Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “identifiability”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 1,729 records · Page 96
All sourcesNASA NTRSDOE OSTI
DOE OSTI2020

Relevant Advanced Reactor Benchmarks for Nuclear Data Assessment

Advanced reactor concepts currently being developed throughout the industry are significantly different from light water reactor (LWR) designs with respect to geometry, materials, and operating conditions, and consequently, with respect to their reactor physics behavior. Given the limited operating experience with non-LWRs, the accurate simulation of reactor physics and the quantification of associated uncertainties are critical for ensuring that advanced reactor concepts operate within the appropriate safety margins. Nuclear data are a major source of input uncertainties in reactor physics analysis. As part of an ongoing project at Oak Ridge National Laboratory, the effects of nuclear data uncertainties on key figures of merit associated with advanced reactor safety are being assessed for selected advanced reactor technologies. Key nuclear data relevant for reactor safety analysis for each selected advanced reactor technology were identified in Phase 1, and their impact on important key figures of merit was assessed in Phase 2. This report describes the outcome of Phase 3. Available benchmarks and fuel irradiation data for use in evaluating the impact of uncertainties and gaps in nuclear data that impact reactivity control for advanced reactor designs through the fuel cycle were identified and assessed. Benchmarks were identified by searching (1) the Organisation for Economic Co-operation and Development (OECD)/Nuclear Energy Agency (NEA) International Criticality Safety Benchmark Evaluation Project (IRPhEP) handbook, (2) the OCED/NEA International Reactor Physics Experiment Evaluation Project (IRPhEP) handbook, (3) ongoing OECD/NEA benchmark activities, and (4) documentation in public literature. Relevant benchmarks were identified by selecting reactors with geometry, materials, and neutron energy spectra similar to those of selected advanced reactor technologies. This assessment identified six benchmarks, of which three are experimental and three are purely computational. One experimental and one computation benchmark contain depleted fuel; all others are limited to fresh fuel. This report provides short descriptions of the selected benchmarks along with the availability of measured data for comparison.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2022

Artificial Intelligence/Machine Learning Technologies for Advanced Reactors (Workshop Summary Report)

A workshop on artificial intelligence and machine learning (AI/ML) for advanced reactors (AR) was held October 5-6, 2021. The workshop was to be attended in-person at ANL but COVID restrictions forced the workshop to go virtual. The objectives of the workshop were to identify the most promising AI/ML opportunities for improving advanced reactor design, optimizing plant performance, and enhancing economic competitiveness and to develop an understanding of the scientific, engineering and licensing challenges facing their application. The workshop planning committee included GAIN, EPRI and NEI and members of three national laboratories (ANL, INL, and ORNL). The workshop was attended by more than 200 individuals representing academic and scientific institutions and the nuclear power industry. The definition put forth for an AI/ML system was one that perceives its environment and takes actions that maximize its chance of achieving its goals. In this report AI/ML refers to next generation algorithms that include deep learning, statistical analysis and data analytics and associated scientific computing and their potential application to the design, licensing, operation and maintenance of ARs. These methods typically incorporate models built from process data and may also include data generated by simulations that represent the behavior of a system. The workshop was organized in response to the growing interest in application of AI/ML for improving the economic competitiveness of nuclear energy. Increasingly more resources are being allocated to investigating the benefits of AI/ML methods. The DOE created the Artificial Intelligence & Technology Office to promote their development. And within the Office of Nuclear Energy, resources have been allocated to explore and understand the potential benefits of AI/ML. Additionally, the national laboratories are strategically positioned with DOE computing facilities such as Summit, Perlmutter, Aurora and Frontier that support large-scale simulations, hybrid HPC models with AI surrogates, and the exploration of new types of generative models emerging from multi-model data streams and sources. The workshop was organized with members of the AR community to understand the effort and to identify the level of interest and progress in this emerging technology. The workshop discussions focused on identifying opportunities for AI/ML across diverse areas of the nuclear industry and identifying current scientific and engineering challenges for advanced reactors that might be addressed through transformational uses of AI/ML. Discussion panels focused on four high-interest technical domains for advanced reactors: design, maintenance and operations, energy storage, and materials. The results of those discussions are summarized in this report. This includes opportunities that were identified for exploiting AI techniques and methods to improve the efficacy and efficiency of reactor analysis and to improve the operation and optimization of advanced reactors. Advanced reactor developers expressed an interest in learning more about AI/ML methods and their application. This included understanding whether ML methods can provide an advantage over existing nonlinear data regression methods for collapsing high-fidelity simulation results into faster running models. A consensus emerged that AR advances planned for the next decade will benefit from the use of AI/ML tools. The need exists to understand and model complex systems across length scales and modalities. AI/ML is a tool for discovery that can yield a set of engineering principles for use by nuclear engineers, licensing bodies, and operators to solve problems in plant design, safety analyses, autonomous operation, and predictive maintenance. While AI/ML represents a new set of tools, an awareness by the nuclear community of the full potential is still in the early stages so there is a need to increase awareness. It appears that the wide-spread adoption of AI/ML tools for ARs would be facilitated by future educational workshops that describe foundational methods and capabilities and describe successful applications.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2022

WISP: Watching grid Infrastructure Stealthily through Proxies (Final Technical Report)

The complex interdependencies of cyber systems (sensors and communications), physical grids and associated electricity market operations make protecting electric power grids a significant challenge. The energy sector is constantly under new, targeted, advanced and dangerous cyber-attacks that have the potential to result in the loss of human life. These threats are further exacerbated by our need to modernize the grid. One focus of cyber security research in smart grids is the securing of the SCADA system through advanced intrusion detection systems (IDS) and bad data detection algorithms in state estimation. These methods either require full knowledge of the system topology and parameters or fail to understand the physical behaviors under attack. WISP (Watching grid Infrastructure Stealthily through Proxies) is designed to provide additional protection to the power grid using only publicly available data. In particular, WISP exploits the spatio-temporal nature of the real time locational marginal prices (LMPs), in conjunction with other information such as bids, weather, outages and load data to analyze anomalous power pricing behaviors and then correlate those observations to localize regions of interest and identify potential cyber events. WISP is non-intrusive as the tool is deployed as a service in the Cloud or on premise and provides reliable information to system operators for enhanced situational awareness, without impeding energy delivery functions. The WISP technology comprises three modules: the data-driven anomaly detection core, the vulnerability and risk analysis and the root cause analysis. The data-driven anomaly detection core performs the tasks of feature selection, anomaly detection and attack region localization. The vulnerability and risk analysis module provides system level information of the vulnerable variables and times, assisting the operators in selecting monitoring and protection nodes. The root cause analysis module takes the detection results and identifies potential operational conditions that contribute to the detected anomalies. In Phase I, we have demonstrated the feasibility and effectiveness of WISP. We developed a realistic electricity market simulator capable of generating normal and attack market data under various operational conditions. We developed a series of cyber-attack detection and analysis algorithms and evaluated them under multiple data sources. Finally, we integrated all modules into an end-to-end software, providing functions for data management, data analytics and visualization. Specifically, we have achieved: (i) real-time data acceptance from external utility interfaces with >99% acceptance rate; (ii) high performance anomaly detection algorithms with >98% detection accuracy and <0.1% false alarm rate; and (iii) ultra-low computing delay <50 milliseconds. Additionally, our team developed algorithms to identify the vulnerable variables in electricity market operations and root cause analysis functions to identify major contributors to the price spikes. These ancillary modules are necessary when deploying WISP in real world industry environment. In Phase II, we have demonstrated the effectiveness of WISP software on realistic largescale power systems. We performed red team testing for the Phase I WISP software and identified software vulnerabilities and implemented corresponding mitigation solutions. We adapted the electricity market simulator for the Texas synthetic 2000-bus system and generated datasets for the false data injection attacks. We created database and visualization interfaces for the Texas system and the ISO New England system. We performed software optimization in terms of operation efficiency, computing speed and detection accuracy. Finally, we tested the software on the Texas system and the ISO New England system and evaluated the detection performance. Overall, we achieved above 89% detection rate, below 3% false alarm rate and below 37 seconds of end-to-end detection delay.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2024

Building a framework to genetically characterize “feather spots” and understand demographic impacts of solar energy sites on migratory bird populations

The lack of data on the impact of utility-scale solar facilities on avian species and populations adds to the cost of siting and operation. As much as 32 percent of the avian biological material (feathers and carcasses) recovered from solar facilities remain unidentified, because they often take the form of “feather spots”. Feather spots are remains of impacted animals that can be separated into two broad categories: 1) those remains that may be visually identified to a species, or 2) those that cannot be visually identified to a species due to degradation from the environment and/or scavenger activity (listed as “unknown”). Even when feather spots can be identified to species, they cannot be visually assigned to particular breeding populations. In some cases, it is unknown whether multiple feather spots represent single or multiple individuals. This project’s objectives were to: 1. Use a developed, genetic-based technique to identify and determine the species, population of origin, and number of individuals found in feather spots recovered from solar facilities. 2. Implement collected data and resulting analyses to develop a publicly accessible web-based decision-making tool that can be used by the solar industry, regulators and other stakeholders to inform siting, mitigation, and conservation management efforts. 3. Establish a not-for-profit fee-for-service center at UCLA to ensure collection and identification of feather spots continue after the project period of performance. During the Project Period, we proposed to establish a pipeline for collecting, transporting, and storing of avian biological material collected at solar facilities and the collection and identification of feather spots to species and individual. We proposed the development of a genetic-based framework that would recover viable DNA from feather spots, amplify this DNA (i.e., make millions of copies of the original DNA), and use it to match the resulting sequences to a national database of known species of birds. The result would be the identification of feathers spots that were previously unidentified, and the incorporation of these samples into a larger database that included all samples recovered from solar facilities. The resulting report (below) details the result of this work and its alignment with proposed activities. We proposed the use of the data collected to assess the comparative risk to specific species or populations of species from solar facilities. For some species, we have already identified genomic markers of specific breeding populations and developed “genoscapes,” maps of unique genetic variation across the full breeding range of a species. We used these (previously and newly developed) genoscapes to probabilistically link a feather spot to the specific breeding populations from which it originated (assignment probabilities range from 75%-100% depending on species and population groups). For those species without genoscapes, we developed a vulnerability and susceptibility estimate that determines the relative local and regional risk to populations that are in geographic proximity to solar facilities, using citizen science data (Breeding Bird Survey (BBS) and eBird). These two feather spot processing pipelines (see Figure 1 below) provide quantitative estimates as to the numbers of individuals from a given population of origin that are affected by solar facilities, and ultimately can reduce costs to the consumer by reducing the industry costs associated with mitigation and siting strategies for future solar energy development.

14 SOLAR ENERGY↗
DOE OSTI2024

Williston Basin CORE-CM Initiative Final Report

The University of North Dakota Energy & Environmental Research Center (EERC) is leading the Williston Basin Carbon Ore, Rare Earth, and Critical Minerals (CORE-CM) Initiative to drive the expansion and transformation of coal and coal-based resource usage within the Williston Basin to produce rare-earth elements (REEs), CMs, and nonfuel carbon-based products (CBPs). This project is the first phase in a long-term program and set the stage for future work by assessing resource, market, technology, and infrastructure knowledge; identifying knowledge gaps; developing a series of plans to be carried out in future work; and initiating stakeholder engagement. Composed of several tasks, the project sought to identify, characterize, and assess several necessary aspects vital to make this future work a reality. The project’s fundamental task was to characterize the Williston Basin CORE-CM resources. Over 2500 samples from multiple sources were utilized to begin the assessment. Several locations were identified in western North Dakota where sample analysis identified the total REE (TREE) concentration as being over 500 parts per million (ppm), which is at a concentration level that would be suitable to consider for mining and extraction. Current operating coal mines have sufficient concentrations of TREEs for consideration. However, the current data across the basin are still not adequate to fully characterize REE and CM content nor give reliable estimates of the total resource potential. Waste stream reuse was also considered, and several streams were identified which ranged from potential energy sources to chemicals to material wastes. This includes streams that result from oil and gas production. These streams are not fully characterized, and further data are needed before they can be accurately assessed. Infrastructure within the Williston Basin is suitable for expansion of a new industry to mine, extract, and concentrate REEs and CMs. The development of this industry will not only preserve many existing jobs in the coal-mining industry but produce many new jobs. The supply chain for REEs and CMs is currently controlled outside of the United States in nations such as China, but the potential to develop the supply chain within the basin is considered possible. Processing of the mined materials for REEs and CMs needs further research. The technology and knowhow exist outside of the United States, and within the country much of the knowledge has been lost and must be regained. To develop the supply chain and regain lost processing technology, the creation of technology innovation centers (TICs) is crucial. The Williston Basin contains several similar centers and entrepreneurial assistance for other industries that can be applied in the development of REE and CM innovation centers. Education to develop the new skill sets required is also needed. Outreach is important for the development of the REE and CM industry within the basin. Understanding throughout federal and state governments, state agencies, industry, and resource end users is vital for the industry to form and grow. Through this project these groups have been contacted through bulletins, presentations, webinars, and annual symposiums. The report is a summary of the work conducted and throughout refers to a series of appendixes which contain more thorough and specific information about each section.

01 COAL, LIGNITE, AND PEAT↗
DOE OSTI2024

Enhanced Resistance Pines for Improved Renewable Biofuel and Chemical Production (Technical Report)

We completed phenotyping constitutive and inducible oleoresin flow across two seasons, constitutive resin canal number and density and wood terpene content in our ADEPT2 and CCLONES populations. We completed genetic association between 19 oleoresin phenotypes and a total of 523,192 SNP markers from ADEPT2 and 13,883 SNP markers in CCLONES using four mixed linear models. A total of 293 significant SNPs (FDR = 0.20) were identified. We used the MENTOR tool to mine mechanistic connections from a multiplex network constructed from poplar multi-omic data to construct a conceptual model for a subset of these significant SNPs. Our model contains 6 transcriptional regulators in addition to 3 monoterpene synthases. To generate more lines of evidence for these significant SNPs, we completed a time course RNAseq experiment after inducing vascular zone cells to differentiate into new resin canals with a methyl jasmonate treatment, a single nuclei RNAseq that identified differentiating resin canal epithelial cells and are completing analysis for a QTL study in a hybrid pine population. The time course identified 4634 significantly down and 1890 significantly up regulated transcripts after treatment with methyl jasmonate, an inducer of new resin canal formation in the vascular cambial meristem. To analyze this large set of differentially regulated genes, we created a predictive expression network and analyzed it with random walk restart using 6 seed genes coding for transcription factors regulating xylem differentiation in poplar. Of the top ranked 200 transcripts, 119 transcripts were significant differentially expressed supporting these transcripts as potential candidates regulating resin canal formation. Analysis of single nuclei sequencing of shoot tips that contain differentiating resin canals, identified 10 clusters. One cluster was highly enriched in transcripts coding for 9 of the enzymes in the MEP pathway 3 prenyl synthetases, and 3 monoterpene synthases strongly suggesting that this cluster represents resin canal epithelial cells. We are mining the additional transcripts to create a trajectory analysis. In summary, we have identified > 10 novel genes that are strongly supported candidates for further analysis in breeding lines and for genetic engineering over- and under- expressing lines to increase wood terpene content to improve resistance to insect and fungal pathogens while simultaneously increasing terpene supplies for renewable chemicals and biofuels.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2024

Analyzing Risks of Virtual Private Network Connections

The use of Splunk for analyzing VPN logs is an effective approach for identifying vulnerabilities in network endpoints. Splunk, a powerful platform for searching, monitoring, and analyzing machine-generated data, enables organizations to aggregate VPN logs in real-time, providing insights into network activity, user behavior, and potential security risks. By indexing VPN traffic and authentication logs, security teams can track abnormal patterns such as multiple failed login attempts, unusual IP addresses, or unexpected changes in bandwidth usage, all of which could indicate potential vulnerabilities or breaches. With Splunk’s advanced search and reporting capabilities, users can create custom dashboards and alerts to detect suspicious activities. Automated searches can flag endpoints exhibiting unusual behavior, while correlation analysis can identify links between compromised devices and broader network vulnerabilities. In particular, Splunk's machine learning capabilities can be leveraged to predict and prevent threats by identifying trends that might otherwise be missed in traditional log analysis. This proactive approach to monitoring VPN logs allows for the early detection of security weaknesses, enabling rapid response and minimizing potential damage to network integrity. By enhancing endpoint visibility, Splunk plays a crucial role in securing remote connections and safeguarding sensitive information. Additionally, Splunk’s automation and alerting features allow teams to create custom workflows that notify them of vulnerable or misconfigured endpoints identified through Shodan. This synergy between Splunk’s log analysis and Shodan’s device intelligence enhances an organization’s ability to proactively identify and mitigate security risks, improving the overall resilience of their VPN infrastructure.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

An Architectural Survey of the U12G Tunnel Historic District, Nevada National Security Site, Nye County, Nevada

The U.S. Department of Energy (DOE), in conjunction with the National Nuclear Security Administration Nevada Field Office (NNSA/NFO), proposes to demolish six buildings and three storage areas located at the U12g Tunnel portal area in Area 12 of the Nevada National Security Site (NNSS). The buildings are 12-358 (Signal Vault); 12-201800 (Storage Quonset Hut); 12-202555 (Walker Shack); 12-868 (Pipe Assembly); 12-B100933 (Electrical Shop); 12-B100944 (Conference Room); and Storage Area 1; Storage Area 2; and Storage Area 3. The buildings and storage areas were selected for demolition as part of the DOE’s Real Property Efficiency Plan to reduce the footprint of unused and non-operational facilities on the NNSS. They are all vacant and have no proposed uses for current or upcoming NNSS missions. Demolition activities constitute an undertaking subject to review under Section 106 of the National Historic Preservation Act (NHPA) (54 United States Code [USC] § 306101) and its implementing regulations, 36 Code of Federal Regulations (CFR) Part 800. Identification efforts began with resources proposed for demolition in federal Fiscal Year (FY) 23. Four buildings were proposed to be demolished in FY23 (12-358, 12-868, 12-201800, and 12-202555). These buildings and the U12g Tunnel Historic District (SHPO No. D444) were recorded in Identification, Evaluation, and Finding of Adverse Effect for the Proposed Demolition of Five Buildings in Area 12, Nevada National Security Site, Nye County, Nevada (Menocal et al. 2023). Identification efforts indicated three buildings (12-358, 12-201800, and 12-868) supported nuclear testing in the U12g Tunnel. The fourth building post-dated the use of U12g Tunnel for nuclear testing activities. The report recommended that three of the four buildings (12-358, 12-201800, 12-868) and the U12g Tunnel Historic District may be eligible for the National Register of Historic Places (NRHP). The report also found that the undertaking would have an adverse effect on the three buildings and on the historic district. The Nevada State Historic Preservation Office (SHPO) concurred with the report’s findings (Reed 2023). The U12g Tunnel was determined eligible as a historic district under the Secretary of the Interior’s (SOI) Significance Criterion A, at the local level, in the context of the Cold War as an underground testing environment for the development of nuclear weapons and to assess the effects of a nuclear explosion on materials and equipment with a period of significance from 1959 to 1971. It was also determined eligible under Significance Criterion C for embodying the distinctive characters of a horizontal tunnel complex used for nuclear testing and as a significant and distinguishable entity. The three buildings were determined to be contributing elements of the district. The undertaking was expanded with the addition of two buildings and three storage areas proposed to be demolished and located within U12g Tunnel Historic District in FY24. These five resources (12-B100933, 12-B100944, and Storage Areas 1, 2, and 3) were recorded in Supplemental Identification, Evaluation, and Finding of Effect for Additional Proposed Demolition at U12g Tunnel, Area 12, Nevada national Security Site, Nye County, Nevada (Brannan et al. 2024). Identification efforts indicated that the two buildings and Storage Area 1 supported nuclear testing in the U12g Tunnel. Storage Area 1 and Storage Area 2 post-dated the nuclear testing activities at U12g Tunnel and were not recommended as contributing elements to the district. The report also found that the undertaking would have an adverse effect on the newly identified buildings and one storage area and on the historic district. The SHPO concurred that the expanded undertaking would result in adverse effects to historic properties (Reed 2025). To resolve these adverse effects, NNSA/NFO, in consultation with the SHPO, is following standard mitigation as stipulated in the 2024 Programmatic Agreement DE-GM58-22NA25554 Among the U.S. Department of Energy and the Nevada State Historic Preservation Officer and the Advisory Council on Historic Preservation Concerning the Protection of Historic Properties on the Nevada National Security Site, Nye County, Nevada (hereafter referred to as the NNSS PA). The standard mitigation measures are outlined in Appendix D of the NNSS PA. As such, this architectural survey has been prepared in accordance with Appendix D of the NNSS PA and follows the report format outlined in Appendix F. It includes a historic context that describes the district’s origin, history, and support functions, its significance in the context of nuclear testing on the NNSS, and identifies contributing and non-contributing elements within the district. The report is accompanied by Architectural Resource Assessment (ARA) forms for individual resources and a Historic District Resource Assessment (HDRA) for the U12g Tunnel Historic District. In total, this architectural report identified 32 primary resources within the district boundary. Six of the primary resources were previously identified as contributing elements. An additional 17 resources are recommended as contributing elements to the district for a total of 23 contributing elements. The other nine resources identified are recommended as non-contributing elements to the district.

12-201800↗
DOE OSTI2025

Verification of the REBUS Software

Ongoing design activities at Argonne National Laboratory are requiring a thorough verification of the Argonne Reactor Computation codes be performed. REBUS is central to this system. The driver for this effort requires the Triangular-Z and hexagonal-Z core geometry options of REBUS to be verified. Previous work identified the REBUS features required to be verified to support current design activities, features of which are generally applicable to hexagonal-Z fast reactor designs. The scope of this verification effort includes verifying REBUS’s ability to correctly intepret the user input model, verifying that the features identified yield the intended results, and verifying the correctness of the REBUS output tables. The REBUS software verification relies heavily upon the accuracy of the embedded DIF3D software, the verification of which was completed and documented elsewhere. Given that DIF3D produces an accurate solution, the primary focus of the verification in the REBUS software is to ensure that it properly uses the DIF3D solution and that the depletion system (Bateman equations) are correctly implemented. This manuscript reiterates the verification tasks and displays results with respect to the features needed for current design activities. Analytic solutions of the Batemen equations are displayed and the results calculated with REBUS are displayed demonstrating the accuracy. Since coupled Bateman and neutron diffusion/transport solutions are extremely difficult to obtain, much of the focus is placed on how REBUS uses a given DIF3D solution assuming the accuracy of the DIF3D solution. The verification effort identified no issues that are debilitating or otherwise impactful to the design usage of REBUS, and thus REBUS version 11.0, release 3012 is considered verified. It is important to note that several outputs of REBUS are identified to be inaccurate, such as burnup in MWD/MT. Most of the relevant ones for VTR are generally accurate with 10-20% errors which is not impactful as all regular REBUS users are aware of this issue and know how to hand calculate the results. The REBUS manual further makes it clear that these values are consistent with the methodology being used by REBUS and thus the “errors” are more of an inconsistent definition with respect to what a user would expect given a definition in literature. Other issues that were identified included unclear documentation and software bugs all of which were inconsequential to the final results.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2025

Chemical Process Safety at TRISO-Based, Metal-Based, and Salt-Based Fuel Fabrication Facilities: Technical Assessment and Guidance Assessment

As part of efforts to prepare for potential and ongoing safety reviews for licensing of advanced non-light-water reactor fuel cycles, the U.S. Nuclear Regulatory Commission (NRC) tasked Pacific Northwest National Laboratory to prepare an assessment on the state of knowledge of potential chemical processes at fuel cycle facilities supporting the front end of these fuel cycles, and to assess the associated regulatory guidance. This report provides a technical assessment of chemical process safety considerations to support NRC licensing reviews of fabrication processes for tri-structural isotropic (TRISO) based, metallic-based, and salt-based fuels. The assessments involved collecting publicly available information on the fuel fabrication processes to (i) identify the operational process steps, characteristics and chemicals involved, (ii) identify the physical safety considerations and health safety considerations during licensing reviews of the various process steps, and (iii) collect information to support assessments of severity of accidents and potential mitigative measures to be implemented. The assessment provides a foundational basis on chemical process safety considerations for advanced fuel fabrication activities, although it is recognized that licensing reviews may necessitate design-specific considerations. The specific conditions under which chemical hazards emerge will require process-specific considerations, highlighting the importance of process-informed interpretation. The assessment also determined that exposure guidelines and limits to assess the consequences of acute exposures are limited for some chemicals, although alternative limits and supplementary information from databases or safety data sheets provide sufficient information to evaluate consequences of acute exposures. In addition, it was identified that metallic and salt fuel fabrication processes may involve beryllium, which is an exposure hazard. The regulatory framework for the licensing of advanced fuel cycle facilities, per 10 CFR Part 70 Domestic Licensing of Special Nuclear Material, is deemed robust and flexible to address the chemical safety considerations in this report. A review was conducted on various regulatory guidance and technical basis documents. This included reviewing NUREG-1520, Revision 2, Standard Review Plan for Fuel Cycle Facilities License Applications – Final Report and the process descriptions in Appendix A of NUREG/CR-6410, Nuclear Fuel Cycle Facility Accident Analysis Handbook, to address advanced fuel types. As new fuels will involve process-specific chemical uses, process-specific considerations are provided in this report. Additionally, it is noted that the U.S. Department of Energy protective action criteria database includes Temporary Emergency Exposure Limits (TEELs) for process-specific chemicals. This report provides technical information to support chemical safety assessments of new advanced fuel cycle facilities and identifies technical and safety information to support licensing reviews. No regulatory barriers were identified for the licensing of advanced fuel cycle facilities.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗
DOE OSTI2023

Precursor Analysis Report: Ryuk Ransomware Attack on Universal Health Services 2020

The Ryuk Ransomware Attack on Universal Health Services (UHS) 2020 Precursor Analysis Report leverages publicly available information about the 2020 UHS cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. UHS manages over 400 hospitals and is one of the largest healthcare providers in the United States with 3.5 million patients each year. On 27 September 2020, UHS suffered a widespread ransomware attack that resulted in a denial of service to critical internet-dependent healthcare systems including workstations, phones, and data centers. Employees resorted to filing patient details with pen and paper, while other facilities had to redirect ambulances and urgent patients to other facilities for adequate care. Adversaries carried out the attack with Ryuk, a ransomware that encrypts data and generates a RyukReadMe.txt ransom note with the ransom fee to decrypt the data, varying from 15 Bitcoin (BTC) to 50 BTC, equivalent to roughly $\$$353,892 to $\$$964,617. UHS did not pay the ransom and was able to recover data through backups, but still reported an impact of $\$$67 million dollars in recovery costs. On 29 October, one month after the attack, UHS made an official statement that their systems had been restored and they were resuming normal operations. Researchers and analysts identified 18 unique techniques (used in a sequence of 19 steps) utilized during the attack with a total of 185 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fourteen of the identified techniques used during the UHS cyber attack were precursors to the triggering event. Analysis identified 106 observables associated with these precursor techniques, 82 of which were assessed to have an increased likelihood of being perceived in the 30 days to two hours preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: JBS Foods Ransomware Attack 2021

The JBS Foods 2021 Ransomware Attack Precursor Analysis Report leverages publicly available information about the JBS ransomware cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. In late May 2021, one of the world’s largest meat producers, JBS Foods, announced they had fallen victim to a worldwide ransomware attack, later found to be REvil ransomware. In the United States alone, JBS Foods accounts for nearly 25% of beef and roughly 20% of pork production. Adversaries initially launched a Distributed Denial of Service (DDoS) attack on the company’s Information Technology (IT) networks in Australia, but the attack impacted operations in Brazil, Canada, and the United States, as well. The attack caused plant operations in all four countries to shut down for at least one day. All nine of the U.S. meatpacking plants temporarily shut down because of the attack. The adversaries initially demanded a $\$$22 million ransom for the company’s data, but later negotiated the ransom down to $\$$11 million even after JBS Foods restored most of their systems. JBS Foods eventually paid the $\$$11 Million for reassurance from the adversaries that none of their customers’ data would be compromised in the future. Despite its short duration, the attack still caused large stocks of meat to spoil. The incident also underscored how adversaries can simultaneously compromise and move laterally through global subsidiaries of an organization. Researchers and analysts identified 22 unique techniques (in a sequence of 21 steps) utilized during the attack with a total of 361 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Sixteen of the identified techniques used during the JBS Foods cyber attack were precursors to the triggering event. Analysis identified 308 observables associated with these precursor techniques, 163 of which were assessed to have an increased likelihood of being perceived in the 75 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003

The SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003 Precursor Analysis Report leverages publicly available information about Davis-Besse’s 2003 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. On 25 January 2003, the SQL Slammer worm infected more than 90% of vulnerable hosts and crashed the internet in 10 to 15 minutes, making it one of the fastest spreading worms in history. SQL Slammer is a fileless, memory-resident worm that remotely exploits a stack-based buffer overflow vulnerability on local hosts to intensively scan and rapidly self-propagate across the internet. The worm infected approximately 300,000 unpatched hosts running Microsoft Structured Query Language (SQL) Server 2000 or Microsoft Desktop Engine (MSDE) 2000 with SQL Server Resolution Service. The SQL Slammer worm indirectly infected FirstEnergy’s Davis-Besse nuclear power plant by first infecting a consultant’s company network server and then propagating through an external misconfigured connection into Davis-Besse’s site network. The infection caused major network congestion, slow performance, data overloads, and the inability of local hosts to communicate with each other, which eventually caused a loss of availability and a loss of view when the Safety Parameter Display System (SPDS) and Plant Process Computer (PPC) crashed. At the time of the infection, the plant was already offline, the digital monitoring systems had redundant analog backups, and the plant control and safety functions were not affected, so there were no concerns of a safety breach. However, this incident resulted in many lessons learned and spawned important discussions about cybersecurity’s role in nuclear safety and electric power reliability regulation, policy, and guidance. Researchers and analysts identified 10 unique techniques utilized during the attack with a total of 640 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Eight of the identified techniques used during Davis-Besse cyber attack were precursors to the triggering event. Analysis identified 596 observables associated with these precursor techniques, 428 of which were assessed to have an increased likelihood of being perceived in the 331 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: Industroyer2 and Wiper Malware Targeting Ukrainian Energy Provider 2022

The Industroyer2 and Wiper Malware Targeting Ukrainian Energy Provider 2022 Precursor Analysis Report leverages publicly available information about the Industroyer2 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. An adversary attempted to cause a blackout in Ukraine in April 2022 by using the Industroyer2 malware against a regional Ukrainian energy provider. The adversary targeted eight high-voltage electrical substations and utilized the malware in tandem with disk wipers for Windows, Linux, and Solaris operating systems in an attempt to make response and recovery efforts more difficult. The adversary reused a piece of the original Industroyer malware designed to open circuit breakers and de-energize target substations. The adversary gained initial access to the victim’s enterprise network through unknown means in February 2022 and was able to perform reconnaissance, pivot to the operations network, and reside in the system for at least 51 days. This gave the adversary a detailed understanding of the environment and allowed them to customize the Industroyer2 malware to the victim’s operations network. However, defenders detected and stopped the attack before the adversary could achieve their intended impact. Had the Industroyer2 attack been successful, it could have caused a blackout for more than two million people during the early stages of Russia’s invasion of Ukraine. Researchers and analysts identified 22 unique techniques (used in a sequence of 31 steps) utilized during the attack with a total of 297 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-three of the identified techniques used during the Industroyer2 cyber attack were precursors to the triggering event. Analysis identified 224 observables associated with these precursor techniques, 122 of which were assessed to have an increased likelihood of being perceived in the 51 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Industroyer Targeting Ukraine Electric Power Transport Utility (Ukrenergo) 2016

The Industroyer Targeting Ukraine Electric Power Transport Utility (Ukrenergo) 2016 Precursor Analysis Report leverages publicly available information about the December 2016 cyber attack against the Ukrainian Ukrenergo electric transmission utility and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. Industroyer is a modular malware framework designed to deploy several Industrial Control System (ICS) protocol-specific attack payloads to disrupt electricity distribution. Adversaries deployed Industroyer within the target network on a Microsoft Windows endpoint capable of directly manipulating or communicating with ICS. Industroyer abuses the functionality of a targeted ICS’s legitimate control system to achieve its intended impact. Adversaries likely first gained access to Ukrenergo enterprise networks in early 2016 after a successful spearphishing campaign against organizations in the electric power sector. Adversaries then began capturing credentials beginning on 1 December 2016. This allowed access to the ICS environment at the Pivnichna electric transmission substation outside Kyiv through a device dual-homed on the Information Technology (IT) and ICS networks. Adversaries conducted discovery, targeting, and access to this device using information and previously captured credentials from compromised enterprise IT machines. Finally, the adversaries deployed and launched the Industroyer malware just before midnight on 17 December. By midnight, Ukrenergo had lost control of a targeted substation, resulting in electric power outages for over an hour in the city of Kyiv and the Kyiv region. Researchers and analysts identified 31 unique techniques (used in a sequence of 33 steps) utilized during the attack with a total of 846 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-nine of the identified techniques used during the Industroyer cyber attack were precursors to the triggering event. Analysis identified 548 observables associated with these precursor techniques, 353 of which were assessed to have an increased likelihood of being perceived in the 300 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Conti Ransomware Attack on the Health Service Executive of Ireland 2021

The Conti Ransomware Attack on the Health Service Executive (HSE) of Ireland 2021 Precursor Analysis Report leverages publicly available information about the attack and catalogs anomalous observables for each technique employed by the adversary. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The HSE provides public healthcare corporate services and operational services throughout Ireland, with critical functions including the acute national ambulance service, acute hospital service, and community healthcare service. On 14 May 2021, Conti ransomware encrypted 80 percent of the HSE’s Information Technology (IT) infrastructure across corporate, hospital, community, and electronic health record services. Conti is a ransomware-as-a-service operation that encrypts local files, uses double extortion against victims, and is facilitated by many intrusion tools. The attack forced the HSE to shut down its entire IT infrastructure to contain the ransomware, forcing employees to revert to pen and paper recordkeeping and leading to the cancellation of many appointments and procedures. The adversary also exfiltrated 700 GB of data, compromising the confidentiality of patients’ protected health information. Had the adversary targeted the COVID-19 cloud systems or operational technology assets, such as Internet of Medical Things medical devices or smart building management systems, the impact of the attack would almost certainly have been far more severe. Researchers and analysts identified 21 unique techniques (used in a sequence of 23 steps) likely utilized during the attack with a total of 1,185 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-one of the identified techniques used during the attack on the HSE were precursors to the triggering event. Analysis identified 1,086 observables associated with these precursor techniques, 850 of which were assessed to have an increased likelihood of being perceived in the 57 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Doppelpaymer Ransomware Attack on Petroleos Mexicanos (PEMEX) 2019

The DoppelPaymer Ransomware Attack on Petroleos Mexicanos (PEMEX) 2019 Precursor Analysis Report leverages publicly available information about the PEMEX cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The 2019 DoppelPaymer ransomware attack on PEMEX, Mexico’s nationalized petroleum corporation, highlights a unique threat that ransomware and cybercriminal extortion poses to Operational Technology (OT) environments in critical infrastructure. The incident began with an employee downloading commodity malware that allowed adversaries to gain initial access to PEMEX’s enterprise environment. After conducting privilege escalation, tool ingress, and data exfiltration, the adversaries deployed DoppelPaymer ransomware throughout the PEMEX enterprise environment, resulting in the company having to take dozens of systems offline for at least several days. Although PEMEX stated that their operations were not affected, the data exfiltrated from PEMEX was made available for download on DoppelPaymer’s leak site, as well as on other illicit criminal forums. This stolen data included not only company information, but also sensitive OT-specific configuration data. This incident showcases how cybercriminal exfiltration and posting of sensitive OT architecture documentation can pose security concerns for the targeted organization for years due to the long lifespan of OT assets and architectures. Researchers and analysts identified 18 unique techniques utilized during the attack with a total of 190 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fifteen of the identified techniques used during the DoppelPaymer ransomware attack were precursors to the triggering event. Analysis identified 163 observables associated with these precursor techniques, 34 of which were assessed to have an increased likelihood of being perceived in the 60 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Remote Access Attack on Oldsmar Water Treatment Facility 2021

The Remote Access Attack on Oldsmar Water Treatment Facility 2021 Precursor Analysis Report leverages publicly available information about the Oldsmar cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. On 5 February 2021, an adversary gained unauthorized remote access to Bruce T. Haddock Water Treatment Plant in Oldsmar, Florida, which provides treated water to 15,000 customers. The adversary accessed the facility’s Supervisory Control and Data Acquisition (SCADA) workstation and human machine interface (HMI) to change the chemical concentration of sodium hydroxide, commonly referred to as lye and used to regulate acidity levels, from 100 parts per million (PPM) to 11,100 PPM. The chemical was raised to lethal levels that if ingested could lead to serious soft tissue damage, burns, or even death. The facility, however, had redundancies and alarms in place to alert personnel of dangerous chemical levels, and facility officials stated it would have taken 24 to 36 hours for the chemical changes to affect the water supply. Researchers and analysts identified six unique techniques utilized during the attack with a total of 23 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Four of the identified techniques used during the Oldsmar cyber attack were precursors to the triggering event. Analysis identified 21 observables associated with these precursor techniques, 20 of which were assessed to have an increased likelihood of being perceived in the minutes preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗