SEARCH · Engineering Papers

Results for “Vulnerability Analysis”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 55 records · Page 3

All sources NASA NTRS DOE OSTI

DOE OSTI2026

Blueprint: Coordinated Vulnerability Disclosure (CVD) Adoption for Information Sharing and Analysis Center (ISAC)-Like Groups

The electric vehicle supply equipment (EVSE) industry is an incredibly diverse set of participants (EVSE manufacturers, charge network operators (CNOs), original equipment manufacturers (OEMs), etc.), and with the potential for an Information Sharing and Analysis Centers (ISAC) or ISAC-like group, it requires a series of guidance for doing a multiparty coordinated vulnerability disclosure (CVD) such that a group like this could be successful. This blueprint provides a template and guidance to stakeholders in the EVSE industry for conducting a multiparty CVD. It also formalizes what multiparty CVD could look like in an ISAC-like group with multiple entities as well as vulnerability coordinators by specifically calling out who in the ISAC-like group may be involved, and which industry members it may apply to. This blueprint leverages tools such as Vultron, VINCE, etc. along with open resources such as the Software Engineering Institutes guide for coordinated vulnerability disclosure, for the stakeholder in the EVSE industry to start up a CVD program of their own.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2024

Highly silanized cellulose biocomposites for sustainable insulation materials

Microfibrillated lignocellulose networks, derived from agricultural byproducts, represent an environmentally friendly biogenic material production due to their abundant availability to circular bioeconomy and inherent carbon sink in life cycle analysis. Yet, its vulnerability to moisture and flammability, coupled with challenges in creating highly reinforced insulation materials, poses challenges for the carbon-zero green building sector. Here we address these challenges with a new concept of in-situ grafting polymerization of nanoporous silica in pre-formed lignocellulosic fiber networks. The seamlessly integrating nanoporous silica with cellulose through hydrogen bonding networks enabled us to prepare highly reinforced biogenic composites for green building insulations. A high reinforcement biocomposite with hierarchal arrangements of nanoporous silica within the cellulose network exhibits remarkable attributes. It boasts a thermal conductivity of 24.2 mW·m –1 ·K –1 , a flexural modulus of 942 MPa, and soundproofing with a 20.8 % noise reduction, as well as the fire resistance characterized by an extended time to ignition and a reduced peak heat release rate of 144 kW·m –2 at 35 kW·m –2 of incident radiant heat flux. Furthermore, it demonstrates a reduced water absorption capacity, dropping from 5.12 g·g –1 to 0.75 g·g –1 . Altogether, this study opens the new pathways towards sustainable carbon-zero building materials in the context of circular bioeconomy.

36 MATERIALS SCIENCE↗

DOE OSTI2023

Gene-by-environment interactions influence the fitness cost of gene copy-number variation in yeast

Abstract Variation in gene copy number can alter gene expression and influence downstream phenotypes; thus copy-number variation provides a route for rapid evolution if the benefits outweigh the cost. We recently showed that genetic background significantly influences how yeast cells respond to gene overexpression, revealing that the fitness costs of copy-number variation can vary substantially with genetic background in a common-garden environment. But the interplay between copy-number variation tolerance and environment remains unexplored on a genomic scale. Here, we measured the tolerance to gene overexpression in four genetically distinct Saccharomyces cerevisiae strains grown under sodium chloride stress. Overexpressed genes that are commonly deleterious during sodium chloride stress recapitulated those commonly deleterious under standard conditions. However, sodium chloride stress uncovered novel differences in strain responses to gene overexpression. West African strain NCYC3290 and North American oak isolate YPS128 are more sensitive to sodium chloride stress than vineyard BC187 and laboratory strain BY4743. Consistently, NCYC3290 and YPS128 showed the greatest sensitivities to overexpression of specific genes. Although most genes were deleterious, hundreds were beneficial when overexpressed—remarkably, most of these effects were strain specific. Few beneficial genes were shared between the sodium chloride-sensitive isolates, implicating mechanistic differences behind their sodium chloride sensitivity. Transcriptomic analysis suggested underlying vulnerabilities and tolerances across strains, and pointed to natural copy-number variation of a sodium export pump that likely contributes to strain-specific responses to overexpression of other genes. Our results reveal extensive strain-by-environment interactions in the response to gene copy-number variation, raising important implications for the accessibility of copy-number variation-dependent evolutionary routes under times of stress.

60 APPLIED LIFE SCIENCES↗

DOE OSTI2024

Fail-Safe Logic Design Strategies Within Modern FPGA Architectures

Fail-safe computing refers to computing systems that revert to a non-operational safe state when a fault occurs. In this paper, we investigate a circuit level technique as mitigation for single event upsets (SEUs) and fault injection attacks on field programmable gate arrays (FPGAs), and analyze the effectiveness of the technique as a fail-safe monitor for an encryption algorithm. The propagation of fault effects through FPGA primitives including lookup tables (LUTs) and programmable interconnect points (PIPs) is assessed within an FPGA architecture created using an open source tool, and validated using fault injection experiments on an FPGA. The analysis reveals additional vulnerabilities exist within reconfigurable architectures over those in equivalent fail-safe application specific integrated circuit (ASIC), thus requiring a more elaborate network of redundant circuits and checking logic. The configuration memory bits (CMBs), which configure routing and designate logic functions within the LUTs of the FPGA, add complexity to fail-safe design strategies by introducing additional fault conditions and fault propagation paths. A resource-efficient fail-safe circuit design technique called DEsign for Fail-safe in reCONfigurable systems (DEFCON) is proposed. The benefits and limitations associated with DEFCON are described in the context of fault injection experiments carried out as simulations and in FPGA hardware.

Bhakta, Priya A. [Univ. of New Mexico, Albuquerque↗

DOE OSTI2025

Residential Building Stock Characterization in Palm Beach County, Florida

This building stock characterizations is intended to help Palm Beach County (PBC) Office of Resilience (OOR) and municipalities composing the Municipal Resilience Partnership prioritize building energy efficiency investments to reduce energy costs and increase resilience for the county's most vulnerable residents. The analysis utilizes NREL’s ResStock model to characterize PBC’s residential building stock, including building type, renter/owner status, size (square footage), age of buildings (vintage), HVAC system types, and, for multi-family buildings, number of units. Building energy efficiency, weatherization, and electrification upgrade packages were assessed for approximate cost, customer bill-savings, and emissions reductions potential and findings will help guide OOR financial assistance program design.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗

DOE OSTI2023

Decision Support Tool for Solar Energy Cybersecurity Policy and Regulation

The Decision Support Tool helps users address four discrete challenges: (1) complex requirements of relevant codes and standards, (2) technical complexity of solar assets, (3) undefined cyber risk severity, and (4) unclear roles and responsibilities. Content includes an analysis of cyber vulnerability risks, a decision support resource for policymakers to mitigate cyber risks to solar photovoltaic systems, and background resources for informing policy development. A key component of this tool is the Probable Risk Assessment (PRA), based on established, formal variables, models, and consequences, which helps users understand the determined risk and assigned ownership of the physical components. It helps states draw logical lines between vulnerabilities and mitigative solutions, of which some have been further detailed as Cybersecurity Advisory Team for State Solar (CATSS) tools.

14 SOLAR ENERGY↗

DOE OSTI2023

Assessing the vulnerability of solar inverters to EMPs: Port testing, PCI modeling, and protection strategies

Renewable energy sources are becoming an ever-larger contributor to the power grid. These renewable energy sources depend upon the power electronic devices, specifically inverters, being essential for connecting Photovoltaic (PV) generation to the grid. However, the Electromagnetic Pulses (EMPs) caused by the high-altitude nuclear explosions can generate fast broad-band pulses with nanosecond rise time, potentially causing damage or destruction to electronic components. To assess the vulnerability of PV inverters to high-altitude EMPs, the port testing and Pulsed Current Injection (PCI) modeling schemes are proposed based on the port impedance analysis. Wide-band frequency measurements are achieved by fusing impedance results from three vector network analyzers. Then, a PCI model is used to simulate the induced response to EMP, with two typical immunity levels of EC5 and EC8 tested. Here, the experiment successfully excites the induced voltage and current under EMP, where the voltage and current can reach 1500V/40A and 8000V/150Aunder EC5 andEC8, respectively. The port vulnerability analysis results demonstrate that only some ports can survive under EC5. To defend against the impact of EMP, three protection strategies are discussed.

42 ENGINEERING↗

DOE OSTI2026

Structural dynamics of the renewable energy economy: A longitudinal input-output insights for a resilient transition

As countries accelerate their energy transitions, understanding how renewable energy (RE) systems structurally integrate into national economies is essential. This study presents a longitudinal economic input-output (EIO) analysis of the renewable energy sector in South Korea from 2016 to 2022. We develop a novel EIO-based framework that disaggregates the RE sector both by energy source (thermal, hydro, nuclear and renewable) and by industrial function (manufacturing, generation, and services), allowing for a detailed assessment of production dynamics, value-added creation, and import dependency. By quantifying backward and forward linkages and induced economic effects, the analysis reveals persistent structural vulnerabilities in renewable manufacturing and increasing sectoral interdependencies. Results reveal that while the renewable energy sector's production and value-added shares have increased, critical segments remain highly import-dependent, particularly in equipment manufacturing. The analysis highlights systemic gaps in domestic supply chain resilience and offers sector-specific insights for reducing vulnerability and enhancing energy security. Although applied to South Korea as a case study, the proposed framework is designed to be transferable to other national contexts where renewable energy planning requires economic structural insights. The findings offer policy-relevant guidance for enhancing domestic energy resilience and aligning industrial strategy with long-term decarbonization goals.

Economic linkage↗

DOE OSTI2021

PLC-based Impedance Measurement and Current Injection Response Analysis

Studying and mitigating the vulnerabilities of Programmable Logic Controllers (PLCs) to electromagnetic pulse is important for the reliability of the power system. In this paper, an effective impedance measurement scheme is proposed to estimate the susceptibility of PLCs to an electromagnetic pulse. The equivalent non-uniform transmission line model is established to eliminate the impact of the fixture in the de-embedding process. Based on the measured impedance, the equivalent circuit is established to calculate the response of the device when subjected to the electromagnetic pulse. The voltage and current responses of different interfaces are compared utilizing the developed pulse Current Injection (CI) method. Finally, the impedance measurement scheme is verified through testing using three measuring instruments. And the CI simulation experiments reveal the characteristics and susceptibilities of different PLCs interfaces, indicating that some protection measures are required for the reliable operation of PLC.

Qiu, Wei↗

DOE OSTI2025

Establishing nationwide power system vulnerability index across US counties using interpretable machine learning

Power outages have become increasingly frequent, intense, and prolonged in the US due to climate change, aging electrical grids, and rising energy demand. However, largely due to the absence of granular spatiotemporal outage data, we lack data-driven evidence and analytics-based metrics to quantify power system vulnerability. This limitation has hindered the ability to effectively evaluate and address vulnerability to power outages in US communities. Here, in this work, we collected ∼179 million power outage records at 15-min intervals across 3022 US contiguous counties (96.15 % of the area) from 2014 to 2023. We developed a power system vulnerability assessment framework based on three dimensions (intensity, frequency, and duration) and applied interpretable machine learning models (XGBoost and SHAP) to compute Power System Vulnerability Index (PSVI) at the county level. Our analysis reveals a consistent increase in power system vulnerability across the US counties over the past decade. We identified 318 counties across 45 states as hotspots for high power system vulnerability, particularly in the West Coast (California and Washington), the East Coast (Florida and the Northeast area), the Great Lakes megalopolis (Chicago-Detroit metropolitan areas), and the Gulf of Mexico (Texas). Our heterogeneity analysis indicates that urban counties and those located along regional transmission boundaries tend to exhibit significantly higher vulnerability. Our results highlight the significance of the proposed PSVI for evaluating the vulnerability of communities to power outages. The findings underscore the widespread and pervasive impact of power outages across the country and offer crucial insights to support infrastructure operators, policymakers, and emergency managers in formulating policies and programs aimed at enhancing the resilience of the US power infrastructure.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2020

Q-Learning-Based Impact Assessment of Propagating Extreme Weather on Distribution Grids

The increasing number of power outage events due to extreme weather conditions is hampering us socioeconomically. Preparing in advance for the extreme weather event is critical. It can help utility operators to reduce grid damages, restore grid service quickly, allocate energy resources and repair crews strategically, and hence dramatically increase grid resilience. In this paper, we propose a method to identify the sequence of worst impact zones in the power grid caused by extreme weather events based on Q-learning (a reinforcement learning algorithm). To quantity the weather severity and its effect on the grid, we model the impact of extreme weather on the grid as a function of intensity, vulnerability, and exposure. A modified IEEE 123-node distribution feeder is presented in a mesh grid and experimented for sequences of zones identification. Finally, simulation results present the identified sequences and their associated impacts on the grid caused by extreme weather events.

distribution system↗

DOE OSTI2022

An Analysis of Grid Operator Survey Responses: Inexperience, Workload and Fatigue in the Control Room

Although a wide array of tools and technologies have been developed over the last decade to support power grid operators, deployment of these tools has been less successful. One reason for unsuccessful deployment may be an inadequate understanding of the factors that contribute to operator error in the control room. An analysis of operators’ current vulnerabilities may provide the baseline understanding needed to inform new technology integration. In an attempt to learn more about these vulnerabilities and their perceived impact on human error we collected and analyzed survey data from 20 electric grid control room operators. We asked survey respondents to consider the various operator, technology and interaction vulnerabilities that may arise during work in the control room and record their attitudes and experiences toward each. Results suggest operator inexperience, high mental workload and fatigue are the most common vulnerabilities experienced during a shift. Survey results were analyzed to explore these vulnerabilities in greater depth.

Inexperience, Workload, Fatigue↗

DOE OSTI2025

Hydrogen Transportation and Distributed Energy Systems Seismic Risk Assessment for Cascadia Subduction Zone Airport Facilities

08 HYDROGEN↗

DOE OSTI2025

Hydrogen Transportation and Distributed Energy Systems Seismic Risk Assessment for Cascadia Subduction Zone Airport Facilities

Portland International Airport in Oregon is exploring operating a fleet of 28 fuel cell electric buses to support airport operations and possibly provide backup power during outages. In this report, we evaluate the risk of hydrogen deployment at an airport considering the potential for seismic activity. We present a seismic risk assessment for pressurized piping for a generic hydrogen refueling station at the airport. Only pressurized piping was considered in the risk analysis because of its vulnerability and availability of fragility information unlike the other components. Seismic capacity of other components should be included as more information becomes available. To characterize the seismic hazard, we considered the initiating event frequency of a Cascadia Subduction Zone earthquake event based on data from the literature. Seismic stressors that translate to the site from an earthquake event are expressed as peak ground acceleration. Site disturbance is characterized as a function of soil conditions, represented by different shear wave velocity values, which affect how seismic waves propagate and impact structures. Pipe fragility curves as a function of seismic capacity were used to correlate ground acceleration and failure probability. These fragility characteristics were combined with site-specific soil conditions to calculate the probability of pipe rupture during a seismic event. It should be noted that multiple simultaneous failures due to an earthquake event as a common cause are not considered. Some epistemic uncertainties such as self-exciting shocks, aftershocks, and the time variant nature of the ground motion are not considered either.

08 HYDROGEN↗

DOE OSTI2026

Satellite-based Investigation of Power-Line Vegetation Encroachment in the US (SILVANUS)

Rapid wide-area assessments of vegetation encroachment on transmission and distribution line rights-of-way (ROW) is a highly desirable capability for understanding risks to the power grid during severe weather and wildfire events. Conventional assessments are time-consuming and expensive due to the need for in-situ inspections and the use of aerial assets. Performing conventional assessments on a wide area would require immense resources and time that might not be available within the horizon of an expected adverse event. Developing a capability to accurately assess vegetation encroachment into ROWs will enable faster analysis of potential grid vulnerabilities in NAERM. This project sought to develop a prototype capability for rapid ROW vegetation encroachment assessments by using Puerto Rico as a test case. Puerto Rico is a heavily forested island territory frequently impacted by tropical cyclones that threaten the electric grid by downing trees across transmission and distribution lines. Multispectral satellite imagery (MSI) enable very high resolution (i.e., 0.5 - 2 meter) assessment of vegetation conditions at scale and with revisit times appropriate for regular monitoring (e.g., weekly to quarterly, depending on cloud cover) of the entire island. Synthetic aperture radar (SAR) data from satellites was also investigated as solution to the cloud-cover issue as they are active sensors that emit and receive a microwave signal rather than relying on solar illumination, and are therefore unaffected by cloud cover and can collect data during day or night. Finally, MSI-derived digital surface models (DSMs) map the height of objects relative to sea level, and were assessed for their ability to estimate the height of forest canopies relative to coincident transmission lines. The results of the mapping investigation are described in this report.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2021

Q-Learning Based Impact Assessment of Propagating Extreme Weather on Distribution Grids: Preprint

Increasing number of power outage events due to extreme weather condition is hampering us socioeconomically. Preparing in advance for the extreme weather event is critical and can help utility operators to reduce grid damages, restore grid service quickly, allocate energy resources and repair crews strategically, and hence dramatically increase grid resilience. In this paper, we propose a method to identify the sequence of worst impact zones in the power grid caused by extreme weather events based on Q-learning (a reinforcement learning algorithm). To quantify weather severity and it’s effect on the grid, we model the impact of extreme weather on the grid as a function of intensity, vulnerability and exposure. A modified IEEE 123-node distribution feeder is presented in a mesh grid and experimented for sequences of zones identification. Finally, simulation results present the identified sequences and their associated impacts on the grid caused by the extreme weather events.

distribution system↗

DOE OSTI2023

ProvSec: Open Cybersecurity System Provenance Analysis Benchmark Dataset with Labels

System provenance forensic analysis has been studied by a large body of research work. This area needs fine granularity data such as system calls along with event fields to track the dependencies of events. While prior work on security datasets has been proposed, we found a useful dataset of realistic attacks and details that are needed for high-quality provenance tracking is lacking. We created a new dataset of eleven vulnerable cases for system forensic analysis. It includes the full details of system calls including syscall parameters. Realistic attack scenarios with real software vulnerabilities and exploits are used. For each case, we created two sets of benign and adversary scenarios which are manually labeled for supervised machine-learning analysis. In addition, we present an algorithm to improve the data quality in the system provenance forensic analysis. We demonstrate the details of the dataset events and dependency analysis of our dataset cases.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2024

Deciphering Discrepancies: A Comparative Analysis of Docker Image Security

As the use of microservices continues to grow and become a foundational approach to architecting software solutions, ensuring the security of microservices is paramount. Docker images have emerged as the predominant solution to containerize microservices–and thus, Docker images are becoming a large attack surface. Thus, reducing vulnerabilities in Docker images will reduce microservice cyberattacks. A common way to find vulnerabilities in Docker images employs static analysis tools like Trivy and Grype. However, these tools frequently generate disparate vulnerability reports when analyzing the same Docker image, thus causing uncertainty in tool selection. We collected 927 Docker images, analyzed them with Trivy and Grype, and compared the vulnerabilities reported in each image. Among the 865 images found to have vulnerabilities, Trivy and Grype disagreed on both the number of vulnerabilities and the vulnerability IDs found therein. Since both tools interface with external vulnerability databases, some discrepancies can be attributed to how the tools interface with these external resources. The external vulnerability databases partially overlap and frequently contradict one another, thereby creating challenges for static analysis tool developers and end users alike. This New Ideas and Emerging Results (NIER) study contains new and critical information that practitioners need for selecting and using static analysis tools–given that increases in the use of Docker technologies means increases in the size of the attack surfaces.

Boles, Brittany [Montana State University]↗