ML20071P248
| ML20071P248 | |
| Person / Time | |
|---|---|
| Site: | Clinch River |
| Issue date: | 11/01/1982 |
| From: | Hammond G, Penico E ENERGY, DEPT. OF, JOINT APPLICANTS - CLINCH RIVER BREEDER REACTOR, PROJECT MANAGEMENT CORP. |
| To: | |
| Shared Package | |
| ML20071P101 | List: |
| References | |
| NUDOCS 8211020405 | |
| Download: ML20071P248 (86) | |
Text
. .
80 p Tgo conasseoW DOCKETED USHRC
'82 NOV -1 P358
- .- n ,:.:1, o UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION
)
In the Matter of )
)
UNITED STATES DEPARTMENT OF ENERGY )
)
PROJECT MANAGEMENT CORPORATION ) Docket No. 50-537
)
TENNESSEE VALLEY AUTHORITY )
)
(Clinch River Breeder Reactor Plant) )
)
APPLICANT' S DIRECT TESTIMONY CONCERNING SAFEGUARDS (NRDC CONTENTIONS 4 AND 6.b.4)
' bated: November 1, 1982 DSOT PDR ADOCK0211020405 T
05000537 021101 PDR
3 Q.l. Please state your names and af filiations.
l A.l. Edward F. Penico, Industrial Security Specialist, Project I Management Corporation. Glenn A. Hammond, Branch Chief, Technology Development and Implementation Branch, Office of Safeguards and Security, Department of Energy.
Q.2. Have you prepared statements of professional qualifications?
A.2. Yes. Copies are attached to this testimony.
Q.3. What contentions does this testimony address?
A.3. The Intervenors' contentions that this testimony addresses are:
Contention 4: "Neither Applicants nor Staff adequately analyze the health and safety consequences of acts of sabotage, terrorism or thef t directed against the CRBRP and supporting facilities, nor do they adequately analyze the programs to prevent such acts or disadvantages of any measures to be used to prevent such acts.
a) "Small quantities of plutonium can be converted into a nuclear bomb or plutonium dispersion device which if used could cause widespread death and destruction, b) " Plutonium in an easily useable form will be available in substantial quantities at the CRBR and at supporting fuel cycle facilities, c) " Analyses conducted by the Federal Government of the potential threat from terrorists, saboteurs and thieves demonstrate several credible scenarios which could result in plutonium diversion or releases of radiation (bo th purposeful and accidental) and against which no adequate safeguards have been proposed by Applicants or Staff.
3-d) " Acts of sabotage or terrorism could be the initiating cause for CDA's or other severe CRBR accidents and the probability of such acts occurring has not been analyzed in predicting the probability of a CDA."
Contention 6 b.4: "The impact of an act of sabotage, terrorism or thef t directed against the plutonium in the CRBRP f uel cycle, including the plant, is inadequately assessed (as regards environmental impact), nor is the impact of various measures intended to be used to prevent sabotage, thef t or diversions. "
Q.4. What do the Applicants understand to be the significant issues in the contentions?
A.4. NRDC has contended that the Applicants cannot propose an adequate safeguards system for, and have not analyzed the consequences of sabotage, terrorism or thef t directed at CRBRP and its supporting f uel cycle activities. In particular, NRDC alleges that plutonium in a form easily usable for a bomb or dispersion device will be available at CRBRP and supporting f acilities, and that sabotage or terrorism could be the initiating cause of a Hypothetical Core Disruptive Accident (HCDA) or other serious accidents at CRBRP. Thus, NRDC argues that the risks and costs associated with safeguards at the CRBRP and its supporting fuel cycle facilities are not adequately assessed or appropriately incorporated in the CRBRP cost-benefit analysis.
Q.5. What information will the Applicants provide in addressing the above contenti( ??
,-v--- - - -e - ,, . , , , _ - , - , , - - - - - - - , - - - - - - - - -
l
_4_
l I
A.5. In the following testimony Applicants will demonstrate that they have analyzed adequately the safeguards for CRBRP and have developed a safeguards system which will ensure that the overall risks and economic costs associated with safeguarding CRBRP will not significantly affect the CRBRP cost-benefit analysis. In particular, Applicants will show that safeguards measures will be implemented to protect against diversion or thef t of pluotnium. Also, initiation of a HCDA or other serious accident due to sabotage will be shown to be highly unlikely because of the protection derived from the design of the CRBRP reactor shutdown system, shutdown heat removal system, reactor ref ueling system, and the various elements of the plant's security system. Moreover, it will be shown that the costs associated with the saf eguards system will not significantly af fect the CRBRP cost-benefit analysis. In addition, the Applicants will P # address CRBRPs supporting fuel cycle activities to show that the additional risks and economic costs associated with safeguards for these activities are also insignificant; i.e., they will not significantly af fect i
I the CRBRP cost-benefit analysis.
Q.6. What general outline will this testimony follow?
f
A.6. This testimony will describe the basic approach that is used to provide the foundation for the development of an effective saf eguards system. A brief overview of the CRBRP f uel cycle will then be discussed. Finally, a more detailed description of saf eguards associated with CRBRP and its fuel cycle activities will be presented together with an assessment of their risks and economic costs.
Q.7. What are the safeguards objectives for CRBRP and its supporting fuel cycle activities?
1 A 7. The safeguards objectives defined for CRBRP and supporting fuel cycle activities are: (1) to deter malevolent actions directed at such facilities, (2) to prevent the success of such attempts if they occur, and (3) to minimize the potential consequences of any successful
, malevolence.
I 1
0.8. How will these objectives be achieved?
A.8. To achieve these objectives, an integrated, comprehensive safeguards system for CRBRP and its associated fuel cycle activities have been developed. The safeguards systems combine elements of physical protection, and material control and accounting (MC&A) . These elements are briefly described below:
l l
- 1. Physical protection comprises measures to deter, detect, delay, and respond to malevolent acts, and include such elements as personnel access controls, physical barriers, intrusion detection sensor's, and armed protective response and recovery forces.
- 2. Material control procedures are those measures in effect to provide surveillance and control of materials operations where and whenever special nuclear materials are being handled and processed, and include such elements as two-man rule, access controls, security seals, and surveillance.
- 3. Accountability systems comprise those systems which generate and maintain data on the location and status of special nuclear material inventories and the equipment and procedures used to verify the physical inventory of special nuclear materials through measurements.
l The goal in designing a safeguards system is to integrate these elements in a manner to assure that they reinforce each odaer's effectiveness in addressing the threat spe ctr um.
0.9. What information is used to characterize the threat
-4
_7_
l spectr um?
A.9. DOE's ongoing safeguards supporting efforts are directed to assure that the nature of the threat to nuclear f acilities are specified as accurately as possible to assist in assessing the perf ormance of an effective safeguards system.
Threat assessment is used to provide a clear picture of the potential adversaries, their capabilities and motivations, and their obj ectives. Thus, a profile is developed of the adversary which can be used to determine what capabilities a safeguards system must have to be effective against the range of credible threats.
Threat assessment is a dynamic process because the characteristics of individuals or groups that might engage in actions such as stealing or dispersing special nuclear
,' material (SNM) or committing acts of sabotage change over time. Studies are being perf ormed which: examine the motivations, resources, and other attributes of potential adversaries; identify the range of credible threats inclu'ding capabilities such as the types of weapons available; and consider the types of actions a particular adversary might choose against a nuclear target. Involved in these studies is communication with the intelligence i __ _
-g-community to identify short- and long-term changes in adversary characteristics and modes of operations. Thus, a continuing effort is made to develop a comprehensive understanding of the various motivations and capabilities of potential adversaries.
These studies provide a basis for identifying the range of threats which current or future safeguards systems might be required to counter. It should be noted that a recent study found that actions against U.S. nuclear facilities which have occurred, mostly during the last 10 years, have been relatively low level acts. Even the more violent acts in Europe, such as bombings in Spain, have largely occurred at reactors in construction. There is an important difference between low level actions which have actually occurred and those designed to produce vast casualties through sabotage or utilization of SNM. The latter would be an escalation beyond present experience.
It should be observed that potential criminal adversaries l
l such as political terrorists generally have not engaged in mass destruction. Nevertheless, the design and evaluation of saf eguards systems is approached with the assumption that the range of potential threats should be considered credible. In this regard, DOE has strongly supported the I
concept of the importance of considering a range of adversaries as opposed to a single design basis threat, as
the most fruitful approach to the development of effective saf eguards systems.
Q.10. How is the effectiveness of a safeguards system evaluated?
A.10. Considerable effort by NRC and DOE has been focused on determining method;1ogies and approaches to evaluate the ,
ef fectiveness of saf eguards systems. The general design approach utilized is to:
- 1. Select a ref erence saf eguards system;
- 2. Assess the system ef fectiveness against a range of threats by identifying specific vulnerabilities to thef t and sabotage;
- 3. Indentify modifications to upgrade the system at various points to reduce those vulnerabilities;
- 4. Assess the effect of the proposed modifications on saf eguards perf ormance and on f acility operations and l
costs;
- 5. Repeat the process in order to improve system l
effectiveness while reducing cost and operational impact; and
- 6. Implement the upgrades in the design of the safeguards system.
To assure that this iterative process will be successful, substantial efforts by both DOE and NRC have been applied
- - to develop methodologies and techniques to assist in the identification of the vulnerabilities of facilities and the evaluation of saf eguards systems. These include the use of fault tree and decision analysis techniques extensively utilized in safety analysis and various computer aided systems to evaluate facility protection plans. Another critical element is the intelligent use of judgmental techniques such as " black hatting. " In the latter, ,
personnel from various disciplines, including law enforcement and military experts, play the role of adversaries in order to identify system weaknesses. The objective of most of these techniques is to test and retest the design of the safeguards system by examining as exhaustively as possible all routes or strategies an adversary might use. The goal of this approach is the ,
identification of the widest range of vulnerabilities of the potential system. Some of these methods focus on the possible actions of the insider (s), others on assaults by
- e outsiders, and others can be used for a variety of adversary problems.
The ultimate objectives of all these ef forts are to assure that the saf eguards system is effective and the weaknesses and strengths of the safeguards and security system are comprehensively understood. This will assure necessary improvements will be made in the existing system, or new 1 l
l l
l
R&D efforts initiated as needed.
Q.11. What technologies are available or are being investigated f or use in desigining an ef fective system?
A.11. An important element of the DOE safeguards program is the development and improvement of technology for physical protection, and material control and accountability. Af ter development and testing, these technologies become available to be incorporated in the safeguards system design.
- 1. Physical Protection Over the last 6 years, there has been a concerted effort to improve the perf ormance of physical protection components, such as barriers, interior and exterior sensors to detect unauthorized intrusions, closed circuit television (CCTV) for surveillance and assessment of unusual incidents, personnel identifiers, and security force perf ormance. All of these i
developments are designed to limit the effectiveness of adversary actions.
A number of sensors, such as microwave, ultrasonic, and buried cable, have been tested and proven effective at identifying intrusions with acceptable false alarm
- - occurances. Combinations of these . technologies have been used at various commercial and government facilities.
Protection against forceful intrusion by vehicles, such as embankments and reinforced fencing, has been improved and tested. Demonstrations of a variety of barriers and sensors have been conducted at a test f acility at Sandia National Laboratories and various DOE sites. Thus, an extensive data base currently exists and is available for design, installation, operation, and maintenance of ef fective, in-depth, physical protection systems in support of the CRBRP and its fuel cycle facilities.
In addition, technology to improve the perf ormance of security forces during an incident has been developed and utilized extensively in training within the DOE system. A sophisticated system which has been used to train responce forces under conditions simulating actual combat, initially developed by the military and called the Multiple Integrated Laser Engagement System (MILES), is available.
Other development? that can improve security force response and perf ormance are the use of technologies to
improve central communication and incident evaluation.
For example, a Sandia system called Experimental Computerized Alarm Display System (ECADS) has 'been developed as a design tool to determine methods to allow an operator of an alarm station to more effectively assess an incidant. The intent of this design system is to increase the effectiveness of man-machine interaction. The ECADS system is an attempt to " human engineer" this interf ace to minimize problems during a threatening safeguards incident.
Another focus of concern is the control of access into sensitive parts of fuel cycle facilities. Reactors, reprocessing plants, plutonium storage facilities, and f uel preparation and f abrication f acilities all have sensitive areas which must be protected from sabotage or SNM losses. It is necessary to assure: (1) that only those who have a need to have access can enter
,.' these areas, (2) that contraband (such as explosives or )
weapons) cannot be brought into the area, nor SNM taken out, and (3) finally that those that have access can be monitored to detect and help prevent a hostile or malevolent act from occurring.
With regard to the control of access, not only will the current badge or card key identification systems be
- 14 _
available, but technologies that would include more sensitive indicators of identity such as hand geometry (physical dimension of the hand) are being deployed.
Other technologies will be available for application in the future. To prevent the renoval of special nuclear
~
material from a facility, or the introduction of contraband, personnel portal monitors have been developed and are now commercially available which can detect gram quantities of plutonium (unshielded), as well as metallic obj ects. Sensitive instruments have also been developed to search for nuclear materials in
- vehicles and other hiding places. Commercial explosives detectors are available and R&D is underway to further increase the detection sensitivity of such devices.
Finally, motion detectors that can monitor movements within or into or out of sensitive areas have been l
demonstrated. CCTV surveillance and assessment can also be used.
To deal with potential sabotage events involving manipulation of equipment or operational controls, tamper-indicating devices and time delays on critical components such as switches can be developed and implemented with existing technology. An alarm signal
and override control in a central location could be part of an effective system.
- 2. Material Control and Accountability Another important component of the overall safeguards system for CRBRP and its supporting fuel cycle facilities will be accounting for plutonium moving throughout the system.
One of the basic activities for material accounting is the analytic determination of the U and Pu content of various process materials. These analyses can be made by destructive means (which consume the sample) or by non-destructive means (which do not alter the sample) .
Several non-destructive assay (NDA) techniques for determing the content of uranium and plutonium have been installed and successfully tested. On-line NDA techniques are developed to give near real time l
analyses that are comparable, in precision and accuracy, to more time consuming wet chemistry methods.
Data from the instruments are fed into a computer-based accountability system. Several commercial and DOE facilities have various systems in operation.
i The generic type studies, applications and l
l l
. . demonstrations mentioned above, together with other safeguards measures in place and under evaluation at DOE facilities, will provide an increasingly extensive inventory of technology which can be drawn upon to design safeguards systems for application to CRBRP and its related fuel cycle facilites.
Q.12. The contentions question the adequacy of saf eguarding CRBRP and its supporting fuel cycle facilities. Would you
, describe the particular fuel cycle in question?
A.12. The CRBRP f uel cycle includes mixed oxide (MOX) fuel fabrication, blanket element fabrication, reprocessing, management of the wastes generated by the various facilities, transportation of wastes and products among the various facilities, and of course, the CRBRP itself. Some of the facilities required to support the CRBRP fuel cycle are not yet available; for example, a reprocessing plant
< for LMFBR fuel is still in the design stage and permanent I repositories for some of the nuclear waste have not been identified at this time. Fuel cycle activities necessary for operation of the CRBRP will not require dedicated supporting f acilities as will be shown in each individual i section. Additionally, the magnitude of the CRBRP supporting fuel cycle activities is such that they represent a small increment over current DOE and NRC-
licensed nuclear fuel cycle operations. A diagram of the CRBRP f uel cycle is shown in Figure 1.
1 l
l l
t I.
3 CRBR FUEL CYCLE
[
CORE BLANKET BLA94KET CORE DOE YET TO BE DETERMINED STORAGE FEDERAL REPOSITORY g n FUEL ASSY FABRICATION A (HANFORD, 308) E EM i
TRANSURAMC a WASTE WASTE WASTE FUEL PIN FABRICATION (HANFORD, SAF) g y
" ) H
{ REPROCESSING (DRP)
- LOW LEVEL WASTE (YET TO BE DETERMINED g URAleUM LOW LEVEL FABRICATION AND URANIUM OXIDE WASTE CONVERS!ON FACE.ITY)
DOE SITE "
BLANKET ASSEMBLY DEPLETED YET TO BE DETERMSdED FABRICATION FACE.fTY URANIUM COMMERCIAL DINEAL SITE PLUTONIUM Figure 1 I
. The plutonium for the startup and operation of the CRBRP during the 5-year demonstration period will be supplied by the DOE. Some of this plutonium may require conversion to an oxide form at a yet-to-be determined f acility prior to f uel fabrication. Transportation of the plutonium oxide l powder will be accomplished using the existing DOE Transportation Saf eguards System (TSS) .
Fabrication of the MOX fuel is planned to be perf ormed in the Secure Automated Fabrication (SAF) line which will be an integral part of the Fuels and Materials Examination Facility (FMEF) on the DOE Han-ford Reservation.
Fabrication of CRBRP f uel will require approximately 65 percent of the SAF line's capacity. Fabrication of blanket assemblies will be perf ormed by a commercial supplier.
I I The SAF line will utilize fully remote technology which will result in improved safeguards protection. This is l ,' accomplished by reducing personnel access to the SNM and incorporation of a near real-time acountability system.
The SAF line produces fuel pins containing the MOX fuel pellets. The mechanical assembly of the fuel pins into integral assemblies will be perf ormed in Building 308, also on the Hanf ord Reservation. This is an existing facility which was used for the assembly of the FFTF driver fuel and l l
has vault-like compartments for short term storage of the completed assemblies.
Transportation of the completed assemblies from Hanford to the CRBRP site will be accomplished using the DOE TSS
~
system. The fresh fuel assemblies will be enclosed in shipping containers which serve to prevent physical damage as well as to provide radiological shielding.
At the CRBRP site, the assemblies are logged into a computer-based accounting system through a unique mechanical identification system. The fuel then undergoes a visual check for mechanical damage af ter which it is inserted into the ex-vessel storage tank (EVST). Once inserted into the EVST, the assemblies are maintained in either an argon or sodium environment at elevated tenperatures (40 0 -5250F) which significantly reduces material accessibility and substantially improves safeguards protection against diversion. All fuel movement
, f rom insertion into the EVST, through insertion into the reactor core, through the decay period in the EVST af ter irradiation, and finally loading into a spent f uel shipping cask, is accomplished using automated remote equipment and does not allow for personnel access to the fuel.
Transportation of CRBRP spent fuel will be accomplished by
l rail using a specially designed cask weighing many tons.
The material is hot, both thermally and radiologically, and theref ore does not represent an attractive thef t target.
The cask / car combination will be designed in accordance with NRC and DOT regulations.
The CRBRP fuel will be reprocessed in a facility that is yet to be constructed. Several design options for this facility have been proposed, and conceptual designs have been developed:
- 1. A small facility dedicated to CRBRP and FFTF fuels with approximately 15 tons per year capacity,
- 2. A breeder fuels head-end capability add-on to an existing LWR fuels reprocessing plant, or
- 3. A multipurpose stand-alone demonstration f acility
- called the Demonstration Reprocessing Plant (DRP) with about 150 tons per year capacity.
The DRP will be capable of reprocessing currently conceived types of fuel assemblies from plutonium-fueled breeder reactors as well as from light water reactors. The conventional PUREX reprocessing process, modified as required for specific nuclear fuels, will be employed at the DRP. The uranium and plutonium products will be converted to the oxide form on-site which can then be used directly in f uel fabrication. The transportation of the j
plutonium oxide from DRP to fuel fabrication will be accomplished with the TSS system.
Q.13. Why do you believe that the CRBRP can be adequately protected against acts of thef t or sabotage?
A.13. The approach used to demonstrate that the potential risks of thef t and sabotage directed at CRBRP are low will be to consider each risk separately (i.e., thef t and sabotage) and describe design features or procedures included in the overall saf eguards program for the CRBRP. First, thef t will be considered. It will be demonstrated to be unlikely due largely to inherent and specific plant design features, specifically the f uel handling system. Second, measures taken to eliminate vulnerabilities to sabotage will be described. This will be presented in greater detail to demonstrate the depth of analysis undertaken to reduce this threat to the lowest possible level. It will also show how b < plant systems discussed above help reduce the risk. Third, a description will be provided of the various elements of the safeguards system to show how their interaction enhances overall system ef fectiveness. Four th , a l description of continuing research and development programs to support potential improvements in the saf eguards system will be presented. Finally, a discussion of costs will be presented to show that costs will be acceptably low.
1 1
I l
During this discussion it will become clear that the CRBRP design effort was not confined to merely meeting regula-tions. Rather the assumption was that if the design was correctly developed, meeting NRC regulations would be a result of that design ef fort. In essence NRC regulations become a final check-off list.
A. Theft Due to the fact that the plant will contain quantities of plutonium, thef t of this plutonium must be considered. However, the design of the plant is such that plutonium will not be available at any time in an accessible form. Plutonium which is in the plant is so inaccessible as to make thef t of the fuel a highly unlikely event. To better understand and appreciate this last statement a review of the fuel handling system is necessary.
New fuel assemblies containing Pu in the oxide form will be delivered to the plant in single assembly containers, with a truck containing as many as six containers. The truck is a Saf e Secure Transport (SST) type operated by armed couriers under DOE Transportation Saf eguards System (TSS) mana gement. The 1
. - new fuel assemblies, together with their individual containers, each weigh about three thousand pounds.
Each CRBRP f uel assembly will be 14 feet long and weigh approximately 450 pounds. These 450 pound f uel assemblies remain as assembled units during their entire use at the CRBRP plant. All normal handling operations af ter receipt and inspection are performed remorely, or with substantial shielding around the assembly.
The fuel handling system provides for replacement of -
the reactor core assemblies, including f uel, blanket, control and radial shield assemblies. The system consists of the facilities and equipment needed to accomplish the normal scheduled ref ueling operations, and all other functions incident to handling of core assemblies. These include receiving and unloadina of new core assemblies, receipt inspection, storage under i
sodium, transfer of both new and spent core assemblies between storage facilities and the reactor, transfer of core assemblies within the reactor, removal from l
storage facilities and visual examination of spent core assemblies, and preparation and loading for shipment off-site.
After receipt, inspection, and a preheating stage in the Ex-Vessel Storage Tank (EVST), the f uel assemblies are transferred to a sodium-filled core component pot in one of the storage positions in the EVST. The EVST is a large, sodium-filled tank recessed in the floor of the Reactor Service Building (RSB). There are two storage tiers of fuel and the top of the upper tier is 28 inches below the surface of the molten (400-5250F) sodium pool. Insertion and removal of fuel can only be accomplished using the renotely controlled grapple of the Ex-Vessel Transfer Machine. The grapple is key card controlled and requires individual approval by supervisory personnel for use.
While the f uel is being received, it will be under the control of both the plant guard force and the DOE TSS couriers. The DOE courier force will accompany the l
l fuel until the plant personnel have signed for receipt
( -
,' of the f uel. All of these activities will take place within the four-foot thick reinforced concrete walls of the Reactor Service' Building. Additionally all fuel handing operations are under continuous closed circuit television coverage and constant communications are maintained by guard forces.
l In summary, the large heavy fuel assemblies remain
intact the entire time dhey are in the plant. They are handled individually using remotely controlled and shielded equipment. Except for the initial inspection operations and final preparations for shipment, the fuel assemblies are at a tenperature of over 4000F in molten sodium and under an inert abnosphere. All transfers between plant locations are made while maintaining a sealed enclosure between the fuel and the working environment. Operation of the various items of handling equipment requires special knowledge and training, and an operating crew of about four or five technicians who are present during all fuel transfers.
In addition, plant operating procedures will require guards to be present whenever fuel is moved.
This type of renote, totally enclosed, and shielded fuel handling provides an extremely high degree of inherent security within the fuel handling system.
This inherent security, coupled with a. comprehensive and redundant plant security system, makes thef t of fuel a highly unlikely event.
l B. Sabotage Unlike thef t, discussed above, sabotage as an event is considered marginally possible even though it is not considered a likely event. Theref or e, a significant I
level of effort was expended, and is continuing to be expended, in the analysis of potential credible sabotage scenarios.
To establish a frame of ref erence, the NRC definition of radiological sabotage will be used and is quoted from 10 CFR Part 73 paragraph .2(p) .
" Radiological Sabotage" means any delib-erate act directed against a plant or transport in which an activity licensed pursuant to regulations in this chapter is conducted, or against a component of such plant or transport which could directly or indirectly endanger the public health and saf ety by exposure to radiation.
Using this definition as the basis for initiating an analysis, the following question regarding events of sabotage is evident. What actions could be taken to cause a release of radiation which would endanger the health and saf ety of the public? Once the answer to this question is known, the second question of importance is: what can be implemented to prevent events of sabotage?
- 1. Inherent Plant Features i In the initial analysis, the first step taken was to review the plant design. In this review, the predominate characteristic is the fortress like l
l nature of' the plant with walls up to six feet thick and many individual cells (rooms), all of which are designed for safety. An estimate is that the plant was substantially saf e from sabotage before any specific additions to the security system were considered.
In this regard, consider the following: As shown in the Applicant's testimony concerning Contentions 1, 2, and 3, excessive power generation on reduced heat renoval events without scram represent the principal accidents that, through multiple system failure, could lead to an HCDA. Multiple layers of saf eguards are available within the plant protection system and control system to preclude f ailure to scram. Access is limited to authorized personnel only.
Additionally, detailed knowledge of the design and U- < operation of the plant protection system, control l system, and hardware would be required. The plant systems are equipped with sensors which will alarm at any attempt to place the plant in an unsaf e condition. The multiple layers of controls and safeguards which have been incorporated in the plant design, and which would preclude the circumstances raised by the concern, include the l
primary and secondary plant protection system logic train panels and the manual control system.
The primary plant protection system (PPS) logic train circuit panels are separated and locked in a controlled area within a controlled building.
Unauthorized entrance to each panel will result in alarms which annunciate to the operator in the control room. Efforts to bypass the logic train circuit would result in indications of an abnormal condition to the operator, or may cause scram.
The secondary plant protection system logic train circuit panels, although in the same room, are physically separated f rom those of the primary system. Unauthorized entrance to these panels l
will result in alarms which annunciate to the operator in the control room. Efforts to defeat relays in the logic train circuits would pr6 vide indications of an abnormal condition to the operator, or may cause scram.
I The remainder of the control rod drive systems,
' excluding the control rods themselves, are located in separate rooms in yet another part of the plant. Access to the rooms containing these
1 l
l 1
l systems is controlled by card reader.
The manual control system, located in the control room, is designed with widely separated manual scram buttons. At least one reactor operator will be stationed at the control board at all times.
Unauthorized personnel are not permitted in the l
control room. The doors to the control room are locked and alarmed. This arrangement assures that operators can initiate manual scram if necessary.
I Thus, the combination of administrative and system control and saf eguards available within the plant protection systems provides multiple layers of protection to assure that the reactor will not be ;
placed in a condition enabling heat i
generation / heat removal imbalance events without l scram being initiated.
1 The plant design contains additional features l l
which made the likelihood of occurrence of excessive heat generation or reduced heat removal low. In the case of TOP events, entrance must be 1
gained to separate PPS equipment or the control !
system which are locked, alarmed and annunciated to the operators. For reduced heat renoval to be achieved by sabotage, access through separated I
locked panels and alarms would be required to override control signals.
Any modifications required to sabotage the plant protection systems would depend on the operating condition of the reactor, further complicating the task and reducing the likelihood of successful completion. Even assuming the highly unlikely initiation of a transient, depending on the configuration of the control system, the inherent plant saf ety features will serve to mitigate the consequences. Any deliberate attempt to initiate a transient would require manipulations of complex electronic / electrical circuitry. There will be little margin for error, and any mistake by an adversary could result in a reactor scram. In i addition, upon indication of abnormal conditions or alarms, the reactor could be scrammed from several remote locations and maintained in a safe shutdown condition.
Similarly, inherent plant design characteristics protect against loss of shutdown heat renoval.
The redundant, diverse coolant flow paths are well l separated and within security areas. The primary l loops are all contained in steel lined, nitrogen f
atmosphere, concrete cells. The intermediate loops, Steam Generator Auxiliary Heat Removal System (SG AHRS) components, and Direct Heat Removal Service (DHES) equipment are also within the security area. As with failure to scram, the number of actions which would have to be completed l
i sequentially in order to cause loss of shutdown heat removal resulting in a core melt without time for corrective action are such to make this an exceedingly remote possibility.
- 2. Specific security considerations Following a review of the physical layout and operation, including components of the plant, the next step was to assemble personnel who would operate the plant and personnel with plant experience at other nuclear power plants. Drawing upon the background of these individuals, paths that would normally be followed through the nuclear island during normal operation were determined. This action provided knowledge regarding traffic patterns through specific cells as well as to identify which cells would normally not be used, such as inerted cells or cells which would require entrance for maintenance purposes
only.
The same group was also used in a gaming activity called " black hatting." In this form of gaming, questions are asked of knowledgeable people, i.e.,
design engineers, operators, etc. The questions posed were related to the initiation of an event, such as an HCDA, which would result in a radiological release.
The answers obtained were evaluated and from this information a tentative security plan was develope d. Some structural design changes were made based on security principles included in the security plan. For example, no cell would have more than one entrance, which eliminated many doors. Any other doors would be emergency exits without exterior hardware.
l Using the first tentative security design, a second series of " black hatting" exercises were conducted with participants from the first exercise as well as with some new participants.
It was noted by most participants that many safeguards system improvements had been made because the participants had a more difficult time i
developing scenarios which could logically accomplish any sabotage that could induce a radioactive release. The results of this second series of " black hatting" were factored into the design of the system.
The safeguards system was then formalized so it could be put through a more comprehensive analysis.
Sandia Laboratories, which had been engaged in similar analyses regarding light water reactors, was tasked with reviewing the safeguards systems f or the CRBR Plant.
These preliminary analytical efforts, are briefly summarized as follows:
e a. Vulnerability Analysis identified combinations of events which, if initiated, could result in sabotage. This type of analysis aids in the identification of vital components.
l
- b. Location Analysis which identified the physical locations where the identified events could be initiated.
[
- c. critical Path Analysis which identified paths for adversary attack that offer the highest probability of adversary success. The preliminary design was modified based on these analyses.
Additionally, Science Applications, Inc. (SAI),
which was involved in probabilistic risk analysis for CRBRP was asked to expand its work to include potential sabotage scenarios. This was based on the fact that since any potential saboteur would have to attack the same type of systems, similar analytical techniques would be usef ul. The system was modified as a result of this analysis, but at this point only sof tware changes were required with inexpensive (15 dollars) logic modules.
Currently, Sandia is reevaluating the plant i s vulnerability to sabotage by an insider. This sabotage study uses baselined plant design descriptions. Fault tree analysis is being used to identify vital locations and components, as described earlier. The latest technology in access control and vital components and operations monitoring will be employed in addressing the l
. l insider threat.
Acts of sabotage which could initiate a HCDA or other serious accident at the CRBRP have been qualitatively analyzed and shown to be unlikely.
Acts of sabotage at the CRBRP are considered highly unlikely due to inherent features of the plant design and, secondly, due to the installation of a sophisticated security system designed and installed to complement the plant design.
t l
Q.14. In the above discussion, the plant security system was mentioned. Would you discuss this system?
A.14. The plant security system for the CRBRP provides protection against sabotage of the plant and diversion of thef t or special nuclear material. The concepts employed consider operational features, physical security system design features, and inherent safety-related features. Those features to be utilized at CRBRP are identified below.
- 1. Operational Features Selected personnel of the Tennessee Valley Authority will operate CRBRP. An important measure that will be
_ 37 _
implemented at CRBRP is the selection and retention of reliable personnel.
All plant employees will be screened for adverse character traits that might bear on their ability or motivation to discharge their duties in a responsible manner.
All plant employees will be examined by a licensed physician prior to employment. The examining physician must find that the potential employees do not display indication of anotional instability such that there is reasonable doubt they would discharge their duties in a
~
competent manner.
A security investigation also will be conducted either I prior to enployment at the CRBRP or prior to assignment to a position allowing access without escort. Such a
, security check will normally disclose adverse character traits that might bear on the enployee's abilities or motivation to discharge his duties in a responsible manner.
At the time of employment, each TVA enployee is given a National Agency Check with written inquiries routinely made to references such as former enployers, schools,
and police.
Since it is the general policy to promote and transfer present TVA employees rather than to appoint candidates f rom outside TVA, most CRBRP employees will have an established perf ormance record f rom their previous employment at other TVA generating plants.
- Psychiatric examinations will be given when an employee's perf ormance indicates that this is desirable or when an examining physician deems it necessary to enable him to determine whether or not the individual is suitable for continuation as an employee.
Observation of each plant employee's perf ormance will 4 be made as a regular part of the day-to-day continuous i
supervisory function. Supervisors will be instructed to be alert for unusual behavioral patterns, such as l may result from mental illness, alcohol, or other drug
( abuse, l
i
- 2. Physical Security Svstem Desian Features Four security areas with increasing degrees of security will be designated as follows: (1) Controlled Area; (2) Isolation Zone; (3) Protected Area and (4) Vital Areas. (See Figure 2) (
l n
4 G
8 i
l l
l l l
i po ,
e
[:
6 :-
.y mi g, f :
j W 3 f, ,, , .[ .' ,
s c .
l (g.I.
u u -
=
I '
s l _-
//
- Q .
l
~
I - '
y .
l ..
g C -
5 wz 3
.A p
.. A E
hA e
-'m
. i..
R A
A P - . -
E D a
- . R E
- L t'. -
' l-A L ,
.p D O R
g
' E 7
p T T C N O
,. - g E
C g , .
T O
R
%% 4 a 3_
R P E N
.c
- _? B W 2 O
_ -F .;
2 . . e
.~ . r
> D u
, w g k
. .c S i
,4 F
=
A 9 -- ... E y- <. , ..
R I
. , ;,) ,; E A
N l^
. ;- L O A Z
.~ .
[
.,6;(
qO
- ,n y. E 3
T I R V A
" A,.
E t ..
,"s
~
A L
. . , .,k_ ' -- C
_ .'v -
?,"
.s
yl' .
- } .
. .r C jO'
'*N'.
>' f.
'. y x .
b+ ,
. . c ,
?
T
' .,. . ., -~ ~ . ,
- . +
.e,.fi.
9 .
- g . . ,
'c ', 7. ,3 4
{ J j-<.
~
". 9 -
,,. 1, .".
'p,g l-
'_- _'. c-
- i
- ;
~ - .f,
_ ;s .
- - )f
- ,r
'?
.{
j .f .- -
i
, + . .
2
, s , - .
.'.. -f '
- 6. , .
%Q - '
. - 3
The Controlled Area which includes the owner controlled area outside the security barrier will be marked by signs or other means to ensure that persons entering
~
the area are aware they are on private property.
Patrol roads will facilitate locating and removing persons from this area when required.
The Isolation Zone which is an area straddling the fence line is cleared of all obstacles which would impede vision. It is roughly 30 feet outside and 10 feet inside the fence.
The Protected Area which is an area within the Controlled Area shall be completely enclosed by a secur4ty barrier through which controlled access is strictly enforced. All structures and components necessary for the safe operation of the CRBRP are within the protected area security barrier. Exclusion of unauthorized personnel from the protected area represents the first line of physical protection of vital equipment and special nuclear material from intruders.
Vital Areas contain vital equipment and receive maximum protection and access control. All vital areas associated with the CRBRP are located within the fenced i
and alarmed protected area.
The physical security systems associated with safeguarding the protected area include proper grading and landscaping to facilitate maximum visual and closed circuit television monitoring; lighting; security barrier fence; multiple, sectionalized intrusion-detection systems located on and along the security barrier fence; perimeter patrol road; and a closed circuit television monitoring system. These systems not only will deter threats, but also will alert personnel in the Central and Secondary Alarm Stations when an external threat exists. Notifica tion of the trained on-site and of f-site guard force and law enforcement agencies can then be conducted from either the continuously manned Central or Secondary Alarm Sta tions.
A minimum number of exterior doors will be provided for vital areas located in plant buildings and other site structures. Exterior door assemblies including hardware will be of heavy-duty type designed to l <
withstand forced entry. Exterior doors of the plant buildings will be alarmed and controlled by card-key hardware. Roof hatches will be alarmed and controlled
! by locking hardware. Roof and exterior wall l
L
l 1
I penetrations of plant buildings, like air intake and exhaust openings or other openings by which a forced entry into the building can be accomplished, will be protected with security grating to prevent such action.
Sewer pipe entrances to the protected area will be treated in a similar manner.
Access within the plant structures is strictly controlled by computer based card readers to ensure
. daat no personnel are granted unauthorized access.
This is administrative 1y supplemented by personnel screening and monitoring, a photo-identification system, escorts when required, and control of personnel traffic flow. Access through the protected area barrier is physically controlled by security guards located at the Access Control Station. Physical search will be aided by an explosives detector and a metal detector to enable detection and identification of b < explosives and firearms.
Plant employees parking f acilities will be located outside the protected area barrier. The vehicle access gate will be located within 50 feet from the gatehouse.
Full visual monitoring and physical control of the vehicle access gate, parking facilities, security barrier and isolation zones will be conducted f rom the l
gatehouse. The vehicle gate will be remotely operated by a switch located in the Access Control Station.
This will ensure that the guard who controls the gate will be protected until the vehicle is searched.
Security within the plant structures further enhances the def ense-in-depth concept. Operationally, the photo-identification system and escort system continue to ensure that only authorized personnel are allowed unescorted access to protected areas. The vital areas are separated by function (i.e., diesel, reactor, etc.). The entry controls follow the same pattern.
Very few people have access to all vital areas. Entry to vital areas is controlled by a dual computer based card reader system. Training in health physics, plant emergencies, and security procedures is a prerequisite to the issuance of a photo-identification badge. The _
location of vital equipment and special nuclear '
material has been considered in developing traffic patterns to limit access to these spaces. Also a portion of the vital equipment and systems are located in ..ierted cells and spaces not accessible during normal operation.
Access to some vital areas, however, is necessary for
operation of the plant. In these cases, access is limited to only those personnel required to carry out applicable operational procedures. Access controlled '
by a card-key access control system will continuously monitor the status of vital area doors, with status presentation at a console and printer located in both the Alarm Stations. These printers will provide information on each authorized entry or attempted use of an unauthorized card-key. This system will be equipped with audible and visual alarms in both Alarm Sta tions. Alarms will sound in the event a door remains open too long, control wiring to a door is cut, or a door is forced open.
The internal protection is further aided by plant operators who not only monitor the performance of each other, but also are alert to abnormal situations which may arise in the plant.
The timely and reliable communication of security information is essential to safeguards in that it transmits the alarms and provides the means for prompt and efficient response coordination of on-site and of f-site f orces to security threats. This communication of information is transmitted from the security hardware (perimeter intrusion alarms, door l
alarms, card-reader alarms, etc.) to both the Central Alarm Station and Secondary Alarm Station by wire.
Redundant and separate communication systems are provided both on-site, between security stations and guard force personnel, and off-site from the Central Alarm Station and Secondary Alarm Station.
Since prompt communication between the operators and security force personnel in situations requiring immediate action is important, special emergency (Duress) alarm switches will be provided at the Access Control Station, Central Alarm Station, and Secondary Alarm Station. These switches will provide notification that a security threat requiring an immediate response is present. These switches will be located and designed so that they cannot be accidentaly tripped during normal activities, t
-> The Central Alarm Station and the Secondary Alarm Station exhibit many features that are redundant. Dual computers form the heart of this system.
Additionally, a form of operation without computers is provided. The system is completed by an on-site security force that maintains guard posts and serves as a response force when required.
l
The design of the security system was facilitated by i the availability of modern computer hardware, including such devices as the card-key reader which allows controlled access by individuals, and multiplexing systems which would allow for control over a vast network of devices. The system was designed in a I modular manner so that any changes in technology, change in threat, or for any other reason, the system could be modified at little additional cost. The security system is continually reviewed for improvement as the state of the art progresses and as other potential problems are identified or plant designs are modified.
l r
- 3. Inherent Safety Related Features Saf ety-related systems and structures of CRBRP that are
, designed as Category I also directly enhance the protection capabilities. Examples of Category I design features include seismically hardened structures and seismically tested components, reinforced concrete
, walls designed to resist tornado and turbine-generated I
missiles, reactor containment / confinement, redundancy of safety-related equipment, and physical separation of l saf ety-related equipment. This design includes
provisions which not only make core related accidents resulting from sabotage unlikely and extremely difficult to achieve, but also mitigates the consequences of such unlikely accidents.
Q.15. What steps are being taken to ensure that the physical security system will be able to meet changing threats and regulatory requirements?
A.15. Consistent with the objectives and approach of the DOE Safeguards Program, the R&D Program for CRBRP safeguards is designed to support the development of an effective
, security system for the CRBRP. It will, to the maximum extent possible, support the development of a threat-independent system in a timely and cost-effective manner. Advanced analytical techniques, which were described above, will continue to be applied to the design to test the system against a wide range of threats as they may evolve. By this means, sufficient flexibility will be factored into the design to assure that an effective integrated system is in place at the time of CRBRP operation. In concert with this, the advanced design of the CRBRP system, as currently configured and as being tested by the analytical techniques, will be built around a modular concept. This will ensure from the very beginning that the system has an inherent flexibility capable of
accommodating design changes brought about by future changes in perceptions of threat or analyses of system 1
capability without significant increments of costs. As the design develops and as regulatory requirements evolve prior to CRBRP operation, the design will be reviewed and additional analyses will be conducted as appropriate.
Q.16. What are the costs associated with safeguarding CRBRP?
A.16. Current cost estimates by the Project Office indicate that I
the capital cost of engineering and installing an effective security system that meets existing regulatory requirements will be approximately $3.8 million. In addition, it should be recognized that the modular design of the security system will allow improvements to be made with small or no cost impact. This is true because the major costs in the system will be in the central system and the wiring, so any changes need only be in peripherals. For example, if, f because of an analysis, it is determined that a two man l
rule is required for a certain area, this would require no capital cost, merely a program change for that particular card reader. As another example, if analysis shows that a
( door which was planned to be locked and alarmed needed to be used on a regular basis, a simple change from alarm to card reader would only require a change of equipment at that door since wiring would serve either f unction.
t
Indeed, improvements in state of the art technology, particularly in the area of microprocessors, may well reduce capital costs. The same type of technology which has led to cost reduction in such items as pocket calculators, digital watches, and home computers is applicable here and leads to this conclusion. Thus, it is reasonable to conclude that security costs will remain relatively constant. Even if security costs double, that would only represent less than one percent of total plant Costs.
CRBRP security operating costs are estimated at under S2.5
' millicn per year during the demonstration period. Future changes should not impact heavily on operating costs.
Thus, the maximum capital and operating costs attributable to safeguards are not likely to be significant since they l
represent less than one percent of the total cost of constructing and operating the CRBRP during the five' years demonstration period.
Q.17. Let us now turn our attention to each of the supporting fuel cycle activities. What has been done to assure the risks to thef t or sabotage are minimal during CRBRP fuel fabrication?
l A.17. The following information will show that an integrated safeguards and security system is being installed which will ensure that the alleged risks to the fuel fabrication facility and its process are acceptably low, and that the cost to install such systems is relatively small. It will be shown that due to geographical location of the facility within a dedicated government reservation which has over forty years operating experience in security and handling
, of fissile materials the consequences of the hypothesized threats are minimal.
CRBRP fuel pins will be fabricated in the Secure Automated Fabrication (SAF) line to be constructed in the Fuels and Materials Examination Facility (FMEF) at DOE's Hanford Reservation in Richland, Washington.
The FMEF and SAF are protected by an integrated safeguards system composed of a material control and accountability and a physical security system. The safeguards system will meet all applicable DOE requirements and the system design is modular to allow for installation and evaluation of advanced safeguards equipment and systems.
The SAF line will be an integrated breeder fuel pin f abrication line which includes all fabrication and support f unctions. This includes all processes between receipt of
special nuclear material (SNM) and f abrication of welded fuel pins. Included in these functions are support systems for waste and scrap handling, shipping and receiving, safeguards, chemical analyses, maintenance and utilities.
The reference fuel manufacturing process is the cold-press and high tenperature sintered pellet process utilized in light water reactor (LWR) and FFTF reactor fuel supply.
Therefore, the mixed oxide (MOX) fabrication for the CRBRP does not introduce a new fabrication process to the fuel cycle.
Pu0 feed material required for operation of SAF will be 2
supplied from existing DOE inventory sources. UO2 feed materials will be supplied from existing commercial sources. The fissile materials (Pu02 ) will be transported to the FMEF from the production site by means of the DOE TSS system.
+
Fissile materials for use in SAF will be received in sealed containers f rom the SST. Seal integrity and identity verification will be made immediately upon receipt of each item. Canisters will be weighed and measured by calorimetric nondestructive assay (NDA) . Each canister will be immediately logged into the Safeguards Computer Operating System (SACOS) inventory.
The SACOS maintains complete records of all SNM in the facility. This includes near real-time inventory records, periodic reporting and audit trailing.
The SAF, for materials accountability purposes, is established as a single material balance area (MBA) . Item control areas (ICAs) are established across each discrete process step. Material transfers across processes are accomplished on a measured weight basis, and where physical changes to the material have occurred, by chemical analysis.
Storage of fissile materials will be carried out in an automated (vault within the FMEF. A computer operated stacker / retriever machine will handle movements of all materials in and out of storage locations. Within the storage area material control will be based on canister I
j.. serial numbers and cannister weights. Each time a canister enters or leaves the storage area, it will be identified by laser scanning and automatically weighed on an electronic balance interf aced to the accountability computer.
The PuO2 will be blended with UO2 and the mixed oxide (MOX)
- processed and pressed into pellets. The pellets will be i
sintered, ground to size and inserted into f uel rods. The
rods will be remotely welded, inspected for quality assurance and assembled into fuel bundles or assemblies.
The fabrication and assembly operations will take place in separate facilities. In all cases operations will be conducted in a material access area, within a security area containing other sensitive facilities and materials.
Additionally, the facilities to be utilized in MOX fabrication are either presently existing or under construction for other or shared purposes. Costs of modifications to the 308 Building, which will be used for final assembly and short-term storage, are presently
. estimated at $15M. CRBRP f uel fabrication, from a facility standpoint, does not represent a significant cost increase l to the breeder fuel cycle.
The physical protection and material control requirements are described in DOE orders. The physical protection system for a security area for both FMEF/SAF and Building 308 starts with the government owned, controlled area surrounding the protected area and the sensitive buildings.
A double chain-link fence, topped with barbed wire, surrounds the protected area. One or more access gates are provided with hardened guard posts and facilities for searching personnel, packages and authorized vehicles.
! Intrusion detectors are installed at and within the fences.
The protected area is illuminated and CCTV is provided to assess alarms. A second, hardened guard post is provided within the security area. Wire and radio communications link the guards and the guard posts to each other, to the local Operations Office and to the local law enforcement agencies. The guards are provided with communications equipment and a mix of small arms such as semi-automatic weapons and shotguns.
Individuals authorized admission to a security area are identified by picture badges indicating which buildings or material access area an individual is authorized to enter.
Additional guard posts and portal monitors insure that individual access to material access areas is authorized.
Authorization is based on the need for such access and upon selection as to competence and reliability.
The intrusion detection, entry control and internal
't f surveillance systems employ the best available components and techniques, including hand geometry identification, TV displays, electrically locked doors, computer data processing and data analysis to assist the security personnel.
The materials management and accountability functions within the FMEF and SAF are carried out on SACOS. The
1 i
computer operates in a near real-time mode through direct links to the process control computer. Data received on transfers of material between work stations, changes in form and analytical update are converted in SACOS to information forms that meet the requirements for safeguards inventory control, plant safety and DOE reporting.
All communication lines to SACOS within the facility are carried in secure wireways. Dial-up access to the system from outside sources cannot be carried out. Access to the computer is controlled by authorization levels that are positively linked to the users through hand geometry. Each category of user-process technicians, safeguards analyst or auditor is provided with access specifically tailored to their needs.
Q.18. What are the costs associated with saf eguarding the fuel fabrication for CRBRP? .
A.18. CRBRP fuel fabrication and assembly, in all instances, share facilities with other ongoing operations at Westinghouse Hanford. Only those costs directly attributed to CRBRP fuel fabrication are applicable.
The initial costs of installing additional physical security systems for the SAF line are:
1 1
l
$0.5M - entry control portals, hand geometry controls, key card controlled doors, map displays, TV monitors, alarm processors, TV switchers, video recording equipment, electrically locked doors, sensors and closed circuit TV cameras.
$0.4M - installation of the above equipment
$0.2M - software development
$1.1M - Total The annual cost of operating the SAF physical security system is estimated at 15 percent of the hardware costs for repair and maintenance, plus one additional guard per shif t
, over that required for FMEF. The guard force operates on a five shift operation. Therefore, the additional guard per shift is expected to cost $250,000 per year. The annual cost for repair and maintenance is estimated to total
$165,000.
The initial investment for the FMEF/SAF MC&A system is estimated as:
$0.5M - computer
$1.0M - software development so.5M - upgraded measurement capability for safeguards purposes
$2.0M - Total
The annual cost of operating the FMEF/SAF MC&A system assumes one shif t operation, except the sintering f urnace will continuously operate.
$150K - 15 percent of the hardware costs for repair and maintenance
$150K - computer software improvement
$200K - 2 supervisors
$480K - 8 technicians S100K - analytical services
$1.08M - Total As the CRBRP f uel cycle utilizes about 65 percent of SAF's operational schedule, only that portion of the above costs are applicable to CRBRP. Total installation costs attributable to CRBRP are $1.3M; annual operating costs are $700K.
Q.19. With regard to the transportation of fresh fuel for CRBRP, t .
3- what safeguards are being applied to reduce the risk of thef t or sabotage?
A.19. It is planned that the DOE TSS will be used for transporting fresh Mox fuel assemblies. The TSS has been designed to minimize the risks associated with the threats of sabotage and thef t. This system is discussed in the next few pages in terms of its background, transpor t
equipment, communications, couriers, and law enforcement agency liaison and response.
Since 1947, DOE and its predecessor organizations, the Atomic Energy Commission (AEC) and the Energy Research and Development Administration (ERDA), have moved nuclear materials by a variety of commercial and Government transportation modes. Those materials that require special safeguarding have always been transported in vehicles controlled and guarded by armed Federal courier escorts.
In the early 1970's, AEC started development of its first
" safe-secure trailer" (SST) for the transport of nuclear weapons and nuclear components. Design and installation of a high-fcpquency (HF) security communications (SECOM) system was also initiated to assure reliable radio contact between selected shipments and the headquarters of the Albuquerque Operations Office (ALO), the AEC of fice with
, field responsibility for the nuclear weapons programs. By the end of 1972, 10 SSTs were in operation, and the SECOM system was providing radio-voice communications for these shipments.
In 1974, ALO was directed to expand its transportation system to provide weapons-level prot ction to all AEC shipments involving significant quar. cities of SNM (SQSNM).
As of October 1976, all SQSNM was being transported by this safe and secure transportation safeguards system. Today, the system serves approximately 125 shippers / receivers of SNM and other sensitive materials at approximately 100 locations throughout the United States.
l This transportation system has been caref ully designed and continuously tested to assure a very high level of safety and security protection for nuclear materials. The system is an ef fective combination of specially designed transportation equipment, nationwide communications, and armed couriers.
~
SNM is transported in two principal modes: (1) by highway in specially constructed SSTs, and (2) by rail in safe-secure railcars (SSRs).
SSTs are constructed from shells of standard 40-foot highway trailers into " mobile vaults." The trailer is highly resistant to unauthorized entry and attack and also provides a high degree of cargo protection in the event of serious accident, including fire. The tractors that tow the SSTs provide their occupants protection against attack.
l They are equipped to initiate quick response when necessary.
l t
SSRs have been designed with essentially the same entry deterrant systems as SSTs. Thus, they are also highly resistant to unauthorized entry and attack. For more than 20 years, AEC/ERDA/ DOE have used all-steel cars designed to minimize damage in the event of an end-on collision. SSRs move in special convoys and escort coaches manned by armed couriers are part of the special trains.
Shipping containers used for the transport of SNM must meet requirements set forth in current regulations governing the packaging and transportation of radioactive material.
These requirements are specified in regulations of the Nuclear Regulator Commission (NRC) and the Department of Transportation (DOT), which are incorporated into the DOE regulations.
The degree of containment and, theref ore, the type of package required, depend on the type, form, and quantity of 1 5 nuclear material being shipped. The materials shipped in the SST are usually shipped in containers commonly referred to as " Type B" packages, which are designed to withstand severe accident damage without loss of contents and with
! minimal loss of shielding.
I i
Communications is a vital link in the system. Therefore, a computer-based SECOM provides a nationwide capability to
monitor the status and location of every shipment so that in the event of an accident, mechanical problems, or an incident of violence, the convoy can immediately notify the central communications center (SECOM control) in Albuquerque.
In addition to the hardware that has been specially designed and deployed, specialized personnel are necessary for an effective system.
A key element in DOE's first line of defense against a malevolent act is the courier force. Couriers are Federal
- officers, employees of the DOE, authorized by the Atomic Energy Act to carry firearms, including automatic weapons, in the perf ormance of their duties nationwide. Couriers are authorized to make arrests when necessary.
Armed DOE couriers guard each rail and highway shipment.
They also drive the highway tractors and the escort vehicles and operate all convoy equipment en route.
Couriers are professional, responsible individuals who have been thoroughly trained in every aspect of the job.
Af ter caref ul screening and selection, the courier trainees undergo a seven-week basic-training course, during which l _ _,_
they must pass tests on tractor-trailer driving; qualify with various weapons; meet specific physical standards; operate telecommunications systems; and become familiar with basic operating procedures. Couriers receive frequent firearms, physical, and tactical training. Advanced training includes offensive and defensive tactics with emphasis on teamwork.
The couriers carry both a photo identification card and shield which certify their Federal Officer status and their authority to carry firearins. They have been instructed to identify themselves upon request and to cooperate fully with all law enforcement of ficers in the perf ormance of their duties.
While the TSS has been designed, with procedures established and couriers trained, to provide "self-sufficiency" in the event of threat, success against
' # attack can be enhanced by employing law enforcement resources that are available everywhere throughout the United States, particularly state police and highway patrol organizations.
For the past 30 years, DOE and its predecessors have maintained liaison with state police organizations, and they have always provided valuable and timely service when
needed.
When the TSS was expanded, more formal arrangements for 1
emergency assistance were established at the state governors' level and with each state police chief.
Personal briefings are periodically given to some governors' staffs and to most state police and state police chiefs' staffs, i
In addition to participating in state and local police orientation and training programs, the Transportation Saf eguards Division (TSD) of ALO provides briefing material and a film about the DOE TSS to most state police and highway patrol organizations. The close liaison and l
training with law enforcement have proved their worth a l
number of times during situations of severe weather, equipment failures and minor emergencies.
j Because of this entire system, it is theref ore felt that the risk to the movement of CRBRP fuel from thef t and sabotage is at an acceptably low level.
Q.20. What are the costs associated with safeguarding the transportation of fresh fuel for CRBRP?
A.20. The transportation cost of CRBRP fuel will be but a small l
l l
incremental increase to the already existing transportation system. The incremental cost is expected to be less than a million dollars per year.
Q.21. What safeguards measures will be implemented during the
~
transportation of spent fuel from CRBRP to assure that the risks to sabotage or thef t are acceptable?
A.21. The transportation of irradiated (spent) fuel and blanket asr- abi.as removed f rom CRBRP represents a small incremental risk in addition to other fuel cycle operations. This risk is well recognized and DOE has substantial experience in shipping spent fuel from its various programs.
The spent fuel and blanket assemblies are hot, both radiologically and thermally, and theref ore, require special equipment for even the simplest handling operations. The material is highly unattractive as a target for the thef t of plutonium, since chemical and mechanical operations requiring expensive complex facilities and equipment are needed to reduce it to a usable' form. Moreover, without special shielding, radiation doses to individuals trying to work with unshielded or poorly shielded spent assemblies would be life threatening.
In transit, spent assemblies would be protected in large casks weighing many tons to minimize radiation. Irradiated assemblies would be contained in a removable canister inserted in the cask. The casks will be designed to be l
transported on a 100-ton capacity railroad flatcar. The cask / car combination will be designed in accordance with DOT and NRC Regulations, which include provision for crash protection and passive cooling capability. These protection elements, while designed to enable the irradiated assemblies to withstand a crash, also provide substantial protection against sabotage. Casks designed to carry LWR spent fuel have been shown through experiment to provide significant protection from credible, intentional destructive acts. Experiments have shown that these casks do limit consequences of intentional acts to levels considerably less than those dhat had been previously estimated using conservative engineering judgment and to
/ levels that are less than the consequences of the explosive blast associated with the malevolent act.
It is likely that the CRBRP spent fuel casks will be even more massive and difficult to penetrate than LWR casks. In any case, since the spent assemblies will be owned and shipped by the Department of Energy, the CRBRP spent f uel shipments will be subject to appropriate physical 1
l
protection requirements. The purpose of these requirements in to minimize the chances of a successf ul, intentional ,
destructive act.
Q.22. What are the costs associated with safeguarding the spent fuel from CRBRP?
a A.22. The safeguards cost of the additional protective equipment and personnel will be insignificant in relation to overall plant cost for the fourteen shipments needed per year.
Q.23. What safeguards measures will be implemented during th'e reprocessing of spent fuel discharged from the CRBRP to ensure the risks to thef t or sabotage are acceptable?
A.23. The reprocessing of spent fuel discharged f rom the CRBRP is expected to occur in the DOE's proposed DRP. Extensive conceptual designs have been developed at Oak Ridge
- # National Laboratory for this plant. Approximately 12 MT of fuel materials will be discharged annually from the CRBRP, and this amount repreannha about 8 percent of the planned capacity of the nsi 'he remaining capacity will be used for reprocessing icsa. Irom other reactors such as the FFTF and LWR's. The detailed activities involved in l
l reprocessing CRBR fuels and other fuels in the DRP are very similar to ongoing activities in exicting nuclear
facilities in the U.S. and would, theref ore, be expected to
- pose similar small safeguard risks. By carefully examining planned reprocessing activities for CRBRP spent fuels in the DRP, the safeguards implications can be identified and appropri.cte safeguards measures can be described including impacts of DRP design features. Also, an assessment can be made of the safeguards cost attributable to CRBRP spent f uels in the DRP.
The spent fuel assemblies shipped from the CRBRP to the DRP l will be highly radioactive and have higher decay heating rates than LWR fuels. Like other highly radioactive fuels,
- the CRBRP spent fuel is not considered to be an attractive thef t target in spite of its relatively high Pu content.
The high radioactivity necessitates some special handling during cask unloading at the DRP, but these activities are done in a secure remotely operated fuel receiving cell and do not result in significant safeguards risks. Each fuel assembly removed from the cask will be renotely examined to verify its identity and will be subjected to item accounting. NDA will be made to determine the approximate fissile content and radiation signature characteristics.
The fuel assemblies will be stored in a remotely operated pool where continuous surveillance is provi~ded to detect unauthorized f uel movements. Due to the generally hostile
environment and extensive surveillance in the fuel receipt area, fuel thef t and sabotage are highly unlikely. In addition, the massive containment associated with the remote design features tend to mitigate the possible consequences of sabotage.
As the fuel assemblies are removed from storage and mechanically prepared (chopped) for processing, thei r physical Ictm is changed so that item accounting is no longer applicable. The chemical form of the fuel is also changed as the fuel is dissolved into nitric acid prior to transfer into the chemical separations part of the plant.
The variety of physical and chemical forms of fuel materials in the traditional chop-leach area of the reprocessing plant has several safeguards implications.
Since the f uel assemblies will lose their unique identification when they are mechanically disassembled, monitoring of operational activities in the head-end area
< is done to assure that all the fuel received is correctly transferred to the chemical separations area. The ese of non-destructive assay on fuel assemblies provides valuable estimates of fuel inventories in the spent fuel receipt area.
The chopped fuel which enters the dissolver can leave the dissolver by only four means:
- 1. Normally as a highly radioactive nitrate solution which is transferred to the feed preparation components upstream of the chemical separation area;
- 2. As undissolved " fines" which can travel with the nitrate solution and are removed as sludge in the feed clarification step;
- 3. As undissolved fuel which remain in the hulls and can be discarded as waste or recycled through a secondary dissolver; and
- 4. As an abnormal constituent in an off-gas or discharge
~
stream due to a component failure.
By caref ully monitoring the dissolver operations and by perf orming appropriate analyses on the discharged hulls and clarification sludge, a diversion from the chop-leach can be detected with high assurance.
/
The dissolved f uel is transferred f rom the chop-leach area into the accurately calibrated input account-ability tank where an accurate input determination of SNM is made.
Although the high radiation levels and high Pu content of CRBRP spent fuels complicates their input measurement, analytic techniques are available which provide SNM concentration accuracies comparable to those for other i
y r _ . , -- . - , - . - - ,
,.m-- - --
reactor fuels.
In the chemical separations area of the reprocessing plant, the plutonium can be partitioned from the uranium and fission products. There are numerous process vessels and
~
flow paths from which this material may be accessed.
Therefore, extensive monitoring of the process operations and containment penetrations will be necessary to detect diversions and related process anomalies.
The product of the chemical separations area will be a fuel bearing nitrate solution which must be converted to an oxide form for further use in the fuel cycle. The nitrate-to-oxide conversion will be accomplished in the product 4(en of the reprocessing plant. The conversion from liquid form to solid form and subsequent loading into sealable containers will require close monitoring to detect material diversions.
Up to this point, the reprocessing activities for CRBRP fuels are essentially identical to the activities that could be used for other fuels, and the safeguards risks are correspondingly similar. In fact, most of these activities are routinely accomplished today for similar amounts of other reactor fuels in operating f acilities. The needed monitoring techniques and analytic methods exist, or are l
being developed, to permit very effective safeguards for this area.
The DRP will have some general features that can have significant safeguards implications. The economic incentives f or high operating ef ficiency will cause extensive use of process instrumentation, and that same i
instrumentation can provide valuable information for various safeguards measures. Also, the trend toward increasingly stringent radiological exposure limits for both the operating personnel and the general public has caused a much greater reliance on remote operations and maintenance concepts. The remote design concepts use the biological shields to provide maximum separation of personnel and nuclear materials; indirect access to the I
materials is achieved with manipulator and crane systems.
By minimizing direct access to materials and providing an opportunity to monitor the manipulator and crane systems,
/ the remote design concepts will reduce the opportunity for sabotage acts involving nuclear fuel and will enhance diversion detection capabilities.
l The DRP's physical protection system is designed to protect nuclear materials from thef t or diversion through the use of access and egress controls and physical barriers, detect attempts at thef t or diversion through the use of l
l L _ . _ . . .- . -
surveillance measures and alarm systems, and respond to attempts at thef t or diversion through the use of on-site security personnel and of f-site law enforcement assistance.
The physical protection system design includes the following safeguards elements: SNM isolation features, portal SNM contraband detection components, forcible entry detection components, covert entry detection components, damage control procedures, communications systems, armed response forces, and personnel surveillance. Each of these physical protection systems elements is an integral component of the entry-control and intrusion detection subsystems, and the safeguards response and control system.
Design basis criteria and guidelines for these subsystems have beed prepared.
The increased reliance on advanced safeguards concepts in future reprocessing plants will be possible due to the successful development efforts.
An accounting strategy called near-real-time accounting (NRTA) has been extensively developed and limited demonstrations have been conducted. Recent demonstrations at the Barnwell Nuclear Fuel Plant (BNFP) have clearly shown that NRTA can significantly increase the sensitivity and timeliness of diversion detection relative to
conventional accounting.
Process monitoring is a material control strategy designed to use standard process control data to provide expanded safeguards protection of nuclear fuel cycle facilities.
The methodology identifies process events by recognizing significant patterns of changes in on-line measurements.
The goals of process monitoring are to detect diversions of nuclear material and to provide information about process status usef ul to other facility saf eguards operations.
Process monitoring demonstrations, which have been conducted at the BNFP, established the feasibility of the
- concept. The process monitoring concept is being expanded and f urther demonstrations are planned.
Penetration monitoring is a material control strategy that involves monitoring penetrations of containment boundaries to detect anomalous movements of material through the boundaries. The concept has been extensively developed and documented, and one detailed study was done for a conceptual plant design. However, no large-scale demonstrations have been conducted. This concept is receiving a large amount of attention for international applications.
A safeguards concept has been proposed for monitoring
selected operational and maintenance equipment and, in some cases, operating personnel as a means of obtaining saf eguards information. This concept is in a preliminary stage of development and appears to be especially usef ul for remotely operated and maintained plants.
Each of the safeguards measures which can be used in reprocessing plants involves large amounts of data and requires complex decision analyses. Consequently, future safeguards systems for reprocessing plants will necessarily rely on extensive use of computers, and considerable ef fort will be required to achieve the reliability and security needed for safeguards applications. Also, many of the instruments which may be needed for some of the safeguards measures are not fully developed, and additional effort is r equired.
Any realistic considerations of the effectiveness of fuel cycle safeguards for CRBRP fuels must be based on the amount of special nuclear material involved. Approximately 12 metric tons of uranium-plutonium fuels will be recycled annually in support of the CRBRP; the plutonium portion of i
this recycle should be about 3 metric tons annually. Since the inventory holdup in fuel cycle facilities is usually less than the annual throughput, the reprocessing f acility will usually have less than 3 metric tons of CRBRP i
i
! plutonium inventory. To obtain some perspective on this l
quantity of plutonium, consider that the operating uranium-fueled reactors in the U.S. produce and discharge 5 to 10 times as much plutonium annually as the 3 metric tons annually discharged f rom the CRBRP. Also, very much larger amounts of plutonium are used in U.S. military programs, and this plutonium is effectively safeguarded. Therefore, the plutonium associated with the CRBRP represents a small incremental increase in the total plutonium inventory existing in the U.S. and poses no substantial unique risk.
Q.24. What are the costs associated with safeguarding the reprocessing of spent f uel from CRBRP?
A.24. Since the DRP has not been developed beyond the conceptual design stage, detailed cost estimates have not been made.
However, other documented designs for advanced fuel cycle l
l f acilities report initial capital costs for saf eguards
,' systems to be about 5 percent of the total plant costs.
Therefore, the projected one billion dollar plant cost for DRP suggests that an estimate for the DRP safeguards system initial cost would be about 50 million dollars. By using reported data for existing saf eguards systems, the annual operating costs appear to be in the range of 15 to 25 percent of the initial capital cost for the safeguards system. On this basis, the operating costs for the DRP
saf eguards system will not exceed $12.5 million annually.
Since the reprocessing of CRBRP spent fuel uses only 8% of the DRP's capacity, the pro-rate cost of safeguarding CRBR fuel in the DRP would be about 4 million dollars for the initial capital costs and about 1.1 million dollars for annual operating costs. These costs are approximately the same magnitude as the cests associated with safeguarding CRBRP fuels in the plant. If the facility option selected for reprocessing of CRBRP fuels is a low throughput dedicated facility, ef fective safeguards can be applied at costs comparable to the pro-rata costs described anove.
Q.25. What saf eguards measures will be implemented to assure the risk to tpef t or sabotage of the radioactive wastes from CRBRP f uel will be acceptable?
A.25. Because of the low concentration of plutonium and uranium in radioactive wastes, wastes are not considered attractive for thef t. High level wastes do contain substantial radioactive material, and thus could be a target for sabotage.
However, there are certain inherent safeguards features within radioactive waste handling and management procedures. High level radioactive waste (HLW) will be l
stored within the physical security bounds of the reprocessing plant prior to shipment. Due to the relatively high radioactivity and thermal output associated with HLW, transport to a repository will be accomplished in a fashion similar to the transportation of spent fuel. The high level waste will be shipped in a heavily shielded cask which will be resistant to penetracion for sabotage.
Safeguard requirements should also be the same as those used for spent fuel.
At the repository, the physical security of the site as well as the remote location of the wastes deep underground should effectively deter diversion. The requirements for protection against sabotage should be determined by NRC since this will be a licensed f acility.
i Transuranic and low level wastes will be packaged in DOT approved shipping containers and transported f rom points of
,' origin to dicposal facilities, where they will be handled within existing physical security systems.
Q.26. What are the costs associated with saf eguarding the radioactive wastes from the CRBRP f uel?
A.26. Overall, the costs of adequate safeguards to reduce risk should be small and not af fect the cost-benefit ratio.
. . i s.
1 I
Q.27. Would you summarize this testimony?
A.27. The Intervenors have contended that Applicants have neither analyzed the consequences of sabotage, terrorism or thef t
[ directed at CRBRP and its supporting f uel cycle activities, nor have they adequately assessed the risks and costs in the cost-benefit analysis. It is the Applicant's position that this testimony demonstrates that this contention is not substantiated by the facts. The Applicants have shown that acts of sabotage, terrorism or thef t have been adequately analyzed and that they will continue to be analyzed in the future. Present and future safeguards
, requirements provide, and will continue to provide, a high i
degree oft assurance that such acts will not be successful in causing serious consequences for society, nor will the risks and costs of safeguards be unacceptable. As noted in the discussion above, CRBRP and its supporting facilities
- e and transportation links are not unique. They are similar to other power reactors and DOE production and transportation activities. Theref ore, given this combination of operating experience, and safeguards planning and technology development, the Applicants are confident that the risks and costs of safeguards will not be excessive and unacceptable, and will not significantly change the CRBRP cost-benefit ratio.
Clemmary i ALO Albuquerque Operations Office Applicants Tennessee Valley Authority (TVA) , U.S.
Department of Energy (DOE) , and the Project Management Corporation (PMC)
BNFP Barnwell Nuclear Fuel Plant CCTV Closed Circuit Television CRBRP Clinch River Breeder Reactor Plant DHRS Direct Heat Removal Service DRP Demonstration Reprocessing Plant
. ECADS Experimental Computerized Alarm Display System EVST Ex-vessel Storage Tank FFTF Fast Flux Test Facility, a liquid metal cooled f ast reactor owned by the DOE and located on the Hanford Reservation FMEF Fuels and Materials Examination Facility HCDA Hypothetical Core Disruptive Accident HLW High Level Waste l ICA Item Control Area LMFBR Liquid Metal Fast Breeder Reactor MBA Material Balance Area HC&A Material Control and Accountancy MOX Mixed-Oxide NDA Nondestructive Assay
NRTA Near-Real-Time Accounting PPS Plant Protection System R&D Research and Development RSB Reactor Service Building SACOS Saf eguards Computer Operating System SAF Secure Automated Fabrication Safeguards In this testimony, safeguards is defined as physical security, material control and material accountancy SGAHRJ Steam Generatory Auxiliary Heat Removal System SNM Special Nuclear Material SQSNM Significant Quantitites of Special Nuclear Material SST Safe Secure Trailer TSD Transportation Safeguards Division TSS Transportation Safeguards System
~ r
~
STATEMENT OF QUALIFICATIONS Col. Edward F. Penico Industrial Security Specialist I received a B.A. and M.A. in Psychology from the Un'iversity of Pennsylvania in 1950 and 1951, respectively.
From 1951 until 1976 I was an officer in the United States Marine Corps. I retired as a Colonel during 1976. In thi.s capacity I held several positions in which security was my primary assignment.
- 1. From 1962 through 1964 I was in charge of all security for U.S. embassies in Asia and the Pacific, fifteen embassies in all.
- 2. From 1973 through my retirement in 1976 I was in charge of
,' Physical Security for the Department of the Navy. In that capacity I was instrumental in developing the techniques adopted by the Department of Defense for the protection of nuclear weapons, and personally designed the security for all Navy nuclear weapons storage sites, and the Navy's weapon transportation system. I also sat as a member of all i
interdepartmental steering committees on defense against the l 1
terrorist threat (i.e., DOD, NRC, ERDA, DNA, et al.).
._. _ _ _ _ _ . - . _ _ . _ . _ _ _ ~ _ _ _ _ _ _ _ _ _ _ . . . _ . . _ _ _ _ _ _ _ _ _
l Additionally, as part of my career development, I was required to develop expertise in the areas of electronics and computers through a variety of service schools.
In August of 1976 I was appointed to the position of industrial security specialist for the CRBRP Project Office. In
~
this position I was responsible for developing the overall security system and plan for the CRBRP.
In 1980 I opened my own consulting firm which has expanded my security background even further. Work as been accomplished with fabrication facilities, guard companies, and Sandia. Also, I teach several seminars a year on nuclear security.
I f
l
STATEMENT OF QUALIFICATIONS l
l Glenn A. Hammond Chief, Technology Development and Implementation Branch Office of Safeguards and Security U.S. Department of Energy Washington, DC 20545 I received a Bachelor of Science degree in chemistry with minors in mathematics and physics from East Tennessee State University in 1956.
Following graduation, I joined the Atomic Energy Commission in 1956 as a technical intern in the Production Division, Oak Ridge Operations Office. From 1956 to 1961, I had responsibilities in the technical analysis of nuclear materials production and on-site quality assurance programs; and for l review, evaluation and on-site inspection of methods and procedures for measurements and safeguards. I also completed the Suclear Safety Training School at the Oak Ridge School of Reactor Technology and, af ter transferring to AEC Headquarters in Washington in 1961, completed graduate-level courses in nuclear reactors and operations research.
From 1961 to 1973, I served as physical scientist at AEC Headquarters in development and administration of policies, procedures and standards for the U.S. nuclear materials saf eguards programs; and perf ormed field evaluations of
I implementation practices. )
From 1973 to 1979, I was Chief of three branches in safeguards and security during successive reorganizations from
~
AEC to the Energy Research and Development Administration to the current Department of Energy. In these positions, I was responsible for research and development programs to improve or establish technology and systems for nuclear materials safeguards. These programs resulted in major advancements in conceptual designs, diversion path analysis methods, near-real-time systems and supporting measurements and nondestructive assay technology. For exanple, a safeguards conceptual-design for mixed oxide (MOX) processing was completed during this period and serves as a basis for the designs at the FMEF.
From 1979 to 1981, I was Chief, International Support Branch in DOE's Office of Safeguards and Security with responsibilities for research and development in safeguards approaches and technology to improve the effectiveness of
- international safeguards in support of U.S. nonproliferation and national security objectives. Major projects included technology and systems for uranium enrichment and spent fuel reprocessing plants; and direct technical support to the International Atomic Energy Agency, Vienna, Austria.
Since late 1981, I have been in my current position of Chief, Technology Development and Implementaton Branch, DOE's Office of Safeguards and Security with responsibilities for 1
.l
1 f '
development, test and evaluation of physical security, materials control and accountability components and systems required to ,
ensure protection of DOE nuclear materials and facilities. These DOE-sponsored programs are carried out primarily by the national laboratories such as Los Alamos and Sandia. Projects include identification of deficiencies at DOE production facilities, development of advanced integrated systems designed to meet site-specific needs and assist field managers in application; and concepts and advanced hardware and systems for implementation at new facilities such as FFTF, FMEF, CRBRP, and proposed design options for reprocessing facilities such as the Demonstration Reprocessing Plant (DRP).
~
l t
l l
I
. _ _