Search NASA⌕ Search

SEARCH · Search NASA

Results for “nuclear cybersecurity”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 55 records · Page 3

Hands-On, Heads-Up: Blending Cyber T&E with Data Science-Driven Training in Jupyter Notebooks

In an era of increasingly sophisticated threats to critical infrastructure, cybersecurity professionals must be more than just aware; they must be immersed, agile, and equipped to operate in environments where failure is not an option. Nowhere is this truer than in the nuclear sector, where cyber-physical systems, regulatory scrutiny, and insider threat potential demand a new generation of hands-on, technically fluent defenders. This paper presents a unified training approach that integrates Cybersecurity Test and Evaluation (T&E) with data science techniques using Jupyter Notebooks as the interactive lab environment. The program centers on a modular, scenario-driven curriculum designed to build not just knowledge but practical capability in the assessment and defense of radiation detection systems, firmware interfaces, and operational security postures.

98 - NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL↗

Large Load Integration - Task List and Overview

Large Load Integration Tasks: Task 1 – Workshops Support stakeholder engagement across industry to promote collaboration and identify solutions to challenges that will guide other work Task 2 – Ancillary Services Characterize different types of large loads to assess under what conditions they may be utilized to provide grid stability services Task 3 – Communications Explore the cybersecurity and communications infrastructure required to enable large loads to interface with grid operations to provide ancillary services Task 4 – Nuclear Integration Explore risks and methods for supporting large load energy needs with SMRs and incorporating them into the wider power system Task 5 – Decision Support and TA Provide support to stakeholders through the creation of planning tools and direct technical assistance.

24 - POWER TRANSMISSION AND DISTRIBUTION↗

Performing Numerical Analysis of Cybersecurity Options Using Dynamic Risk Analysis Tool EMRALD

Cyberattacks can have many different attack paths, durations, and goals. There are also many different mitigation options involving hardware, software, and/or humans. Considering a cyber threat should involve defense-in-depth methods and a quantitative or numerical evaluation of overall effectiveness against dynamic, time-dependent attacks to make cost and risk-informed decisions. Typical cyberattack modeling methods only provide a qualitative evaluation. The main areas of cybersecurity are confidentiality, integrity, and availability. For companies with cyber-physical systems such as advanced nuclear reactors, cyber-related safety is a requirement set by North American Electric Reliability and the U.S. Nuclear Regulatory Commission. They are also concerned about availability or reliability as a business case. As cyber threats are evolving to a business-for-hire structure, more attacks may focus on disrupting business success and reliability, causing financial and economic stability risk. Companies want to know business reliability and recovery from those threats, and that requires modeling physical behavior of the targets. Dynamic-state-based and Markov-based modeling provides a method for better cyber scenario modeling with different tools having issues such as state-base explosion. Dynamic modeling enables time and conditional features not found in other numerical evaluation methods. EMRALD (Event Modeling Risk Assessment using Lined Diagrams) is a dynamic risk analysis modeling and simulation tool and has features that reduce modeling issues. It has been used to model different time-dependent events including plant behavior and operator procedures. As a general modeling tool, EMRALD can also be used to model cyberattack scenarios with varying mitigation options and quantify effectiveness, producing numerical data for risk-informed decisions. This paper uses EMRALD to demonstrate that dynamic numerical risk analysis can be used for cyber threat modeling to provide insights for design decision-making and optimize defense strategies. Keywords: cyber modeling; cyber-physical systems; numerical cyber modeling

97 - MATHEMATICS AND COMPUTING↗

ARCADE Technical Pathway and Industry Impact

The Advanced Reactor Cyber Analysis and Development Environment (ARCADE) simplifies the evaluation and assessment of robustness factor and cyber resilience that support secure-by-design for advanced reactor nuclear power plants. In this manner, ARCADE supports risk-informed performance based (RIPB) evaluations of cybersecurity through its integration of plant physics with high-fidelity emulations of control systems. This cross domain approach enables comprehensive analysis of control system sensitivities, cyber-attack scenarios, and their consequences. ARCADE has been custom developed to meet the demands identified in Tier 1 of the Tiered Cyber Analysis (TCA) as outlined in NRC Draft Regulation Guide (RG) 5.96, which provides a RIPB cybersecurity approach for new reactors.

97 MATHEMATICS AND COMPUTING↗

PSA 2025 DPRA for Cyber Optimization

Cyberattacks can have many different attack paths, durations, and goals. There are also many different mitigation options involving hardware, software, and/or humans. Evaluating defense options should include quantitative evaluation of overall effectiveness to make cost and risk-informed decisions. Typical cyberattack modeling methods only provide a qualitative evaluation and have difficulty with time dependent scenarios. The main areas of cybersecurity are confidentiality, integrity, and availability. For companies with cyber-physical systems such as advanced nuclear reactors, cyber-related integrity is a requirement set by the U.S. Nuclear Regulatory Commission. But companies are also concerned about availability or reliability as a business case. As cyber threats are evolving to a business-for-hire structure, more attacks focus on disrupting business success and reliability, causing financial and economic stability risk. Companies want reliability analysis while optimizing cost, which requires more than safety modeling methods. Dynamic-state-based and Markov-based modeling provides a method for better cyber scenario modeling with timing and conditional features not found in other numerical evaluation methods. EMRALD (Event Modeling Risk Assessment using Lined Diagrams) is a dynamic risk analysis modeling and simulation tool and has features that reduce modeling issues such as state-base explosion found in Markov-based tools. It has been used to model different time-dependent events including plant behavior and operator procedures. As a general modeling tool, EMRALD can also be used to model cyberattack scenarios with varying mitigation options and quantify effectiveness, producing numerical data for risk-informed decisions. This paper uses EMRALD to demonstrate that dynamic risk analysis can be used for cyber threat modeling to provide insights for design decision-making and optimize defense strategies.

97 - MATHEMATICS AND COMPUTING↗

Robotic automation of maintenance work in nuclear power plants a cross-sector survey and roadmap

Nuclear power plants face increasing cost pressures, workforce constraints (aging workforce and skilled labor shortages), and safety requirements that are accelerating interest in robotic systems for inspection and maintenance. We conducted semi-structured interviews with personnel from seven U.S. nuclear utilities and compared deployment models, operational use cases, and integration practices with those reported by participants in the oil, gas, and petrochemical sector. In nuclear plants, robotic use remains concentrated in inspection—particularly indoor unmanned aerial vehicles and submersible remotely operated vehicles—with limited application to physical maintenance tasks. Reported near-term value includes reduced radiological and industrial risk, reduced outage labor, and improved data for planning and condition assessment. Key barriers include integration and data-interoperability constraints, operator qualification requirements, cybersecurity review burden, and difficulty demonstrating reliability in plant-representative environments. Cross-sector benchmarking highlights organizational and deployment practices that may help nuclear plants scale from pilots to routine use. We propose a deployment-oriented roadmap emphasizing modular payload strategies, representative qualification pathways and testing environments, and improved data governance to support safe and economically justified expansion of robotics in operating nuclear power plants.

11 - NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗

Cyber-Informed Engineering Power Generation Guide [Slides]

The CIE for Power Generation: Insights and Case Studies guide is being developed to assist engineers at utilities, asset owner-operators developers, and cybersecurity teams to build in robustness and cyber resiliency into their designs using cyber-informed engineering practices. This guide will break out these topics including use cases by chapters for areas such as Nuclear, IBRs, Geothermal, natural gas, etc.

97 MATHEMATICS AND COMPUTING↗

ARCADE Analysis Methods & Validation Pathway

The Advanced Reactor Cyber Analysis and Development Environment (ARCADE) provides an automated analysis system which supports risk-informed performance based (RIPB) evaluations of nuclear control systems. Every possible cyber threat which could lead to consequence is identified by simulating the unsafe control action sequences which transform digital harm into physical harm. Eliminating the simulation of complex digital cyber attack chains cuts out unnecessary computational overhead and focuses directly on the physics of cyber-physical attacks. This focus enables designers to make informed decisions which can entirely eliminate categories of cyber threats against advanced reactors through the physical nature of the plant design. This narrowing of cyber threat against nuclear power plants through the physics of the system is intended to make any remaining threat management and cost efficient. This is the goal of the Tiered Cyber Analysis (TCA) outlined in NRC Draft Regulation Guide (RG) 5.96, which provides a RIPB cybersecurity approach for new reactors. ARCADE has been custom developed to meet the demands of the rigorous analysis required in Tier 1 of the TCA, which forms the foundation of the TCA process. Currently, ARCADE is still under development, but has made significant leaps in capability. A pilot analysis on the opensource Asherah simulator was performed which demonstrated key functionality goals. The next stage of ARCADE development involves improvements to the applications which support the analysis system, and enabling the analysis system to utilize the full suite of unsafe control action simulations. Since the analysis method’s core functions are complete, validation of the analysis method will be started concurrent to the next development stages. The automated analysis ARCADE will provide can radically change the cybersecurity design process for advanced reactors, reducing the cost of security implementation while enhancing cyber resilience. The pathway for ARCADE’s development to this goal has become much clearer. The majority of technical hurdles have been cleared, and the remaining development needs have been solidified. ARCADE is now capable of assisting the advanced reactor design process and directly support advanced reactor industry RIPB practices.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

Assessment of Cloud-based Applications for Enabling a Scalable Riskinformed Predictive Maintenance Strategy

The current light-water reactor fleet uses time-based maintenance strategies to achieve high-capacity factors. But to make nuclear more competitive in the energy market, these reactors could utilize emerging artificial intelligence (AI) and cloud computing technologies to achieve a cost-effective, predictive-maintenance strategy. This paper presents discussion and results on the application of cloud computing in the nuclear industry. The technical viability of cloud computing was analyzed using data from a boiling-water reactor’s safety relief valve. The models were hosted on three different systems: a local personal computer, Idaho National Laboratory’s high-performance computer system, and Microsoft Azure. The data were loaded and processed, and two types of models were trained in an A/B fashion. Based on the speed at which these actions were completed, it was determined that cloud computing affords adequate computing resources. Additionally, the computing power can scale with the demanded load. To enable cloud computing in the existing fleet, additional sensors, networks, and other requirements must be implemented to ensure a smooth transition from current maintenance strategies. However, the benefit is that the plants no longer need to manage their own servers, software, cybersecurity, and information technology support staff for in-house data analytics purpose. Many of these features can be offloaded to the cloud provider for a potential cost savings. Demonstrating how AI can improve the maintenance and operation of non-safety-related systems seems the likely path forward for implementing AI and cloud computing resources inside nuclear power plants.

azure↗

Evaluation of Hardware and Software Bill of Materials (HBOMs/SBOMs) Extraction Methods

Hardware and software bills of materials (HBOMs and SBOMs) provide important visibility into the components, dependencies, and supply chain relationships within programmable digital devices. This visibility is critical for advanced nuclear reactor applications, where use of common or shared hardware components, software libraries, suppliers, or manufacturing processes may create common cause failure (CCF) vulnerabilities despite apparent diversity. This paper evaluates current approaches for obtaining and analyzing HBOMs and SBOMs in support of CCF, diversity and defense-in-depth (D3) assessments, and begins to explore potential methods for artificial intelligence/machine learning-based analysis. The availability of BOM information from advanced reactor manufacturers and vendors, representative hardware and software categories found in advanced reactor systems continues to limit research [13]. This paper compares commonly used BOM formats, including CycloneDX, SPDX, and SWID. It also surveys publicly available tools for generating BOMs from source code, compiled binaries, and hardware-related information, noting limitations in language coverage, system age, and format interoperability. Finally, this paper evaluates methods for correlating BOM data with vulnerability and exploitability information, including VEX, CVE, and CWE resources. The findings indicate that publicly available nuclear-vendor BOMs are limited, making third-party extraction and research into novel analysis techniques necessary.

Cybersecurity↗

Assessment of Condition Monitoring Methods and Technologies for Inservice Inspection and Testing of Nuclear Power Plant Components

This report was prepared for the U.S. Nuclear Regulatory Commission (NRC) to explore the application of advanced technologies toward meeting the current and future regulatory requirements for maintenance and condition monitoring of structures, systems, and components. The advanced technologies considered in this work are advanced sensors and instrumentation, data analytics, machine learning and artificial intelligence (ML/AI), physics-based models, and digital twins (DT). The interest in the application of advanced technologies for condition monitoring in nuclear power plants continues to grow, and current and future licensees are expected to implement advanced technologies as part of their inservice inspection (ISI) and inservice testing (IST) programs. This report delineates the outcomes of an exploratory investigation into the implementation of advanced condition monitoring technologies to address ISI and IST requirements. A thorough review was conducted of the existing regulatory requirements for ISI and IST, along with an analysis of associated industry practices. Additionally, a state-of-the-art assessment was performed on advanced condition monitoring technologies frequently employed in non-nuclear sectors. This research incorporated two nuclear-specific case studies to illustrate the application of these technologies within the current nuclear fleet. The report provides an exhaustive discussion on the technical challenges, considerations, and opportunities associated with the deployment of advanced condition monitoring technologies. The following are key considerations in the application of advanced technologies for the ISI and IST of nuclear power plant components: • Developing adequate verification and validation procedures to confirm the functional and non-functional requirements, • Developing technical capabilities to conduct real-time asset condition monitoring, • Establishing guidance and protocol for modeling and simulation tools to continuously meet regulatory requirements, • Addressing trustworthiness, explainability, and interpretability of ML/AI methods, • Evaluating maintenance activities to maintain an adequate safety margin and avoid undesirable conditions, • Establishing cybersecure condition monitoring programs associated with a computer-based software system, and • Establishing standardized evaluation metrics for advanced condition monitoring programs. Interest in the use of advanced technologies for condition monitoring in ISI and IST programs continues to grow, and the technology is expected to experience rapid and wide industry adoption in the near future. Adoption of advanced technologies for condition monitoring could have novel and unique impacts on regulatory activities associated with ISI and IST programs. The NRC is continuing to explore the regulatory aspects of advanced technologies as part of ISI and IST programs by pursuing additional research in this technical area.

22 - GENERAL STUDIES OF NUCLEAR REACTORS↗

Site Integration and Regulatory Considerations for a Nuclear Power Plant Colocated with Industrial Facilities: Colocation Studies for a Petroleum Refinery, Methanol Plant, and Wood Pulp Plant

This research explores the colocation of nuclear power plants (NPPs) with industrial applications. Three existing industrial sites were considered to demonstrate the siting process and illuminate technological gaps for future work. The three applications demonstrated for colocation here are a petroleum refinery, a methanol production plant, and a pulp and paper plant. This study uses a modified version of the EPRI siting criteria to explore the geological and demographic characteristics of the location of the current industrial site, as well as exploring external hazards from the industrial plant and its surrounding land use. Data was collected from public databases to estimate site characteristics. We then discuss how the site characteristics may impact the ability to colocate an NPP with an industrial application. The application site and 5 additional sites were explored for each application to give a general indication of the siting implications for an NPP in each area. The hazards for each industrial application was also explored to determine how colocation may impact reactor safety. The following gaps have been identified and should be explored in future research on colocation of NPPs with petroleum refineries, methanol plants, and pulp and paper plants: - There is a variety of industrial use, hazards, and pipelines in the surrounding area. A more thorough review of these hazards should be considered for colocation. - In general, the whole region around some applications seems to have softer soil, with implications for large site preparation costs. Further site investigations should prioritize looking into the geotechnical conditions. - Applications along coastlines are susceptible to flooding and hurricanes. The benefits of colocation should be weighed against the potential design implications. - The benefits of natural gas pipeline infrastructure in place should be explored further. If heat supply from the NPP is not required or not feasible due to the distance between the NPP and the application, there may be an opportunity to supply hydrogen to the plant through an existing pipeline. - Because there are several collocated industrial plants in the regions for the refinery and methanol plant, the benefits of sharing resources from the NPP should be explored further. This may open up additional sites for colocation. The following knowledge gaps were identified for the colocation of NPPs with these three industries, and industrial applications in general. These gaps are: - While the STAND tool contains many important characteristics for the reactor siting process, it is not calibrated for the colocation of NPPs with industrial facilities. - There are aspects of both the NPP and industrial application that need to be quantified for a siting analysis. Particularly, we need to understand the water intake requirements for NPPs and each application. - Further work may focus on adapting the STAND site comparison methodology to comparison of sites for co-location. This will involve using the data documented in this report as a starting point and performing a comprehensive and quantitative comparison. - Without spending significant resources, it would be impossible to gather data for each site to evaluate all aspects of siting. One approach to finding data and understanding its implications to siting is looking at FSARs for existing plants. For example, most sites considered in this study have small Vs30 values, indicating soft soil. However, there are NPPs located in the vicinity of most of the sites (e.g., Waterford Steam Electric Station near New Orleans) and reviewing available site characteristics and geotechnical data for these NPPs, might provide further information for siting. - The siting analysis in this study indicates that colocation of the NPP with the industrial site could be difficult based on external hazards, cooling requirements, weather, or population. We need to determine the impact of distance between the two facilities on cost and quality of energy transport. - This study did not touch on socioeconomic impacts for NPP colocation with industrial facilities. The input-output analysis methodology could be applied to the communities referenced in this study to determine the socioeconomic impact of these projects. - Similarly, the impacts of colocation on emergency planning was not explored in this study. The impacts on emergency planning infrastructure are somewhat related to the socioeconomic impacts, and could be explored using a similar methodology. - This study also did not address physical and cybersecurity, which will be important aspects of co-location [ref] . Cybersecurity will be important, regardless of the distance, but physical security will be important if the facilities are located very closely. Physical security might also be important for the steam lines between the plants, unless they are determined to be non-safety significant. - In many site l

08 HYDROGEN↗

ARCADE (Advanced Reactor Cyber Analysis and Development Environment)

SAND2025-11780O ARCADE (Advanced Reactor Cyber Analysis and Development Environment) software performs cybersecurity experiments on Defensive Cyber Security Architectures (DCSA) for Distributed Control Systems (DCSs). The application is integrated into a cohesive environment that performs cyber risk analyses and reduces costs. ARCADE can investigate the entire cyber-attack surface of a DCS from the physics of control, down to the firmware of individual components with automated efficiency. ARCADE has five major functional components: the Data Broker system, the virtualization environment, the cyber-attack simulator, the cyber-physical analysis system, and the physics simulator. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Valme, Romuald↗

Design of Defensive Cybersecurity Architectures for High Temperature, Gas-Cooled Reactors

This report presents the design of defensive cybersecurity architectures (DCSAs) for High Temperature, Gas-Cooled Reactors (HTGRs). A DCSA is a cybersecurity design feature that places systems into security zones in a graded approach according to the importance of the functions performed by the systems. DCSA design efforts for advanced reactors may commence as early as the system-level design phase. This design approach is consistent with the draft regulatory guide for advanced reactor cybersecurity programs (DG-5075) and enables advanced reactor designers to consider the effects of security-by-design (SeBD) features on their DCSAs. Integration of DCSA design and other cybersecurity activities with the traditional design process as part of a SeBD framework may enable advanced reactor designers to improve the security posture of their plants while reducing implementation and operating costs. This report provides a DCSA template for an exemplar HTGR and describes a DCSA design process using event tree analysis so that the template may be optimized for a given HTGR design.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

Site Integration and Regulatory Considerations for an NPP Colocated with a Petroleum Refinery, Methanol Plant, and Wood Pulp Plant

This research explores the colocation of nuclear power plants (NPPs) with industrial applications. Three existing industrial sites were considered to demonstrate the siting process and illuminate technological gaps for future work. The three applications demonstrated for colocation here are a petroleum refinery, a methanol production plant, and a pulp and paper plant. This study uses a modified version of the EPRI siting criteria to explore the geological and demographic characteristics of the location of the current industrial site, as well as exploring external hazards from the industrial plant and its surrounding land use. Data was collected from public databases to estimate site characteristics. We then discuss how the site characteristics may impact the ability to colocate an NPP with an industrial application. The application site and 5 additional sites were explored for each application to give a general indication of the siting implications for an NPP in each area. The hazards for each industrial application was also explored to determine how colocation may impact reactor safety. The following gaps have been identified and should be explored in future research on colocation of NPPs with petroleum refineries, methanol plants, and pulp and paper plants: - There is a variety of industrial use, hazards, and pipelines in the surrounding area. A more thorough review of these hazards should be considered for colocation. - In general, the whole region around some applications seems to have softer soil, with implications for large site preparation costs. Further site investigations should prioritize looking into the geotechnical conditions. - Applications along coastlines are susceptible to flooding and hurricanes. The benefits of colocation should be weighed against the potential design implications. - The benefits of natural gas pipeline infrastructure in place should be explored further. If heat supply from the NPP is not required or not feasible due to the distance between the NPP and the application, there may be an opportunity to supply hydrogen to the plant through an existing pipeline. - Because there are several collocated industrial plants in the regions for the refinery and methanol plant, the benefits of sharing resources from the NPP should be explored further. This may open up additional sites for colocation. The following knowledge gaps were identified for the colocation of NPPs with these three industries, and industrial applications in general. These gaps are: - While the STAND tool contains many important characteristics for the reactor siting process, it is not calibrated for the colocation of NPPs with industrial facilities. - There are aspects of both the NPP and industrial application that need to be quantified for a siting analysis. Particularly, we need to understand the water intake requirements for NPPs and each application. - Further work may focus on adapting the STAND site comparison methodology to comparison of sites for co-location. This will involve using the data documented in this report as a starting point and performing a comprehensive and quantitative comparison. - Without spending significant resources, it would be impossible to gather data for each site to evaluate all aspects of siting. One approach to finding data and understanding its implications to siting is looking at FSARs for existing plants. For example, most sites considered in this study have small Vs30 values, indicating soft soil. However, there are NPPs located in the vicinity of most of the sites (e.g., Waterford Steam Electric Station near New Orleans) and reviewing available site characteristics and geotechnical data for these NPPs, might provide further information for siting. - The siting analysis in this study indicates that colocation of the NPP with the industrial site could be difficult based on external hazards, cooling requirements, weather, or population. We need to determine the impact of distance between the two facilities on cost and quality of energy transport. - This study did not touch on socioeconomic impacts for NPP colocation with industrial facilities. The input-output analysis methodology could be applied to the communities referenced in this study to determine the socioeconomic impact of these projects. - Similarly, the impacts of colocation on emergency planning was not explored in this study. The impacts on emergency planning infrastructure are somewhat related to the socioeconomic impacts, and could be explored using a similar methodology. - This study also did not address physical and cybersecurity, which will be important aspects of co-location [ref] . Cybersecurity will be important, regardless of the distance, but physical security will be important if the facilities are located very closely. Physical security might also be important for the steam lines between the plants, unless they are determined to be non-safety significant. - In many site l

08 - HYDROGEN↗

Programmable Digital Devices used in Advanced Reactors

This paper introduces the concepts of common cause failure, diversity, and defense-in-depth used by the nuclear industry to analyze resilience in reactors. A survey of publicly traded and private companies building advanced reactors and their licensing status is presented. Safety and non-safety systems found in the NuScale Power design are summarized and the likely hardware and software categories used by those systems are enumerated. The importance of industry partners is highlighted. This paper also identifies an alternate path forward without industry partners to advance the knowledge needed to use artificial intelligence to analyze HBOMs and SBOMs to better understand reactor resiliency.

cybersecurity↗

Design of Defensive Cybersecurity Architectures for Sodium-Cooled Fast Reactors

This report presents the design of defensive cybersecurity architectures (DCSAs) for Sodium-Cooled Fast Reactors (SFRs). A DCSA is a cybersecurity design feature that places systems into security zones in a graded approach according to the importance of the functions performed by the systems. DCSA design efforts for advanced reactors may commence as early as the system-level design phase. This design approach is consistent with the draft regulatory guide for advanced reactor cybersecurity programs (DG-5075) and enables advanced reactor designers to consider the effects of security-by design (SeBD) features on their DCSAs. Integration of DCSA design and other cybersecurity activities with the traditional design process as part of a SeBD framework may enable advanced reactor designers to improve the security posture of their plants while reducing implementation and operating costs. This report provides a DCSA template for an exemplar SFR and how the template may be optimized for a given SFR design.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗