ML19309H494
| ML19309H494 | |
| Person / Time | |
|---|---|
| Issue date: | 03/20/1980 |
| From: | Moglewer S NRC OFFICE OF NUCLEAR MATERIAL SAFETY & SAFEGUARDS (NMSS) |
| To: | Ahearne J NRC COMMISSION (OCM) |
| Shared Package | |
| ML19309H490 | List: |
| References | |
| NUDOCS 8005130389 | |
| Download: ML19309H494 (11) | |
Text
-
~
8005180 36j yn =ec,,
a o
t UNITED STATES
!;. y$,,d/fj NUCLEAR REGULATORY COMMISSION C
WASW NCTON, D. C. 20555 g -.dif,j gad 20M MEMORANDUii FOR:
Chairman Ahearne FROM:
Sidney Moglewer Material Control and Accountability Development Branch Division of Safeguards, NMSS
SUBJECT:
CONCERNS WITH NRC RESP 0liSE TO QUESTIONS ON SAFEGUARDS FROM SENATESUBCOMMITTEEONNUCLEARREGULATION(SENATORHART)
REFEREiiCE:
(1) Memorandum from Lee V. Gossick dated February 13, 1978 on Staff Communications with Congress (2) Letter with Enclosures from Chairman Ahearne to Senator Hart dated March 5,1980.
I am using the Open Door Policy to inform you of my concerns with the NRC response to questions on safeguards from the Senate Subcommittee on Nuclear Regulation that were enclosed with your letter of liarch 5 to Senator Hart (Reference 2 above).
The. memorandum from Mr. Gossick (Reference 1 above) stated that it is incumbent on all of us to respond to Congressional inquiries promptly, responsively, and accurately and that it is essential that information provided to the Congress be presented in a fair and impartial way.
Inasmuch as I believe that several of the iiRC responses of Reference 2 were biased or unresponsive or technically in error, I feel it incumbent upon myself to bring this to your attention. Enclosed with this memo are my Comments on Responses to Specific Questions. They are confined to Section B. Material Accountino System of the original questionnaire transmitted on November 1 by Senator Hart.
The questions of Section B reflected on work that I have been professionally engaged in and on reports that I have been responsible for here at NRC.
.4h.ed.*y 7l '?t$h e, r Sidney Moglewer Senior Operations Research Analyst Material Control and Accountability Development Branch Division of Safeguards
Enclosure:
As stated cc: Commissioner Bradford l
Commissioner Gilinsky Comraissioner Hendrie Commissioner Kennedy William J. Dircks Robert F. Burnett T. S. Sherr
/R.H.Gramann
ENCLOSURE Comments on Responses to Specific Questions E.
Material Accountinc System Question 1 - On what basis has the NRC defined the " limit of error on material unaccounted for" (LEMUF) as a 95 percent confidence interval constructed around the " material unaccounted for" (MUF), after the elimination of biases (10 CFR 70.51(a)(5))? Why not define LEMUF as a 99 percent confidence interval, after the elimination of biases?
Answer - The NRC response does not answer the question.
LEID (LEMUF) is a statistical concept used to measure the variability of an estimator.
It is precisely related to the variance and the standard deviation which are common statistical measures.
ANSI Standard H15.16 defines limit of error as follows "The Limit of Error of an Estimator T is Twice the Standard Deviation of T; Ihat is, Twice the Square Root of the Variance of T.d The definition in 10 CFR 70.51(a) is:
" Limit of Error Means the Uncertainty Component Used in Constructing a 95 Percent Confidence Interval Associated with a Quantity after any Recognized Bias has been eliminated or its effect accounted for."
This is not quite the same as the ANSI definition and is open for alternative interpretations, thus it may create confusion in the calculation of LEID (LEMUF).
~
Ouestion 2 - Does this definition of LEMUF correspond to the NP.C's applied LEMuF parameter of two times the standard deviation?
How does this parameter correspond to the numerical standards for LEMUF in 10 CFR 70.51(0)(5)?
Answer - As indicated in question 1, LEMUF (LEID) may or may not correspond to two times the standard deviation, dependent upon the interpretation given to 10 CFR 70.51(a).
It depends upon the assumptions underlying the specific caiculations for a given licensee.
The limits specified in 10 CRR 70.51(e)(5) are not based.upon any statistics or analysis.
They are arcitrary in the sense of representing intuitive judgment as to what constitutes a reasonable upper bcund for LEMUF (LEID).
This provices a degree of control over the cuality of the measuring system for licensed facilities since LEMUF (LEID) is recuired not to exceed this LEMUF (LEID) limit.
Guestion 3 - Why had the NRC set the alar. threshold at two times LEMUF (or four times the standard deviation)? What chance of undetected civersions does this alarm threshold allow?
Answer - As the NRC response indicated, the alarm is set at two times the LEM0F limit and not at two times LEMUF.
This threshold (two times LEMUF limit) is not related ininy way to the statistical characteristics of the MUF (ID).
Consequently it is not an effective indicator for excessive MUF's, whether caused by diversion or out-of-control factility operations.
A statistical basis is necessary for an acceptable definitions of excessive MUF.
Since the threshold is independent of the statistical characteristics of the
1
=
2 MUF, there is a significant chance that for some licensees, diversions would not be effectively detected by the accounting information.
Furthermore the Staf f Task-Force report (NUREG-0450) and the Material Control and Accounting Rule revision efforts do not meet the above statistical objectives or
~
strategic objections based upon interaction with a potential diverter.
Statistically b'ased thresholds would have been more likely to alarm for such diversions.
Question 4 - What is the basis, statistical or otherwise, for the 9 kg alarm Inresnolo used at NSF-Erwin? How does it relate to the LEMUF definition above? What response actions does an ID exceeding this alarm threshold trigger?
Anwer - The NRC response should have emphasized that the NF.5-imposed alarms aere not baseo on any statistics e>. cept as a rough average of past facility experience.
The " consideration of the measurcrrent uncertainties involved in the fuel-making process" was not spelled out to my knowledge by any dccumented a '.a ly s i s.
hestio, 5 - Has the f;RC established other alarm thresholds? Wnat associated response actions do these other alarm thresholds trigger?
Answer - The alarm thresholds established for NFS Erwin in January 1980 again were not based upon either statistical or strategic considerations.
Tneir effectiseness in responding to a possible diversion can thus be sharp.ly questioned.
Question 6 - An NRC report on the "The Application of Game Theory tc f.uclear haterial Accounting" (NUREG CR-0490) stressed that the classical statistical nypcthesis will not permit effective detection and accurate cetermination of an unautnorized diversion.
For example, a pre set alarm threshold gives the diseater an additional piece of valuable infernation that he nay use in calculating the octimal amount of special nuclear material he can divert and still c.scid cetection.
Nevertheless, the NRC seems to rely heavily on an alternative approach in its reguiction of material accounting precederes.
(a) Wnat is the technical and scientific basis, if any, fcr the present approach? Why has the NRC relied on tne present ap rcach as a means for detecting and assessing unauthorized diversions, rather than adepting the recommendations of NUREG-CR-0490?
(b) Should the regulations require that the alarm thresnold be calculated after the inventory, and thus become a strategic variable in tne hands of the licensee?
Please fully explain your answer.
(c) To what extent should the alarm threshold also.be facility specific, so that its value depends on characteristics unique to the facility, such as physica'l barriers and the security organi ation? Please explain.
3 (d)
Do you agree with the statement in tne NUREG CR-0490 report that,
. If the defender (licensee) fellows present NRC prccedure for most facilities, he suffers a sericus penalty as compared to an cptical gamt theoretic astimate of diversion and an optimal alarm thres-hold"?
If not, why not?
If 50, what measures has *.he 'iRC taken or will 'the NRC take to eliminate tnis "cenalty"?
Answer -
(1) General.
The NRC response quotes some of the Peer Review Grcup's conclusions out of context.
Ey omission of certain major statements from NUREG/CR-0950, a misleading interpretation of the Peer Review Group report is possible.
The Peer Review Group aisc stated:
" Strategic analysis is the only mathematical tecnnique developed specifically to work out rational courses of actior, for the opposing sides in a conflict situation.
Therefore, in principle, strategic analysis is the preferrec analytical nethodology for use in making safeguards programmatic deci-sions. anc the presumpticn of success in sucn acplication is a reascnable operative workirg hypctnesis."
- p. 13.
"Because of its direct censideration of the c ti-Acversar; r
oLjective of the safegua-ds prc; ram game tneory is an especisily suitable toci for use and should na.'e bread, utility i
the safeguards prograr."
- p. 24 "Since game theory has the Dettntial f or cevel:;ing rational action criteria based upcn sccietal benefit /ccsts, the Feer Review Group feels that it scuid be a mistake at this time te incorporate into the regulations fixed quantities such as is recem enced on pages 19-21 of NJREG-0450, Report cf the Material Control and Material Accounting Task :o ce, Volume 1, in place of the current ac:ica criteria.
The Secu: bel ie'. e s su:n ccnstant values (3 'c-nela Kg. and 5 fermela q.) ce nct 6cequ6;ely reflect societa ;.ayoffs and, in pa ticular, would a pricr; limit plant size.
The Group believes the kinds of action criteria derived in NUREG-0290 better reflect societal benefit / costs than do the fixec quantities of NUREG-0450."
- p. 35.
'It is recorrmended that current regulations relative to action criteria for plant 10's not te changed in tne fashion recom-mended oy NUREG-0450 until suf ficient experience with strategic analysis or other benefit / cost analysis will have been accuT.ulated to provide clearer direction as to hcw the regulation.should be revised."
- p. 41.
{
The crinion of Peer Review Greut en fi> ed quantity alarn thresnolds.
such as hate been imposed on NF5-Er in (subsequent to tt.e i
4 publication of the Peer Review Group report), is clear from the above statements.
The NRC response ignores this critical point.
The NMSS request to RES for more work on game theory beginning in FY 81 does not meet the major recomrendations of the Peer Review G rc up'.
It is only a partial and 10. priority respense.
It shculd be ncted, in oroer to provide perspective, that from 1974 to date NRC has funded aimost twenty million collars on material centrol and accrunting technical assistance and research programs and only about two'aundred thousand dollars (inclucing the Peer Review group) on strategic analysis.
The projected RES effort is of the same order of magnitude as past game theory work.
Does NRC feel that the proposed research is responsive to tne Peer Review Group's recom-mendation:' The response to Senator Hart certainly implies this.
Current work on revision of the material control and accounting regulations does not incorporate strategic analysis, in direct contraction to a major recommendaticq of the Peer Review Group.
The NRC response to Senator Hart does nct indicate this and thus could be misleading.
With respect to the NRC response to the preamble to questien 6, certain misconceptions need to be corrected.
Whether material accounting has only a secondary rather than a primary role in detecticn of diversion is not the crucial element in the argunent.
It is both tne obligation and the esponsibility of NRC to prcvide an effective safeguards system.
Tnts we nave the implieo task to develop material accounting to its cost efficient level for detection of diversion, whether this be a primary or a seccndary role in the overall system.
Further. ore the efficiency of material contrcl and physical security in detecting diversien is not discussed in the NRC response.
Can these two systens, r.o matter how good ever provide the assurance that is unique to materiai accounting? The NRC response does r.:t consider this point.
The NF.C response does not define '*r.at is meent cy an ancmalcus situation.
Dees it include diversieni if MJF (ID) exceeding LEMUF (LEID) is considered an anomalous situation, then aLout half of all inventories by licensed facilities indicate an anonaly.
(A statistic that I have calculated indicates that there have been 375 times out of 803 inventories frem 1974 til January 1979 that MUF was greater than LEMUF.
The statistical definition of LEMUF would have only estimated about 40 times.
Clearly something is wrong.)
(b)
Soecific -
(1) The scientific justification fcr the present approach, the Task Force (NUREG-0450) recommendations, or the current staff rule formulation work is not referenced.
My understanding is that the alarm criteria recommended by the above three approaches represents a departure from accepted statistical practice and
5 does not incorporate strategic analysis principles.
Its effectiveness is thus subject to question.
(2) The NRC reply shows little understanding of the :reaning of the alarm threshold as a strategic variable.
It is to NRC's acvantage to prevent a potent al diverter from knowing t3e value of the alarm.
Even thougn a diverter may not know precisely the throughput of a f acility, he may be capable rf approximately estimating its value for a given period and use this estimate as a basis for diversion.
After all, in order to plan plant operations for the period, plant management routinely estimates the throughput.
Therefore the diverter can do the same thing (prior to precise knowledge of the specific value of the throughput.) The rule formulation efforts to my
' knowledge are not analyzing int value to NRC of preventing the diverter from having informatit.. on the alarm level.
It is my recommenoation that the alarm level be made a strategic variable.
Little change to present facility operations is required and there is little additional cost for implementation.
(3)
See remarks above.
(4) The NRC response does not face the problem.
The current NRC approach is driven by false alarm rate and does not adequately take into account undetected diversions.
For instance, as long as the ID is below the alarm levels, no investigation for a possible diversion is uncertaken.
(The presurption of the present system is that. diversions of significance tc NRC will cause the ID to exceed the alarm level.
This is not a necessary condition.
See earlier comments on the Feer Review Group statementsy The present quote of the Prer Review Grcup from the NRC response is out of context.
It :efers to a specific payoff function wnereas the qucte f'cm NUREG/CR-0490 (cf t% Congressional cues:icn) refers te a game theorct':
payof f f unction in cenei ai.
f'o"eover, the Pee-Review Group's ccnclcsion, in its original context, emphasi:EG the urgency for f t.rtner development of game tneory as the proper system to use.
Cuestien 6 - Do you agree with the " Report of the Material Control and "aterial Accc,unting Task Force" that any raterial accounting procedure shoulo oc> atie to detect, with high assorance, tne civersion of five fornula i
Lilograns of special nuclear material?
Please explain.
How do you define "high assurance"?
Answer - Tne arguments presented by the Peer Review Group report (h0 REG /
M-U%D) and the strategic analysis work (NUREG-0290 and NUREG/CR-0490) acainst fixed quantity alarm thresholds have not yet been formally responded te by staff.
The NRC response indicates further study of the issue by the "C&A rule formulation werk.
Since this is a fundamental issue for estab-lisning of effective alarms, it is incumbent upon NRC to expeditiously resolve 1
6 this issue.
It is my position that alarms not based upon tne statistical characteristics of the ID, i.e., fixed cuantity alarm levels, cannot establish just what is an excessive ID and thus offer opportunities for a potential civerter to successfully divert without detection.
Cuestien 7 - Wh'at improvemeras in traterial accounting procedures would enable cetection with "high assurance" of even smaller amounts of special nuclear material?
At what cost to the licensee?
Answer - The NRC response does not mention the requirement for an evaluation methodology and models to provide the capability to make precise probabilistic statements concerning diversion, i.e., a 90 percent probability of detection.
These are necessary for such precise statements.
The respcnse should have described NRC efforts,if any,aiong these lines.
Since it dic not, it is incomplete.
Question 8 - The report also analyzed the balance of utility and disutility inat enters into the game theory for detecting and preventing diversions.
The disutilities to the licensee are the costs of plant shutdown and inventory and of " crying wo'f."
The utilities are the benefits to the licensee of detecting diversions and recovering the diverted caterial.
Without any external NRC regulation, a licensee's decision to shut down the facility and begin recovery search operations would turn on tnis balance of utilities and disutilities.
However, the licensee's personal interes; in cetecting a diversion, especially when weighed acainst the ccst of shutdown
~
and inventory, may not necessarily correspond'to the broader national security interest in preventing diversion.
Therefore, the NRC regulates the licensee's r.aterial accounting prccedures and response actions, pursuant to the Atomic Energy Act, to protect the common defense and security.
In his report on the " Responsibility for Nuclear Security:
A Statement of Considerations," submitted to the NRC on April 20, 1978, R. A. Brightsen, Technical Advisor to the Directer of the Division of Safeguarcs, reported that NR: has tried to define a " reasonable" threat ietei that-rec. ires " industry to increase its capability to protect the :uclic, while still scing acceptable c c 4mpiecentable by the industry."
(See pages 3 and 7)
(a) This statement suggests that the NRC. in writing its regulations, has not accorded the necessary weight to the national excessive weight to.the licensee's interest in avciding the costs of shutoown and inventory.
Pleast commen. in cetail.
(b) Analyze in detail how the NRC has incorporated the national security interest into its decisions on establishing alarm inresholds and prescribing the appropriate response actions.
(c)
Please explain SRC's apparent adoption of a " reasonableness" I
standard in striking a balance between a licensee's interest anc the i
national security interest.
7 (d)
Please analyze and chronologize the past effectiveness of these thresholds and response actions in either preventing or mitigating the ef fects of unauthorized diversions.
Answer - The NRC response to the above four quc5tior.5 does not come to grips wi th the questions of how the alarm threshclos are set.
The assumptions, rationale, and methooology for doing this have not been presented; only the operational procedure is described.
Obvious ceficiencies in present procedure are not indicated in the response.
For instance, there may be a large difference between LEID and the 0.75% of plant throughput level at which a licensee has to reinventory.
An ID value in tSis range may reoresent a significant threat if it is really due to diversion.
The strategic analysis approach, in tonstrast, specifically incorporates into the payoff function tne national security risks as well as the costs to NRC and 19e licensee.
Question 9 - 10 CFR 70;51(e)(6) permits a licensee to request that its material accounting precedures meet higher limits than the nunerical standards set out in 10 CFR 70.51(e)(5).
To which licensee, if any, has the NRC grant f.his reccest for a looser standard? What higher limits has the NRC permitted?
Answer - No comment.
4 Question 10 - Many quasi public institutiens, such as universities, not only nire their owe auditors to take inventories and maintain records, out also must suDmit their records to auditors from tne responsible governmental agency for independent scrutiny.
This independent aucit provides a che:K on cctential internal biases and conflicts of interest that could cistort otherwise objective audits.
The NRC, however, seems to rely on tre licensee tc establish an acceptable material accounting procedure, perform independent audits, and conduct inventories (10 CFR 70.57).
(a)
Does the NRC audti a licensee's records and take in.erttry of the licensee's material on an indepencen. basis?
If so. what do these audits include?
How often are the. :erfcrmed?
If ret how does the NRC provide for a checi cn the auci : anc inver.tcries re-for.ed by i
the liccnsee?
(c) rio. does t,e NRC ensure that the licensee adequately trains those personnel responsible for samoling a-d measuring materials?
Arswer - No comment.
l R.estion 11 - The Brigntsen report noted that :revious NRC st;.d'es have net scuarely acdressed the fundamental question of whether or not tne public cr private sector should cear the responsibility for protection of the public ag5 inst civersions of special nuclear material.
It recommended tnat this responsibility--and especially the responsibility for n.cnning facilities with armed guards--shoulc rest with the Federal Govern,ent.
How coes this recommendaticn compare with those of the earlier NRC Special Safeguards and H :arity Force studici? Has the NRC answered this important po' icy question?
8
.'f not, why not?
If so, please analyze the cenpeting considerations that led to the decision.
Answer - ho comm'ent.
- sestion 12 - The Brightsen report recommencec that NRC implenent an interim ocolic protection program under wnich the Federal Gosernment would give directly to licensees the resources to upgrade their safeguards manpower and equipment.
In addition, the report intimated that the NRC should redefine its upper boundary threat level and its level of confidence that a safeguards system will defeat an attempt to divert or to sabotage special nuclear naterial.
(a) Has the kRC analysed these recor.encat' ens?
If not. enj not?
If so, what conciusions has it d' awn?
(b) Will the NRC implement such a inte '
cualic orctecticn program?
Jrs-er - No comment.
- cestien 13 - When one inventory reading e4Ceeds t"e alarm threshold, what sense coes it make to add to it a subsequent i.ventory reading to demonstrate ina the sum produces a figure below the ala-- tnreshold?
Please explain your a r.ss e r.
- nswer - The NRC respcnse emphasizes facit-s c
- ber inan diversicn to justify re above procedure.
This, I believe, is nct 'n tre public intarest.
The ateve procedu a can actually help a clever cistrie.
After the first
'ncentcry the civerter would know that his citersien has been detected.
By estoring some of the diverted material he car reduce the chances of detection at the second inventory.
An approach based ;;:n strategic analysis cculd have Ecuceo such deficiencies.
~
~
_aestion 14 - Even if a reading exceeds tre s se. threshold, coes the NRC assune tnat a safeguards system has beer s'fe::i.e c.erely because it has nc c: er evidence of a diversion?
Please ext'a'r i.swer - No ccccent.
t f t.estion 15 - What assumption does the NRC rakt abcut the prcoa:ility that a ci.ersicn nas occurred when the ID is bEICet tr.t alarm threshcid.
In this egard, the "Stucy of Nuclear Material Accatn 'rt" (NUREG-0453) states that
",e licer.see "Ihould never estimate zero cit e":-icr when the ID is below the alarm threshelc."
(a) Do ycu agree with that statemert?
(b)
If ycu assene that a civersion ccL c have occurrec even if the ID does not exceed the alarm threstc':, does it folloa tra; a diverter coulc regularly divert special recieir raterial in accents small enough not to trigger the alarm?
Oitase explain why cr why not?
9 (c)
If a divertcr could regularly divert special nuclear material without triggering the alarm, what cata trencs would result from such diversions? Would these trends unequivocally indicate the occurrence of regular diversions?
(c) Woold' a preiorg perioo cf suct diversions pose a serious threat to the national security? Please explain.
(e)
If sc, how coes the NRC propose to eliminate that risk?
Answer -
(a)
If the *urpose cf ID, as stated in the NRC response, is to serve as sigra:s cf ancmalous situations, then NRC has the responsibility to infcrm tne Congress that the current raterial accounting system is not functioning properly.
In actual experience since 1974 almost half the tice the ID is greater tnan the LEID whereas statistics wot.ld indicate this f requency to De less than 5*=.
ID today is nct effective for detecting system ancmalies.
On the other hand the strategic analysis approach indicates that it could be made effective, rci just for detecting systen anoms'ies, but for also providing a preliminary cetection of diversion.
In the model of NUREG/CR-D4% the estimate of diversion was used as an incex of search effort and not a final estimate of diversion.
Effective safeguarcs sncaid require that raterial accounting be brceght up to its highest attential and nct relegated to an arbitrary secor.dary role.
l (b)
In contracition to the NRC response to this questico, I quote from Regulatory G;ide 5.13 (which is stili current):
I
" Asst-ance against uncetectec loss or diversicn of special l
nuclear material can be achieved only by a measured physical
(
invento y.
Various systems of physical protection can be spic;.ec to protect against, deler, or detect thef t er diversion of special nuclear material.
Various systems of material centrol and accounting can be employed to acccunt for the caterial.
Howeier, a material balance based on a measured physical inventory that produces conclusite etidence of the physical presene of the material is the only means for assuring that the physical protection and material control and accounta-bility systems have been effective and inat nc significant losses or diversions nave gone undetected."
(c)
The NRC response does not recognize the full pctential cf the material accounting system and ID analysis for safeguards.
The suggested strategic analysis approach could be effectively applied to interpretation of cumulative ID.
In fact one of the major recommendations of the Peer Review Group was for research on multi-mose gsres which are directly applicable to this prcblem.
To
10 the best of my knowledge, at the present time, such research has not been planned or programmed by NRC.
(d) This cuestion was not answered by the NRC response.
I believe the answer is clearly yes.
(e)
The NRC program as outlinec in the response will not develop material accounting to its full capability and thus reduce tne potential effectiveness of the safeguards system.
Ouestion 16 - Please compare the physical security, material accounting, and naterial control procedures used at DOE OR D0D facilities that handle special nuclear materials with procedures used at NRC-licensed facilities.
Do these 30E/DDD procedures prevent or minimize diversions more or less effectively tran the procecures useo at licensed commercial facilities, such as the NFS-Erwin facility?
Please explain.
If more, why has the NRC not required ts licensees to adept these procedures?
Ansoer - No comment Ouestion 17 - What corsideration has the NRC given to proposals for errinating the license of those facilities currently licensed to possess strategic quantities of special nuclear material and for transferring es;cnsibility for all, or part, of their operations to DOE.
Please ciscuss i r, cetail the feasibility of such preposais.
Ar.swer - No comment.
l 1
O e