Conclusion. At the 56th Power Forum, held on September 4, 2026 at the FKI Tower in Yeouido, Seoul (co-hosted by the Future Energy Policy Institute and lawmaker Lee Jin-sook), Professor Cho Sung-kyung of Myongji University presented the results of a survey of 1234 adults nationwide. 56.7% said they “trust AI analysis in high-risk situations,” but only 6.8% said “AI should be allowed to make autonomous judgments on nuclear safety.”
At the same event, attorney Park Jin-pyo of Bae, Kim & Lee presented a draft law that would classify nuclear AI by safety significance, consequences of failure and autonomy, require that people be able to stop or intervene in its operation when needed, and require functions for switching to manual operation and returning to non-AI methods.
The conclusion from an electrical design engineer’s point of view is this: operations and maintenance AI pays off when it is placed only in a “diagnostic and advisory class” that is not physically connected to the signal paths of the reactor protection system (RPS) or the engineered safety features (ESF), and when the path leading to operator actions keeps the existing procedures and interlocks exactly as they are. The moment AI output reaches a control output contact in any form, that advantage disappears.
“People must be able to stop it” is the minimum condition for controlling AI, not a sufficient one. Even with a stop button, if the AI output is connected to the control command path, then for the few seconds before someone presses the button, the AI was running the plant. Cutting the connection itself is the first interlock.
Some background. According to Professor Cho, when the Diablo Canyon plant in the United States introduced generative AI in 2024, it chose “finding evidence” rather than operational judgment as its first task. Noting that staff spent about 15,000 hours a year searching for information, the plant had AI find technical documents and regulatory material for them. Before introducing AI, the U.S. Nuclear Regulatory Commission (NRC) re-examined 517 regulatory guides, checking whether existing rules could be applied, where they conflicted with AI, and where the criteria for data, testing and verification had gaps. Professor Cho stressed that “nuclear AI must not only prove that it works well; it must be designed to be safe even when it works wrongly.” Dr. Lee Moo-yeol of Sandia National Laboratories, a panelist, summarized nuclear AI legislation as “not deregulation but prevention, setting rules for accountability and verification first.”
There is one counterintuitive observation from the field. The requirement to be “safe even when it works wrongly” is not new to the AI era; it is the same sentence as the basic principle of protection circuit design since the days of relay sequences (fail to the safe side, fail-safe). A de-energize-to-trip circuit is built so that it goes to the safe side even if power is lost or a contact drops out, and the reactor protection system adds redundancy and independence on top of that principle. So what nuclear AI requires is not raising the AI’s “accuracy” but an electrical design problem: where to draw the circuit boundary that the AI’s errors cannot reach when it is wrong. Diablo Canyon starting not with the smartest AI but with the most controllable task (finding evidence) was exactly a decision to draw that boundary between document search and operational judgment.
Precondition (based on the operating time chart). The facts made public at the forum are the survey figures (56.7%/6.8%), the Diablo Canyon case (2024, finding evidence, 15,000 hours a year), the NRC’s re-examination of 517 guides, and the principles of the draft law (classification, human intervention, manual transfer, return to non-AI). The actual scope of AI application at any specific plant, the data linkage method, and the details of verification criteria for high-risk AI have not been disclosed. The interlock order and I/O map below are concept examples that translate these principles into an electrical configuration.
Normal operation (measurement data sent one way to the AI server) → T0 an anomaly appears → T1 the AI presents candidate abnormal states and the basis for its judgment (documents, process variables) on the operator’s screen → T2 the operator checks the procedure and decides → T3 the operator acts through the existing HMI → independently of all this, the protection system trips automatically at T_trip when its own setpoint is reached. There is no path by which a change in the AI server’s state affects T_trip.
Safety interlock check order (top priority)
- Confirm physical separation of the protection system — between safety-class systems such as the RPS and ESF and the AI server, place only a one-way data transfer device (unidirectional communication), and confirm on drawings and on the physical installation that there is no communication or contact path from the AI side toward the safety-class systems. All AI server outputs are limited to indicator lamps, screens and records.
- Keep the manual trip and EMO hardware paths — the operator manual trip and emergency off (EMO) circuits must operate by hardwiring regardless of the state of the AI server or HMI software, and in any AI class design, configurations that replace or bypass these paths with software are excluded.
- Location of the AI stop switch — the “able to stop its operation” function required by the draft law is placed on the AI server side (cutting the advisory output), and the safety-class systems are left untouched. Stopping the AI must have no side effect on plant control.
- Pre-verify the non-AI return procedure — confirm periodically that the plant can be operated with the existing procedures and HMI alone, with the AI advisory screen gone.
- Conservative treatment before the class is fixed — until the classification criteria by safety significance are finalized, treat all operations and maintenance AI as high-risk class for verification.
Nuclear AI advisory class I/O map (example)
| Signal | I/O address | Type | Operating condition |
|---|---|---|---|
| Measurement data (one-way) | AI_PLANT_TAG_xxx | Analog In (one-way receive) | Protection system → AI server direction only; no reverse direction |
| AI server watchdog | DI_AI_HEALTH | Digital In | When OFF, advisory screen shown as invalid; no relation to plant control |
| AI advisory valid | DO_AI_ADVISORY_LAMP | Digital Out (indicator lamp) | Diagnostic class — ON only when evidence document links are attached |
| Operator acknowledgment | DI_OPR_ACK | Digital In | Records that the operator viewed the evidence; no relation to operating authority |
| AI stop | DI_AI_STOP | Digital In | Cuts AI advisory output immediately; no effect on protection system or HMI |
| Manual trip | DI_MANUAL_TRIP | Digital In (hardwired) | Protection class — independent of AI and HMI state |
| AI → actuator output | (none) | — | Design principle: no output contacts from the AI server to valves, pumps or control rods |
The implication of this I/O map fits on one line. The last row, “AI → actuator output: none,” is the core of this design, and assigning no Digital Out to the AI server other than DO_AI_ADVISORY_LAMP is the only electrical configuration that satisfies both the 6.8% public acceptance figure and the draft law’s “guaranteed human intervention” at the same time.
PLC logic snippet (IEC 61131-3 Structured Text pseudocode)
(* Nuclear AI advisory class logic - diagnostics/display only, fully separated from protection class (DI_MANUAL_TRIP, RPS) *)
(* Note: not the actual logic of any specific plant; a concept example translating the principles presented at the forum (classification, human intervention, return to non-AI) *)
VAR
DI_AI_HEALTH : BOOL; (* AI server watchdog, FALSE when the cycle is not received *)
DI_AI_STOP : BOOL; (* operator AI stop switch *)
DI_OPR_ACK : BOOL; (* operator evidence-viewed acknowledgment *)
AI_HAS_EVIDENCE : BOOL; (* whether the AI attached evidence document / process variable links *)
DO_AI_ADVISORY_LAMP : BOOL;
AI_ADVISORY_VALID : BOOL;
END_VAR
(* Advisory valid condition: server healthy AND not stopped AND evidence attached *)
AI_ADVISORY_VALID := DI_AI_HEALTH AND NOT DI_AI_STOP AND AI_HAS_EVIDENCE;
(* The only output: an indicator lamp. No DO to actuators (valves/pumps/control rods) exists in this program *)
DO_AI_ADVISORY_LAMP := AI_ADVISORY_VALID;
(* Record: log the time the operator viewed the evidence - no relation to operating authority *)
IF AI_ADVISORY_VALID AND DI_OPR_ACK THEN
(* LOG_EVENT(AI_EVIDENCE_ACK) *)
END_IF;
(* The protection class (manual trip, RPS automatic trip) is handled by hardwired circuits outside this logic - not referenced here *)Boundary conditions — handling field variables
The point where this design principle’s advantage flips is when “advice” is effectively read as “instruction.” Even if the AI is not connected to a control output, if it presents the wrong document as evidence or displays only a conclusion without evidence, it opens a human error path in which the operator’s judgment is pulled in that direction. That is why the logic above treats the advisory as invalid when AI_HAS_EVIDENCE is absent; but the logic cannot judge whether the attached evidence is the latest revision or the drawing for the right unit — that verification belongs to the document management system and the procedures.
In addition, the actual isolation performance of the one-way communication device and the effect of measurement data transmission delay and noise on the AI judgment point (T1) are items that require waveform analysis and field measurement. Once the classification criteria and the details of verification criteria for high-risk AI are finalized, the scope of the advisory class (for example, whether to allow maintenance planning recommendations) will have to be redrawn.
There is one single selection criterion: confirm that the number of output contacts from the AI server to actuators is zero on the drawings, and if it is not zero, verify that AI not as advisory class but as high-risk control class.
References
- Electric Times (Jeonki Sinmun), “AI eyeing nuclear plant operation and maintenance… may it judge in place of people?” (posted 2026-09-04 12:51, updated 2026-09-07 09:52, reporter Jeong Se-young) — 56th Power Forum (2026-09-04, FKI Tower), survey by Professor Cho Sung-kyung of Myongji University (1234 people, 56.7%/6.8%), Diablo Canyon 2024 case, NRC re-examination of 517 guides, attorney Park Jin-pyo’s draft law, remarks by Dr. Lee Moo-yeol of Sandia National Laboratories, advisor Kim Seo-gon of Lee & Ko, and attorney Lee Ju-heon of Songyul.
- Patent EP4254430A1 “Device and method for tracking basis of abnormal state determination by using neural network model” (Korea Hydro & Nuclear Power Co Ltd, filed 2021-11-15, published 2023-10-04, legal status Pending, same family as WO2022114634A1, KR priority 2020). Claim 1 claims an “abnormal state determination basis tracking device” consisting of an abnormal state classification unit, a process variable derivation unit, a process variable weighting unit and a determination basis generation unit, and it is cited here as prior art for the explainability (evidence presentation) technology corresponding to the AI_HAS_EVIDENCE condition in this article. This patent is a diagnostic and basis-tracking device and does not claim actuator control. Whether it is registered in KR needs separate confirmation (direct lookup on Google Patents).
