ML20206A599
| ML20206A599 | |
| Person / Time | |
|---|---|
| Issue date: | 03/31/1987 |
| From: | Emeigh C NRC OFFICE OF NUCLEAR MATERIAL SAFETY & SAFEGUARDS (NMSS) |
| To: | |
| References | |
| FRN-52FR10033 AA50-2-032, AA50-2-32, NUREG-1280, NUDOCS 8704080097 | |
| Download: ML20206A599 (102) | |
Text
-
g;
,;~
.s L iStandard Format and Content L LAcceptanceECriteria for the.
Material ControleandJAccounting (MC&A)
Reform Amendment l
o
-10 CFR Part 74 i
- Subpart E l
l l
U.S. Nuclear Regulatory
. Commission Office of Nuclear Material Safety and Safeguards l
l.
p* **otiq s
4;
%,..v /
l roj4 gggje70331 12BO-R pop
w,5 w
7 w
a
=
h: =.,,
r
.x.
a w-
.e g>
. y<
.m-0
__ l
", ^
y y
- ~
S N2 s
k.
[,
^
^
s"
~
Qf ' n. +3 ; x'
.L
^
M%
, b U"
[~'+
~
--f' f
~
~
.~
~>
W.
Ly 1
u 3+
^s%
+m
^
r M +M M thy..
V-w
?
J
~;
,g 2,
n
$, 4*,
'+
NOTICE >
~$
y e
3 s
ner
. ~.
J-
- c. -
ms JAvailability of Reference Materials Cited in NRC PublicationsD
~
. a.
s 4
' Most documents Siked in N RC publications will be avaliable from one of the following scurces:. _?
g
=; i
- +.
~
711:The NRC Public Document Room,'1717 H Street, N.WJ
?C
~
(Washington lDC 20666
+
w m
~
'y, -
32.EThe' Superintendent of Documents, U.S. Government Printing Office, P5st Office Box'37082,
. Washington, DC 20013-7082 '
'4 S E m
y.
k1 ~
' 3.' iThe National Technical thformation Servica,' Springfield, VA 221611 -
~
c ~,
Although the 1isting that follows represents the majority of documents cited in NRC puSlications,
~
- % '. u-zit is not intended 'to be exhaustive.
9:~
Referenced documents available,forlinspection and copying for a fee from thA NRC Public Docu-1, s ment Room include NRC correspondence and internal NRC memoranda; NRC Office of Inspection "
m andl Enforcement bulletins,' circulars, info mation' notices, inspection' a'nd investigation' notices:
1 Lisensee Event Reports; vendor reports and correspondence; Commission papers; and applicant and -
F #
J licensee' documents and correspondence.
~
~
q
.The following ' documents in the NUREG series are available for purchase from the GPO Sales-J
- Program: formal NRC staff and contractor reports, NRC-sponsored conference proceedings, and.
1NRC booklets and brochures. Also available are Regulatory Guides, NRC regulations in the Code of '
Federal Regulations, and NucArar Regulatory Commission issuances.
fif
_ DocumentsLavailable ?from the National Technical Information Service include NUREG series:
reports and technical reports prepared by other federal agencies and reports prepared by the Atomic -
Energy Commission, forerunner agency to the Nuclear Regulatory Commission.'
!r,
Documents available from public and special technical libraries include all open literature items, l"
such as books, journal and periodical articles, and transactions. Federal Register notices, federal and state legislation, and congressional reports can usually be obtained from these libraries.
Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference p
proceedings are available for purchase from the organization sponsoring the publication cited.
Single copies of NRC draft reports are available free, to the extent of supply, upon written request u
to the Division of Technical Information and Document Control, U.S.' Nuclear Regulatory Com-mission, Washington, DC 20555.
c Copies of industry codes and standards used in a substantive manner in the NRC regulatory process are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, and are available
,j
-there for reference use by the public. Codes and standards are usually copyrighted and may be purchased from the originating organization or, if they are American National Standards, from the E
American National Standards Institute,1430 Broadway, New York, NY 10018.
9 l
l l
p h-e
Standard Format and Content l
Acceptance Criteria for the Material Control and Accounting (MC&A)
Reform Amendment 10 CFR Part 74 Subpart E ateIu shed arch 1987 Division of Safeguards Office of Nuclear Material Safety and Safeguards U.S. Nuclear Regulatory Commission Wcshington, DC 20555 p~..,,
Y
ABSTRACT Revisions have been made to the material control and accounting requirements for NRC licensees authorized to possess and use a formula quantity or more of strategic special nuclear material.
The revisions require timely monitoring of in process inventory and discrete items in order to detect anomalies poten-tially indicative of material losses.
Timely detection and enhanced loss localization capabilities will be beneficial to alarm resolution and material recovery in the event of an actual loss.
This document presents criteria'that.
can be used by the license applicants and the license reviewers in the prepara-tion and subsequent review of plans.to be submitted in response to the Reform Amendment.
General performance objectives, system capabilities, process monitor-ing, item monitoring, alarm resolution, quality assurance, and accounting are addressed.
l iii 4
TABLE OF CONTENTS ABSTRACT.........................................................
- ACKNOWLEDGEMENT..................................................
vii ACRONYMS AND INITIALS...........................................
.ix INTRODUCTION.......................~.............................
1 GEhERAL DISCUSSION...............................................
3 1.
ABRUPT LOSS DETECTION.......................................
7 1.1 Unit Process Capability................................
7 1.2 Research and Development Operations....................
16 2.
ITEM MONT0 RING..............................................
21 2.1 Item Loss Detection....................................
21 3.
ALARM RESOLUTION............................................
31 3.1 Alarm Resolution.......................................
31 3.2 Alarm Reporting........................................
40 3.3 Alleged Thefts.........................................
41 4.
QUALITY ASSURANCE...........................................
47 4.1 Ma nag eme n t S tru c tu re...................................
47 4.2 Personnel Qualification and Training...................
51 4.3 Measurements...........................................
53 4.4 Measurement Control....................................
55 4.5 P hy s i c a l I n v e n to ry.....................................
64 4.6 Accounting.............................................
71 4.7 Shipments and Receipts.................................
74 4.8 Scrap Control..........................................
77 4.9 Human Errors...........................................
80 4.10 Independent Assessment.................................
88 4.11 SSNM Custodianship.....................................
90 REFERENCES.......................................................
92 1
I l
t v
~.
ACKNOWLEDGEMENT The NRC wishes to acknowledge the valuable technical contributions to this document from the Battelle Pacific Northwest Laboratory, Richland, Washington, under contract to NRC.
Principal contributors from PNL were:
R. J. Brouns, L. C. Davenport; F. P. Roberts, and B. W. Smith.
vii
ACRONYMS and INITIALS CAA Controlled access area CUMSRD Cumulative shipper-receiver difference FKG Formula kilogram i
FNMC Fundamental nuclear material control HEU High enriched uranium ID Inventory difference LEID Limit of error of thel inventory difference MAA Material access area MC&A
. Material control and accounting NDA Nondestructive assay PD Process difference R&D Research and development SEID Standard error of the' inventory difference SNM Special nuclear material SRD Shipper-receiver difference SSNM Strategic special nuclear material l
i l
ix
INTRODUCTION The Atomic Energy Act of 1954, as amended, directed the Atomic Energy Commission (AEC) to regulate the receipt, manufacture, production, transfer, possession, use, import, and export of special nuclear material in order to protect the public health and safety and to provide for the common defense and security.
The Energy Reorganization Act of 1974 transferred all the licensing and related i
functions of the AEC to the Nuclear Regulatory Commission (NRC).
The principal requirements with respect to special nuclear material licensing are found in Title 10, Code of Federal Regulations, Part 70 (10 CFR Part 70),
"Special Nuclear Material" and Part 74 (10 CFR Part 74), " Material Control and Accounting of Special Nuclear Material." Paragraph (b) of $70.22 of 10 CFR Part 70 specifies that special nuclear material control and accounting information must be provided in a license application to show how compliance with the fundamental nuclear material control requirements of $70.58, 674.31, or $74.51 will be accomplished.
Purpose and Applicability This document describes the standard format and content suggested by the NRC for use in preparing fundamental nuclear material control plans (FNMC) in response to the Material Control and Accounting (MC&A) Reform Amendment (10 CFR 74.51).
~
An intent and scope statement is provided for each requirement.
These statements are intended to communicate the underlying objectives of each requirement and are not subject to negotiation in individual licensing actions.
The document also provides acceptance criteria which will be utilized in the adequacy evalua-tion of submitted plans.
To the extent possible, the criteria are presented in a performance-oriented format. Where prescriptive criteria were necessary, i
at least two alternatives normally are provided, and additional alternative l
approaches, which provide an equivalent level of performance, are encouraged.
l Use of the Standard Format By using this standard format for preparing an FNMC plan, a license applicant will minimize administrative problems associated with the submittal, review and approval of the plan.
Preparation of an FNMC plan in accordance with this Standard Format will assist the NRC in evaluating the plan and in standardizing the licensing and review process. However, conformance with the standard format is not required by the NRC.
An applicant may use a different format if it provides an equal ~ level of completeness and detail.
Regardless of the format, the applicant should employ a plan / annex concept.
All fundamental commitments which define the bounds within which the licensee will function and the detailed level of the performance of its MC&A system should be included in the body of the plan.
In those cases where a demonstra-tion of a specific capability is called for, such information should be included in an annex to the plan which will not be incorporated as a condition of license.
Procedures detailed in the annex may be changed without NRC approval or notifica-tion provided plan commitments and capabilities are not degraded.
1
Use of Acceptance Criteria The Acceptance Criteria are for the use of the applicant and the licensing reviewer.
An application which meets these criteria should be acceptable to the NRC staff. However, as noted above, those criteria which are prescriptive in nature are included as examples and each applicant should develop a material control and accounting program that takes into account the unique features of its particular operation.
Where additional guidance is available on particular topics, an appropriate reference is included in the Acceptance Criteria section.
I f
GENERAL DISCUSSION In this section, the license applicant should provide a general description of how its material control and accounting program satisfies the general perform-ance objectives of paragraph 74.51(a).
The description should include informa-tion on the plant, the process, and key features of the material control and accounting program including physical organization, types of tests, and classification of material as bulk versus items.
The description should be sufficiently general to allow for significant modification without necessitating revision of this section.
3 l
a Questions and' Answers 1.
Q:
Previously, material control and accounting (MC&A) regulations of 10 CFR 70.51(e), 70.57, 70.58 applied to fuel facility licensees authorized to possess and use'a quantity of special nuclear material (SPM) exceeding one effective kilogram.
The MC&A Reform Amendments would apply to fuel facility licensees possessing and using more than five formula kilograms of strategic SNM (SSNM).
What is the dif-ference between effective and formula kilograms?
A:
Five formula kilograms (FKG) of high enriched uranium (HEU), plutonium, or U-233 has been established by the Commission as the quantity of strategic importance.
For plutonium or U-233, the number of formula kilogram is defined as 2.5 times the weight in ' kilograms of the plutonium or U-233.
For HEU enriched to 20 percent or more in uranium-235, it is defined as the weight in kilograms of the U-235 isotope.
For plutonium or U-233, an effective kilogram is defined as 4
the weight ir. kilograms of the plutonium or U-233.
For uranium enriched in the U-235 isotope more than 1 percent, it is defined as-the weight in kilograms of the uranium element multiplied by the 4
square of its enrichment expressed as a decimal fraction.
9 The Reform Amendments apply to HEU, plutonium, and U-233, in quantities of 5 FKG or more.
For plutonium and U-233, 5 FKG is the same amount of material as two effective kilograms.
For HEU, 5 FKG varies from
!~
one effective kilogram for 20 percent enrichment to five effective kilograms for 100 percent enrichment.
Licensees possessing and using more than one effective kilogram of SSNM of moderate strategic signif-icance would continue to be subject to the requirements of 10 CFR 70.51, i
70.57, and 70.58.
Licensees possessing and using more than one effec-i tive kilogram of SNM of low strategic significance would be subject
-to the requirements of 10 CFR 74.31.
4 I
6 74.51(b) Threat Definition i
2.
Q:
Why does the collusion protection requirement read differently from that in 10 CFR 73.1(a)?
A:
The physical protection requirements of 10 CFR 73.1(a) stipulate that i
collusion protection be provided against the conspiracy detailed in the design basis threat.
To require the MC&A system to also protect against the same conspiracy would be excessive.
The provisions of the MC&A Reform Amendments are designed to function in an integrated fashion with those of 10 CFR Part 73 while adding an independent verification, thus producing a more cost-effective system.
Under this new approach, MC&A is only required to protect against an insider's ability to cover up his/her theft.
l 1
i 4
t The MC&A system needs to protect against only a. single insider, pro--
viding that individual does not have authority within the physical ~
protection system that would permit him/her to. participate in a conspiracy' aimed at defeating the safeguards system.
If an MC&A individual does have authority within the physical protection system, then the MC&A system is required to protect against the cover-up of i
a collusion of that individual with any other individual having MC&A
^
authority.
This approach should relieve licensees of most of the burden which would result from requiring a totally redundant system while still maintaining the ability of the MC&A system to provide an extra level of independent protection and an added measure of assurance that the
[
safeguards system as a whole has not been compromised.
3.
Q:
What are examples of things this collusion requirement would affect?
A:
Under this provision the licensee would be required to analyze all positions having responsibility within the MC&A system to determine if any also have. responsibility within the physical protection system.
1 A. safeguards manager might be an example of such a position.. If this position includes both MC&A and physical protection responsibilities,
)
procedures would have to be developed to assure that when an individual in this job is performing an MC&A function, that this function be performed under a three person rule, be independently checked later by a third party, or be otherwise protected against abuse of authority.
Another example might be a worker on a shipping dock who has respon-sibility for making a nondestructive assay measurement on a barrel and for moving that barrel out of the material access area (MAA).
Current practice for workers in positions such as this, however, L
J already appears sufficient to meet the proposed provision and few if any changes are anticipated to be required.
For some individuals in management / supervisory positions, some modifications to procedures, such as restricted access without escort to some areas, may be necessary to provide sufficient assurance that the system cannot be compromised.
An MC&A function performed by a worker without physical protection system authority would need to be protected against a single insider threat.
However, it would need no cross-check if that individual had no " hands on" access to formula quantities of SSNM (e.g., a laboratory chemist).
l.
$$ 74.51(c), 74.59(e) Phase-In Period i
4.
Q:
Will the physical inventory period go directly from two months to six months?
A:
The period between physical inventories will not increase from bimonthly to semiannual until after the licensee has implemented all plan commitments, including necessary shutdown for alarm resolution, and demonstrated adequate performance against all commitments.
5 t
f 1 A8RUPT LOSS DETECTION 1.1' Unit Process Detection Capability Requirement: 'The rule requires that for each unit process, a licensee establish a production quality control program capable'of monitoring the status of. mate-rial in process.
The program should include material control tests; the results of which would be subjected to the following:
A statistical-test that has at least a 95 percent power of detecting an abrupt loss of five formula kilograms within three working days of a loss of Category IA material-from any accessible process location and seven calendar days of a loss of Category IB material from any accessible process
- location, A' quality control test whereby results greater than both'three times the estimated standard deviation of the process difference estimator and 25 grams of SSNM are investigated, and a trend analysis for monitoring and evaluating sequences of material control test results from each unit process to determine if they indicate a statistically significant recurrent loss or gain [74.53(b)].
Intent and Scope:
The intent of these requirements is to have in place a quality control program that will provide early indications of material losses that may be indicative of a diversion or theft and a prompt detection system for significant abrupt diversions of 5 FKG or more.
Through prompt detection, response and recovery actions can be initiated soon after a loss event while circumstances surrounding the loss occurrence are fresh in the minds of cogni-zant personnel, and materials are available for remeasurement.
In addition, fewer changes in process conditions, inventories, in process holdups, and item locations will have occurred so that resolution probabilities are' enhanced.
The detection times for a 5 FKG loss are maximums; hence, a licensee may'use shorter intervals for specific unit processes if so desired.
Plan / Annex Content:
The FNMC Plan contains the following affirmations and detailed commitments.
Supporting information, as appropriate, is included in the Annex.
Section 1.1 of the Plan includes the following affirmations:
Material control anomalies resulting from material control tests are investigated when such anomalies exceed three times the standard deviation of the test statistic and also exceed 25 grams of SSNM.
Results are documented.
The detection system is capable of detecting abrupt losses of Category IA material within three working days and Category IB material within seven calendar days of the loss occurrence from any accessible location.
The action thresholds for the material control tests will be updated based on the first six months of operating data and thereafter as supported by the analysis of test data.
7
A11' materials not qualifying for exemption under paragraphs 74.53(a)(1),
'e
-(2), (3), or (4) are' included under_ a material control test.
i Where credible substitute material is present and not controlled, the i
material control tests are capable of detecting. diversions or thefts involving substitution of_other material (s) for SSNM.
or No credible substitute materials are permitted inside the MAA, nor is it credible that substitute materials could be covertly introduced from outside the MAA.
or Credible substitute materials are available within the MAA; however, sufficient controls are in place to preclude their use to conceal diversion.
Automated or manual records of the location, movement, quantity and identity of SSNM are maintained as needed to perform the material control tests for abrupt loss detection.
. Procedures will be implemented and maintained for monitoring and evaluating sequences of loss estimates for each unit process, and anomalous trends in sequences of abrupt loss estimators will be tested to determine if they indicate a recurrent loss trend that is of safeguards significance.
t 1.1.1 Process Subdivision and Measurement Points Describe the subdivision of the process to meet the unit detection requirements and the. associated measurements and measurement points.
A diagram or listing may be used to document this information.
1.1.2 Material Control Tests Describe the material control tests for each unit process.
The description should include:
(1) identification of the test statistic, (2) the amounts and types of data used to establish uncertainties (sigmas), (3) tests for normality, (4) means of handling non-normal data, (5) tests for outliers, (6) methods for establishing alarm thresholds, (7) criteria for modifying alarm thresholds, and (8) the basis for the assignment of the start times for each material control test.
In the Annex provide:
(1) a detailed example alarm threshold calculat. ion for one process unit, (2) a tabulation of the threshold values for all process units, (3) a tabulation of the detection times associated with each material l
control test, (4) the justification for the derivation of each threshold value, i
and (5) a listing of Category IA and IB materials and the justification for the lower classification of the latter.
8
t
+
1.1.3: Location Categorization i-Identify the locations within the facility classified as inaccessible.
In the Annex provide the justification for classifying a location as inaccessible.
1.1.4 Material Substitution i
LIdentify all credible substitute materials at each location and the method of testing for substitution or of controlling the-substitute material to prevent
.or detect attempts at substitution. The method of preventing credible substi-tute materials from being covertly introduced should also be described (NOTE:
Reference to the Physical Prctection Plan is permitted).
1.1.5 Exemptions Provide a listing of material types exempted from the abrupt loss detection tests with their locations and discuss the basis for the exemptions.
1.1.6 Trend Analysis Describe the trend analysis techniques that will be employed to monitor sequences of process differences from material control tests.
The description should include the decision criteria for ascertaining when a significant trend exists.
j.
Acceptance Criteria:
The assessment of the adequacy of the information supplied above will be based on the following criteria or equivalent:
The licensee has developed a system of material control tests for detecting abrupt losses of bulk material from single units or locations within the facility. The material control tests are capable of detecting a goal quantity loss with at least 95 percent probability of detection. The mate-
{
rial control tests will have the following characteristics:
i Each material control test encompasses the SSNM in a definite unit or location or over a span of locations comprising a segment of the process or a single point in the process.
The material control test is based on a comparison of a measured value(s) of a quantity of material (s) or of a process variable with a reference value.
The reference value is the expected or predicted quantity of material or value of the process variable in the absence o
of diversion or unexpected loss.
Examples of possible material control tests are:
SSNM material balance; Mass (weight) balance; Volume balance; Yield versus expected or predicted yield; 9
(
Liquid level versus predicted level; i
Solution' density versus predicted density; j
+
Flow rate versus predicted flow rate;.
Bulk powder volume or volume times bulk density versus predicted quantity; NDA value versus. predicted value; Isotopic ratio versus predicted value; Number of units, such as pellets, elements or pins versus predicted number; and Process control parameters such as pH, reagent volume, or extraction efficiency versus predicted values.
Each material control test has an action threshold (critical value) which, if exceeded, will be the cause for initiating the alarm resolu-tion procedures prescribed in S 74.57.
In general, the action threshold or critical value can be set by a formula of tha following type:
A=G+x-Ko x
where:
~A = alarm threshold G = goal quantity (5FKg or less) x = mean assuming the null hypothesis, Ho, is true (Ho:L=0)
L = zero loss K = factor based on POD o = standard deviation of the test statistics.
x Key considerations applicable to this determination are:
If the distribution of the source data can be reasonably represented by a single normal model after the effects of human errors have been eliminated, use K=1.65 to achieve 95 percent detection probability.
If an analysis of test data indicates the presence of mul-tiple distributions, one of the following actions would be appropriate:
t 10 t
b
-, _.. _,,,... -. _ _,. _, _.. _ _,... _,,. _. _ _ ~. _ _ _ _. - _ _ _ _ _
,m
.I_..-_
o An in-depth study should be undertaken.to identify the
~
sources of error and adjustments should be made, as appropriate, in order that a single normal distribution adequately represents the data.
or The parameters (x, c) should be estimated,'using a computer-program as necessary,-to maximize the likelihood function; then the critical point is determined by integrating the
-probability density function to the probability of interest.
or A determination should be made as to whether the presence of multiple distributions is the result of concomitant data which occurred as the result of some recognized change'that occurred during the test period (e.g. new and recycled material processed through an operation).
If such data are available, the' data should be split into subsets for testing.
When data do not seem to fit a normal distribution, an evaluation-should be mafe to see if some mathematical function of the data values will ?it (transformation of data).
A commonly used trans-formation is logarithms which is the basis for the lognormal distribution.
Although there is no stated limit on the magnitude of the measure-ment and/or process uncertainty, the establishment of alarm thresholds indirectly limits the magnitude of these errors. That is, when the standard deviation of the test statistic becomes a large fraction of "G," there is an excessive number of false alarms.
The combined quality of the material control test and loss resolu-tion decisions shall permit alarms remaining unresolved after the completion of the licensee's investigative activities to be good indicators of an actual loss. To achieve this objective, the i
licensee should demonstrate that the statistically expected number of false alarms will be less than 0.10 per inventory period for all abrupt bulk loss alarms exceeding 5 FKG (i.e., the predicted number of such unresolved alarms should be less than one in 10 inventory periods).
The action thresholds are based on statistical hypothesis tests i
derived from the variances of the test statistics or on other j
technical bases for which it can be shown that the power of the
)
test for loss is satisfactory.
The measurement variances assumed by the licensee are either supported by published typical values (see Reilly and Evans (1977) or Rogers (1982) or others), the licensees measurement control data, or historical data from the licensee's process 11
or other similar processes.
The assumed process variances may be estimated by using conservative judgments based on sound i
engineering principles if historical performance data for the licensee's process or similar processes are not available.
If engineering judgments or typical values are used, the Plan should include provisions and schedules for updating the esti-mated variances with actual performance data.
The methods of estimating the loss detection sensitivity or the variances of
-loss detection parameters are satisfactorily explained and a credible justification for their use is given.
All SSNM in bulk form in the MAA is within the span of a material control
' ~ test.
(Note:
Exceptions to this requirement include (1) low-level waste
'7which meets the criteria in 10 CFR 73.46(c)(6), (2) laboratory samples containing less than 0.05 FKG (3) SSNM in research and development opera-tions with throughputs less than 5 FKG during any seven consecutive days, and (4) SSNM in scrap and waste treatment operations conducted outside an MAA, (e.g. incinerator)).
The tests for detecting abrupt losses at each accessible location will meet the three-and seven-day detection time goals for Category IA and Category IB materials, respectively, under all routine conditions that are expected to prevail at the location.
(Note: When detection times are interrupted by idle time caused by such things as weekends, holidays or vacations, the licensee shall make provisions for con:pleting the tests before the idle time or for conducting additional tests to cover any material control tests that will not be completed.
The additional tests shall achieve the same level of detection as the principal tests.)
The licensee's classification of the process material as Category IA and Category IB is explained and justified in the Annex.
Category IB materials are either (1) not usable for constructing a nuclear explosive device without further processing; (2) not susceptible to undetected removal frcm the MAA by an insider because of size, weight, or chemical hazard; or (3) of such low concentrations of SSNM that ex essively large bulk quanti-ties would be needed to obtain a formula quantity of SSNM.
There is no limit or restriction on the number of control units into which a facility can be divided.
Loss detection sensitivity, false alarm rate, and loss localization capability are key determining factors.
The following criteria are appropriate in determining control unit boundaries:
Material control tests should be performed on units generally consis-tent with readily assessable measurement points which naturally result from the process design.
Process units should not be divided into smaller units for material control tests if such subdivision would cause the standard deviation of the test statistic to increase from below 850 formula grams U-235 (or equivalent units for tests not based on U-235) to above 850 formula grams U-235 unless such subdivision is necessary to meet the timeliness criteria of S 74.53(b)(1).
Batch transfers should be utilized wherever they occur.
12
b Process variabilities should be localized to a control unit.
Concentration differences between feed and product should be minimized wherever possible.
Process units that operate continuously should be separated from those that operate in a batch mode.
False alarm rates should be minimized. The number of false alarms per inventory period should be less than o.ne percent for all tests.
The timeliness of abrupt loss detection at a single location is based on the interval between the time a goal quantity of SSNM becomes accessible for diversion and the completion of the material control test.
The start time occurs when the quantity of SSNM is first equal to or greater than the established goal quantity.
In determining accessibility for the purpose of establishing the start time for material control tests, SSNM may be treated as not accessible for diversion if:
Access to the SSNM is physically precluded without the need for visible puncturing, breaking, or otherwise violating the integrity of the process equipment containing the SSNM; or The state of the SSNM precludes diversion because of high temperature, chemical reactivity, radioactivity, or other chemical or physical property; or The removal of the SSNM from its authorized location cannot be accom-plished because the tools or equipment needed for its movement are unavailable; or The SSNM is dilute (solution) and requires a large vessel, the presence of which could not escape notice; or The material is under the continuous surveillance of two or more individuals or an electronic or other type of monitoring system that will detect attempts to remove material from a process.
The material control tests need only detect those losses not involving substitution unless credible substitute materials are available in the same MAA in the form of uncontrolled material or are not prohibited as contraband from being brought into the MAA.
Where credible substitute material is present and uncontrolled, the material control tests must be capable of detecting diversions employing substitution with the loss sensitivity and probability of detection required in $74.53.
If uranium of a lower enrichment is a credible uncontrolled substitute, a material control test must be capable of detecting isotopic dilution.
Otherwise, a test that detects replacement by another element is adequate.
13 t
Material.will be deemed not to be a credible substitute if Lit either:
Has physical properties such as density, color, particle size, Lor.
other_ characteristics that will be immediately and unequivocally-recognized to be different from the SSNM by personnel who routinely l
work with the SSNM;
_Has chemical properties that will always cause process upsets or-
~ degradation of product quality severe enough to be recognized and reported to a designated individual responsible for initiating a response.within the time period of the material control test; 3
Is controlled by a monitoring technique.that provides assurance that the substitute material cannot be brought into the. material access j:
area; or Is controlled by a material accounting test that will detect losses or' diversion of the substitute material and in the absence of an alarm will provide indirect assurance that an SSNM diversion involving substitution has not occurred.
Acceptable controls on substitute materials might include the following:
Access to the material is controlled through isolation-in a locked-limited access cabinet or room and access is restricted to indi-L viduals who would not be involved in the actual handling of SSNM
~
during production operation.s; t
Periodic material balances are performed on the substitute material inventory where the balance may merely entail a weight comparison <
of material on hand minus material issued for production with the beginning inventory; l
Semi quantitative NDA tests are performed on intermediate product materials from process operations where credible substitute mate-l rials might be introduced; or Credible substitute materials are stored outside the MAA and introduced only in amounts necessary for a shift or day's production.
For low throughput operations such as waste compactors and incinerators j
where throughput is less than five FKG in three months, and the measure-ment uncertainties on inputs and/or outputs are greater than five percent, l
the licensee should perform material balances on a batch basis and make I
appropriate corrections to the originating unit (s) or area cumulative
{-
balances to the extent practicable. Holdup determinations would be neces-sary only at the time of the physical inventory (or sooner for criticality reasons), and input-output differences would need to be assessed only to the extent that significant trends would be investigated to identify i
i measurement biases or an unaccounted for loss stream.
i l
j 14
3 For samples containing greater than 0.05 FKG and scrap and waste containers in laboratories, the licensee shall perform monthly material balances.
-These balances may be accomplished by:
E Maintaining a dynamic record of the laboratory inventory, l
Maintaining a continuous inventory of the contents of scrap and waste i-containers by logging the amounts of all additions to each container, and i
Measuring the contents of each container monthly to detect.significant discrepancies where "significant" is defined as in excess of twice.the standard deviation of the difference estimator.
Process difference estimates that exceed ~both three times the standard deviation of their estimator and 25 grams of SSNM shall be investigated l
and the results documented.
The investigation should as a minimum include:
A review of all source data and calculations for errors, A review of material control test results for the preceding SSNM quantity in the involved unit and the results of material control tests from the two adjacent units, An interview with process operators to ascertain if a perturbation in the process may have occurred, A check of sidestreams for abnormally high SSNM content, and J
An assessment of the possibility that additional holdup beyond what had been projected may have occurred.
l Two process difference estimates in succession that exceed three times the standard deviation of their estimators and three FKG should trigger addi-l tional investigative measures'that include:
i j
Notification to the nuclear materials control manager, Review of security records, Added surveillance measures in the involved process unit, and Performance of a physical inventory within two months.
The trend analysis required by 874.53(b)(3) can be accomplished by the application of appropriate parametric or nonparametric statistical tech-niques.
Examples include:
Page's Test, Runs Test, Dietz's Test, Power One Test, and a Mosum Test.
With respect to " safeguards significance" as it pertains to trend analysis, a trend should be considered significant when the applied test indicates it to be so and the absolute quantity involved is in excess of three FKG.
i i
l 15 i
l
.= -
- 1. 2 Research and Development Operations Requirement.
For research and development operations the rule requires each licensee.to:
(1) Perform material balance tests on a lot or batch basis, as appropriate,
-or monthly, whichever is sooner, and investigate any difference greater than 200 grams of plutonium _or uranium-233 or 300 grams of uranium-235 that exceeds three times the standard error of the inventory difference estimator ($74.53(c)(1)); and (2) Evaluate material balance result; generated during an inventory period for indications of bias or unidentified loss streams and investigate cumulative differences greater than three FKG of SSNM.
Intent and Scope.
By design, research and development operations are dynamic in nature.
Consequently, the prompt loss detection techniques that depend upon stable estimates of the uncertainties associated with material balances or process yields are inappropriate for loss detection. Taking into account the low throughput of such operations, periodic material balance tests on a lot
<i or batch basis or monthly are deemed acceptable for loss detection.
Plan / Annex Content:
The FNMC Plan contains the following affirmations and i
detailed commitments.
Supporting information, as appropriate, is included in the Annex.
Section 1.2 of the Plan includes the following affirmations:
Material balance tests are performed on lots or batches of material from research and development operations or on a monthly basis, whichever is sooner.
Inventory differences that exceed 300 grams of uranium-235 (or 200 grams plutonium or uranium-233) and three times the standard error of the
-inventory difference estimator are investigated and resolved.
Sequences of inventory differences are monitored for indications of a trend and cumulative differences exceeding three formula kilograms are i
investigated.
t i.'
1.2.1 Lot / Batch Characterization i
l Provide the criteria that will be utilized to define a lot or batch.
1.2.2 Material Balance Tests 3
Describe how the components of a process material balance will be established j
including the degree to which a process will be cleaned out and/or holdup measurements will be performed. Discuss the handling of scrap including measure-ments, pre-treatment prior to recovery, and segrigation.
1 1
16 t
Acceptance Criteria:
The assessment of the adequacy.of the information supplied above will be based on the following criteria or equivalent:
Proposed materials groupings into lots or batches are acceptable taking into account prompt loss detection objectives, measurement characterization, and processing constraints.
The inputs to the standard error of the inventory difference are reasonable and include all sources of measurement error.
Inventory differences on lots or batches generated during an inventory period inay be based on weight comparisons provided:
The lots or batches represent intermediate products, The input materials to the facility are measured for element and/or
- isotope, There are no credible substitute materials present in the MAA or adequate controls exist to preclude the use of substitute materials to conceal a diversion, The quantity of SSNM in sidestreams can be reliably measured, and The ultimate product of the operation is measured for element and/or isotope, as appropriate.
Questions and Answers 74.53 In-Process Monitoring 1.
Q:
What forms of SSNM are covered by this section?
A:
Bulk materials, including nontamper-safed containers of SSNM as well as materials in process equipment.
In general, these requirements apply to material that has to be measured or counted to verify its presence, rather than have its identification number and seal integrity checked.
2.
Q:
How does the lost detection mass sensitivity of 10 CFR 70.51, 70.57, and 70.58 compare to that of the proposed amendments?
l A:
It is difficult to make this comparison because the current regulations do not explicitly specify loss detection performance capability required of the licensees.
l The current regulations (10 CFR 70.53(b)(1)) require the licensee to report the probable cause if an inventory difference exceeds both its measurement system limit of error and 200 grams of plutonium or uranium-233 or 300 grams of high enriched uranium or uranium-235 con-tained in high enriched uranium.
The measurement system limit of error is permitted to be 0.5 percent of plant throughput.
This l
l l
17 l
(V,,
^
. reporting requirement is not equivalent to the response.to'a detec-tion alara that the proposed rule would requiro.
Further, it is not Ltimely'and does not. require substantiation of the cause.
Neverthe-less,:it provides a point for comparison. The proposed' amendments require at least a 95 percent probability of detecting a five FKG
. loss from each unit process. To attain:the_same probability under the current reg'.'lations, the limit of error should not exceed one.
~
FKG* which corresponds to 200 formula kilograms of bimonthly :
throughput.
3.
Q:
Would licensees;be' required to detect-losses of amounts smaller than
~5 FKG?
A:
The Commission has judged the risk to the public's health and safety of losses of less than 5 FKG of SSNM to be relatively.small compared to losses of more than that amount.
Under the current regulations, which include limits that are proportional to plant throughput, a small throughput licensee may be required to keep inventory ' differences less than a few hundred grams, while.a large throughput facility may be allowed to operate with inventory differences of more than five FKG. The proposed amendments would apply the same detection goal quantity to all licensees, both large and small.
These amendments would require detection of single abrupt losses of 5 FKG with 95 :
percent or greater probability of detection.
They would also provide a capability to detect smaller losses with reduced detection probability.
Furthermore, each licensee who possesses one gram or more of U-235, U-233' or plutonium would continue to be required by 10 CFR 74.11 to report any' actual known loss of SSNM, regardless-of quantity.
4.
Q:
Are losses from any location required to be detected, or only losses from accessible locations?
A:
Losses from any location must be detected.
The concept of accessible location applies only to the criteria for establishing and determining the timeliness of the licensees' detection capabilities.
The detec--
tion time is the duration from when the SSNM passes a place from where it is accessible to diversion to the time at which its loss would be detected.
Licensees are encouraged to have few accessible locations since the risk of material being stolen is reduced by minimizing opportunities for people to have access to material or to have access to points of remote control over material flow if those controls could I
be used to divert the flow into unauthorized locations.
"This is based on studies that suggest that the true standard deviation of inventory difference is often about twice that due to measurement system error i
alone, and on the assumption that the true distribution is not symmetrically distributed about zero.
18
b 4
-5.
Q:
Should a glovebox be considered an " accessible location"?
E A:
~ Generally yes.
Since such activities as a glove change or " bagging out" operation are considered routine, a removal of material via this t
route may not be readily detectable.
However, if there-is an enforce-able policy that all removals.from a glovebox must be accomplished by
/~
.at least two individuals and there are no access points which could 1
be, accessed without an obvious indication, a glovebox may be treated i"
as' inaccessible.
A st a
6.
Q:
Wilt it be necessary to close a material balance in order to achieve the detection capabilities?.
t A:
No.
As defined in 10 CFR 70.51:
S
" Material. balance" means a determination of an inventory difference (ID) (formerly called material unaccounted for (MUF)) by subtracting ending inventory. (EI) plus removals (R) from beginning of inventory (BI) plus additions to inventory (A).
Mathematically, ID = BI + A - EI - R.
o
- Paragraph 70.58(k) requires closing a measured material balance around each raterial balance area (MBA) and the total plant.
All SNM received by an MBA, transferred from the MBA, discarded, or on inventory has to be measured and recorded to permit the ID to be determined 4
The ID is required to be calculated for both-the element and fissile isotope of uranium.
I In contrast to current regulations, it is not the intent of the proposed amendments to require measured balances as the only acceptable material 4
icoptrol test for detection of losses.
j t
a llt is the intent of the proposed amendment to assure that the detec-tion and localization performance criteria of the rule are met.
In
, some cases, a licensee may find no satisfactory alternative to closing a material balance in order to satisfy the performance criteria.
In other cases, alternatives will be feasible.
(For example, see pages
^
4-8 of NUREG/CR-1670, Volume 1, "The Use of Process Monitoring Data l
for Nuclear Material Accounting," October 1980, and pages 12-13 of NUREG/CR-1686, Volume 1, " Feasibility and Cost / Benefit of Advanced l
Safeguards for Control of Nuclear Material In-Process," October 1980).
7.
Q:
The measurement system error is not constrained by the detection probability requirement without a false alarm limit.
Isn't l
there a limit on how big the measurement error can be?
l A:
The problem that comes from too large a measurement or process e
uncertainty, which causes the standard deviation of the test statistic to be a large f. action of G, is excessive false alarms.
The rule does not limit the nu:nber of false alarms allowed.
However, the alarm resolution requirements must be met.
One approach to meeting 19
_. _ _ _ _ _ _ ~ _ _ _ -... _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _, _ _ _ - _ _ _ - - _ _ _, _ _. _ _ _ _
1 i
h those requirements is to reduce expected false alarms to a level' below the acceptable number of unresolvable alarms.
Another approach is to tolerate a fairly high rate of false alarms and have more accurate backup measureraent systems or more accurate downstream measurements to help resolve the false alarms.
Criteria for the acceptability of the alarm resolution approach will provide the limits on measurement error for detection and response.
8.
Q:
Why is there a requirement. to investigate process differences that exceed three times the standard deviation of their estimator and 25 grams of SSNM.
A:
Differences that exceed three standard deviations are expected to be good quality control indicators for anomalies that could have an adverse impact on material. control and accounting.
In some units differences of such a magnitude might trigger an alarm potentially indicative of a 5 FKG loss, in which case alarm resolution procedures would be initiated.
In other cases, the differences may be far less than the quantity necessary to trigger an alarm; however, investigative action is appropriate before the problem escalates to a more serious situation.
9.
Q:
What is to be accomplished by a trend analysis?
A:-
Non-random behavior of process dif'ferences may indicate the presence of an unidentified bias, unmeasured loss' stream, or a diverter.
It is important that trends be identified so that investigations can be initiated to uncover the cause.
- 10. Q:
What constitutes a " working day" as used in this part?
A:
A working day is any 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period during which material processing activities occur and there is material handling.
A day during which activities such as maintenance of equipment, clean-up, autoclave monitoring. etc., occur would not be considered a work day unless SSNM h2o? bg was involved. The main criterion is whether or not the activit:
would afford the opportunity for diversion or theft.
l 20
2 ITEM MONITORING 2.1 Item Loss Detection l
Requirement: The rule requires that each licensee establish the capability to detect a five formula kilogram loss in item form using any statistical test that has a 99 percent power of detection. Detection is to occur within:
(1) Thirty calendar days of a Category IA loss and 60 calendar days of a i
Category IB loss for those items in a vault or permanently controlled access area isolated from the rest of the MAA; (2) Three working days of a Category IA loss and seven calendar days of a Category IB loss for items located elsewhere in the MAA except that the loss of reactor components at least one meter in length and in excess of 30 kilograms is to be detected within 30 calendar days; (3) Sixty calendar days from the loss of Category IB items in a permanently controlled access area outside of an MAA; and (4) Sixty calendar days for samples in a vault or permanently controlled access area and 30 calendar days for samples elsewhere in the MAA for those samples containing less than 0.05 FKG of SSNM (S74.55(b)).
Items, except samples, are to be uniquely identified, quantitatively measured, with the validity of the measurement independently confirmed.
Additionally, items are to be either:
(1) Tamper-safed or placed in a vault or permanently controlled access area that provides protection at least equivalent to tamper-safing; or (2) Sealed such that removal of SSNM would be readily and permanently apparent (e.g., encapsulated) (74.55(a)).
Intent and Scope:
The intent of this requirement is to ensure timely plant-wide detection of t1e loss of items that total 5 FKG or more.
To achieve this capa-bility, the licensee is expected to verify the presence and integrity of selected SSNM items on a periodic basis.
The required frequency of tests for missing items is graded according to the relative attractiveness of the material type in the item, the ease with which the item could be diverted without being observed, and the degree of surveillance and containment provided for by the physical security.
If SSNM is not tamper-safed, stored in a vault or permanently controlled access area that provides protectiori at least equivalent to tamper-safing, encapsulated, or in samples containing less than 0.05 FKG, it is not considered an item and the SSNM is subject to the in process control requirements for bulk material.
The longer detection times for losses of items from permanently controlled access areas takes into account the added security afforded by the physical protection measures required of such areas by 10 CFR Part 73. However, this provision should not be interpreted as authorizing the placement of materials in these areas other than those already authorized pursuant to Part 73.
l 21
Plan / Annex Content:. The FNMC Plan contains the following affirmations and detailed commitments. Supporting information, as appropriate, is included in the Annex.
Section 2.1 of the Plan includes the following affirmations:
.The presence and integrity of selected SSNM items are verified periodically.
The item selection method has at-least a 99 percent probability of detecting the loss of items plant-wide that total 5 FKG within:
Thirty calendar days from loss for Category IA items and 60 calendar
- days from a. loss for Category IB items for items in a vault or a permanently controlled access area that is isolated from the rest of the material access area (MAA);
Three working days from a loss for Category IA items and seven calendar days from a loss for Category IB items located elsewhere in the MAA except for reactor components measuring at least one meter in length and weighing in excess of 30 kilograms for which the time interval shall be 30 calendar days; Sixty calendar days from the loss of Category IB items in a permanently controlled access area outside of an MAA; and Sixty calendar days for samples in a vault or permanently controlled access area and 30 calendar days for samples elsewhere in the MAA for samples each containing less than 0.05 FKG of SSNM.
)
Items are classified as either Category IA or IB at the time they are created in order to fix the frequency of tests for item loss.
1 Each SSNM item is uniquely identified; the SSNM content is quantitatively I
measured; the validity of the measurement is independently confirmed and assured through tamper-safing or storage in a vault or permanently controlled access area that provides protection at least equivalent ~
to tamper-safing; and a record of the identity, location, and SSNM content is maintained.
Vaults or permanently controlled access areas isolated from the rest of the MAA are operated with physical and administrative controls over personnel access such that unauthorized additions and removals of items from the storage area will be either prevented or promptly detected.
In addition, every change of inventory in the storage area is recorded.
The operating procedures of item storage areas are documented.
A designated individual is responsible for the operation of each such storage area.
The response actions documented in Chapter 3.0 of this Plan will be initiated if one or more items are missing except where the missing items total less than 10 grams U-235, U-233, or Pu.
22 i
i
~---.a-.
..,, -. ~
,,,,,, - +.,
2.1.1 Item Identification Describe the identification system (numeric or alpha numeric) that will be used to assign unique identification to each item.
The description should include the features of the system which preclude falsification or which assure prompt detection of such attempts.
2.1.2 Item Classification Provide the basis for classifying items as material Category IB and any proposed exemptions from item control tests or from response actions, including a listing of the item categories involved and the rationale for such exemptions.
2.1. 3 Tamper-safing Describe the tamper-safing procedures that will be employed to assure the continuing validity of previously measured and attested to SSNM values assigned to unique items.
Aspects to be addressed should include: personnel involvement, types of seals, attesting to declarations, records, and inspection methods for detecting viola-tions of item integrity.
2.1.4 Accessibility Describe the personnel access controls, the surveillance procedures, and the records procedures for entrance and exit of personnel to and from vaults and/or permanently controlled access areas.
If any of the above attributes are described in sufficient detail in the facility's Physical Security Plan, appro-priate references may be made.
2.1.5 Accounting and Control Procedures Describe the item accounting and centrol procedures for items placed in and removed from secure storage.
The description should include item inventory 4
records utilized.
2.1. 6 Item Measurements l
Identify the measurement systems to be used for quantification of the SSNM l
content of items at item creation time.
The description also should include l
the confirmatory measurements used to quantitatively verify the SSNM content I
of nontamper-safed items placed into or removed from vault storage or a perma-l nently controlled access area that is equivalent to tamper-safing, including the controls that prevent or detect attempts at substitution.
2.1.7 Item Verification Describe the item verification procedure.
The description should include:
The inventory sampling method, including the sample size selection equations, the inventory stratification plan, and the method of selecting the actual items to be verified; 23
The extent to which cyclic, dynamic, or perpetual inventory data and production records, if any, will be used to modify or supplement the sample size, sample selection, or item verification procedures; and The minimum loss detection sensitivity and maximum time periods between item verifications for each category of material.
In the Annex, provide the rationale for the item stratification plan.
2.1.8 Sample Items Describe the technique that will be used to establish the sample population and how the presence of selected items will be verified.
Additionally describe how samples containing greater than 0.05 FKG will be monitored.
Acceptance Criteria: The assessment of the adequacy of-the information supplied above will be based on the following criteria or equivalent:
The item identification system possesses attributes that assure unique item identification, preclude falsification, or as a minimum, make prompt detection of such attempts achievable.
Factors to be considered in achieving this objective are:
The use of tamper-safe seal numbers for unique identification repre-sents an attractive alternative because:
the same number is used for both seal and item tracking, seal numbers cannot be altered without leaving visible evidence, and seal distribution and usage are controlled; The use of prenumbered containers which retain the same identifica-tion for repeat uses should generally be avoided unless detailed usage records are maintained that reflect the source and disposi-tion of items including times to fractions of a day; and The use of pre printed labels or blatik labels that are numbered as s
they are used is acceptable provided unauthorized alteration or replacement of the labels would be readily apparent to a knowledgeable observer.
Independent confirmation of the SSNM content of items will be achieved by having a second person do the following:
Observe the bulk measurement and sampling of the item whose contents are to be determined, Observe the nondestructive analysis of the item, or Perform a second quantitative analysis independently that does not destroy the integrity of the item, and Witness and attest to the application of an approved tamper-seal, or 24
Accompany the first person and the item to a vault or permanently controlled access area which will provide storage equivalent to tamper-safing.
Storage that meets the physical security requirements for vaults, documented in Part 73, will meet the requirements of 10 CFR 74.55 for storage of items containing either Category IA or IB material.
Storage that meets the following requirements will be accepted as a perma-nently controlled access area (CAA) isolated from the rest of the MAA for the purposes of 10 CFR 74.55:
CAA is equipped with physical protection capabilities required in Part 73; Access to the storage area is limited to the minimum number of persons necessary and records ara kept of the persons who enter and leave it; Records of the items in storage are maintained; and An operator within the storage area will be continuously observed by another person, and all additions, removals and movements of material by either person are verifiable by the other person.
Storage will provide protection at least equivalent to tamper-safing if:
Access to the vault or permanently controlled access area is limited to the minimum number of perscns necessary, and records are kept of the persons who enter and leave it; The personnel authorized to enter and operate the vault or permanently controlled access area are not authorized to remove or handle SSNM beyond the boundaries of the vault or area unless controls are in place that would preclude an individual from surreptitiously removing an item or any portion of an untamper-sealed container; A person entering the vault or permanently controlled access area will i
be accompanied by another person and all activities by either person will be verifiable by the other.
In addition, remote surveillance, such as. closed circuit television, with the capability of seeing both operators at all times will be used.
The remote surveillance need not be continuous if the occupants cannot determine or predict when they are or will be under surveillance; The SSNM content of nontamper-safed items will be measured, indepen-dently confirmed by a second person, and the item will be under the continuous surveillance of the two persons from the time of measure-l ment until placed in a vault or permanently controlled access area;
(
A record will be maintained of the location, identity and SSNM content of the nontamper-safed items; 25
The SSNM contents of nontamper-safed items will be verified by quanti-tative measurements when removed from a vault or permanently controlled access area except for solid components which can be verified by a weight check.
The verification measurement and the original result shall agree within the combined measurement uncertainties. '(Note:
Random errors will generally be the only component of the uncertainty except in those instances where a recalibration of the measurement
. process has taken place.) The verification measurement should also detect substitution except where it can be demonstrated that no credible substitute material is present in the vault or permanently controlled access area; and The response actions documented in Chapter 3.0.will be initiated.if an unauthorized vault or permanently controlled access area penetra-tion is suspected or if the SSNM content of any container is unexplainable and significantly different from the recorded value.
The acceptability of tamper-seals will be based on an evaluation of the seal attributes in relation to time to defeat and tamper-indicating features.
Seals already deemed acceptable by NRC include: Type E, Pressure-sensitive, and Steel Padlock (SAND 780400, Figure 14(2)). Other seals, such as fiber optic, may be equally acceptable.
The licensee should provide the appropriate information, including references, to enable the licensing reviewer to assess the adequacy of other than currently approved seals.
The control of seals and seal records should preclude or make readily apparent any attempts at illicit use of seals.
Potential contributors to these objectives should include commitments that:
Seals would be stored in a locked repository within a room that is locked when unoccupied, Blocks of seals issued to designated individuals would be afforded the same level of protection, A single individual without any responsibility for seal application or destruction would be designated as the seal control officer, The seal log book maintained by the control officer would be kept separate from the seals and stored in a locked repository, Individuals responsible for applying seals either would have unused seals in their personal possession or place them in a limited access locked compartment.
As a general rule, the number of available seals issued to these individuals would be limited to a typical single day's use, The licensee would have in his possession a commitment from the seal manufacturer that plates and/or dies and production residuals will be controlled and protected, and 26
k i
Used Type E seals would be crimped, flattened or otherwise rendered' unusable and properly disposed of.
The frequency of item verification tests should be consistent with " times.
to detection" specified in $74.55(b).
The number of items to be verified should be sufficient to give a power of i-
- detection of at least 99 percent for a loss of items totaling 5 FKG from each stratum or inventory subdivision (a' grouping into similar types and amounts of SSNM).
If all strata in a facility are sampled for verification
- with at least a 99 percent power of detecting a loss of items containing 5 FKG, that criterion also will be achieved for a loss of items containing 5 FKG or more plant-wide.
The item inventory should be stratified or subdivided in a manner that.
[
assures at least a 99 percent power of-detection while minimizing the number of items to be verified.
It is advantageous to subdivide the inventory into classes or strata having approximately uniform quantities
--of SSNM per item.
A moderate range of SSNM contents within a class, such as i 10 to 20 percent, is usually advisable.
Typical classes for sampling are fuel elements, containers of scrap, containers of feed material, containers of waste, etc.
The means of determining the number of items to be verified per class'or strata should be specified.
For example, the equation 1
n = _(N) (1 - SB) is an acceptable formula for calculating the sample size required from an inventory or any subset or group of size N, where d is the number of altered or missing items (defects) that total a goal quantity and 1-p is the desired probability of obtaining one defect in the sample of n items where there are d defects (ditl) in' the population of items.
The number d is a function of the amount of SSNM per item.
If the SSNM content varies over the population of items, the largest value must'be used to calculate d to ensure that n is large enough to guarantee that the power of detection is at least 99 percent.
This results in a conservative value of n, i.e.,
n is larger than necessary.
If a smaller item content were chosen, such as the average value, an informed adversary could selectively divert only iarge items and thereby reduce the risk of detection.
Additional points to consider in this regard include the following:
l In those cases where the SSNM content per item is very small, the required sample size is a small fraction of the inventory.
The i
result may even be that, in some instances the calculated sample size will be less than one.
However, such items cannot be ignored.
An acceptable approach would be to periodically verify one randomly selected item from the class at times chosen by random selection, such as by a random number generator.
27
In some instances an entire-stratum may contain less than 5 FKG.
Nevertheless, such strata should be sampled like any other.
If the number of items, N, in each strata remains reasonably constant (such as within i 10 percent),-it is not necessary to recalculate the fraction of the population, n/N, to be checked each time.
Neither the specific items to be verified in any particular instance nor items that won't be verified shall be predictable.
Every item in a stratum has a non-zero probability of being selected for verification.
When incorrect descriptive information for an item, such as item type, seal number or location is found, the action to be taken will ensure that the item is located, is correctly identified, and the deficiencies in the system are corrected.
Item verification should include positive identification, seal integrity checks, container integrity checks, and location confirmation.
Considera-tions related to verification include the follcwing:
Electronic or optical methods such as bar code readers may be used in place of manual methods to record item or seal numbers provided safeguards against falsification are in place.
If the licensee can demonstrate that seal falsification is non-credible, seal identification can be done on a random basis provided an independent means of confirming item identity, such as unique container numbers, is available.
Seal integrity checks normally will encompass visual examination and, in the case of certain seals (e.g., Type E), physical handling.
Proposed shortcuts may be justified on the basis of low strategic value, limited accessibility, frequency of checks, and backup checks by production, quality assurance, production control, etc. These should be reviewed for acceptability on a case-by-case basis.
The magnitude of the formal item verification effort can be adjusted to take credit for other means of confirming the presence and identity of sealed items.
Process control and accounting, quality control testing, and other production operations routinely generate informa-tion that can serve to verify the identity and presence of sealed items. These sources can be used in lieu of item verification pro-vided the frequency and loss detection sensitivity requirements of the item verification procedure are met and the use of the data for this purpose is not predictable.
Examples of specific sources of such data are:
(1) Records that an item was created (tamper-safing procedure applied) or transferred within the required time span, as defined in $74.55(b);
28
(2) Records that an item was inspected, tested, analyzed, altered, or subjected to any.other production or quality assurance operation within the required time span; and (3) Production schedules showing that a particular item was
" cued up" for production planning purposes where the cueing process involved a check of identity and location.
Any items that have been verified by such a procedure within the time span required for that category of material can be exempted from formal item verification provided, as indicated above, item handling or movement is unpredictable to a potential diverter or the items will be physically accounted for by at least two individuals during sequential processing or inspection steps during the required time span.
To exempt the above items from formal item verification, the items are simply dropped from the list of n items selected from the inventory list where n is the sample size required for verification.
Small items such as element sections and samples can be amassed in a tamper-safed container to alleviate excessive item verification.
Items will be classified as Category IB material and subject to the lower frequency item loss test if:
The dimensions are large enough to preclude hiding the item on an individual (i.e. at least two meters in one dimension, greater than one meter in each of two dimensions, or greater than 25 cm in each of three dimensions.);
The weight of 5 FKG of the material is so large that one person cannot carry the item inconspicuous 1y.
The minimum weight to meet this criterion is 50 kilograms; or The quantity of SSNM in the item is so small that a large number of diversions are needed to accumulate 5 FKG.
The maximum quantity to meet this criterion is 50 formula grams.
The first two exceptions do not apply if the item can be opened or disas-sembled and part or all of the SSNM removed without a high probability of being observed or detected.
The presence of higher tier components such as fuel blocks, preassemblies, subassemblies, etc. stored outside of a permanently controlled access area should be verified in accordance with a sampling plan that provides the capability to detect a 5 FKG loss within one month.
One month is deemed to be acceptable on the basis of the large physical size and weight of these items and the restrictions on removing them from the MAA.
Encapsulated items containing less than 200 grams of SSNM whose presence has been verified during the prior six months as part of a statistical sample or handling during routine production need not be reverified for physical inventory.
Items whose presence has not been verified in the same time interval should be located by two person inventory teams.
29 1
~
- Samples-containing.in' excess of 0.05 FKG can be considered a sidestream-in a~ bulk test performed in the originating' process unit provided the samples are returned to process.within seven' days.
SSNM removals from-such samples should be. documented and-the' area records corrected accordingly.
J.
4 i
30 l'
,e
,,,,,,..,--,,-,--,,r--
- -, -, -.,, - ~
3 ALARM RESOLUTION 3.1 Alarm Resolution Requirement: The rule requires that a licensee resolve the nature and cause of any MC&A alarm within an approved time period.
If a loss has occurred, the licensee is to determine the amount of SSNM lost and, as appropriate, return out-of place SSNM to an appropriate place, update and correct involved records and modify the MC&A system to prevent similar occurrences in the future.
Addi-tionally, if an abrupt loss detection estimate exceeds 5 FKG of SSNM, material processing operations related to the alarm are to be suspended until completion of planned resolution activities unless the suspension of operations will nega-tively affect the ability to resolve the alarm.
However, operations of con-tinuous processes may continue for a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period while checks are made for mistakes (S 74.57(b), (d), (e), and (g)(1)).
Intent and Scope:
The intent of these requirements is that the licensee's alarm resolution systim will be able to respond promptly to alarms indicating a poten-tial loss of SShH and determine whether the alarm was caused by an actual loss or by a system eiror.
The alarm resolution program also should be able to iden-tify the type of system error or innocent cause so that remedial action can be taken.
The alarm )esponse should be timely to ensure that alarms are investi-gated and resolved promptly while memories of events leading up to the alarm are fresh, materials are still available for remeasurement, and fewer changes of process conditions, inventories, in process holdup, and item locations will have occurred.
Prompt resolution will facilitate recovery of " lost" or stolen material.
Plan / Annex Content:
The FNMC Plan contains the following affirmations and detailed commitments.
Supporting information, as appropriate, is included in the Annex.
Section 3.1 of the Plan includes the following affirmations:
A systematic investigation into the nature and cause of each MC&A alarm will continue until the cause has been established or a determination has been made that the alarm is not resolvable with the information currently available.
NRC will be notified when the latter situation occurs within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or within the next working day when a weekend or holiday intervenes.
Written investigation procedures will be maintained which will include decision rules by which a particular cause or combination of causes will be accepted as the cause of an alarm.
Investigation of alarms will be initiated promptly and the maximum allow-able time periods for completion of the alarm resolution procedures will be as specified in Section 3.1.3 A search for a missing item will not be terminated until the item is either located or evidence is obtained that the item has been destroyed.
A claim that an item containing more than 50 formula grams was destroyed without having been recorded will be supported by independent and concrete confirm-atory evidence of destruction.
31
T
' If:the.' integrity of an item has been compromised,:i.e., the container seal
~or-the encapsulation'has been. altered.or broken, an appropriate response procedure will be promptly initiated to determine whether any SSNM;is
]
~
missing.
Compromised items will be placed under surveillance or in secure storage and will.be remeasured within the time period specified in the plan.
The
. quality of the remeasurement will be at least equal to the original measurement.
Following alarm resolution, appropriate corrective action will be taken-to correct any records found in error, to return misplaced SSNM to the proper location, if appropriate,.and to revise the MC&A system to prevent similar occurrences in the future if such action is warranted.
When an actual loss of SSNM is indicated, the quantity of material, lost will.be estimated and other information which may aid in the recovery of the material, such as the material type and container. type, and who last
. had responsibility for it will be' generated, if possible.
~
When a detection alarm indicates a potential loss in excess of 5 FKG,-
continuous processing operations related to the alarm will-be suspended within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the alarm, and the suspension will be continued until completion of.the planned resolution activities unless the sus-pension would negatively affect the ability to resolve the alarm, or When a detection alarm indicates a' potential loss in excess of 5 FKG, batch processing operations will be suspended immediately after the alarm or upon completion.of the batch in process, and the suspension will be continued until completion of the planned resolution activities.
When a process is not shut down,-equally effective alternative measures will be taken when an alarm occurs to protect information and material that would be needed during the alarm investigaticn._ Alternative measures by' unit. process are documented in-the procedures specified in Section 3.1.1.
3.1.1. Alarm Resolution Procedures Describe the alarm resolution procedures that will be applied to the various types of alarms and unit processes. The procedures should take into account credible innocent occurrences that may cause alarms indicating'a potential SSNM loss.
The resolution procedure descriptions may be abbreviated.
l Also describe in the Plan the specific procedures to be employed in response to alarms indicating a potential loss in excess of 5 FKG.
The description should identify those operations that will be shut down or alternative measures that l
will be employed in lieu of shutdown to. facilitate an investigation.
In the Annex, provide (1) a listing of identified credible causes of possible i
alarms by unit process and details of the resolution procedures by which specific r
i l
32 l
l
.. ~ < -
--,-,_----,<---~,-----1,-,,
--_n-----.----,.--,,,--,e--
,,n,
.,-,,-,-,,- - -,,.. - -,---. - _- - - - - - -a.,. - - -,., - -, - - -
i i
l causes could be identified, (2) a statistical estimate of the expected number l
of unre' solvable alarms per inventory period with loss estimates greater than l
5 FKG and a description of the estimation method, and (3) the justification for not shutting down certain process operations during an investigation.
3.1.2 ' Decision Rules l
l Describe the types of information and data developed during response that will j
be accepted as sufficient evidence for assigning a specific cause to an alarm.
The information and data described above should form the basis for development of the decision rules to be included in this section. These rules should take into account every identified potential innocent cause that may result in a bulk or item loss alarm.
3.1. 3 Response Time Indicate the response times that will be allotted to resolve each alarm type.
If alarms involving certain material types or alarms from certain processes require appreciably longer response times than those estimated in the acceptance criteria section on page 30, justify the indicated times.
3.1.4 Item Discrepancies Describe the actions that will be taken in response to the following item discrepancies:
An item has apparently oeen destroyed without being recorded.
]
The integrity of a tamper-safed or encapsulated item has been compromised.
i Unauthorized entry or other violation of control of a vault or a perma-i nently controlled access area has occurred.
A significant difference between the measured input and output value of an untamper-safed item placed in vault or CAA storage has been detected.
The actions in response to these discrepancies should include decision rules which will be the basis of acceptable resolution.
Acceptance Criteria: The assessment of the adequacy of the information supplied above will be based on the following criteria or equivalent:
Resolution procedures are described for alarms that indicate a potential abrupt loss of 5 FKG of SSNM in bulk or item form.
The procedures take into account the expected differences in loss mechanisms and necessary differences in response approaches for in process materials, items, different material types, and different types of unit operations.
The differences and variations in resolution procedures are explained.
Examples of different types of unit processes are:
A bulk storage unit, 33
l A batch process with cleanout between batches and very small amounts of in process holdup, A continuous process with continuous flow between the unit process and the succeeding process, and A process with large hold-up inventories that cannot be measured directly without cleanout.
The alarm resolution procedures provide a systematic and logical sequence of steps for determining the cause or causes of an alarm.
An example of a systematic approach to assessment would be:
Check the data and calculations for clerical, transcription, or computational errors; Trace the data to the primary sources (operator logbooks or production records and analytical reports) to check for agreement; Compare the source data, such as item and batch sizes and numbers, inventory quantities and flow rates, to historical values to detect anomalies that may indicate an error of identification or measurement; Review downstream material balances for potential off-setting gains; Localize the source of the alarm as nearly as possible with regard to time, place, material type, and individuals potentially involved; Report a potential SSNM loss to security who then should implement intensified search and surveillance procedures; Stop further processing in the unit process, if feasible, to retain items.and inventory for remeasurement; and Remeasure all items, inventories, batches, and/or samples from the unit process that are still available.
Each type of alarm response is identified with the corresponding types of material and/or unit processes and the credible innocent causes of the alarm.
Examples of innocent causes would be:
A clerical or computational error is identified that clearly explains the alarm; A missing item is located; A claim that an item was added to the process, although no record of the transfer was found, if substantiated through an actual yield versus predicted yield comparison; t
l A remeasurement confirms that error (s) in the original data caused l
the alarm; or l
34
'A random fluctuation in the' measurement' process or a process vari-ability is~ identified through sufficient measurements.or additional processing.
The decision rules-for a conclusion that a particular cause is applicable L
and that.the alarm is resolved are described.
(Backup information about the rationale and justifications are included.in the Annex.)- A decision rule must generally provide an objective basis for de'ciding whether or not the, data and information acquired up to that point.in the alarm assessment supports the. hypothesis that the alarm was due to an innocent cause. -Each decision rule should be based on the identification of a specific cause_or a: source of incorrect data that contributed to the alarm. level of the loss estimator except that the rule may verify with high probability that no loss has occurred without having identified all contributing causes of the alarm.
Examples of acceptable decision rules are:
A false alarm resulting from a mistake.
I 1.
A correctable mistake identified and supported by direct evidence such as comparison to data collection sheets, reading a column level, or measuring a sample.
4 2.
A correctable mistake or recordkeeping error identified and supported by at least two sources of independent indirect evidence such as consistency of process values, historical ranges, a loss followed by a gain in the following control-unit such that an error in the transfer was identified as greater than measurement error, or an interview with operators j
who observed an unusual process condition.-
3.
A hypothesized uncorrectable mistake (or combination of mistakes) or procedural error which is supported by a difference of oppo-site sign and comparable magnitude in a related loss indicator and two sources of indirect evidence such as process yield, balance around non-SSNM materials, process consistency, or measurement control data indicating a short term failure.
l A false alarm caused by stochastic fluctuationc in the detection l
[
system.
1.
An error resulting from measurement variability identified and supported by remeasuring inventories or transfers where the differences between the original and remeasurement values exceed the two sigma confidence-interval used to monitor and control measurement performance.
2.
An error resulting from variabilities in the process that is confirmed by processing the material through the process and t
verifying the discrepancy by recovering the material.
L 3.
An error resulting from inadequate modeling of in process inventory where continued processing results in a stable I
cumulative loss indicator.
35
i J
4.
A bias identified by an. independent technique that results from differences in material' types being processed.
The alarm resolution time commitments ensure a reasonably prompt alarm response..The check of the loss indicator data for clerical mistakes and data errors should normally be completed within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for any abrupt loss alarm. -The maximum time for completion of the resolution procedure i
for alarms indicating a possible abrupt loss of items that were tamper-safed, encapsulated, or retained in a vault that provided protection i
equivalent to tamper-safing should normally not exceed three calendar -
days.
The maximum time for completion of the resolution procedure for alarms indicating a possible abrupt loss of SSNM in any form or container that was not tamper-safed, encapsulated, or stored in a vault equivalent to tamper-safing should not normally exceed three working days.
- However, if longer time periods are required for certain unit processes -or types of necessary response activities, the licensee should explain and justify the proposed times in the response plan submitted.
When a tamper-safed or encapsulated item has been compromised, a remeasure-ment should be immediately undertaken.
The maximum time after the alarm for. completing a remeasurement to confirm the contents should normally not exceed two working days.
Any proposed extension of that time should be explained and justified.
An example of where additional time might be necessary would be if isotopic measurements are performed off-site.
When a vault or CAA providing protection equivalent to tamper-safing has been entered without authorization, when the prescribed vault protection has been compromised, or when other indications of loss of control are discovered, the entire vault contents should be accounted for within three calendar days by a piece count and attribute test of all items not tamper-safed or encapsulated, such as by weighing or NDA.
Remeasurement of all items in the vault or permanently controlled access area not tamper-safed or encapsulated should be initiated within one working day.
If a longer period is proposed, justification is provided.
Since the number of samples to be analyzed is unknown, it is impractical to specify a time to complete the remeasurement.
Remeasurements of the SSNM to verify the content or composition of items or bulk material associated with an alarm should be made to a standard deviation of the quantity estimate that is comparable to that of the book value, and the hypothesis that the difference between the initial and remeasurement value is zero should be tested at the 0.05 level of significance.
In the event that the cause of the alarm is claimed to be the destruction of an item such as by processing it to another form, without the act having been recorded, confirmatory evidence should be developed to support the conclusion.
The types of confirmatory evidence that are expected to be applicable are described in the plan.
The evidence will be acceptable if it is relevant, concrete, independent, and objective.
Examples of such evidence are:
'l 36
The measured density of a suspect solution is consistent with the-predicted density assuming the contents of the missing container had been added to the process, The actual yield from a suspect unit process is consistent with the predicted yield from that process if it contained the contents of~
the missing item, or The fact-that the container was added to process can be attested to by two individuals.
~
After an alarm has been resolved, the planned corrective action includes MC&A system revisions, if appropriate, that provide reasonable assurance that future alarms of that nature, i.e., having the same or a similar cause,_will not occur.. An example of where an MC&A system revision would be appropriate would be revision of a procedure or computer software that contains an error that caused an alarm.
If one or more items are not found in their recorded locations, the licensee should normally declare the item (s) missing if not found or accounted for within:
24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for Category IA items totalling five formula kilograms or more and three working days for all other items.
A search for a misplaced item that was not tamper-safed or encapsulated should not be terminated without NRC permission until the item is located or evidence of its destruc-tion is obtained, except that a claim that an item was destroyed without recording the fact may be accepted if independent confirmatory evidence of destruction is obtained.
Items containing less than 0.05 FKG are exempted from the requirements for confirmatory evidence.
Searches for missing items should not be interrupted by idle time such as weekends, holidays, etc.
An item loss assessment procedure has been included which details a logical sequence of actions to resolve an apparent loss.
A_ typical assessment sequence (not necessarily in the order listed) might be to:
Determine that the records are apparently correct by tracing the item identification and location information to its source data in inven-tory and production records; Search other production and storage areas to determine if the item was transferred without supporting documentation; Identify all persons involved in creation and movement of the item (s) and question them for possible ways the item might have been misplaced I
l or record errors made; Extend the search to other locations, particularly those suggested by the persons involved; Check for possible errors in the item records by evaluating the bulk r
l material balances in the adjacent processing units; Reinventory all items of that type in storage locations routinely used for such items; and 37 l
l
-r 1
~
Extend the inventory search to items of similar size and appearance.
A description of the licensee's proposed course of action in response to a broken tamper-seal should include:
Placing the item under surveillance immediately or in secured storage and remeasuring it as soon as practicable (time limits specified) to determine if SSNM is missing, Performing blending, mixing, or splitting operations, if appropriate, to assure that any samples taken for remeasurement are representative; and Testing the difference between the original and confirming measurement for statistical significance with a probability of no more than five percent of concluding that no SSNM is missing when in fact a loss has occurred.
The quality of the remeasurement should be at least compar-able to the original measurement.
The operations that will be shut down to resolve alarms in excess of 5 FKG are identified or alternatives to shutdown are provided.
Examples of acceptable alternatives might include:
Shutting down of only downstream operations to retain products that may require remeasurement, Discontinuing the processing of certain sidestreams to retain scrap or recyclable intermediates that may require remeasurement, Diverting scrap, waste or product from the alarming unit to auxiliary vessels or to a buffer storage area to retain the products for remeasurement, Collecting additional samples for remeasurement of materials that would become unavailable if operations were not suspended in the area under investigation.
The key consideration in employing alternatives to shutdown is that the licensee can show that no data or information needed for response will be lost if the alternative is used.
The conditions for restart are specified.
Fundamental to any decision to restart are the alarm has been resolved, i.e., an assignable cause has been found, the loss is real but remedial, or recovery action is underway or the alarm has not been resolved; however, all possible and necessary data associated with the process material have been acquired, and no infor-mation will be jeopardized by resuming operations.
The quality of the licensee's loss resolution capability is such that the combination of the material control test and resolution decisions will permit alarms remaining unresolved after investigation to be good indica-tors of material loss.
To achieve this objective, the licensee's planning 38
data'should demon' strate-that the expected number of unresolved alarms-in-excess of.5 FKGs will be less than-0.10 abrupt loss alarms per inventory-period.
The followingl additional -information is pertinent to this point:
The only. false alarms that need to be predicted are-those due to normal process or measurement system statistical variation.
Mistakes in tran--
scription of data or process upsets do not need to be predicted because the response procedures'should be designed to correctly resolve alarms stemming from those types of. events.
False. alarms-due to statistical fluctuations'are expected to be more difficult to resolve.
One approach is to claim no credit for resolution of statistical alarms.
In that. case, the incremental expected number of alarms with discrepancies greater than 5 FKG can be calculated for a single test from the formula:
AN = 1 - F (5/o).
where o = the predicted standard deviation of the detection test in test in FKG' i.
n F(x) = the predicted statistical distribution of the test statistic normalized by o.
.This increment must then be multiplied by the expected number of times the test will be performad in an inventory period,.and similar calcula-tions then added up over all tests in the facility. 'That sum must be less than 0.10, i.e., the number of such alarms must be less than one j_
every 30 months.
If the distribution function cannot be assumed to the normal (Gaussian) and the true distribution cannot be adequately predicted, the Camp-Meidell inequality may be applied if it is reasonable to expect the true distribu-l tion will be symmetric and unimodal (see Shewhart (1931), pages 176-177; and Eisenhart, Hastay and Wallis (1947), page 49).
The Camp-Meidell inequality permits a bound on N to be calculated from the formula:
AN5(f)(f)2 where o has units of formula kilograms.
However, this will typically be useful only if s is less than 0.1 formula kilogram.
A more useful approach would be to estimate the maximum range that the test statistic could have based on a physical model of the process and measurement systems under the hypothesis of no material diversion.
If this value is less than 5 FKG, set AN = 0.
Evaluation is more complicated if the licensee claims that response procedures will permit resolution of some fraction of the statistical i
39 O
e
. false alarms.
Such procedures would need to be summarized in the plan.
One approach is to make additional measurements of inputs,
. products,.sidestreams, and holdups to complete measured material.
balances where loss detectors are based on average expected yields.
Additional measurement of input quantities requires samples to be-taken and retained.
This would permit laboratory analyses to be made which are more reliable than.NDA.
The procedures also could utilize data resulting from processing the 'same batch through the next. process
-step, data resulting from processing another batch through the same processLstep,:and tests that eliminate intermediate' measurement points by combining several process steps.. In any of these cases, estimating the fraction of-N that would be expected to remain unresolved requires
-detailed modeling of.the response capability.
A Monte Carlo simulation method can be used to model the alarm response procedures and predict the resolution. success rate.
(For a single material control test, refer to Tanner (1981).
For an entire plant, refer to Reardon, Heaberlin and Eggers (1932).
Detailed information is available in Eggers (1982)).
Alternatively, if the licensee.has a performance history of responses to and assessment of alarms, this may be cited in place of the simula-tion'of a proposed response program if the experience demonstrates a capability to meet the commitment goals for resolving false alarms.
3.2 Alarm Reporting Requirement:
The. rule requires that a licensee notify the appropriate NRC 4
Regional 0ffice listed in Appendix A of Part 73 of this chapter of any MC&A
. alarm that remains unresolved beyond the time period specified for its resolu-3 i
tion.
Notification is to occur. within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or by_the next working day when a weekend or holiday intervene.
For alarm estimates that exceed 5 FKG, the notification that an MC&A alarm resolution procedure has been initiated
'is_to occur within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (74.57(c) and (g)(2)).
Intent and Scope:
The intent of.these requirements is that the NRC be made aware of potential MC&A discrepancies in a-timely manner so that appropriate actions can be initiated.
Plan / Annex Content:
The FNMC Plan contains the following affirmations and detailed commitments.
Supporting information, as appropriate, is included in
- the Annex.
Section 3.2 of the Plan includes the following affirmations:
The appropriate NRC Regional Office will be notified within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, or i
by the next workday when a weekend or holiday intervene, of any alarm that -
i remains unresolved beyond the time limit specified for its resolution in l
Section 3.1.3.
4 The appropriate NRC Regional Office will.be notified within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of 4
the initiation of an alarm resolution procedure involving an alarm estimate that exceeds 5 FKG.
40
~,.
_~ -
'3.2.1 1 Reporting Responsibility Indicate how the responsibility for reporting unresolved alarms will be assigned in the organization.
3.2.2 Information
Discuss'the types of information that will be provided to NRC an'd the schedule
^
.for updating the status of the unresolved alarms to NRC.
l l'
.' Acceptance Criteria:
The assessment of the adequacy'of the information supplied above will be based on the following criteria or equivalent:
The responsibility for reporting unresolved alarms is assigned at a suffi-l ciently high level of responsibility within the licensee's organization that decisions on the need for reporting will be timely and unquestioned.
The information to be reported includes:
the magnitude of the discrepancy l
indicated by the. alarm, the investigation procedure, the status of the investigation, the status of.the facility, the planned remedial measures, l
and the status of the security during the period.
q The remedial measures include assigna.ent of responsibility for the.investi-gation to a technically competent individual, rechecking the response of the measurement system to certified standards, outlining a schedule of recalibrations of the key measurement systems if appropriate, in-situ or clean-out measurements of holdup, and statistical evaluation of the material j
accounting data.
With-regard to recurring losses, a significant loss trend will be reported within one week of its discovery and the progress of the resulting investi-gation will be reported monthly.
'3.3 Alleged Thefts i
Requirement: The rule requires that a licensee establish and maintain ability to respond rapidly to alleged thefts (74.57(f)).
Intent and Scope:
The intent of this requirement is to have the capability in place to respond rapidly to alarms occurring external to the MC&A system.
The response capability should provide the information necessary to rapidly assess the validity of an alleged theft.
l Plan / Annex Content:
The FNMC Plan contains the following affirmations and
~
detailed commitments.
Supporting information, as appropriate, is included in the Annex.
Section 3.3 of the Plan includes the following affirmations:
An allegation or other indication of diversion of SSNM from its authorized location will be rapidly investigated and evidence developed that supports l
either a confirmation or a denial.
t 41 I
4 A contingency capability will be maintained to enable on demand location-
~
of any specific tamper-safed or encapsulated item or an unencapsulated item stored in a vault equivalent to-tamper-safing within eight hours, and to verify the presence of all items in a vault within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
-A contingency capability will be maintained to initiate an emergency plant-wide physical inventory of all SSNM in the plant, or in any portion of the plant,.within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after receipt of an NRC order.
(" Initiate" means to begin actions to placesSSNM in a measurable form and perform necessary preparations for conducting a physical inventory).
Accurate item inventory records will be established and maintained to
.{
provide knowledge of the identity, location, and quantity of SSNM in the form of items outside a vault or permanently controlled access area,.and the capability will be maintained to update the records rapidly enough to confirm the presence and integrity of any item within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and, upon demand, all items within~one week.
^
For material not in the form of items, accurate records will be established and maintained on the quantities of SSNM which have been received, shipped, or otherwise removed from each MAA, and quantities of SSNM remaining within l
each MAA and the capability will be maintained to update the records _ rapidly enough to meet the requirements of the emergency plant-wide physical inventory.
3.3.1 Item Control System Describe the item control system that will be maintained in order to readily determine the identity, quantity, and location of SSNM in item form.
The description should include the forms, records, and document flow paths.
Where i
records are not centralized,- the means of record verification by MC&A personnel and the responsibility for maintenance and disposition'should be described.
l 3.3.2 Inventory Verification Describe the emergency physical inventory procedure, including a description of i
the status that each unit operation should be in to be inventoried and indicate the status of each unit operation during its inventory.
In the Annex provide estimates of the times needed to perform and reconcile the inventory and to determine the associated projected variance.
3.3.3 Record Maintenance Describe the protective measures that will be implemented to prevent loss, misplacement, or accidental destruction of inventory and item location records.
Acceptance Criteria:
The assessment of the adequacy of the information supplied above will be based on the following criteria or equivalent:
From the description of the SSNM item record system, it is evident that the records of the identity and location of every item can be updated with sufficient speed to support the commitments that any randomly selected 42
item within a vault can be. located within eight hours, and any item outside a vault can be located within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
The capability also exists to locate all items within a vault within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and all items outside a vault or permanently controlled access area within one week.
Provisions are included for maintaining the availability of forms, tags,
. trained personnel, inventory listing, and other items that may be needed to initiate a plant-wide physical inventory within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
The emergency inventory capability is designed to help answer the following questions:
.Can it be determined conclusively that SSNM is or is not missing from the facility?
What quantity is missing?
What material type is it? For example, what is its isotopic composi-tion, its chemical form, and its physical size?
Over what time period could it have been diverted?
Which plant employees or other individuals might have had access to it during that time?
Which plant employees may be able to provide information useful for its recovery?
Appropriate safeguards are implemented to prevent loss, misplacement, or accidental destruction of the inventory and item location records.
The data collecting, recording, and auditing procedures provide reasonable protection against errors in the records.
Questions and Answers 74.57 Alarm Resolution 1.
Q.
How do alarm resolution requirements integrate the contingency plans for MC&A events required in 10 CFR Part 73?
i A.
Licensees' plans for response to MC&A indications of possible theft or missing SSNM are currently part of the licensees' " Safeguards L
Contingency Plans," required by 10 CFR 70.22(g), 73.40(b), and 73.46(h).
These were prepared in accordance with the critetla in Appendix C to 10 CFR Part 73 and Regulatory Guide 5.55, " Standard Format and Content of Safeguards Contingency Plans for Fuel Cycle Facilities." However, the regulations under which those plans were prepared and reviewed focused on the physical security system.
The proposed amendments would define the performance to be achieved by the licensees in response to detection alarms from the MC&A system and to external allegations of thefts.
Furthermore, the proposed amendments would require reconsideration by the licensee of what constitutes an MC&A detection, with increased attention paid to 43
process and production anomalies that might be due to SSNM loss, and less emphasis on periodic physical inventories.
Thus the licensees would have to submit revised FNMC plans to comply with the proposed amendments, as well as reconsider the parts of their Safeguards Con-i tingency Plans dealing with MC&A events.
Rather than duplicate the same words in both plans, either plan could incorporate by reference appropriate pages of the other.
2.
Q.
What quality of loss resolution must the licensee achieve?
A.
The combined quality of the material control test and loss resolution decisions shall permit alarms remaining unresolved after completion of the licensee's investigative activities to be good indicators of theft or diversion.
This will be judged in two ways:
(1) During review of a licensee's planned detection and alarm resolution capabilities, attention will be directed to the ability to resolve false abrupt loss alarms.
For the alarm resolution capabil-ity to be acceptable, it must appear able to correctly identify all errors due to leaks, process upsets, or human mistakes that are large enough to cause an alarm. With respect to other false alarms, in particular those alarms that are expected to occur because of the statistical nature of the processes and measurement systems, the alarm resolution capability need not be 100 percent effective.
However, for it to be acceptable, it must be effective enough to satisfactorily limit the statistically expected rate of unresolvable abrupt loss alarms.
(The expected rate can be thought of as a weighted average of all possible rates, where the weights are the likelihoods of occurrence of those rates.) A satisfactory limit is an expected rate of unresolvable large abrupt loss alarms less than one pr 10 years per plant.
A large false alarm is one whose loss et,t emate exceeds 5 FKG.
Because the licensee should be able to resolve all such alarms other than those of a statistical nature, calculation of the expected rate of unresolvable large abrupt loss false alarms needs only consider false alarms of a statistical nature.
(2) After the phase-in period is over and all elements of the licensee's alarm resolution commitments have been implemented, the alarm resolution performance would be judged good when:
(a) there have been no situations over the past year in which a large abrupt loss alarm is found in subsequent audits or investigations to have been innocently caused but was not so resolved within the licensee's time commitments; and (b) there are no unresolved large abrupt loss alarms remaining after the quarterly inventories and annual audit have been completed.
S 74.57(f) Alleged Thefts 3.
Q.
What are alleged thefts?
A.
Alarms that originate external to the MC&A system.
Among these are any statements communicated directly or indirectly to facility staff, NRC, FBI, police, etc., that diversion of SSNM under license has 44
occurred.
The statements may or may not include details such as from which plant material was allegedly taken, which item was taken, or submittal of an alleged sample of the material.
This covers threats allegedly from within as well as from outside the facility. An external alarm may include other indications such as an external assault that penetrated an MAA or the discovery that an MAA door had been opened from the inside.
45
i 4 QUALITY ASSURANCE 4.1 Management Structure Requirement: The rule requires that a licensee:
(1) Establish a management structure that includes clearly defined responsi-bility for the planning, coordination, and administration of MC&A func-tions; independence of MC&A functions from production responsibilities; and separation of functions such that the activities of one individual or organizational unit serve as controls over and checks of the activities of others.
(2) Provide for the adequate review and use of those MC&A procedures that are identified in an approved plan as being critical to the effectiveness of the described system (S74.59(b)).
Intent and Scope:
The intent of this section is to require licensees to imple-ment a management structure that permits effective functioning of the MC&A system.
Documentation, review, and approval of the procedures and the assign-ment of the key functions to specific positions eliminates ambiguities about what is to be done by whom.
The management structure is meant to separate key MC&A functions from each other in order to provide cross-checks that increase MC&A system reliability and counter defeat of the system through neglect, deceit, or falsification, and to free MC&A management from conflicts of interest with other major responsibilities such as production.
Plan / Annex Content: The FNMC Plan contains the following affirmations and detailed commitments.
Supporting information, as appropriate, is included in the Annex.
Section 4.1 of the Plan includes the following affirmations:
The overall responsibility for MC&A system management is assigned to a position that provides a separation from production responsibilities or any other responsibilities that may give rise to a conflict of interest.
The responsibility for each MC&A function is assigned to a specific position in the organization in a way that key functions are cross-checked.
The management structure and the critical MC&A policies and procedures are documented and provisions are made for review and approval prior to implementation.
4.1.1 Organization Describe the organization for MC&A including the functional responsibilities for each organizational unit and show how the MC&A organization is independent of responsibilities that have potentially conflicting goals.
47
4.1.2 Policies and Procedures Describe the policies, procedures, duties, responsibilities, and authorities associated with each position involved with an MC&A function in sufficient detail to demonstrate the cross-checks built into the MC&A system.
In the Plan provide a listing (by title and procedure number) of the proce-dures deemed to be critical to the effectiveness of the MC&A system.
Acceptance Criteria:
The assessment of the adequacy of the information supplied above will be based on the following criteria or equivalent:
The MC&A organization is separate from the SSNM production organization and any other organization that generates source data, if practical.
Otherwise controls are in place to ensure that process operations, measurements, measurement controls, accounting functions, and any other activities that influence MC&A system performance are carried out both in the letter and spirit of approved procedures; and that decisions impacting MC&A, that can conflict with production or other plant functions, are under the oversight of an independent authority.
An effective management structure will exhibit at least the folicwing attributes:
The overall planning, coordination, and administration of the MC&A functions for S$NM is vested in a single individual at an organiza-tional level that is sufficient to ensure independence of action and objectivity of decisions.
The individual must be in a position to recommend and initiate timely action for the control and accounting of SSNM including delaying production, if necessary, and must not be enmeshed in a hierarchical framework that could inhibit or compromise independent action.
The assignment of MC&A functions in the licensee organization provides a separation of functions so that the activities of one individual or organizational unit serve as controls over and checks of the activities of other individuals or organizational units.
The critical MC&A functions are documented in written procedures.
The procedures and any revision thereto are reviewed and approved by appropriate management personnel prior to implementation.
The indi-vidual with overall responsibility for the MC&A system will approve all procedures generated in the MC&A organization and be cognizant of all other procedures affecting MC&A.
Critical MC&A procedures should, as a minimum, address the establish-ment of basic MC&A system policies, detection of the loss of a goal quantity, performance of the physical inventory, determination of inventory and shipper-receiver differences, establishment of measure-ment control policies, and determination of measurement and non-measurement errors critical to MC&A.
48
The responsibilities and authorities for each position assigned an SSNM control and accounting function are clearly defined in position descrip-tions that are accessible to all affected personnel and to the NRC upon request.
The individuals responsible for each MC&A function have sufficient authority to perform the function in the prescribed manner.
The overall management responsibility for the MC&A system is at a level at least comparable to the organization having responsibility for produc-tion or storage of SSNM, or a direct line of communication is provided to management level which has the authority to implement measures essential to effective MC&A.
The individuals who generate source data, such as those performing measure-ments, preparing transfer forms, or preparing analytical reports do not perform any accounting or record control functions unless cross-checks of the work are performed to prevent falsification.
Examples of appropriate checks and balances are:
Review of measurement data and calculations by another individual, Maintenance of a duplicate copy of all source data and transfer forms under controls separate from the accounting function, Performance of independent audits, and Separation of computer program maintenance from the program user function.
No individual has the sole authority to recheck, evaluate, or audit infor-mation for which that individual is responsible.
No individual may have responsibility and control of both an MC&A and physical protection function unless independent cross-checks are in place to preclude defeat of the overall safeguards system.
As a minimum the cross-check must include countersigning by one other person of any SSNM transfer within an MAA and countersigning by two individuals for SSNM transfers out of an MAA.
The managament structure provides for assignment of a responsibility for SSNM undergoing processing and in storage to a single individual or group.
The duties of the individual (s) include but are not limited to:
Maintaining appropriate inventory control over SSNM in their assigned area; Authorizing and recording all movements of SSNM into and out of their l
assigned area; Maintaining appropriate local MC&A records or assuring that other records, such as production records, contain necessary MC&A information; 49 l
l
A 4
Participating in physical inver. tories as required; Assisting in internal or external alarm resolution activities as required; Assuring that, when SSNM is processed in bulk form, only authorized perrons.have hands-on access to the material;<and-Notifying proper authorities of irregularities in material and MC&A data handling.
Questions and Answers
- 1.-
Q.
At what level of understanding should MC&A procedures be written?
A.
Procedures such as those used in MC&A should be written so that any-person performing the work should be able to understand the content and meaning of the actions to be taken, the warning statements, and all other messages.
Generally, a twelfth grade level of vocabulary should be used in writing procedures.
This restriction does not '
apply to the technical terminology included in the procedures, although these terms must then be' included in any specific training that involved personnel are required to take.
2.
Q.
What is a systematic task analysis, and how will it help to define the content of procedures?
A.
A task analysis breaks down and evaluates in a systematic manner a human function in terms of the abilities, skills, knowledge, and
-attitudes required for' performance of the function.
These analyses
.may be performed to differing degrees of depth, depending on the information requirement and its specific application.
e A task analysis will assist the procedure developer by systematically outlining the steps to be performed to complete a task, the' personnel needed to complete each step, and the requirements of each person.
i Procedures usually do not require an in-depth task analysis, but consideration of the needs of personnel will usually make procedures better.
3.
Q.
Why should procedures be reviewed and verified before being accepted for regular usuage?
A.
Procedures that contain inaccurate or incomplete information are i
misleading and can be detrimental to MC&A information error rates.
Review by personnel who have previously performed similar tasks or are familiar with the process to be performed will frequently i
discover omissions of required information, misleading information, t
or mistakes.
[
Verification of the procedures involves field testing by the personnel who will be using the procedures to determine problems not found j
during the review phase.
50
+ +-
m
.%<.s y.#
,r.,
m
-r
4.2 Personnel Qualification and Training Requirement:
The rule requires that each licensee ensure that key personnel, who work in positions involving tasks where mistakes could directly ' degrade r
the safeguards capabilities of the MC&A system, are trained to maintain a high level of safeguards awareness and are qualified to perform their jobs (74.59(c)).
Intent and Scope: The intent of this section is to ensure that the effectiveness of the MC&A system is maintained by.the qualification and training of key personnel. A training and qualification program can help ensure that these individuals are adequately prepared to perform their functions correctly with a minimum of errors.
The program should be structured to define job require-ments,--to establish minimum qualifications for candidates, to train and qualify the candidates, and to define requalification criteria.
t Plan / Annex Content: The FNMC Plan contains the following affirmations and detailed commitments.
Supporting information, as appropriate, is included in-the Annex.
Section 4.2 of the Plan includes the following affirmations:
The duties, responsibilities, essential functions, and qualifications of key MC&A positions, i.e., those involving tasks where mistakes could 5
directly degrade the safeguards capabilities of the MC&A system, are defined in written job descriptions.
4 The individuals designated for key positions do not assume the positions until they have demonstrated their competence through tests that will determine whether or not the individual satisfies the pre-established qualification criteria for the positions.
1 A training and qualification program for key MC&A positions and a method i
of demonstrating continued competency of personnel has been implemented t
and will be maintained.
The program is periodically updated to reflect changes in job requirements.
The descriptions of the key job functions, the design of the training and qualification program, and the method of confirming qualifications of personnel are subject to the formal approval of the MC&A manager.
4.2.1 Training Program Describe the fundamentals of the training program that will be implemented to ensure the competency of key MC&A personnel. The description should identify the training program structure, source of instructional material, and general training objectives.
l In the Annex, provide an example of a typical training program for one typical position and a tabulation of the key MC&A positions.
51
4.2.2 Qualification Program Describe the qualification program including generic qualification criteria for the key MC&A positions and the criteria for assessing the need for requalification.
In the Annex, provide an example of the complete qualification criteria for a
' key MC&A position.
Acceptance Criteria: The assessment of the adequacy of the information supplied above will be based on the following criteria or equivalent:
The list of key positions or functions includes all.those for which errors or faulty performance could directly /
de SSNM control and accounting.
These include MC&A management positi... and individual contributor positions having responsibility for key measurements, data ' analysis, preparation of accountability source documents,.and collecting or recording of other data having a direct impact on loss detection, alarm response, and quality assurance functions.
The qualification criteria for the key positions are consistent with the posit Nn _escriptions and focus on minimum levels of education and exper-tence knowledge of the job content and its purposes, types and levels of skills or proficiencies, and understanding of the safeguards role and its importance. The criteria are defined in terms of measurable performance goals whenever possible.
The training program emphasizes the job purpose and scope; relationship to other positions, especially the MC&A positions; the role or significance with respect to MC&A; technical knowledge; understading of duties, respon-sibilities and procedures; and skill development.
The training plans provide for a reasonable balance of theory and practice, or oral and written instruction versus demonstration and learning-by-doing, the use of on-job training for positions that are primarily operational or clerical, and individualized instruction based on performance goals whenever feasible.
Tests for positions requiring measurements, calculations, or recording of data and information will include demonstration of correct and accurate job performance. 'When operating procedures or manipulative skills are required, the tests will include hands-on demonstrations on competence.
The continuing qualification of key personnel will be verified on an ongoing basis or at least every two years.
The training program provides for training of personnel already experienced and functioning in MC&A positions at the time of Plen implementation when r
competency tests indicate that additional training is called for.
The i
criterion will be whether or not the individual can function at the level of proficiency called for in the qualification criteria.
l l
52 4
---.--.e
,.--,--,-c.-._
n a------..
-,----------.,-,,..,,r, c
,4.3 Measurements Requirement:
The rule requires that a licensee establish and maintain a system cf measurements sufficient to:
(1) Substantiate the plutonium element and uranium element and isotope content of all SSNM received, produced, transferred between areas of custodial responsibility, on inventory, or shipped, discarded, or otherwise removed from inventory;
'(2) Provide the necessary_ data for the performance of the material control
' tests required by $74.53(b); and (3) Permit an estimation of the standard deviations associated with each measured quantity (74.59(d)).
Intent and Scope:
The intent of these requirements is that all SSNM values used for MC&A purposes be based on measurements and the uncertainties associated with
~
the measured values be quantifiable.
. Plan / Annex Content:
The FNMC Plan contains the following affirmations and detailed commitments.
Supporting information, as appropriate, is included in the Annex.
-Section 4.3 of the Plan includes the following affirmations:
o Measurement systems are in place to substantiate the element and isotope content, as appropriate, of all SSNM received, produced, transferred between areas of custodial responsibility, on inventory, or shipped, I
discarded, or otherwise removed from inventory.
.SSNM quantities transferred into and out of each unit process are based o
on measurements for mass, volume, element, and isotope, as necessary, to accommodate material loss detection tests.
4 o
Factors employed in process models are based on measurements and are updated at least annually.
4.3.1= Measurement Points Identify each point in the process where measurements are made for special nuclear material control and accounting purposes.
References to process flow diagrams included in the Annex are acceptable.
4.3.2 Materials and Measurements i
j Characterize the materials and measurements for each measurement point. One suitable means of presentation would be a coded chart showing the types of materials and the components of measurement involved at each measurement point l
.(i.e. weight, volume, sampling, analytical assay, or nondestructive assay).
l l
53 l
. ~
In the Annex: provide'a-detailed description of the measurement systems that will'be employed for.MC&A purposes. The description should include:
General characteristics (equipment, range of application and sensitivity);
-Method description,'and Estimated measurement uncertainties.(random.and fixed).~
> Acceptance Criteria. The assessment of the adequacy of the information supplied above will be based on the following criteria or equivalent All measurements points have been identified and as a minimum include the.following:
Facility receipts;.
Transfers between areas of custodial responsibility; Points where SSNM is produced; Unit process boundaries; Facility shipments including product, scrap, and waste; Effluent 'discharp'. points; and Significant sidestreams.
The material types to be measured at each measurement point and the measurement system involved are described in the Plan.
A " measurement system" should include:
Sampling method (if appropriate),
Mass or volume (if appropriate),
. Chemical assay, or Nondestructive assay, Isotopic analyses (if appropriate),
The descriptions of the components of each measurement system reflected in the Annex should include:
Equipment, Synopsis of technique, Range of application, 1
54
Sensitivity, Precautions, and Random / fixed error estimates.
The use of factors is limited to those situations where timely measurements are impractical. A commitment should be included to the effect that factors will be based on measurements, monitored, and updated when appropriate statistical tests indicate the need for updating.
In the Annex, the licensee should provide the justification for employing I
i factors la lieu of measurements.
Appropriate measurements for material control tests will depend upon the following considerations:
Availability of substitute materials, Predictability of material composition, and Material accessibility These considerations influence whether a test as simple as a weight compar-ison will suffice as a means of loss detection or a measurement for element and perhaps isotope is necessary.
4.4 Measurement Control Requirements: The rule requires that a licensee assure that the quality of SSNM measurement systems and material processing practices is continually controlled to a level of effectiveness sufficient to satisfy the capibilities required for detection, response, and accounting.
To achieve this objective the license should:
(1) Perform engineering analyses and evaluations of the design installation, preoperational tests, calibration and operation of all measurement systems
(
to be used for MC&A purposes.
(2) Perform process and engineering tests using well characterized materials to establish ~or to verify the applicability of existing procedures for mixing and sampling SSNM and maintaining sample integrity during transport and storage.
(3) Generate current data on the performance of measurement processes, including, as appropriate, values for bias corrections, uncertainties on calibration factors, and random error standard deviations.
The program shall include:
(i) The ongoing use of standards for calibration and control of all applicable measurement systems.
Calibrations shall be repeated whenever any significant change occurs in a measurement system 55
or when program data, generated by tests performed at a predetermined 4
frequerwy, indi: ate a need for recalibration. Calibrations and tests shall bi based an standards with traceability to a national standard or nationally accepted measurement system.
(ii) A system of control measurements to provide current data for the determination of. random errors that are significant contributors to the measurement uncertainties associated with shipper / receiver differ-ences, inventory differences, and process differences.
(4) Utilize the data generated during the current material balance period for
.the estimation of the standard error of the inventory difference (SEID) and.
I the standard deviations associated with the process differences. Measure-ment error data collected and used during immediately preceding materiai balance periods may be combined with current data provided that the measurement systems are in statistical control, and the data are utilized in the determination of current period SSNM values.
(5) Evaluate all program data and information to assure that measurement performance is so controlled that the SEID estimator is less than 0.1 percent of active inventory for SSNM processing facilities.
(6) Apply bias corrections by an appropriate procedure whereby:
(i) Bias corrections are applied to individual items whenever the bias estimate exceeds both twice the estimated standard deviation of the estimator, 50 grams of SSNM, and the rounding error of affected items.
(ii) The impact of all biases that are not applied as corrections to individual items, are applied as a correction to the inventory difference.
(iii) If, for like-material types, shipper / receiver differences accumulated over six month period exceed the larger of one FKG or 0.1 percent of the total amount received, then the licensee will investigate and take corrective. action, as appropriate, to identify and reduce asso-ciated measurement biases.
(7) Establish and maintain a statistical control system designed to monitor i
the quality of each type of program measurement.
Control limits shall be established to be equivalent to levels of sinnificance of 0.05 and 0.001.
Control data exceeding the 0.05 limits shall be investigated and corrective action taken in a timely manner. Whenever data exceed the 0.001 control limit, the measurement system shall not be used for MC&A purposes until it has been brought into control at the 0.05 level.
Intent and Scope: The intent of these requirements it that the licensee continually control the quality of measurement systems employed for MC&A to a level sufficient to satisfy the capabilities required for loss detection, response and accounting.
The goals of the quality control program for SSNM i
measurements are to maintain the SEID within the limits specified in $74.59(e)(5) and minimize the measurement error contribution to the standard deviations associated with the material control tests required oy 974.53(b).
56 i
l
Plan / Annex Content: The FNMC Plan contains the following affirmations and detailed commitments.
Supporting information, as appropriate, is included in the Annex.
Section 4.4 of the Plan includes the following affirmations:
Engineering analyses and evaluations are performed on the design, installa-tion, preoperational testing, calibration, and operation of all measurements systems to be used for MC&A purposes.
Process and engineering tests are performed, using well characterized materials, to verify the applicability of mixing and sampling procedures for SSNM and assure sample validity during transport and storage.
Current data is generated during the inventory period for establishing bias correction values, uncertainties on calibration factors and random error variances.
Current inventory period data is utilized for the estimation of the SEID and the standard deviations associated with the process differences.
Data generated in immediately preceding material balance periods may be combined with current data when it can be demonstrated that the data is from the same distribution, and the combined data are utilized to establish current period SSNM values.
Measurement system performance is controlled such that the total SEID will not exceed 0.1 percent of the active inventory.
Bias corrections are 9pplied to individual items whenever a bias estimate exceeds twice the estimated standard deviation of the estimator, 50 grams of SSNM, and the rounding error of affected items.
Otherwise the impact of uncorrected biases is applied as a correction to the inventory differ-ence.
Uncorrected biases are not entered in the accounting records.
A statistical control system is maintained to ensure that measurements employed for MC&A purposes v a obtained from measurement systems that i
are in a state of statistical control. Control limits are established at the 0.05 and 0.001 levels of significance.
Bias corrections associated with material control tests are either applied prior to assessing the significance of the test results or are available for resolution.
When a statistically significant change occurs in the estimated standard deviation of a material control test statistic, the alarm threshold of the test is adjusted as necessary to ensure that a goal quantity loss of SSNM will be detected with a probability at least as high as that required in the regulations ($ 74.53(b)(2)).
Additionally, the charge will be investigated to an extent sufficient to determine the cause.
When a process modification occurs, sufficient data are generated to provide a reliable estimate of the standard deviation applicable to the material control test.
57 l
The magnitude of the uncertainties associated with process variabilities is determined and applied in the overall uncertainty (standard deviation) utilized in establishing alarm thresholds.
The cumulative shipper-receiver differences for each like material type are routinely monitored, and when they are determined to be statistically significant and exceed the larger of one FKG or 0.1 percent of the quantity shipped, corrective action is taken to identify and correct measurement biases.
Contractors who perform MC&A measurement services will implement and maintain a control program for measurement errors and for human errors.
The program will be of such depth and intensity as not to degrade the MC&A system.
The estimated standard deviations of the material control test statistics are maintained at or below a level sufficient to achieve the loss detection capabilities established pursuant to S 74.53(b) without incurring an exces-sive rate of false alarms.
Sufficient standards measurements and replicate analyses of process mate-rials are performed to permit a determination of the standard deviation associated with each measured quantity.
4.4.1 Measurement Control for Detection / Response Measurements' Describe the measurement control program applicable to those measurement systems utilized for detection and response.
The description should include:
The general types of standards that will be utilized; The procedure for certifying the values assigned to the standards; The minimum number and analysis frequency or schedule of standard and process material measurements that will be used to establish the magnitude of biases, calibration and contrcl measurement errors, and variances of random errors; The means of monitoring the magnitude of biases and variances; The criteria for determining the need for recalibration; The means of establishing mixing and sampling errors; The tests and criteria for judging the acceptability of data pooling; The measures to ensure that bias estimates and variances reflect the actual operating conditions and process materials; The tests that will be employed to identify outliers; and The tests for assessing the significance of bias estimates.
t 58
In the Annex provide:
A listing of the standards to be used with each measurement system l
and, for in-house standards, how they will be prepared; A brief description of how assigned values of standards are determined; A brief description of the calibration procedures for each measurement system; and A listing of expected or estimated variances associated with each measurement system.
4.4.2 Measurement Control for Inventory and Shipper-Receiver Measurements Describe the measurement control program applicable to those measurement systems utilized for inventory and shipper-receiver purposes.
(Note:
References may be made to Section 4.4.1, as appropriate.)
4.4.3 Standard Error of the Inventory Difference Estimator Provide an explanation of the statistical basis for determining the SEID estimator. The description should include the means of monitoring the overall measurement system uncertainties to ensure that the SEID does not exceed the applicable limit defined in 9 74.59(e)(5).
In the Annex, provide the statistical model and equations or literature reference with an example calculation of a typical material balance.
4.4.4 Cumulative Shipper-Receiver Differences Describe the program for monitoring cumulative shipper-receiver differences (CUMSRD). The description should include:
The means of determining the uncertainty against which the significance of the difference will be assessed; and The course of action with respect to review of measurement systems, shipper notification, and treatment with respect to impact on ID (i.e., how the impact of the CUMSRD will be accounted for in the evaluation of ID significance).
Acceptance Criteria; The assessment of the adequacy of the information supplied above will be based on the following criteria or equivalent:
Proposed mixing and sampling studies appear to be adequate for assessing the capabilities of a sampling technique to produce representative samples.
Considerations applicable to sampling techniques are:
Sample size should be a function of material homogeneity, number of containers sampled (if compositing), physical form of the material, and the particular sampling device used.
59
~
Sampling-of solutions containing solids should be avoided whenever possible unless it can be.shown that representative sampling is possible or the solids have no SSNM content and do not contribute any significant error. to the bulk volume or bulk weight measurement.
Subsampling requirements should also be addressed in the sampling evaluations.
Grab sampling should generally be avoided unless it can be shown -
that the involved materials are sufficiently homogeneous and stable.
Sample integrity during storage can be demonstrated by a comparison-of measurement results taken immediately with results on the same i.
samples following an extended period of storage.
Calibration and control standards have assigned or certified values that are traceable through an unbroken chain of comparisons, including the overall uncertainty in each, to a national standard or physical constant.
Control standards should be representative of the material being measured with respect to matrix and SSNM concentration unless it can be demonstrated 1
that the non representative aspects have a negligible impact in that measurement'results are unbiased.
1 Control measures that will ensure or confirm the continuing validity of standards' assigned values are indicated.
Examples of the types of controls that would be appropriate are:
Storage of metal standard weights in a non-corrosive atmosphere; Tamper-safing of NDA standards immediately after makeup; Storage of solution standards in more than one container when usage will be over an extended time period (e.g. > one month);
Storage of standards witkan affinity for moisture in a desiccator; l
and Remeasurement of the stanoard to confirm that its value has not
- changed, The estimated standard deviations of the material control test statistics are derived from the monitoring program data that are collected in such a manner that they represent the current performance of the process and measurement systems.
Values obtained when the process is operating in an abnormal manner or when a significant process upset or anomaly has occurred will not be included in the data used to estimate the standard deviation.
However, data are discarded only on the basis of pre-established objective criteria.
Data may not be pcoled over periods of time when significant process or measurement syste.m changes have occurred. When data pooling is appropriate, statistical tests will be applied to demonstrate that the means I
60
..~.
and variances are from the same distribution at the 0.05 level of signifi-The data will be tested for randomness (see Jaech, Section 2.9.2) l cance.
and normality when tests, such as the F-test on variances, are distribution l
dependent.
The quality control program for monitoring detection system effectiveness should have as its key goal assurance that the estimates of standard devia-tions used in establishing action thresholds that comply with the detection probability criteria neither underestimate nor overestimate the true standard deviations of the tests.
It is most important to ensure that the estimate of the mean and standard deviation for each material control test reflects the actual operating conditions and error sources. Generally, this is done by calculating them from sets of material control test data, but it is very important to avoid serious inflation of the variability of the data that would result in the event of actual losses of SSNM or out-of-control process variables.
Therefore, both the measurement component and the overall standard deviation should be monitored for diagnostic purposes.
Failure to consider all sources of nonccrrectable variation, including normal process variations, would result in an unrealistically small estimate.
Use of too small an estimate could result in an action threshold being set too high to provide the required loss detection probability.
The standard deviation of each material control test statistic is period-ically checked by comparing an estimate of the current standard deviation with the prior value used in setting the alarm threshold.
The estimate of the current standard deviation will be based on at least the 10 most recent values of a test statistic whereas the reference value will be based on at least 20 values.
The alarm threshold for a material control test is adjusted when a statis-tically significant change of the standard aeviation is indicated. The change of the standard deviation is considered significant when the null hypothesis for an F test is rejected at the 0.05 level.
Calibration procedures are adequate te ensure that the measurement systems will generate reliable results.
Considerations in this regard are:
The number of runs to establish the initial calibration are sufficient to establish a reproducible calibration.
The calibration range spans the anticipated range of process values and the standards are adequately spread over the range.
For point calibrations utilizing 3 single calibration standard, the unknowns should be within i 10 percent of the assigned value of the involved standard.
Standard measurements are spread out across the material balance period with the expressed objectives of monitoring calibrations for trends or sudden shifts and providing the necessary data for bias estimates.
l I
61
Recalibrations are performed when a need is identified.
Recalibrations
~
would be deemed necessary when:
A trend, shift, or out-of-control condition at the 0.001 level is detected; A' bias estimate exceeds the 95 percent confidence level;
' A change in process materials occurs that extends the needed range of calibration or renders the calibration / control standards nonrepresentative; or A change or modification is made to a measurement system that has the potential'to affect measurement results.
All measurement systems affecting a material control test, ID estimate, or shipper-receiver comparison are monitored for bias except as noted below.
l
-The intensity of the renitoring program is proportional to the significance of the measurement sys6em for the test involved.
The key measurement systems', i.e., those that contribute greater than 90 percent of the esti-mated standard deviation due to measurements in the material control test and shipper-receiver uncertainties and at least 90 percent of the measure-ment uncertainty associated with the ID estimator, are tested for bias at least monthly except where:
The measurement system has been demonstrated to be quite stable and the results predictable, The bias estimate of a measurement system utilized solely for material control test affects inputs and outputs equally and therefore the
+
effects of bias cancel, The bias estimate for a measurement system utilized solely for material control test is shown to be constant and docs not impact the material i
control test, or The system is defined as bias-free.
Where the above conditions exist, the bias tests can be extended to three months or exempted altogether if the system qualifies as bias-free.
The bias tests will be made using the mean of at least eight standard I
measurements.
Bias corrections will be made to ids if the bias exceeds twice the standard deviation of its estimator, 50 grams of HEU, U-235, U-233, or Pu and the rounding error of affected items.
i All other measurement systems shall be monitored for bias and tested every three months except for those measurement systems involved with movement of material across the MAA boundary and no cross-check measurement is performed.
Such systems shall also be tested monthly.
Measurement systems are considered to be " bias-free" if a standard is run for each unknown or set of unknowns measured at the same time, or standards i
62 i
...-n
.--...----,._.n.
-.,.-..,---,--,,,.,..,,,n,-,r-n-,.,.,.
,n.--
'I are measured before or after a group of process samples and the standard measurement response and assigned value, rather than any previous calibra-tion information, are used in determining the value of the unknown (s).
The measurement control program produces data that are representative of actual operating conditions and all errors that impact ID.
The uncertainty estimates that contribute more than 90 percent to the standard error of the I
ID estimator will be based on a minimum of 15 standard or replicate process material measurements, as appropriate.
The licensee has demonstrated that the standard error of the ID estimator meets the requirement of 9 74.59(e)(5).
j Error variances associated with calibrations will be determined and applied in accordance with the following:
For point calibrations, where a standard is measured with each unknown, the uncertainty associated with the standard measurement is treated as a random error, while the uncertainty associated with the standard's assigned value is treated as a fixed error.
For point calibrations, where standards are run before and after a group of process samples and the average measured value of the stan-dards is utilized in the element and/or isotope determination, the uncertainty associated with the standard's everage measured value is treated as a fixed error for the group of process samples.
For line or curve calibrations, the uncertainty associated with the calibration parameters is treated as a fixed error.
Correlation between terms are taken into account in the determination of fixed errors whenever bias corrections are cade to calibrations.
Data from intercomparison programs and from intra-laboratory comparisons is not acceptable for determining bias.
CUMSRDs on like kinds of material will be monitored for trends that may l
be indicative of a bias in the shipper's or receiver's measurements.
For the purpose of this requirement, "like kinds of material" means major l
l categories having the same chemical and physical form (e.g., UFs, Pu0 2 powder, UC coated particles, etc.).
The standard deviation applicable to a shipper-receiver difference will take into account all measurement variances and covariance effects.
The CUMSRD will be tested at the 0.05 significance level.
If a significant difference is determined to exist and it exceeds one percent of the amount received, the licensee will conduct an investigation involving the shipper and a referee as appropriate.
Appropriate statistical methodology for analyzing CUMSRDs can be found in Rose and Scholz (1983).
63
The methods of monitoring.and controlling measurement performance are o
adequate to ensure.the reliability of the measurement systems used for
.MC&A purposes.. Examples.of acceptable methods include control charts and automated data analysis performed on an ongoing basis.
Considerations to be taken into account include:
The proposed method is capable of providing timely information on the control status of measurement systems including the possible~ presence
~
of unacceptable trends.
The control limits are established at the 0.05 and 0.001 levels of
-~
4 significance or are more conservative.
Response actions include commitments to (1) collect additional data when a single point exceeds the 0.05 limit, (2) notify the individual ~
responsible for the measurement control program when two consecutive data points fall between the 0.05 and 0.001 limits, (3) initiate an investigation to identify an assignable cause when a data point E
exceeds the 0.001 out-of-control limit and (4) remove out-of control measurement systems from service until control is restablished at the 0.05 control limit.
- 4. 5 Physical Inventory Requirements:
The rule requires that a licensee should:
(1) Except as required by Part 75 of this Chapter, perform a physical inventory at least every six calendar months and within 45 days from the start of the 4
ending inventory:
4 Calculate the inventory difference, estimate the standard error of the inventory difference, and investigate and report any difference that exceeds three times the standard error and 200 grams of plutonium or uranium-233 or 300 grams of uranium-235, and If required to perform an investigation pursuant to paragraph (i) of j
this section, evaluate the significance of the inventory difference i
relative to expected performance as determined from an analysis of an appropriate sequence of historical inventory differences, t
Investigate and report to the appropriate NRC Regional Office any difference that exceeds its limits of expectation; and
(
Perform a reinventory if so directed by NRC; and Reconcile and adjust the plant and subsidiary book inventories to the results of the physical inventory.
(2) Implement policies and procedures designed to ensure the quality of physical inventories. Appropriate practices and procedures shall include:
Development of procedures for tamper-safing of containers or vaults containing SSNM not in process that include adequate controls to
}
assure the validity of assigned SSNM values; i
64
,_---,.~-___..,__m
___,__,.-,-...e.m._,,,,,,-ww,,.,,,_
,,m,
i Records of the quantities of SSM added to and removed from process; Requirements for signed documentation of all SSM transfer between areas with different custodial responsibility that reflects all quantities of SSM transferred:
Means for control of and accounting for internal transfer documents; f.
Cutoff procedures for transfers and processing so that all quantities
.are inventoried and none are inventoried more than once; Cutoff procedures for records and reports so that all transfers for the inventory and material balance interval and no others are included in the records; Inventory procedures for sealed sources and containers or vaults containing SSM that assure reliable identification and quantification of contained SS M; Inventory procedures for in process SSM that provide for measurement of quantities not previously measured for element and isotope, as appropriate, and remeasurement of material previously measured but.
J.
whose validity has not been assured by tamper-safing; and Written instructions for conducting physical inventories that detail 3
i assignments, responsibilities, preparation, and performance of l
inventory ($ 74.59(f)).
I Intent and Scope:
Periodic physical inventories enable a licensee to adjust accounts to accurately reflect the status of the SSM inventory within a facility. Comparisoas of the book inventory to the physical inventory, i.e.,
i the inventory difference, also serve as a quality control check on the perform-Ence of the material control tests employed for prompt loss detection.
The subdivision of a facility into multiple process units and the performance of material control tests will enhance the resolution of significant ids through better loss localization capability. Additionally, material control test results will be useful in pinpointing the time when an anomaly likely occurred.
Plan / Annex content: The FNMC Plan contains the following affirmations and i
detailed commitments.
Supporting information, as appropriate, is included in the Annex.
Section 4.5 of the Plan includes the following affirmations:
o A measured physical inventory is performed every six calendar months and within 45 days of the start of the ending inventory:
An ID and associated standard error are calculated; Any ID greater than 300 grams of uranium-235 (200 grams of plutonium or uranium-233) and three times the SEID is investigated and reported; 65
All investigations include an evaluation of the significance of the 10 relative to expected performance as determined from an analysis of an appropriate sequence of historical inventory differences.
Any difference that' exceeds its limits of expectation is. investigated and reported to the appropriate NRC Regional Office.
Actions in response to excessive ids will be as described in Section 4.5.3.
The material accounting records are reconciled and adjusted to the results of the physical inventory.
4.5.1 Facility Preparation Describe the preparation of the facility for physical inventory. The descrip-tion should include:
The basic approach to facility preparation (e.g. draindown, cleanout, etc.);
The degree to which any inventory prelisting will be utilized, and the means of verifying the prelisted items; The means of controlling inventory listing forms and tags; The cutoff procedures for SSNM processing, transfers, and records adjust-ments to ensure an accurate recording of material transactions and inventory listing; The organization of the inventory teams including the cross-checks to prevent falsification and minimize mistakes; and The criteria for tamper-safing containers or vaults whose SSNM content will be accepted for inventory.
4.5.2 Inventory Performance l
l Describe how physical inventories are conducted. The description should address the following:
The techniquA to assure that all SSNM is inventoried and none is counted more than once; The measurements that will be performed specifically for inventory purposes; The use of prior measurement data, factors, and composite data; The degree to which holdup will be cleaned out and the measurement of residual holdup; and The use of post-inventory inspection techniques (if employed).
In the Annex provide an example of a typical inventory listing by material type and quantity.
66
4.5.3 Inventory Reconciliation Describe the reconciliation procedure including:
The method of calculating the SEID, The criteria for investigation of ids that exceed three times the SEID, The method of establishing the total error against which an ID that exceeds three times the SEID will be evaluated, The criteria for establishing the depth of investigation for excessive ids and the types of investigative actions, The handling of prior period adjustments and uncorrected biases, The method of adjusting the book records to the results of the physical inventory, and The means of establishing the active inventory including the source records that will be used in the computation.
Acceptance Criteria.
The assessment of the adequacy of the information supplied above will be based on the following criteria or equivalent:
The physical inventory procedures provide for verifying the location and identity of all quantities of SSNM.
The SSNM quantity of each component in the material balance is based on measurements.
By-difference accounting is not acceptable.
Use of inventory cutoff and cutoff verification procedures, tag procedures, and post-inventory inspections or equally effective measures are used to ensure all quantities are accounted for and not counted more than once.
Sufficient information is provided in the plan to show that the inventory process is organized and coordinated to ensure the use of uniform and consistent procedures for checking and recording the SSNM status.
The SSNM content of groups of like items can be determined by averaging typical contents as determined by measurements of representative item samples of that material at the time of the inventory if the licensee demonstrates that any additional uncertainty resulting from this averaging method is included in the SEID estimator.
Adjustments to reconcile the book inventory to the physical inventory will be in accordance with commonly accepted accounting practices, and the adjustments will be traceable and auditable.
The effect of prior period adjustments will be taken into account before the significance of the current period ID is assessed.
Prior period adjustments could be the result of:
Remeasurement of scrap generated and measured in a prior period but remeasured by a higher quality method in the current period resulting in the assignment of a different value; 67
4 b
Recovery of scrap generated in a prior period'where the processing
-to a better. measurable form results in a " gain" or " loss" of material; or Resolution of;an' outstanding shipper receiver difference from a prior period.
The' appropriate procedure for dealing with these discrepancies is, for
-- purposes of ID' evaluation, to modify the ID quantity by adding or subtracting a quantity of SSNM equivalent-to the adjustment prior to assessing the significance of the current period ID.
However,.as with the uncorrected bias case, the adjustment to the book records must include the prior period adjustments in order to bring the accounting' records into-
- balance.
With respect to the processing of scrap generated in a~ prior period, the assigned value must be based on dissolver. solution and dissolver residue measurements and not on the product of the scrap plant.
This is because losses may occur during the separation and purification stage which should, in fact, be attributable to current period processing.
. All.SSNM values on the physical inventory listing must be based on measure -
ments.
Prior measurement values may be accepted for inventory provided they were determined on a measurement system subject to the licensee's measurement. control program, and the containers were either tamper-safed,-
stored in an area that provided protection' equivalent to tamper-safing, or encapsulated..
The method to be used for estimating the SEID for the typical material balance, as shown in the Annex, meets the following cfiteria:
All reasonable and probable sources of measurement error for the key measurement systems affecting ids are included.
The selection of the key measurements whose variances are to be-included in calculating the standard error is justified by an analysis of the relative magnitudes of the variance components of a typical ID and their comparative effect on the SEID.
Any measurement error standard deviations not actually determined by
.the measurement control program are shown to be reasonable either by comparison with published state-of-the-art measurement performance in similar applications (see such sources as Rogers (1982), and Reilly and Evans (1977)) or with records of past performance data from the licensee's facility.
Records showing these data must be available to the NRC.
The calculation of the SEID is performed in accordance with a recognized error propagation method.
(Such methods have been published by Jaech (1973); Tingey, Lumb and Jones (1982); and the IAEA (1977)).
68
Assessment of the significance of current period material balance results by sequential analysis of prior period ID data requires consideration of several relevant points.
These are:
The sequence of ids used for analysis should possess essentially the same components as the current period.
That is, the throughputs should be approximately the same (e.g., i 25 percent to 30 percent),
the same process units should be operational, and the process should not have undergone any major modifications. With respect to the unit operations, it is not essential that all units operate every period but rather that the grouping of ids for analysis take into account which units were operative. As to process modifications, a major modification would be one that has a significant impact on measurement capabilities or holdup patterns.
"Significant" means a change in the SEID of i 30 percent or greater.
The analysis of a sequence of ids to establish a representative standard deviation must take into account the covariances that exist between adjacent (lag 1) and alternate (lag 2) pairs.
The AAMASS methodology (Lumb and Tingey (1984) and INDEP (Lumb and Associates (1986) provide two acceptable means of determining the historical standard deviations taking covariances into account.
The criteria against which the significance of a current period ID should be evaluated can be established by at least two different methods.
These are:
Control chart limits constructed with current and historical material balance closure data, where such limits for further action should be established at a level of significance of 0.01.
The limits should be based on the statistical variance-covariance structure of the current inventory difference and an appropriate sequence of previous inventory differences; or Three sigma control limits where sigma is determined as described above t
Excessive ids must be investigated and appropriate action taken.
Following are actions that would be deemed appropriate:
ID > 3 g and 300 grams U-235 (200gms Pu/u-233)
(1) Review inventory listing to ensure that all items have been listed.
(2) Review measurement results for previously unidentified biases.
(3) Review inventory documentation and book records for human errors.
(4) Review holdup estimates for reasonableness relative to historical data.
69 l
l d
q
'(5)- Calculate a standard deviation representative ~of relevant historical ID performance.
5FKg > ID > 3 o
]
ID (1) Compare material control' test and item monitoring data with 3
results of the physical inventory.
l
-(2) Review results'of trends analyses for all process units.
j J
(3) Review conclusions of alarm investigations.
10FKg > ID > 3 o and SFKg ID (1) Same as above,-and
'(2) Review plant security records.
(3) Conduct next. inventory within two months or as directed by NRC ID > 3 o and 10FKg ID (1) Same as above (2) Prepare facility for an immediate reinventory.
(3) Remeasure a statistically determined sample of the items generated during the material balance period in question that is sufficient to detect the ' loss of 5 FKG with a 99% probability of detection.
The concept of active-inventory is adequately described and represents the quantity of material typically handled under normal plant operating conditions.
Questions and Answers 1.
Q.
What is the distinction between an ID estimate and estimator?
A.
Because of unavoidable uncertainties in any measurement, the true amount of material.being measured is unknown.
The measurement can be considered to be a random variable characterized by a probability distribution. As a random variable, the measurement process is referred to in statistical termirology as an estimator.
A particular value realized by applying an estimator is referred to as an estimate.
Since ID is a function of measured values, it is sometimes useful to distinguish between true ID, its estimator, and a single estimate.
The ID calculated at the end of an inventory is a point estimate.
70 e _, _. -. - - - - - -.-.
There is no guarantee, in fact it is highly unlikely, that the ID 1
estimate will exactly equal the true ID.
The ID estimator random variable can be written as:
l ID = BI + A - EI - R, i
where ending inventory (EI), beginning inventory (BI), additions (A) and removals (R) are also random variables.
In this form of the ID equation the inventory terms must represent all inventory including residual holdup.
2.
Q.
Why not use limit of error as the measure of ID variability?
A.
Although the limit of error of ID (LEID) has been used for some time in nuclear material accounting, the terminology is a departure from statistical terminology taught in schools and universities, and as a result, it has been the source of some confusion.
In practice LEID has been calculated as twice the standard deviation of the measure-ment error associated with the 10.
It should be realized that licensees need only use an estimate for the standard deviation.
3.
Q.
How does the constraint on measurement system quality, i.e., 0.1 percent of active inventory, compare to the LEID limit in 10 CFR 70.51?
A.
The LEID limit for most processes is 0.5 percent of the throughput, which is the larger of additions to or removals from process.
Since active inventory, which replaces throughput because it is a more widely applicable measure of the amount of material subject to measure-ment error in an inventory period, involves the sum of additions and removals, it is approximately double throughput.
Thus the LEID limit could be expressed as "approximately 0.25 percent of active inventory."
The LEID is also twice the standard deviation of ID (measurement component only).
Thus the LEID limit can be expressed as "twice the standard deviation must be less that 0.25 percent of active inventory."
This equates to one standard deviation being less than 0.125 percent of active inventory.
The proposed rule uses a limit of 0.100 percent of active inventory dnce measurement equipment is better than it was when the LEID limit of 0.o percent throughput was originally proposed a decade ago.
4.6 Accounting Requirements:
The rule requires that a licensee establish auditable records sufficient to demonstrate that the requirements of SS 74.53, 74.55, 74.57 and 74.59 have been met.
The records are to be retained for at least three years or longer if required by Part 75 of this Chapter (S 74.59(g)).
Intent and Scope:
The intent of these requirements is that the licensee l
establish an auditable records system that contains sufficient information to I
facilitate future reviews, audits, and inspections to demonstrate that all Plan I
commitments have been met. As a minimum, the records system should include 71
data and information on material control tests; item monitoring; alarm resolu-tion; SSNM receipts, shipments, and discards; measurement control; physical inventories; and MC&A prtgram assessments.
Plan / Annex Content:
The FNMC Plan contains the following affirmations and detailed commitments.
Supporting information, as appropriate, is included in the Annex.
Section 4.6 of Plan includes the following affirmations:
A records system is maintained that contains auditable records sufficient to demonstrate compliance with all commitments reflected in this Plan.
Sufficient protection and redundancy of the record system is provided so that an act of record alteration or destruction will not eliminate the capability to provide a complete and correct set of SSNM control and accounting information that could be used to detect the loss of a goal
' quantity or more, resolve indications of missing material, or aid in the i
investigation and recovery of missing material.
Controls are incorporated in the records system to maximize the likelihood j
that mistakes and attempts at data falsification will be detected.
SSNM transactions are traceable from source data to the final accounting records.
4.6.1 Records System Provide-a general description of the records system including recordkeeping policies and the types of data and information routinely recorded.
The types of records to be retained and their form should also be described.
In the Annex, provide flow charts showing the flow of data from the source 2
documents to the final accounting records and the typical forms and report formats used throughout the MC&A system.-
l 4.6.2 Record Maintenance l
Describe the mea'sures that will be taken to ensure record integrity including:
j Physical protection; Assignment of overall responsibility; Access controls which permit only authorized updating and correcting l
of records; Cross-checks for preventing or detecting missing or falsified data and records, ensuring completeness of the records, and locating data discrepancies and errors; and Capability for reconstructing lost or destroyed records.
72 i
a
~.... _. _,.. - - _,
.., _. _.. _ _. -. -. _, -. _...,._..~...
_____.-.-_,,_..____..__._,-.._.-_.m.,_
' Acceptance' Criteria: The assessment of the adequacy of the information supplied above will be based on the follwing criteria:
The records system provides for retention of key material accounting and original source data and relevant reports and documents including:
Management st'ucture; r
MC&A policies and procedures; Measurement data used for loss detection, alarm resolution and material balance accounting; Records of the investigation and resolution of alarms; Calibrations of measurement systems, measurement quality control data, bias adjustments and their backup data, and the statistical analyses of the measurement control data; Calculations of action thresholds for the detection system; Shipper / receiver data and investigations of significant shipper /
receiver differences; Tamper-safing records (e.g., application records, " attesting to" records, destruction records);
Physical inventory listings and inventory work sheets; Records of ids and calculations of the SEIDs; Reports of investigations and resolution of alarms, excessive ID estimates, and shipper / receiver differences; and Reports of periodic reviews and assessments and the resultant correc-tive actions taken by management.
Records may be retained in hard copy, magnetic tapes or disks, microfiche, or other suitable forms.
The records and reports contain sufficient detail to enable inspectors to determine that SSNM control and accounting has been conducted in compliance with SS 74.53, 74.55, 74,57 and 74.59.
The record system will be complete and sufficiently detailed to permit auditing of all parts of the MC&A system. The records and reports will be'readily traceable back to source documents.
The record system will have sufficient redundancy to enable reconstruction
~*
of lost or missing records so that a complete knowledge of the SSNM inven-tory is available.
The capability for reconstruction of records will be provided by a subsystem at least equivalent to the following:
source data 73
I I
for receipts, shipments, internal transfers, adjustments, and corrections to the records will be retained in a separate secure location so that a single individual or a single event cannot alter both accounting and source records.
Cross-checks or other controls will be provided to prevent or detect errors in the records that would affect ids or item location records.
Examples of cross-checks or controls that might prevent or detect errors in the records system would include:
Minimizing the number of people authorized to make data entries; Using verification methods for data entry for shipments, receipts, waste discards, and item records (item records may be checked by random sampling rather than on a 100 percent basis); and cross-checking calculations, at least by random sampling.
The records of the data that are the basis of the SEID will permit traceability to the sources of the variances due to calibrations, bias adjustments, and random errors in the measurements.
These records may simply be summaries of calibrations, bias tests, and variance monitoring data or control charts.
4.7 Shipments and Receipts Requirement: The rule requires that a licensee shall establish procedures for shipping and receiving SSNM that provide for:
Accurate identification and measurement of the quantities shipped and received; Review and evaluation of shipper / receiver differences on an individual container or lot basis, on a shipment basis, and on a batch basis when required by Part 75 of this Chapter; Investigation and corrective action when shipper / receiver differences exceed twice the estimated standard deviation of the difference estimator and the larger of 0.5 percent of the amount of SSNM in the container or lot, as appropriate, and 50 grams of SSNM.
Documentation of shipper / receiver evaluations, investigations and correc-tive actions ($ 74.59(h)(1)).
Intent and Scope:
Timely and accurate quantificatioi of the SSNM content of shioments and receipts is an essential component of an effective MC&A system.
When significant shipper / receiver differences are identified, it is imperative that they be resolved and contributing factors corrected.
Plan / Annex Content:
The FNMC Plan contains the following affirmations and detailed commitments.
Supporting information, as appropriate, is included in the Annex.
s 74
Section 4.7 of the Plan includes the following affirmations:
The element and isotopic content of SSNM shipments are based on measurements obtained from measurement systems subject to the measurement control program.
Receipts of SSNM are checked and measured to confirm that the quantity received is consistent with the supporting documentation.
Item checks l-and seal integrity inspections are completed within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of receipt.
Receipt measurements are completed within 30 days of receipt except in the case of scrap.
Shipper / receiver differences are investigated whenever they exceed twice the standard deviation of the difference estimator and the larger of 0.5 percent of the amount of SSNM in the container, lot or shipment, as appropriate, or 50 grams of SSNM.
Results of shipper / receiver difference investigations, including corrective actions, are documented and retained for at least three years.
4.7.1 Receiving Procedure Describe how materials are received, stored, and measured. The latter should include a description of the sampling techniques employed.
4.7.2 Shipper-Receiver Differences Describe the investigation of significant shipper-receiver differences.
The description should include:
The method of establishing the standard deviation of the shipper-receiver difference estimator under conditions where the shipper's uncertainty estimate is available and where it is unavailable; The conditions under which a referee laboratory is involved and the criteria for selecting a referee laboratory; The bases' established for concluding that a significant difference is resolved; The procedure for adjusting book records to accommodate resolution of the difference; and The procedure for establishing and resolving differences involving scrap.
4.7.3 Shipping Procedure Describe the preparation and certification procedures for shipping SSNM.
The description should include:
The measurement data and tamper-safing information provided to the group responsible for SSNM shipments; 75
1 The cross-checks, including any item checks or measurements, made by the shipping group; and The types of records maintained by the shipping group.
-Acceptance Criteria: The assessment of the adequacy of the information supplied above will be based on the 'following criteria-or equivalent:
Receipts are inspected promptlys to verify the validity of the shipper's data. Acceptable times to complete the verification measures.are:
Item verification, 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />; Seal integrity, 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />; Gross weight, 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />; NOA scans (if appropriate), 120 hours0.00139 days <br />0.0333 hours <br />1.984127e-4 weeks <br />4.566e-5 months <br /> *; and SSNM measurements (scrap excepted), 30 days.
Times other than those indicated above would be acceptable with adequate justification.
Shipper's values may be accepted for encapsulated items such as fuel rods, elements, etc.
- ~
'The investigation of statistically significant shipper-receiver differences should normally be completed within three months except where the differ-ence exceeds 5 FKG.
In the latter case, the discrepancy should be resolved within 30 days of the time that its existence is determined.
The following stepwise analysis is an example of an acceptable approach for investigating a significant shipper-receiver difference:
The receiver should review his or her data to check for possible entry errors such as an incorrect number or the transposition of numbers.
The receiver should then review source data including the basic calculations and the associated measurement control data.
Assuming the difference remains unresolved, the receiver should remeasure the SSNM content of the receipt.
If remeasurement fails to resolve the difference, the shipper should be notified and requested to conduct a similar investigation.
" Qualitative or semi quantitative 76
If the two parties fai1 to resolve the difference, a referee-
~
F laboratory should be involved. The shipper and receiver should mutually agree-on the sampling procedure.
Unless contractual' requirements dictate otherwise, the value closest to the referee's value should be accepted and booked by both parties.
If the referee's value is not within statistical limits of either the shipper or receiver, the referee's value should be used.
For purposes of shipper-receiver evaluation, a lot may be defined in several ways. These would include:
Multiple containers of a material that has been blended by a procedure that has been demonstrated to produce a homogeneous product; Multiple containers filled from a master container of homogeneous material (e.g., UFs cylinders);
A quantity of scrap transferred on multiple transfer receipts (741s) but combined for processing through recovery.
4.8 Scrap Control Requirement: The rule requires that a licensee establish a scrap control program that' assures that internally generated scrap is segregated from scrap from other licensees or contractors until accountability is established, and 4
any scrap with a measurement standard deviation greater than five percent of the measured amount is recovered so that the results are segregated by inventory period and received within six months of the end of the inventory period in which the scrap was generated except where it can be demonstrated that the scrap measurement uncertainty will not cause noncompliance with 5 74.59(e)(5) (See R
$ 74.59(h)(2)).
Intent and Scope:
The regular processing of scrap with relatively large measurement uncertainties precludes such scrap being the source of a problem at the time of physical inventories.
Inaccurate scrap measurements could cause an apparent ID or conceal a theft or diversion.
Segregation of internally gener-L ated scrap from that received from off-site until accountability is established j
ensures that potential anomalies in assigned values will be attributed to the appropriate facility.
Plan / Annex Content:
The FNMC Plan contains the following affirmations and detailed commitments.
Supporting information, as appropriate, is included in the Annex.
I Section 4.8 of the Plan includes the following affirmation:
Scrap control procedures are in place that provide for:
{
Segregation in the recovery process of any scrap that originates from l
off-site from scrap generated on-site until accountability has been 1
established; and 4
i 77 l
~
Recovery of scrap within six months after the inventory period in which it was generated, when such scrap has a standard deviation of-its measurement estimator greater than five percent of the measured amount unless it can be shown that the total scrap measurement error will not cause noncompliance with S 74.59(e)(5).
4.8.1 Location Identify the scrap and waste quantities of contained SSNM with respect to source, storage, and disposition.
Refer to process flow charts and plant operations descriptions included in the Annex.
4.8.2 Processing Describe the program for in-house processing of scrap including recovery plant capacity, rate of recovery, and the estimated amount of scrap expected to be on hand at any given time. Describe any plans for shipments and for off-site recovery of scrap.
Describe procedures for the control and discard of wastes containing SSNM, including procedures and capabilities for storage prior to discard.
4.8.3 Measurement Describe the procedures for determining the SSNM content of scrap and waste, including the criteria and procedures for segregation, identification, and classification of various kinds of scrap to facilitate measurement.
Identify types and quantities of scrap expected to have measurement uncertainties greater than i 5 percent (la).
4.8.4 Inventory Control Describe the control program that will be implemented to assure that scrap measured with an uncertainty greater than i 5 percent does not remain on inventory longer than six months, or the measurement uncertainty associated with the scrap on hand will not cause noncompliance with $74.59(e)(5).
4.8.5 Recovery of Off-Site Scrap Describe the procedures that will be implemented to ensure that scrap received for recovery from off-site is segregated until accountability is established.
The description should address segregation during storage and processing.
Acceptance Criteria:
The assessment of the adequacy of the information supplied above will be based on the following criteria or equivalent:
A comparison of generation rates and recovery capacity indicates that adequate recovery capability exists to preclude the buildup of excess amounts of scrap.
Where offsite recovery is utilized, the description of the program includes as a minimum:
Types and estimated quantities of scrap to be shipped, 78
I-Contractor's program to assure segregation of customer scrap, I
Basis for establishing accountability values, Contractor and shipper measurement responsibilities, and Proposed means of performing shipper / receiver comparisons (i.e.
shipment basis, campaign basis, etc.).
Special handling procedures for waste such as conversion to a better measurable form or independent measurement verification are described.
Proposed measurement techniques for specific scrap types are described including:
Material description, Specific NDA system to be employed (as appropriate),
Container size, Mixing and blending operations (as appropriate),
Sampling technique, and Assay procedure.
An estimate of the measurement uncertainties associated with each scrap type should be included in the Annex.
For those materials measured by NDA in 30 gallon drums or larger containers, the licensee should commit to an annual evaluation to demonstrate the continuing reliability of the measurement system.
Possible evaluation techniques include a destructive analysis, a second NDA technique not subject to the same potential interferences as the primary technique, or a standard addition procedure.
The program for segregation of scrap generated off-site from on-site scrap appears adequate to protect against commingling.
Possible techniques to achieve this objective are:
Retain customer scrap in shipping containers prior to recovery, Isolate customer scrap in a particular section of a vault or permanently controlled access area, or Identify designated storage bins or shelves for application of shelves for application limited access controls.
Segregation of customer scrap during processing is accomplished by cleaning the dissolver and accountability weigh tank before and after the recovery campaign.
Additional processing of dissolver residues should be handled in the same manner unless the quantity involved is less than one FKG or the measurement uncertainty is less than i 5 percent (10).
79
4.9 Human Errors Requirement:
The rule requires that a licensee incorporate checks and balances in the MC&A system to minimize the rate of human errors in MC&A information (S 74.59(h)(3)).
Intent and Scope:
The objective of this requirement is to reduce the frequency of human errors affecting MC&A information and to enhance the likelihood of detection when they do occur.
This can be achieved by implementation of a system of checks and balances in MC&A information systems that involve generating, collecting, processing, computing, analyzing, summarizing, and reporting data.
Plan / Annex Content:
The FNMC Plan contains the following affirmations and detailed commitmi ts.
Supporting information, as appropriate, is included in an Annex.
Section 4.9 of the Plan includes the following affirmations:
MC&A procedures will be developed and implemented in a manner that assures that the frequency and consequences of human errors will be minimized.
MC&A procedures include job performance aids, where applicable, that help to reduce the frequency of human errors.
MC&A procedures will be formatted in a manner that facilitates a reduction in human errors and helps to make errors easier to identify.
MC&A activities associated with collecting and processing data, record-keeping, and auditing are automated where it is practical and advantageous to do so.
A quality control system is in place to monitor the frequency of human errors and permit categorization of the types of errors encountered.
4.9.1 Control Describe the techniques that will be employed to minimize the frequency of human errors and enhance the likelihood that they will be detected when they do occur.
The description should address the use of:
Control methods to ensure that current procedures are in place and being
- used, Job performance aids, Automated data processing, Personnel training and qualification, Preprinted forms, 80
Multiple copy forms, and:
Data verification.
'4.9.2 Monitoring Describe the quality control system that will be used to moniter the frequency
_and types of human errors.
Acceptance Criteria: The adequacy of the information supplied above will be based on the following criteria or equivalent:
Procedures should be developed and used that will control the rate of human i
e error in MCM data.
Specific procedures should be available to guide-personnel in performing major or complex tasks associated with MCM.
Procedures should'be sufficiently explicit and comprehensive to promote error free performance by the least skilled or least experienced person that will be assigned to perform the tasks specified by the procedures.
Procedures should be based on the activities required to effectively accomplish the task.
Procedures should be self-contained to avoid the need to refer i
}
to supporting documents.
Procedures should be written with flexibility in the sequence of events whenever possible.
n Knowledgeable personnel should prepare and review procedures.before they.are implemented.
Procedures should be validated by means of field tests to ensure their clarity, comprehensiveness, and effectiveness.
f Personnel should be required to use and follow appropriate procedures in performing complex MCM tasks or tasks that affect MCM.
\\
Job performance aids must be considered for use in highly complex MCM j
tasks.
I Job performance aids should assist novice users in their performance while net hindering the performance of experienced users.
Terms and labels should match common usage for equipment labels and legends.
l Quantities and dimensional units should correspond to referenced displays, documents, and information.
I i
i 81 1
1
r f
Uncommon and inconsistent abbreviations should be avoided.
The presentation of illustrations, graphs, and tables, if used, should be consistent throughout the procedure.
Illustrations, tables, graphs, and other job performance aids, if used, should be appropriate to the task to be performed.
Checklists or data tables should be provided for lengthy i
prerequisites, tests, and calculations.
]
Illustrations should be used in place of long descriptions where possible.
Illustrations should be placed so that they can be referenced easily from the text section.
Illustrations should be clearly labeled and easy to read.
All tables and graphs should be clearly labeled in quantitative terms.
l The format of MC&A procedures should be arranged to help to reduce the i
rate of human error and to detect mistakes.
The complexity, sentence length, and grammatical structure should be appropriate to the educational level of the least qualified user, l
Short sentences with concise and unambiguous language should be used.
The level of detail in instructions should be adequate to avoid errors of omission.
No more than three simple task elements should be included per step.
More complex actions should be separated into additional steps.
Procedures should be formatted to allow experienced personnel to concentrate on major headings or capsule descriptions, while more detail is provided in clearly demarcated fashion for less experienced personnel.
Procedures may be formatted in " cookbook" fashion for ease of use when appropriate.
All steps and tasks should be stated as actions.
The sequence of steps and tasks in a proceduce should be in the same sequence followed to accomplish the objective of the procedure.
Attention getting warnir.g and precaution notices should be placed immediately preceding applicable steps and, where required, should also be summarized at the beginning of the procedure.
82
Summary information should be included at the beginning of every procedure.
All required supplies, tools, test equipment, documents, and protective measures should be listed at the beginning of the procedure.
All applicable referenced documents should be listed in one section of the procedure.
Quality control and quality assurance points should be identified.
Decision-making cues should be clearly stated.
Sub-tasks and sub-tests should be set off with separate headings or by an appropriate indentation.
The sequence of steps should be logical and accurate.
Unnecessary memory recall should be avoided.
The need for personnel to perform calculations and conversions should be avoided whenever possible.
Data collection tables and data reduction aids should be provided if lengthy tests and calculations cannot be avoided.
Pre printed forms for recording data should be utilized when practical.
Multiple copies of forms, if needed, should be generated automatically in the data collection phase.
Formatting should be neat and simple and should be consistent among all related procedures.
MC&A data should be directly collected, input, checked, manipulated, reported, and audited by computer where it is practical and advantageous to reduce the consequences and frequency of human error in MC&A data as much as practical.
Statistical quality control systems should be used to track the effective-ness of human error control measures and the frequency of human error in MC&A systems, and should be used to alert management whenever the rate of human error is in an out-of-tolerance condition.
The quality control system should be capable of determining if and when an individual, procedure, or process makes more errors than is reasonably expected.
The quality control system should be capable of determining both the individuals who require retraining due to their frequency of committing errors and the procedures and processes that should be revised to produce fewer human errors.
83
i 1
Double checklists should be provided to allow auditing of data collec-tion by a supervisor or other independent person that checks the results of the first person's work and signs off when the work is complete and accurate.
Each data collection form should be checked by the originator to verify that the data are accurate.
When MC&A data processing is automated, quality control systems should also be automated, so that out-of-tolerance conditions, human errors, and other warnings can be detected and corrective actions can be taken promptly.
3 A configuration management plan should be established for vital MC&A l
equipment, computer software, and manuals.
Configuration control meas 0res should be performed systematically and immediately reflect all changes as they are made.
Procedures and technical manuals should be stored, indexed, filed, and controlled in a manner that ensures easy retrieval and availability.
The quality of operations and maintenance manuals should be one criterion in selecting between vendors when purchasing new equipment.
MC&A equipment and computer software manuals supplied by vendors should be specific to the equipment model purchased and contain explicit troubleshooting, calibrating, and repair instructions for hardware and coding and application instructions, if software is used.
Personnel should perform quality control and quality assurance activities that are specified in the procedures.
Estimates of human error rates should be based on a human reliability analysis of the data collection process to determine a reasonable rate of human error in MC&A data for the specific licensee.
Reasonable estimates of human error rates should include input regarding equipment design, plant policies and practices, and written procedures.
Reasonable estimates of human error rates should include input regarding situational and personnel factors that may produce errors.
Any potential problems that can reasonably be resolved fo110 wing a human reliability analysis should be resolved and the estimate of a reasonable error rate should be recalculated.
Questions and Answers.
1.
Q:
What are some job performance aids that are used successfully?
A:
Several job performance aids (JPA) are illustrations and diagrams, graphs for interpolation, approximate times to complete specific 84
jobs, clearly stated decision-making cues and clues to the correct decision given specific cues, and data reduction aids.
JPAs are good as long as they do not cause the procedure to become difficult to use because of too many aids, the wrong types of aids for thatIf the application, or presentation in an inappropriate manner.
procedure can be written so than an experienced user can omit unnecessary aids meant for novice users, that in itself is a JPA and will encourage procedure usage.
2.
Q:
Some of the notation and labels used on equipment at specific facilities may not be current with respect to recommended terminology.
Should procedures use current terminology, or be consistent with the equipment?
A:
Ideally, equipment should be brought into compliance with the current idea of "best" notation on labels and panels.
However, confusion 4
could occur because personnel at the facility are accustomed to that l
terminology, so these labels probably should not be changed.
In any case, procedure terminology should be consistent with equipment, as i
should forms and other information to be employed by personnel at the j
l facility.
i 3.
Q:
Why should there be no more than three actions per step in a procedure?
By restricting the amount of information that personnel are required l
A:
to remember while performing a procedure, there is a greater i
probability that the procedure will be performed correctly.
l Remembering precise, numerical information is not a task that humans perform well. Using checklists or pre-printed forms are methods to limit the amount of memorization required while reducing dependence on often bulky procedures.
I Why should an independent observer be used to sign off on checklists 4.
Q:
and other work?
i A:
An independent observer is useful in the event that a person makes a mistake, since an independent observer will often see mistakes whereas the person who made the original mistake, using the same logic or reviewing the work rather quickly, will be unable to recognize the problem.
S.
Q:
What is configuration control and how is it applied to procedures?
A:
Configuration control is a method by which the current official copies of procedures are maintained and controlled.
Procedures that may be used in configuration control include sign offs by a responsible person on the released version, numbering and dating versions, and periodic checks of the individual procedures under the control of the procedure custodian or holder to make sure that current copies are being used.
85
i j
I 6.
Q:
What level of human error is reasonably achievable in MC&A data?
A:
A reasonable amount of human error in MC&A data depends on the i
systems that are in place to provide checks and balances to reduce i
An effective program to reduce human error would employ I
errors.
techniques that limit human error by reducing the chances for errors to be made and not creating error-likely situations in the design of the work.
However, without totally eliminating the human element from MC&A, there is no way to eliminate human error totally.
Table 1 lists some of the applicable human error rates and situational multipliers from Swain and Guttmann (1983).
86
T Table 1 Errors Rate Associated with MC&A Data Collection These values are adapted from Swain and Guttmann and reflect some typical error probabilities for human activities in the MC&A process.
For additional data and information on its usage, please refer to the cited document.
Potential Error Estimated Error Rate Failure to perform rule-based actions correctly when written procedures are available and used.............
.005 written procedures are not available or used..........
1.0 Omitting a step or important instruction from a formal procedure.............:......................
.003 oral instructions......................................
negligible Writing an item incorrectly in response to a formal procedure....................................
.003 oral instructions......................................
negligible Carrying out a plant policy scheduled task such as periodic tests performed weekly, monthly, etc.......................
.01 Using a written test or calibration procedure properly.....
.01 Using a checklist properly.................................
.5 Omitting items when procedures have check-off provisions and are correctly used........................................
.003 incorrectly used......................................
.01 Omitting items when written procedures are available and are not used...............................................
.05 Errors of commission in reading and recording quantitative information from unannt.aciated displays anslog meter..........................................
.003 digital readout.......................................
.001 chart recorder........................................
.006 printing recorder with large number of parameters.....
.05 graphs................................................
.01 recording tasks.......................................
.005 simple arithmetic calculation.........................
.01 Estimated probabilities that a checker will fall to detect errors made by othersroutine tasks, checker uses written materials.........
.1 routine tasks, checker uses no written materials......
.2 one-of-a-kind checking with alerting factors..........
.05 special measurements..................................
.01 87
Table 1 (Continued)
Modifications of estimated error rates for the effects of stress and experience level low stress............................................
x2 optimum stress........................................
x1 moderately high stress novice...........................................
x4 L
ski 11ed...........................................
x2 extremely high stress (life threatening) novice...........................................
x10 l
sk111ed..........................................
x5 l
f 4.10 Independent Assessment Reaut rement:
The rule requires that a licensee independently assess the past performance of the MC&A system and review its effectiveness at least once every 12 months, including management's action on prior assessment recommendations
($ 74.59(h)(4)).
Intent and Scoce:
The intent of the independent assessment of the MC&A system is to periodically review the system performance from an effectiveness perspec-tive relative to the performance objectives defined in 574.51(a) and the system capabilities defined in 574.51(b).
Plan / Annex content:
The FNMC Plan contains the following affirmations and detailed commitments.
Supporting information, as appropriate, is included in the Annex.
Section 4.10 of the Plan includes the following affirmations:
An effectiveness evaluation of the entire MC&A system is performed at least every 12 months.
The assessment is performed by technically qualified individuals whose organizational positions and normal work assignments will not interfere with their ability to make objective decisions.
The assessment team leader will have no responsibility for performing or directly managing any part of the MC&A program.
The details and results of the assessments and recommended corrective actions are documented and reported to the plant manager.
Management wlII receive the assessment report and take the actions neces-sary to correct identified deficiencies.
The actions taken to correct deficiencies are documented and reviewed during the subsequent assessment.
88
r 4.10.1 Assessment Program Describe the structure of the program including:
The means of assuring independence of action and objectivity of decision; The technical qualifications of and the selection criteria for team members; The planned objective and scope of the assessment listing the general areas to be covered; and The organizational positions responsible for initiating the assessment, approving the membership of the assessment team, implementing the correc-tive actions that are deemed necessary, and providing follow-up action to assure that corrective actions have been implemented.
In the Annex, provide a checklist of the functions to be reviewed in each area.
Regulatory Guide 5.51 may be used as appropriate.
Acceptance criteria:
The assessment of the adequacy of the information supplied above will be based on the following criteria:
The assessment will include a comprehensive review of the MC&A system to independently assess the system design and evaluate its capabilities to achieve the general safeguards objectives and an audit and inspection of the system performance, carried out in sufficient depth, to detect defi-ciencies or weaknesses in either the system design or implementation.
The assessment encompasses tha entire MC&A system with particular emphasis on abrupt loss detection, item :ontrol, and alarm resolution.
The emphasis is justified on the basis that these functions provide the primary assur-ance that no loss has occurred.
The assessment program provides objective measure of:
Management effectiveness and responsiveness to indications of possible loss, Staff training and qualifications for particular job functions, Quality control of measurements and process variability.
Timeliness of loss detection and response to alarms, and Alarm resolution effectiveness.
The personnel assigned to the assessment team will have an understanding of the objectives and requirements applicable to the MC&A system and have sufficient knowledge and experience to be able to assess the adequacy of the function they are requested to review.
The team will not include 89
MC&A management personnel but may include other MC&A staff provided no individual reviews his/her own area of responsibility nor the area of another MC&A team member.
The responsibility and authority for the assessment program and for initiating corrective actions is at least one organizational level higher than the MC&A manager.
Outside contractor laboratories should be included in the 12 months assessments.
4.11 SSNM Custodianship Requirement:
The rule requires that a licensee assign custodial responsibility for all SSNM possessed under licensee in a manner that ensures that such respon-sibility can be effectively executed ($ 74.59(h)(5)).
Intent and Scope:
The intent of this requirement is that there be a designated individual who is responsible for having knowledge of the placement and movement of SSNM within a specified area and transfers into and out of the area.
Such an individual should be vested with the authority to obtain the information necessary to accomplish his/her task and to assure that activities are carried out in accordance with approved policies and procedures.
Plan / Annex content:
The FNMC Plan contains the following affirmations and detailed commitments.
Supporting information, as appropriate, is included in the Annex, Section 4.11 of the Plan includes the following affirmations:
The SSNM processing facility is subdivided into a sufficient number of areas to ensure that custodial responsibilities can be effectively executed.
A custodian and a minimur.1 number of alternates are designated for each area subdivision.
Transfers of SSNM between areas of different custodial responsibility are measured for element and isotope, as appropriate, and results are docu-mented on signed tranfer receipts.
4.11.1 Custodial Areas Identify the areas into which the facility will be divided to assure that custodianship can be effectively executed.
Reference to facility drawings included in the Annex is acceptable.
4.11.2 Duties / Authority 00 scribe the duties of the SSNM custodians including defined authorities.
90
Acceptance Criteria:
The assessment of the adequacy of the information supplied above will be based on the following criteria or equivalent.
Except for the stipulations that all SSNM crossing custcoial area boundaries must be measured and custodians must be able to effectively execute their duties, there are no restrictions on how large an area can be. However, different MAAs should have different custodians, and within MAAs, areas with widely divergent functions should have different custodians.
An example of the latter situation.would be a fabrication plant where bulk material is handled in one area in the preparation of the fuel component of an element, and a second area is involved with machining and preparation of the element for higher tier fabrication.
A current Ifsting of designated custodians and alternates should be maintained.
Custodians should be familiar with SSNM processing activities as well as MC&A functions. A minimum of one year of experience in each of these areas is desirable.
Custodians should not be appointed from production or production control to preclude the possibility of confifets of interest.
i 6
I 91
~ -
REFERENCES ANSI N15.36, Non-Destructive Assay Measurement Control and Assurance, American National Standards Institute, New York, New York, (in preparation).
ANSI N15.41, Guide to Nuclear Facility Measurement Control, American National Standards Institute New York, New York, (in preparation).
R. H. Augustson, DYMAC Demonstration Program:
Phase ! Experience, LA-7126-MS, Los Alamos Scientific Laboratory, Los Alamos, New Mexico,1978.
W. M. Bowen, Evaluation of Simultoneous Testing Procedures for Nuclear Mate-rials Control and Accounting, NUREG/CR-2483 (PNL-4083), Pacific Northwest Laboratory, Richland Washington, March 1982.
R.J.Brouns,andJ.E.Fager,DetectionTimeGuidance,(Draftsubmittedto NMSS Division of Safeguards, donuary 1982), Pacific Northwest Laboratory.
Richland, Washington, 1982.
R. J. Brouns, and F. P. Roberts, Training and Qualifying Personnel for Perform.
l ing Measurements for the Control and Accounting of Special Nuclear Material NUF EG/CR-0773 (PNL-3020), Pacific Northwest Laboratory, Richland, Washington Washington, November 1980.
R. J. Brouns F. P. Roberts, J. A. Merrill, and W. B. Brown, A Measurement Control Program for Nuclear Material Accounting, NUREG/CR-0529 (PNL-3021),
Pacific Northwest Laboratory, Richland, Washington, June 1980.
R. J. Brauns, B. W. Smith, D. W. Brite, and C. O. Harvey, The Use _of Process ~
Monitoring Data for Nuclear Material Accounting:
Vol. 1, Summary Report NUEEG7CR-1670 (PNL-3356), Pacific Northwest Laboratory, Richland, Washington, 1980.
(Available in abbreviated form as R. J. Brouns and B. W. Smith, "The Use of Process Monitoring Data to Enhance Material Accounting," In Proceedings of the Institute of Nuclear Materials Manage-mentMeeting,I,J,,pp. 688 696, Chicago, Illinois, 1960.)
D. D. Cobb, " Sequential Tests for hear Real-Time Accounting," In P_roceedings of the Institute of Nuclear Materials Management Meeting, 3, pp. 62-70, Chicago, Illinois,1981 H. A. David, Order Statistics, John Wiley & Sons, New York,1970.
W. P. Duggan, K. R. Byers, and L. Hulse. Criteria for Respons*' to Special Nuclear _ Material and Control and Accounting System Alarms,
~
IMQ091), Draf t Report to thu NPC, Pacific Northwest Laboratory.
Richland, Washington, 1981.
R. F. Eggers, Detailed Response to_ Alarms, Technical Report to the NRC, Pacific Northwest Laboratory Richldnd, Washington,1981.
R. F. Eggers Design Aids for Estimating the_ Frequency _of Occurronco of Unresolved Plant-Wide false Alanns, Tqchnical Report to tI1 REC, Pacific Northwest Laboratory, Richland,5fishington, 1982.
92
C. Eisenhart, M. W. Hastay, and W. A. Wallis, Selected Techniques of Statistical Analysis, McGraw-Hill, New York, 1947.
J. E. Glancy, G. Borgonovi, S. Donelson et al., Feasibility and Cost / Benefit af Advanced Safeguards for Control of Nuclear Material In-Process, NUREG/
CR-1686 Vol. 1 (SAI 01580-343LJ), Science Applications, Inc., La Jolla, California, October 1980.
F. A. Graybill, Theory and Application of the Linear Model_, Duxbury Press, North Scituate, Massachusetts, 1976.
E. A. Hakkila, J. W. Barnes, T. R. Canada et al., Coordinated Safeguards for Materials Management in a Fuel Reprocessing Plant, Appendix (Part E),
LA-6881. Vol. II, Los Alamos Scientific Laboratory, Los Alamos, New Mexico, 1977.
E. A. Hakkila. D. D. Cobb. H. A. Dayem et al., Materials Management in an Internationally Safeguarded Fuels Reprocessing Plant, LA-8042. Vols. I, 2, and 3. Los Alamos 5cientific Laboratory, Los Alamos New Mexico,1980.
R. L. Hawkins, R. L. Lynch, and R. F. Lumb, Using Advar,ced Process Monitoring to improve Material Control, NUREG/CR-1676 Vol. 1 (NU5AC-566), Nuclear Surveillance and Auditing Corporation, McLean, Virginia,1980.
R. D. Hurt S. J. Hurell, J. W. Wachter et al., Ex >erimental Demonstration of Microscopic Process Monitoring, ORNL/TM-7848, Oac Ridge National Laboratory, Oak Ridge, Tennessee, 1982.
IAEA Safeguards Technical Manual, Part F - Statistical Concepts and Techniques.
IAEA-174, International Atomic Energy Agency, Vienna, Austria, 1977.
J. L. Jaech, Statistical Methods in Nuclear Material Control, TID-26298, National Technical Information Service, springfield Virginia,1973.
J. L. Jaech "On Forming Linear Combinations of Accounting Data to Detect Constant Small Losses," J. Nucl. Mator. Manage., VI,(4):37-42,1977.
J. M. Juran, (ed.), Quality Control Handbook, McGraw-Hill Book Company, Inc.,
Lumb and Associates, Inventory Difference Evaluation Program (INDEP),1986.
R. Lumb, and f. Tingey, Matnematical Derivation of the Automated Material Accounting Statistics System (AMA35), Nuclear Surveillance and Auditing Corporation, McLean, Virginia,1981.
J. T. Markin, n. L. Baker, and J. P. Shipley, Accounting "g Advanced Data Anai-
"Implementin yses Techniqses in Near Real-Time Materiait In Proceedings nf l
the Instituta of Nuclear Mstorials Management Meeting, ~IX, pp. 236 244, Chicago, IlTinois, IMO.
93
.-..-.m-.
l J. C. Miles, J. E. Glancy, and S. E. Donelson, Use of Process Monitoring Data for the Enhancement of Nuclear Material Control and Accounting, NUREG/cR-1013 (MLM-2643), Mound Laboratorte,, Miamtsburg, Ohio, and science Applications, Inc., La Jolla, California,1979.
P. T. Reardon, S. W. Heaberlin, and R. F. Eggers, "An Assessment Method to Predict the Rate of Unresolved False Alarms," In Proceedings of the Inntitute of Nuclear Materials Management Meeting, g, pp. z75-252, Chicago, Il ino15, 195Z.
T. D. Rollly, and M. L. Evans, Measurement Reliability for Nuclear Material
- g. LA-6574. Los Alamos Scientific Laboratory, Los Alamos, New Mexico.
D. R. Rogers (ed.), Handbook of Nuclear Safeguards Measurement Methods.
NUREG/CR-2078 (MLM-za55), Mound Laboratories, Miamtsburg, Chlo,1953.
D. M. Rose, and F. W. Scholz, Statistical Analysis of Cumulative Shioner-Receiver Difforonces, NUREG/CR-2819 (BC5 40354-0), Boeing Computer services Company. Tukw'l'a Washington, 1983.
C. R. Rudy, D. B. Armstrong, K. W. Foster D. R. Rogers, and D. R. Hill, 4
Controlled Unit Approach: AnApplicationManual.NUREG/CR-2538(MLM-2881),
Mound Fac111ty, Miam'sburg, Ohio,195Z.
P. W. Seebaugh, D. R. Rogers, H. A. Woltemann et al., The controllable Unit Approach to Material Control: Application to a High Throvilhout Mixed j
0xide Process, NUREG/cR-1214, Vol. I and Vol. 2, (P LM-25JZ;, Mound Labora-tories, M' amtsburg, Ohio,1980.
W. A. Shehart Economic Control of Quality of Manufactured Products, D. Van Nostrand Co., New York, 1931.
J. P. Shipley, " Decision Directed Materials Accounting Procedures: An Overview."
In Proceedings of the Institute of Nuclear Materiah Management Meeting, j
X, pp. 251-Z57. Chicago, Illinofs, 1981.
- 8. W.* Smith and J. Razvi, " Resolving MC&A Alarms from Process Monitoring in a Fuel Fabrication Facility," In Proceeding of the Institute of Nuclear Materials Management Meeting, XI!!, pp. J22-329. Columbus, Ohtu,1964.
K. B. Stewart, "The Loss Detection Powers of Four Loss Estimators," J. Nucl.
]
Mater. Manage.,yg(3):7480,1978.
i A. D. Swain, and H. E. Guttmann, Handbook of Human Reliability Analysis with l
Emphasis un Nuclear Power Plant Applications, NUREG/CR-1278, Sandle l
National Laboratories Albuquerque, New Mexico, October 1983.
l J. Tenner False Alarm Resolution Assessment Methodology, Technical Report l
to the NRC, Pactric Northwest Laboratory, Richland, Washington,1981.
u I
)
l 94
'\\
F. H. Tingey, C. J. Barnhart, and R. F. Lumb, Re: solving the Comonents of Process Variability and Estimatin<a the Uncertainty of the
.EID, NUSAC Report 752, Rev. 1, NUSAC, Inc., teston, tirginia, 1983.
F. H. Tingey, R. H. Lumb, and R. J. Jones, Statistical Guidance for Material Control Detection rests, NUSAC Report 712 (Draft), NUSAC, Inc., Reston, Virginia, 1982.
M. A. Wincek, K. 8. Stewart, and G. F. Piepel, Statistical Methods for Evaluat-ino Sequential Material Balance Data, NUREG/CR-0683 (PNL-2920), Pacific Northwest Laboratory, Richland, Washington, 1979.
J 95
pumC 70AM 3J.
U S 88UCLE. A A4GULTORv COMMisstose st,oM t Nvwet a I Ass ea.e er T,0C.dw We, 4., d.*8 h,"3g[
BIBLIOGRAPHIC EATA SHE?,T NUREG-1280
$50 intimuCisONS ON f t stVER$4 J LEavt et.N.
3 Taitt.4D lve terte Standard F mat and Content / Acceptance Criteria for the Material Co trol and Accounting Reform Amendment
[ D.75 ptPOR T COMPLE T ED Mar [
I 1987
..u, mo.,,,
C. W. Emeigh f
. oart at oar issuto j
vt..
Mo r-arch 1987
,,E., 0.. u o. 3..,..o
~.. E. ~ <. u ~o.oo,,0..,,,,,. i. c,
., p tc.. u
.us.,,,v Division of Safeguar
/
Office of Nuclear Mat ial Safety and Safeguards f ' a oa 'a ***a a i
U.S. Nuclear Regulator Commission Washington, D. C. 20555
/
10 SPU8,$omeNQ onG.Nat.f TON N.UL.No M.e L#NG.L
- 'E ll f,as %s /g f as,.,
11.f PR08MiPoRY Same as item #7 Technical
...,0 0 c a, E t o,,~~..
- 1) SvPPLtWlMf.RFhof.5
\\
n..,i t uc,,m. -.,
y j
T51s repott documents a standard format suggested by the NRC for use in preparing fJndamentalnuclearmaterialcontrolplansafrequiredbytheMaterialControland Accounting Reform Amendment (pcrtions of 10)CFR Part 74).
The report also describes g
the necessary contents of a comprehensiveplan and provides exanple acceptance criteria which are intented to communicate acceptalle means of achieving the performance capa-
/
bilities of the Reform Amendment.
By using,the suggested format, the license appli-cant will minimize administrative probl s associated with the submittal review and a,', proval of the FNMC plan.
Preparation f th'e plan in accordance with this format will assist tta NRC in evaluating the plan and in standardizing the review and Itcensing process. However, conformance with ttjis guidange is not required by the NRC.
A licenrc applicant who employs a format that provides an equivalent level of complete-ncss and detail may use their own fo' mat.
t t
s
\\
..m.,......
u.o.,<
,,a
,,...s.,u,,
Reform Amendment 3
High Enriched Uranium /Plutoni m f
Unlimited Strategic Special Nuclear Mat rial V
a in * c 6.im.' os High Strategic Significance ea j
y Un c T..assified
.,ei s e..... v,i s sci o.. o*
x j
Unclassified he..
.3... a r
-..s.
. y, g, p,yg gigg g g pg gg g g gg gy g g gg, ggg p, g g g,gg y,g g y y
e t.'
UNITED STATES NUCtAAR RESULATORY COMMISSION
%e o WASHINGTON, D.C. 20805 w3,.. a..
penam m.
OPPICIAL BUSINESS PENALTY POR PANATE L'SE, eles L
.1