Search NASA⌕ Search

SEARCH · Search NASA

Results for “Safety Controls”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 55 records · Page 3
All sourcesNASA NTRSDOE OSTI
DOE OSTI2020

Nuclear Criticality Safety Assessment of Criticality Control Containers without Moderation Control at the Waste Isolation Pilot Plant

The Waste Isolation Pilot Plant (WIPP) provides for safe, permanent disposal of government-owned transuranic (TRU) and TRU mixed wastes. Receipt and disposal of waste at the WIPP site began in March 1999. The Sandia report, Consideration of Nuclear Criticality When Disposing of Transuranic Waste at the Waste Isolation Pilot Plant, addressed potential nuclear criticality safety issues based on the projected inventory characteristics known at the time [1]. As designs for inventory, waste forms, and disposal packages have changed, new analyses have been performed, and updates have been made to address any potential effects to the WIPP safety basis. New analyses performed include Saylor 2017 [2] and Brickner 2019 [3], which address certain waste containers with specified loadings under post-closure conditions. Both examined several hypothetical scenarios and included analyses to bound (from a criticality potential standpoint) credible configurations that could occur at WIPP during the repository regulatory post-closure disposal time period for feature, event, and process (FEP) considerations—10,000 years. During this post-closure period at WIPP, the screening of FEPs is governed by the risk-based standards and implementing regulations of the US Environmental Protection Agency (EPA) (i.e., 40 CFR 191 and 40 CFR 194, respectively) [4,5]. An FEP screening can be based on either a low-consequence or low-probability rationale. A low-probability rationale includes either (a) a qualitative rationale that the FEP is not credible or (b) a quantitative demonstration that the probability is less than 10-4 in 104 years. In this evaluation, a qualitative lowprobability rationale of not credible is used by demonstrating that bounding configurations of the waste are not critical. The demonstration of subcriticality is through quantitative calculations, but a probability of criticality is not evaluated. Rather, the rationale for this evaluation is that bounding configurations with an effective neutron multiplication factor (keff) well below the upper subcriticality limit (USL) make criticality incredible. Reference [2] documented a nuclear criticality assessment of the WIPP repository for disposal of dilute surplus plutonium materials using the Dilute and Dispose Approach and packaging in criticality control overpacks (CCOs). The CCO is the waste disposal container recently designed to allow for up to 380 fissile gram equivalent (FGE) 239 Pu per drum, which is a higher fissile loading than typical waste containers. The CCO consists of a criticality control container (CCC) positioned by upper and lower plywood spacers within a standard 55 gal drum. The CCC is used to establish a geometry control for fissile materials during transportation and WIPP emplacement operations. The current WIPP waste acceptance criteria for CCO payloads limit beryllium to less than or equal to 1% by weight of the waste contents and require the waste form to be non-machine compacted. Reference [2] considered two scenario progressions—room closure from salt creep, hereafter referred to as the reconfigured dry scenario, and flooding with brine, hereafter referred to as the reconfigured wet scenario. The subsequent drying out of the reconfigured wet scenarios was also considered. For all scenarios, subcriticality was maintained when 50 g of B 4 C (acting as a neutron absorber) per CCC was intermixed within the plutonium disposition waste form. The analysis used a waste form description that limits the amount of moderation that could be present within the waste form (i.e., it limits the amount of water and polyethylene that could be present based on planned processing conditions). This analysis to evaluate increased limits on the amount of moderation that could be present was performed as a companion to Reference [2] to address concerns associated with verifying moisture and/or plastic contents of waste materials following packaging of dilute surplus plutonium in the CCO. To that end, this analysis used the models and methods from Reference [2] to evaluate a more generic base waste form consisting of water and polyethylene that is more similar (and nearly identical) to the generic waste forms utilized in other models/analyses supporting the TRU Package Transporter Model II (TRUPACTII) safety analysis [6] (all are without moderation controls). The waste form in this analysis uses a base mixture of 75% water and 25% polyethylene, the total amount of which is varied to determine the optimum moderation to fissile material (H/Pu) ratio. The fissile loading is maintained at up to 380 FGE 239 Pu (modeled as PuO 2 ) per CCO with an additional 545 g of beryllium (to bound the 1% by weight contents restriction) and 50 g of B 4 C intermixed per CCO. The beryllium content (1% by weight) is based on the total allowed waste weight (this does not include packaging and container weights). Figures ES-1 and ES-2 display summary results, showing that with this model including 50 g of B 4 C per CCO, the system keff remains under 0.85 for all moderator amounts and provides a significant margin against post-closure criticality under postulated bounding conditions for compaction. Figure ES-1 compares an infinite model with a room model at the initial emplacement spacing and under full radial compaction. Full radial compaction places each CCC in direct contact and does not credit any anticipated spacing associated with current post-closure geomechanical modeling of the repository [7]. The effects of variations in the H/Pu ratio were evaluated by varying the amount of the water/polyethylene component of the waste model, with fissile loading maintained at 380 239 Pu FGE. Similarly, Figure ES-2 illustrates how various amounts of B 4 C per CCO influence k eff at different radial compactions, all at the H/Pu ratio of 200 (in the room array model). Therefore, while the results from Saylor 2017 [2] modeled more realistic process limits associated with packaging of dilute surplus plutonium, this analysis demonstrates that limits on moderation (plastic and water content) are not necessary to ensure subcriticality in the WIPP repository, provided the requisite B 4 C absorber is present.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
DOE OSTI2022

Safety-Related Instrumentation and Control Pilot Upgrade: Initial Scoping Phase Implementation and Lessons Learned

In May 2016, the U.S. Nuclear Regulatory Commission (NRC) staff provided a digital instrumentation and control (I&C) regulatory infrastructure integrated action plan to the NRC for approval. One of the objectives of that plan was to establish a clear regulatory structure with reduced regulatory uncertainty to enable the expanded safe use of digital I&C in commercial nuclear reactors while continuing to ensure safety and security. To achieve this end, the NRC, with collaboration from industry, developed a streamlined License Amendment Request Alternate Review (AR) process for safety-related (SR) digital I&C upgrades. In spite of this effort, the industry has remained reluctant to perform such I&C upgrades because of perceived regulatory and financial risks associated with being the first or an early adopter of the AR process for SR I&C upgrades. The U.S. Department of Energy Light Water Reactor Sustainability Program at the Idaho National Laboratory performed Initial Scoping Phase research to help break this impasse by supporting a SR I&C Pilot Upgrade, working with MPR Associates, ScottMadden Inc., and Exelon Generation. Exelon’s Limerick Generating Station (LGS) was selected as the target for this research. This paper summarizes the Initial Scoping Phase engineering and operations, licensing, and project management activities necessary to bound the scope, schedule, and estimated cost of the project sufficiently to enable utility management authorization of Conceptual Design Phase activities. These efforts and associated products are intended to provide a template to support larger industry efforts to perform similar upgrades as a foundation stone for a digital transformation that will improve plant safety, reliability, and operational performance while lowering plant total cost of ownership. As a result of the combined effort of Exelon Generation and research participants, Conceptual Design Phase activities for the subject upgrade at LGS were approved by Exelon. Further, the U.S. Department of Energy also awarded a $50 million cost share award to Exelon in order to pave the way for SR I&C modernization and associated control room upgrades across the U.S. nuclear fleet. Additional research reports are planned for the Conceptual Design Phase, Detailed Design Phase, and the Implementation Phase of the LGS project to document the process followed and promulgate lessons learned to industry.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2023

3D Modeling of Safety-Related Upgrade Pilot Project

Constellation Energy and the United States Department of Energy (DOE) have established a public/private partnership to implement a pilot digital upgrade to replace legacy analog, safety-related reactor protection and emergency safety feature actuation systems (RPS/ESFAS) with modern digital systems. This effort is occurring at Constellation’s Limerick Generating Station. This project is being performed in accordance with industry processes that have been adapted to better support digital upgrades. These processes include IP-ENG-001, Standard Design Process, NISP-EN-04, Standard Digital Engineering Process and Electric Power Research Institute Report 3002011816, Digital Engineering Guide. The Light Water Reactor Sustainability (LWRS) Program at the Idaho National Laboratory (INL) has been supporting this effort. Latest INL HFE efforts in support of this project have focused on definition and implementation of the Human Factors Engineering (HFE) Program in support of Constellation design and related licensing efforts. This paper will present the development of the HFE 3D modeling execution of the Main Control Room safety upgrades. New equipment and modifications are planned for upgrading the new safety systems. 3D modeling allows for visualization of the new equipment and modifications to be shared with engineering and design teams for evaluation and review. Anthropometric considerations such as sight lines and functional reach can be evaluated directly using the 3D model. This effort has helped to provide visualizations for additional review with operations personnel and project stakeholders.

3D Modeling↗
DOE OSTI2020

Volume III. DUNE far detector technical coordination

The preponderance of matter over antimatter in the early universe, the dynamics of the supernovae that produced the heavy elements necessary for life, and whether protons eventually decay -- these mysteries at the forefront of particle physics and astrophysics are key to understanding the early evolution of our universe, its current state, and its eventual fate. The Deep Underground Neutrino Experiment (DUNE) is an international world-class experiment dedicated to addressing these questions as it searches for leptonic charge-parity symmetry violation, stands ready to capture supernova neutrino bursts, and seeks to observe nucleon decay as a signature of a grand unified theory underlying the standard model. The DUNE far detector technical design report (TDR) describes the DUNE physics program and the technical designs of the single- and dual-phase DUNE liquid argon TPC far detector modules. Volume III of this TDR describes how the activities required to design, construct, fabricate, install, and commission the DUNE far detector modules are organized and managed. This volume details the organizational structures that will carry out and/or oversee the planned far detector activities safely, successfully, on time, and on budget. It presents overviews of the facilities, supporting infrastructure, and detectors for context, and it outlines the project-related functions and methodologies used by the DUNE technical coordination organization, focusing on the areas of integration engineering, technical reviews, quality assurance and control, and safety oversight. Because of its more advanced stage of development, functional examples presented in this volume focus primarily on the single-phase (SP) detector module.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
DOE OSTI2022

Hyperbranched PDMAEMA-functionalized SiO 2 microparticles: ATRP polymerization and grafting in a continuous flow reactor

Flow chemistry offers high reaction yield, kinetic control, improved safety, reliability, scalability, and greater degree of process control. Herein, hyperbranched polymer-grafted silica microparticles (HP-SMPs) are synthesized in a commercially available flow reactor through atom transfer radical polymerization. Initiator-anchored silica microparticles are obtained by in situ silanization in the flow reactor. Hyperbranched poly[2-(dimethylamino)ethylmethacrylate] chains are grafted onto the initiator-anchored SMPs through inimer–monomer ratio control. To demonstrate the efficiency and universality of this approach in grafting polymers onto SMPs, multiple hyperbranched polymeric structures are obtained by varying the inimer concentration. Dye absorption test is conducted to demonstrate the potential applications of HP-SMPs.

36 MATERIALS SCIENCE↗
DOE OSTI2021

A Risk-Informed Performance-Based Methodology to Manage Fire Protection Systems in Nuclear Facilities

Fire protection systems (FPSs) and features are installed in U.S. Department of Energy (DOE) Hazard Category 1, 2, or 3 nuclear facilities to protect property (maximum possible fire loss thresholds), life, and nuclear safety (i.e., structures, systems, and components). These FPSs and features are designed and maintained in accordance with the prescriptive guidance provided in applicable building codes and National Fire Protection Association codes and standards. Management, operations, and maintenance activities of FPSs involve significant effort. A DOE facility’s documented safety analysis or other safety basis document could also rely on FPSs to provide either a safety significant or safety class function to mitigate fire hazards and minimize radiological consequences. In some cases, the designation of safety significant or safety class may be determined to provide a layer of defense-in-depth to minimize nuclear safety risks independent of the fire risk. DOE standards allow the use of performance-based design alternatives developed by the fire industry but do not consider the defense-in-depth layers of protection provided in DOE facilities to prevent or mitigate the risks associated with unintended release of radioactive materials into the environment. Pacific Northwest National Laboratory developed a decision-making methodology tailored for DOE non-reactor nuclear facilities to manage FPSs and features by integrating nuclear safety risk insights into a performance-based analysis. This risk-informed, performance-based (RIPB) methodology can be used to provide the technical basis for classifying an FPS as safety class and safety significant, tailoring administrative controls (e.g., technical safety requirements), and ranking the importance of FPSs to prioritize maintenance, upgrades, and replacement activities. The RIPB methodology is a graded approach to inform DOE facility owners and Fire Protection Program managers of the most risk-significant FPSs and equipment, and those systems would be cost-beneficial to relax rigor if there is a need to re-design the FPS coverage or deviate from DOE and National Fire Protection Association standards for those systems that would be less significant. This paper describes the framework used to develop the RIPB methodology and the outcome of implementing this methodology in a use-case nuclear facility. This paper also discusses the impact to DOE policies and standards and the safety margins and defense-in-depth measures credited in nuclear safety assessments in a facility’s documented safety analysis and the benefits of implementing an RIPB methodology in lieu of a prescriptive method to comply with fire protection requirements.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2022

Benchmark Exercise for the Control Rod Swelling Evaluation

The VTR core has six reactivity control assemblies and three safety assemblies. The control assemblies or primary control rods are adjusted during the normal operation to balance the core reactivity and to control the reactor power. A typical control assembly radial layout is presented in Figure 1. The figure shows the swelled absorber (B 4 C) rod. Initially, helium gas fills the gap between the pin and the cladding before irradiation swelling takes place. For VTR, HT9 steel was selected as the cladding and duct material. The main neutron absorbing material used in the VTR is B 4 C. When residing in the core, the neutronics, thermophysical, and mechanical properties of the materials used in a control assembly will degrade due to accumulated neutron damage. Material degradation limits how long a control assembly can reside in the core. Many phenomena affect the control assembly lifetime, such as the loss of reactivity worth due to B 4 C depletion, the mechanical interaction of the absorber rod and the cladding due to B 4 C swelling, the helium gas buildup in the pin due to B-10 capture, etc. B 4 C swelling, which causes closure of the gap between the absorber rod and the cladding, is usually considered as the main limiting factor from past experience. An initial study was conducted at PNNL to evaluate the irradiation behavior of a VTR control assembly. The evaluation was performed using the CNRD2 code that was initially developed for the FFTF. The study also included an assessment of the VTR control assembly and focused on a 61-pin control assembly design, which is different from that used (37-pin design) in the core design study. The study conducted by PNNL was reviewed independently by ANL. A Python script referred to as the Control Assembly Evaluation Script (CAES) was developed for the independent review and additional assessment of 37-pin control assembly design. The script has focused on the assessment of the absorber rod swelling for its importance in determining the control assembly lifetime. CAES uses geometry, neutronics, materials data as input to predict the swelling of the absorber rod during its residence in the reactor core. The results from CAES showed some non-negligible differences against the PNNL results. Some of the differences can be attributed to the different interpretation of the control rod assembly dimensions. To resolve this issue, a benchmark exercise was proposed. The benchmark specification was developed by PNNL. The benchmark exercise was performed independently at PNNL and ANL using different codes/scripts (CRND2 and CAES). This memo documents the results calculated using the different codes. However, this report is limited to presenting the results obtained. Further investigation of the cause of the observed difference will be performed as part of future activities, pending continuation of the VTR program.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2020

HAZARD ANALYSIS OF DIGITAL ENGINEERED SAFETY FEATURES ACTUATION SYSTEM IN ADVANCED NUCLEAR POWER PLANTS USING A REDUNDANCY-GUIDED APPROACH

Replacing the existing aging analog instrumentation and control (I&C) systems with modern safety control and protection digital technology offers one of the foremost means of performance improvements and cost reductions for the existing nuclear power plants (NPPs). However, the qualification of digital I&C systems remains a challenge, especially considering the issue of software common-cause failures (CCFs), which are difficult to address. With the application and upgrades of advanced digital I&C systems, software CCFs have become a potential threat to plant safety because most redundant designs use similar digital platforms or software in the operating and application systems. With complex designs of multilayer redundancy to meet the single-failure criterion, digital I&C safety systems (e.g., engineered safety-features actuation system [ESFAS]) are of a particular concern in the U.S. Nuclear Regulatory Commission (NRC) licensing procedures. This paper applies a modularized approach to conduct redundancy-guided systems-theoretic hazard analysis for an advanced digital ESFAS with multilevel redundancy designs. Systematic methods and risk-informed tools are incorporated to address both hardware and software CCFs, which provide guidance to eliminate the triggers of potential single points of failure in the design of digital safety systems in advanced plant designs.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
DOE OSTI2020

Transient Safety Filter Design for Grid-Forming Inverters

Unlike conventional generators, inverter-based generation are fundamentally incapable of providing rotational inertia. While grid-forming inverters alleviate some of that problem by synthesizing small inertia via feedback control, additional control mechanisms are needed to ensure safety and security during transients. In this paper, we propose novel real-time safety-constrained feedback controllers (``safety filters'') for droop-based (grid-forming) inverters to ensure transient security of the grid. The safety filter acts as a buffer between the network operational layer and the inverter-control layer, and only lets those dispatch control signals pass to the inverter droop-controller, which are guaranteed to not violate the safety specifications (frequency, voltage, current limits). Using a distributed barrier certificates method, we construct sector-like conditions on the control policies, which guarantee the satisfaction of transient safety specifications. Sum-of-square programming is used to synthesize the safety filters. Numerical simulation results are provided to illustrate the performance of the proposed filter on inverter-based microgrids.

Kundu, Soumya↗
DOE OSTI2024

An Integrated Framework for Risk Assessment of Safety-related Digital Instrumentation and Control Systems in Nuclear Power Plants: Methodology Advancement and Application

This report documents activities performed by Idaho National Laboratory (INL) during fiscal year (FY) 2024 for the U.S. Department of Energy (DOE) Light Water Reactor Sustainability (LWRS) Program, Risk Informed Systems Analysis (RISA) Pathway, Digital Instrumentation and Control (DI&C) Risk Assessment project. The goal of the RISA Pathway is to optimize safety margins and minimize uncertainties to achieve economic efficiencies while maintaining high levels of safety. This is accomplished by providing scientific basis to better represent safety margins and factors that contribute to cost and safety, and by developing new technologies that reduce operating costs. The research efforts for FY 2024 encompass methodology refinement and exploration. The efforts include: (1) The implementation of a natural language processing tool to expedite key aspects of the reliability analysis methods developed by INL; (2) advances to support intersystem CCF analysis by providing guidance for and identification of coupling mechanisms that may contribute to CCF; (3) the investigation of how generative artificial intelligence tools can aid in hazard analysis and diversity and defense in depth (i.e., D3) assessments; (4) Industry collaboration, allowing the demonstration of and INL's risk assessment tools to support risk assessment of DI&C systems at early and late stages of development; (4) a roadmap for the development of a software for each of INL's risk assessment tools; (5) The development of a theory and methodology manual for a risk quantification methodology; (6) the development of a reliability analysis for machine learning (ML)-integrated control systems.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2020

On the Road to Achieving Safety Excellence at the Idaho Cleanup Project: The Initial Challenges, Solutions, and Positive Results of Striving to be the Best and Safest in the DOE Complex - 20518

When Fluor Idaho, LLC (Fluor Idaho) assumed the Idaho Cleanup Project Core contract (ICP Core) in mid-2016, it inherited the successful multi-faceted, employee-owned safety programs of two prior contractors supporting cleanup operations at the Idaho National Laboratory Site. Fluor Idaho incorporated the best of both safety programs along with Fluor Corporate's 106-year legacy of safety initiatives and successes. Fluor Idaho integrated the separate programs and cultures under a One Fluor approach - one project, one mission, One Fluor. Job changes, management changes, and procedures, processes, and system changes presented multiple challenges. Those challenges combined with the severe Winter of 2016/2017 resulted in numerous slips, trips, and falls first aids and reportable injuries. The road to safety excellence started off bumpy and stayed that way for some time. Since then, Fluor Idaho has successfully implemented several key initiatives including employee engagement; management engagement and time in the field; communications improvements; safety culture sustainment; injury/illness prevention; organizational learning; and DOE Voluntary Protection Program (VPP) readiness and preparation. Management became more engaged by making more workplace visits and increasing their supervision of 'life critical work' or complex activities. Additional training became mandatory for first-line supervisors and front-line workers. Most recently, Fluor Idaho increased its injury and illness prevention initiatives extensively. In the last year, things have turned around in a dramatic way. This shift is directly attributable to the significant number of initiatives launched in late 2017 and 2018. These initiatives addressed safety performance in the five key areas of the DOE VPP and promoted sustainability of the company's safety culture. The five key areas are: management leadership, employee involvement, work-site analysis, hazard prevention and control, and safety and health training. Employees and managers alike recommitted to making safety the highest value. The result of this laser-like focus on safety and accident and injury prevention is that injuries and first aids are a fraction of what they were. During FY 2019, employees worked more than 4.2 million hours without a serious injury or lost work-day and 1 million hours without a recordable injury. Fluor Idaho is proud of its safety trend. The company invested significant resources in improving its safety record, and that investment is paying off. Other contractors in the DOE Complex can learn and benefit from this discussion of the challenges Fluor Idaho faced, as well as its innovative safety initiatives that are producing results that are being recognized by our U.S. Department of Energy (DOE) customer. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
DOE OSTI2021

Barrier Function-based Reinforcement Learning for Emergency Control of Power Systems

Under voltage load shedding has been considered as a standard and effective measure to recover the voltage stability of the electric power grid under emergency and severe conditions. However, this scheme usually trips a massive amount of load which can be unnecessary and harmful to customers. Recently, deep reinforcement learning (RL) has been regarded and adopted as a promising approach that can significantly reduce the amount of load shedding. However, like most existing machine learning (ML)-based control techniques, RL control usually cannot guarantee the safety of the systems under control. In this paper, we introduce a novel safe RL method for load shedding of power systems, that can enhance the safe voltage recovery of the electric power grid after experiencing faults. Unlike standard RL method, the safe RL method integrates a Barrier function into the reward function. Consequently, the optimal control policy can render the power system to avoid the safety bounds. This method is general and can be applied to other safety-critical control problems. Numerical simulations on the 39-bus IEEE benchmark is performed to demonstrate the effectiveness of the proposed safe RL emergency control, as well as its adaptive capability to faults not seen in the training.

Vu, Thanh Long↗
DOE OSTI2025

Proposed Classifications of Remote Operations for Nuclear Reactors Based on Physical and Cybersecurity Considerations

The incorporation of remote operations into reactor operations is a topic of high interest among advanced and small modular reactor (A/SMR) vendors, with some considering it essential to the success of their business models. However, remote operations are a concept novel to the nuclear industry. While various technical aspects of remote operations have been explored, a significant gap remains in understanding the security implications of integrating remote operations into reactor designs, particularly concerning the security requirements for remote-operations facilities and infrastructure. This report aims to address this gap by first defining classes of remote operation based on the extent of remote access to reactor control systems and grounded in the existing regulatory framework with compatible terminology. Secondly, the report outlines the physical and cybersecurity requirements applicable to remote-operations facilities and infrastructure at each defined class. These requirements are based on existing licensing frameworks provided by 10 Code of Federal Regulations (CFR) Part 50 and 10 CFR Part 52, as well as the upcoming A/SMR licensing framework in the proposed Part 53. The assessment focuses specifically on security regulations, such as 10 CFR Part 73, which includes provisions for both cybersecurity (§ 73.54) and physical security (§ 73.55). This report proposes five classes of remote reactor operations. Class 1 involves remote monitoring only, with no control over reactor systems. Class 2 allows for the remote issuance of allowlisted commands to the reactor facility. Class 3 extends control to non-safety-significant, non-safety-related, or not important to safety systems and equipment. Class 4 permits remote control of safety-significant systems. Finally, Class 5 allows remote control of safety-related systems. It is important to note that these classes were defined purely with functionality in mind, without considering the practicality or feasibility of implementation for each class under current or upcoming regulatory guidance. The intention behind this approach is to enable an assessment of which security requirements apply to each class, allowing readers to evaluate the implementation possibilities for their specific use cases. Following the definition of remote-operation classes, the report assesses the specific physical and cybersecurity requirements applicable to the remote-operations facility and infrastructure within each defined class. This includes defining the types and locations of operators that are possible at each class of operation and, based on operator type and location, as well as functionality within each class, outlining the physical and cybersecurity requirements. By detailing the security requirements by class, the report provides readers with the information needed to determine the type of security program they may need to implement for their desired concept of operation. The next contribution of this report was to assess the practicality of implementing each proposed class of remote operations based upon the security requirement assessment. In short, three of the five proposed remote-operation classes were found to possibly have a practical path forward to implementation under the U.S. regulatory framework. Class 1 remote operations are currently in use in the U.S. while Class 2 and 3 remote operations may be logistically possible to implement under the U.S. regulatory framework. The final two Classes, 4 and 5, would likely be logistically difficult, if not infeasible to implement within the current U.S. physical- and cybersecurity regulatory framework. Given the results of the feasibility assessment, an example architecture is proposed for both Class 2, remote allowlisted commands, and Class 3, remote control of non-safety systems as well as security implication assessments of each architecture. These example implementations are not meant to be prescriptive in terms of how Class 2 or Class 3 remote operations should be deployed; instead, they are intended to be informative to stakeholders on how Class 2 or Class 3 could potentially be applied in order to inform their system design. An example architecture for Class 1 remote monitoring was not provided as Class 1 in already in use in U.S. nuclear operations. Example architectures for Class 4 and Class 5 were not provided due to their assessment of being likely infeasible to implement. The final contribution is an assessment of the physical- and cybersecurity implications of introducing autonomous operations into an A/SMR. What was found was that the security implications can be separated into two cases. Autonomous operations supported by SSCs located only at the reactor site, and autonomous operations supported by SSCs outside of the reactor site. For the first case, the introduction of autonomous systems will likely not change the facility’s requirement to comply with existing cyber and physical security regulation

22 - GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2025

Local practically safe extremum seeking with assignable rate of attractivity to the safe set

We present Assignably Safe Extremum Seeking (ASfES), an algorithm designed to minimize a measured, static objective function while maintaining a measured, static metric of safety (a control barrier function or CBF) to be positive in a practical sense. We ensure that for trajectories with safe initial conditions, the violation of safety can be made arbitrarily small through appropriately chosen design constants. We also guarantee an assignable “attractivity” rate: from unsafe initial conditions, the trajectories approach the safe set, in the sense of the measured CBF, at a rate no slower than a user-assigned rate. Similarly, from safe initial conditions, the trajectories approach the unsafe set, in the sense of the CBF, no faster than the assigned attractivity rate. The feature of assignable attractivity is not present in the semiglobal version of safe extremum seeking, where the semiglobality of convergence is achieved by slowing the adaptation. We also demonstrate local convergence of the parameter to a neighborhood of the minimum of a quadratic objective function constrained to the safe set with a linear CBF. The ASfES algorithm and analysis are multivariable, but we also extend the algorithm to a Newton-Based ASfES scheme which we show is only useful in the scalar case. The proven properties of the designs are illustrated through simulation examples.

42 ENGINEERING↗
DOE OSTI2023

Risk Analysis of Various Design Architectures for High Safety-significant Safety-related Digital Instrumentation and Control Systems of Nuclear Power Plants during Accident Scenarios

This report documents the plus-up activities performed by Idaho National Laboratory (INL) during Fiscal Year (FY) 2022 for the U.S. Department of Energy (DOE) Light Water Reactor Sustainability (LWRS) Program, Risk Informed Systems Analysis (RISA) Pathway, digital instrumentation and control (DI&C) risk assessment project. In FY 2019, the RISA Pathway initiated a project to develop a risk assessment strategy for delivering a strong technical basis to support effective, licensable, and secure DI&C technologies for digital upgrades/designs. An integrated risk assessment technology for the DI&C systems was proposed for this strategy, which aims to (1) provide a best-estimate, risk-informed capability to quantitatively and accurately estimate the safety margin obtained from plant modernization, especially for the high safety-significant safety-related (HSSSR) DI&C systems, (2) support and supplement existing advanced risk-informed DI&C design guides by providing quantitative risk information and evidence, (3) offer a capability of design architecture evaluation of various DI&C systems to support system design decisions and diversity and redundancy applications, (4) assure the long-term safety and reliability of HSSSR DI&C systems, and (5) reduce uncertainty in costs and support integration of DI&C systems in the plant. To achieve these technical goals and deal with the expensive licensing justifications from regulatory insights, the LWRS-developed framework instructs nuclear vendors and utilities on how to effectively lower the costs associated with digital compliance and speed industry advances by: (1) defining an integrated risk-informed analysis process for DI&C upgrade, including hazard analysis, reliability analysis, and consequence analysis, (2) applying systematic and risk-informed tools to address common cause failures (CCFs) and quantify corresponding failure probabilities for DI&C technologies, particularly software CCFs, (3) evaluating the impact of digital failures at the component level, system level, and plant level, and (4) providing insights and suggestions on designs to manage the risks, thus to support the development, licensing, and deployment of advanced DI&C technologies on nuclear power plant (NPPs). Adding diversity within system or components is the main means to eliminate and mitigate CCFs, but diversity also increases plant complexity and errors and may not address all sources of systematic failures. How to optimize the diversity and redundancy applications for the safety-critical DI&C systems remains a challenge. To deal with the technical issues in addressing potential software CCFs in HSSSR DI&C systems of NPPs and supporting relevant design optimization, the framework provides: ? An integrated best-estimate, risk-informed capability to address new technical digital issues quantitatively, accurately, and efficiently in plan modernization progress, such as software CCFs in HSSSR DI&C systems of NPPs ? A common and a modularized platform for DI&C designers, software developers, cybersecurity analysts, and plant engineers to efficiently predict and prevent risk in the early design stage of DI&C systems ? Technical bases and risk-informed insights to assist U.S. Nuclear Regulatory Commission (NRC) and industry to address and fulfill the risk-informed alternatives for evaluation of CCFs in HSSSR DI&C systems of NPPs ? An integrated risk-informed tool that offers a capability of design architecture evaluation of various DI&C systems to support system design decisions in diversity and redundancy applications. The plus-up research and development efforts of this project in FY 2022 are focused on methodology improvement of software CCF modeling and estimation, prevention analysis, importance analysis and risk analysis of various design architectures of HSSSR DI&C systems. This work greatly enhances the capability of the LWRS-developed framework for the risk assessment and design optimization of safety-critical DI&C systems. It should be noted that all the analyses are performed for the demonstration of the LWRS-developed framework, not for the evaluation of relevant systems. Results are obtained based on very limited design information and testing data.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2022

An Integrated Framework for Risk Assessment of High Safety Significant Safety-related Digital Instrumentation and Control Systems in Nuclear Power Plants: Methodology and Demonstration

This report documents the activities performed by Idaho National Laboratory (INL) during Fiscal Year (FY) 2022 for the U.S. Department of Energy (DOE) Light Water Reactor Sustainability (LWRS) Program, Risk Informed Systems Analysis (RISA) Pathway, digital instrumentation and control (DI&C) risk assessment project. In FY 2019, the RISA Pathway initiated a project to develop a risk assessment strategy for delivering a technical basis to support effective and secure DI&C technologies for digital upgrades/designs. A framework was proposed for this strategy, which aims to (1) provide a best-estimate, risk-informed capability to quantitatively and accurately estimate the risk impact of plant modernization, considering the introduction of high safety-significant safety-related (HSSSR) DI&C systems, (2) support and supplement existing risk-informed DI&C design guides by providing quantitative risk information and evidence, (3) offer a capability of design architecture evaluation of various DI&C systems, (4) assure the long-term safety and reliability of HSSSR DI&C systems, and (5) reduce uncertainty in costs and support integration of DI&C systems in the plant. To achieve these technical goals, the framework provides a means to address relevant technical issues by: (1) defining a risk-informed analysis process for DI&C upgrade, that integrates hazard analysis, reliability analysis, and consequence analysis, (2) applying risk-informed tools to address common cause failures (CCFs) and quantify corresponding failure probabilities for DI&C technologies, particularly software CCFs, (3) evaluating the impact of digital failures at the component level, system level, and plant level, and (4) providing insights and suggestions on designs to manage the risks, thus to support the development and deployment of advanced DI&C technologies on nuclear power plant (NPPs).

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2021

Quantitative Risk Analysis of High Safety Significant Safety-related Digital Instrumentation and Control Systems in Nuclear Power Plants using IRADIC Technology

This report documents the activities performed by Idaho National Laboratory (INL) during fiscal year (FY) 2021 for the U.S. Department of Energy (DOE) Light Water Reactor Sustainability (LWRS) Program, Risk Informed Systems Analysis (RISA) Pathway, digital instrumentation and control (DI&C) Risk Assessment project. In FY-2019, the RISA Pathway initiated a project to develop a risk assessment strategy for delivering a strong technical basis to support effective, licensable, and secure DI&C technologies for digital upgrades/designs. An integrated risk assessment technology for the DI&C systems (IRADIC technology) was proposed for this strategy, which aims to (1) provide a best-estimate risk-informed capability to quantitatively and accurately estimate the safety margin obtained from plant modernization, especially for the High Safety Significant Safety-related (HSSSR) DI&C systems, (2) develop an advanced risk assessment technology to support transition from analog to DI&C technologies for nuclear industry, (3) assure the long-term safety and reliability of vital HSSSR DI&C systems, (4) reduce uncertainty in costs and support integration of DI&C systems in the plant. To achieve these technical goals and deal with the expensive licensing justifications from regulatory insights, the IRADIC technology is instructive for nuclear vendors and utilities to effectively lower the costs associated with digital compliance and speed industry advances by: (1) defining an integrated risk-informed analysis process for DI&C upgrade, including hazard analysis, reliability analysis, and consequence analysis, (2) applying systematic and risk-informed tools to address common cause failures (CCFs) and quantify responding failure probabilities for DI&C technologies, particularly software CCFs, (3) evaluating the impact of digital failures at the individual level, system level, and plant level, (4) providing insights and suggestions on designs to manage the risks; thus, to support the development, licensing, and deployment of advanced DI&C technologies on nuclear power plant (NPPs). In this report, an approach for performing software CCF analysis, given limited data, is developed and demonstrated using a case study of a highly redundant digital reactor trip system. Consequence analysis is also performed based on different accident scenarios. Results indicate that plant modernization including the improvement of HSSSR DI&C systems will make great benefits to plant safety by providing more safety margins to accident management. In addition, a novel approach is proposed in this report for the quantification of software hazards when sufficient operational and testing data available. The method incorporates software development quality as well as strong analysis techniques to identify and link software defects to potential failure modes. The approach includes both semantic and test-based analysis to detect failures that can exist in different stages of the software development life cycle. This method is applied to an advanced human system interface relevant to reactor trip safety developed from the APR 1400 design.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2023

Precursor Analysis Report: SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003

The SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003 Precursor Analysis Report leverages publicly available information about Davis-Besse’s 2003 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. On 25 January 2003, the SQL Slammer worm infected more than 90% of vulnerable hosts and crashed the internet in 10 to 15 minutes, making it one of the fastest spreading worms in history. SQL Slammer is a fileless, memory-resident worm that remotely exploits a stack-based buffer overflow vulnerability on local hosts to intensively scan and rapidly self-propagate across the internet. The worm infected approximately 300,000 unpatched hosts running Microsoft Structured Query Language (SQL) Server 2000 or Microsoft Desktop Engine (MSDE) 2000 with SQL Server Resolution Service. The SQL Slammer worm indirectly infected FirstEnergy’s Davis-Besse nuclear power plant by first infecting a consultant’s company network server and then propagating through an external misconfigured connection into Davis-Besse’s site network. The infection caused major network congestion, slow performance, data overloads, and the inability of local hosts to communicate with each other, which eventually caused a loss of availability and a loss of view when the Safety Parameter Display System (SPDS) and Plant Process Computer (PPC) crashed. At the time of the infection, the plant was already offline, the digital monitoring systems had redundant analog backups, and the plant control and safety functions were not affected, so there were no concerns of a safety breach. However, this incident resulted in many lessons learned and spawned important discussions about cybersecurity’s role in nuclear safety and electric power reliability regulation, policy, and guidance. Researchers and analysts identified 10 unique techniques utilized during the attack with a total of 640 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Eight of the identified techniques used during Davis-Besse cyber attack were precursors to the triggering event. Analysis identified 596 observables associated with these precursor techniques, 428 of which were assessed to have an increased likelihood of being perceived in the 331 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗