Search NASA⌕ Search

SEARCH · Search NASA

Results for “Operational Risk”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 91 records · Page 5
All sourcesNASA NTRSDOE OSTI
DOE OSTI2023

Autonomous Inversion of In Situ Deformation Measurement Data for Injection-Induced Stress Change

Geologic carbon storage (GCS) is likely to play a key part of the global effort to dramatically reduce CO2 emissions and perhaps even reduce atmospheric CO2 concentrations through carbon negative operations. A critical part of effort to commercialize and widely deploy this technology is developing the capability to rapidly assimilate real-time monitoring data into a form that will enable site operators to make decisions to manage the safe and efficient operations. Two of the risks associate with GCS are the risk of inducing fractures in the sealing formations that can create leakage pathways and the risk of inducing earthquakes of sufficient magnitude to cause public concern, property damage, or safety risks. To properly manage these risks the site operator needs to know the initial state of stress, the change in stress induced by injection, and the relationship between operational parameters such as injection rate and pressure and the change in stress. Current methods of estimating the change in stress require choosing the type of constitutive model and the model parameters based on core, log, and geophysical data during the characterization phase, with little feedback from operational observations to validate or refine these choices. These characterization methods interrogate the geologic formations using length scales, loading rates or magnitudes that are quite different from those encountered by the actual storage system. It is shown that errors in the assumed constitutive response, even when informed by laboratory tests on core samples, are likely to be common, large, and underestimate the magnitude of stress change caused by injection. Recent advances in borehole-based strain instruments and borehole and surface-based tilt and displacement instruments have now enabled monitoring of the deformation of the storage system throughout its operational lifespan. This data can enable validation and refinement of the knowledge of the geomechanical properties and state of the system, but brings with it a challenge to transform the raw data into actionable knowledge. We demonstrate a method that uses automatic differentiation and a finite-element based geomechanical model perform a gradient-based deterministic inversion of geomechanical monitoring data. This approach allows autonomous integration of the instrument data without the need for time consuming manual interpretation and selection of updated model parameters. Furthermore, only isotropic linear elasticity is considered in this paper, the approach presented is very flexible as to what type of geomechanical constitutive response can be used. The approach is easily adaptable to nonlinear physics-based constitutive models to account for common rock behaviors such as creep and plasticity. The approach also enables training of machine learning-based constitutive models by allowing back propagation of errors through the finite element calculations. This enables strongly enforcing known physics, such as conservation of momentum and continuity, while allowing data-driven models to learn the truly unknown physics such as the constitutive or petrophysical responses.

Burghardt, Jeffrey A.↗
DOE OSTI2024

Quantitative Risk Assessment for Hydrogen-Powered Locomotive Refueling

Hydrogen powered locomotives are being explored to reduce emissions in rail applications. The risks of operations like refueling should be understood to ensure safe environments for workers and members of the public. Sensitivity analyses were conducted using HyRAM+ to identify major drivers of risk and compare effects of system parameters on individual risk. The consequences of jet fires from full-bore leaks dominated the risk, compared to explosions or smaller leaks. Pipe size, leak detection capability, and leak frequencies of system components greatly affected risk while overpressure modeling parameters and ambient conditions had little effect. The effects of personal protective equipment (PPE) materials on individual risk were quantified by reducing the individual’s exposure time or absorbed thermal dose. PPE only showed a risk reduction in low-risk cases. This study highlighted target areas for risk mitigation, including leak detection equipment and component maintenance, and indicated that the minimal effects of other parameters on risk may not justify prescriptive requirements for refueling operators.

08 HYDROGEN↗
DOE OSTI2024

SOSAT: Geohazard Risk Assessment in Carbon Sequestration Operations

Like all operations in which fluids are injected into the subsurface, geologic carbon storage (GCS) presents inherit risks that must be assessed and mitigated to successfully deploy such technology in the field. For example, alterations to pore pressure and the stress state due to fluid injection may trigger certain geohazards, such as potential fault activation and induced seismicity or unintentional hydraulic fracturing. Here we present capabilities for assessing these potential risks using the State of Stress Analysis Tool (SOSAT): a Python library and web-based application capable of probabilistically estimating the subsurface state of stress informed by various field observations. Using posterior distributions of principal stress components, SOSAT can assess the risk of fault activation within the injection formation for either a critically oriented fault or a fault with a user-prescribed orientation. Additionally, SOSAT can estimate the probability of unintentional hydraulic fracturing of the intact reservoir rock. Here, we demonstrate these SOSAT capabilities using a hypothetical GCS site. This type of risk assessment can assist with the effective deployment of GCS technology in the field by informing safe design and management practices.

Haagenson, Ryan J.↗
DOE OSTI2026

Hazard and risk analysis framework for nuclear power plant–based integrated energy systems

Employing integrated energy systems (IESs) with nuclear power plants (NPPs) can improve NPP utilization by leveraging dedicated thermal and electric power delivery, but it may also increase operational safety risks. This paper presents a framework to identify and quantify hazards and risks for such IESs. The framework combines accidentology to review past industrial accidents with failure modes and effects analysis (FMEA) to identify potential future incidents. Hydrogen explosion and toxic chemical release hazards are of particular concern. Explosion consequences are quantified using the Bauwens-Dorofeev (Bauwens) and trinitrotoluene equivalent mass (TNT-EM) methods, while chemical release consequences are computed using the Gaussian atmospheric dispersion method. Operational disturbances from direct electrical and thermal integration that may affect NPP safety are modeled using probabilistic risk analysis (PRA). Hazards and risks are then evaluated for regulatory compliance. The framework is applied to IESs comprising pressurized or boiling water reactors supplying three levels of thermal and electrical power to industrial customers. Case studies include high-temperature steam electrolysis hydrogen plants of varying capacities and a synthetic fuel production plant. Sensitivity analysis examines piping component failures in the PRA model as a precursor to cost estimation for thermal extraction line design. Additionally, Fussel-Vessely (FV) and risk increase importance (RII) measures identify risk-informed design improvements for the thermal extraction system. FMEA highlights hazards such as loss of offsite power, prompt loss of electrical load, loss of thermal output, and immediate steam diversion, in addition to hydrogen explosions and toxic chemical releases. Both Bauwens and TNT-EM methods suggest maintaining several hundred meters of separation between the NPP and hydrogen facility to mitigate explosion risks. PRA results show a maximum initiating event frequency increase of 1.15% and an overall risk increase of 0.28%. Importance measure analysis identifies upstream pipe leak isolation components as critical. Evaluating the results against safety regulations, it is concluded that hazards and risks can be managed to comply with regulations through risk-informed thermal and electrical connection designs, component selection, maintenance programs, and safe separation distances between NPPs and integrated industrial facilities.

08 - HYDROGEN↗
DOE OSTI2024

Connected and Learning Based Optimal Freight Management for Efficiency

The management of the future heterogenous fleet is a complex decision-making problem. The heterogenous fleet is emerging as decarbonization technologies are deployed by fleets toward lowering the freight operation emissions in Medium and Heavy-duty vehicles. Traditionally, in fleets characterized by a homogeneous Diesel Internal Combustion Engine (ICE) powertrain, the process of fleet planning and operational optimization unfolds sequentially without the necessity to account for powertrain and vehicle-specific characteristics during dispatch decisions. Fleets with trucks less than 5 years old tend to maintain stable vehicle efficiency with minimal operational reliability risks for fleet managers. However, the landscape changes with the incorporation of emerging powertrain technologies, which lack extensive operational data and service experiences. This includes technologies like hybrid, Electric, Fuel Cell, or alternative fuel ICE. Operational decisions for fleets featuring heterogeneous powertrain technologies and facing limited access to alternative fueling and charging stations become intricate, requiring careful consideration and optimization at each dispatch. The difference in efficiency characteristics of emerging technologies, their range limitations, and the restricted availability of charging/alternative fueling infrastructure, coupled with sensitivity to driving conditions (e.g., EV range reduction in low temperatures) and their impact on component aging (such as batteries), become pivotal factors influencing the reliable and efficient freight transportation. To make the path toward low emission freight transportation efficient and reliable, an AI-assisted fleet management software is developed in this project to help fleet managers in optimizing both adoption of emerging powertrain decarbonization, connected and automated technologies and also operating the fleet after such technologies are deployed as schematically. Freight transportation requirements are different depending on the cargos to be shipped, customer requirements and regions of operations. This further highlights the need for software and digital solutions to tailor deployment and operation of emerging powertrain, connectivity, and automation technologies toward the specific fleet operation requirements. The fleet management optimizer was also integrated with a model of the fleet to simulate the operation of the fleet over 1 year of the baseline fleet operation (250,000+ shipments) indicating the significance of day-to-day variations on emissions and energy consumption of a freight transportation fleet. The results demonstrate ≥20% improvement in freight efficiency in terms of WTW CO2 per ton-mile of cargo shipments while all fleet operation constraints are enforced, and the cost (CapEx and OpEx) is minimized.

33 ADVANCED PROPULSION SYSTEMS↗
DOE OSTI2025

Center of Excellence for Operational Technology

The Center of Excellence for Operational Technology Traditional Presentation Abstract 2025 National Laboratories Information Technology Summit | Denver, CO Traditional Presentation Session Managing cybersecurity risk in Operational Technology (OT) presents a significant challenge across the Department, and critically, at many of the national laboratories. This includes IT-OT convergence, aging OT systems, cost of updating OT systems, and increased Advanced Persistent Threat efforts against OT including the 16 critical infrastructure sectors as listed in Presidential Policy Directive 21. DoE’s Office of Science and NNSA’s Office of the Chief Information Officer are taking the lead in addressing this challenge to include critical systems, by establishing the Center of Excellence (CoE) for Operational Technology. Championed by NNSA Deputy Chief Information Officer Steven McAndrews and the Office of Science Chief Information Officer Shila Cooch, the CoE for OT was chartered in February 2025 to address the challenges of OT cybersecurity and compliance. The CoE for OT will create partnerships and leverage expertise from across the NNSA National Security Enterprise and DOE Labs, Plants and Sites. The CoE will also collaborate with colleagues in other government agencies, industry partners and academia. The CoE for OT discussion at the National Laboratories Information Technology Summit ’25 will include the genesis of the CoE, stated goals, organizational structure, and the effort to attract OT subject matter experts to join the CoE effort to share knowledge and expertise. The discussion will include opportunities to get involved and contribute to this important effort. This session will be led by CoE for OT Co-Chairs Matt Kwiatkowski, Fermi National Laboratory Chief Information Security Officer, and Steven Weldon, Savannah River National Laboratory Cyber Program Director at the Georgia Cyber Center. The session will be of particular interest to CIOs, CTOs, CISOs, as well as IT and OT practitioners.

Kwiatkowski, Matt [Fermilab]↗
DOE OSTI2023

Wildfire Risk Evaluation Framework for Grid Operations and Planning

The United States (US) environmental protection agency's (EPA's) climate change indicators for wildfires show a long-term trend of increased annual wildfire activity, larger wildfire size, and more variable dynamics in wildfire behavior. This has caused more frequent preemptive public safety power shutoff (PSPS) events in the regions with recognized high wildfire risk. These preemptive power shutoffs attempt to prevent the ignition of a wildfire but it nonetheless renders the transmission line non-operational, which often sheds load of downstream communities. As wildfires and PSPS events become more frequent, it is crucial to find the communities most at risk of load shedding. To that end, this paper proposes the wildfire risk evaluation of the system (WiRES) framework, which is a performance-based framework that translates extreme weather-related and PSPS event probabilities into a cumulative probability of a non-operational transmission line. This study also provides a geospatial visualization tool that breaks down the entire western electrical coordinating council (WECC) region into 50 km grid cells which can be used to 1) filter out transmission lines with higher than a threshold outage probability, and 2) graphically discover the affected regions and their biophysical and socioeconomic metrics. %such as the social vulnerability index, population density, gross domestic product, etc. Lastly, an impact assessment study is conducted which connects the results of the proposed framework to python and powerworld-based contingency analysis to highlight the applicability of the framework.

Wildfire, Resilience, Extreme Events, Grid Reslien↗
DOE OSTI2023

Design and requirements of a hydrogen component reliability database (HyCReD)

Hydrogen technologies are expected to play a key role in the decarbonization of several sectors including energy storage and transportation. Rigorous investigation and quantification of the risk and reliability issues associated with hydrogen technologies will be critical to ensuring both their wider adoption and safe, economical operations. Quantitative risk assessment (QRA) is an important tool that has been used to enable the safe deployment of many engineering systems, including hydrogen fueling stations and hydrogen storage systems. However, QRA studies require reliability data which is currently lacking for expanding applications of hydrogen systems. Here, to address this gap, we present a new structure for a hydrogen component reliability database (HyCReD) that can be used to generate reliability data to be used in QRA, reliability, safety studies, maintenance planning, and more. Building on our previous work examining four major hydrogen safety data collection tools (West et al., 2022) [1], our approach in this work was to consult scientific literature on reliability data collection as well as a number of existing reliability engineering databases in the oil & gas, chemical processing, and nuclear power plant sectors. The evaluation of these databases led to identifying best practices to be implemented in a data collection framework for a hydrogen component reliability database. Based on these best practices, a set of 24 requirements for the proposed database are presented, covering its characteristics and the types of data to be collected. We define the structure of the HyCReD database and 25 data elements to be collected, spanning system description, failure, shutdown, or near-miss events, and maintenance events. The data elements are then defined according to international standards used in the safety and reliability practice and potential choice lists are provided for each field. Since this database is being piloted for hydrogen fueling stations, a generic station component hierarchy developed by West (2021) [2] is used to standardize system data. Finally, we demonstrate populating the database with information extracted from five narrative reports on hydrogen fueling station incidents.

08 HYDROGEN↗
DOE OSTI2026

Demand response event simulator and risk-aware bidding tool for industrial customers

Incentive Based Demand Response (IBDR) program participation delivers financial benefits to the consumers and resiliency benefits to the electricity grid. Effectively participating in these programs as an industrial consumer requires bidding strategies that balance financial risk with operational constraints. Existing bidding tools tend not to fully incorporate stochastic IBDR event modeling, program specific baseline and payment/penalty calculations, or demand reduction process control schemes that account for the cascading impacts of shutdown in complex facilities. Here, this work presents an IBDR event simulator and risk-aware bidding framework tool integrating three key components: a flexible, parameterized demand response event generator that rigorously accounts for program structures and stochasticity, a demand response operational simulation model that generates explicit control strategies for load reduction, and a Monte Carlo simulator to evaluate financial risk for varied capacity bids. A case study at a wastewater treatment plant participating in PG&E's Capacity Bidding Program demonstrates the framework's utility. In the peak capacity price month of August, optimal bidding by the wastewater treatment plant nets a mean IBDR benefit of $101,000 (67% of the August electricity bill) with 0.4% probability of a financial loss. This framework enables industrial operators to make informed bidding decisions, negotiate better program terms with demand response load aggregators, and analyze energy flexibility investments at their facilities. Ultimately, this work reduces participation barriers in IBDR programs and supports the broader goal of enhancing grid reliability and renewable energy integration.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2025

First-of-a-Kind Risk-Informed Digital Twin for Operational Decision Making

A digital twin (DT) is a digital model or a collection of models of a physical entity. DTs in the nuclear arena can be used from plant design through decommissioning. Decisions are typically a priori or made offline. Risk-informed decision making is identifying what can go wrong, its frequency, and the consequences of its failure. Ideally risk-informed decision making reflects the current state of the plant and provides a decision in real time. Traditionally, probabilistic risk assessments (PRAs) evaluate the failures of safety systems, the risk of core damage, and the offsite dose as the consequence. However, this DT evaluates the decisions on the control side rather than the protection side. It uses the same risk methods to probabilistically inform the decision-making process but in a different way. Rather than evaluating the risk of core damage, this DT evaluates the likelihood of avoiding a trip set point while maintaining plant safety. Performance-based assessments are identified via its probabilistic evaluation of operational alternatives based on system status. Because the purpose of the control system is to maintain system variables within prescribed operating ranges, upsets or challenges that can exceed a trip set point resulting in a plant transient and a challenge to plant mitigating systems based on actual plant conditions, are evaluated to safely maintain the plant within the operating ranges. The probabilistic portion of the model is autonomously and automatically adjusted, and the metric of interest (i.e. likelihood of avoiding a trip set point) is recalculated. The digital representation of the physical system (i.e. the DT) performs a deterministic performance–based assessment of the probabilistically identified alternatives identified to validate the probabilistic assessment. A decision-making algorithm selects the appropriate option based on the probabilistic and deterministic assessments and transmits a control signal to a component(s) to initiate a corrective action or informs an operator of its decision.

digital twin↗
DOE OSTI2024

Safety Basis Compliant Flexible Operations [Capstone Project]

Compliant nuclear operations must be weighed against the radiological risk to the worker, public, and the environment. This project set out to look at one facility at Los Alamos National Laboratory (LANL or the Laboratory) and compare the risk with the operational restrictions associated with the Technical Safety Requirements (TSRs). The hope was to identify controls that could be reduced or simplified while maintaining compliance with 10 CFR 830, Nuclear Safety Management. This would result in increasing facility operational flexibility and efficiency. Controls were identified to be simplified or eliminated based on risk. This identification was initially envisioned from the perspective of reanalysis of the accident and hazard analysis consequences. Additionally, it was envisioned that fire testing could show that the consequences of a fire are not as dramatic as analyzed. Specific facility controls were identified that cause operational inefficiencies. Based on data collection, two controls were identified for further evaluation. The first control was combustible loading within the waste storage buildings, and the second control is related to the seismic power cutoff switch. In evaluating the combustible loading control, the thought is that the fire suppression system (FSS) provides adequate protection and the combustible loading controls do not need elevation to a TSR control. The FSS, along with the Fire Protection Program, would provide protection to prevent a fire from impacting large amounts of stored waste material. The seismic switch was more of a challenge. When reviewing the facility operation, it was determined that the facility does not operate anywhere near the established material-at-risk (MAR – radioactive material) limits. By adjusting these limits, a reduced consequence could be achieved and hence, a significant risk reduction achieved. A new operating mode would be used to achieve this reduction. A reduced MAR limit was successfully used as a test case for snow removal during this project. This project expands on that trial case as related to combustible loading and the seismic power cutoff switch TSRs. This will increase the efficiency of operations with reduced TSR controls while reducing overall facility risk. This is a win-win situation for Triad National Security, LLC (Triad) and the U.S. Department of Energy (DOE). Due to schedule and budgetary constraints, not all envisioned work scope was accomplished. However, it is maintained in this report for future efforts.

61 RADIATION PROTECTION AND DOSIMETRY↗
DOE OSTI2025

Field Insights: Strengthening Digital Assurance Through On-Site Network Monitoring

The accelerating deployment of digital energy infrastructure, ranging from inverter-based resources (IBRs), battery energy storage systems (BESS), to advanced grid control platforms, has brought unprecedented visibility, flexibility, and efficiency to the electric grid. However, this digital transformation also introduces new cybersecurity challenges, particularly in the form of supply chain risks and operational blind spots at the grid edge. Over the past year, the Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response (CESER), through its Rapid Risk Assessment initiative, along with the Grid Deployment Office (GDO), through its Technical Assistance for Digital Assurance (TADA) initiative, have supported a series of on-site network engagements led by Idaho National Laboratory (INL). These engagements, conducted in partnership with asset owners across the country, have focused on identifying real-world vulnerabilities and misconfigurations in operational environments, many of which are not detectable through remote assessments or traditional compliance audits. The goal of this report is to distill key findings and lessons learned during network hunt engagements from INL’s fiscal year (FY) 2024 - 2025. It is intended to help asset owners—regardless of their participation in the program—better understand the evolving threat landscape and adopt practical measures to secure their digital energy infrastructure.

24 - POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

Intelligent Process Visualization through Nuclear Operation Process Modeling, Reasoning, and Object Detection from Field Videos (Final Report)

This report is a deliverable for the “Final Report” task of DOE NEET Project 19-16790, "Context-Aware Safety Information Display for Nuclear Field Workers." This project's overall goal is to test the hypothesis that integrating computer vision and process reasoning methods will enable proactive visualization of the safe operation and maintenance processes of Nuclear Power Plants (NPP) for field workers. Augmented Reality (AR) glasses adopting such proactive safety information visualization techniques can significantly increase personnel safety and reduce the NPP’s operating costs. The current practice of monitoring NPPs requires workers to switch between digital models, data, and physical workspaces in identifying relevant but potentially occluded objects and in assessing the risks of operation and maintenance processes. On the other hand, frequently changed field conditions require field workers to report to supervisors for real-time guidance. Such guidance is essential to ensure that changing conditions will not invalidate or endanger the work order and other ongoing processes that may jeopardize NPP operations. Additionally, incorrect recognition of equipment objects can result in communication errors and safety problems. AR techniques can assist engineers in viewing the physical workspaces with objects labeled with detailed operation procedures and safety reminders during field operations. The project team developed an “Intelligent Context-Aware Safety Information Display” (ICAD) for supporting Nuclear Power Plant (NPP) field workers in achieving safe and efficient execution of a series of operational tasks in uncertain and changing workspaces of an NPP. Before designing the ICAD-AR prototype, the project team synthesized NPP operational knowledge models through literature review studies, surveys, interviews with domain experts, and knowledge modeling. The project team conducted an extensive study of the operational procedures of various NPPs, and digital technologies that can support the safe and efficient execution of those procedures in different NPP operational contexts. This literature review helped the project team conduct surveys and interviews with nuclear engineers and field workers to identify three categories of information. The NPP knowledge modeling efforts reveal that the three categories of information identified have different levels of importance in a typical procedure of carrying out a series of tasks to achieve a specific NPP operation goal (e.g., shutdown, mode changes). These three categories of information include 1) Workspace dynamics – the changing spatial arrangements of workspaces, tools, protection equipment, and supporting materials, 2) Workflow prognostics – the dynamic dependencies between different parts of an NPP that functionally support and influence each other in terms of safety and efficiency, and 3) Hazards – objects and spaces that contain hazardous materials or physical conditions that can pose risks to workers or mechanical systems. The project team has profiled the importance levels of these categories of information into a knowledge model. This knowledge model specifies what types of information are more critical for a given task in a given workspace so that computers can automatically identify critical objects and sensors in a scene for delivering context-ware safety information to field workers through AR devices. Significant research development of this project results in technical research outcomes and a prototyping system that illustrates the technical feasibility of establishing an ICAD-AR system supporting the proactive safety information display for nuclear field workers. This final report summarizes the project team’s technological achievements in the past three years. Overall, the project team completed the development and integration of five techniques into a prototype ICAD Augmented Reality (ICAD-AR) system and demonstrated the developed system’s real-time execution in a mechanical room. The project team completed the analysis of using this prototype in other types of workspaces based on 3D image data and digital design models collected from two additional workspaces (a water treatment plant and a flow loop training facility). The integrated techniques include 1) Natural Language Processing (NLP) algorithms supporting the generation and updates of nuclear fieldwork process models based on text analysis of work packages and operation manuals; 2) sensor log analysis for predicting control actions in given sensor reading contexts; 3) computer vision algorithms for automatic localization and navigation of workers; 4) object detection algorithms for identifying task-related objects and correlated sensors for safety checking; 5) AR technique as a platform for supporting the integration. The testing results of these five techniques have shown that 1) the sensor log analysis model can predict the next control action with an accuracy of 0.883; 2) the trained natural language processing model can extract more than 80% of the critical information from paper-based procedures (PBPs); 3) the navigation algorithm with the integration of Visual Inertial Odometry (VIO) and Non-Recursive Bayesian Filter methods make operator’s trajectory estimation resilient to drift error; 4) the computer vision algorithm can detect task-specific and safety-critical objects with an average accuracy of 95.3%. The project team used work procedures collected from a flow loop training facility and two datasets collected from two mechanical rooms simulating the workspaces of NPPs to demonstrate the technical capabilities of the developed ICAD-AR prototype. The demonstration validated the technical feasibility of establishing the ICAD-AR system for nuclear field workers and identified the challenges in 1) automatic text analysis of work packages; 2) use of limited samples of sensor logs for predicting the proper timings of control actions; 3) reliably tracking workers and their task progress in mechanical rooms with many similar objects.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2024

Unpinning the Lynchpin: Development of a system to introduce redundancy at Department of Energy laboratories

The United States Department of Energy (DOE) laboratory system employs over 78,000 people and had a budget of $8.1 billion for Fiscal Year 2023 (FY23). This diverse workforce includes employees at all levels from operational support staff to senior level management. Together, the labs take on incredibly complex and unique technical challenges in an attempt to address fundamental National and global needs. These technical challenges often require specialized training such that only a single person is truly capable of completing specific tasks. With the modern competitive environment, and an aging workforce, the risk of technical capability loss is highly probable with potentially severe impact. An online survey of Lawrence Livermore National Laboratories (LLNL) employees, a typical DOE lab, found that of responders with greater than 10 years of experience, 100% of respondents felt burnt out, 40% felt they were not paid fairly, and 50% believe that not enough is done by leadership to retain them as an employee. Couple that to an aging workforce, and the risk of losing institutional knowledge due to single point of failure, or lynchpin, is significant. There is a need for a system which reduces the risk of operational and technical losses due to lynchpin employees leaving the organization. A mitigation of this risk would lead to the successful transfer of knowledge from one generation to the next, improving the rate of development and minimizing general risk of mistakes.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2021

Development of a Nearly Autonomous Management and Control (NAMAC) System for Advanced Reactors (Final Report for ARPA-E Project)

The project formulates a technical basis for, and preliminary development of, a Nearly Autonomous Management and Control (NAMAC) system in advanced reactors. The system is intended to provide recommendations to operators during plant operation. The NAMAC system utilizes simulation-informed, data/knowledge-driven, AI-guided, plant-data-assimilated real-time operating procedures to effectively support the operator in risk-informed management of plant operations.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2025

Smart Contracts for Power Grid Applications Using the Advanced DLT Cyber Grid Guard Testbed

In this study is presented two power system applications with distributed ledger technology (DLT) and smart contracts (SC) that were assessed in a Cyber-Grid-Guard System (CGGS) advanced testbed, with protective relays, power meters, communication devices, DLT devices, synchronized time source, clock displays and real time simulator. This CGGS testbed was set in the Advanced Protection Lab, 252 lab space of the Grid Research Integration and Deployment Center (GRID- C), at Oak Ridge National Laboratory. In power grids, customer-owned distributed energy resources (DERs) are more frequent than in the past, and the numbers of points of interconnection (POI) with customer-owned DERs have increased. Disruptive operation from DERs presents a risk to grid operations, and protective relays located at the POI are used to isolate out-of-tolerance or poorly behaving of DERs. Ensuring the integrity of data from the relays at the POI, and DLT could enhance the security of the power grids. The first application is a SC to define and control the allowable total power factor (TPF) of the DER (wind farm) output, and the terms of the SC are implemented using DLT with a CGGS for a customer-owned DER. The TPF SC was implemented by the CGGS using DLT. The experimental model was performed with a real-time simulator using a CGGS and relay in-the-loop. The data collected from the CGGS were used to execute the TPF SC. The TPF limits were between +0.9 and +1.0, and the breakers’ operation in the POI was controlled by the relay using the SC. The events were collected from the real-time simulator, CGGS, and SEL 700GT relay to validate a successful application of the TPF SC using DLT. The second application is a SC to measure and control the allowable voltage service limits (VSL) by the CGGS using DLT. The tests were performed by using a real-time simulator, CGGS and relay in-the-loop. The data was collected from the CGGS that executed the SC. The main constraints were defined based on ANSI C84.1 service voltage limits, and the operation of the breakers in the POI. The events were collected from the CGGS, and SEL 700GT relay to assess a successful operation of the VSL SC using DLT.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

Evaluation of Joint Cyber/Safety Risk in Nuclear Power Systems

This report presents an analysis of the Emergency Core Cooling System (ECCS) for a generic Boiling Water Reactor (BWR)-4 NPP. The Electric Power Research Institute (EPRI) developed Hazards and Consequences Analysis for Digital Systems (HAZCADS) process is applied to the ECCS and its subsystems to identify unsafe control actions (UCAs) which act as possible cyber events of concern. The analysis is performed for two design basis events: Small-break Loss of Coolant Accident (SLOCA) and general transients (TRANS), such as unintended reactor trip. In previous work, HAZCADS UCAs were combined with other cyber-attack analysis to develop a risk-informed approach; however, this was for a single system. This report explores advanced systems engineering modeling approaches to model the interactions between digital assets across multiple systems which may be targeted by cyber adversaries. The complex and interdependent design of digital systems has the potential to introduce emergent cyber properties that are generally not covered by hazard analyses nor formal nuclear Probabilistic Risk Assessment (PRA). The R&D and supporting analysis presented here explores approaches to predict and manage how interdependent system properties effect risk. To show the potential impact of a successful cyber-attack to formal PRA event tree probabilities, HAZCADS analysis was also used. HAZCADS was also used to model the automatic depressurization system (ADS) automatic actuation. This analysis extended to an integrated system analysis for common-cause failure (CCF). In this aspect, the HAZCADS analysis continued by analyzing plant design details for system connectivity in support of critical plant functions. A dependency matrix was developed to depict the integrated functionality of the interconnected systems. Areas of potential CCF are indicated. Future work could include adversary attack development to show how CCF could be caused, resulting in PRA events. Across the multiple systems that comprise the ECCS, the analysis shows that the change in such probabilities was very different between systems. This indicates that some systems have a larger potential risk impact from successful cyber-attack or digital failure, which indicates a need for these systems to have a higher priority for design and defensive measures. Furthermore, we were able to establish that a risk analysis using any arbitrary threat model establishes an ordering of components with regard to cyber-risk. This ordering can be used to influence the overall system design with an eye to lowering risk, or as a way to understand real-time risk to operational systems based on a current threat landscape. Expert knowledge of both the analysis process and the system being analyzed is required to perform a HAZCADS analysis. The need for a tiered risk analysis is demonstrated by the results of this report.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗