ML19284A655
| ML19284A655 | |
| Person / Time | |
|---|---|
| Site: | 07700644 |
| Issue date: | 12/19/1978 |
| From: | Michelson C Advisory Committee on Reactor Safeguards |
| To: | Mark J Advisory Committee on Reactor Safeguards |
| References | |
| ACRS-CT-1086, NUDOCS 7903150153 | |
| Download: ML19284A655 (4) | |
Text
.
' hm REQyt
" '+
UNITED STATES
[ " c v.
',S NUCLEAR REGULATORY COMMISSION
{-
/j ADVISORY COMMITTEE ON REACTOR SAFEGUARDS WASHINGTON. D. C. 20655 December 19, 1978 C[/Cb PPR L/tt/v?
MEMORANDUM FOR:
Dr. J. Carson Mark, ACRS Member FROM:
Mr. C. Michelson,
Consultant
SUBJECT:
REVIEW 0F SANDIA REPORT ON REACTOR SAFEGUARDS SYSTEM ASSESSMENT AND DESIGN (SAND 77-0644)
The subject report is divided into two volumes, the second of which contains analytical details and is classified.
I reviewed both volumes prior to preparing this letter.
Volume I contains most of the information you may wish to know, but some of the details included in Volume II were needed to answer your specific question.
Howeve r, I believe the following answer and remarks should not compromise any classified information.
As I understand your question, you would like to know if the Sandia report has identified all areas of significant vulnerability and, if these areas were suitably protected, could the plant be maintained in a safe condition despite the destruction or maloperation of other systems and components.
My answ(r to the first portion of your question is "yes", the report does appear to identify all areas of significant vulnerability.
It is more difficult to give a firm re-sponse to the second portion of your question since it is very plant specific and would require a review of the plant in greater detail than given in the report.
Howeve, I believe it can be concluded with reasonable certainty that the sui;able protection of each identified area of signific alt vulnerability will afford an acceptable degree of plant protection against an external terrorist attack which is paramilitary oriented and bent on the unsophisticated destruction of a limited number of targets.
If you wish to consider an external terrorist attack based on detailed intelligence, competent technical direction, and sophisticated target selection, manipulation, and destruction techniques, then I believe that a number of additional scenarios can be developed which would not be accounted for in the Sandia study and would leave the plant in an unsafe condition.
Having answered your specific question, I would now like to volunteer a few additional remarks and observations concerning the report and the general question which you have posed.
7903150 M.3
Dr. J. Carson Mark 1.
Identified Areas of Specific Vulnerability The Sandia study is based on the detailed consideration of a typical nuclear nowar ni nne fa-il i e" 'A i-k can ho rn,dily identified from the 3
~
/This is the same plant JTs was ' con'idered in earlier Sandia work on sabotage vulnerability and s
which was reviewed by the Sandia Workshop in 1976.
The Workshop report concluded that all areas of significant vulnerability were identified by Sandia. The current study does not appear to include any additional areas.
2.
Vital Location Analysis The Sandia study considers that where a large number of fault tree events are involved, the specific locations within which significant sabotage acts can be accomplished, can be reduced to a minimum set,the protection of which will interrupt all sequences leading to potentially useful sabotage results.
It should not be overlooked that the minimum set results from the mathematical manipulation of the fault tree equations.
If the fault trees are incomplete, there may exist other branches which could result in additions to the minimum sets requiring protection.
I recommend that additional attention should be given to assuring the adequacy and completeness of the fault trees.
In particular, attention should be directed toward fault trees based on an assumed higher level of adversary sophistication.
3.
Pault Tree Analysis Results The 250 primary events represented in the fault trees were reduced to 36 locations identified as room, compartments, or buildings. The protection of a certain 15 of these locations assures the interruption of all adversary action sequences. Although the nwnber of locations requiring protection seems small, it should be appreciated that some of these locations include one or nore floors of a building.
The net result is a requirement to protect a large portion of primary containment, the reactor, control, and diesel-generator buildings, the water intake structure, and certain other locations.
The actual area to be protected is, therefore, much larger than the small number (15) might lead you to believe.
Dr. J. Carson Mark 4.
Guard Force Engagement The probability of adversary defeat is based, in part, on the outcome of guard force engagements with the adversary.
During ecch engagenent, the adversary advancement is assumed to be interrupted.
If the adversary wins, his advancement continues.
It scens likely that certain results and conclusions given in the Sandia report could te sensitive to the engagement model used (but not included in report).
I did not review the model to de-termine its applicability to the real world of nuclear power plants and to the various physical arrangements involved in and around each engagement area. The engagement model should consider the effect on guard response of uncertainty as to the adversary objective (s), and the likelihood of diversionary or surprise actions such as fire bombing, the use of gas, door jamming, or disruption of building lighting (particularly if an insider is used). Consideration should also be given to the possibility of hostages. Perhaps it would be worth-while to discuss the engage-ment model at a future ACRS meeting.
5.
Minirum Path Analysis The Sandia study is based on the concept of selecting the minimum-time path to each critical location as the probable adversary strategy for forcible attack. This may not be the probable strategy if guard force engagement is considered likely by the adversary.
Pathways which maximize the probability of successfully deterring or eliminating the limited on-site guard force (such as by ambushing) may appear more attractive than those which conserve time but are not advantageous engagement areas.
Perhaps the guard force engagement model does not give adequate credit for this situation.
6.
Safeguards Effectiveness Model The Sandia Forcible Entry Safeguards Effectiveness Model was used (but not included in report) to evaluate the assumed safeguards system configurations. This model is based on the use of a random sample of input probability distributions representing various se-Iccted adversary attributes, the attack plan, and the characteristics of the site including its safeguards features. The program simulates
Dr. J. Carson Mark a large number of attacks along shortest-time paths with possible guard force engagement.
The program output is the probability of adversary defeat.
- he results and conclusions given in the Sandia report are based on these simulations and, therefore, are sensitive to the validity of the simulation model.
I did not review the model to determine its applicability.
Perhaps this model should also be discussed at a future ACRS meeting.
7.
Damage Control It seems unlikely to me that an adversary with the resources re-quired to take on a nuclear power plant and dedicated to its destruction would select and execute a sabotage sequence which could be countered by damage control when more effective, although perhaps more difficult, alternatives are available.
If damage control measures are used to re-doce requirements for physical protection, then consideration should be given to the protection of such measures during the sabotage sequence.
8.
Usefulness of Study A lot of developnent work remains to be done before a methodology of this type could be considered practical for routine use.
The present models appear unwieldy, but simplification may lead to a loss of use-fulness for specific safeguards determinations.
The developnent of the required fault trees for each specific plant is, in itself, a considerable task which is not presently undertaken. Although the Sandia study repre-sents a significant academic undertaking which has produced some interesting analytical tools and concepts, it appears to have very limited immediate usefulness.
It should be thoroughly reviewed before being considered as a basis for any current safeguards decisions.
i e
i 6