Self-Attestation vs Independent Verification for Autonomous Reactors

The distinction, stated as plainly as possible

Self-attestation is a system reporting on itself. The operator runs the reactor and also produces the account of how the reactor is behaving. Independent verification adds a second party that appraises that account against evidence and records the result, where that party has no stake in the answer.

Both can be accurate. The difference is not honesty, and framing it as a trust problem about vendors misses the point. The difference is what an outside party is able to establish for themselves.

A useful test: if the operating organization went silent tomorrow, what would a regulator, insurer, or lender still be able to determine about what the reactor did last month? Under self-attestation the answer is roughly nothing, because every artifact traces back to the party being evaluated. Under independent verification the answer is bounded but real.

That gap is the entire subject of this article, and it becomes load-bearing precisely when people stop being physically present.

One clarification before going further, because it is the most common misreading of this argument. Nothing here implies that operators are untrustworthy or that vendor engineering is weak. The claim is narrower and structural: a party cannot supply the independence of its own account, however competent or honest it is. That is a property of the arrangement rather than a judgment about the people inside it.

Why self-monitoring is necessary but never sufficient

Nothing here argues against operator monitoring. A reactor cannot be run without it, and a vendor with excellent internal instrumentation is in better shape than one without. Self-monitoring detects the large majority of problems, and it detects them fastest.

What it cannot do, by construction, is catch the class of problem where the reporting path itself is the thing that is wrong. If a model is miscalibrated, a sensor drifts, or a reporting chain is compromised, the dashboard can look healthy while the underlying picture is not. There is no second party positioned to notice the discrepancy, because the only observer is the one being observed.

This is not a hypothetical failure mode invented for marketing purposes. It is the ordinary reason auditors exist in every other high-consequence domain, and the reason no serious institution accepts a self-certified financial statement as equivalent to an audited one.

Nuclear has historically solved it with people. The NRC keeps roughly 150 resident inspectors in the field, at least two at every plant, and describes their function as independently verifying that requirements are being met ^[1]. That word "independently" is doing specific work in that sentence. The inspector is not a better observer than the operator. The inspector is a differently positioned one.

Three tests that separate the two models

Independence is not a matter of intentions, and it cannot be established by assertion. It is structural, and it can be tested with three questions that a buyer can ask in a meeting.

The second row is where most systems marketed as verification actually fail. Logs that the operator can rewrite are not evidence, however well formatted. The property that matters is not that a record cannot be changed, but that it cannot be changed quietly.

The third row is the one buyers should press hardest, because it is answerable with a demonstration rather than a description. Ask what an outside party can check without the vendor participating. If the answer requires the vendor to hand something over or vouch for something, the separation is nominal.

How other high-consequence fields already solved this

Nuclear contains the precedent already, in a different problem domain. The IAEA safeguards system exists so that an outside body applies technical measures through which it can independently verify that facilities are not misused, rather than relying on a state or operator assertion ^[2]. Safeguards address non-proliferation rather than operational safety, so do not overread the analogy. But the structural insight is identical: for a claim that matters enough, the verifying party is placed outside the party being verified.

Computing formalized the same split and standardized it. RFC 9334 defines an architecture with an Attester that produces evidence, a Verifier that appraises it against an appraisal policy, and a Relying Party that acts on the Verifier's result, built on the premise that one end of a communication needs to know whether the other end is in an intended operating state ^[3].

The reason that architecture exists is worth noting: the industry that most wanted self-attestation to be sufficient concluded, after trying, that it was not. Remote attestation was developed precisely because a machine's own claim about its state is not usable by a party that has reason to care.

So the model this article argues for is not novel and we are not claiming to have invented it. It is a settled pattern in two adjacent fields, and the contribution is applying it to reactor operations, which is what verifying an autonomous microreactor actually requires.

What independence has to mean in practice

Vendors will describe many things as independent. Four properties are worth insisting on, because each closes a specific loophole.

Separation of function. The party appraising reactor state is not the party operating the reactor. Not a different team inside the same organization with the same incentives, and not a subsidiary whose budget depends on favorable results.

Completeness of the record. Disagreement is recorded as faithfully as agreement. A system that only writes a record when everything matches is not verifying, it is publishing.

Durability. The record survives the equipment and the vendor. This is why signature choices matter for records intended to outlive a reactor design cycle, and why NIST approving post-quantum signature standards in August 2024 is relevant to a nuclear conversation at all ^[4].

Checkability without cooperation. A third party can verify the record later without asking the operator for help. That is exactly what an append-only transparency service with issued receipts provides ^[5], using receipts standardized as compact cryptographic proofs of inclusion and consistency ^[6]. Assurance over the components involved sits under established federal supply-chain guidance ^[7].

Why autonomy moves this from good practice to necessity

For a staffed plant, weak evidence is partly compensated by presence. An inspector on site can form a judgment that instrumentation missed, inside an oversight process built on inspection findings and performance indicators ^[8]. The GAO has described NRC safety assurance as resting on exactly that monitoring and inspection of the most safety-significant activities ^[9].

Remove or thin that presence and the compensation goes with it. Proposed Part 57 contemplates remote operation and reduced on-site staffing ^[10], against a current requirement that a licensed operator be present at the controls at all times ^[11]. NRC staff have separately proposed operational-phase oversight built on a scalable inspection footprint ^[12].

The national laboratories have been explicit about what this disturbs. Oak Ridge found autonomous control reaches past staffing into manipulation of controls, licensed operator provisions, technical specifications, cybersecurity, and notifications, with the control room possibly not co-located with the plant ^[13]. Sandia, working for the NRC, described designs where one control room supervises multiple microreactors ^[14]. Brookhaven, also for the NRC, framed the safety question for facilities without main control rooms as verifying that important human actions can be accurately and reliably performed ^[15].

Put together: as presence decreases, the share of the safety story carried by self-report increases. Independent verification is what stops that curve from ending somewhere uncomfortable, and it is why the fleet-scale version of this problem is harder still.

There is a fair objection to all of this, and it deserves a direct answer rather than being skipped. Independent verification adds cost, adds a party, and adds latency to a system that already carries heavy regulatory overhead. For a single well-run reactor with inspectors on site, a reasonable person can argue the marginal benefit is small relative to that burden.

We think that argument is correct for exactly the case it describes, and stops being correct as soon as the model changes. The value of independence scales with two things: how consequential the claim is, and how difficult it is for an outsider to check by other means. A staffed plant with regular inspection scores low on the second. A remotely operated unit inspected on a scalable footprint scores high on both. So the cost stays roughly constant while the benefit grows, which is the opposite of the usual argument for skipping an audit layer.

The other consideration is timing. Verification designed after deployment tends to be verification bolted on, and bolted-on evidence is the kind an outside party has least reason to trust, because the system was not built to produce it. Doing it late is not merely more expensive. It produces a weaker artifact.

What this looks like applied to reactor state

Concretely, the chain has four steps. Reactor state is measured. An independent party appraises the measurements against what the operator reports and what the design permits. The appraisal is signed and written to an append-only log that returns a receipt. Later, a third party checks the receipt and the signature without needing the operator's cooperation. That is the sequence we walk through in turning reactor state into an attestation record.

The engineering preconditions are not trivial and the labs have named them: sensor and instrumentation technologies capable of long-term unattended operation, complete system state awareness, and cybersecurity appropriate to remote monitoring ^[16]. Guidance on protecting reactor instrumentation and control across its life cycle exists internationally ^[17], and the IAEA has an active research project on computer security for small modular and microreactors that names autonomous and remote operations and centralised fleet management with reduced staffing as the conditions to address ^[18].

Capability on the operations side is real and demonstrated. DOE reported that INL demonstrated a digital twin of a simulated microreactor that predicted heat pipe temperatures and then autonomously controlled the heat pipe ^[19]. The verification side is where the field is thinner, which is the honest asymmetry in this whole discussion.

Where we actually are, including us

No commercial microreactor fleet operates today, so no fleet operates under continuous independent verification either. Proposed Part 57 is a proposal whose comment period has closed and under which no developer is licensed ^[10]. Anyone presenting independent verification of reactor state as a deployed, proven capability is describing an intention.

RankShield Energy is a pre-applicant with the NRC. We hold no license, permit, or design approval, and nothing about our design has been demonstrated to or accepted by the NRC ^[20]. Verifier-operator separation is the architecture we build toward and the reason this site exists. It is not a certified capability, and we do not present it as one.

Our position, stated so it can be argued with: a vendor cannot be its own independent verifier, and this remains true of us. It is why we treat the separation as structural rather than as a feature to be added later, and the tradeoff is genuine. A separate verifier costs more, adds a party to coordinate with, and creates a body that can contradict us in public. We think that last property is the point rather than a defect.

If you are evaluating developers on this, the questions are in our vendor evaluation guide, and they should be applied to us as unsentimentally as to anyone else.