Operator documentation
Nuclear Facility Alpha — Operator Guide
Cyber-Physical Anomaly Detection System
Version: 1.0 · Audience: Facility Safety Officers & Plant Operators
This dashboard monitors your nuclear facility in real time. It watches two separate data streams simultaneously:
- Physical sensors — what is actually happening inside the facility (pump speed, temperature, pressure, vibration, etc.)
- IT network feed— what the facility's computer systems are reporting
If a cyber attack occurs, attackers can spoof the IT feed to show "Normal" while physically pushing hardware toward failure. This system detects that gap and alerts you immediately — before damage occurs.
Step 1 — Open the dashboard
Open your browser and go to the facility dashboard URL provided by your IT team. The system works on any modern browser — Chrome, Firefox, or Edge. You will see the secure application shell.
Step 2 — Log in
Enter your operator ID and secure PIN as issued by your plant manager. Do not share your credentials with anyone. Once authenticated, the dashboard loads and begins receiving live data within a few seconds.
Step 3 — Check the connection indicator
In the header and live strip, look for the SSE / telemetry live indicator with a green pulsing dot. This confirms the system is receiving real-time telemetry from the facility.
If this indicator is not green, contact your IT administrator immediately.
System status (header & live strip)
Telemetry and model state are summarized in the header badge and the live strip below it. Use them together with the Command console.
| State | Meaning | Your action |
|---|---|---|
| Green / nominal | Stream live, scores within envelope | Continue monitoring |
| Amber / elevated | Attack mode or elevated anomaly score | Watch closely; review IT vs physical charts |
| Red / breach | High divergence or model threshold | Follow incident response below |
Threat level & anomaly score
The Command dashboard shows an anomaly score derived from the Isolation Forest model (and fallbacks). Under normal conditions this stays low. If it climbs toward the configured threshold, pay close attention and cross-check physical vs IT traces.
Physical telemetry (motion, thermal, vibration)
Live bar stacks and numeric readouts reflect physical plant behaviour. Bars encode proximity to envelope — treat rapid change alongside IT divergence as high priority.
| Signal | What it measures | Example nominal band |
|---|---|---|
| Pump / RPM | Cooling / shaft speed | ≈ 1,450 – 1,510 rev/min |
| Reactor temp | Core temperature | ≈ 308 – 316 °C |
| Coolant PSI | Loop pressure | ≈ 152 – 158 bar |
| Turbine load | Generation demand | ≈ 75 – 82 % |
| Core vibration | Mechanical vibration | ≈ 0.7 – 1.0 mm/s |
| Valve / flow | Control position / flow proxy | Per plant SOP |
Green / calm bars = safe envelope. Amber = warning. Red / flashing = critical — act per procedure.
IT network feed
SCADA-style lines and the IT vs physical charts show what digital systems report. During spoofing, IT traces may remain "nominal" while physical traces diverge — that pattern is what this platform highlights.
Live charts (IT vs physical)
Physical lines track OT signals; IT (spoofed) lines track the HMI / historian path. In healthy operation they track together. If the physical trace spikes while IT stays flat, treat that as a spoofing signature and escalate.
The per-metric panels also show Δ (phys − IT) so separation is visible even when both traces look close on the primary scale.
Divergence matrix & reactor topology
The matrix summarizes channel deltas and mesh weights. The reactor topology schematic animates flow paths; breach styling on the IT edge indicates when payload or model state matches attack signatures.
Event timeline & logs
The Command chronology and the dedicated Log page capture SCADA and model events with timestamps. Use them as your contemporaneous evidence trail — export policy remains governed by your site records programme.
When the model flags an anomaly or attack mode is injected for exercise, treat the console as authoritative. The exact threshold is configured with your deployment; the UI shows live score and mode.
- Verify — Compare IT vs physical charts and the topology / matrix. Confirm divergence is not explained by approved maintenance.
- Contain— Execute your site's cyber-physical playbook (SCRAM, containment, alternate comms). This application does not replace licensed operator actions or safety systems.
- Escalate — Notify Plant Manager, Facility Security, and regulators per protocol. Prefer out-of-band voice paths if IT integrity is uncertain.
- Preserve evidence — Keep SSE sessions and log exports per legal hold instructions.
Maintenance, sensor drift, or legitimate transients can elevate scores without malicious intent. If IT and physical traces move together, suspect instrumentation before cyber. When in doubt, escalate — it is safer to over-report than to dismiss a genuine attack.
- Review the event timeline and Log for anomalies during your watch.
- Confirm relief staff are connected (green telemetry) before you leave.
- Record handoff notes per your station log (paper or approved digital system).
- Use the secure Log Out control when finished.
End of operator guide · Nuclear Facility Alpha
