Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “consequence”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 55 records · Page 3

Drinking Water Consequences Tools. A Literature Review

In support of the goals of Department of Homeland Security’s (DHS) National Protection and Programs Directorate and the Federal Emergency Management Agency, the DHS Office of Science and Technology is seeking to develop and/or modify consequence assessment tools to enable drinking water systems owner/operators to estimate the societal and economic consequences of drinking water disruption due to the threats and hazards. This work will expand the breadth of consequence estimation methods and tools using the best-available data describing water distribution infrastructure, owner/assetlevel economic losses, regional-scale economic activity, and health. In addition, this project will deploy the consequence methodology and capability within a Web-based platform. This report is intended to support DHS effort providing a review literature review of existing assessment tools of water and wastewater systems consequences to disruptions. The review includes tools that assess water systems resilience, vulnerability, and risk. This will help to understand gaps and limitations of these tools in order to plan for the development of the next-generation consequences tool for water and waste water systems disruption.

54 ENVIRONMENTAL SCIENCES↗

Low-Probability High-Consequence (LPHC) Failure Events in Geologic Carbon Sequestration Pipelines and Wells: Framework for LPHC Risk Assessment Incorporating Spatial Variability of Risk

If Carbon dioxide Capture and Storage (CCS) is to be effective in mitigating climate change, it will need to be carried out on a very large scale. This will involve many thousands of miles of dedicated high-pressure pipelines in order to transport many millions of tonnes of CO 2 annually, with the CO 2 delivered to many thousands of wells that will inject the CO 2 underground. The new CCS infrastructure could rival in size the current U.S. upstream natural gas pipeline and well infrastructure. This new infrastructure entails hazards for life, health, animals, the environment, and natural resources. Pipelines are known to rupture due to corrosion, from external forces such as impacts by vehicles or digging equipment, by defects in construction, or from the failure of valves and seals. Similarly, wells are vulnerable to catastrophic failure due to corrosion, cement degradation, or operational mistakes. While most accidents involving pipelines and wells will be minor, there is the inevitable possibility of accidents with very high consequences, especially to public health. The most important consequence of concern is CO 2 release to the environment in concentrations sufficient to cause death by asphyxiation to nearby populations. Such accidents are thought to be very unlikely, but of course they cannot be excluded, even if major engineering effort is devoted (as it will be) to keeping their probability low and their consequences minimized. This project has developed a methodology for analyzing the risks of these rare but high-consequence accidents, using a step-by-step probabilistic methodology. A key difference between risks for pipelines and wells is that the former are spatially distributed along the pipe whereas the latter are confined to the vicinity of the well. Otherwise, the methodology we develop for risk assessment of pipeline and well failures is similar and provides an analysis both of the annual probabilities of accident sequences of concern and of their consequences, and crucially the methodology provides insights into what measures might be taken to mitigate those accident sequences identified as of concern. Mitigating strategies could address reducing the likelihood of an accident sequence of concern, or reducing the consequences, or some combination. The methodology elucidates both local and integrated risks along the pipeline or at the well providing information useful to decision makers at various levels including local (e.g., property owners and town councils), regional (e.g., county and state representatives), and national levels (federal regulators and corporate proponents).

54 ENVIRONMENTAL SCIENCES↗

Chemical Consequence Analysis and Atmospheric Dispersion Coefficients under DOE-STD-3009-2014 Nuclear Safety Analysis

During preparation of non-reactor nuclear facility documented safety analyses (DSAs), chemical consequence analysis is an important contributor to correctly identifying and classifying nuclear safety controls. The Department of Energy (DOE) recently-issued DOE-STD-3009-2014, which increases the focus on chemical hazards within non-reactor nuclear facilities, and imposes additional requirements. Chemical consequence analysis can be significantly more complicated than radiological consequence analysis. Specifically, atmospheric dispersion factors used in chemical consequence analysis must consider several additional factors, such as the energy of the release, buoyancy, and initial chemical concentration. This paper describes the overall requirements of chemical consequence analysis under DOE-STD- 3009-2014, and provides specific guidance for determining an applicable atmospheric dispersion coefficient for use in chemical consequence analysis.

37 INORGANIC, ORGANIC, PHYSICAL, AND ANALYTICAL CH↗

Consequence analyses of sabotage-induced radiological releases in high-temperature helium-cooled prismatic microreactors

Here, this study analyzes the radiological dose consequences of sabotage-induced accidents at three high-temperature helium-cooled prismatic microreactors (HTPMs) with thermal power ratings of 1, 10, and 50 MWt. Each HTPM employs uranium oxycarbide tristructural isotropic fuel enriched to 19.75 wt% high-assay low-enriched uranium. Simulations were conducted to estimate reactor core inventory at the point of fuel discharge––when the effective multiplication factor reduced to less than 1––representing peak radionuclide inventory. Postulated sabotage scenarios leading to reactor shutdown were analyzed at two intervals: immediately post-shutdown (0 h) and 3 days after shutdown using the SCALE code for radionuclide inventories and the RASCAL tool for dose consequences. Results show that although HTPMs benefit from inherent safety features and robust fuel design, radiological consequences scale with reactor power because of increased source term inventories. Smaller microreactors exhibited proportionally lower dose consequences. To support the economic and regulatory feasibility of microreactor deployment, this study emphasizes the value of a risk-informed, performance-based approach, as supported by regulations like 10 CFR Parts 100 and 53 in the United States. Microreactor developers should perform site-specific assessments of potential sabotage or low-probability, high-consequence events, especially when considering minimal on-site or full off-site emergency response.

Consequence↗

Addressing Consequence within Operational Risk (O.T. Gagnon III) 9-18-2024

Addressing Consequence within Operational Risk: Why threats and security are just not that important! When dealing with cyber or physical risk within any critical infrastructure (CI) environment, don’t concern yourself with vulnerabilities and threats, at least not at first! Also, don’t be overly fixated on “securing the systems” within the organization. The endeavor of tackling operational risk focused on consequences in any critical infrastructure environment to include the complex Aviation ecosystem is challenging even for the most resourced entity but can be advanced though a simplified approach: identifying, binning, and prioritizing the infrastructure environment. While no two entities within a single element of the 16 critical infrastructure sectors are exactly alike when it comes to risk, there is a basic process to move toward a greater understanding of operational risk through becoming more informed about the infrastructure environment in which the entity exists. The process starts with bringing internal and external stakeholders and subject matter experts together to analyze key areas such as Information Technology (IT) and Operational Technology (OT) components and points of convergence, analyzing internal and external cyber and physical dependencies, accounting for explosive growth in devices and wireless technology, and leveraging the contributions of people inside and outside the operational environment. Attaining a common understanding of the infrastructure environment as part of addressing consequences within operational risk is not easy to do or resource light, but the process outlined provides the framework to further any entity’s efforts in this space. When it comes to cyber risks, before an organization can consider vulnerabilities within and threats to its operations, it must first have a solid understanding of the consequences existing inside its infrastructure environment. Idaho National Lab’s Consequence-Driven, Cyber-Informed Engineering is offered as an example of this approach to effective and efficient cyber risk mitigation.

99 GENERAL AND MISCELLANEOUS↗

Economic Consequence Analysis of Disasters: The ECAT Software Tool

This study develops a methodology for rapidly obtaining approximate estimates of the economic consequences from numerous natural, man-made and technological threats. This software tool is intended for use by various decision makers and analysts to obtain estimates rapidly. It is programmed in Excel and Visual Basic for Applications (VBA) to facilitate its use. This tool is called E-CAT (Economic Consequence Analysis Tool) and accounts for the cumulative direct and indirect impacts (including resilience and behavioral factors that significantly affect base estimates) on the U.S. economy. E-CAT is intended to be a major step toward advancing the current state of economic consequence analysis (ECA) and also contributing to and developing interest in further research into complex but rapid turnaround approaches. The essence of the methodology involves running numerous simulations in a computable general equilibrium (CGE) model for each threat, yielding synthetic data for the estimation of a single regression equation based on the identification of key explanatory variables (threat characteristics and background conditions). This transforms the results of a complex model, which is beyond the reach of most users, into a "reduced form" model that is readily comprehensible. Functionality has been built into E-CAT so that its users can switch various consequence categories on and off in order to create customized profiles of economic consequences of numerous risk events. E-CAT incorporates uncertainty on both the input and output side in the course of the analysis.

Environmental Economics↗

Criticality Consequence Analysis Roadmap for Spent Nuclear Fuel Canister in a Repository

This report discusses an initial criticality consequence analysis approach of commercial spent fuel canisters in a repository that will be developed to support a performance assessment (PA) of a repository with criticality events. A repository PA with criticality events may be needed to support direct disposal of currently loaded dual-purpose canisters. The ultimate goal is to develop a criticality consequence analysis model that can interface with any repository PA model. The criticality consequence analysis approach describes multi-physics coupling between neutronics, thermal hydraulics, and mechanics analysis codes. This report also discusses the sensitivity and uncertainty analysis approach for quantifying conservatism in the criticality consequence outcomes, as well as a defensible multi-physics validation approach to support any future licensing effort. This criticality consequence analysis approach will be refined in the future to support specific regulatory frameworks for a specific repository PA if needed.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

Radiological Consequences of Hydrogen Explosions in Vessels and Piping at the WTP

Hydrogen (along with other gases) is generated in process vessels and other components at the Hanford Waste Treatment and Immobilization Plant (WTP) due to the radiolysis of water and to the radiolysis and thermolysis of organics in WTP radioactive process wastes. In the absence of controls, the hydrogen may accumulate until a flammable or explosive concentration is reached. Once a buildup has occurred, ignition of the hydrogen causes an explosion that creates radioactive aerosols that could escape the confinement boundary and be released to the environment. Such a release could cause significant radiological exposures to a public receptor at the site boundary and to a co-located worker (CLW/) in the yard areas outside the physical facilities. Hydrogen explosion events therefore require evaluation as to the potential magnitude of their consequences. The WTP methodology for the evaluation of the potential radiological consequences due to hydrogen explosions in vessels and piping is a conservative approach that is defensible from a regulatory standpoint yet only results in the need for Safety controls for the most highly radioactive process vessels (generally those containing waste with significant quantities of solids). For WTP vessels with waste not containing significant quantities of solids, radiological dose consequences are sufficiently low such that neither Safety Class controls for the public receptor nor Safety Significant controls for the CLW are required. Similarly, the dose consequences for hydrogen explosions in piping and ancillary vessels are all very low to both receptors, again indicating that no Safety Class or Safety Significant controls are required. The WTP vessel and piping hydrogen explosion calculations are dependent on vessel and pipe sizes, hydrogen generation rates, operational requirements, and waste stream properties such as solids content, radioisotope concentration, and slurry density. Consequently, the WTP-specific results discussed above cannot be extrapolated directly to other facilities. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

Consequence-driven cyber-informed engineering (CCE)

The Idaho National Lab (INL) is leading a high-impact, national security-level initiative to reprioritize the way the nation looks at high-consequence risk within the industrial control systems (ICS) environment of the country’s most critical infrastructure and other national assets. The Consequence-driven Cyber-informed Engineering (CCE) effort provides both private and public organizations with the steps required to examine their own environments for high-impact events/risks; identify implementation of key devices and components that facilitate that risk; illuminate specific, plausible cyber attack paths to manipulate these devices; and develop concrete mitigations, protections, and tripwires to address the high-consequence risk. The ultimate goal of the CCE effort is to help organizations take the steps necessary to thwart cyber attacks from even top-tier, highly resourced adversaries that would result in a catastrophic physical effect. CCE participants are encouraged to work collaboratively with each other and with key U.S. Government (USG) contributors to establish a coalition, maximizing the positive effect of lessons-learned and further contributing to the protection of critical infrastructure and other national assets.

97 MATHEMATICS AND COMPUTING↗

Preventive Rad/Nuc Detection Equipment Categorization for Consequence Management

The overall objective of this project is to research, evaluate, and test first responder preventive radiological/nuclear detection equipment (PRND) to provide state and local agencies with guidance on how to best use this equipment for response after a radiological/nuclear release or detonation. While the equipment being tested in this effort has been specifically designed for detection and interdiction operations, the fleet of PRND equipment can help fill critical needs for radiological instrumentation should a consequence management response take place. This effort will provide scientific guidance on the best way to deploy and operate this class of equipment for consequence management missions. With the support of the US Department of Homeland Security’s (DHS) Domestic Nuclear Detection Office (DNDO), PRND equipment has been placed into service at federal, state, and local agencies throughout the nation. If the equipment capability and limitations are taken into account, this large inventory can be repurposed to support the emergency response in the aftermath of a radiological of nuclear event. This report evaluates PRND equipment to define key categories of equipment and the types of missions they can be used for. This is important because there are over 100 different types of PRND equipment, often with significantly different capabilities with respect to the consequence management mission. The current DNDO draft NIMS PRND equipment types were used as a foundation and expanded, when necessary, to address key characteristics important for the consequence mission. Table 1 provides a summary of the PRND instrument categories developed for this effort. Also included on the table are some common response mission detection equipment categories that will be used for capability comparisons.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗

Mission Analysis for Using Preventive Radiological/Nuclear Detection Equipment for Consequence Management

The overall objective of this project is to research, evaluate, and test first responder preventive radiological/nuclear detection (PRND) equipment to provide state and local agencies with scientific guidance on how to effectively use this equipment for response after a radiological/nuclear release or detonation. While the equipment being tested in this effort has been specifically designed by technology manufacturers and purchased by responders for preventive detection and source interdiction operations, the fleet of PRND equipment can help fill critical needs for radiological instrumentation should a consequence management (CM) response take place, as it is currently the most widely available and fielded radiological instrumentation by state and local agencies. This effort will provide scientific guidance on the most effective way to utilize this class of equipment for consequence management missions. Gaining a better understanding of how PRND equipment can operate and perform for these missions will allow for recommendations on the tactical approach responders can use for consequence management operations. PRND equipment has been placed into service by federal, state, and local agencies throughout the nation. If the equipment capability and limitations are taken into account, this large inventory can be leveraged to support the emergency response in the aftermath of a radiological or nuclear event. With several hundred makes and models of PRND equipment, often with significantly different detection capabilities that do not align with their nominal PRND equipment type, development of a streamlined categorization scheme with respect to consequence management missions was the first step to identifying safe and effective uses of PRND equipment for radiological/nuclear incident response.

61 RADIATION PROTECTION AND DOSIMETRY↗

Mission Analysis for using Preventive Rad/Nuc Detection Equipment for Consequence Management

The overall objective of this project is to research, evaluate, and test first responder preventive radiological/nuclear detection equipment (PRND) to provide state and local agencies with guidance on how to best use radiological search and interdiction systems and equipment for consequence management and response after a radiological/nuclear release or detonation. While the equipment being tested in this effort has been specifically designed by technology manufacturers and purchased by responders for preventive detection and source interdiction operations, the fleet of PRND equipment will help fill the needs for radiological instrumentation should a consequence management response take place, as it is currently the most widely available and fielded radiological instrumentation by state and local agencies. This effort will provide scientific guidance on the best way to deploy and operate this class of equipment for consequence management missions. Gaining a better understanding of how PRND equipment can operate and perform for these missions will allow for recommendations on the tactical approach responders can use for consequence management operations. With the support of the US Department of Homeland Security’s (DHS) Domestic Nuclear Detection Office (DNDO), PRND equipment has been placed into service at federal, state, and local agencies throughout the nation. If the equipment capability and limitations are taken into account, this large inventory and capability can be repurposed to support the emergency response in the aftermath of a radiological of nuclear event.

61 RADIATION PROTECTION AND DOSIMETRY↗

MACCS (MELCOR Accident Consequence Code System) User Guide

The MELCOR Accident Consequence Code System (MACCS) is used by Nuclear Regulatory Commission (NRC) and various national and international organizations for probabilistic consequence analysis of nuclear power accidents. This User Guide is intended to assist analysts in understanding the MACCS/WinMACCS model and to provide information regarding the code. This user guide version describes MACCS Version 3.10.0. Features that have been added to MACCS in subsequent versions are described in separate documentation. This User Guide provides a brief description of the model history, explains how to set up and execute a problem, and informs the user of the definition of various input parameters and any constraints placed on those parameters. This report is part of a series of reports documenting MACCS. Other reports include the MACCS Theory Manual, MACCS Verification Report, Technical Bases for Consequence Analyses Using MACCS, as well as documentation for preprocessor codes including SecPop, MelMACCS, and COMIDA2. PAPERWORK REDUCTION ACT STATEMENT The NUREG does not contain information collection requirements and, therefore, is not subject to the requirements of the Paperwork Reduction Act of 1995 (44 USC 3501, et seq.). PUBLIC PROTECTION NOTIFICATION The NRC may not conduct or sponsor, and a person is not required to respond to, a request for information or an information collection requirement unless the requesting document displays a currently valid OMB control number. ACKNOWLEDGEMENTS Contributions to this User Guide were received from NRC and Sandia National Laboratories (SNL) project managers, technical experts, and code authors dedicated to the production of a valuable resource for the MACCS user community. Instructions and guidance included herein were developed over many years and include advancements in the code that provide users the ability to develop complex consequence modeling scenarios. WinMACCS and many of the early MACCS developments were due to vision of an earlier Project Manager, Jocelyn Mitchell. Jonathan Barr and AJ Nosek also contributed to the development of this report. The current NRC Project Manager, Salman Haq, provided the leadership to ensure this document was completed. Several other NRC and Sandia staff provided insights supporting development of the MACCS code and of this document.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗

Comparative Assessment of Radiological Consequences from Sabotage-Induced Releases in Diverse Microreactor Designs

Many microreactor design developers are planning to reduce on-site physical protection measures and emergency planning zones by relying on robust fuel and reactor designs and leveraging passive safety systems. These reductions raise the risk of sabotage at these microreactors. To evaluate these requirements, this study assessed the radiological consequences of sabotage-induced accidents at microreactors. For the assessment, five diverse designs, each producing 30 MWt, were considered. These designs included pressurized water microreactors (PWMs), sodium-cooled fast microreactors (SFMs), high-temperature helium-cooled prismatic microreactors (HTPMs), heat pipe–cooled microreactors (HPMs), and molten salt–cooled microreactors (MSMs). For each design, two postulated sabotage-induced accidents were defined along with the associated release percentages of fission products. Additionally, consequences from the release of activation products were assessed. With regard to evaluating physical protection and emergency planning requirements, the consequences of sabotage-induced accidents for each design type were found to be comparable. The differences were primarily because of the distinct fuel forms (and associated release mechanisms), burnup, and neutron spectra of the different microreactor types. Future effort will further investigate the release percentages of fission products to perform accurate dose consequence assessment.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

Consequence-driven cyber-informed engineering and related systems and methods

Embodiments of the disclosure relate to a computer-implemented consequence-driven cyber-informed engineering tool for performing and reporting consequence-based prioritization, system-of-systems breakdown, consequence-based targeting, and mitigations and protections. Embodiments of a CCE tool may perform one or more steps of defining a target industrial control system (ICS), wherein the target ICS includes operational goals, critical functions, and critical services; determining one or more scored high consequence events (HCE) associated with the defined target ICS; prioritizing the scored HCEs according to an HCE severity index; and updating a dashboard with one or more representations of the prioritized HCEs, wherein the updated dashboard is associated with the CCE tool and presented at a display.

Assante, Michael↗

Glovebox Handling of High-Consequence Materials with Super Baxter and Gesture-Based Programming - 18598

The handling of high-consequence materials is a difficult task requiring safe object manipulation while avoiding the risk of contamination or spillage. Specific operations including opening containers, segregating the wastes, and repackaging are required to be safely executed inside contained spaces such as gloveboxes. However, the workers' ability and dexterity to manipulate objects through thick protective gloves are compromised in many aspects. The fixed position of the glovebox arm ports restricts the movements of the workers' arms, which also makes it hard to lift heavy objects. Further, the operational workspace inside the glovebox is restricted by the gloves' reachability. Safety of workers is the paramount concern in glovebox operations and the very reason for their existence. Sharp edges and tools increases the risk of glove punctures, which may expose the operator to chemicals and radiation and risks contamination in the vicinity outside the glovebox. The operators are also affected by ergonomic stressors due to prolonged and repetitive operations. To achieve a high degree of human safety, robotic solutions to handle high-consequence materials inside the glovebox are desirable, as they remove the operators from the hazards listed above. However, robots, in general, lack the degree of adaptability necessary for most high-consequence material handling tasks as these tasks are often unstructured or highly variable. Likewise, most human operators, while highly skilled in the tasks at hand (task expertise), lack the robot programming skills necessary to adapt the robot's motions to the variations (programming expertise). A way to bridge this divide is to make robot programming more intuitive to human operators. Since humans naturally teach one another through demonstration and learning, robotic 'programming by demonstration' paradigms have begun to appear to reduce the burden of robot reprogramming. Gesture-Based Programming attempts to achieve that by enabling a robot to observe the normal actions and affordances of a human performing a task to learn to map those onto the skills of the robot. In the end, this approach permits benefits from both the human and the robot: the human's adaptive decision making and the robot's resilience to high-consequence material. Robotic solutions assuringly provide protection for the operators, however their autonomy brings about other potential risks. Artificial Intelligence is not perfect; it is a black box, which can produce results, but the full extent of those results may not be known precisely. In self-driving cars, a hypothetical AI problem is the 'green man detector'. Since self-driving cars have presumably never seen a green man, how can we know it won't veer toward him the first time it sees a green man? Likewise, even though GbP provides an open method for safe task execution replicating a human, incorrect task inferences can lead to potential collisions or unintended operations. Thus, a hardware safety measure is proposed to provide reliable operation inside the glovebox, and true safe operations are achieved by mechanically limiting the operational range of each arm link. The operational range is computed and validated through exhaustive offline simulations, which can be streamlined by affordable computing power. Super Baxter is one such robot which incorporates these capabilities. It is a human-like, bimanual robot, being developed at the Collaborative Robotics Lab (CRL) in conjunction with the Dept. of Energy/Environmental Management, Rethink Robotics, Barrett Technology, and the NSF Center for Robots and Sensors for the Human Well-Being (RoSe-HUB). Super Baxter is envisioned to represent the next generation of collaborative robots that will be intrinsically human-safe, as well as exceptionally human-intuitive. In summary, Super Baxter will enable safe glovebox operations through low-shot Gesture based Programming incorporated with hardware safety measures. Two aspects of safety will be discussed in the paper. First, the safety of the operator achieved by allowing him to program Super Baxter remotely through Gesture based Programming. Second, the safety of the glovebox, achieved by incorporating hardware safety measures using joint limits. Further, the capability of Super Baxter on Gesture based Programming is demonstrated through typical object manipulation tasks in glovebox operations. (authors)

42 ENGINEERING↗

An Approach for Assessing Consequences of Potential Supply Chain and Insider Contributed Cyber Attacks on Nuclear Power Plants

The Stuxnet attack at the Natanz facility is an example of a targeted and successful cyber attack on a nuclear facility. Snowden's release of National Security Agency documents demonstrated the consequences of the insider threat. More recently, the United States tried to attack North Korea but failed, South Korea was attempting to attack North Korea, and both applied Stuxnet-like approaches. These sophisticated targeted attacks differ from web-site hacking events that are reported almost daily in the news mainly because targeted attacks require detailed design and operation information of the systems attacked and/or are often carried out by insiders. For instance, in order to minimize disruption of facilities around the world, Stuxnet remained idle until it recognized the specific configuration of the Natanz facility, demonstrating that the attackers possessed extremely detailed information about the facility. Such targeted cyber attacks could become a national-level military weapon and be used in coercion of hostile countries. While U.S. nuclear power plants (NPPs) are well designed and protected and not easily attacked through internet hacking, there have been a few digital-system-related incidents. For example, in 2003, the Slammer worm breached the private network of the Davis Besse plant and disabled a safety monitoring system for almost five hours. The breach did not pose a safety hazard because the plant was offline, but it demonstrates the vulnerability of NPP systems. The worm did not enter the plant systems directly; it began by entering the systems of a Davis Besse contractor, and entered through the T1 line bridging the contractor's computer and Davis Besse's corporate networks. The T1 line was not protected by the plant's firewall. The success of the Stuxnet-Natanz case demonstrates that supply-chain level attack (i.e., physically tampering with digital systems to install undetectable malware for the purpose of bringing harm to a player further down the supply chain network) plays a crucial role in a successful attack. Although attacking an NPP naturally requires more complex strategies and tactics than internet hacking, NPP's have a variety of sophisticated and possibly sensitive systems that may be attacked. Previous studies, for example, Baylon, have identified and confirmed that such attack strategies and tactics can be designed and could produce severe damage to an NPP. Current NPPs were designed according to design basis accidents that predate use of the internet by the general public and did not take into consideration potential cyber attacks that could be carried out by state-sponsored attackers and malicious insiders. To date, no detailed engineering analysis has been performed to realistically examine the consequences these attacks may have on the plants. In this paper, we discuss an approach for assessing the potential consequences of Stuxnet type of attacks. We will examine the engineering criteria used in designing the plants, develop possible attack scenarios in terms of the structures, components, and systems (SSCs) being controlled by digital systems at the NPPs, perform engineering analysis to determine if the attacks would impose conditions that are beyond design bases, and categorize the consequences of the potential accidents. (authors)

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

Applying understanding of likelihood and consequences to demonstrate post-closure criticality safety of a geological disposal facility - 14377

Radioactive Waste Management (RWM) is responsible for implementing geological disposal of the UK's higher activity wastes. These wastes include significant quantities of fissile nuclides and, therefore, demonstration of criticality safety under disposal conditions forms an important component of RWM's disposal system safety case. At the time of disposal, controls (e.g. fissile material limits and/or water barriers) will ensure that waste packages are sub-critical. These controls, plus the containment provided by the engineered barrier system of a geological disposal facility (GDF) will also ensure that criticality is prevented for a long time after disposal. However, over post-closure timescales conditions in the GDF will evolve, and therefore underpinning knowledge is required to demonstrate: under what conditions criticality could occur; what the likelihood of such conditions developing is; and what the consequences would be if a post-closure criticality did occur. These requirements are set out in the UK environment agencies' Guidance on Requirements for Authorisation of a GDF. This paper discusses the disposal of Pressurised Water Reactor fuel, as an example of a waste type that may require disposal. It briefly selects relevant research to combine and summarise results from three recent RWM research projects. The first 'Likelihood of Criticality' considered under what conditions post-closure criticality could occur, whilst a second 'Modelling of Consequences of Hypothetical Criticality' focused on understanding the local physical consequences (temperature rise, power and rock response) of hypothetical 'what-if' post-closure criticality. The paper then explains how this understanding is applied to make safety arguments as to why post-closure criticality is not a significant concern. This is achieved via a third, stream of work that has considered the effects of a potential criticality on pathways that might give rise to a post-closure risk in the future, such as transport of radionuclides in groundwater. Collectively RWMs post-closure criticality safety work allows us to conclude in our generic environmental safety case that a post closure criticality is a low likelihood event, and even if one of these low likelihood events was to occur its consequences would be insignificant to GDF performance. This paper also serves to give context to two companion UK post-closure criticality safety papers which communicate further information on our modelling development and more detailed results underpinning our demonstration of post-closure criticality safety. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗