A Reference Architecture for Independent Verification of Reactor State

1. The oversight function that remote operation displaces

Presence performs an evidential function before it performs a regulatory one. The NRC assigns resident inspectors to operating commercial power reactor sites, where they conduct inspections, observe licensee activities, and hold access to the facility that does not depend on the licensee's own reporting^[1][2]. Their findings feed the Reactor Oversight Process, which combines licensee performance indicators with NRC inspection results and assesses both against defined cornerstones of safety^[3]. Separately, 10 CFR 50.54(m) establishes minimum licensed operator staffing as a condition of the licence, including the presence of a licensed operator at the controls while the reactor is operating^[4].

Four distinct goods come out of that arrangement, and they are worth separating because a remote operating model does not remove them equally. Observation is contemporaneous: an inspector sees the plant in the state it is in, not in the state a report describes some hours later. Observation is unmediated: it does not pass through the licensee's own recording and summarising before it reaches the regulator. Observation is contextual: a person who knows the unit notices that a parameter is ordinary here and would be anomalous next door. And observation is institutionally independent: the observer is employed by the regulator, not by the licensee.

A remote model with reduced on-site staffing erodes the unmediated property most sharply. What reaches an off-site reviewer is a record that the operator's own systems produced, transported, and stored. The contextual property degrades next, because context is expensive to reconstruct from telemetry. The institutional independence of the regulator survives, but it now operates on evidence supplied by the party being regulated, which is a materially weaker epistemic position than walking the plant.

The regulator has been examining this. A February 2025 report prepared for the NRC by Brookhaven National Laboratory, which is contractor analysis and not a Commission position, reviews reactor facilities that operate without main control rooms^[21]. Earlier, SECY-20-0093, an NRC staff paper rather than a Commission decision, set out policy and licensing considerations specific to micro-reactors^[8]. Both establish that the question is live inside the agency. Neither establishes an answer, and neither should be read as one.

The framing this paper adopts follows from that. The claim is not that remote operation is unsafe; this paper takes no position on that. The claim is narrower and more tractable: presence supplied evidence with four identifiable properties, and a remote model has to supply evidence with those properties by other means or accept a weaker basis for oversight. Stated that way, a governance argument becomes a design specification, which Section 2 attempts to write down.

2. Problem statement and design goals

The design problem is to reproduce the evidential properties of presence, not to reproduce presence itself. The distinction matters, because attempts to reproduce presence lead to more cameras and more telemetry, which increase the volume of operator-produced information without changing who vouches for it. Volume is not assurance. A hundred additional signals routed through the same trust path have the same trust properties as one.

We state the goals as criteria so that a proposed design can be tested against them individually rather than assessed as a whole:

A sixth property is deliberately excluded. The layer must not become a control path. Evidence flows outward; nothing flows inward. This is a constraint rather than a convenience, because an evidence channel with a write path into plant systems is a new attack surface on safety functions, and the NRC's digital instrumentation and control guidance treats new digital pathways as requiring justification^[10].

These criteria are not new individually, and this paper does not claim them as discoveries. National-laboratory work has treated the assurance burden created by reducing operator involvement as a design input rather than an afterthought: ORNL's concepts for autonomous operation of microreactors^[19] and its companion analysis of licensing challenges associated with autonomous control^[20] are laboratory technical reports rather than regulatory positions, and both frame the difficulty as one of demonstrating behaviour rather than of the control concept as such. What this paper adds is the insistence that all five criteria hold at once, and an architecture that attempts it. We have written separately about what it would take to verify an autonomous microreactor is operating safely; this paper is the structural version of that argument.

3. Defined terms, with attribution

Several words in this paper carry regulatory weight in one field and a different technical meaning in another. The definitions below are taken from the standards that define them, and are attributed on introduction so a reviewer can check the source rather than our paraphrase.

One collision deserves flagging, because it causes real confusion in mixed audiences. In the attestation literature, verification means appraisal of evidence against a policy. In nuclear software practice, verification and validation refer to a distinct discipline concerned with whether a system was built correctly and whether the right system was built. These are separate activities and neither substitutes for the other. Where this paper says verification without qualification, it means the RFC 9334 sense^[11].

A second distinction runs through the rest of the paper: attestation by the party being assessed is self-attestation, and self-attestation with a signature is still self-attestation. The signature establishes who made the statement and that it has not been altered since. It establishes nothing about whether the statement is true. We have set out the difference between self-attestation and independent verification in more accessible terms elsewhere; the architecture below exists to achieve independent verification rather than to dress self-attestation up as it.

4. The reference architecture, component by component

The architecture has five components and one consumer. None is novel. The proposal is the assembly, and the constraint that each component is instantiated by a published standard a reviewer can audit independently.

Measurement. Instrumentation produces the state record: power level, temperatures, control element positions, and the status of each safety function. This component is governed by the plant design and by the NRC's guidance on digital instrumentation and control for advanced reactors^[10]. It is also the component this architecture does not improve, a point Section 6 returns to. We have described the path from a sensor reading to a checkable attestation record in introductory terms; what follows is the same path stated as a specification.

Independent appraisal. A verifier, organisationally separate from the operator, appraises the evidence against an appraisal policy and issues an attestation result^[11]. Agreement and disagreement are both recorded. A verifier that records solely the agreements produces an advertisement.

Signing. The attestation result is signed with a digital signature scheme standardised by NIST, which approved three post-quantum standards in August 2024^[14], including FIPS 204, the module-lattice-based digital signature standard^[15]. The reason to choose a post-quantum scheme now is not urgency about quantum computers. It is criterion 5: a record that must remain checkable across a plant's service life should not be signed with an algorithm whose assumptions are expected to be revisited within that window.

Transparency log. Signed statements are registered in an append-only transparency service as defined by RFC 9943^[12]. The log's value is not storage. It is that a statement cannot be quietly withdrawn or reordered after registration without detection, provided the log is independently witnessed.

Receipt. Registration returns a receipt in the format specified by RFC 9942^[13], which a holder can check against the log's published state. This is the component that satisfies criterion 4, because it lets a party who was absent verify that a specific record existed at a specific point in the log's history.

Read down the fourth column and the architecture's honest shape appears. Each component establishes something narrow. The assembly is stronger than any component, and weaker than the sum a casual reader would assume.

5. Mapping the architecture to the regulatory context

The regulatory context is in motion, and this section describes it rather than interpreting it for anyone. The nrc's proposed 10 cfr part 57 rule (proposed, published in the federal register on may 1, 2026, comment period closed june 15, 2026, not final, and no developer is licensed under it) would establish a licensing framework for microreactors and other reactors with comparable risk profiles^[5]. Draft guidance for preparing and reviewing applications under that proposed framework was issued as NUREG-2271, a draft for comment and an NRC staff document rather than final guidance^[6]. The agency maintains a public summary of its broader microreactor regulatory activities^[7]. We have written a plain-language account of what proposed Part 57 does and does not say about autonomous operation; the point here is narrower.

Two staff papers frame the operational questions. SECY-20-0093, staff analysis and not a Commission position, addressed policy and licensing considerations for micro-reactors including operational programmes^[8]. SECY-25-0052, likewise a staff paper rather than a Commission decision, addressed nth-of-a-kind microreactor licensing and deployment considerations^[9], which is where the oversight-per-unit question becomes acute: an inspection model calibrated to a small number of large sites does not obviously transfer to a large number of small ones.

If a regulator held receipts of the kind described in Section 4, four checks become available without the operator's cooperation. Whether a record for a given unit and period exists in the log at all. Whether the record presented today matches the record registered then. Whether the verifier that appraised it was the expected party. And whether records are missing for periods when the unit was operating, which is often the more informative question. None of these requires the regulator to trust the operator, the vendor, or us.

Four caveats have to sit alongside that, and we state them because omitting them would misrepresent the position. The rule is proposed and not final: proposed Part 57 (proposed, published May 1, 2026, comment period closed June 15, 2026, not final, no developer licensed under it), so nothing here describes a compliance pathway. The NRC has not been asked to accept this architecture and has accepted nothing about it^[22]. The record is an input to inspection, not a replacement for inspection authority, and the resident inspector programme^[1][2] and the Reactor Oversight Process^[3] remain the regulator's framework rather than something a vendor record displaces. And the operator-at-controls condition in 10 CFR 50.54(m)^[4] is a current, final requirement for the licences it governs; a verification layer has no bearing on it. Safety-significant actions keep a human in the loop, and nothing in this paper supports a fully autonomous or unmanned operating model.

6. Threat and failure analysis

The architecture is tamper-evident, not tamper-proof. It is not unhackable and not unbreakable, and any description of it in those terms is describing something other than this. Tamper-evidence means an alteration made after registration is detectable by a party holding a receipt. It does not mean the alteration is prevented, and it does not mean anyone is watching. Detection without a party whose job is to look is a property nobody exercises.

Compromised or degraded sensors. This is the dominant residual risk and the honest weak point. Everything downstream of measurement operates on whatever the instrument reported. A drifted, spoofed, or replayed reading that is faithfully appraised, signed, and logged produces a durable, independently checkable record of something untrue. IAEA guidance on computer security of instrumentation and control systems at nuclear facilities treats the I&C layer as a security domain in its own right^[18], and no amount of downstream cryptography substitutes for that work. Our introductory treatment of microreactor cybersecurity as an emerging standards space covers the surrounding landscape.

The verifier as a trust anchor. The architecture relocates trust; it does not abolish it. A relying party that accepts an attestation result is trusting the verifier's appraisal policy, key custody, and independence. If the verifier is captured, funded, or staffed by the operator, criterion 3 fails while every cryptographic check still passes, which is the most dangerous failure mode in the set because it looks exactly like success.

Log operator collusion. An append-only log is append-only because independent witnesses observe its published state over time. A log whose witnesses are all operated by the same organisation as the log provides a weaker guarantee than its structure suggests. RFC 9943 defines the technical role^[12] and RFC 9942 defines the receipt^[13]; neither assigns the institutional independence that makes them meaningful.

Supply chain. Firmware, signing libraries, and hardware roots of trust reach a plant through a supply chain that is itself an attack surface. NIST SP 800-161r1 sets out cybersecurity supply chain risk management practices for systems and organisations^[16]; applying them to qualified nuclear instrumentation, where component substitution is constrained by qualification rather than by procurement preference, is unresolved work.

Cryptographic transition and availability. FIPS 204^[15] is standardised, but a record checkable for decades will outlive at least one migration, and migration of a signed historical corpus is an operational problem no standard solves. Separately, the evidence path must be allowed to fail without consequence to the plant. If loss of the verification channel can influence operations, the channel has become a control path, which Section 2 excluded by design.

7. Precedent in adjacent domains

The structural precedent is international safeguards. IAEA safeguards rest on independent verification of a state's declarations by a body outside that state, using the agency's own inspections, instruments, containment and surveillance measures, and analysis^[17]. The relevant feature for this paper is not the technology. It is the institutional shape: the party making the declaration and the party verifying it are separate by design, the verifier maintains its own measurement capability rather than relying entirely on the declarant's, and the resulting conclusions are drawn by the verifier rather than negotiated with the declarant.

The analogy has limits that must be stated, because safeguards specialists will notice them immediately. Safeguards address nuclear material accountancy for non-proliferation purposes under a distinct legal basis; they are not an operational safety oversight regime, and conclusions drawn under safeguards say nothing about whether a plant is operating safely^[17]. The architecture proposed here borrows the institutional shape and none of the legal authority. Conflating the two would be a serious error, and we are not proposing that a commercial verification record discharges any safeguards obligation.

The technical precedent sits in computing. Remote attestation formalises exactly the separation described above: an attester produces evidence about itself, a verifier appraises it, and a relying party consumes the result, with the roles specified so they can be held by different organisations^[11]. Supply chain transparency work extends this to durable records, defining a transparency service that registers signed statements in an append-only log^[12] and receipts that let a holder check registration^[13]. Those specifications were written for software supply chains, where the problem is structurally similar: a producer makes claims about an artefact, and consumers downstream need a basis for those claims that does not reduce to trusting the producer.

What neither precedent supplies is the nuclear-specific part. Safeguards practice has institutional independence and physical measurement but was not designed for continuous operational state. The attestation specifications have the record structure but assume a computing environment where the attesting device can hold a hardware root of trust, which qualified reactor instrumentation generally cannot^[18]. The gap between them is where the engineering work actually sits, and this paper does not close it.

8. Applying the framework to RankShield Energy

A paper proposing a verification architecture should apply it to its author, and the result should be unflattering if it is honest. RankShield Energy is a pre-applicant engaged in early regulatory interaction with the NRC^[22]. We hold no licence, permit, or design approval. No aspect of the HELIX microreactor has been demonstrated to or accepted by the NRC. Everything in the preceding sections is analysis and design intent, not capability.

Measured against the five criteria in Section 2, our position is as follows. Criterion 1, per-unit evidence: we have a design intent and no operating unit, so this is untested. Criterion 2, comparability: unmet in any meaningful sense, because comparability across vendors requires a schema the industry does not have and cannot be created by one participant. Criterion 3, independence of the operator: this is the one we are furthest from. A verifier organisationally distinct from the operator does not exist for our design, and standing one up is an institutional problem rather than a technical one.

Criterion 4, checkability after the fact: partially addressed in prototype form and materially weaker than this paper's specification. Our current transparency logging arrangement does not yet provide the third-party verifiability the architecture requires, and the witnesses observing our log are not independent of us. We state this plainly because a reader who assumed otherwise from the preceding sections would have been misled by our omission. Criterion 5, durability: post-quantum signing is design intent^[14][15], and we have not exercised a migration of a signed historical corpus.

Two further gaps deserve naming. We have no sensor-level attestation, which means the dominant residual risk identified in Section 6 applies to our design with full force^[18]. And our supply chain practices have not been assessed against NIST SP 800-161r1^[16] in the form that a qualified instrumentation programme would require.

The reason to publish an architecture we do not yet satisfy is that the alternative is worse. Verification designed after a fleet is deployed is verification bolted on, and bolted-on evidence is precisely the kind an outside party has least reason to trust. Publishing the specification before we meet it also creates a record against which we can be held, which is the property this paper argues reactor operations should have. The criteria in Section 2 are offered for use by anyone, including parties assessing us, and we would rather be measured against a written standard than against our own description of our progress.