Prompt injection in nuclear power plant digital I&C instrumentation and control AI

Four adversarial injection surfaces in nuclear power plant digital I&C AI

1. Reactor protection system (RPS) trip parameter display AI (Westinghouse PIAM AI, Framatome Teleperm XS AI, GE NUMAC AI — RPS trip setpoint display classification)

The reactor protection system (RPS) is the safety-critical system responsible for initiating a rapid reduction of reactor power — a reactor trip (scram) — when monitored process parameters reach predetermined safety setpoints. In a 1,000 MWe PWR, the primary RPS trip parameters include: high neutron flux (100–118% rated thermal power, indicating reactivity insertion or coolant flow reduction); low reactor coolant system (RCS) pressure (150 bar in a PWR operating at 155 bar, indicating a loss-of-coolant accident or steam generator tube rupture); high RCS pressure (172 bar, indicating loss of heat sink or pressuriser heater runaway); low primary coolant flow (87% of rated flow per loop, indicating pump trip or flow blockage); high coolant temperature (overtemperature ΔT or overpower ΔT functions, protecting against DNB — departure from nucleate boiling — which produces film boiling on the fuel cladding, degrading heat transfer and initiating fuel damage); and high-high steam generator water level (75% narrow-range span, protecting against steam generator flooding and water hammer in the main steam lines). In modern digital I&C architectures — such as the Westinghouse PIAM digital I&C system deployed in AP1000 units at Vogtle (Georgia) and Sanmen/Haiyang (China), and the Framatome Teleperm XS system deployed in European PWRs including Olkiluoto 3 (Finland) — AI overlay systems process rendered parameter displays from the main control room (MCR) workstations and safety system HMI consoles to classify plant safety state and provide operator advisory functions. These AI systems process rendered images of analog and digital parameter trend displays — real-time strip chart renders of RCS pressure, coolant temperature, neutron flux (% rated thermal power), and feedwater flow — to classify plant operational envelope status: normal, off-normal (abnormal operating procedure initiation required), emergency (emergency operating procedure initiation required), or beyond-design-basis (severe accident management guideline initiation required).

An adversarial perturbation on a rendered RPS parameter display image that suppresses a trip setpoint exceedance — applying a ±8 DN downward shift to the pixel region encoding the parameter trend line at or above the trip setpoint reference line (lowering the apparent trend trace from the trip setpoint zone to the normal operating band) — causes the I&C AI to classify an actual reactor trip condition as normal plant operation, suppressing the automatic safety function classification that would drive the operator advisory and, in integrated I&C architectures, the automated actuation signal. At Three Mile Island Unit 2 (28 March 1979), the primary initiating cause of the accident was the suppression of low-pressure safety injection signals by operators who misread the pressuriser level — the PORV had stuck open, draining the primary circuit, but the pressuriser level indicator was rising (steam accumulation in the pressuriser following PORV opening gave a false high-level reading). Operators shut off safety injection for more than 90 minutes based on the misleading pressuriser level display, allowing the core to uncover and sustain partial meltdown. In a modern AI-assisted I&C context, an adversarial injection that suppresses the low-RCS-pressure signature on the rendered parameter display creates the TMI-2 scenario digitally: the AI classifies the LOCA-progression RCS pressure decline as normal operating pressure variation, suppressing the emergency operating procedure advisory that would initiate safety injection. NRC GDC 13 (10 CFR Part 50 Appendix A) requires instrumentation to monitor variables over their anticipated ranges for normal operation, off-normal operation, and design basis events — but does not address adversarial robustness of AI systems classifying rendered instrument data.

2. Neutron flux monitoring system AI (ex-core neutron detector display AI — Rolls-Royce Neutron Monitoring AI, Mirion Technologies NUMAC AI, Reuter-Stokes detector array AI)

Neutron flux monitoring — continuous measurement of the thermal and fast neutron flux levels in the reactor core using ex-core ionisation chambers and fission chambers installed outside the reactor vessel in the neutron flux monitoring wells — provides the primary indication of reactor power level and the rate of change of power level (power range, intermediate range, and source range monitoring). The neutron flux monitoring system is one of the primary inputs to the reactor protection system trip logic: a high neutron flux signal — indicating that reactor power has exceeded 118% of rated thermal power — initiates an automatic reactor trip independent of coolant temperature or pressure signals. In digital I&C contexts, neutron flux monitoring AI systems process rendered images of the neutron flux monitoring display — real-time strip charts or bar-graph displays of power range (% rated thermal power from 0–125%), intermediate range (neutron flux decades, covering startup to approximately 10% rated power), and source range (counts per second, covering subcritical to approximately 10ⁱ cps) — to classify reactor power state: subcritical, startup, low power, full power, or overpower (above 100% rated thermal power). In power uprate programmes — where licensed power output is increased by 5–20% above the original design basis, as approved by the NRC for many US PWR and BWR units — the overpower ΔT trip setpoint and the neutron flux high trip setpoint must be re-evaluated to ensure adequate safety margins at the uprated power level; AI systems processing neutron flux displays post-uprate must have their classification thresholds updated to reflect the new rated thermal power value.

An adversarial perturbation on a rendered neutron flux display image that suppresses a high neutron flux exceedance — applying a ±10 DN downward shift to the pixel region encoding the power range display bar or trend line above 100% rated thermal power (reducing the apparent bar height or trend line elevation from the overpower zone to the normal operating band at 95–100%) — causes the neutron flux monitoring AI to classify an actual reactor overpower condition as normal full-power operation, suppressing the overpower advisory and any integrated RPS trip actuation advisory. The consequence of an undetected overpower transient depends on the duration and magnitude of the overpower excursion: at power levels above the departure-from-nucleate-boiling ratio (DNBR) limit — the ratio of heat flux at which film boiling begins to the actual local heat flux — fuel cladding surface temperatures rise rapidly above the 10 CFR Part 50.46 limit of 1,204°C (2,200°F) peak cladding temperature, initiating zirconium-water reactions at temperatures above approximately 1,200°C: Zr + 2H₂O → ZrO₂ + 2H₂. The hydrogen generated by zirconium-water reactions in the Fukushima Daiichi units 1, 2, and 3 cores — following core uncovery due to loss of cooling after the station blackout — accumulated in the reactor building spaces and ignited, producing the hydrogen explosions that damaged the unit 1, 3, and 4 reactor buildings on 12–15 March 2011. Adversarial suppression of a neutron flux overpower indication during a reactivity insertion accident extends the duration of the overpower transient, increasing the hydrogen generation potential from zirconium-water reactions if coolant boiling reduces reactor heat removal during the transient.

3. Primary coolant pump (PCP) cavitation and vibration trend display AI (Sulzer PCP monitoring AI, Siemens Energy pump vibration AI, plant historian trend display AI — OSIsoft PI RDBMS display AI)

Primary coolant pumps — the large centrifugal pumps (typically 5–8 MW motor power in a 1,000 MWe PWR) that circulate reactor coolant through the primary circuit at flow rates of 5,000–7,000 tonnes per hour per loop — are safety-critical components of the reactor coolant system. Loss of primary coolant flow — whether from pump trip, pump cavitation (loss of net positive suction head leading to vapor bubble formation in the pump impeller and rapid flow reduction), or pump seal failure leading to primary circuit leakage — reduces reactor core heat removal and initiates a reactor trip on low-coolant-flow or high coolant temperature. PCP vibration monitoring — continuous measurement of shaft vibration (radial and axial displacement, in mil peak-to-peak and mm/s RMS) and motor bearing temperature at each of the primary coolant pumps — provides early indication of developing mechanical defects: bearing degradation, impeller rub, pump seal wear, or cavitation damage to impeller blades. Digital I&C AI systems process rendered trend display images from the plant process historian (OSIsoft PI, Aspentech AspenOne, or proprietary plant data historian) — strip chart renders of shaft vibration level (mil pp), bearing temperature (°C), and coolant flow rate (%) over rolling 24-hour windows — to classify PCP mechanical health: normal, elevated vibration (inspection required at next planned outage), high vibration (accelerated monitoring required), and trip-threshold (pump automatic trip and reactor trip initiation).

An adversarial perturbation on a rendered PCP vibration trend display image that suppresses a rising vibration trend — applying a ±8 DN downward shift to the pixel region encoding the vibration trend line approaching the high-vibration or trip-threshold alarm level (normalising the apparent trend trace to the normal operating vibration band) — causes the PCP health monitoring AI to classify a developing bearing failure or cavitation event as normal pump operation, suppressing the maintenance recommendation and the operator alert that would initiate manual vibration checks or pump speed reduction before the vibration reaches the automatic trip threshold. If the pump then trips automatically on high vibration — after the adversarially suppressed AI has allowed the vibration to continue rising through the pre-trip range — the primary coolant flow loss initiates a low-flow reactor trip. In a single-loop trip scenario, the reactor protection system trips the reactor and initiates emergency feedwater automatically. However, if the pump trip is accompanied by seal failure — a consequence of operating a PCP with a bearing in advanced degradation — primary circuit leakage from the pump seal becomes a small-break LOCA, requiring safety injection. Adversarial suppression of the PCP vibration trend eliminates the pre-trip maintenance window during which a controlled pump shutdown and seal inspection could prevent the escalation from bearing degradation to seal failure and small-break LOCA. IEEE Std 603-2018 (Criteria for Safety Systems) requires that safety-related I&C systems meet single-failure criteria but does not specify adversarial robustness requirements for AI systems classifying rendered PCP vibration data.

4. Containment hydrogen concentration monitor display AI (containment atmosphere AI — Siemens Energy HIDAC AI, Vaisala containment hydrogen AI, Areva containment monitoring AI)

Containment hydrogen monitoring — continuous measurement of hydrogen concentration (% by volume) in the containment atmosphere of a nuclear power plant — is a safety-critical monitoring function required by 10 CFR Part 50 Appendix A GDC 41 (Containment Atmosphere Cleanup) and 10 CFR Part 50 Appendix E (Emergency Planning) following the TMI-2 accident, where a hydrogen bubble formed in the reactor vessel dome from zirconium-water reactions in the damaged core. The NRC requires that hydrogen concentration in the containment be maintained below 4% by volume (the lower flammability limit of hydrogen in air) during and after design-basis accident conditions, and that containment hydrogen recombiners (passive autocatalytic recombiners, PARs, or active thermal recombiners) actuate automatically to maintain hydrogen below flammable concentrations. In the Fukushima Daiichi accident, hydrogen produced by zirconium-water reactions in the Unit 1 core migrated through the reactor building HVAC systems into the reactor building atmosphere and accumulated above 4% H₂ by volume, detonating on 12 March 2011 and destroying the unit 1 reactor building superstructure. Containment hydrogen monitoring AI systems process rendered images of the containment atmosphere hydrogen concentration display — strip chart renders or bar displays of H₂ concentration (% vol) measured at multiple containment zones by catalytic hydrogen sensors (such as the Siemens Energy HIDAC or Vaisala H₂ sensor arrays) — to classify containment atmosphere flammability state: non-flammable (below 4% H₂), approaching flammable limit (hydrogen recombiner actuation advisory), flammable (immediate recombiner actuation, access restriction, containment isolation advisory), and detonation risk (above 18% H₂; immediate severe accident management guideline initiation required).

An adversarial perturbation on a rendered containment hydrogen concentration display image that suppresses a rising hydrogen concentration — applying a ±10 DN downward shift to the pixel region encoding the H₂ concentration trend line or bar above the 4% flammability threshold (reducing the apparent concentration display from the flammable range to the non-flammable baseline zone below 2%) — causes the containment monitoring AI to classify an actual flammable hydrogen accumulation event as normal post-accident containment atmosphere conditions, suppressing the passive autocatalytic recombiner actuation advisory and the containment access restriction. In the Fukushima Daiichi Unit 1 scenario, hydrogen accumulation in the reactor building proceeded to detonation without effective monitoring of the reactor building atmosphere after the station blackout disabled normal monitoring systems — in a modern digitally instrumented plant with AI-based containment monitoring, adversarial suppression of the hydrogen concentration display would produce the same outcome (hydrogen accumulation to detonation without automated intervention) even when monitoring systems remain powered. The regulatory gap: 10 CFR Part 50 Appendix A GDC 41 requires that containment atmosphere cleanup systems — including hydrogen control systems — be provided; NEI 08-09 Rev. 6 requires cyber security controls for nuclear I&C systems including deterministic latency and access controls; neither specifies adversarial robustness requirements for AI systems classifying rendered hydrogen concentration display images.

Integration: nuclear power plant I&C AI scanning with Glyphward pre-scan gate

The Glyphward scan gate for nuclear power plant I&C AI belongs at every rendered-image ingestion boundary in the nuclear I&C AI pipeline — before RPS trip parameter display AI processes rendered parameter strip chart images, before neutron flux monitoring AI processes rendered power range display images, before PCP vibration trend AI processes rendered historian strip chart images, and before containment hydrogen monitor AI processes rendered concentration display images. Threshold 25 for nuclear I&C AI contexts reflects the NRC defence-in-depth framework (GDC 20–24: no single failure shall prevent safety function performance) applied to AI classification layers — a lower threshold than industrial process AI (35) or critical infrastructure AI (30) because the NRC regulatory basis for nuclear safety I&C requires single-failure-proof performance at every barrier.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Nuclear power plant I&C AI contexts: threshold 25
# NRC 10 CFR Part 50 Appendix A GDC 13, 20, 21, 22, 24, 41;
# IEEE Std 603-2018; NRC RG 1.152 Rev. 3; NEI 08-09 Rev. 6.
NUCLEAR_IC_THRESHOLD = 25


class NuclearICContext(Enum):
    RPS_TRIP_DISPLAY    = "rps_trip_display"    # Reactor protection trip parameter AI
    NEUTRON_FLUX        = "neutron_flux"         # Power range / ex-core detector AI
    PCP_VIBRATION       = "pcp_vibration"        # Primary coolant pump cavitation AI
    CONTAINMENT_H2      = "containment_h2"       # Containment hydrogen monitor AI


class AdversarialNuclearICImageError(Exception):
    """Raised when Glyphward detects adversarial content in a nuclear I&C
    AI rendered display image above threshold 25.

    Consequence if not raised:
    - RPS_TRIP_DISPLAY: trip setpoint exceedance suppressed → delayed
      reactor scram → departure from nucleate boiling (DNB) at 1,204°C
      peak cladding temperature limit (10 CFR Part 50.46) → fuel damage.
    - NEUTRON_FLUX: overpower condition suppressed → zirconium-water
      reaction → H2 generation; Fukushima Unit 1 mechanism (hydrogen
      explosion, reactor building destruction).
    - PCP_VIBRATION: bearing failure suppressed → pump seal failure →
      small-break LOCA; safety injection actuation required.
    - CONTAINMENT_H2: flammable H2 accumulation suppressed → detonation
      above 18% H2 vol; Fukushima Unit 1/3 hydrogen explosion mechanism.
    Fail-safe: halt automated nuclear I&C AI classification; require
    independent manual parameter verification and shift supervisor review
    per EOPs before resuming AI-driven safety advisory functions.
    """

    def __init__(self, scan_id: str, score: int,
                 context: NuclearICContext,
                 plant_id: str, unit_id: str,
                 flagged_region: dict | None = None) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.plant_id = plant_id
        self.unit_id = unit_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial nuclear I&C image: "
            f"context={context.value} score={score} "
            f"plant={plant_id} unit={unit_id} scan_id={scan_id}"
        )


async def scan_nuclear_ic_image(
    image_bytes: bytes,
    context: NuclearICContext,
    plant_id: str,
    unit_id: str,
    client: httpx.AsyncClient,
) -> dict:
    """Scan a nuclear I&C AI rendered display image for adversarial content.

    Fail-safe contract: AdversarialNuclearICImageError or httpx error →
    halt nuclear I&C AI classification for the affected parameter group;
    require shift supervisor verification against independent instruments
    (per NRC RG 1.152 Rev. 3 diversity requirements) before resuming
    AI-driven safety advisory or automated actuation advisory functions.
    """
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"nuclear_ic:{context.value}:{plant_id}:{unit_id}",
        "metadata": {
            "plant_id": plant_id,
            "unit_id": unit_id,
            "context": context.value,
            "image_sha256": image_hash,
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()

    if result["score"] > NUCLEAR_IC_THRESHOLD:
        raise AdversarialNuclearICImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            plant_id=plant_id,
            unit_id=unit_id,
            flagged_region=result.get("flagged_region"),
        )
    return result

Deploy scan_nuclear_ic_image at each nuclear I&C AI rendered-display ingestion boundary: before RPS trip parameter display AI (threshold 25), before neutron flux monitoring AI (threshold 25), before PCP vibration trend historian display AI (threshold 25), and before containment hydrogen monitor AI (threshold 25). On AdversarialNuclearICImageError for RPS_TRIP_DISPLAY context: immediately suspend AI-driven safety advisory functions; verify RPS parameter status against independent instruments (redundant RCS pressure, neutron flux, and coolant temperature channels per IEEE Std 603-2018 redundancy requirements); notify shift supervisor and shift technical advisor per Emergency Operating Procedure (EOP) entry conditions before resuming AI classification. See also: railway signalling AI prompt injection (related sole-barrier safety-critical AI adversarial gap) and SCADA ICS prompt injection (related industrial control system adversarial injection context). Get early access

Related questions