools (UAVs) when creating DTs for specific cases [18], significant investments [4,13], insufficient standardization [5,9,12,13], the complexity of implementing continuous real-time data synchronization [8,14], as well as a critical need for verification and validation [9,11,12,13,14] and the assurance of security [17], trustworthiness, and explainability [13].

2.2. DT for V&V of Industrial Control Systems and I&C of NPPs and SMRs

Operating reliability assessments for instrumentation and control systems (I&Cs) is one of the most important activities, especially for critical domains such as nuclear power plants [19]. An important source of I&C reliability information is operational information from the system in the laboratory or during operation. This allows for the continuous updating of the database of current failure modes and failure information when planning countermeasures [19]. DT can play the role of such a centralized repository and additionally perform a number of important functions in conjunction with industrial control systems; for example, V&V [20,21,22,23,24,25]. Using DT as a test environment for checking functionality, cybersecurity, and for the detection of anomalies allows for non-destructive and cost-effective testing [20].

DT can improve the continuity of engineering work throughout the asset’s lifecycle [20]. A DT model synchronized with equipment data increases validation capabilities when compared with traditional methods. In general, Ref. [20] reviews the literature on DT for V&V in various industries. The author identifies three classes of such applications: (1) exploratory investigation—evaluating scenario data in order to understand the behavior of a system in a given situation by conducting experiments or learning from the example of a system in action; (2) testing—in which DT is used for comprehensive testing of properties and functional capabilities in accordance with its specifications; and (3) formal proof—this is another aspect of V&V that mathematically proves certain system behavior, and DT here helps to generate models or data for formal methods.

DT can be used as a non-destructive test environment for V&V. Testing on real industrial equipment or even prototypes is expensive and carries additional risks [21,22,23]. Thus, Ref. [21] presents a framework for detecting intrusions into ICSs based on a digital twin. The authors implement four types of attacks on an autonomous digital twin of an industrial bottling plant and propose a machine learning-based stack ensemble classifier for real-time intrusion detection. The digital twin acts as a safe and non-destructive test environment for developing and evaluating intrusion detection systems. In [22], a similar use of a control system for testing and evaluating the security of an ICS is extended to functional testing. This concept was confirmed using the example of a bottle filling system controlled by a programmable logic controller (PLC). Ref. [23] also proposes a cyberattack detection system, but one that is based on a hybrid DT that includes both a plant model and a controller. This allows attacks on control equipment to be taken into account and simulated. A laboratory setup simulating an ICS water supply was used as the target plant in the implementation. Additionally, DT has proven its suitability for validating nonlinear industrial systems by accurately representing their complex dynamics, as demonstrated by the validation of an industrial installation model using DT based on the Hammerstein model [24]. A different approach to this issue was taken in [25], where a DT was used to train and validate students’ decisions in a non-destructive environment. A DT was created for an automated cocoa processing line, which was used for remote student training. The system also allows for the simulation and validation of updated control and management algorithms prior to implementation in production, reducing risks and downtime.

Thus, digital twins play a key role in the verification and validation of industrial control systems, including NPP and SMR I&C, providing a non-destructive and cost-effective test environment for the entire equipment lifecycle [20]. These enable in-depth research into new concepts, comprehensive functional testing and cybersecurity verification, including the detection of intrusions and attacks on controllers [21,22,23], as well as formal proof of system correctness [20]. In addition, DTs are effective for the accurate validation of complex nonlinear systems [24] and are used to train personnel and test updated control algorithms in a safe virtual environment [25].

2.3. DT for Predictive Maintenance

DTs are becoming an important technology in the implementation of predictive maintenance for critical equipment in industry and infrastructure. In particular, in sectors such as energy, transportation, and manufacturing, DT enables continuous monitoring of the technical condition of systems, the detection of signs of degradation at early stages, and the prevention of accidents through timely maintenance, thereby increasing system availability and reliability [26,27,28,29,30,31]. Ref. [26] presents a framework that supports the implementation of a distributed digital twin capable of improving prognostic and health management (PHM) in an IIoT-enabled manufacturing environment, such as wind turbines. The DT predicts the behavior of the gearbox temperature based on a few selected variables and predicts failures two weeks in advance. A feedback mechanism regulates deviations and controls identified components to remain within threshold values, potentially extending the asset’s useful life. In [27], the implementation of predictive maintenance based on DT was also studied, with induction motors selected as the object of study. Ref. [28] presents a digital twin framework for smart manufacturing that allows one to compare machine learning models for predictive maintenance with the effective prediction of surface roughness and energy consumption in turning. A systematic review [29] reveals some details regarding the use of DT in the field of transport system maintenance and operation, where the main areas of DT application are identified, in particular for improving the reliability, maintainability, and efficiency of transport fleets. In [30], the authors developed a DT framework for maintenance systems (using HVAC as an example), integrating generative AI for generating simulation data and explainable AI for explaining model predictions. Such application is relevant for the nuclear industry, as it improves the transparency of DT and helps in modeling rare conditions for various failures. Ref. [31] aims to fill the gap with limited empirical data on the economic impact of predictive maintenance by quantitatively assessing the economic performance of manufacturing companies in the Visegrad Group countries. It has been demonstrated that the implementation of predictive maintenance (PdM) significantly increases the profitability of enterprises, reduces production costs, and optimizes the use of assets. Statistical analysis has shown the positive impact of PdM on operating profit, as well as on reducing production costs in some EU countries. Refs. [32,33] explore the use of DT in industry as a decision support system and compliance control.

An analysis of the sources cited [26,27,28,29,30,31,32,33] shows that digital twins are becoming a fundamental tool for implementing predictive maintenance strategies in critical sectors such as energy, transport, and industry. They not only enable accurate failure prediction and modeling of rare scenarios, but also ensure transparency in decision-making. However, well-known publications do not describe in sufficient detail the methodological and technological solutions that would form the basis of DT-based lifecycle models for complex systems such as NPP, SMR I&Cs, and, in particular, V&V processes.

Based on the analysis of existing studies on digital twin (DT) applications in instrumentation and control (I&C) and cyber–physical systems (e.g., [3,4,5,8,9,11,12,13,14,19]), which predominantly address isolated lifecycle (LC) stages or individual DT functions, this study proposes, as a novelty, a unified framework for embedding a digital twin consistently across all stages of the V-shaped lifecycle of an I&C system, formally grounded in a set-theoretic model that integrates physical and component entities, DT functions associated with specific LC stages, stakeholders, data types, and evolving virtual models that co-develop with the physical system and reflect its operational state over time. To operationalize this framework and bridge the gap between conceptual modeling and practical implementation, the study further introduces a set of stage-oriented DT–I&C interaction diagrams that explicitly describe the role and integration of the digital twin at the design, test, commissioning, operation, modernization and decommissioning stages, thereby providing a structured representation of DT-supported information flows and decision-making processes across the system lifecycle. Finally, the proposed framework is analytically instantiated through multi-fragment Markov availability models that extend conventional reliability and availability analysis by explicitly incorporating the adaptive role of the digital twin during the operation stage, including relearning mechanisms and increasing diagnostic trustworthiness, which enables quantitative assessment of availability indicators and supports informed decisions related to maintenance and relearning strategies.

3. Methodology

Given the high complexity and limited time and resources available for projects to modernize the ICS of nuclear power plants and other complex facilities, the research focuses on developing a flexible and cost-effective methodology. The goal is to use digital twins to improve the completeness and quality of testing, as well as to identify anomalies throughout the development lifecycle of a new ICS. The main concept is the continuous (end-to-end) use of DT throughout the various stages of the ICS SMR lifecycle. In this methodology, DT serves as a means for two-tier V&V during both design and operation. This methodology is based on a sequential, multi-stage approach that includes theoretical representation, modeling, and practical application of digital twins. Thus, the methodology consists of five steps (Figure 1): theoretical and multiple representation of the system, which provides a general description of its components and corresponding general processes (step 1); development of an ICS model with a digital twin for all stages of the lifecycle, which evolves and grows accordingly (step 2); a case study with a specific demonstration of how the proposed high-level modeling toolkit is used to verify the ICS (step 3); a practical case with an analytical model—creation of a Markov model and the parameterization and simulation of an intelligent system for diagnosing an SMR pump (step 4); and discussion, conclusions and future research (step 5).

Figure 1. Methodology.

The first step will be to develop a formalized set-theoretic representation of the ICS with an integrated digital twin for the lifecycle stages. This model will consist of the following sets:

• A set of physical entities (PE): hardware and software, sensors, actuators, etc.
• A set of functions (F): all functions performed by the DT at each stage of the LC.
• A set of stakeholders (SH): all participants in the process, from developers to regulatory authorities.
• A set of data (D): all types of data used in the system (historical, streaming, ontological, etc.).
• A set of versions—digital twin (DT) models: a set of virtual models that change over time according to the stages of system development and reflect the corresponding physical entity.

In the second step, a detailed diagram describing the interaction between the DT and the ICS will be developed. This will allow one to visualize the dynamics of the system at each stage of the LC.

• Sub-step 2.1. Modeling at the Design Phase: Creation of a model demonstrating the use of DT for validation and verification (V&V) of the ICS design.
• Sub-stage 2.2. Modeling at the commissioning stage: Creation of a diagram showing the use of DT for testing and debugging the physical ICS.
• Sub-phase 2.3. Modeling during the operation phase: Development of a model to demonstrate monitoring, predictive maintenance, and algorithm adaptation functions.
• Sub-step 2.4. Modeling at the decommissioning phase: Create a diagram showing the use of DT for planning and for assessing dismantling risks.

For practical illustration of the proposed methodology, two practical cases will be demonstrated, covering the third and fourth stages. The third stage (practical case 1) will include the following:

• Selection of a specific scenario: Consideration of a scenario for modernizing the ICS at an existing nuclear power plant.
• Application of the methodology: Demonstration of how the selected DT classification allows flexible selection of their properties for each level of V-shaped lifecycle testing.
• Improving test coverage: Identifying how the use of test cases that are as close as possible to real conditions increases the completeness and quality of testing, allowing anomalies to be found at an early stage.

The fourth stage (practical case 2) will include the following:

• For a more in-depth analysis of the system dynamics, analytical models—Markov models in particular—will be used. This approach will allow for a quantitative assessment of the probabilities of transitions between different states of the system and its location in these states, which is particularly useful for predicting its behavior and reliability.
• A basic and multi-fragment Markov model of the intelligent SMR pump diagnostic system is described.
• Parameterization and simulation of this model are performed.
• Behavior analysis and conclusions.
• The final step, which will include.
• Discussion: Analysis and interpretation of the results obtained in the previous stages.
• Conclusions: Generalization of key findings and confirmation of the research hypothesis.
• Future research: Identification of directions for further work, including the integration of additional models and expansion of the DT functionality.

4. DT Model for ICS

Let us identify the main stakeholders and applications in the construction of the DT for the ICS which can be applied for NPP/SMR. A unified set-theoretic model describing the digital twin system for the ICS can be represented as follows. Let S be the set of all components of the DT system. S = {PE, SH, DT, F}. Where

• PE—a set of representations of physical entities at different stages of the lifecycle, PE = {PEdesign, PEtesting, PEoperations, PEmodernisation, PEmaintenance, PEdecommissioning};
• SH—a set of stakeholders who interact with the system, where SH = {SHregulators, SHops_and_eng, SHmanagers, SHresearchers_and_designers};
• DT—a set of DT system components, including the core, data, and services, where DT = {DTcore, DTdata, DTservices, DTHardware}, DTcore—a set of virtual models, DTcore = {VMphysical, VMAI, VMbehavior, VMrules};

  ○

  DTdata—set of data (Data), where DTdata= {Dstorage, Dstreaming, Dhistorical, Dontology};

  ○

  DTservices—set of services (Services), where DTservices = {Ssimulation, Smonitoring, Spredictive_API, Sdata_API, Splatform}.;

F—a set of functions performed at each stage of the lifecycle. F = {Fdesign, Ftesting, Foperations, Fmodernisation, Fmaintenance, Fdecommissioning}, where

• Fdesign—a set of design phase functions (Design Phase Functions), where Fdesign = {f_sys_design_V_V, f_app_alg_dev, f_personnel_training l};
• System Design V&V (f_sys_design_V_V)—Verification of the design of the ICS for compliance with requirements and identification of faults;
• Supporting of Application algorithms developing (f_app_alg_dev)—Test environment and models to support the development of information and control algorithms;
• Personnel Training (f_personnel_training)—Use of the DT as a simulator for training operators and personnel;
• Ftesting—a set of testing phase functions (Testing Phase Functions), where Ftesting = {f_control_alg_debug, f_sys_V_V, f_personnel_training, f_monitoring, f_exp_analysis};

  ○

  Control algorithm debugging (f_control_alg_debug)—Test environment and models to support debugging and the optimization of information and control algorithm development;

  ○

  Physical System Verification and Validation (f_sys_V_V)—Verification of the real system’s compliance with security, protection, and non-proliferation requirements;

  ○

  Personnel Training (f_personnel_training)—Use of the DT as a simulator for training operators and personnel;

  ○

  Monitoring (f_monitoring)—Collection and analysis of data from the physical object in real time;

  ○

  Experimental Analysis (f_exp_analysis)—Conducting “what-if” experiments, modeling failure and malfunction scenarios;

• Foperations—a set of operations phase functions (Operations Phase Functions), where Foperations = {f_predictive_maintenance, f_control_alg_optimization, f_monitoring, f_safety_analysis, f_inventory_management, f_personnel_training, f_exploratory_analysis, f_synthetic_data_generation};

  ○

  Predictive maintenance and cost optimization (f_predictive_maintenance)—Predicting failures, optimizing costs and maintenance time;

  ○

  Control algorithm optimization and support (f_control_alg_optimization)—Improving control algorithms based on real data;

  ○

  Monitoring (f_monitoring)—Continuous monitoring of the physical object’s condition;

  ○

  Safety analysis (f_safety_analysis)—Testing resistance to cyberattacks, analyzing functional safety levels;

  ○

  Inventory management (f_inventory_management)—Tracking and controlling materials;

  ○

  Continuous personnel training (f_personnel_training)—Training operators using real data and scenarios;

  ○

  Exploratory analysis (f_exploratory_analysis)—Investigating “what-if” scenarios to optimize the system;

  ○

  Test bed for synthetic data generation (f_synthetic_data_generation)—Generating synthetic data for training ML models, where Fdecommissioning—A set of decommissioning phase functions. Fdecommissioning = {f_decommissioning_V_V, fknowl_acc, fmonit_anom_detect, fdecom_risk_assess};

• Fmodernisation—Multiple functions of the modernisation stage, where Fmodernisation = {fmonit_anom_detect, fdecom_risk_assess}

  ○

  Monitoring and anomaly detection (fmonit_anom_detect)—to monitor the condition of equipment during modernisation;

  ○

  Modernisation risk assessment (frisk_assess)—to identify potential threats during the process;

  ○

  Experimental Analysis (f_exp_analysis)—Conducting “what-if” experiments, modeling failure and malfunction scenarios;

  ○

  Verification and validation of the physical system (f_sys_V_V)—Verifying the compliance of the real system with security, protection, and non-proliferation requirements;

  ○

  Personnel training (f_personnel_training)—Using the DT as an interactive simulator to train personnel to work with new, modernized systems;

• Fmaintenance—Set of maintenance phase functions, where Fmodernisation = {fmonit_anom_detect, fdecom_risk_assess};

  ○

  Monitoring and anomaly detection (fmonit_anom_detect)—for monitoring equipment status during maintenance;

  ○

  Predictive maintenance (f_predictive_maintenance)—predicting component failures and malfunctions based on data collected in real time;

  ○

  Resource optimization (f_resource_optimization)—modeling and optimizing the use of materials, personnel, and time. DT can help create the most efficient maintenance schedules, minimizing reactor downtime;

• Fdecommissioning—Multiple functions of the decommissioning phase, where Fdecommissioning = {fknowl_acc, fmonit_anom_detect, fdecom_risk_assess};

  ○

  Knowledge accumulation (fknowl_acc)—for preserving experience and data;

  ○

  Monitoring and anomaly detection (fmonit_anom_detect)—to monitor the condition of equipment during decommission;

  ○

  Decommissioning risk assessment (fdecom_risk_assess)—to identify potential threats during the process.

Although the basic sets (SH, DT) are invariant throughout the lifecycle, their content, status, and use are dynamic. For example, the data set (D) is constantly replenished with new data, and the composition of active stakeholders (SHphase ⊆ SH) changes depending on the stage of the lifecycle and the specific functions performed. At the same time, each stage of the system’s lifecycle is defined by unique subsets of physical entities (PEs) and functions (Fs) performed by the digital twin. The relationships between system elements can be described as binary relations. For example, the interaction between the set of stakeholders and the functions of the DT at different stages, as follows:

• Relationship R1 ⊆ SH × F: Each stakeholder is involved in performing specific functions at different stages. For example, (Dregulators, fcert_accel), (SHops_and_eng, fpred_maint).
• Relationship R2 ⊆ F × DT: Each function at each stage of the lifecycle uses certain components according to the representation of the DT at that stage of the lifecycle. For example, (fpred_maint, DTservices), (fexp_analysis, DTcore).
• Relationship R3 ⊆ PE × DT: A physical entity that is represented differently at different stages of the lifecycle interacts with the corresponding representation of the DT for a given lifecycle (for example, by providing stream data or receiving control signals).
• Relationship R4 ⊆ SH × F × PE × DT: Each stage of the lifecycle is represented by the corresponding intersection of all considered high-level sets, namely the set of representations of the physical entity, the set of stakeholders, the set of functions at each stage of the lifecycle, and the set of DT system components.

Next, we will take a closer look at each lifecycle and the DT model representation for SMR.

5. Architecture and Use of DT for ICS

5.1. Design Phase

The design and V&V phase are critical for the development of reliable and safe information and control systems for small modular reactors or other nuclear utilities. By integrating the digital twin concept into this process, it is possible to significantly improve the efficiency, speed, and quality of development and certification, while minimizing risks and costs in later stages. This phase focuses on creating a digital representation of the ICS, which allows for comprehensive verification and testing even before the physical object is built.

Figure 2 shows the general structure and functions of the DT of ICS in the design phase. The main components are the physical twin (in this case, the SMR), the digital twin, and the stakeholders. The digital twin is decomposed into high-level components, namely storage (static data, models, requirements, historical data), connections, a set of integrated models, and services. The basis was taken from the five-dimensional architecture of the DT, which is now often used as a reference model and is a logical extension of the three-dimensional model proposed by the co-founder of the DT concept, Michael Grieves [34]. Functions that are relevant to this phase of the lifecycle and are a projection of DT services are highlighted separately. Each stakeholder is also associated with functions that they can use according to their tasks with the help of DT at this stage of the lifecycle.

Figure 2. General structure and functions of the DT of an ICS at the design phase.

Let us take a closer look at the main components of a DT:

• Virtual models (VMs): These are a set of models representing various aspects of a future physical object (for example, SMR). They include physical models of the technological process, behavioral models of ICS components, as well as AI models for analysis and forecasting, based on previous experience in creating the next SMR. A separate place is occupied by rule models that implement regulatory requirements and control logic. Developers and researchers are the main stakeholders who create and upload these models, using them as a basis for simulation. In turn, regulatory organizations focus on reviewing the results of the validation of such models.
• Data (D): This is a repository that contains all the data necessary for the DT to function. It includes a permanent repository for static data, historical data for model training and analysis, and streaming data for real-time simulation. An important element is ontology, which provides structure and interconnection of all components, allowing the hierarchy of the system to be reproduced with the necessary accuracy.
• Services (S): These services act as an integral part of the DT, combining models and data to perform specific functions. They provide access to simulation capabilities, monitoring, predictive APIs for predictive analytics, and general platform services. Thanks to these services, various stakeholders can interact with the DT without delving into the complex details of its internal implementation.

It is worth highlighting the functions that can be performed via the services built on top of the DT of ICS:

• System Design V&V: Designers and engineers use DT to verify ICS designs and models. They perform V&V to ensure that the system is built correctly and meets requirements. This allows faults to be detected at an early stage, reducing the cost of fixing them;
• Supporting Application Algorithm Development: Existing digital models (physical, CAD, statistical, data-driven, and others) of future equipment can serve as the primary test environment to support the development of SMR control algorithms;
• Personnel Training: As a specific test environment, the DT can act as a simulator for operators, allowing them to practice in various scenarios, including emergency situations, without risk to real equipment.

Thus, several stakeholders were identified for the design stage who could improve the performance of their tasks with the help of DT, as follows: regulatory body, researchers and developers, and operators and engineers. The correspondence of functions to stakeholders is shown in Table 1.

Table 1. Description of functions, responsible services, and stakeholders of DT of ICS at the design phase.

Function	Description	Stakeholders
System Design V&V	Verification of ICS design for compliance with requirements and identification of faults	Researchers and designers, engineers and operators, regulatory body
Supporting of Application Algorithms Developing	Test environment and models to support the development of information and control algorithms	Researchers and designers, engineers and operators
Personnel Training	Use of the control center as a simulator for training operators and personnel	Researchers and designers, engineers and operators

5.2. Testing Phase

During the testing phase (Figure 3), the DT helps to integrate and test the system before it goes into full operation, allowing for faster implementation at a lower cost. The high-level structure of the DT also changes: a physical entity appears, as well as a connection to it, which now exists. This connection enables real-time data exchange, which is the basis for V&V, monitoring, and algorithm optimization.

Figure 3. General structure and functions of DT of ICS at the testing phase.

The correspondence of functions to stakeholders is shown in Table 2. The functions of the DT have also changed during the test phase, focusing on V&V, reducing commissioning time, training, and monitoring, as follows:

Table 2. Description of functions, responsible services, and stakeholders of a DT of an ICS at the testing phase.

Function	Description	Stakeholders
Adjustment of Application Algorithms	Test environment and models to support the optimization of information and control algorithm development	Researchers and designers
Physical system V&V	Verification of the real system’s compliance with security, protection, and non-proliferation requirements	Researchers and designers, engineers and operators, regulatory body
Personnel Training	Use of the DT as a simulator for training operators and personnel	Researchers and designers, engineers and operators
Monitoring	Real-time collection and analysis of data from physical objects	Regulatory body
Experimental Analysis	Conducting “what-if” experiments, modeling failure and malfunction scenarios	Researchers and designers, engineers and operators

• Adjustment of Application Algorithms: Designers use the DT to fine-tune and optimize control algorithms, taking into account the actual behavior of the physical object. This leads to a reduction in implementation costs, which can be directly assessed in financial terms.
• Physical system V&V: DT is used to verify that the real system complies with security, safety, and non-proliferation (3S) requirements. This allows any deviations that occurred during implementation to be identified and corrected.
• Personnel Training: The DT acts as a realistic simulator for operators, allowing them to practice standard procedures and respond to emergency and unpredictable situations in a safe virtual environment.
• Monitoring: The DT collects, processes, and analyzes data from the physical facility in real time, providing continuous monitoring of its status and performance. This allows for the timely detection of anomalies and potential problems during implementation and test runs.
• Experimental Analysis: Researchers and engineers use the DT to run “what-if” scenarios, simulate and analyze system behavior under unpredictable conditions or extreme loads. This allows one to explore scenarios of failures, malfunctions, or external influences, providing a deep understanding of the system’s resilience and reliability.

5.3. Operation Phase

During the operational phase (Figure 4), the digital twin becomes an integral part of supporting the ongoing activities, providing continuous monitoring, algorithm optimization, and decision support. At this stage, the physical entity is functioning, and the DT is used to control and analyze its performance in real time. A key feature is feedback, where data collected during operation are continuously fed back into the DT, allowing it to be updated, adapted, and improved. The correspondence of functions to stakeholders is shown in Table 3. The main functions performed by the DT at this stage include the following:

Figure 4. General structure and functions of a DT of an ICS at the operation phase.

Table 3. Description of functions, responsible services, and stakeholders of DT of ICS at the operation phase.

Function	Description	Stakeholders
Predictive maintenance and maintenance cost optimization	Predicting failures, optimizing costs and maintenance time	Engineers and operators
Application algorithms optimization and V&V	Improving control algorithms based on real data	Researchers and designers, engineers and operators
Monitoring	Continuous monitoring of the physical object’s condition	Engineers and operators, regulatory body
Cybersecurity and functional safety testbed	Testing resistance to cyberattacks	Cybersecurity personnel
Inventory management	Tracking and controlling materials	Managers
Personnel training	Training operators using real data and scenarios	Managers, engineers and operators
Exploratory analysis	Exploring “what-if” scenarios to optimize the system	Researchers and designers, engineers and operators
Testbed for ML synthetic data generation	Generating synthetic data for training ML models	Researchers and designers

• Predictive maintenance and maintenance cost optimization: The DT analyzes equipment status data, predicts the likelihood of failures, and determines the optimal time for maintenance. This helps avoid unplanned downtime, reduce costs, and extend equipment life.
• Application algorithm optimization and V&V: The DT provides a platform for testing and improving control algorithms based on real data. This allows for a continuous improvement in system efficiency and safety.
• Monitoring: Continuous monitoring of the physical object’s status, allowing for the prompt detection of anomalies and response to them.
• Cybersecurity and functional safety testbed: The DT can serve as a test bed for checking the system’s resistance to cyberattacks and working out response scenarios. In addition, when using the DT to assess the functional safety level for SMR facility as a whole, it becomes possible to simulate multiple failures and investigate or predict which actions during failures will lead to emergency events. This will significantly expand existing risk analysis methods such as FMEC(D)A and PRA.
• Inventory management: This is especially important for facilities where it is necessary to track the movement and use of materials (e.g., special nuclear material).
• Personnel training: The DT continues to be used to train operators, but now with real data and scenarios, making training even more effective.
• Exploratory analysis: Researchers use the DT to model “what-if” scenarios and explore opportunities for system optimization or response to specific incidents.
• Testbed for ML synthetic data generation: The DT is used to generate synthetic data needed to train machine learning models, which is especially useful for rare or specific scenarios.

5.4. Modernization Phase

At the modernization stage of the lifecycle (Figure 5), the digital twin plays a critical role in preparing, verifying, and implementing changes to the ICS. Instead of making changes directly to the real system, the DT acts as a safe “testing ground.” This allows one to not only test new algorithms and equipment, but also to train personnel to work with the updated system before its physical deployment, minimizing risks and downtime. The correspondence of functions to stakeholders is shown in Table 4. The main functions performed by the DT at this stage include the following:

Figure 5. General structure and functions of the DT of an ICS at the modernization phase.

Table 4. Description of functions, responsible services, and stakeholders of DT of ICS at the modernization phase.

Function	Description	Stakeholders
Physical system V&V	Verification of the real system’s compliance with security, protection, and non-proliferation requirements	Researchers and designers, engineers and operators, regulatory body
Modernization risk assessment	Assessment of potential risks during modernization	Engineers and operators, regulatory body
Monitoring and anomaly detection	Continuous monitoring of the physical facility’s condition	Engineers and operators, regulatory body
Personnel training	Training of operators using real data and scenarios	Managers, engineers and operators
Exploratory analysis	Research of “what-if” scenarios to optimize the system	Researchers and designers, engineers and operators

• Physical system V&V: Using the DT to verify that the upgraded part of the system meets security, protection, and non-proliferation requirements.
• Modernization risk assessment: Allows one to identify potential threats, such as compatibility failures, integration errors, or vulnerabilities that may arise when implementing new components or software.
• Monitoring and anomaly detection: Continuous monitoring of equipment status during upgrades allows for the rapid detection of unforeseen deviations or anomalies that may arise as a result of system intervention.
• Personnel training: Using the DT as an interactive simulator to train personnel to work with new, modernized systems.
• Exploratory analysis: Conducting “what-if” scenarios and failure modeling on the DT helps to assess the behavior of the system after modernization in various conditions, even emergency ones.

5.5. Maintenance Phase

At the maintenance stage (Figure 6), the DT maintains the reliability and uninterrupted operation of the SMR. By collecting and analyzing data in real time, the DT enables a shift away from outdated scheduled preventive maintenance in favor of a proactive, condition-based approach. The DT allows potential problems to be identified in advance, minimizing risks and optimizing resources. The correspondence of functions to stakeholders is shown in Table 5. The main functions performed by the DT at this stage include the following:

Figure 6. General structure and functions of the DT of an ICS at the maintenance phase.

Table 5. Description of functions, responsible services, and stakeholders of DT of ICS at the maintenance phase.

Function	Description	Stakeholders
Predictive maintenance	Predicting failures, supporting staff during maintenance activities	Engineers and operators
Resource optimization	Creating the most efficient maintenance schedules	Engineers and operators, managers
Monitoring and anomaly detection	Continuous monitoring of the physical object’s condition	Engineers and operators, regulatory body

• Predictive maintenance: Using monitoring data, the DT predicts the likelihood of failures and determines the optimal time for maintenance. This allows repairs to be scheduled when they are really needed, rather than according to a fixed schedule. During the maintenance process itself, predictive maintenance data are used to support the process.
• Resource optimization: The DT helps create the most efficient maintenance and repair schedules, taking into account the availability of personnel, spare parts, and tools. This minimizes reactor downtime, reduces costs, and increases overall efficiency.
• Monitoring and anomaly detection: The DT continuously analyzes data from sensors and control systems, detecting deviations from normal operation. This allows one to respond quickly to potential problems before they escalate into serious malfunctions.

5.6. Decommissioning Phase

During the decommissioning phase (Figure 7), the DT supports the planning, monitoring, and assessment of risks associated with the shutdown of a physical facility. The DT helps to ensure safe and efficient decommissioning, minimize environmental risks, and document the entire process for future use. At this stage, the physical facility is in a state of decommissioning. The correspondence of functions to stakeholders is shown in Table 6. The main functions of the DT at this stage include the following:

Figure 7. General structure and functions of the DT of an ICS at the decommissioning phase.

Table 6. Description of functions, responsible services, and stakeholders of the DT of an ICS at the decommissioning phase.

Function	Description	Stakeholders
Verification and validation of the decommissioning process	Testing and verification of decommissioning procedures	Engineers and operators, researchers, regulatory body
Knowledge accumulation	Collection and preservation of historical data and models for future use	Researchers and designers, engineers and operators
Monitoring, anomaly detection, and predictive control	Monitoring of the decommissioning process, detection and response to incidents	Engineers and operators, regulatory body
Decommissioning risk and environmental impact assessment	Assessment of potential risks and environmental impact	Engineers and operators, regulatory body

• Verification and validation of the decommissioning process: The DT is used as a test bed for modeling and verifying dismantling procedures. This allows specialists to ensure that the planned actions are safe and effective, as well as to identify potential problems before the actual work begins.
• Knowledge accumulation: The DT stores historical data and models accumulated throughout the entire lifecycle of the facility (design, implementation, operation). This knowledge is invaluable for supporting decisions during decommissioning, as well as for use in future system designs.
• Monitoring, anomaly detection, and predictive control: The DT continues to monitor the physical object during dismantling. This allows any anomalies or unforeseen events to be detected and responded to promptly.
• Decommissioning risk and environmental impact assessment: The DT is used to model the potential risks associated with decommissioning and assess its impact on the environment. This allows regulatory authorities to monitor the process and ensure compliance with all safety standards.

6. Practical Cases

6.1. Practical Case 1

As evidenced by the literature review above, the complexity of implementing a DT for a physical object such as a nuclear power plant requires significant time and financial resources. However, at the same time, any project to modernize the existing I&C at an NPP or SMR in future will have both a limited budget and a limited implementation period, which in turn is determined by the outage schedule. Therefore, the scientific and practical task of developing proposals (methodologies) for the use of a DT, which will be developed over a period of three months, will not require significant investment, and will, by increasing test coverage, increase the probability of finding anomalies during the lifecycle of the development of a new I&C, is relevant.

Problem statement: The object of study is the functions performed by the I&C at an existing nuclear power plant that must be replaced with a new one. The subject of study is the various technological processes controlled by the existing I&C. The development lifecycle of a new I&C will vary depending on the requirements of the national regulator, but most industry standards suggest using a lifecycle based on a V-shaped model. One branch is dedicated to development tasks, while the other branch is dedicated to various levels of testing. Each individual testing level has its own unique object, in which a specific set of requirements is implemented.

Therefore, the first step is to introduce the following classification of a DT (see Figure 8), according to which a flexible selection of DT properties can be made so that the selected DT corresponds to the test object, to a set of requirements for the test object, and to a specific set of functions as a test environment.

Figure 8. The DT facet classification for the existing I&C modernization project.

Based on the proposed classification, as well as the generalized V-shaped I&C development lifecycle (see Figure 9), a proposal was made to improve the existing approach via the use of a DT, the set of properties of which will satisfy the testing objectives of a specific stage of the development lifecycle (see Figure 9).

Figure 9. The DT implementation into a V-shape model lifecycle of the existing I&C modernization project.

Explanation of what is shown in Figure 9. Each stage of the V-model on the right (raising) branch is a testing stage. Each testing stage defines the system (I&C component) under test (what is being tested) and a set of test environments (equipment that will be used for testing). Stage by stage, the system under test becomes more complex and approaches the final version of the system being developed. The test environment should also become more complex stage by stage in order to be able to load all the input data of the system under test and read all the output data from it. This is a flexible approach to using DT during the development of I&C. The main purpose of using DT is to create a test environment that is as close as possible to real conditions and limited by the requirements of a particular stage of development. At stages when the system is not yet fully assembled, there is no need to use complex software and hardware DTs with full emulation of all physical processes. At the qualification testing and burn-in testing stages, it becomes necessary to use software and hardware DT, but there is no need to simulate a closed control loop. This is because the purpose of these stages is not to fully test the I&C operating algorithms. It should be noted that, during the direct development of control algorithms, i.e., “coding,” it is possible to use only software versions of control systems with a gradual increase in their complexity by adding simulations of new technological processes.

Separately, attention should be paid to the validation testing and factory acceptance testing (FAT) stages. At these stages, the object of testing is a fully integrated system in the form in which it will be deployed on the unit. Therefore, at these stages, it is necessary to have SW/HW versions of the DT for all technological processes that will be controlled. At these stages, the I&C must provide the ability to implement a closed control loop, and, in cases of emergency, allow continuous simulation; in other words, it be an identical digital version of the real physical control object.

6.2. Practical Case 2

The operations phase is one of the longest and most interesting for analysis and monitoring and predictive maintenance functions are among the key functions at this stage in the I&C of an SMR. Therefore, as part of the practical case, a mathematical model of an intelligent pump diagnostic system in the SMR at the operation stage was prepared, covering precisely these functions and actual operation parameters (Figure 10). The diagnostic system detects failures, allowing for appropriate responses, thereby increasing the availability and functional safety of the system. The digital twin provides the ability to continuously train such a diagnostic system, increasing the availability of failure detection. An analysis of the reliability behavior of the system under study concluded that it can be described by a Markov model with discrete states and continuous time. Considering that, due to the use of DT characteristics (in particular trustworthiness), the diagnostic system can improve over time by detecting hidden faults, the so-called multi-fragment Markov model (MFMM) [35] was applied. Such a model consists of a set of fragments that represent variants of basic behavior models. For this case a basic model (Figure 11) of a diagnostic system consists of six states and is described by 11 parameters (see Table 7). These states describe the behavior of the system for the up state, Su; down state, Sd; maintenance state, Sm; hidden error state, Sh; critical error state, Shc; and learning state Sl.

Figure 10. General structure and functions of the DT of the I&C at the operation phase, with highlighted stakeholders and functions used in modeling for practical case 2.

Figure 11. Basic model of an intelligent pump diagnostic system in SMR at the operations phase. By regularly retraining the diagnostic system, the reliability/trustworthiness of failure detection (D) is changed. Thus, the basic model “unfolds” into an MFMM with a variable parameter D (Figure 12).

Table 7. States and parameters of MFMM.

№	Parameter	Description
1	Su	Up state
2	Sd	Down state (detected failure)
3	Sm	Maintenance state
4	Sh	Hidden error state
5	Shc	Hidden error becomes critical
6	Sl	Learning state
7	D	Probability of failure detection
8	Pld	Probability of needing learning after detected failure repair
9	Plm	Probability of needing learning after maintenance
10	Plh	Probability of needing learning after critical hidden failure
11	μu	Recovery rate
12	μh	Recovery rate from critical hidden state
13	μm	Recovery rate after maintenance
14	λd	Failure rate
15	λm	Rate of maintenance activities
16	λhc	Rate of hidden error becoming critical
17	λl	Rate of relearning

Figure 12 shows, in our opinion, three possible configurations for the last fragment: (a) retraining is no longer relevant because the increase in ΔD after retraining does not justify the resources spent, but hidden errors are still possible; (b) parameter D is ideal, but maintenance is still required due to either insufficient coverage by the diagnostic system or other regular activities; (c) parameter D is ideal, but maintenance was only required to detect and correct hidden failures, so it is now unnecessary. Option (a) was taken as the most realistic for modeling. However, other options can be used to simplify the modeling under certain assumptions.

Figure 12. MFMM of the intellectual pump diagnostic system in SMR at the operations phase. Different options for representing the last fragment.

The methodology of the intelligent diagnostic system from our previous work [36] was taken as a basis. The MFMM (named BM5s) was designed separately for the intelligent diagnostic system of the pump in the SMR at the operations phase. DT here is responsible for retraining.

The goal of the practical case is to run a simulation with realistic parameters, compare the system availability indicators in the configuration with retraining, without retraining, and with perfect fault detection. The comparative analysis should indicate the relevance of using DT for retraining, taking into account the initial costs and additional downtime during training/configuration updates based on training results. There are three key indicators that should be used for analysis: (1) Amin—the minimum availability value for the entire simulation time; (2) Tloss—the time lost in availability when comparing the target model with retraining with the model without retraining; and (3) Astationary—the stationary availability value of the model with retraining.

A discrete-continuous Markov model (Figure 11) was simulated using the R language and the corresponding packages for statistics and visualization. The parameters shown in Table 8 were selected. The parameter values were selected based on an analysis of I&C of NPP operation and relevant publications [19,36]. It was assumed that, with each iteration, retraining only improves the target indicator D. In addition, the relearning process is regulated and does not depend on the reasons that initiated it. A total of four retraining iterations were programmed. The simulation was performed on a virtual segment of two years, and, for each day of such simulation, a vector with probabilities of being in each of the states was recorded. Thus, it was possible to see the dynamics of the model’s operation over time.

Table 8. Values and description of MFMM parameters for simulation.

№	Parameter	Value	Description
1	D	0.75, 0.826, 0.854, 0.870	The probability of detecting a failure change over time. A total of four iterations, with 0.75 as the initial value.
2	Pld	0.4	Not every failure requires retraining
3	Plm	0.3	Maintenance will often end with a known result without the need for retraining
4	Plh	0.6	Hidden failures will more often require retraining
5	μu	1/4 (1/h)	Repair in 4 h
6	μh	1/6 (1/h)	Repair after critical failure up to 6 h
7	μm	1/12 (1/h)	Scheduled maintenance up to 12 h
8	λd	1/(24 × 30) (1/h)	MTBF—30.0 days
9	λm	1/(24 × 90) (1/h)	Maintenance once every 3 months
10	λhc	1/(24 × 7) (1/h)	Escalation of a hidden failure to a critical level occurs on average weekly
11	λl	1/8 (1/h)	Retraining and making appropriate changes based on its results takes 8 h

The BM5s mathematical model was implemented as a continuous Markov chain (CTMC) with an intensity matrix Q describing transitions between six states of the system. Transient analysis (to reflect the state of the system in dynamics) was performed by solving the system of Kolmogorov–Chapman differential equations using the matrix exponentiation method P(t) = P(0) × exp(Q × t). This method was implemented using the expm library in R, which employs Higham’s scaling and squaring algorithm. This approach allows for computing state probabilities based on the analytical solution form, thus mitigating the time-discretization errors associated with traditional iterative ODE solvers. The multi-fragment structure of the model is implemented through a step-by-step increase in the D parameter (probability of failure detection) with an exponential learning law, where each fragment represents an improved version of the diagnostic system after a learning cycle.

Several rounds of simulation were performed with changes in the basic parameters (Table 8), but the visualization presented is specifically for the parameters in Table 8. The simulation results show that such a model in a stationary state shows better stationary availability values when compared with a diagnostic system without retraining (Figure 13), although there is a certain loss in availability at the beginning (Figure 14 and Figure 15).

Figure 13. Comparison of availability in MFMM modeling in three configurations: with retraining, without retraining, and with perfect failure detection.

Figure 14. The model matches the availability level of a model with learning to the level of a model without learning on the 32nd day according to the simulation results.

Figure 15. Comparison of the difference in availability between the model with retraining and the model without retraining over time.

The key factors for effectiveness are the maximum value of improving the probability of detecting failures (D), the speed of learning, and the intensity of transitions to the learning state. With low D values or slow learning, the benefits of additional learning may not compensate for the initial losses, making such configurations ineffective for critical systems. However, in such cases, it is possible to disable retraining with downtime at a certain point to preserve positive results and prevent further negative impact on readiness (Figure 12a).

Parametric analysis revealed nonlinear dependencies between system characteristics and learning efficiency. High failure rates accelerate system improvement through more frequent training, but significantly reduce overall readiness. The probability of transitioning to retraining on the one hand accelerates the improvement of the diagnostic system but, on the other hand, aggressive training at the beginning can increase the impact of the initial loss in readiness, although this does not greatly affect the steady-state value. Depending on the system and the tasks at hand, we can accept low initial availability in order to enable frequent initial experiments, operation in non-standard modes, or non-standard parameters for the initial learning impulse. However, this is not suitable for critical equipment during operational work, such as a complex station pump. Therefore, experiments must be virtualized in the DT or performed at earlier stages of the lifecycle. Maintenance has a dual effect: it can reveal hidden failures but, as D improves, its usefulness decreases in this model. It is clear that maintenance is necessary not only to detect hidden faults, but also to predict and prevent new failures for different strategies (Figure 12). The relationship between the intensity of critical failures and the speed of repair is important—with high costs for critical conditions, retraining becomes particularly important because it virtually prevents the transition to emergency modes.

7. Discussion

7.1. About Cyber Security Issue

The proposed architecture and application of digital twins at various stages of the ICS lifecycle involve interaction with cybersecurity specialists and potentially allow for an increase in the level of cyber protection. However, the models considered in practical cases do not directly take this possibility into account. At the same time, the proposed methodology and tools make it possible to integrate the aspect of cybersecurity into the model representation and implement the so-called security-informed safety (SIS) principle [37]. This can be implemented in two ways.

The first approach (Figure 16) is based on the assumption that a cyberattack can be initiated when the system is in an operational state. In this case, the basic fragment of the model is supplemented by the cyberattack state Sca, to which the system transitions from the state Su with an intensity of λ_ca. From Sca, it is possible to transition either to a failure state (Sd) or back to an operational state (Su), depending on the success of the attack, which is determined by the probability Pcas. Additionally, it is assumed that each act of retraining affects two parameters at once: the reliability of diagnosis D and the success of a cyberattack Pcas. The expected effect is an increase in D and a decrease in Pcas.

Figure 16. Taking cyberattacks into account in the MFMM with practical case 2.

The second approach involves cloning all existing model states with the suffix ca (cyberattack) and creating corresponding links between the original and cloned states. This makes it possible to represent a cyberattack situation at any moment and in any state of the system. The attack can be initiated from state X with a transition to Xca, after which, if the attack is unsuccessful, the system returns to the previous state X, and if successful, it transitions to the failure state Sd. This approach works similarly to the first one, but allows one to model cyberattacks without restrictions on the initial state of the system.

In general, the example of implementing a DT-oriented lifecycle model allows us to summarize and discuss the principles and methods used in developing the ICS of SMRs.

In addition, the proposed model also allows calculating the reduction in losses associated with the system transition to non-operational states. This can be done by taking into account the relative losses depending on the non-operational state (Sh, Shc, Sd, Sm, Sl). These losses will reduce as a result of the decrease in the corresponding probabilities after the system transitions to the states described in the subsequent fragments, up to and including the final one.

7.2. Features, Principles and Metrics of Implementing DT

The key principle is component-by-component and phase-by-phase decomposition for the formation and evolution of the DT. This consists in the evolutionary development of the DT through initial decomposition, in accordance with the lifecycle of the ICS. This principle is implemented through a number of methods (subprinciples). The subprinciples and methods of implementation are as follows:

• Gradual development of DT by phases and components in parallel with the development object—the so-called “snowball” method. At each stage of the lifecycle (LC), a DT is formed to test the object being developed within the requirements of the current LC stage.
• DT by stages and operations is considered as an additional function-opportunity to increase the effectiveness (increase test coverage and the corresponding probability of detecting failures at early stages of the project) of testing during development;
• Test data are expanded for verification and validation: from application logic algorithms to testing the entire system;
• Test data are gradually expanded across several processes that will be within the control loop.

DT also allows one to decrease the probability of detecting an anomaly related to test coverage and reduces testing time. For example, there is an input channel that processes an analog signal from 0 to 20 mA. There is a set-point value within the range that changes system behavior. Classic testing theory states that the entire range should be divided into equivalent classes. Only one value from each class and boundary value needs to be checked. A DT allows one to undertake this in such a way as to establish the dynamics of the input value change, similar to a real physical object, which will be interconnected with the developed system and cover the entire range. In addition, this method of covering the range of input values enables testing hysteresis (if any) in both directions. The system can have hundreds of such input signals, and these signals can be partially interrelated. Therefore, DT as a test automation tool allows one to cover the entire range of variables, and the dynamics of this coverage will be closer to the real process that will be under the control loop.

However, any set of test equipment must be checked for correct operation before use, as required by quality management standards such as N299.XX (Canada) and Branch Technical Position (BTP) 7–14 (USA). Based on these requirements, the test circuit (hardware) and test software must be evaluated to ensure that the results obtained are trustworthy. As DT is a type of test equipment, it must also be checked before use. The method and level of DT verification depend on the type of DT to be used. The results of the DT verification must be documented in accordance with the company’s quality management system rules.

It is also necessary to have certain metrics that can be used to evaluate the implementation of DT. The following set of metrics is proposed:

• Degree of test coverage of DT TC_DT—This can be estimated as the ratio of the number of requirements of the technical specifications that are verified using DT, R_DT, to the total number of requirements of the technical specifications, R: TC_DT = R_DT/R;
• The number of faults found through DT-based testing at various stages of the project can be estimated in terms of the costs that would be incurred if these anomalies (faults, bugs) were found at the final stage of the ICS development lifecycle;
• Internal synergy is a gradual decrease in the number of faults found as the project develops, via their detection and elimination at early stages (a complex metric). This metric can be represented as the number of bugs that will be detected at the commissioning stage—F_c. An F_c value approaching 0 indicates that the phased decomposition of the DT was performed correctly and that the use of a specific DT at each stage of the development lifecycle made it possible to identify and eliminate anomalies that are an integral part of the design;
• An economic indicator that takes into account the cost of correcting faults compared with the cost of developing and using DT, ROI, for example. This indicator can be expressed as the ratio of the cost of corrected faults found through the use of DT—FF_DT—to the cost of developing or purchasing DT—P_DT, so that ROI = FF_DT\P_DT;
• Other metrics are based on expert results assessments.

Currently, there are several open questions to be addressed in future work:

• What software and hardware platform will enable communication with the system being developed in its entirety?
• The evolution of DT is carried out in conjunction with the evolution of SMR. Therefore, the DT for the ICS must evolve in the same way. How can this evolution and adaptability be ensured?

7.3. Limitations of DT Implementation

It is important to discuss the limitations of such DT applications, in particular in I&C systems of SMR. The implementation of the proposed methodology goes beyond a purely technical task and requires a restructuring of processes in the SMR lifecycle. In other words, it is a set of organizational and technical procedures where, in addition to technical difficulties, challenges may arise in the face of new practices, both at the level of certification and regulatory authorities and at the level of adaptation of personnel and processes at all levels of the organization.

Traditional approaches to development and operation are often based on fixed stages, whereas effective use of a DT requires a transition to a dynamic model with continuous feedback and evolutionary functionality enhancement. This creates challenges in terms of synchronizing the work of development teams, operators, and regulators, and also requires adaptation of the regulatory framework, which is currently often not ready to make decisions based on digital simulations. In addition to organizational changes, there are also technological limitations: the need to validate the DT model itself (the problem of “trust in the twin”), the complexity of ensuring cybersecurity when transmitting data in real time, as well as high initial investments of resources to create high-precision models, which requires a careful balance between the detail of the twin and economic feasibility at each stage.

Finally, the implementation of a technology such as DT requires an appropriate level of digital maturity within the organization, without which the costs and risks of prolonging the process of implementing DT-based practices may be more significant.

8. Conclusions

Implementing a full-fledged digital twin (DT) for such a complex facility as a nuclear reactor and its control and safety systems is a resource-intensive task. However, such an implementation can significantly improve the safety and efficiency of processes at every stage of the lifecycle. Given the limited timeframes and budgets for projects to modernize existing ICS, there is an urgent scientific and practical task to develop a flexible approach to the use of DT that increases the efficiency of testing changes in ICS without significant investment.

The main contribution of this research is the conceptualization of certain models and algorithms for solving this problem based on the proposed methodology of embedding a DT into the V-shaped lifecycle model of an I&C system controlling a physical object. At each stage of the lifecycle according to the V model, the DT performs specific functions that help speed up implementation and the introduction of changes to the system. Instead of creating a single, overly complex twin, the model offers an evolutionary increase in functionality according to the principle of component-by-component and phase-by-phase decomposition. For example, software versions are sufficient at the design stage, while full-fledged software and hardware models are required for qualification testing and factory acceptance testing.

This suggested flexible approach allows one to create a test environment that is as close as possible to real conditions. This optimizes resource and time costs while ensuring maximum test coverage. As a result, the use of DT at various levels of the I&C development lifecycle increases the likelihood of detecting anomalies, which is critical for improving system security and reliability.

In particular, in Practical Case 2, an intelligent diagnostic system for a complex SMR pump was analyzed, where the digital twin was used as an intelligent component for detecting hidden faults and enabling relearning to improve failure detection capability. The proposed models demonstrated measurable improvements in system availability. Three key availability indicators were evaluated: the minimum availability loss, Amin; the availability loss period, Tloss; and the stationary availability, Astationary. For the considered scenario and selected parameters, the configuration with relearning, compared with the model without relearning, yielded Amin = 0.0046, Tloss = 32 days, and Astationary = 0.9564. The resulting overall availability gain was Abenefit = 0.0185, increasing availability from 0.9379 to 0.9564. Consequently, the stationary unavailability of the system, defined as 1−Astationary, decreases from 0.0621 in the baseline case without relearning to 0.0436 when digital twin-based relearning is applied. The relative reduction in unavailability, calculated as (0.0621 − 0.0436)/0.0621 = 0.2979, indicates that the system unavailability is reduced by approximately 29.8% for the selected input parameters. These results demonstrate that the DT with learning capability enhances stationary availability by reducing both the impact and duration of hidden failures, which is crucial for critical equipment operating in continuous mode.

Furthermore, these models allow the key principles of 3S-by-design (safety, security, safeguards) to be implemented as an integral part of the development process from the outset, the importance of which has been emphasized in the literature reviewed.

Future research will be dedicated to creating a DT for the ICS of nuclear utilities to speed up the process of making changes to control algorithms while maintaining reliability and safety, as well as reducing the costs of implementation and maintenance. The economic feasibility of these actions should be justified in more detail and quantified using appropriate indicators. A more detailed study and the creation of DT for key operations at different stages of the lifecycle, as well as their integration into the V-shaped model of the SMR lifecycle, are planned as well. Additionally, it is important to develop a DT V&V compliance strategy framework and elaborate limitations of DT verification and regulation adoption.