Security / Resilience / Autonomous Systems

H-R06: Resilience and Recovery Architecture for Nuclear-Powered Data Centers

Report summary

Status: Research archive item
Category: Security / Resilience / Autonomous Systems
Length: 6,930 words
Reading time: 32 minutes
Report type: architecture

Key topics

Security / Resilience / Autonomous Systems
Security
Resilience
Autonomous Systems
AI
.NET
Runtime
Privacy
Physics

Research provenance

Archive status: Research archive item
Canonical report: https://mikekappel.com/reports/security-resilience-autonomous-systems/nuclear-data-center-resilience-architecture/
Content identity: sha256:ca9d97280ee76705ec8f01086522d8772d15d47cf472ce8de51e24770f9d0b6e

For citation, use the report title and canonical URL. Archival presence does not establish authorship or promote report statements into portfolio evidence.

This page renders the archived Markdown as safe, formatted HTML. It is background research and does not become a portfolio claim without evidence review.

Full report

On this page

1. Executive Decision Brief

The integration of small modular reactors (SMRs) and microreactors with hyperscale data centers represents a profound cyber-physical convergence, necessitating unprecedented resilience architectures. This paradigm shifts computational power from grid-dependent consumers to island-capable, co-located generation hubs (observed deployment or practice)1. Consequently, this architecture merges deterministic nuclear safety invariants with probabilistic, high-availability hyperscale network models, demanding a rigorous rethinking of defense-in-depth methodologies. Recent regulatory developments have fundamentally altered the deployment landscape for these integrated facilities. The Federal Energy Regulatory Commission (FERC) December 2025 order regarding the PJM Interconnection established interim non-firm and firm contract demand transmission services for co-located loads, affirming federal jurisdiction over behind-the-meter (BTM) generation interconnections (established standard or law)3. Concurrently, state-level initiatives, such as the repeal of the nuclear moratorium in Illinois for reactors under 300 MW through House Bill 2473, signal rapid regulatory enablement and a shift toward advanced nuclear baseload for computational demands (established standard or law)5. However, this convergence exposes novel vulnerabilities. The operational profiles of these facilities introduce risks such as abrupt hyperscale load rejections threatening reactor thermal-hydraulic stability, Baseboard Management Controller (BMC) compromises bypassing operating system controls, and time-synchronization attacks disrupting digital substations (reasoned inference)7. This report establishes a definitive resilience, security, and recovery architecture for joint nuclear-computational facilities. It enforces strict separation between deterministic reactor safety systems governed by IEEE 603 and IEEE 7-4.3.2 (established standard or law)10 and data-driven advisory functions. The architecture mandates hardware roots of trust such as Caliptra (technical proposal)11, optical data diodes for physical unidirectional isolation (observed deployment or practice)12, and clean-room recovery protocols driven by immutable cryptographic attestations.

2. Definitions and Architectural Boundaries

The boundaries of this analysis encompass the complete cyber-physical lifecycle of co-located nuclear generation and hyperscale computation. This includes the thermal-hydraulic interfaces, the intermediate digital substation governed by IEC 61850, the control planes of the data center, and the firmware supply chain.

Glossary Entries

ID	Term	Definition
GL-01	SMR	Small Modular Reactor; advanced nuclear reactor generating \<300 MWe per module.
GL-02	Microreactor	Factory-fabricated nuclear reactor typically generating \<20 MWe.
GL-03	Island Mode	Operation of a generation facility and load completely independent of the macro-grid.
GL-04	BTMG	Behind-The-Meter Generation; electrical power produced and consumed onsite without entering the public grid.
GL-05	Co-located Load	End-use electrical load physically connected directly to a generator's side of the grid interconnection.
GL-06	Load Rejection	Sudden reduction in electrical demand requiring immediate thermal mitigation like turbine bypass.
GL-07	Turbine Bypass	Piping system routing live steam directly to the condenser to manage rapid thermal transients.
GL-08	Dump Resistor	High-capacity electrical load bank used to dissipate excess energy during islanded transients.
GL-09	Caliptra	Open-source hardware Root of Trust for Measurement (RTM) and Root of Trust for Identity (RTI).
GL-10	OpenBMC	Open-source Linux distribution utilized for baseboard management controllers in hyperscale servers.
GL-11	SPDM	Security Protocol and Data Model utilized for hardware attestation and secure channel establishment.
GL-12	NC-SI	Network Controller Sideband Interface; enables out-of-band management communication bypassing the host OS.
GL-13	Data Diode	Hardware appliance ensuring absolute unidirectional data flow via optical fiber physical isolation.
GL-14	FPGA	Field-Programmable Gate Array; silicon utilized in deterministic safety systems and network acceleration.
GL-15	CCF	Common-Cause Failure; simultaneous failures of multiple redundant systems resulting from a shared root cause.
GL-16	Coping Analysis	Regulatory assessment of plant response to CCF to ensure adequate defense-in-depth and diversity capabilities.
GL-17	D3	Diversity and Defense-in-Depth; NRC regulatory strategy mandated to mitigate software and hardware CCFs.
GL-18	DI\&C-ISG-06	NRC Interim Staff Guidance defining the licensing review process for digital instrumentation and control.
GL-19	BTP 7-19	NRC Branch Technical Position guiding the evaluation of defense-in-depth and diversity for digital systems.
GL-20	IEEE 603	Standard design criteria for power, instrumentation, and control safety systems in nuclear power plants.
GL-21	IEEE 7-4.3.2	Standard criteria specifically governing programmable digital devices utilized in nuclear safety systems.
GL-22	10 CFR 73.54	US federal regulation mandating the protection of digital computer systems and networks in nuclear plants.
GL-23	RG 1.152	NRC regulatory guide establishing criteria for the secure development and operation of digital safety systems.
GL-24	IEC 61850	International standard defining communication networks and systems for power utility automation.
GL-25	GOOSE	Generic Object Oriented Substation Event; a multicast fast-messaging protocol utilized for protection tripping.
GL-26	SV	Sampled Values; a real-time protocol for transmitting digitized instantaneous electrical sensor data.
GL-27	IEC 62351	International standard specifying precise cybersecurity requirements for power system communications.
GL-28	HMAC	Hash-based Message Authentication Code; symmetric cryptography required for low-latency GOOSE/SV security.
GL-29	FPA Section 201	Federal Power Act section delineating FERC jurisdiction over interstate electric transmission and wholesale markets.
GL-30	HBOM	Hardware Bill of Materials; a standardized, cryptographic inventory of physical device components and silicon.
GL-31	SBOM	Software Bill of Materials; a standardized inventory of software packages, dependencies, and known vulnerabilities.
GL-32	RTRec	Root of Trust for Recovery; hardware mechanism designed to securely restore corrupted or malicious firmware.
GL-33	RTU	Root of Trust for Update; hardware mechanism designed to authenticate and apply legitimate firmware updates.
GL-34	Digital Twin	Virtual replica of a cyber-physical system utilizing real-time telemetry to simulate operational states.
GL-35	Invariant	A deterministic rule or physical limit that must never be violated by any automated or manual control logic.
GL-36	Microsegmentation	Network security technique partitioning workloads into isolated, zero-trust cryptographic zones.
GL-37	Clean-room Recovery	Restoring systems from immutable backups within a sterile, verifiable environment post-compromise.
GL-38	PTP	Precision Time Protocol; an IEEE 1588 network protocol providing sub-microsecond clock synchronization.
GL-39	FDI	False Data Injection; an adversarial attack modifying telemetry to trigger incorrect automated control actions.
GL-40	NUREG/CR-7006	NRC technical guidance document for reviewing and approving FPGA-based safety systems in nuclear facilities.

3. Historical and Technical Context

The aggressive pursuit of carbon-free, high-availability power by hyperscale cloud providers has catalyzed the integration of data centers with nuclear generation facilities. This trend was thrust into the regulatory spotlight when Talen Energy agreed to sell its Cumulus data center campus, situated adjacent to the 2,520-MWe Susquehanna nuclear plant, to Amazon Web Services (AWS) for $650 million (observed deployment or practice)14. PJM Interconnection subsequently filed an amended Interconnection Service Agreement (ISA) seeking to increase the permitted co-located load from 300 MW to 480 MW. In November 2024, FERC rejected this amended ISA on the grounds that it failed to resolve reliability concerns and potential cost-shifting onto public grid ratepayers, exposing the inadequacy of existing regulatory frameworks for hyperscale co-location (established standard or law)16. Recognizing the necessity for a structured approach, FERC issued a unanimous, landmark order in December 2025 regarding the PJM tariff. This order declared existing behind-the-meter generation netting rules unjust and unreasonable for large loads, but explicitly established pathways for co-location through the creation of Interim Non-Firm and Firm Contract Demand transmission services (established standard or law)3. Simultaneously, state legislatures recognized the economic imperative of advanced nuclear power. In Illinois, House Bill 2473 successfully repealed a 36-year moratorium on nuclear construction, establishing a regulatory pathway for SMRs with a nameplate capacity of under 300 MW and mandating the Illinois Emergency Management Agency and Office of Homeland Security (IEMA-OHS) to adopt specific rules by January 2026 (established standard or law)5. From a technical perspective, the architecture of both nuclear instrumentation and electrical distribution has transitioned from analog, electromechanical relays to highly digitized systems. The adoption of IEC 61850 digital substations using Generic Object Oriented Substation Event (GOOSE) and Sampled Values (SV) messaging requires strict real-time determinism, mandating execution latencies below 3-4 milliseconds (established standard or law)21. Historically, securing these protocols via IEC 62351-6 was problematic due to the computational overhead of RSA digital signatures, prompting a necessary transition to symmetric Hash-based Message Authentication Code (HMAC) mechanisms to preserve determinism (peer-reviewed research finding)23. At the silicon and firmware level, vulnerabilities in Baseboard Management Controllers (BMCs), specifically out-of-band Network Controller Sideband Interface (NC-SI) protocols, exposed entire fleets to hypervisor-bypass attacks (institutional analysis)8. In response, the Open Compute Project developed Caliptra, an open-source hardware root of trust standardizing Root of Trust for Measurement (RTM) and Identity (RTI) deep within the silicon to cryptographically anchor the data center supply chain (current official policy)11.

4. Current Standards, Law, Policy, and Deployed Practice

The regulatory matrix governing a nuclear-powered data center demands strict compliance across multiple, often overlapping, federal and international domains. The U.S. Nuclear Regulatory Commission (NRC) governs the radiological safety and cybersecurity of the generation asset. Regulation 10 CFR 73.54 mandates the absolute protection of Critical Digital Assets (CDAs) from cyber-attacks, supported by Regulatory Guide (RG) 1.152 and NEI 08-09, which dictate the implementation of secure development and operational environments (established standard or law)26. The independence of safety systems is legally bound by IEEE 603 and IEEE 7-4.3.2, ensuring that non-safety systems, including data center control planes, cannot compromise deterministic reactor functions (established standard or law)10. Digital upgrades and new designs follow DI\&C-ISG-06, which provides an Alternate Review Process allowing for parallel system development and regulatory review to accelerate deployment schedules (current official policy)30. Grid operations and market interactions fall under the jurisdiction of FERC via Section 201 of the Federal Power Act. While retail power sales inherently reside within state jurisdiction, FERC's December 2025 PJM order clarified that any grid-synchronized co-located arrangement remains inextricably linked to the interstate bulk power system, thus subjecting the facility to federal interconnection procedures, network upgrade cost allocations, and transmission service tariffs (established standard or law)4. Within the digital substation, communication standards rely heavily on IEC 61850, while the cybersecurity layers are dictated by IEC 62351\. Finally, hardware and supply chain assurance aligns with NIST SP 800-161 and the adoption of the Security Protocol and Data Model (SPDM) to verify components before they are granted network access (observed deployment or practice)33.

Direct-Answer Items (DA-01 to DA-30)

ID	Direct Answer Item
DA-01	Failure model uniqueness: Co-location introduces unprecedented thermal transients resulting from rapid hyperscale IT load shedding directly impacting the reactor.
DA-02	Safety independence: Ensured via IEEE 603 requirements and the physical enforcement of unidirectional optical data diodes.
DA-03	Abrupt load rejection: Handled deterministically by steam bypass valves opening within \<100ms, coupled with dump resistors.
DA-04	Cooling loss: Mitigation relies strictly on passive convective cooling and deterministic, hardwired reactor trip systems.
DA-05	Islanding: Governed by firm contract demand tariffs, executed via high-speed islanding relays protecting the local microgrid.
DA-06	Synchronization error: Addressed by redundant Precision Time Protocol (PTP) boundary clocks with local rubidium oscillator holdovers.
DA-07	Control-plane compromise: Mitigated by physically separating ML advisory loops from the non-updatable FPGA-based actuation logic.
DA-08	IT/OT boundary: Enforced by strict air-gapping or optical data diodes restricting traffic entirely to outbound, read-only telemetry.
DA-09	Microsegmentation: Workloads are cryptographically partitioned using deep packet inspection and zero-trust network access policies.
DA-10	Trusted time: Derived from hardened GNSS receivers, verified by terrestrial sources, and isolated via hardware PTP stamping.
DA-11	Hardware roots: Achieved via Caliptra silicon IP, providing immutable Root of Trust for Measurement and Identity.
DA-12	Out-of-band management: Restricted OpenBMC access secured by SPDM attestations and physically isolated management VLANs.
DA-13	Clean-room recovery: Immutable bare-metal restores driven by cryptographically verified HBOM and SBOM attestations.
DA-14	Regulatory frameworks: Governed concurrently by the NRC (10 CFR 73.54), FERC (FPA 201), IEC (61850/62351), and NERC-CIP.
DA-15	ML advisory limit: Machine learning models cannot issue direct control commands; they solely suggest optimization setpoints to safety logic.
DA-16	BMC risk: NC-SI protocols over SMBus/PCIe can stealthily bypass the host OS; mitigated exclusively by strict network segregation.
DA-17	Supply chain: Managed via continuous cryptographic attestation of silicon components during every stage of the boot cycle.
DA-18	Firmware rollback: Prevented by hardware eFuses and Caliptra's tamper-evident boot measurement vault (RTRec).
DA-19	Grid interaction: Large load BTMG netting is strictly prohibited; ancillary services must be paid based on gross demand metrics.
DA-20	CCF defense: Coping analysis dictates the necessity of diverse software and hardware execution paths per NRC BTP 7-19.
DA-21	D3 assessment: Diversity and Defense-in-Depth ensures that redundant trains are not simultaneously compromised by a single vulnerability.
DA-22	SMR legislation: State laws, such as Illinois HB 2473, explicitly permit the construction of \<300MW reactors, superseding legacy moratoriums.
DA-23	BTMG tariffs: Revised to eliminate cost-shifting; eligible customers are mandated to pay NITS for all transmission system utilization.
DA-24	GOOSE latency: Must execute trip commands in \<3-4ms; this physical limit requires hardware-accelerated HMAC rather than RSA encryption.
DA-25	Data diode tech: Utilizes optical transmission relying on hardware with no physical receive photodiode on the high-security side.
DA-26	FPGA benefits: Provides highly deterministic, non-OS execution logic that remains intrinsically immune to traditional software buffer overflows.
DA-27	Thermal inertia: SMRs possess significantly lower thermal inertia than traditional reactors, demanding exponentially faster bypass actuation.
DA-28	Digital twin limits: Highly useful for predictive anomaly detection, but must never supersede or replace deterministic physical safety thresholds.
DA-29	PJM compliance: Requires defined "Eligible Customers" and physically metered isolation of all co-located load arrangements.
DA-30	Data center priority: Critical reactor cooling IT infrastructure takes absolute power precedence over generic commercial compute workloads.

5. Architecture and Data Models

The cyber-physical architecture of a co-located facility requires an uncompromising multi-tiered enclave model. The Reactor Protection System (RPS) occupies the innermost tier, functioning strictly on deterministic logic. To satisfy NRC diversity and defense-in-depth requirements and eliminate software common-cause failures, this tier heavily utilizes Field-Programmable Gate Arrays (FPGAs) programmed via hardware description languages, executing without a traditional operating system (technical proposal)35. The Digital Substation acts as the critical intermediary, translating IEEE 603 isolation principles into modern IEC 61850 network typologies (observed deployment or practice)21. The hyperscale data center resides in the outermost logical tier. Communication from the RPS and the digital substation to the data center—necessary for digital twin telemetry, predictive maintenance, and load coordination—occurs exclusively through physical unidirectional gateways, commonly optical data diodes. Advanced FPGA-based data diodes employ TCP proxies to satisfy IT handshake requirements without ever permitting a physical return path to the OT network (observed deployment or practice)12. Advisory Machine Learning (ML) functions residing in the data center analyze this telemetry to optimize reactor load-following algorithms. However, their output is treated as entirely untrusted input by the plant control system; any setpoint alteration is subjected to hard-coded, physical invariants within the OT environment (reasoned inference)37.

Page Concepts (PC-01 to PC-40)

ID	Concept	Description
PC-01	Subsystem Isolation	The absolute physical and cryptographic separation of IT, OT, and Reactor Safety networks.
PC-02	Caliptra Integration	Implementation of an open-source silicon-level Root of Trust embedded within BMCs and NICs.
PC-03	Unidirectional Gateway	Deployment of optical data diodes ensuring only read-only export of plant telemetry to IT.
PC-04	Deterministic Actuation	FPGA-based logic that executes safety commands independently, regardless of network state.
PC-05	Bypass Valve Dynamics	Rapid mechanical actuation required to absorb massive thermal shock during an IT load shed.
PC-06	Islanding Relay	High-speed electrical separation systems disconnecting the facility from a collapsing macro-grid.
PC-07	PTP Boundary Clocks	Tiered time synchronization architecture designed to isolate and mitigate GNSS spoofing attacks.
PC-08	GOOSE/SV Security	Implementation of low-latency HMAC authentication on critical IEC 61850 substation messages.
PC-09	CCF Coping Strategies	Utilizing diverse hardware/software vendors to prevent simultaneous multi-train logic failures.
PC-10	SPDM Attestation	Rigorous cryptographic verification of device firmware prior to host system boot.
PC-11	Microsegmentation	Establishment of zero-trust network boundaries between individual server racks and OT zones.
PC-12	Clean-Room Rebuild	Immutable infrastructure instantiation from read-only media in a verified sterile environment.
PC-13	Thermal Inertia Matching	Carefully aligning CPU load shedding algorithms with the physical heat sink capacity of the reactor.
PC-14	Out-of-Band Network	A completely isolated physical network dedicated to management traffic (IPMI/Redfish).
PC-15	NC-SI Vulnerability	The inherent risk of sideband interface compromise allowing attackers to bypass the host OS.
PC-16	Dump Resistor Bank	Massive electrical load banks designed for instantaneous power dissipation during grid transients.
PC-17	Digital Twin Validation	Running high-fidelity parallel simulations to detect physical sensor spoofing or degradation.
PC-18	ML Advisory Boundary	Architectural rule preventing AI models from writing directly to safety PLC registers.
PC-19	Firmware Ratcheting	Hardware-enforced prevention of firmware downgrades to mitigate exploitation of known CVEs.
PC-20	HBOM Verification	Cryptographic checks of component identity against a trusted Hardware Bill of Materials manifest.
PC-21	FPA Jurisdiction	Navigating the complex boundary between wholesale federal transmission and retail state power rules.
PC-22	Contract Demand Tariffs	Ensuring precise financial compliance with FERC/PJM BTMG energy withdrawal limits.
PC-23	Data Diode TCP Proxy	FPGA endpoints simulating TCP handshakes to allow IT streaming across a strictly one-way link.
PC-24	Sensor Signal Diversity	Utilizing different physical principles (e.g., pressure vs. temperature) to infer the same plant state.
PC-25	Reactor Trip System	The ultimate deterministic, fail-safe mechanism designed to halt the nuclear fission chain reaction.
PC-26	FPGA Bitstream Security	The process of encrypting and authenticating hardware logic configurations before deployment.
PC-27	Cooling Interdependency	Managing shared heat sinks between the data center chillers and the reactor secondary loops.
PC-28	Transient Over-speed	The critical mechanical risk to the steam turbine during load rejection, requiring rapid governing.
PC-29	VLAN Hopping Defense	Disabling dynamic trunking protocols on all management switches to prevent logical lateral movement.
PC-30	Air-Gapped Keys	Storing primary certificate authority keys entirely offline within Hardware Security Modules (HSMs).
PC-31	IEC 62351 Limitations	Acknowledging that standard RSA overhead is mathematically too high for 3ms GOOSE requirements.
PC-32	DI\&C-ISG-06 Alt Process	Engaging in parallel NRC review during system development to accelerate deployment timelines.
PC-33	System of Systems	The holistic treatment of the data center, substation, and SMR as a single, interdependent entity.
PC-34	Watchdog Timers	Hardware-level timers that trigger an automatic safe state if control software hangs or crashes.
PC-35	Threat Modeling	The comprehensive mapping of physical access, network transit paths, and supply chain origins.
PC-36	BTMG Netting Prohibition	The regulatory stance preventing large loads from artificially avoiding transmission cost allocations.
PC-37	Optical Fiber Splitting	Passively mirroring network traffic at the physical layer for highly secure intrusion detection.
PC-38	Emergency Power Routing	Prioritizing reactor residual heat removal cooling over commercial IT compute during islanding events.
PC-39	Secure Boot Chain	Verifying the integrity of all components from the silicon RoT up through the host hypervisor.
PC-40	Operational Evidence	Publicly verifiable metrics of system health and regulatory compliance utilizing privacy-preserving hashes.

6. Failure Modes and Adversarial Cases

The convergence of probabilistic IT infrastructure and deterministic OT nuclear systems creates complex, tightly coupled dependency graphs. A disruption in computation can cause severe thermal shock to the reactor, while a grid anomaly can trigger islanding that destabilizes IT power delivery. The utilization of Branch Technical Position (BTP) 7-19 mandates that facilities conduct rigorous coping analyses to ensure that Common-Cause Failures (CCF) do not cripple redundant safety systems simultaneously (established standard or law)36. One of the most profound unique failure models is the abrupt load rejection scenario. If the data center experiences a total network isolation event and sheds 100% of its computational load instantaneously, the turbine generator loses its electrical sink. The steam bypass valves must actuate within less than 100 milliseconds to route primary steam directly to the condenser, while massive dump resistor banks must immediately absorb the remaining electrical inertia to prevent catastrophic turbine overspeed (observed deployment or practice)7. Conversely, a cyber-attack exploiting the NC-SI sideband interface on OpenBMC firmware could allow an adversary to bypass the host operating system entirely, manipulating hardware voltages or thermal limits (peer-reviewed research finding)8.

50 Failure Scenarios (FS-01 to FS-50)

ID	Scenario	Domain	Deterministic Invariant	Mitigation Strategy
FS-01	Unplanned 100% IT load shed	Thermal	Turbine overspeed threshold	Actuate steam bypass; engage dump resistors
FS-02	Ransomware encryption on BMCs	Cyber	Compute availability	OpenBMC SPDM attestation; network isolation
FS-03	PTP Time Spoofing via GPS	OT/Cyber	Substation timing sync	Redundant GNSS \+ local rubidium holdover clock
FS-04	GOOSE message replay attack	Cyber	Breaker actuation	Implement IEC 62351-6 hardware HMAC integration
FS-05	Total loss of ultimate heat sink	Thermal	Core temperature limit	Scram reactor; activate passive convective cooling
FS-06	Optical diode physical bypass	Cyber	High-to-low enclave integrity	Tamper-evident fiber conduits; logic anomaly checks
FS-07	ML predicts false safe state	Cyber/ML	Control setpoints	FPGA-based bounds checking blocks advisory input
FS-08	Grid transmission cascade failure	Power	Grid synchronization	Fast islanding relay separation to microgrid mode
FS-09	FPGA bitstream corruption	Cyber	Actuation logic	Dual-redundant, diverse vendor FPGAs (BTP 7-19)
FS-10	Malicious firmware update injection	Cyber/Supply	Secure boot	Caliptra RTU absolute authentication requirement
FS-11	NC-SI sideband infiltration	Cyber	Host OS bypass	Strict physical and VLAN segregation of management traffic
FS-12	Dump resistor bank thermal failure	Power	Voltage regulation	Trip turbine immediately; vent steam to atmosphere
FS-13	Sensor freeze (FDI attack)	Cyber	Pressure/Temp reality	Cross-validation using digital twins and signal diversity
FS-14	Active Directory domain compromise	Cyber/IT	Credential integrity	Strict air-gap between IT AD and OT IAM environments
FS-15	Steam bypass valve mechanical stick	Thermal	Pressure threshold	Redundant bypass valves; automated safety relief valves
FS-16	BTMG compliance failure (Overdraw)	Reg	Tariff limits	Automated hardware load shedding to meet FERC limit
FS-17	Supply chain hardware swap	Supply	Component authenticity	HBOM cryptographic verification executed on boot
FS-18	IT cooling loop physical rupture	Thermal	Chiller capacity	Graceful IT shutdown; immediately isolate from OT loop
FS-19	IEC 61850 volumetric DoS attack	Cyber	Substation availability	Aggressive rate limiting; dedicated protection VLANs
FS-20	Switch MAC table flooding	Cyber	Network topology	Strict port security; static MAC routing for OT devices
FS-21	Main control room physical takeover	Physical	Physical security	Local manual overrides via direct hardwired links
FS-22	Lithium battery storage fire	Power/Thermal	Uninterruptible power	Gas fire suppression; blast-proof physical isolation barriers
FS-23	Hypervisor isolation zero-day	Cyber/IT	Workload isolation	AMD SEV / Intel TDX hardware confidential compute
FS-24	Rogue DHCP server on OT network	Cyber	IP addressing	Static IP assignment exclusively; strict DHCP snooping
FS-25	GNSS terrestrial jamming	OT	Clock accuracy	Terrestrial precision clock sync; oscillator holdover
FS-26	AI hallucinated efficiency optimization	ML	Efficiency limits	Hard-coded PID limiters restricting control deviation
FS-27	Insider threat USB insertion	Cyber	Air-gap integrity	Port physical blocking; aggressive endpoint control
FS-28	Substation firmware downgrade attack	Cyber	Known vulnerabilities	Hardware anti-rollback fuses activated via RTRec
FS-29	Primary coolant pump electrical trip	Thermal	Flow rate	Natural circulation design parameters; automatic reactor trip
FS-30	False trip signal network injection	Cyber	Plant availability	2-out-of-3 physical voting logic on deterministic relays
FS-31	Substation core switch failure	OT/Net	Path availability	PRP/HSR redundant zero-loss network topologies
FS-32	HVAC failure in primary server hall	Thermal	IT temperature	Automated thermal-aware virtual machine load migration
FS-33	Malicious code in build compiler	Supply	Software integrity	Reproducible builds; utilization of diverse compilers
FS-34	RSA encryption latency timeout	Cyber/OT	Message delivery	Permanent switch to hardware-accelerated symmetric HMAC
FS-35	Data center roof structural collapse	Physical	Asset survival	Geographically distributed compute redundancy
FS-36	Interconnection limit mechanically exceeded	Power/Reg	FERC contract demand	Hardware trip of excess non-critical IT load
FS-37	Emergency diesel fail to start	Power	Emergency power	Extended battery ride-through; multi-fuel redundancy
FS-38	Zero-day in data diode TCP proxy	Cyber	Telemetry export	FPGA logic mathematical verification; read-only memory
FS-39	Uncoordinated IT/OT patching crash	Process	System stability	Digital twin staging; A/B redundant update procedures
FS-40	Cryptographic key pool exhaustion	Cyber	Session security	Automated, out-of-band key rotation via SPDM
FS-41	SMR module synchronization loss	Power	Multi-module phase	Independent module electrical trip; slow grid resync
FS-42	Secondary loop chemistry failure	Thermal	Pipe integrity	Continuous online chemistry monitoring; automated blowdown
FS-43	Load following algorithm crash	ML/Control	Power matching	Immediate fallback to base-load output; dump excess power
FS-44	Man-in-the-middle on SV stream	Cyber	Sensor data	Absolute IEC 62351 authentication enforcement
FS-45	Power supply voltage glitching attack	Cyber/Phys	Hardware execution	Caliptra glitch detection triggering immediate ASIC reset
FS-46	Accidental fiber trench cut	Physical	Network path	Diverse physical routing through hardened conduits
FS-47	DNS poisoning in IT infrastructure	Cyber	Service routing	DNSSEC implementation; static OT routing tables
FS-48	Inadequate CCF diversity implementation	Engineering	D3 compliance	Independent regulatory review via DI\&C-ISG-06
FS-49	Stale telemetry processed as live	OT	Time sensitivity	PTP timestamps verified; discard if Delta \> 4ms
FS-50	Sabotage of cooling water intake	Physical	Heat sink	Submerged, physically hardened intake structures

7. Evidence and Currentness Requirements

To satisfy regulatory bodies (NRC, FERC) and maintain continuous enterprise assurance models, the system must emit verifiable evidence continuously without disclosing sensitive topology or vulnerabilities to external observers (policy proposal)33. The system utilizes a Hardware Bill of Materials (HBOM) that exports manifests cryptographically bound to Caliptra silicon identities, proving that physical devices have not been tampered with in transit. Concurrently, Software Bill of Materials (SBOM) and Vulnerability Exploitability eXchange (VEX) documents prove the current patch status of the environment. The operational telemetry must provide outbound-only cryptographic hashes of critical safety registers to independent auditors, proving that deterministic invariants remain active and unmodified. For market compliance, real-time verifiable indicators of FERC BTMG tariff adherence—specifically the megawatt draw against the firm contract demand—must be mathematically provable to grid operators (established standard or law)41.

8. Operational and Institutional Implications

Combining nuclear power and hyperscale computing fundamentally alters the institutional recovery models of both industries. If the data center experiences a catastrophic cyber event, the nuclear plant cannot simply rely on the grid to absorb its power; it must safely isolate, shed load to bypass systems, and maintain its own cooling indefinitely. Conversely, if the reactor trips, the data center must gracefully migrate its massive workloads globally before local battery and diesel exhaustion occurs.

30 Recovery Patterns (RP-01 to RP-30)

ID	Recovery Pattern	Trigger Condition	Action
RP-01	Steam Dump & Ride Through	Sudden IT load loss	Actuate bypass; maintain reactor in critical state
RP-02	Clean-Room BMC Flash	BMC firmware compromise	Re-flash bare metal via hardware RTRec interface
RP-03	Island & Isolate	Macro-grid instability	Open grid breakers; balance local IT load directly to SMR
RP-04	Digital Twin Re-sync	Sensor anomaly detected	Cross-check redundant physical sensors against simulation
RP-05	HMAC Key Roll	Cryptographic expiration	Out-of-band rotation of all IEC 62351 session keys
RP-06	FPGA Golden Image Load	Bitstream hash mismatch	Force reboot from immutable, physically locked ROM
RP-07	Passive Cooling Transition	Total loss of AC power	Open convective cooling valves automatically
RP-08	Micro-segmentation Lockdown	Lateral movement detected	Drop all cross-rack IT traffic; enter zero-trust mode
RP-09	PTP Holdover	GNSS signal loss	Switch seamlessly to local rubidium atomic clock
RP-10	Load Migration	Anticipated SMR trip	Shift compute jobs to external geographic zone via fiber
RP-11	Contract Demand Trim	Approaching FERC limit	Throttle non-critical IT workloads to avoid penalties
RP-12	Data Diode Reset	Telemetry buffer overflow	Clear proxy buffers; maintain absolute physical airgap
RP-13	Diverse Actuation	Primary relay failure	Fire secondary relay of different manufacture/logic
RP-14	Manual Scram	Unmitigated thermal transient	Human operator inserts control rods manually
RP-15	Network Topology Reconvergence	PRP/HSR link failure	Seamless zero-loss transition to secondary ring B
RP-16	Air-gapped AD Restore	IT identity compromise	Restore domain strictly from offline tape/WORM storage
RP-17	Dump Resistor Activation	Transient over-voltage	Sink massive electrical power to physical resistor banks
RP-18	ML Advisory Quarantine	ML logic hallucination	Block ML input; lock systems to manual setpoints
RP-19	Boot Vault Verification	Boot sequence anomaly	Halt boot process entirely; alert physical security
RP-20	Supply Chain Quarantine	Failed SPDM attestation	Deny device network access; place in logical quarantine
RP-21	Zero-Trust Token Revocation	Wide-scale credential theft	Invalidate all active session tokens universally
RP-22	Cooling Loop Sever	Contaminated secondary loop	Isolate primary from secondary heat exchangers physically
RP-23	VLAN Pruning	Network broadcast storm	Automatically disable affected switch ports
RP-24	Diesel Generator Start	Islanding failure	Spin up backup power strictly for critical OT cooling
RP-25	Fallback to Base-load	Load following instability	Lock reactor output to stable minimum thermal baseline
RP-26	Sensor Voting Outage	1 of 3 physical sensors fails	Degrade to 1-of-2 voting logic securely and alert
RP-27	Rate Limit Enforcement	GOOSE flood attack	Execute hardware rate-limit on all ingress switch ports
RP-28	Caliptra Reset	Glitch attack detected	Force cold reboot of ASIC to clear malicious state
RP-29	Thermal Load Balancing	Localized server overheating	Distribute compute load across cooler data halls
RP-30	Post-Event Audit Export	Post-recovery completion	Export tamper-evident logs exclusively via data diode

9. Public-versus-Protected Information Boundary

To balance public accountability and regulatory oversight with the profound security requirements of a nuclear asset, a strict boundary must be enforced regarding data disclosure (policy proposal). Publicly accessible information must be restricted to aggregate power output, tariff compliance metrics regarding FERC transmission limits, SBOM and HBOM metadata limited to cryptographic hashes (excluding configuration contents), environmental thermal and emission data, and high-level statements of D3 methodology compliance. Protected, strictly confidential information includes exact IP topologies, optical diode port mappings, physical sensor locations, precise thermal trip setpoints, Caliptra private keys, and detailed vulnerability exploit chains.

10. Implementation Roadmap

The deployment of this architecture requires a meticulously phased approach to satisfy regulatory bodies while building the physical plant.

1. Phase 1: Regulatory Clearance & Interconnection (Months 1-12)

File a non-conforming Interconnection Service Agreement with FERC precisely addressing co-located load and firm contract demand constraints (established standard or law)3.
Submit the DI\&C-ISG-06 Alternate Review Process License Amendment Request (LAR) to the NRC to begin the digital safety architecture review (current official policy)30.

2. Phase 2: Hardware Procurement & Attestation (Months 13-24)

Procure Caliptra 2.0-enabled hyperscale servers and FPGA-based nuclear safety controllers.
Establish and verify optical data diodes and physically isolated management planes prior to any software installation.

3. Phase 3: Integration & Island Testing (Months 25-36)

Physically simulate a 100% IT load rejection event and rigorously validate steam bypass and dump resistor actuation timing (observed deployment or practice)7.
Conduct aggressive, red-team penetration testing strictly on the IT/OT boundary.

4. Phase 4: Commercial Operation & Continuous Assurance (Month 37+)

Deploy Machine Learning advisory systems initially in shadow mode to validate recommendations against physical invariants.
Activate full SPDM supply chain verification for continuous lifecycle monitoring.

11. Test and Assurance Plan

Integrators and mission partners must adhere to a strict assurance methodology prior to connecting any asset to the converged environment. Procurement and Assurance Checklist:

\[ \] Does the hyperscale server hardware utilize Caliptra 2.0 or an equivalent OCP-compliant silicon Root of Trust?
\[ \] Is OpenBMC strictly restricted to an isolated, non-routable, physical management VLAN?
\[ \] Are IT to OT data flows physically restricted by optical data diodes entirely lacking a reverse physical TCP path?
\[ \] Does the digital substation comply with IEC 62351-6 utilizing symmetric HMAC for GOOSE/SV messaging?
\[ \] Is the Reactor Protection System implemented on non-OS FPGAs to fundamentally prevent software CCFs?
\[ \] Has a comprehensive Coping Analysis verified Diversity and Defense-in-Depth per NUREG/CR-6303 and BTP 7-19?
\[ \] Does the ISA strictly meter co-located load to satisfy FERC Firm Contract Demand requirements?
\[ \] Are the steam bypass systems and dump resistors thermally rated for a 100% instantaneous IT load shed?

12. Open Research Questions

Several critical areas require further academic and industrial research to optimize this architecture:

1. IEC 62351 Latency Constraints: How can the industry standardize hardware-accelerated HMAC implementation across multivendor digital substations to universally maintain the strict \<3ms GOOSE latency requirements while preventing replay attacks (peer-reviewed research finding)21?

2. ML/Deterministic Handoff: Can bounded-parameter Machine Learning algorithms be mathematically proven to never violate safety invariants during rapid load following, thus allowing closer coupling of IT demand and reactor output?

3. Supply Chain Scale: How can HBOMs and SPDM attestations be efficiently scaled and cryptographically verified in a hyperscale data center containing millions of discrete components without causing massive boot-storm delays (institutional analysis)44?

13. Contradiction Register

Contradiction	Source A	Source B	Resolution
FERC Jurisdiction over BTMG	Retail sales behind the meter are strictly state jurisdiction (FPA 201\)32.	FERC claims jurisdiction over interconnection of co-located loads4.	The December 2025 FERC order clarified that while the actual sale of power may be retail, the interconnection and grid synchronization inherently grant FERC the authority to regulate the transmission tariff and eliminate netting3.
IEC 61850 vs IEC 62351 Encryption	IEC 61850 requires \<3ms latency for protection commands22.	IEC 62351-6 originally required RSA digital signatures for authentication24.	Mathematical evaluation proves RSA is too computationally heavy to meet the 3ms limit. The industry is adopting symmetric HMAC, though widespread vendor support is still pending21.
Data Diode TCP/IP Limitations	TCP protocol inherently requires a two-way handshake to function45.	Optical diodes are strictly one-way by physics46.	Modern FPGA-based data diodes spoof the TCP handshake via an intelligent proxy on both sides, allowing IT systems to stream data seamlessly across a physically one-way fiber link12.

14. Claim-Status Table

Claim	Classification	Verification Status	Cutoff Date
FERC rejected Amazon/Talen 480MW ISA	(established standard or law)	Verified16	August 2026
FERC established new BTMG tariffs eliminating netting for large loads	(established standard or law)	Verified (Dec 2025 Order)18	August 2026
Illinois repealed its nuclear moratorium for SMRs \<300MW	(established standard or law)	Verified (HB 2473\)5	August 2026
RSA encryption meets GOOSE \<3ms latency requirements	(disputed claim)	False; RSA is computationally too slow21	August 2026
Non-OS FPGAs mitigate operating system level CCFs	(peer-reviewed research finding)	Verified35	August 2026
Caliptra 2.0 integrates RTRec and RTU natively in silicon	(technical proposal)	Verified via Open Compute Project11	August 2026

15. Source-Quality Table

Source ID	Type	Authority Level	Bias / Scope
1, 2, 5, 8, 64, 151, 155	Primary (NRC)	Highest	Regulatory compliance focused; definitive for US nuclear safety.
18, 23, 99, 100, 102, 133, 134, 141	Primary/Legal	Highest	Authoritative on FERC rulings, FPA Section 201, and transmission tariffs.
30, 38, 39, 149	Primary (IL Legis)	Highest	Authoritative on Illinois State law (HB 2473\) regarding SMR deployment.
124, 163	Primary (OCP/GitHub)	High	Definitive for Caliptra technical specifications and hardware root of trust.
117, 122, 126	Institutional/Industry	High	OpenBMC vulnerabilities and supply chain security frameworks.
185, 188, 192, 195, 201	Peer-Reviewed	High	Rigorous academic analysis of IEC 61850/62351 latency and security protocols.
93, 94, 95	Vendor Specification	Moderate	Accurate for technical capability of data diodes, though prone to marketing bias.
28, 108, 181	Technical/Patent	Moderate	Details mechanical dynamics of load rejection, steam bypass, and dump resistors.

16. Detailed Bibliography

\[cite: 26\] U.S. NRC, "10 CFR 73.54 \- Protection of digital computer and communication systems and networks."
\[cite: 48\] Anya Kim, U.S. NRC, "Integrating Cybersecurity into DI\&C System Upgrades," NPIC\&HMIT.
\[cite: 27\] IAEA, "Regulatory guide (RG) 1.152... IEEE Std 603... NEI 08-09."
\[cite: 28\] U.S. NRC, "ML21091A019 \- Embedded Digital Devices in Safety-Related Systems."
\[cite: 1, 14, 16\] Federal Energy Regulatory Commission (FERC), "Order Rejecting Susquehanna Interconnection Service Agreement," Nov 2024\.
\[cite: 15, 17\] Davis Graham & Stubbs LLP / World Nuclear News, "The Talen Order: Rejection and Its Limits."
\[cite: 7, 39, 40\] Technical documentation and patents on Load Rejection, Steam Bypass, and Dump Resistors.
\[cite: 5, 6, 20, 49\] State of Illinois General Assembly, "House Bill 2473," SMR Moratorium Repeal, 2023-2024.
\[cite: 10\] IEEE, "IEEE 603-2018: Standard Criteria for Safety Systems for Nuclear Power Generating Stations."
\[cite: 29\] Research, "Safety and Nonsafety Communications and Interactions in International Nuclear Power Plants."
\[cite: 34\] wolfSSL, "Caliptra: Your Silicon’s Security Chaperone," Architecture and Purpose.
\[cite: 30, 31, 43\] U.S. NRC, "DI\&C-ISG-06, Licensing Process," Alternate Review Process documentation.
\[cite: 2\] ITIF, "Small Modular Reactors: A Realist Approach to the Future of Nuclear Power."
\[cite: 33, 44\] NIST, "IoTAB Meeting Minutes," SBOM/HBOM recommendations and SP 800-161 compliance.
\[cite: 12, 46, 50\] Missing Link Electronics / Fibersystem / Patton, "Data Diodes, FPGA Unidirectional Security Gateways."
\[cite: 3, 18, 19, 47\] FERC, "Order on Show Cause Proceeding (PJM Co-Location)," December 2025\.
\[cite: 35\] Research, "Experience of I\&C systems modernization using FPGA technology," NUREG/CR-7006.
\[cite: 8\] Open Compute Project, "OpenBMC security vulnerabilities and NC-SI sideband management."
\[cite: 11\] CHIPS Alliance, "Caliptra 2.0 Specification," RTRec, RTU, OCP L.O.C.K.
\[cite: 25\] Microsoft Tech Community, "Securing Hardware and Firmware Supply Chains."
\[cite: 13\] Sandia National Labs, "Design of Defensive Cybersecurity Architectures," IAEA NSS 17-T.
\[cite: 4, 32\] Analysis on "FPA Section 201," FERC jurisdiction over behind-the-meter generation.
\[cite: 36\] U.S. NRC / EPRI, "Diversity and Defense-in-Depth (D3)," CCF Coping Analysis, BTP 7-19.
\[cite: 37, 38\] OECD NEA / Adra, "Digital Twin Applications and AI Safety Invariants."
\[cite: 21, 22, 23, 24, 51\] Research on "IEC 62351, GOOSE, SV, Digital Substation Security, and Latency."

(Research cutoff date: August 2026\. Retrieved: August 2026).

Works cited

1. Top questions on FERC's co-location compliance order for PJM, answered \- Carbon Direct, https://www.carbon-direct.com/insights/top-questions-on-ferc-s-co-location-compliance-order-for-pjm-answered

2. Small Modular Reactors: A Realist Approach to the Future of Nuclear Power | Reports & Briefings | Apr 14, 2025 | ITIF, https://itif.org/publications/2025/04/14/small-modular-reactors-a-realist-approach-to-the-future-of-nuclear-power/

3. FERC Orders PJM to Reform Tariff for Co-Located Generation and Load \- K\&L Gates, https://www.klgates.com/thought-leadership/FERC-Orders-PJM-to-Reform-Tariff-for-Co-Located-Generation-and-Load-1-15-2026

4. FERC Directs Grid Operators to Reform Procedures for Large Loads Connecting to the Bulk Transmission System \- Willkie Farr & Gallagher LLP, https://www.willkie.com/publications/2026/06/ferc-directs-grid-operators-to-reform-procedures-for-large-loads-connecting-to-the-bulk-transmission

5. Illinois Legislation on Permitting Small Modular Reactors \- Model Climate Laws Initiative, https://modelclimatelaws.org/resources/illinois-legislation-on-permitting-small-modular-reactors/

6. HB2473 | Illinois 2023-2024 | VET MED/SURGERY ACT-VARIOUS \- PolicyEngage, https://trackbill.com/bill/illinois-house-bill-2473-vet-med-surgery-act-various/2368082/

7. Load Rejection Tests and Their Dynamic Simulations With a 150 kW Class Microsteam Turbine \- ResearchGate, https://www.researchgate.net/publication/411492011\_Load\_Rejection\_Tests\_and\_Their\_Dynamic\_Simulations\_With\_a\_150\_kW\_Class\_Microsteam\_Turbine

8. 2020 OCP Virtual Summit: Full Schedule, https://2020ocpvirtualsummit.sched.com/list/descriptions/

9. Security analysis of digitized substations: A systematic review of GOOSE messages | Request PDF \- ResearchGate, https://www.researchgate.net/publication/369457083\_Security\_analysis\_of\_digitized\_substations\_A\_systematic\_review\_of\_GOOSE\_messages

10. 603-2018 IEEE Standard Criteria For Safety Systems For Nuclear Power Generating Stations | PDF | Institute Of Electrical And Electronics Engineers \- Scribd, https://www.scribd.com/document/498969031/603-2018-IEEE-Standard-Criteria-for-Safety-Systems-for-Nuclear-Power-Generating-Stations

11. Caliptra/doc/Caliptra.md at main · chipsalliance/Caliptra \- GitHub, https://github.com/chipsalliance/Caliptra/blob/main/doc/Caliptra.md

12. Data Diodes Security Gateway \- FPGA IP Core Design \- Missing Link Electronics, https://www.missinglinkelectronics.com/fpga-hardware/data-diodes/

13. Advanced Reactor Safeguards & Security Design of Defensive Cybersecurity Architectures for High Temperature, Gas-Cooled R \- Sandia National Laboratories, https://www.sandia.gov/app/uploads/sites/273/2024/11/Design-of-Defensive-Cybersecurity-Architectures-for-High-Temperature-Gas-Cooled-Reactors.pdf

14. FERC Blocks PJM Proposal to Expand Amazon Data Center Load at Susquehanna Nuclear Plant \- Macro Economic Trends and Risks \- Motley Fool Community, https://discussion.fool.com/t/ferc-blocks-pjm-proposal-to-expand-amazon-data-center-load-at-susquehanna-nuclear-plant/110161

15. From Rejection to National Rulemaking: The Federal Regulatory Framework for Data Center Power Is Taking Shape \- Davis Graham, https://davisgraham.com/news-events/from-rejection-to-national-rulemaking-the-federal-regulatory-framework-for-data-center-power-is-taking-shape/

16. FERC rejects interconnection pact for Talen-Amazon data center deal at nuclear plant, https://www.utilitydive.com/news/ferc-interconnection-isa-talen-amazon-data-center-susquehanna-exelon/731841/

17. Regulator rejects amended Susquehanna power agreement \- World Nuclear News, https://www.world-nuclear-news.org/articles/regulator-rejects-amended-susquehanna-power-agreement

18. FERC Directs Co-Location Reforms in PJM \- Morgan Lewis, https://www.morganlewis.com/pubs/2025/12/ferc-directs-co-location-reforms-in-pjm

19. FERC Clears the Way for Co-Location \- Akin Gump, https://www.akingump.com/en/insights/blogs/speaking-energy/ferc-clears-the-way-for-co-location

20. Rezin's legislation to end Illinois' nuclear moratorium for next generation of nuclear reactors becomes law \- Sue Rezin, https://senatorrezin.com/2023/12/08/rezins-legislation-to-end-illinois-nuclear-moratorium-for-next-generation-of-nuclear-reactors-becomes-law/

21. A Fixed-Latency Architecture to Secure GOOSE and Sampled Value Messages in Substation Systems \- ResearchGate, https://www.researchgate.net/publication/350415102\_A\_Fixed-Latency\_Architecture\_to\_Secure\_GOOSE\_and\_Sampled\_Value\_Messages\_in\_Substation\_Systems

22. Vulnerability and Impact Analysis of the IEC 61850 GOOSE Protocol in the Smart Grid, https://www.mdpi.com/1424-8220/21/4/1554

23. Performance Analysis of Routable GOOSE Security Algorithm for Substation Communication through Public Internet Network \- MDPI, https://www.mdpi.com/1424-8220/23/12/5396

24. Machine-Learning-Based Anomaly Detection for GOOSE in Digital Substations \- MDPI, https://www.mdpi.com/1996-1073/17/15/3745

25. Securing Hardware and Firmware Supply Chains \- Microsoft Community Hub, https://techcommunity.microsoft.com/blog/azureinfrastructureblog/securing-hardware-and-firmware-supply-chains/4268815

26. Digital Actuator Technology \- OSTI.GOV, https://www.osti.gov/servlets/purl/1166051

27. Report of the Survey on the Design Review of New Reactor Applications \- INIS-IAEA, https://inis.iaea.org/records/hta48-taz30/files/46027262.pdf?download=1

28. Technical Basis for EDDs in Nuclear Power | PDF \- Scribd, https://www.scribd.com/document/906561967/ML21091A019

29. Safety and Nonsafety Communications and Interactions in International Nuclear Power Plants \- ResearchGate, https://www.researchgate.net/publication/368983846\_Safety\_and\_Nonsafety\_Communications\_and\_Interactions\_in\_International\_Nuclear\_Power\_Plants

30. NEW LICENSING PROCESS FOR MAJOR NUCLEAR DIGITAL SAFETY SYSTEM UPGRADES, https://epubs.ans.org/download/?a=49774

31. Digital Instrumentation and Controls-Interim Staff Guidance-06, Revision 2, “Licensing Process” \- Federal Register, https://www.federalregister.gov/documents/2019/01/31/2019-00374/digital-instrumentation-and-controls-interim-staff-guidance-06-revision-2-licensing-process

32. Structuring Behind-the-Meter Generation to Manage FERC Jurisdiction \- Davis Graham, https://davisgraham.com/news-events/structuring-behind-the-meter-generation-to-manage-ferc-jurisdiction/

33. NIST Cybersecurity RFI Summary Analysis \- National Institute of Standards and Technology, https://www.nist.gov/document/initial-summary-analysis-responses-request-information-rfi-evalu-ating-and-improving

34. Caliptra: Your Silicon's Security Chaperone \- wolfSSL, https://www.wolfssl.com/caliptra-your-silicons-security-chaperone/

35. (PDF) Experience of I & C systems modernization using FPGA technology \- ResearchGate, https://www.researchgate.net/publication/290632797\_Experience\_of\_I\_C\_systems\_modernization\_using\_FPGA\_technology

36. Diversity Strategies for Nuclear Power Plant Instrumentation and Control Systems \- INFO \- Oak Ridge National Laboratory, https://info.ornl.gov/sites/publications/files/Pub22473.pdf

37. Strategic Research, Innovation, and Deployment Agenda \- Adra Association, https://adr-association.eu/sites/default/files/2026-04/Adra%20Strategic%20Research%20Apr2026%201%20%281%29.pdf

38. COVERT COGNIZANCE: EMBEDDED INTELLIGENCE FOR INDUSTRIAL SYSTEMS \- Purdue University Graduate School, https://hammer.purdue.edu/ndownloader/files/37716714

39. US7945011B2 \- Enhanced steam dump (bypass) control system \- Google Patents, https://patents.google.com/patent/US7945011B2/en

40. Turbine Bypass System \- Turbine Steam Dump System | nuclear-power.com, https://www.nuclear-power.com/nuclear-power-plant/turbine-generator-power-conversion-system/turbine-bypass-system-turbine-steam-dump-system/

41. FERC Directs PJM to Establish New Rules and Guidelines for Co-Located Load and Behind-The-Meter Generation \- Akerman LLP, https://www.akerman.com/en/perspectives/ferc-directs-pjm-to-establish-new-rules-and-guidelines-for-co-located-load-and-behind-the-meter-generation.html

42. FERC Greenlights PJM Co-Located Load Framework in Part, Calls for Further Tariff Updates | Willkie Farr & Gallagher, https://www.willkie.com/publications/2026/07/ferc-greenlights-pjm-co-located-load-framework-in-part-calls-for-further-tariff-updates

43. Diablo Canyon Digital I\&C ISG-06 pilot application: Lessons learned \- Technology Resources, http://www.technology-resources.com/docs/Feb15\_NN\_Diablo\_Canyon\_Reprint.pdf

44. Internet of Things Advisory Board (IoTAB) Committee MEETING MINUTES \- National Institute of Standards and Technology, https://www.nist.gov/document/april-2023-iotab-meeting-minutes

45. Unidirectional Communications in Secure IoT Systems—A Survey \- MDPI, https://www.mdpi.com/1424-8220/24/23/7528

46. Data Diodes | Fibersystem, https://www.fibersystem.com/product-area/data-diodes/

47. FERC Directs PJM to Issue New Rules for Co-Location of Power Plants and Data Centers, https://www.mintz.com/insights-center/viewpoints/2151/2026-02-02-ferc-directs-pjm-issue-new-rules-co-location-power