Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Vulnerabilities”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 271 records · Page 15
All sourcesNASA NTRSDOE OSTI
DOE OSTI2022

Strengthening the Security of Operational Technology: Understanding Contemporary Bill of Materials

The evolution of cyber-physical infrastructure has made its security more challenging. The last few years have witnessed a convergence of hardware and software segments in various domains, including operational technology (OT) which is responsible for carrying out critical tasks such as monitoring and controlling power grids, nuclear plants, transportation, and emergency services. Both hardware and software encapsulate numerous open source and proprietary subcomponents, making it crucial for end-users to understand the composition of the products they are using. For example, wind turbines incorporate thousands of lines of code (software) used for the turbine's design, planning, operation, and analytics in addition to the numerous hardware subcomponents that construct it. Due to the highly complex nature of software and hardware, knowledge of the components and subcomponents is required to mitigate cyber vulnerabilities and defend against cyberattacks. There has also been a transformation from a traditional linear supply chain into a global, dynamic, diverse, and interconnected system. The digitization of the supply chain makes it easier to find and exploit vulnerabilities. Critical infrastructures (e.g., power grids, oil, natural gas, water, and wastewater) rely on OT to function, and if the OT is compromised, equipment damage and potential interruption of services could result. A significant security measure to protect OT systems from disruption is to develop a supply chain bill of materials (BoM) corresponding to the software and hardware used in OT, along with attestations amongst vendors and asset owners. A supply chain BoM is a proactive way to understand the inherent vulnerabilities in the system and mitigate them in advance of being exploited. BoMs bolster the trust placed in the digital infrastructure and enhance software supply chain security by sustaining the management of component obsolescence and compliance, along with the seclusion of unsafe segments of a specific product. Adopting BoM tools is becoming increasingly important across various government sectors, as evidenced by the recent U.S. executive order on cybersecurity (NIST 2021). This paper aims to classify BoMs based on structure, functionality, component type, and architecture. The work also discusses case studies to further highlight the benefits of BoMs. In addition, it identifies missing pieces in existing BoM implementations so that future research may identify bounds on where it could expect to make improvements and directly enable researchers to identify promising areas for exploration. Further, the authors provide valuable recommendations to tool developers, researchers, and standardizing organizations (policymakers), additionally benefitting critical infrastructure owners and government executives. This aids in paving a path for future work, thereby, providing suggestions to determine a tool for consumers that best suit their needs.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2020

Cybersecurity for Distance Relay Protection

This project is a DOE follow-up effort on the CREDC workshop held on September 13, 2018 in Cambridge, MA to discuss cybersecurity of distance relays, which considered the benefits, vulnerabilities and risk mitigations for the use of communication systems in power system protection. The objectives of this project are to define the taxonomy of relay protection and associated communications; define use cases describing approaches to reduce the cyber-attack surface on those protective relays; and evaluate the loss of operational functional capability from changes to communication coverage. Mitigating controls will also be evaluated to understand if there are other approaches to reduce attack surfaces while maintaining communications or partial communications. Distance relays are used to protect transmission lines of approximately 10 to 300 miles in length, by detecting short circuits (i.e., faults) on the lines and then tripping circuit breakers in the substation. Such protection systems are a subset of the power system and they incorporate sensing, logic and communication functions. Protection system exposure to cyberattack could be drastically limited by disconnecting relays from all vulnerable communication systems, but this may adversely impact overall power system performance in the absence of cyberattack. This project began with a use case analysis of protection systems with communications, as summarized in this report. It continued with modeling, testing and evaluation in a miniature power system (MPS), located in the Western Area Power Administration (WAPA) Electric Power Training Center (EPTC). The project also incorporated feedback from two industry meetings held in February and September 2019. The suggested next steps account for and complement the work already underway with DOE/CESER funding: 1. Study the performance of LCD and PC vs. PUTT, which is less reliant on communication system performance and GPS timing references. The PUTT scheme could prove to be more resilient to cyberattack or communications-related disruption. It could also be more tolerant of message re-routing with SDN/SDR communication systems. On the other hand, it will be more vulnerable to false tripping during dynamic events or to loss of the voltage signal. The optimum choice of scheme may depend on the specific power system and risk assessment. This study could provide a new template for evaluation based on business functions. 2. Research and develop new methods to detect and monitor distributed physical attacks, possibly using drones, video sensors, thermal sensors, machine learning and other advanced techniques. This will help mitigate the impact of cyberattack on the protection system, and will also help mitigate the impact of wild fires. 3. Implement a scalable PKI for use in electric utility protection systems. This will encourage widespread adoption of secure authentication methods that are already available, but not widely used at present. This will help secure engineering access to the relays. 4. Investigate the use of SDN in combination with SDR to achieve better cybersecurity and electromagnetic security of the network, incorporating path variability. This would help secure both engineering access and peer-to-peer GOOSE messaging. 5. Perform additional testing, with operator evaluation of “red button” scenarios, PUTT vs. LCD, relay mis-operations, and other cyberattacks in the EPTC. This is an important advantage of testing in the EPTC rather than by computer simulation or even hardware-in-the-loop simulation; the EPTC is already dedicated to managing the situational awareness, operator response times and other human impacts. One of the project objectives was to settle on a common nomenclature for this problem space. We have concluded that the OSI layer model, supplemented by ANSI device numbers and other IEEE standards, is already well-accepted by the industry. The IEEE PSRC knowledge base provides a great deal of public information

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2020

HEMP Testing of Substation Yard Circuit Breaker Control and Protective Relay Circuits

There are concerns about the effects of High-Altitude Electromagnetic Pulses (HEMP) on the electric power grid. Activities to date tested and analyzed vulnerability of digital protective relays (DPRs) used in power substations, but the effect of HEMP on the greater substation environment is not well known. This work establishes a method of testing the vulnerability of circuit breaker control and protective relay circuits to the radiated E1 pulse associated with HEMP based on coupling to the cables in a substation yard. Two DPRs from Schweitzer Engineering Laboratories, Inc. were independently tested. The test setup also included a typical cable in a substation yard with return plane to emulate the ground grid and other ground conductors near the yard cable, cabinetry housing the installed DPRs, station battery and battery charger, terminal block elements, and a breaker simulator to emulate a substation yard configuration. The DPRs were powered from the station battery and the transformer inputs energized with a three-phase source to maintain typical operating conditions during the tests. Vulnerability testing consisted of a conducted E1 pulse injected into the center of the yard cable of the DPR circuits. Current measurements on the yard cable and DPR inputs indicated significant attenuation of the conducted pulse arriving at the control house equipment from the emulated substation yard. This reduction was quantified with respect to the equivalent open-circuit voltage on the yard cable. No equipment damage or undesired operation occurred on the tested circuits for values below 180 kV, which is significantly higher than the anticipated coupling to a substation yard cable.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

Cybersecurity and Digital Components: Supply Chain Deep Dive Assessment

The report “America’s Strategy to Secure the Supply Chain for a Robust Clean Energy Transition” lays out the challenges and opportunities faced by the United States in the energy supply chain as well as the federal government plans to address these challenges and opportunities. It is accompanied by several issue-specific deep dive assessments, including this one, in response to Executive Order 14017 “America’s Supply Chains,” which directs the Secretary of Energy to submit a report on supply chains for the energy sector industrial base. The Executive Order is helping the federal government to build more secure and diverse U.S. supply chains, including energy supply chains. As the energy sector has become more globalized and increasingly complex, digitized, and even virtualized, its supply chain risk for digital components – the software, virtual platforms and services, and data – in energy systems has evolved and expanded. All digital components in U.S. energy sector systems are vulnerable and may be subject to cyber supply cha in risks stemming from a variety of threats, vulnerabilities, and impacts. This includes digital components in all systems within the ESIB, namely those systems operated by asset owners across different energy subsectors (e.g., electricity, oil and natural gas, and renewables) and the systems operated by a worldwide industrial complex with capabilities to perform research and development and design, produce, operate, and maintain energy sector systems, subsystems, components, or parts to meet U.S. energy requirements. Supply chain risks for digital components including software, virtual platforms and services, and data have grown in recent years as increasingly sophisticated cyber adversaries have targeted exploiting vulnerabilities in these digital assets. Supply chain risks for digital components in energy sector systems will continue to evolve and likely increase as these systems are increasingly interconnected, digitized, and remotely operated.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2022

Fragility Functions Resource Report: Documented Sources for Electricity and Water Resilience Valuation

Fragility curves provide the vulnerability between hazard intensity and an asset. Federal installations may include many different electricity and water infrastructure types (or assets) such as generators, wind turbines, solar PV, switch yards, substations and power lines as well as water distribution systems that could be affected by different hazards. The vulnerability of each asset is a function of its age, type of materials and maintenance. In addition, the vulnerability changes with the hazards intensity and has a probability distribution function associated with it. The fragility functions are used in conjunction with hazard probability and consequence valuations to determine the values at risk for examination of investment grade analyses of alternative mitigation strategies. This document provides examples of fragility functions and links to their sources for different electricity and water infrastructure assets by hazard type.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2024

EMP Testing of NAE Magnetic Motor Starters

Sandia National Laboratories (SNL) performed a high-altitude nuclear electromagnetic pulse (HEMP) critical generation station component vulnerability test campaign with a focus on high-frequency, conducted early-time (E1) HEMP for the Department of Energy (DOE) Office of Cybersecurity, Energy Security, and Emergency Response (CESER). This report provides vulnerability test results to investigate component response and/or damage thresholds to reasonable HEMP threat levels that will help to inform site vulnerability assessments, mitigation planning, and modeling calibrations. This work details testing of North American Electric (NAE) magnetic motor starters to determine the effects of conducted HEMP environments. Motor starters are the control elements that provide power to motors throughout a generating plant; a starter going offline would cause loss of power to critical pumps and compressors, which could lead to component damage or unplanned plant outages. Additionally, failed starters would be unable to support plant startup. Six industrial motor starters were tested: two 2 horsepower (HP) starters with breaker disconnects and typical protection equipment, two 20 HP starters with breaker disconnects, and two 20 HP starters with fused disconnects. Each starter was placed in a circuit with a generator and inductive motor matching the starter rating. The conducted EMP insult was injected on the power cables passing through the motor starter, with separate tests for the generator and motor sides of the starter.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2023

PathTrace and MPVEASI: A Path Analysis Comparative Validation Study

Developed in 2018, PathTrace is a software package built with the intention of making path analysis simple and intuitive. PathTrace is a top-down pathway analysis software where a user is able to explore vulnerable pathways into a facility. The intention of utilizing a software tool like PathTrace is to characterize an existing physical protection system (PPS) and to upgrade the system to achieve a high level of response interruption, or probability of interruption (P I ) of the adversary. There are four steps for conducting path analysis using PathTrace. The first step is to identify an image to use to build the model and scale the model within PathTrace using a section of known distance (wall or fence perimeter, for example). The scaling process will produce a grid of cells through which the user is able to build a model. The second step is to fill out the grid of cells with four categories of materials: Barriers, Detection Areas, Jumps, and Targets. These materials apply associated delay and detection values to the cells in which they are applied. The third step is to represent the adversary and response forces. The adversaries are represented by their capabilities in interacting with the materials identified in step two, and the response is represented by how quickly they will be able to respond to an adversary attack. Finally, the user is able to take all of the information from the previous three steps and perform a Most Vulnerable Path (MVP) analysis. In this stage, the user is able to visualize vulnerable adversary pathways and reason about how to upgrade these pathways to provide a high level of P I .

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

CAST Technical Bulletin #004: Network Time Protocol Introduction

Network Time Protocol (NTP), as it traditionally generated and widely consumed, is a legacy system with known security vulnerabilities. The vulnerabilities can be mitigated by modern implementations of NTP that use internal and external redundancy for better accuracy and fault tolerance. Precision Time Protocol (PTP) is an alternative that uses master clocks inside secure networks to eliminate the known vulnerabilities of NTP.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2024

Machine-Learning-Based Mapping and Modeling of Solar Energy with Ultra-High Spatiotemporal Granularity

Despite the rapid growth of solar energy, we still lack a dynamic, high-fidelity database that tracks the spatiotemporal variations of solar PVs and their associated infrastructures across different places at a spatially resolved scale. The absence of such data presents a barrier to various applications such as solar PV growth projection, solar energy integration, solar incentive design, and climate risk assessment. In this project, we aim to bridge this gap by developing AI-based algorithms to extract granular information about solar PV installations and their associated infrastructures (i.e., distribution grids) from widely available unstructured data like remote sensing images and street views. As a result, we have built the Solar Energy Atlas, a fine-grained, large-scale geospatial overlay of distributed solar PVs and distribution grids. On top of it, we have advanced the understanding of solar adoption and distribution grid vulnerability to climate-induced extremes. Our major contributions can be summarized as follow: (1) By developing new AI algorithms, we have built the most comprehensive solar PV spatiotemporal database covering the entire US. This is the first time we obtained the exact GPS locations, size, subtype, and installation year information for rooftop solar PVs across the US. This database can be used for solar PV growth projection, solar energy integration, solar energy policy analysis and design, and spatially-resolved climate risk assessment. (2) Leveraging this database, we have uncovered the socioeconomic driving factors that are correlated with earlier onset of solar adoption and higher saturated adoption levels. We have identified the heterogeneity in the effects of different types of financial incentives on solar adoption and provided implications for tailoring incentive design based on local income levels to promote equitable solar adoption. (3) We have developed a distribution grid GIS mapping algorithm which can obtain granular geospatial and topology information about distribution grids using multi-modal open data, reducing the dependency on hard-to-obtain smart meter data of conventional approaches. It shows effectiveness in both the U.S. and Sub-Saharan Africa. Using this algorithm, we have uncovered the non-uniform vulnerability of distribution grids to wildfires in California in the aspects of undergrounding protection and Distributed Energy Resources (DER) preparedness. This has provided important implications for improving the affordability and equity of grid adaptation approaches. (3) We have made our produced database publicly available and provided user-friendly interface to enable various stakeholders and the general public to interact with the data. We have also integrated the produced data into the Data Commons platform to enable the public to access the data and correlate it with other location-specific characteristics simply using natural language as queries. The impact of our project is three-fold: (1) New algorithms for mapping solar PVs and distribution grids across space and time, which are open source to facilitate researchers and industry; (2) New databases of solar PVs and distribution grids that have been made publicly available for engineering, social, and policy applications; (3) New understandings and actionable insights on the potential approaches to promoting solar adoption and reducing energy infrastructure vulnerabilities. In this report, we start by discussing the project background and motivation (section 5), followed by the overview of project objectives (section 6). Results and discussion for each task are presented in section 7. Significant accomplishments are summarized in section 8. This report will be concluded by discussing the paths forwards (section 9), products (section 10), and team roles (section 11).

14 SOLAR ENERGY↗
DOE OSTI2024

The Design and Evaluation of Zero Trust Architecture for Electric Vehicle Charging Infrastructure: EVs @ Scale Series on EV Charging Station Cybersecurity

Implementing a zero trust architecture can significantly bolster the security of electric vehicle (EV) charging infrastructure. EV charging infrastructure includes numerous networked interfaces, each of which can present potential vulnerabilities. When these vulnerabilities are exploited, they can compromise the entire system, leading to severe operational and security risks. Zero trust is a security model that operates on the principle of "never trust, always verify," which helps manage the attack surface and limit the scope of any potential compromises. Fundamentally, this model ensures that no entity, whether inside or outside the network, is trusted by default. The design principles of zero trust include continuous verification, strict deny-by-default access controls, and micro-segmentation. Continuous verification ensures that every request is thoroughly checked, regardless of its origin. Strict access controls enforce the principle of least privilege, allowing users and devices only the minimum necessary access to perform their functions. Micro-segmentation involves dividing the network into smaller, isolated segments to prevent lateral movement in case of a breach. In the context of EV charging infrastructure, zero trust can be implemented through various strategies. For example, multi-factor authentication (MFA) can be required for engineers to access the management interfaces and control systems of charging stations. Real-time monitoring and analysis of network traffic can help detect and respond to anomalies. Systems that do not need to communicate with each other can be micro-segmented to enhance security. All communications should adhere to predefined policies to be permitted. Additionally, encrypting communications can protect sensitive information exchanged between chargers and management systems. This paper presents a zero trust architecture specifically designed for EV charging infrastructure. Implementing zero trust not only mitigates risks but also builds a resilient infrastructure capable of withstanding and quickly recovering from cyber threats. The architecture addresses six defined security objectives. A comprehensive test plan is developed to assess the architecture against these objectives, and the results of the evaluation are reported. This approach is essential for maintaining the reliability and integrity of EV charging services in an increasingly interconnected and vulnerable digital landscape. This is the first in a planned series of papers exploring the implementation of zero trust in EV charging infrastructure. Each paper will delve into different aspects and applications of zero trust, highlighting how various work processes and requirements can lead to distinct architectural designs. These architectures will be tailored to address specific security challenges and operational needs within the EV charging ecosystem, ensuring a robust and adaptable security framework.

33 ADVANCED PROPULSION SYSTEMS↗
DOE OSTI2024

Retrieval Augmented Generation for Robust Cyber Defense

In cybersecurity, the ability to efficiently analyze and respond to vulnerabilities, weaknesses, attack patterns, and threat tactics is critical for effective defense strategies. With the increasing complexity and volume of cybersecurity data, traditional methods of querying and retrieving information are often inadequate. To address this challenge, we implemented Retrieval-Augmented Generation (RAG) systems—CyRAG and GraphCyRAG—that integrate large language models (LLMs) with both structured data from relational databases and knowledge graphs such as Neo4j. CyRAG is designed to handle structured data, focusing on CVE (Common Vulnerabilities and Exposures) and CWE (Common Weakness Enumeration) entities to generate accurate and context-rich responses. In contrast, GraphCyRAG leverages Neo4j knowledge graphs to retrieve interconnected information from CVE, CWE, CAPEC (Common Attack Pattern Enumeration and Classification), and ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) datasets. By utilizing Neo4j’s graph-based framework, GraphCyRAG enables deeper traversal of relationships between vulnerabilities and attack patterns, providing cybersecurity analysts with more comprehensive insights into potential attack vectors and mitigation strategies. Our preliminary results demonstrate that integrating knowledge graphs with RAG significantly enhances both the accuracy and depth of threat analysis, allowing for the retrieval of dynamic, real-time data and the generation of contextually aware responses. This approach helps analysts uncover hidden relationships between cyber entities, predict exploit paths, and prioritize mitigation efforts effectively. The integration of RAG with cybersecurity knowledge graphs represents a significant advancement in cybersecurity threat intelligence, enabling more informed decision-making and stronger defense strategies.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Strategic Plan: Decrease Critical Minerals Waste Through Enabling Advanced Manufacturing Techniques

In this report we developed a strategic outlook derived from previous findings by our Phase-2 Scorecard Report and the Critical Mineral Evaluation Report. In addition, Phase 2 Materials Scorecards have been developed in 2022 to provide a detailed justification and traceability for the adoption of additively manufactured structural materials and ceramics for nuclear deployment. The report provides a strategic vision to harvest the benefits of reduced material and energy demands by enhanced deployment of advanced manufacturing in nuclear technology. The objective of this report is to address the needs for imminent experimental/computational studies to optimize the deployment of advanced manufacturing for its energy-, cost-, and critical materials saving potentials. We display what further actions are needed to minimize supply risks of critical minerals and to lower the economic vulnerability when implementing the additional nuclear capacity projected by 2050, in support of the U.S. goal of net-zero carbon emission. The critical minerals essential for Gen-IV nuclear technology show either low disruption potential (supply risks) combined with high economic vulnerability, such as: copper, nickel, and chromium; or low supply risks combined with medium economic vulnerability, such as: manganese, molybdenum, tungsten, vanadium, tantalum, and zirconium. Enhancements in quality and yield of critical mineral recycling and the recovery of critical minerals from solid and industrial waste streams are needed to enhance supply security for stainless-steel production and to shift the time to scarcity for society to future years.

36 MATERIALS SCIENCE↗
DOE OSTI2025

The Future of X-ray Irradiation: Addressing Supply Chain Risks and Opportunities (UUR Edition)

This study supports the Office of Radiological Security’s (ORS) mission of eliminating cesium irradiators by analyzing the supply chain for self-shielded X-ray irradiators (SSXIs), identifying potential risks, and proposing mitigation measures. The research focuses on the primary components of SSXIs, including X-ray tubes, controllers, generators, and coolers or chillers, and evaluates their vulnerabilities using a comprehensive risk matrix framework. The methodology includes subject matter expert (SME) interviews with relevant manufacturers and major stakeholders, a deep literature review, and a meta-analysis of maintenance reports provided by SSXI end users. Results show that while the SSXI market is small, it’s growing, and the highly global nature of the supply chain may create vulnerabilities for critical SSXI components (X-ray tubes are the most vulnerable, followed by generators and controllers). This research communicates necessary information to address concerns of current and future end users, especially those interested in transitioning away from radioactive sources, and informs future policy aimed at supporting the irradiation industry.

07 ISOTOPE AND RADIATION SOURCES↗
DOE OSTI2025

Equity-Centered Engagement Through Climate Resilience Policy in Massachusetts

Communities who experience disproportionate climate change impacts tend to be excluded from resilience planning (Vale, 2014). Those efforts typically follow top-down processes within established governance practices that are inaccessible to marginalized folks and reinforce inequalities (Malloy & Ashcraft, 2020; Adger, 2003). Such participatory planning processes may offer the public little opportunity to influence the process itself or the outcomes (Smith & McDonough, 2001). They might ignore important public values or alternative ways of knowing which can be critical assets in resilience (Few et al., 2007). Designing communities for climate action and resilience means creating opportunities for everyone to meaningfully shape those decisions and experience related benefits. Having the opportunity to shape one’s community is necessary for human flourishing (Allen, 2016). Resilience planning that shifts power into communities and focuses on social vulnerability can affect how people survive and thrive in a climate changed world. The Massachusetts Municipal Vulnerability Preparedness (MVP) 2.0 program is an attempt to change the status quo in resilience planning by bringing new voices into decision-making power, recognizing their labor, addressing root causes of vulnerability, and investing in social infrastructure. It aspires to build capacity for equity-focused community engagement within teams of municipal staff and community liaisons, and ultimately build social capital and community cohesion. My mixed methods research investigates implementation of this state grant program in several western Massachusetts towns. I am using document review, participant observation, and interviews to understand the MVP 2.0 process as written, how different towns navigate it, and how individuals make sense of their experiences in it. I seek to understand how those experiences explain relationships between engagement approaches, mediating factors, and process outcomes. I am interested in the conditions that allow for community empowerment and how a model like MVP 2.0 can shift conditions that hold systems in place. In a practical sense, our findings will help municipalities reflect on their work during MVP 2.0 and plan for future community engagement. They may be informative for designing future iterations of the MVP program and for other municipalities, offices of community engagement, and practitioners. The findings will also contribute to the participation, resilience, and climate justice literatures, by adding perspectives on equity-centered resilience and community engagement approaches in smaller towns and rural settings. References: Adger, W. N. (2003). Social capital, collective action, and adaptation to climate change. Economic Geography, 79, 387-404. Allen, D. (2016). Toward a connected society. Our compelling interests: The value of diversity for democracy and a prosperous society, 71-105. Few, R., Brown, K., & Tompkins, E. L. (2007). Public participation and climate change adaptation: avoiding the illusion of inclusion. Climate Policy, 7(1), 46–59. Malloy, J. T., & Ashcraft, C. M. (2020). A framework for implementing socially just climate adaptation. Climatic Change, 160(1), 1–14. Smith, P. D., & McDonough, M. H. (2001). Beyond public participation: Fairness in natural resource decision making. Society & natural resources, 14(3), 239-249. Vale, L. J. (2014). The politics of resilient cities: whose resilience and whose city? Building Research & Information, 42(2), 191–201.

Callaham, Shannon↗
DOE OSTI2025

Equity-Centered Engagement Through Climate Resilience Policy in Massachusetts

Resilience efforts tend to reinforce injustices. Communities who experience disproportionate climate impacts are often excluded from resilience planning, and those plans do not typically address root causes of social vulnerability. More transformational approaches to resilience would shift decision-making power into communities and affect how people survive and thrive in a climate changing world. The Massachusetts Municipal Vulnerability Preparedness (MVP) 2.0 program is an attempt to change the status quo in resilience planning by bringing new voices into decision-making power, recognizing their labor, addressing root causes of vulnerability, and investing in social infrastructure. It aims to build capacity for equity-focused community engagement within teams of municipal staff and community liaisons, and ultimately build community cohesion. My mixed methods research investigates implementation of this state grant program in several Massachusetts towns. I am using document review, participant observation, and interviews to understand the MVP 2.0 process as written, how different municipalities navigate it, and how individuals make sense of their experiences in it. I seek to understand how those experiences explain relationships between engagement approaches, mediating factors, and process outcomes. I am interested in the conditions that allow for community empowerment and how a model like MVP 2.0 can shift conditions that hold systems in place. In a practical sense, my empirical results will help municipalities reflect on their work during MVP 2.0 and plan for future community engagement. They may be informative for designing future iterations of the MVP program and for other municipalities, offices of community engagement, and practitioners. The findings will also contribute to the participation, resilience, and climate justice literatures, by adding perspectives on equity-centered resilience and community engagement approaches in smaller towns and rural settings.

Callaham, Shannon↗
DOE OSTI2025

Equity-Centered Engagement Through Climate Resilience Policy in Massachusetts

Communities who experience disproportionate climate change impacts tend to be excluded from resilience planning. Those efforts typically follow top-down processes within established governance practices that are inaccessible to marginalized folks and reinforce inequalities. Regenerating the commons includes creating opportunities for everyone to meaningfully shape community resilience decisions and experience related benefits. Resilience planning that shifts power into communities and focuses on social vulnerability can affect how people survive and thrive in a climate changed world. The Massachusetts Municipal Vulnerability Preparedness (MVP) 2.0 program is an attempt to change the status quo in resilience planning by bringing new voices into decision-making power, recognizing their labor, addressing root causes of vulnerability, and investing in social infrastructure. It aspires to build capacity for equity-focused community engagement within teams of municipal staff and community liaisons, and ultimately build social capital and community cohesion. My research investigates implementation of this state grant program in several western Massachusetts towns. I am using document review, participant observation, and interviews to understand the MVP 2.0 process as written, how different towns navigate it, and how individuals make sense of their experiences in it. I seek to understand how those experiences explain relationships between engagement approaches, mediating factors, and process outcomes. I am interested in the conditions that allow for community empowerment and how a model like MVP 2.0 can shift conditions that hold systems in place. In a practical sense, our findings will help municipalities reflect on their work during MVP 2.0 and plan for future community engagement. They may be informative for designing future iterations of the MVP program and for other municipalities or offices of community engagement. The findings will also contribute to the participation, resilience, and climate justice literatures, by adding perspectives on equity-centered resilience and community engagement approaches in smaller towns and rural settings.

Callaham, Shannon↗
DOE OSTI2026

Leveraging ARM Data to Improve Models for Predictive Understanding of Energy and Security Challenges

Extreme weather and natural hazards can disrupt the energy sector, affecting demand, generation, transmission, distribution, consumption and operational planning at regional and national scales. These disruptions stem from a broad range of atmospheric phenomena, including winter storms, freezing rain, wet snow loading, severe convection, flooding and landslides, wildfires, prolonged heat, and drought. Many of these same phenomena can also affect national security through impacts to transportation and infrastructure. To support the U.S. Department of Energy (DOE) focus on energy resilience and national security, the Atmospheric Radiation Measurement (ARM) User Facility is uniquely positioned to contribute measurement data, analyses, and modeling frameworks that can significantly improve predictive understanding of these hazards to mitigate their effects. To explore this opportunity, ARM convened a two-part virtual workshop in November 2025. The workshop engaged interdisciplinary experts in atmospheric science, energy systems, modeling, and operations. The goal of the meeting was to engage with these interdisciplinary experts to address three questions: • What are examples of atmospheric processes that represent significant risks to energy security or national security and where are those risks greatest? • What measurements or measurement strategies would improve ARM’s capacity to address these issues? • How can ARM and users of the ARM facility better work with the Energy Exascale Earth System Model (E3SM) and multi-sector modeling communities to apply ARM data to improving E3SM simulations of these phenomena? Participants were asked to submit white papers ahead of the meeting to initiate thinking on these themes and to help organize discussions. Workshop sessions were then organized around themes identified in the white papers. First from the white papers and then through subsequent discussions, workshop participants identified many examples that address the three questions listed above. Participants called out energy system vulnerabilities to weather phenomena such as the impact of freezing rain, strong winds, and excessive heat on power grids. They also noted the effects that weather phenomena could have on energy demand or supply (e.g., through effects of extreme temperatures). They called out security vulnerabilities such as impacts to crops from aerosol-borne pathogens and risks to industry due to melting permafrost in the Arctic. In all, over a dozen meteorological phenomena were linked to energy or security vulnerabilities. For many of the identified phenomena, participants pointed out where ARM was well poised to address issues (e.g., through measurements of cloud microphysics to inform studies of freezing rain) but also noted needs for additional measurements or modified measurement strategies. For example, adaptive scanning of severe weather would be valuable for probing winter storms or severe convection. Participants pointed out the value in integrating external observations with ARM measurements and with applying artificial intelligence (AI) to ARM observation analysis and they advocated for using model simulations to help optimize measurement strategies through Observing System Simulation Experiments (OSSEs). It was clear from the workshop that there are many ways that ARM observations can be used to mitigate energy and security concerns, but meeting participants were also asked to identify what they considered to be the greatest opportunities by ranking issues pertaining to the three workshop questions. This was accomplished through a survey administered to participants between the two virtual sessions. The highest-priority phenomena identified were winter storms, severe convection, and arctic processes. Discussion in the second session, therefore, focused primarily on these three areas, which were most fully developed in exploring ARM opportunities. Nevertheless, it was also clear that ARM has opportunities to contribute to all the identified topics. This report describes the workshop, including input from discussion and white papers (Sections 2 and 3) and a list of priority recommendations (section 4). Many other ideas for ARM contributions are discussed in individual white papers (Appendix D).

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2025

Cyber-Informed Engineering (CIE) Workbook: End-of-Train (EoT) / Head-of-Train (HoT) Communications

This workbook presents a vulnerability (CVE-2025-1727 ) found in train applications and guides a digital risk assessment and mitigation analysis and application of Cyber-Informed Engineering principles to mitigate the potential consequences and ultimately the hazard through the engineering discipline because of exploiting this vulnerability. Workshop participants are encouraged to use the workbook to capture insights and lessons learned. The workbook guides the participant to: • Understand the HE communication vulnerability • Map digital threats to physical consequences • Use bowtie analysis to illustrate both “security” and “engineering” barriers • Apply CIE principles to ensure that even if communications are compromised, the physical engineered system still behaves safely. • Produce an actionable set of engineered and infosec controls for implementation

42 - ENGINEERING↗