Text

NUREG-1280, Final Draft Guidance, Rev. 2, Acceptable Standard Format and Content for the Material Control and Accounting Plan Required for Strategic Special Nuclear Material.
	ML18234A097
Person / Time
Issue date:	08/22/2018
From:	; Office of Nuclear Material Safety and Safeguards
To:	;
	Young T
References
	NUREG-1280, R02, DRF
	Download: ML18234A097 (151)
	v • d • e

NUREG-1280, Rev. 2 Acceptable Standard Format and Content for the Material Control and Accounting Plan Required for Strategic Special Nuclear Material Final Draft Guidance Manuscript Completed: August 2018 Date Published: Month 20xx Office of Nuclear Material Safety and Safeguards

ABSTRACT This document provides a revised structure for NUREG-1280, Revision 1, issued March 1995, which specifies information that the licensee or applicant should provide in its material control and accounting (MC&A) plan, formerly the fundamental nuclear material control plan. This revision has been structured to serve as a direct outline for licensees to use in preparing their MC&A plan and follows the structure and format of other guidance on MC&A plans required by Title 10 of the Code of Federal Regulations (10 CFR) Part 74, Material Control and Accounting of Special Nuclear Material, Subparts C, Special Nuclear Material of Low Strategic Significance, and D, Special Nuclear Material of Moderate Strategic Significance.

This revised structure for NUREG-1280 reflects the requirements of 10 CFR 74.3, 10 CFR 74.51, 10 CFR 74.53, 10 CFR 74.55, 10 CFR 74.57, and 10 CFR 74.59, and includes guidance for implementing the new requirements in 10 CFR 74.59 pertaining to tamper-safing, and the designation of material balance areas and item control areas. This NUREG applies to NRC licensees authorized to possess and use 5 or more formula kilograms of strategic special nuclear material (often referred to as a Category I quantity of material).

All other modifications involve format and editorial changes designed to provide clarifications and facilitate preparation or revision of the required MC&A plan.

iii NUREG-1280, Revision 2

CONTENTS ABSTRACT ...............................................................................................................................iii CONTENTS ............................................................................................................................... v ABBREVIATIONS .....................................................................................................................ix

1. INTRODUCTION................................................................................................................... 1

2. GENERAL PERFORMANCE OBJECTIVES, RELATED REQUIREMENTS, COMMITMENTS, AND ACCEPTANCE CRITERIA ............................................................. 3

3. PROCESS MONITORING .................................................................................................... 9 3.0 Regulatory Intent ............................................................................................................. 9 3.1 Process Subdivision and Measurement Points ...............................................................10 3.2 Material Control Tests ....................................................................................................11 3.3 Location Categorization ..................................................................................................15 3.4 Material Substitution .......................................................................................................16 3.5 Process Monitoring Exceptions ......................................................................................17 3.6 Trend Analysis ...............................................................................................................18 3.7 Research and Development Operations .........................................................................19 3.8 Commitments and Acceptance Criteria ..........................................................................20

4. ITEM MONITORING ............................................................................................................21 4.0 Regulatory Intent ............................................................................................................21 4.1 Item Loss Detection........................................................................................................21 4.2 Item Identification and Classification ..............................................................................22 4.3 Accessibility and Storage Controls .................................................................................24 4.4 Accounting and Control Procedures ...............................................................................26 4.5 Item Measurements........................................................................................................26 4.6 Item Verification .............................................................................................................27 4.7 Sample Items .................................................................................................................29 4.8 Commitments and Acceptance Criteria ..........................................................................31

5. ALARM RESOLUTION ........................................................................................................33 5.0 Regulatory Intent ............................................................................................................33 5.1 Alarm Resolution Procedures .........................................................................................33 5.2 Types of Alarms .............................................................................................................35 5.3 Response Time ..............................................................................................................39 5.4 Item Discrepancies .........................................................................................................40 5.5 Alarm Reporting .............................................................................................................42 5.6 Alleged Thefts ................................................................................................................43 5.7 Commitments and Acceptance Criteria ..........................................................................44

6. MANAGEMENT STRUCTURE AND PERSONNEL QUALIFICATION AND TRAINING ..................................................................................................................45 6.0 Regulatory Intent ............................................................................................................45 6.1 Corporate Organization ..................................................................................................45 6.2 Plant or Site Organization...............................................................................................45 6.3 Material Control and Accounting Organization................................................................46 6.3.1 Responsibilities and Authority ...............................................................................46 6.3.2 Material Control and Accounting Procedures ........................................................47 v NUREG-1280, Revision 2

6.3.3 Human Errors........................................................................................................48 6.3.4 Job Performance Aids ...........................................................................................49 6.4 Training and Qualification Requirements ........................................................................50 6.4.1 Training Program ..................................................................................................50 6.4.2 Qualification Program............................................................................................51 6.5 Material Control and Accounting Program Description ...................................................51 6.5.1 Automation of Material Control and Accounting.....................................................52 6.5.2 Human Error Quality Control .................................................................................52 6.6 Commitments and Acceptance Criteria ..........................................................................54

7. MEASUREMENTS...............................................................................................................57 7.0 Regulatory Intent ............................................................................................................57 7.1 Measurement Points ......................................................................................................57 7.2 Measurement Systems ...................................................................................................58 7.2.1 Bulk Measurement Systems..................................................................................59 7.2.2 Analytical Measurement Systems .........................................................................59 7.2.3 Nondestructive Assay Measurement Systems ......................................................60 7.2.4 Other Measurement Systems ................................................................................60 7.3 Measurement Uncertainties............................................................................................60 7.4 Measurement Procedures ..............................................................................................60 7.5 Scrap Control .................................................................................................................61 7.6 Commitments and Acceptance Criteria ..........................................................................61

8. MEASUREMENT CONTROL PROGRAM ...........................................................................65 8.0 Regulatory Intent ............................................................................................................65 8.1 Organization and Management ......................................................................................65 8.1.1 Functional Relationships .......................................................................................65 8.1.2 Procedures ...........................................................................................................65 8.1.3 Contractor Program Audits and Reviews ...............................................................66 8.2 Calibrations ....................................................................................................................66 8.3 Control Standards ..........................................................................................................68 8.4 Replicate Sampling ........................................................................................................70 8.5 Control Limits .................................................................................................................71 8.5.1 Measurement Control Data Analysis .....................................................................72 8.5.2 Response Actions .................................................................................................72 8.6 Commitments and Acceptance Criteria ..........................................................................73

9. STATISTICS ........................................................................................................................79 9.0 Regulatory Intent ............................................................................................................79 9.1 Determination of Measurement Uncertainties .................................................................79 9.2 Determination of the Standard Error of Inventory Difference ..........................................81 9.3 Bias Corrections .............................................................................................................82

10. PHYSICAL INVENTORIES ................................................................................................85 10.0 Regulatory Intent ..........................................................................................................85 10.1 General Description......................................................................................................85 10.2 Organization, Procedures, and Schedules ...................................................................85 10.3 Description of Typical Item Strata .................................................................................86 10.4 Facility Preparation.......................................................................................................86 10.5 Conducting Physical Inventories...................................................................................86 10.6 Inventory Reconciliation ...............................................................................................88 NUREG-1280, Revision 2 vi

10.7 Commitments and Acceptance Criteria ........................................................................89

11. SHIPMENTS AND RECEIPTS ...........................................................................................96 11.0 Regulatory Intent ..........................................................................................................96 11.1 Receiving Procedure ....................................................................................................96 11.2 Evaluation of Shipper-Receiver Differences .................................................................96 11.3 Shipping Procedure ......................................................................................................97 11.4 Commitments and Acceptance Criteria ........................................................................97

12. SCRAP CONTROL ..........................................................................................................100 12.0 Regulatory Intent ........................................................................................................100 12.1 Location .....................................................................................................................100 12.2 Processing .................................................................................................................100 12.3 Measurements ...........................................................................................................100 12.4 Inventory Control ........................................................................................................100 12.5 Recovery of Offsite Scrap...........................................................................................101 12.6 Commitments and Acceptance Criteria ......................................................................101

13. ASSESSMENT AND REVIEW OF THE MATERIAL CONTROL AND ACCOUNTING PROGRAM .....................................................................................104 13.0 Regulatory Intent ........................................................................................................104 13.1 General Description....................................................................................................104 13.2 Report of Findings and Recommendations .................................................................105 13.3 Management Review and Response to Report Findings and Recommendations .......106 13.4 Commitments and Acceptance Criteria ......................................................................106

14. DESIGNATION OF MATERIAL BALANCE AREAS, ITEM CONTROL AREAS, AND CUSTODIANS .........................................................................................................110 14.0 Regulatory Intent ........................................................................................................110 14.1 Material Control Boundaries .......................................................................................110 14.2 Custodians .................................................................................................................111 14.3 Commitments and Acceptance Criteria ......................................................................111

15. TAMPER-SAFING ...........................................................................................................114 15.0 Regulatory Intent ........................................................................................................114 15.1 Characteristics of Tamper-Safing Devices ..................................................................114 15.2 Use of Tamper-Safing Devices ...................................................................................115 15.3 Description of Tamper-Safing Records .......................................................................115 15.4 Commitments and Acceptance Criteria ......................................................................116

16. RESOLVING INDICATIONS OF LOSS, THEFT, DIVERSION, OR MISUSE OF SPECIAL NUCLEAR MATERIAL AND STRATEGIC SPECIAL NUCLEAR MATERIAL ....................................................................................118 16.0 Regulatory Intent ........................................................................................................118 16.1 Methods and Procedures for Identifying Indicators .....................................................118 16.2 System and Procedures for Investigating and Resolving Loss Indicators ...................118 16.3 Response Actions for Unresolved Indicators ..............................................................119 16.4 Documentation Requirements ....................................................................................119 16.5 Commitments and Acceptance Criteria ......................................................................120 vii NUREG-1280, Revision 2

17. INFORMATIONAL AID FOR ASSISTING IN THE INVESTIGATION AND RECOVERY OF MISSING SPECIAL NUCLEAR MATERIAL AND STRATEGIC SPECIAL NUCLEAR MATERIAL ................................................................122 17.0 Regulatory Intent ........................................................................................................122 17.1 Types of Information ...................................................................................................122 17.2 Information Indicating Possible Losses of Special Nuclear Material/Strategic Special Nuclear Material.............................................................................................122 17.3 Information on Resolving Indications of Missing Special Nuclear Material/Strategic Special Nuclear Material ................................................................123 17.4 Commitments and Acceptance Criteria ......................................................................124

18. RECORDKEEPING .........................................................................................................126 18.0 Regulatory Intent ........................................................................................................126 18.1 Description of Records ...............................................................................................126 18.2 Program and Controls for Ensuring an Accurate and Reliable Record System ...........127 18.3 Commitments and Acceptance Criteria ......................................................................128

19. GLOSSARY .....................................................................................................................132

20. REFERENCES ................................................................................................................138 NUREG-1280, Revision 2 viii

ABBREVIATIONS CAA controlled access area CFR Code of Federal Regulations DOE U.S. Department of Energy FKG formula kilogram IAEA International Atomic Energy Agency ICA item control area ID inventory difference JPA job performance aid MAA material access area MBA material balance area MC&A material control and accounting MOX mixed oxide NDA nondestructive assay NMMSS Nuclear Materials Management and Safeguards System NRC U.S. Nuclear Regulatory Commission R&D research and development SEID standard error of the inventory difference SNM special nuclear material SSNM strategic special nuclear material TID tamper-indicating device wt% weight percent Chemical Symbols:

K2Cr2O7 potassium dichromate U-235 uranium-235 Pu plutonium U-238 uranium-238 PuO2 plutonium dioxide UO2 uranium dioxide Pu-238 plutonium-238 U3O8 urano-uranic oxide U uranium UF6 uranium hexafluoride U-233 uranium-233 UNH uranyl hexahydrate U-234 uranium-234 ix NUREG-1280, Revision 2

1. INTRODUCTION Title 10 of the Code of Federal Regulations (10 CFR) Part 70, Domestic Licensing of Special Nuclear Material, and 10 CFR Part 74, Material Control and Accounting of Special Nuclear Material, include the principal requirements for licensing special nuclear material (SNM). In particular, 10 CFR 70.22(b) specifies that a license application must fully describe the applicants program for the control and accounting of such SNM and demonstrate how the program will comply with the graded material control and accounting (MC&A) requirements of 10 CFR Part 74, Subparts C through E.

This guidance document describes the standard format and content suggested by the U.S. Nuclear Regulatory Commission (NRC) for use in preparing MC&A plans for the possession and use of a formula quantity (i.e., 5 formula kilograms (FKG) or more) of strategic special nuclear material (SSNM). This document also provides recommended acceptance criteria for use by licensees and NRC licensing reviewers. Criteria are included as examples, and each licensee should develop an MC&A plan that takes into account the unique features of its particular operation. Where additional guidance is available on particular topics, the acceptance criteria section includes an appropriate reference.

A licensees general MC&A program, and its specific MC&A plan, must demonstrate that it will achieve and maintain the basic capabilities specified in the following regulations:

10 CFR 74.51, Nuclear Material Control and Accounting for Strategic Special Nuclear Material

10 CFR 74.53, Process Monitoring

10 CFR 74.55, Item Monitoring

10 CFR 74.57, Alarm Resolution

10 CFR 74.59, Quality Assurance and Accounting Requirements The licensee must also demonstrate how such capabilities are used to meet the general performance objectives stated in 10 CFR 74.3 and 10 CFR 74.51(a). After approving an MC&A plan and imposing it as a license condition, the NRC will verify the adequacy of a licensee's MC&A program by inspecting to determine conformance with commitments and practices described in the MC&A plan.

Because 10 CFR 74.3, 10 CFR 74.51, 10 CFR 74.53, 10 CFR 74.55, 10 CFR 74.57, and 10 CFR 74.59 are performance-oriented regulations, they do not contain a detailed set of technical specifications. With this flexibility, applicants and licensees have many alternatives with regard to how their MC&A program is designed, managed, and operated, which permits a risk-informed, performance-based approach that focuses on MC&A activities most important to safeguards. Accordingly, this document does not cover all possible methodologies that a licensee might use to meet the MC&A requirements. Instead, this document provides examples of acceptable MC&A approaches that a licensee may use. This guidance is intended for use by 1 NUREG-1280, Revision 2

applicants, licensees, and the NRC safeguards licensing reviewers. Acceptance criteria are not to be regarded as rigid, fixed standards. That is, a lower effectiveness of one capability relative to a particular aspect is acceptable if there is a compensating program feature, or combination of features, that provides an overall effective safeguards program. In the final analysis, an NRC reviewer must find that the applicants or licensees MC&A plan provides adequate assurance that all applicable regulatory requirements will be met.

The introductory material to this document describes the basis of the eight general performance objectives of 10 CFR 74.3 and 10 CFR 74.51(a). The chapters that follow incorporate and expand on the general performance objectives and describe the MC&A features and capabilities needed to meet the performance objectives. Together, Chapters 3-18 provide licensees an acceptable outline for establishing MC&A plans.

The NRC will make the body of an approved MC&A plan a condition of the license, in accordance with 10 CFR 70.32(c), and compliance with the MC&A plan commitments and pertinent procedures will be inspectable. Explanations and discussions appearing in the body of the plan should be sufficiently detailed and precise so that the NRC licensing reviewers, the NRC inspectors, and licensee personnel responsible for developing and implementing the plan have a clear and common understanding of what the MC&A plan requires.

The annex (or appendix) of an MC&A plan should provide supplementary and general information about the facility and the MC&A program and subsystems (e.g., copies of blank record forms, site map, process diagrams, an example standard error of the inventory difference (SEID) calculation). The annex will not be incorporated as a condition of license and will not be the basis for inspection. Thus, descriptions presented by the licensee to meet regulatory requirements must be in the plan itself, rather than the annex, and must provide adequate detail so as not to depend greatly on examples or supplementary information in the annex for proper understanding. Procedures detailed in the annex may be changed without NRC approval or notification provided that plan commitments and capabilities are not degraded.

Preparation of an MC&A plan with this standard format will assist the NRC in evaluating the plan and in standardizing the licensing and review process. However, the NRC does not require conformance with the standard format. An applicant may use a different format if it provides an acceptable level of completeness and detail.

NUREG-1280, Revision 2 2

2. GENERAL PERFORMANCE OBJECTIVES, RELATED REQUIREMENTS, COMMITMENTS, AND ACCEPTANCE CRITERIA General Performance Objectives The regulations in 10 CFR 74.3 and 10 CFR 74.51(a) set forth the eight general MC&A performance objectives applicable to licensees authorized to possess and use a formula quantity of SSNM. As indicated below, for licensees authorized to possess Category I amounts of material, these performance objectives apply to SNM and SSNM. The following paragraphs discuss the basis of these general performance objectives and the related requirements in Subpart E, Formula Quantities of Strategic Special Nuclear Material, of 10 CFR Part 74.

1. Maintain accurate, current, and reliable information on, and confirm the quantities and locations of, SNM/SSNM in the licensees possession.

The purpose of this performance objective is to verify the presence of all SNM and SSNM held by the licensee and to detect the occurrence of any significant loss, including possible theft or diversion. To maintain current information on all such SNM/SSNM in their possession, licensees should have in place a program that provides timely, accurate, and reliable information about the quantity and location of SNM/SSNM in their possession. Accurate information means that quantities for plutonium (Pu), the element uranium (U), and the isotopes U-235 and U-233 are based on measured values or on reliable information. Reliable information means that the quantity of SNM/SSNM in an item and the location of all items are known. The location designations should be specific enough to provide for the retrieval of the items in a prompt manner. Reliable information also means that the quantities and locations of all nonexempt SNM/SSNM and items listed in the accounting records are correct and verifiable.

The licensee should accurately account for all SNM/SSNM it receives and ships by maintaining reliable records based on accurate measurements. When a shipment is received, the licensee should begin monitoring the movement and location of the material within the facility using item control procedures to (1) monitor the location and integrity of items until they are processed and (2) ensure all SNM/SSNM quantities of record associated with receipts, shipments, discards, and ending inventory are based on measurements. Chapter 4 of this document provides recommendations for meeting the performance objectives for the item control program.

Chapters 7 and 8, respectively, include recommendations for the MC&A measurement and measurement control subsystems. Monitoring the material in process may involve the use of process or material control data. To support this function, the licensee should maintain a detailed and accurate recordkeeping system for the generated data that provides knowledge of the materials location on a timely basis.

The licensee must conduct total plant physical inventories at least every 185 calendar days, in accordance with 10 CFR 74.59(f). The licensee must conduct each physical inventory in a manner to ensure the detection of any actual significant loss, including possible theft or diversion, by evaluating each inventory difference (ID) using an SEID that is less than 0.1 percent of the active inventory, in accordance with 10 CFR 74.59(f). As a result, the investigation and reporting of any ID that exceeds three times the SEID is equivalent to a hypothesis test that provides 90 percent power for detecting a discrepancy as small as 0.4 percent of active inventory at a false alarm rate of 5 percent.

3 NUREG-1280, Revision 2

The licensee should verify the presence of all SNM/SSNM held under its license, as documented in accounting records. This verification is normally accomplished by a shutdown and cleanout of processing equipment, measurement of cleanout materials and measurement of any materials not previously measured in their existing form, visual verification (on a 100-percent basis) of the presence of all possessed SNM/SSNM items (by means of unique item identities), and confirmation of the SNM/SSNM quantities associated with unencapsulated and unsealed items on ending inventory. However, the licensee may use a dynamic (i.e.,

nonshutdown) inventory of some or all processing equipment if the measurement uncertainty associated with the total material balance (for the inventory period) is within the constraint of 0.1 percent of active inventory specified in 10 CFR 74.59(e)(5).

Chapter 10 of this document details recommendations pertaining to physical inventories. In summary, a total plant physical inventory should involve the following:

verifying the presence, on a 100-percent basis, of all uniquely identified SNM/SSNM items listed in the accounting records

measuring (by direct measurement or, if direct measurement is not feasible, by indirect measurement) all bulk SNM/SSNM quantities on hand (i.e., all SNM/SSNM not in item form)

measuring any items not previously measured

verifying the identity and integrity of all encapsulated items and items affixed with tamper-indicating devices (TIDs)

measuring an SNM/SSNM-related parameter for a sample of randomly selected unencapsulated and unsealed items, based on a statistical sampling plan, to verify the previously measured quantities of SNM/SSNM contained in such items The licensee should manage and maintain the physical inventory program independent of the production or operations organization, but the program should not be excluded from using process monitoring and production control data.

2. Detect, respond to, and resolve an anomaly indicating a possible loss, theft, diversion, or misuse of SNM/SSNM.

3. Permit rapid determination of whether an actual loss, theft, diversion, or misuse of SNM/SSNM has occurred.

The purpose of these two performance objectives is to ensure that licensees can adequately detect and respond to indications of possible loss, theft, diversion, or misuse of SNM/SSNM and rapidly determine whether a loss, theft, diversion, or misuse of SNM/SSNM occurred.

As discussed further in Chapter 16 of this document, to meet the requirements of 10 CFR 74.3(b) and 10 CFR 74.3(c), as well as 10 CFR 74.51(a), the licensee or applicant should have a formalized program to promptly detect, respond to, and resolve an anomaly that may indicate a possible loss of SNM/SSNM. Resolution of such anomalies means that the licensee has made a rapid determination as to whether an actual loss of SNM/SSNM has NUREG-1280, Revision 2 4

occurred, including possible theft or diversion. A licensee should investigate and resolve an anomaly detected during a material balance closure in accordance with the requirements of 10 CFR 74.59(f)(1).

Resolution of an anomaly depends on the type of indicator. Various types of anomalies at plants could occur from a wide range of possible underlying scenarios (e.g., from unidentified or inadequately monitored loss mechanisms, simple theft, complex diversions). The investigation and resolution process should begin with a thorough review of the MC&A records to locate obvious errors. These errors might include omissions of entire items, incorrect entries to computer programs or records, transcription errors, incorrect estimates of the amount of holdup in equipment, or calculation errors. A detailed examination of the MC&A records for each material type should identify gross errors. The next stage in the resolution process is to isolate the process or storage area that appears to be causing the anomaly. Once this is accomplished, the licensee should verify all of the information that contributed to the SNM/SSNM quantities for that location. If resolution still is not accomplished, the licensee should remeasure and sample material in the process or storage areas to verify quantities. If the investigation of an indicator results in a determination that an actual loss or theft has occurred, the licensee must report the loss or theft to the NRC, in accordance with 10 CFR 74.11, Reports of Loss or Theft or Attempted Theft or Unauthorized Production of Special Nuclear Material.

4. Provide information to aid in the investigation and recovery of missing SNM/SSNM in the event of an actual loss, theft, diversion, or misuse.

The purpose of this performance objective in 10 CFR 74.3(d) is to ensure that licensees provide adequate assistance in any investigations of an actual loss, theft, diversion, or misuse of SNM/SSNM conducted by a government agency. If the NRC or other government agencies deem it necessary to conduct an investigation relating to actual or highly suspected events pertaining to missing material, the licensee should provide any information deemed relevant to the recovery of material involved in a loss, theft, or diversion. The licensee must provide all information that it recognizes as being relevant, whether or not the investigators request it.

Chapter 17 of this document provides additional information and recommendations pertaining to providing information to aid in investigations.

5. Control access to MC&A information to preclude loss, theft, diversion, or misuse of SNM/SSNM.

The purpose of this performance objective in 10 CFR 74.3(e) is to implement the practices and procedures needed to provide effective material control and material accounting with respect to deterrence and detection of loss, theft, diversion, or misuse of SNM/SSNM. The licensee should control access to MC&A information through, for example, personnel access control, material containment, and material surveillance. Effective control systems should be multilayered, and licensees should use redundant systems to eliminate the consequence of a single-point failure.

The licensee should implement an effective quality assurance program that minimizes the possibility of potential failures for the MC&A program. These control measures can contribute to deterrence of material loss, theft, diversion, or misuse by providing necessary checks and balances. The licensee should carefully monitor and manage access control involving all movements of people and materials into and out of the material access areas (MAAs).

Adequate containment and surveillance measures should ensure that the integrity of nuclear 5 NUREG-1280, Revision 2

material values is maintained.

The licensee should give primary attention to preventing errors or mistakes by MC&A personnel and to preventing violations of procedures or compromise of MC&A information and data. The licensee should establish a system of balances and checks to ensure data accuracy, and this system should detect any instances of unauthorized access to data. Mistakes resulting from inadequate training, accidents, improper equipment operation or maintenance, or any other unintentional actions can cause the MC&A program to lose its effectiveness.

In addition to the 10 CFR 74.3 general performance objectives, which focus on the prevention of theft, licensees authorized to hold SSNM must, in accordance with 10 CFR 74.51(c), be able to detect the falsification of data that could conceal the diversion of SNM or SSNM by (1) an individual, including an employee in any position, or (2) collusion between an individual with MC&A responsibilities, and another individual who has responsibility or control within both the physical protection and the MC&A programs.

The MC&A program and plan need to protect against only a single insider, providing that such an individual does not have authority within the physical protection system that would permit him or her to participate in a conspiracy aimed at defeating the safeguards system. If an MC&A individual does have authority within the physical protection system, then the MC&A program and plan is required to protect against the coverup of a collusion of that individual with any other individual having MC&A authority. This approach should relieve licensees of most of the burden that would result from requiring a totally redundant system while still maintaining the ability of the MC&A program and plan to provide an extra level of independent protection and an added measure of assurance that the safeguards system as a whole has not been compromised.

The licensee should analyze all positions having responsibility within the 10 CFR Part 74 MC&A program to determine whether any such positions also have responsibility within the physical protection system developed under 10 CFR Part 73, Physical Protection of Plants and Materials. A safeguards manager might be an example of such a position. If this position includes both MC&A and physical protection responsibilities, the licensee would have to develop procedures to ensure that, when an individual in this job is performing an MC&A function, he or she performs the function in the presence of at least two other people (industry procedures often reference this as the three-person rule), that performance of the function be independently checked later by a third party, and that abuse of authority is otherwise protected against.

To address collusion concerns, the licensee would need to protect an MC&A function performed by a worker without physical protection system authority against a single insider threat, particularly if such a worker has hands on access to formula quantities of SSNM.

6. Provide ongoing confirmation of the presence of SSNM in assigned locations.

The purpose of this performance objective in 10 CFR 74.51(a)(1)(i) is to ensure timely plantwide detection of the loss of items that total 5 FKG or more. To achieve this capability, the licensee should verify the presence and integrity of selected SSNM items on a periodic basis. The required frequency of tests for missing items, as described in 10 CFR 74.55, is graded according to the relative attractiveness of the material type in the item, the ease with which the item could be diverted without being observed, and the degree of surveillance and containment provided for by the material control and physical security systems. Chapter 4 of this document NUREG-1280, Revision 2 6

provides additional information and recommendations pertaining to ongoing confirmation of the presence of SSNM in assigned locations.

7. Provide for the timely detection of the possible abrupt loss of five or more formula kilograms of SSNM from an individual unit process.

8. Permit rapid determination of whether an actual loss of fiveor more formula kilograms of SSNM occurred.

The purpose of these performance objectives in 10 CFR 74.51(a)(1)(ii)-(iii) and the requirements in 10 CFR 74.53 is to have a quality control program that will provide early indications of diversion or theft and a prompt detection system for significant abrupt diversions of 5 FKG or more. Through prompt detection, the licensee can initiate response and recovery actions soon after a loss event while the circumstances surrounding the loss are fresh in the minds of cognizant personnel and materials are available for remeasurement. In addition, fewer changes in process conditions, inventories, in-process holdups, and item locations would occur, thus enhancing the probability of resolution. The detection times for a 5 FKG loss are maximums; hence, a licensee may use shorter intervals for specific unit processes. Chapter 3 of this document provides additional information and recommendations pertaining to the timely detection of a possible abrupt loss of 5 FKG.

Commitments and Acceptance Criteria Pertaining to General Performance Objectives In its MC&A plan, the applicant or licensee should provide definitive commitments that adhere to the regulatory requirements with respect to these general performance objectives and corresponding program capabilities. Chapters 3 through 8 and 10 through 18 of this document list the acceptance criteria pertaining to the performance objectives and program capabilities.

The following chapters of this document incorporate and expand on the performance objectives and on the MC&A program and plan capabilities specified in 10 CFR 74.3, 10 CFR 74.51, 10 CFR 74.53, 10 CFR 74.55, 10 CFR 74.57, and 10 CFR 74.59. The chapters are arranged in a format and sequence that will provide applicants and licensees an outline for their required MC&A plans.

7 NUREG-1280, Revision 2

3. PROCESS MONITORING 3.0 Regulatory Intent The intent of the 10 CFR 74.53 process monitoring requirements is to have a quality control program that will provide early indications of diversion or theft and a prompt detection system for significant abrupt diversions of 5 FKG or more. Through prompt detection, the licensee can initiate response and recovery actions soon after a loss event while circumstances surrounding the loss are fresh in the minds of cognizant personnel and materials are available for remeasurement. In addition, fewer changes in process conditions, inventories, in-process holdups, and item locations would occur, thus enhancing the probability of resolution. The detection times for a 5 FKG loss are maximums; hence, a licensee may use shorter intervals for specific unit processes if so desired.

The regulations in 10 CFR 74.53(a) require licensees subject to 10 CFR 74.51 to monitor internal transfers, storage, and processing of SSNM. The process monitoring must achieve the detection capabilities described in 10 CFR 74.53(b) for all SSNM, except for the material listed in 10 CFR 74.53(a)(1) through (4).

As required by 10 CFR 74.53(b), the licensee must establish, for each process unit, a production quality control program capable of monitoring the status of material in process. The program shall include the following:

a statistical test that has at least a 95 percent power of detecting an abrupt loss of 5 FKG within 3 working days of a loss of Category IA material from any accessible process location and 7 calendar days of a loss of Category IB material from any accessible process location (10 CFR 74.53(b)(1))

a quality control test whereby results greater than both three times the estimated standard deviation of the process difference estimator and 25 grams of SSNM are investigated (10 CFR 74.53(b)(2))

a trend analysis for monitoring and evaluating sequences of material control test results from each unit process to determine whether they indicate a pattern of losses or gains that are of safeguards significance (10 CFR 74.53(b)(3))

The regulations in 10 CFR 74.53(c) require that, for research and development (R&D) operations that are exempt from 10 CFR 74.53(b), the licensee shall (1) perform material balance tests on a lot or batch basis, as appropriate, or at intervals not to exceed 30 calendar days, whichever is sooner, and investigate any difference greater than 200 grams of plutonium or U-233 or 300 grams of U-235 that exceeds three times the estimated SEID and (2) evaluate material balance results generated during an inventory period for indications of measurement biases or unidentified loss streams and investigate, determine the cause of, and institute corrective action for cumulative IDs generated during an inventory period that exceed 3 FKG of SSNM.

By design, R&D operations are dynamic in nature. Thus, the prompt loss detection techniques that depend upon process yields are inappropriate for loss detection. Taking into account the low throughput of such operations, periodic material balance tests on a batch or 30 calendar day basis are deemed acceptable for loss detection.

9 NUREG-1280, Revision 2

A working day is any 24-hour calendar day (from 12:01 AM to 12:00 midnight) during which material processing activities occur and there is material handling, except for those calendar days in which the only processing and material-handling activities are limited to the first or last 30 minutes of the day, or both the first and the last 30 minutes of the day, because of the ending or beginning of shift scheduling times. A day during which activities such as maintenance of equipment, cleanup, and autoclave monitoring occur would not be considered a work day, unless such a day involved the handling of SSNM.

3.1 Process Subdivision and Measurement Points The MC&A plan should describe the subdivision of the process to meet the unit detection requirements, the associated parameters to be measured, and the measurement points. The plan may include a diagram or listing to document this information.

The number of control units into which a facility can be divided is not limited or restricted. Loss detection sensitivity, false alarm rate, and loss localization capability are key determining factors.

Bulk materials, including nontamper-safed containers of SSNM (i.e., not within a vault or permanently controlled access area (CAA)), as well as materials in process equipment, should be covered. In general, this applies to material that must be measured to verify its presence, rather than having its identification number and seal or encapsulation integrity checked.

Acceptance Criteria:

All SSNM in bulk form in the MAA is within the span of a material control test.

Exceptions include (1) low-level waste that meets the criteria in 10 CFR 73.46(c)(6),

(2) laboratory samples each containing less than 0.05 FKG, (3) SSNM in R&D operations with throughputs of less than 5 FKG during a period of 7 calendar days, and (4) SSNM in waste treatment operations conducted outside an MAA (e.g., incinerator).

The following criteria are appropriate in determining control unit boundaries:

Material control tests should be performed on units generally consistent with readily assessable measurement points that naturally result from the process design. Process units should not be divided into smaller units for material control tests if such subdivision would cause the standard deviation of the test statistic to increase from below 850 formula grams U-235 (or equivalent units for tests not based on U-235) to above 850 formula grams U-235 unless such subdivision is necessary to meet the timeliness criteria in 10 CFR 74.53(b)(1).

Batch transfers should be used wherever they occur.

Process variabilities should be localized to a control unit.

Concentration differences between feed and product stream output should be minimized wherever possible.

Process units that operate continuously should be separated (in terms of defining control unit test boundaries) from those that operate in a batch mode.

NUREG-1280, Revision 2 10

False alarm rates should be minimized. The number of false alarms per inventory period should be less than 1 percent of all tests.

3.2 Material Control Tests The MC&A plan should describe the material control tests for each unit process. The description should include the following:

identification of the test statistic

the amounts and types of data used to establish uncertainties (sigmas)

tests for normality

means of handling nonnormal data

tests for outliers

methods for establishing alarm thresholds

criteria for modifying alarm thresholds

the basis for assignment of the start times for each material control test The annex to the MC&A plan should include the following:

a detailed example alarm threshold calculation for a process unit

a tabulation of the threshold values for all process units

a tabulation of the detection times associated with each material control test

the justification for the derivation of each threshold value

a listing of Category IA and IB materials and the justification for the lower classification of the latter Acceptance Criteria:

The licensee has developed a system of material control tests for detecting abrupt losses of bulk material from single units or locations within the facility. The material control tests are capable of detecting a 5 FKG loss with at least a 95 percent power of detection. The material control tests have the following characteristics:

- Each material control test encompasses the SSNM in a definite unit or location or over a span of locations comprising a segment of the process or a single point in the process.

- Automated or manual records of the location, movement, quantity, and identity of SSNM are maintained as needed to perform the material control tests for abrupt loss detection.

11 NUREG-1280, Revision 2

- The material control test is based on a comparison of a measured value of a quantity of material or of a process variable with a reference value. The reference value is the expected or predicted quantity of material or value of the process variable in the absence of diversion or unexpected loss. Examples of possible material control tests include the following:

SSNM material balance

mass (weight) balance

volume balance

yield versus expected or predicted yield

liquid level versus predicted level

solution density versus predicted density

flow rate versus predicted flow rate

bulk powder volume or volume times bulk density versus predicted quantity

nondestructive assay (NDA) value versus predicted value

isotopic ratio versus predicted value

number of units, such as pellets, elements, or pins, versus predicted number

process control parameters, such as pH, reagent volume, or extraction efficiency, versus predicted values

- Each material control test has an action threshold (critical value) which, if exceeded, initiates the alarm resolution procedures prescribed in 10 CFR 74.57. In general, the action threshold or critical value can be set by a formula of the following type:

A = + G + x - Kx (when x increases upon real loss)

A = - G + x + Kx (when x decreases upon real loss) where:

A = alarm threshold in terms of test value obtained for x (as formula grams SSNM)

G = goal quantity = 5,000 formula grams or less x = test statistic (parameter) such as feed input minus product output for a given test period, as formula grams SSNM NUREG-1280, Revision 2 12

x = test statistic mean, assuming the null hypothesis, H0, is true (H0: L=0), as formula grams SSNM (Note: This mean value can be either positive or negative.)

L = loss quantity K = factor based on probability of detection x = standard deviation of the test statistics, as formula grams SSNM Key considerations applicable to this determination include the following:

- If the distribution of the source data can be reasonably represented by a single normal model after the effects of human errors have been eliminated, use K = 1.65 to achieve the 95 percent detection probability.

- If an analysis of test data indicates the presence of multiple distributions, one of the following actions would be appropriate:

Undertake an in-depth study to identify the sources of error and the adjustments that should be made, as appropriate, so that a single normal distribution adequately represents the data.

Estimate the parameters (x , x) using a computer program as necessary to maximize the likelihood function; then determine the critical point by integrating the probability density function to the probability of interest.

Determine whether the presence of multiple distributions is the result of concomitant data which occurred as the result of some recognized change that happened during the test period (e.g., new and recycled material processed through an operation). If such data are available, the data should be split into subsets for testing.

- If a nonzero x is used, a study should be conducted to identify the causes.

The chosen x should minimize the x for the test statistic.

The action thresholds for the material control tests are updated, at least annually, based on the previous 6 months of operating data and as supported by the analysis of test data.

When data do not seem to fit a normal distribution, the licensee should evaluate whether some mathematical function of the data values will fit (transformation of data). A commonly used transformation is logarithms, which is the basis for the lognormal distribution.

Although no limit on the magnitude of the measurement or process uncertainty is stated, establishment of alarm thresholds indirectly limits the magnitude of these errors. That is, when the standard deviation of the test statistic becomes a large fraction of G, there is an excessive number of false alarms.

The combined quality of the material control test and loss resolution decisions shall permit alarms remaining unresolved after the completion of investigative activities to be 13 NUREG-1280, Revision 2

good indicators of an actual loss. To achieve this objective, the licensee should demonstrate that the statistically expected number of unresolved false alarms will be less than 0.10 per inventory period for all abrupt bulk loss alarms exceeding 5 FKG (i.e.,

the predicted number of such unresolved alarms should be less than 1 in 10 inventory periods).

The action thresholds are based on statistical hypothesis tests derived from the variances of the test statistics or on other technical bases for which it can be shown that the power of the test for loss is satisfactory.

The measurement variances assumed by the licensee are either supported by published typical values (see Reilly and Evans (1977); Rogers (1983); or Reilly et al. (1991)), the licensees measurement control data, or historical data from the licensees process or other similar processes. The assumed process variances may be estimated by using conservative judgments based on sound engineering principles if historical performance data for the licensees process or similar processes are not available. If engineering judgments or typical values are used, the MC&A plan should include provisions and schedules for updating the estimated variances with actual performance data. The methods of estimating the loss detection sensitivity or the variances of loss detection parameters are satisfactorily explained and a credible justification for their use is given.

The tests for detecting abrupt losses at each accessible location meet the 3- and 7-day detection time requirements for Category IA and Category IB materials, respectively, under all routine conditions expected to prevail at the location, in accordance with 10 CFR 74.55.

(Note: When detection times are interrupted by idle time caused by weekends, holidays, or vacations, for example, the licensee has provisions for completing the tests before the idle time or for conducting additional tests to cover any material control tests that will not be completed. The additional tests achieve the same level of detection as the principal tests.)

The annex to the MC&A plan explains and justifies the licensees classification of the process material as Category IA and Category IB. Category IB materials must meet at least one of the following criteria:

(1) unusable for constructing a nuclear explosive device without further processing (2) not susceptible to undetected removal from the MAA by an insider because of size, weight, or chemical hazard (3) of such low concentrations of SSNM that excessively large bulk quantities would be needed to obtain a formula quantity of SSNM

The timeliness of abrupt loss detection at a single location is based on the interval between the time a goal quantity of SSNM becomes accessible for diversion and the completion of the material control test. The start time occurs when the quantity of SSNM is first equal to or greater than the established goal quantity.

NUREG-1280, Revision 2 14

Process difference estimates that exceed both three times the standard deviation of their estimator and 25 grams of SSNM must be investigated and the results documented. The investigation should as a minimum include the following:

a review of all source data and calculations for errors a review of material control test results for the preceding SSNM quantity in the involved unit and the results of material control tests from the two adjacent units an interview with process operators to ascertain whether a perturbation in the process may have occurred a check of sidestreams for abnormally high SSNM content an assessment of the possibility that additional holdup beyond what had been projected may have occurred when necessary, a check of safety and backup systems common to several (or all) process units, such as ventilation filters and scrubbers, effluent monitors, and the like, for indications of abnormally high process losses Differences that exceed three times the standard deviation are expected to be good quality control indicators for anomalies that could have an adverse impact on MC&A. In some units, differences of such a magnitude might trigger an alarm potentially indicative of a 5 FKG loss, in which case the licensee would initiate alarm resolution procedures. In other cases, the differences may be far less than the quantity necessary to trigger an alarm; however, investigative action is appropriate before the problem escalates to a more serious situation.

The problem that comes from too large a measurement or process uncertainty, which causes the standard deviation of the test statistic to be a large fraction of the goal quantity, is excessive false alarms. The rule does not limit the number of false alarms allowed. However, the alarm resolution requirements in 10 CFR 74.57 must be met. One approach to meeting those requirements is to reduce expected false alarms to a level below the acceptable number of irresolvable alarms. Another approach is to tolerate a fairly high rate of false alarms and have more accurate backup measurement systems or more accurate downstream measurements to help resolve the false alarms. Criteria for the acceptability of the alarm resolution approach provide the limits on measurement error for detection and response.

3.3 Location Categorization The MC&A plan should identify the SSNM locations within the facility classified as inaccessible (relative to SSNM accessibility by a single individual).

The annex to the MC&A plan should provide the justification for classifying a location as inaccessible.

Acceptance Criteria:

All SSNM locations within the facility that are considered to be inaccessible will be identified and the supporting rationale provided.

15 NUREG-1280, Revision 2

For the purpose of establishing the start time for material control tests, SSNM may be treated as not accessible for diversion if any of the following conditions apply:

Access to SSNM is physically precluded without the need for visible puncturing, breaking, or otherwise violating the integrity of the process equipment containing the SSNM.

The state of the SSNM precludes diversion because of high temperature, chemical reactivity, radioactivity, or other chemical or physical properties.

The removal of the SSNM from its authorized location cannot be accomplished because the tools or equipment needed for its movement are unavailable.

The SSNM is a large volume of dilute solution within a large vessel, the absence of which (i.e., the SSNM) could not escape notice.

The material is under continuous surveillance of two or more individuals or an electronic or other type of monitoring system that will detect attempts by a single individual to remove material from a process.

The licensee must detect losses from any location. The concept of accessible location applies only to the criteria for establishing and determining the timeliness of the licensees detection capabilities. The detection time is the duration from when the SSNM passes a place from where it is accessible to diversion to the time at which its loss would be detected.

Licensees are encouraged to have few accessible locations since the risk of material being stolen is reduced by minimizing opportunities for people to have access to material or to have access to points of remote control over material flow, if those controls could be used to divert the flow into unauthorized locations.

Generally, a glove box should be considered an accessible location. Since such activities as a glove change or bagging out operation are considered routine, a removal of material via this route may not be readily detectable. However, if an enforceable policy exists which states that all removals from a glove box must be accomplished by at least two individuals and no access points can be accessed without an obvious indication, a glove box may be treated as inaccessible.

3.4 Material Substitution The MC&A plan should identify all credible substitute materials (for both simple and isotopic substitution) at each location and the method of testing for substitution or for controlling the substitute material to prevent or detect attempts at substitution. The plan should also describe the method of preventing credible substitute materials from being covertly introduced. (Note:

Reference to the physical protection plan is permitted.)

Acceptance Criteria:

The material control tests need only detect those losses not involving substitution unless credible materials are available in the same MAA in the form of uncontrolled material or are not prohibited as contraband from being brought into the MAA.

NUREG-1280, Revision 2 16

Where credible substitute material is present and uncontrolled, the material control tests must be capable of detecting diversions employing substitution with the loss sensitivity and probability of detection required in 10 CFR 74.53. If uranium of a lower enrichment is a credible uncontrolled substitute, a material control test must be capable of detecting isotopic dilution. Otherwise, a test that detects replacement of plutonium or uranium SSNM by another element is adequate.

Material is not a credible substitute if it satisfies any of the following:

has physical properties, such as density, color, particle size, or other characteristics, that will be immediately and unequivocally recognized to differ from the SSNM by personnel who routinely work with the SSNM has chemical properties that will always cause process upsets or degradation of product quality severe enough to be recognized and reported to a designated individual responsible for initiating a response within the item period of the material control test is controlled by a monitoring technique or physical controls that prevent its substitution for SSNM is controlled by a material accounting test that will detect losses or diversion of the substitute material and, in the absence of an alarm, will provide indirect assurance that an SSNM diversion involving substitution has not occurred

Acceptable controls on substitute materials might include the following:

Access to the material is controlled through isolation in a locked limited access cabinet or room and access is restricted to individuals who would not be involved in the actual handling of SSNM during production operations.

Periodic material balances are performed on the substitute material inventory in which case the balance may merely entail a weight comparison of material on starting inventory plus additions to inventory minus material issued for production versus the current inventory weight.

Semiquantitative NDA tests are performed on intermediate product materials from process operations in which credible substitute materials might be introduced.

Credible substitute materials are stored outside the MAA and introduced only in amounts for a shifts or days production.

3.5 Process Monitoring Exceptions Process monitoring must achieve the detection capabilities described in 10 CFR 74.53(b) for all SSNM, except for the types of material specified in the 10 CFR 74.53(a)(1)-(4) exceptions. The MC&A plan should detail the specific material types, with their locations, that are excepted from the 10 CFR 74.53(b) requirements.

17 NUREG-1280, Revision 2

Acceptance Criteria:

For low-throughput operations, such as waste compactors and incinerators where throughput is less than 5 FKG over a period of 95 calendar days and the measurement uncertainties (at the 2-sigma level) on inputs or outputs, or both, are greater than 10 percent, the licensee performs material balances on a batch basis and makes appropriate corrections to the originating unit or units or area cumulative balances to the extent practicable. Holdup determinations are necessary only at the time of the physical inventory (or sooner for criticality safety reasons), and input-output differences are assessed only to the extent that significant trends are investigated to identify measurement biases or an unaccounted for loss stream.

For samples containing greater than 0.05 FKG and scrap and waste containers in laboratories, the licensee performs monthly material balances. These balances may be accomplished by the following:

maintaining a dynamic record of the laboratory inventory maintaining a continuous inventory of the contents of scrap and waste containers by tracking the amounts of all additions (or removals) to each container measuring the contents of each container monthly to detect significant discrepancies where significant is defined as more than two times the standard deviation of the difference estimator 3.6 Trend Analysis Nonrandom behavior of process differences may indicate the presence of an unidentified bias, unmeasured loss stream, or diversion. It is important that trends be identified so that investigations can be initiated to uncover the cause. The MC&A plan should describe the trend analysis techniques that are employed to monitor sequences of process differences from material control tests. The description should include the decision criteria for ascertaining when a significant trend exists.

Acceptance Criteria:

The licensee can accomplish the trend analysis required by 10 CFR 74.53(b)(3) by applying the appropriate parametric or nonparametric statistical techniques. Examples include Pages test, Runs test, Dietzs test, power one test, and a MOSUM test (e.g., Picard (1986);

Johnston et al. (1987)).

With respect to safeguards significance as it pertains to trend analysis, a trend should be considered significant when the applied test indicates it to be so and the absolute quantity involved is in excess of 3 FKG.

To select a trend analysis test, the licensee should evaluate historical data to determine whether the assumptions of the statistical test are appropriate, including distribution of data and independence of successive data.

NUREG-1280, Revision 2 18

Two process difference estimates in succession within the same process control unit that exceed three times the standard deviation of their estimators and their sum exceeds 3 FKG, where both suggest a loss or a gain, should trigger additional investigative measures that include the following:

notification of the nuclear materials control manager review of security records added surveillance measures in the involved process unit conduct of a physical inventory of the associated material balance area (MBA) within 2 months 3.7 Research and Development Operations The MC&A plan should provide the criteria that are used to define a lot or batch for R&D operations.

The plan should describe how the components of a process material balance are established, including the degree to which a process will be cleaned out or holdup measurements will be performed. The plan should discuss the handling of scrap, including measurement, pretreatment before recovery, and segregation.

Acceptance Criteria:

Proposed materials groupings into lots or batches are acceptable taking into account prompt loss detection objectives, measurement characterization, and processing constraints.

For R&D material balances, the inputs to the SEID are reasonable and include all sources of measurement error.

IDs on R&D lots or batches generated during an inventory period may be based on weight comparisons provided that the following is true:

The lots or batches represent intermediate products.

The input materials to the R&D facility are measured for element or isotope, or both.

No credible substitute materials are present in the MAA, or adequate controls exist to preclude the use of substitute materials to conceal a diversion.

The quantity of SSNM in sidestreams can be reliably measured.

The ultimate product of the operation is measured for element or isotope, or both, as appropriate.

19 NUREG-1280, Revision 2

3.8 Commitments and Acceptance Criteria In its MC&A plan, the licensee should provide definitive commitments that adhere to the regulatory requirements applicable to process monitoring. A finding that the licensees MC&A plan for conducting process monitoring is acceptable and in accordance with 10 CFR 74.53 will be based on, but not limited to, the acceptance criteria listed in Sections 3.1 through 3.7 above.

NUREG-1280, Revision 2 20

4. ITEM MONITORING 4.0 Regulatory Intent The intent of the 10 CFR 74.55 item monitoring requirements is to ensure timely plantwide detection of the loss of items that total 5 FKG or more. To achieve this capability, the licensee is expected to verify the presence and integrity of selected SSNM items on a periodic basis.

The required frequency of tests for missing items is graded according to the relative attractiveness of the material type in the item, the ease with which the item could be diverted without being observed, and the degree of surveillance and containment provided for by the material control and physical security systems. Under 10 CFR 74.55(a), SSNM is not considered as being in item form unless it falls into at least one of the following categories:

(1) It is encapsulated.

(2) It is within a tamper-safe sealed container.

(3) It is stored within a vault.

(4) It is stored in a controlled access area (CAA) that is permanently controlled and which provides protection at least equivalent to tamper-safing.

(5) It is contained in samples each containing less than 0.05 FKG.

If SSNM is not in item form, it must be subjected to the in-process control requirements for bulk material described in 10 CFR 74.53 (except for the types of material specified in the 10 CFR 74.53(a)(2)-(4) exceptions). The longer detection times for losses of items from permanently CAAs take into account the added security afforded by the physical protection measures required for CAAs by 10 CFR Part 73. However, this provision should not be interpreted as authorizing the placement of materials in permanently CAAs other than those already authorized under 10 CFR Part 73.

4.1 Item Loss Detection As required by 10 CFR 74.55(b), each licensee must establish the capability to detect a 5 FKG or greater loss in item form using any statistical test that has a 99 percent power of detection.

Detection is to occur within the following timeframes:

30 calendar days of a Category IA loss and 60 calendar days of a Category IB loss for those items in a vault or permanently CAA isolated from the rest of the MAA (10 CFR 74.55(b)(1))

3 working days of a Category IA loss and 7 calendar days of a Category IB loss for items located elsewhere in the MAA except that a 5 FKG or greater loss of encapsulated SSNM components that are each at least 1 meter in length and in excess of 30 kilograms is to be detected within 30 calendar days (10 CFR 74.55(b)(2))

60 calendar days for the loss of Category IB items of waste stored in a permanently CAA outside of an MAA (10 CFR 74.55(b)(3))

21 NUREG-1280, Revision 2

60 calendar days for samples in a vault or permanently CAA and 30 calendar days for samples elsewhere in the MAA for those samples that each contain less than 0.05 FKG of SSNM (10 CFR 74.55(b)(4))

In accordance with 10 CFR 74.55(a), licensees must ensure that items are uniquely identified and quantitatively measured, with the validity of the measurement independently confirmed.

Additionally, items are to be handled in either of the following ways:

(1) tamper-safed or placed in a vault or permanent CAA that provides protection at least equivalent to tamper-safing (2) sealed such that removal of SSNM would be readily and permanently apparent (e.g.,

encapsulated)

As stated in 10 CFR 74.55(c), items containing scrap in the form of small pieces, cuttings, chips, solutions, or in other forms that result from a manufacturing process, held in containers of 30 gallons or larger, with an SSNM concentration of less than 0.25 grams per liter, are excepted from the 10 CFR 74.55(b) requirements.

4.2 Item Identification and Classification The applicant or licensee should describe the identification system (numeric or alpha numeric) it uses to assign identification to each item. The description should include the features of the system that preclude falsification or that ensure prompt detection of such attempts.

The applicant or licensee should state that the overall MC&A program maintains a record of all SSNM items, regardless of quantity or duration of existence. In addition, the item monitoring component of the MC&A program should provide current knowledge of the location, identity, and quantity of all SSNM contained in all items that are not excepted from the item monitoring requirements (examples of such excepted items are containers of waste designated for burial or incineration).

Each item that is not excepted from the item monitoring requirements should be stored and handled in a manner that enables detection of, and provides protection against, unauthorized or unrecorded removals of SSNM. All items, whether or not they are subject to item monitoring coverage, should have a unique identity. For items subject to the item monitoring requirements, the following means are acceptable for providing unique identity:

a unique alpha-numeric identification on a tamper-indicating device (TID) applied to a container of SSNM

a unique alpha-numeric identification permanently inscribed, embossed, or stamped on the container or item itself

a uniquely prenumbered (or barcoded) label applied to each item having good adhesive qualities such that its removal from an item would preclude its reuse Location designations shown by the MC&A records need not be unique, but location designations should be specific enough so that any item may be located within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Longer times may be acceptable but should be further justified in the MC&A plan. The licensee should NUREG-1280, Revision 2 22

control the MC&A record system in such a manner that the record of an item's existence cannot be destroyed or falsified without a high probability of detection. Each nonexempt item should be stored and handled in a manner that enables detection of, and provides protection against, unauthorized or unrecorded removals of SSNM.

The MC&A plan should provide the basis for classifying items as material Category IB and any proposed exemptions from item monitoring tests or from response actions, including a listing of the item categories involved and the rationale for such exemptions.

The MC&A plan should identify the item locations within the facility classified as inaccessible (relative to item accessibility by a single individual). The plan should also provide the justification for classifying an item location as inaccessible and any proposed exemptions from item monitoring tests. The licensee must be able to detect losses from any location. The concept of accessible location applies to the criteria for establishing and determining the timeliness of the licensees detection capabilities.

Acceptance Criteria:

Each SSNM item is uniquely identified; the SSNM content is quantitatively measured; the validity of the measurement is independently confirmed and ensured through encapsulation, tamper-safing, or storage in a vault or permanently CAA that provides protection at least equivalent to tamper-safing; and a record of the identity, location, date of creation, SSNM content, and utilized measurement method is maintained.

Items are classified as either Category IA or IB at the time they are created so as to fix the frequency of tests for item loss.

All items not included in process monitoring will be included in the sample population stratification for item verification, unless exempted by 10 CFR 74.55(c). The appropriate power of detection and verification frequency will be used, based on category and specific item characteristics.

For items not exempted from the item monitoring program, a record system is maintained to provide knowledge of the current status of such items. For items subject to this commitment, the item control and records system provides the capability to promptly locate and confirm the existence of any specific item or group of items upon demand. The item record system is secured in such a manner that a single individual cannot destroy or falsify the record of an items existence without a high probability of detection.

Each item (unless it is an exempted item) is stored and handled in a manner that enables detection of or provides protection against unauthorized or unrecorded removals of SNM/SSNM; otherwise, knowledge of the SNM/SSNM content is assured by TIDs or maintaining the item as a sealed source (i.e., as encapsulated material).

All incidents involving missing or compromised items or falsified item records are investigated. (A compromised item is one for which there is evidence of tampering or which is found outside its assigned CAA.)

23 NUREG-1280, Revision 2

The contents of a compromised item or an unsealed, unencapsulated item located after it has been missing will be redetermined by measurements (i.e., by NDA or by weighing, sampling, and analysis).

The item identification system possesses attributes that ensure unique item identification, preclude falsification, or at a minimum, make prompt detection of such attempts highly probable. The following factors should be considered in achieving this objective:

The use of TID numbers for unique identification represents an attractive alternative because the same number is used for both TID and item tracking, TID numbers cannot be altered without leaving visible evidence, and TID distribution and usage are controlled.

The use of prenumbered containers that retain the same identification for repeat uses should generally be avoided unless detailed usage records are maintained that reflect the source and disposition of items, including times to fractions of a day.

The use of preprinted labels or blank labels that are numbered as they are used is acceptable provided that unauthorized alteration or replacement of the labels would be readily apparent to a knowledgeable observer.

The methods used to classify items are consistent with those defined in Section 3.2 of this document for process monitoring. The record system identifies whether an item has been classified as Category IA or IB.

4.3 Accessibility and Storage Controls The MC&A plan should describe the personnel access controls, the surveillance procedures, and the records procedures for entrance and exit of personnel to and from vaults and permanently CAAs. If the facilitys physical security plan describes any of the above attributes in sufficient detail, appropriate references may be made.

The MC&A plan should fully describe item storage areas and controls. In particular, the plan should discuss in detail the controls that are used as the basis for ensuring the values of prior measurements, as opposed to remeasuring the item at inventory time, and explain the rationale for accepting prior measurements. Any controls used to ensure the validity of prior measurements should be equivalent to the protection provided by tamper-safing, which is defined by 10 CFR 74.4 as the use of devices on containers or vaults in a manner and at a time that ensures a clear indication of any violation of the integrity of previously made measurements of the SSNM in the container or vault.

Both administrative controls (e.g., custodian assignments and limiting authorized access to storage areas) and physical controls (e.g., locked or alarmed doors) should be identified.

Acceptance Criteria:

Storage that meets the physical security requirements for vaults, documented in 10 CFR Part 73, will meet the requirements of 10 CFR 74.55 for storage of items containing either Category IA or IB material.

NUREG-1280, Revision 2 24

Vaults or permanently CAAs that are subject to 30-day (Category IA) or 60-day (Category IB) test frequencies and isolated from the rest of the MAA are operated with physical and administrative controls over personnel access such that the unauthorized addition and removal of items from the storage area will be either prevented or promptly detected.

Storage that meets the following requirements is acceptable as a CAA, isolated from the rest of the MAA for the purposes of 10 CFR 74.55:

The CAA is constructed or equipped with physical protection capabilities that deter and detect unauthorized access.

Access to the storage area is limited to the minimum number of persons necessary, and records are kept of the persons who enter and leave it.

Records of the items in storage are maintained.

An individual within the storage area is continuously observed by another person, and all additions, removals, and movements of material are verifiable by at least two individuals.

Storage provides protection at least equivalent to tamper-safing if it meets the following conditions:

Access to the vault or CAA is limited to the minimum number of persons necessary, and records are kept of the persons who enter and leave it.

The personnel authorized to enter and operate the vault or CAA are not authorized to remove or handle SSNM beyond the boundaries of the vault or area unless controls are in place that would preclude an individual from surreptitiously removing an item or any portion of a nontamper-safed container.

At all times, a person within a vault or permanently CAA is accompanied by at least one other person, and all activities by any person are verifiable by another. In addition, remote surveillance, such as closed-circuit television, with the capability of seeing all operators at all times is used. The remote surveillance need not be continuous if the occupants cannot determine or predict when they may be under surveillance. However, the time of remote surveillance should, on the average, equal at least 25 percent of the nonsurveillance time, and any interval of nonsurveillance should not exceed 5 minutes.

The SSNM content of nontamper-safed and unencapsulated items is measured and independently confirmed by a second person. In addition, the item is under the continuous surveillance of the two persons from the time of measurement until placed in a vault or CAA.

The SSNM contents of nontamper-safed and unencapsulated items are verified by quantitative measurements when removed from a vault or CAA, except for solid components which can be verified by a weight check. The verification measurement is equivalent to (or better than) the original measurement in terms of measurement uncertainty. The verification measurement and the original result agree within the combined measurement uncertainties. (Note: Random errors will generally be the only 25 NUREG-1280, Revision 2

component of the uncertainty, except in those instances in which a recalibration of the measurement process has taken place.) The verification measurement also detects substitution unless it can be demonstrated that no credible substitute material is present in the vault or CAA.

The response actions documented in the licensees MC&A plan are initiated if an unauthorized vault or CAA penetration is known or suspected to have occurred or if the SSNM content of any container is unexplainable and differs significantly from the recorded value.

4.4 Accounting and Control Procedures The MC&A plan should describe the item accounting and control procedures for items placed in and removed from secure storage. The description should include the item inventory records utilized.

Acceptance Criteria:

Procedures approved by the MC&A organization are utilized and reviewed annually for all secure storage areas.

Each procedure should designate the individual responsible for that secure storage area and describe the method and inventory records used for documenting additions or withdrawals of items from the area.

The operating procedures of item storage areas are documented.

Every change of inventory in the storage area is recorded.

A designated individual is responsible for the operation of each such storage area.

The response actions documented in the MC&A plan will be initiated if one or more items are missing, except when the missing items total less than 50 grams of U-235, U-233, or plutonium.

4.5 Item Measurements The MC&A plan should identify and describe the measurement systems used to quantify the SSNM content of items at the time of their creation. The description should include the confirmatory measurements used to quantitatively verify the SSNM content of nontamper-safed and unencapsulated items placed into or removed from vault storage or a CAA that is equivalent to tamper-safing, including the controls that prevent or detect attempts at substitution.

Acceptance Criteria:

Accountability and confirmatory measurement systems are identified and described in written procedures.

Independent confirmation of the SSNM content of items may be achieved by having a second person do the following, as appropriate:

NUREG-1280, Revision 2 26

Observe the bulk measurement and sampling of the item whose contents are to be determined.

Observe the NDA of the item.

Perform a second quantitative analysis independently that does not destroy the integrity of the item.

Witness and attest to the application of an approved tamper seal.

Accompany the first person and the item to a vault or permanently CAA which will provide storage equivalent to tamper-safing.

4.6 Item Verification The MC&A plan should describe the item verification procedure. The description should include the following:

the inventory sampling method, including the sample size selection equations, the item stratification plan, and the method of selecting the actual items to be verified

the extent to which cyclic, dynamic, or perpetual inventory data and production records, if any, will be used to modify or supplement the sample size, sample selection, or item verification procedures

the minimum loss detection sensitivity and maximum time periods between item verifications for each item stratum of material The annex to the MC&A plan should provide the rationale for the item stratification plan.

Acceptance Criteria:

When incorrect descriptive information for an item, such as item type, TID number, or location, is discovered, the action to be taken will ensure that the item is located and correctly identified and that deficiencies in the system are corrected.

In addition to positive identification and location confirmation, item verification includes encapsulation integrity or container integrity checks, as appropriate; and TID integrity checks, if appropriate. Considerations related to verification include the following:

Electronic or optical methods such as bar code readers may be used in place of manual methods to record item or seal numbers, provided safeguards against falsification are in place.

If the licensee can demonstrate that seal falsification is not credible, TID identification can be done on a random basis, provided an independent means of confirming item identity, such as unique container numbers, is utilized.

TID integrity checks normally encompass visual examination and, for certain TIDs (e.g.,

Type E), physical handling. Proposed shortcuts may be justified on the basis of low 27 NUREG-1280, Revision 2

strategic value, limited accessibility, frequency of checks, and backup checks by production, quality assurance, production control, or others. Such shortcuts should be reviewed for acceptability on a case-by-case basis.

The magnitude of the formal item verification effort can be adjusted to take credit for other means of confirming the presence and identity of sealed items. Process control and accounting, quality control testing, and other production operations routinely generate information that can serve to verify the identity and presence of sealed items.

These sources can be used in lieu of item verification, provided the frequency and loss detection sensitivity requirements of the item verification procedure are met and the use of the data for this purpose is not predictable. Examples of specific sources of such data include the following:

records that an item was created (tamper-safing procedure applied) or transferred within the required time span, as defined in 10 CFR 74.55(b)

records that an item was inspected, tested, analyzed, altered, or subjected to any other production or quality assurance operation within the required time span

production schedules showing that a particular item was cued up for production planning purposes and the cueing process involved a check of identity and location Any tamper-safe or encapsulated items that have been verified by such a procedure within the time span required for that category of material can be exempted from formal item verification, provided (i.e., only if) the prior handling or inspection activities, as indicated above, for which credit is being taken are unknown and unpredictable to a potential diverter or, if known or predictable, the items are scheduled to be physically accounted for by at least two individuals during sequential processing or inspection steps to occur during the next required test time span. To exempt such items from formal item verification, the items are simply dropped from the list of n items selected from the inventory list, where n is the sample size required for verification.

The frequency of item verification tests is consistent with the maximum elapsed time intervals between the occurrence of a loss and its detection, as specified in 10 CFR 74.55(b).

A physical inventory can serve in lieu of an item monitoring test, provided all items represented by an item test are subject to verification as part of the physical inventory process and the following applies:

By using the physical inventory in lieu of item monitoring tests, there is no extension in the maximum time interval between item monitoring tests for 3-day and 7-day tests.

For 30-day and 60-day item tests, the physical inventory is completed within 33 calendar days and 66 calendar days, respectively, of the previous item test.

NUREG-1280, Revision 2 28

4.7 Sample Items The MC&A plan should describe the technique used to establish the sample population and demonstrate how the presence of selected items will be verified. Additionally, the plan should describe how samples containing greater than 0.05 FKG will be monitored.

Acceptance Criteria:

Samples containing in excess of 0.05 FKG can be considered a sidestream in a bulk test performed in the originating process unit, provided the samples are returned to process within 7 days. SSNM removals from such samples should be documented and the area records corrected accordingly.

Small items, such as element sections and samples, can be amassed in a tamper-safed container to alleviate excessive item verification. Conversely, items greater than 0.05 FKG should not be consolidated within a larger tamper-safe container for the primary purpose of reducing item verification effort.

The means of determining the number of items to be verified per class or stratum is specified. For example, the following equation is an acceptable formula for calculating the sample size required from an inventory or any subset of group of size N:

n = N (1 - 1/d) or n = N (1 - x/G),

where d is the minimum number of altered or missing items (defects) that could total a goal quantity (i.e., 5 FKG) and 1 - is the desired probability of obtaining at least one defect in the sample of n items where there are d defects (d is greater than or equal to one) in the population of N items. The number d is a function of the amount of SSNM per item. If the SSNM content varies over the population of items, the largest value must be used to calculate d to ensure that n is large enough to guarantee that the power of detection is at least 99 percent. This results in a conservative value of n (i.e., n is larger than necessary). If a smaller item content were chosen, such as the average value, an informed adversary could selectively divert only large items and thereby reduce the risk of detection. The 1/d exponent is equivalent to x/G (as shown in the alternative equation), where x is the maximum formula grams within a single item (for the stratum being tested) and G is the goal quantity.

Additional points to consider in this regard include the following:

In those cases in which the SSNM content per item is very small, the required sample size is a small fraction of the inventory. The result may even be that, in some instances, the calculated sample size will be less than one. However, such items cannot be ignored. An acceptable approach would be to periodically verify one randomly selected item from the class at times chosen by random selection, such as by a random number generator.

In some instances, an entire stratum may contain less than 5 FKG. Nevertheless, such strata should be sampled like any other.

29 NUREG-1280, Revision 2

If the number of items, N, in each strata remains reasonably constant (such as within 95 to 105 percent of an historical average N), it is not necessary to recalculate the sample size to be checked each time a test is run.

Neither the specific items to be verified in any particular instance nor items that will not be verified shall be predictable.

Every item in a stratum has an equal probability of being selected for verification.

Items of Category IA type material may be treated as Category IB items and subject to the lower frequency item loss test if any of the following conditions apply:

(1) The item is rigid and its dimensions are large enough to preclude hiding the item on an individual (i.e., at least 130 centimeters in one dimension, greater than 65 centimeters in each of two dimensions, or greater than 20 centimeters in each of three dimensions).

(2) The weight of an item is so large that one person cannot carry the item inconspicuously. The minimum weight to meet this criterion is 50 kilograms.

(3) The quantity of SSNM in the item is so small that a large number of diversions are needed to accumulate 5 FKG. The maximum quantity to meet this criterion is 50 formula grams per item.

The first two exceptions (for item test frequency) given above do not apply if the item can be opened or disassembled and part or all of the SSNM removed without a high probability of being observed or detected.

The presence of very large (higher tier) components, such as fuel blocks, preassemblies, and subassemblies, stored outside of a CAA must be verified in accordance with a sampling plan that provides the capability to detect a 5 FKG loss within 30 calendar days. One month is deemed to be acceptable on the basis of the large physical size and weight of these items and the restrictions on removing them from the MAA.

The number of items to be verified is sufficient to provide a power of detection of at least 99 percent for a loss of items totaling 5 FKG or more from each stratum or inventory subdivision (i.e., a grouping into similar types and amounts of SSNM). If all strata in a facility are sampled for verification with at least a 99 percent power of detecting a loss of items containing 5 FKG, that criterion will also be achieved for a loss of items containing 5 FKG or more plantwide.

The item inventory is stratified or subdivided in a manner that ensures at least a 99 percent power of detection while minimizing the number of items to be verified. It is advantageous to subdivide the inventory into classes or strata having approximately uniform quantities of SSNM per item. A moderate range of SSNM contents within a class, such as plus or minus 10 to 20 percent is tolerable. However, regardless of the variability of SSNM content per item, the maximum item content (for the stratum in question) must be used when determining the minimum number of items that could constitute a 5 FKG loss (and hence determine the number of items that make up the sample size, n). Typical classes for NUREG-1280, Revision 2 30

sampling are fuel elements, containers of scrap, containers of feed material, and containers of waste.

Encapsulated items containing less than 100 grams of SSNM whose presence has been verified during the prior 2 months as part of a statistical sample or handling during routine production need not be reverified for physical inventory. Items whose presence has not been verified in the same time interval should be located by two-person inventory teams.

Whenever an item monitoring test results in an MC&A alarm, a 5 FKG (or greater) loss should be assumed until shown otherwise either by additional (i.e., extra) item monitoring tests or by a physical inventory. Section 5.0 of this document defines an item monitoring alarm. When verifying n randomly selected items for an item test, if one or more defective or missing items are encountered, an additional group of randomly selected items from the same stratum should be tested. In this additional test, the sample size should be twice as large (i.e., equal to 2n) and should not include any defective items from the initial test. Other strata scheduled for testing on the same date as the stratum giving rise to the alarm should also be subjected to additional testing (by using a sample size of 2n instead of the normal size of n items). If the quantity of missing SSNM associated with the initial alarm is substantially less than 5 FKG and no further alarms result from the additional tests, strong evidence will have been obtained that a 5 FKG loss did not occur. If, on the other hand, one or more additional alarms are encountered, a complete physical inventory of all SSNM items should be immediately initiated.

4.8 Commitments and Acceptance Criteria In its MC&A plan, the licensee should provide definitive commitments that adhere to the regulatory requirements applicable to item monitoring. A finding that the licensees MC&A plan for conducting item monitoring is acceptable and in accordance with 10 CFR 74.55 will be based on, but not limited to, the acceptance criteria listed in Sections 4.2 through 4.7 above.

31 NUREG-1280, Revision 2

5. ALARM RESOLUTION 5.0 Regulatory Intent The intent of the 10 CFR 74.57 alarm resolution requirements is that a licensee resolve the nature and cause of any MC&A alarm within an approved time period, or if not resolved within the approved time period, the licensee must notify the NRC that the alarm in question remained unresolved beyond the time period specified for its resolution. The regulations in 10 CFR 74.57(c) require that such notification occur within the 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months following the expiration of the resolution period, except when a holiday or weekend intervenes, in which case the notification must occur on the next scheduled workday. If a loss has occurred, 10 CFR 74.57(d) requires the licensee to determine the amount of SSNM lost and, as appropriate, return out-of-place SSNM to an appropriate place, update and correct involved records, and modify the MC&A program to prevent similar occurrences in the future. Additionally, if a process monitoring abrupt loss detection estimate exceeds 5 FKG of SSNM, 10 CFR 74.57(f) requires that material processing operations related to the alarm be suspended until completion of planned resolution activities, unless the suspension of operations will negatively affect the ability to resolve the alarm. However, operations of continuous processes may continue for a 24-hour period while checks are made for mistakes.

The intent of these requirements is that the licensees alarm resolution system must be able to respond promptly to alarms indicating a potential loss of SSNM and determine whether the alarm was caused by an actual loss or by a system error. The alarm resolution program also should be able to identify the type of system error or innocent cause so that remedial action can be taken. The alarm response should be timely to ensure that alarms are investigated and resolved promptly while memories of events leading up to the alarm are still fresh, materials are still available for remeasurement, and fewer changes of process conditions, inventories, in-process holdup, and item locations will have occurred. Prompt resolution will facilitate recovery of lost or stolen material.

For process monitoring, an MC&A alarm is defined as any material control test result that exceeds a defined alarm threshold value such as that given in Section 3.2 of this document.

For item monitoring, an MC&A alarm exists whenever an item monitoring test results in (1) one or more item discrepancies (i.e., items not in their designated locations) which are not resolved within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for Category IA items and 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for Category IB items or (2) one or more items being found defective (i.e., with some or all of their SSNM contents missing).

5.1 Alarm Resolution Procedures The MC&A plan should describe the alarm resolution procedures that will be applied to the various types of alarms and unit processes. The procedures should take into account credible innocent occurrences that may cause alarms indicating a potential SSNM loss. The resolution procedure descriptions may be abbreviated.

The plan should describe the specific procedures to be employed in response to alarms indicating a potential loss in excess of 5 FKG. The description should identify those operations that will be shut down or alternative measures that will be employed in lieu of shutdown to facilitate an investigation.

33 NUREG-1280, Revision 2

The annex to the MC&A plan should provide the following:

a listing of identified credible causes of possible alarms by unit process and details of the resolution procedures by which specific causes could be identified

a statistical estimate of the expected number of irresolvable alarms per inventory period with loss estimates greater than 5 FKG and a description of the estimation method

the justification for not shutting down certain process operations during an investigation Acceptance Criteria:

Resolution procedures are described for alarms that indicate a potential abrupt loss of 5 FKG of SSNM in bulk or item form. The procedures should take into account the expected differences in loss mechanisms and necessary differences in response approaches for in-process materials, items, different material types, and different types of unit operations. The differences and variations in resolution procedures are explained. Examples of different types of unit processes include the following:

a bulk storage unit a batch process with cleanout between batches and very small amounts of in-process holdup a continuous process with continuous flow between the unit process and the succeeding process a process with large holdup inventories that cannot be measured directly without cleanout

The alarm resolution procedures provide a systematic and logical sequence of steps for determining the cause or causes of an alarm. The following are examples of a systematic approach:

Check the data and calculations for clerical, transcription, or computational errors.

Trace the data to the primary sources (operator logbooks or production records and analytical reports) to check for agreement.

Compare the source data, such as item and batch sizes and numbers, inventory quantities, and flow rates, to historical values to detect anomalies that may indicate an error of identification or measurement.

Review downstream material balances for potential offsetting gains.

Localize the source of the alarm as nearly as possible with regard to time, place, material type, and individuals potentially involved.

Report a potential SSNM loss to security who then should implement intensified search and surveillance procedures.

NUREG-1280, Revision 2 34

Stop further processing in the unit process, if feasible, to retain items and inventory for remeasurement.

Remeasure all items, inventories, batches, and samples from the unit process that are still available.

5.2 Decision Rules The MC&A plan should describe the types of information and data developed during response that will provide sufficient evidence for assigning a specific cause to an alarm. This information and data should form the basis for development of the decision rules to be included in this section. These rules should take into account every identified potential innocent cause that may result in a bulk or item loss alarm.

Acceptance Criteria:

Each type of alarm response is identified with the corresponding types of material or unit processes, or both, and the credible innocent causes of the alarm. Examples of innocent causes include the following:

A clerical or computational error is identified that clearly explains the alarm.

A missing item is located.

A claim is made that an item was added to the process, although no record of the transfer exists, if substantiated through an actual yield versus predicted yield comparison.

A remeasurement confirms that an error or errors in the original data caused the alarm.

A random fluctuation in the measurement process or a process variability is identified through sufficient measurements or additional processing.

The decision rules for a conclusion that a particular cause is applicable and that the alarm is resolved are described. The annex to the MC&A plan includes backup information about the rationale and justifications. A decision rule should generally provide an objective basis for deciding whether or not the data and information acquired up to that point in the alarm assessment supports the hypothesis that the alarm resulted from an innocent cause. Each decision rule should be based on the identification of a specific cause or a source of incorrect data that contributed to the alarm level of the loss estimator, except that the rule may verify with high probability that no loss has occurred without having identified all contributing causes of the alarm. Examples of acceptable decision rules include the following:

a false alarm resulting from a mistake a correctable mistake identified and supported by direct evidence, such as comparison to data collection sheets, reading a column level, or measuring a sample 35 NUREG-1280, Revision 2

a correctable mistake or recordkeeping error identified and supported by at least two sources of independent indirect evidence, such as consistency of process values, historical ranges, a loss followed by a gain in the following control unit such that an error in the transfer was identified as greater than measurement error, or an interview with operators who observed an unusual process condition a hypothesized uncorrectable mistake (or combination of mistakes) or procedural error which is supported by a difference of opposite sign and comparable magnitude in a related loss indicator and two sources of indirect evidence, such as process yield, balance around non-SSNM materials, process consistency, or measurement control data indicating a short-term failure a false alarm caused by stochastic fluctuations in the detection system an error resulting from measurement variability identified and supported by remeasuring inventories or transfers where the differences between the original and remeasurement values exceed the 2-sigma confidence interval used to monitor and control measurement performance an error resulting from variabilities in the process that is confirmed by processing the material and verifying the discrepancy by recovering the material an error resulting from inadequate modeling of in-process inventory where continued processing results in a stable cumulative loss indicator a bias identified by an independent technique that results from differences in material types being processed

A systematic investigation into the nature and cause of each MC&A alarm will continue until the cause has been established or a determination has been made that the alarm is not resolvable with the information currently available.

Remeasurements of the SSNM to verify the content or composition of items or bulk material associated with an alarm are made to a standard deviation of the quantity estimate that is comparable to that of the book value, and the hypothesis that the difference between the initial and remeasurement value is zero is tested at the 0.05 level of significance.

After an alarm has been resolved, the planned corrective action includes MC&A program revisions, if appropriate, that provide reasonable assurance that future alarms of that nature (i.e., having the same or a similar cause) will not occur. An example of a case in which an MC&A program revision would be appropriate would be revision of a procedure or computer software that contains an error that caused an alarm.

The operations that will be shut down to resolve alarms indicating a possible loss in excess of 5 FKG are identified or alternatives to shutdown are provided. (Refer to Section 3.2 of this document for establishing alarm threshold values indicative of a possible 5 FKG loss.)

Examples of acceptable alternatives might include the following:

shutting down of only downstream operations to retain products that may require remeasurement NUREG-1280, Revision 2 36

discontinuing the processing of certain sidestreams to retain scrap or recyclable intermediates that may require remeasurement diverting scrap, waste, or product from the alarming unit to auxiliary vessels or to a buffer storage area to retain the products for remeasurement collecting additional samples for remeasurement of materials that would become unavailable if operations were not suspended in the area under investigation

When a detection alarm indicates a potential loss in excess of 5 FKG, batch processing operations are suspended immediately after the alarm or upon completion of the batch in process, and the suspension is continued until completion of the planned resolution activities.

When a process is not shut down, equally effective alternative measures are taken when an alarm occurs to protect information and material that would be needed during the alarm investigation. Procedures document alternative measures by unit process.

The key consideration in employing alternatives to shutdown is that the licensee can show that no data or information needed for response will be lost if the alternative is used.

The conditions for restart are specified. Fundamental to any decision to restart is whether the alarm has been resolved (i.e., an assignable cause has been identified), the loss is real but remedial, recovery action is underway, or the alarm has not been resolved. Before restart, the licensee should verify that all possible data associated with the process material have been acquired, and no information will be jeopardized by resuming operations.

The quality of the licensees loss resolution capability is such that the combination of the material control test and resolution decisions permit alarms remaining unresolved after investigation to be good indicators of material loss. To achieve this objective, the licensees planning data should demonstrate that the expected number of unresolved alarms in excess of 5 FKG is less than 0.10 abrupt loss alarms per inventory period.

The following additional information is pertinent to this point:

The only false alarms that should be predicted are those associated with normal process or measurement system statistical variation. Mistakes in transcription of data or process upsets do not need to be predicted because the response procedures should be designed to correctly resolve alarms stemming from those types of events. False alarms caused by statistical fluctuations are expected to be more difficult to resolve.

37 NUREG-1280, Revision 2

One approach is to claim no credit for resolution of statistical alarms. Then the incremental expected number of alarms with discrepancies greater than 5 FKG can be calculated for a single test from the formula:

N = 1 - F (5/)

where

= the predicted standard deviation of the detection test in FKG F(x) = the predicted statistical distribution of the test statistic normalized by This increment should then be multiplied by the expected number of times the test will be performed in an inventory period and similar calculations then added up over all tests in the facility. That sum must be less than 0.10 (i.e., the number of such alarms would be less than one in 60 months, assuming a physical inventory frequency of every 6 months).

If the distribution function cannot be assumed to be normal (Gaussian) and the true distribution cannot be adequately predicted, the Camp-Meidell inequality may be applied if it is reasonable to expect that the true distribution will be symmetric and unimodal (see Shewhart (1931),

pages 176-177; Eisenhart, Hastay, and Wallis (1947), page 49). The Camp-Meidell inequality permits a bound on N to be calculated from the following formula:

N (8/9)(/10)2 where is expressed in units of FKG. However, this will typically be useful only if is less than 0.1 FKG. A more useful approach would be to estimate the maximum range for the test statistic based on a physical model of the process and measurement systems under the hypothesis of no material diversion. If this value is less than 5 FKG, set N = 0.

Evaluation is more complicated if the licensee claims that response procedures will permit resolution of some fraction of the statistical false alarms. The plan should summarize such procedures. One evaluation approach is to make additional measurements of inputs, products, sidestreams, and holdups to complete measured material balances when loss detectors are based on average expected yields. For additional measurement of input quantities, samples should be taken and retained. This would permit laboratory analyses to be made which are more reliable than NDA. The procedures also could utilize data resulting from processing the same batch through the next process step, data resulting from processing another batch through the same process step, and tests that eliminate intermediate measurement points by combining several process steps. In any of these, estimating the fraction of N that would be expected to remain unresolved will likely involve detailed modeling of the response capability.

A Monte Carlo simulation method can be used to model the alarm response procedures and predict the resolution success rate. For a single material control test, refer to Tanner (1981).

For an entire plant, refer to Reardon, Heaberlin, and Eggers (1982). Eggers (1982) also provides detailed information.

Alternatively, if the licensee has a performance history of responses to and assessment of alarms, this may be cited in lieu of the simulation of a proposed response program, if the experience demonstrates a capability to meet the commitment goals for resolving false alarms.

NUREG-1280, Revision 2 38

The combined quality of the material control test and loss resolution decisions should permit alarms remaining unresolved after completion of the licensees investigative activities to be good indicators of theft or diversion. This will be evaluated in two ways:

(1) During the NRC staff review of a licensees planned detection and alarm resolution capabilities, attention will be directed to the ability to resolve false abrupt loss alarms.

For the alarm resolution capability to be acceptable, it should appear able to correctly identify all errors caused by leaks, process upsets, or human mistakes that are large enough to cause an alarm. With respect to other false alarms, in particular those alarms that are expected to occur because of the statistical nature of the processes and measurement systems, the alarm resolution capability need not be 100 percent effective.

However, for it to be acceptable, it must be effective enough to satisfactorily limit the statistically expected rate of irresolvable abrupt loss alarms. (The expected rate can be thought of as a weighted average of all possible rates, where the weights are the likelihoods of occurrence of those rates.) A satisfactory limit is an expected rate of irresolvable large abrupt loss alarms less than one per 10 years per plant. A large false alarm is one whose loss estimate exceeds 5 FKG. Because the licensee should be able to resolve all such alarms other than those of a statistical nature, calculation of the expected rate of irresolvable large abrupt loss false alarms needs only to consider false alarms of a statistical nature.

(2) After the phase-in period is over and all elements of the licensees alarm resolution commitments have been implemented, the NRC staff could determine that the alarm resolution performance is acceptable when (a) there have been no situations over the past year in which subsequent audits or investigations determined that a large abrupt loss alarm was innocently caused but not resolved within the licensees time commitments and (b) there are no unresolved large abrupt loss alarms remaining after the bimonthly inventories and annual audit have been completed.

5.3 Response Time The MC&A plan should indicate response times that will be allotted to resolve each alarm type.

If alarms involving certain material types or alarms from certain processes need appreciably longer response times than those estimated in the acceptance criteria section below, the plan should justify the indicated times.

Acceptance Criteria:

The alarm resolution time commitments ensure a reasonably prompt alarm response. The check of the loss indicator data for clerical mistakes and data errors should normally be completed within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for any abrupt loss alarm. The maximum time for completion of the resolution procedure for alarms indicating a possible abrupt loss of items that were tamper-safed, encapsulated, or retained in a vault that provided protection equivalent to tamper-safing should normally not exceed 3 calendar days. The maximum time for completion of the resolution procedure for alarms indicating a possible abrupt loss of SSNM in any form or container that was not tamper-safed, encapsulated, or stored in a vault equivalent to tamper-safing should not normally exceed 3 working days. However, if longer time periods are needed for certain unit processes or types of necessary response activities, the licensee should explain and justify the proposed times in its submitted MC&A plan.

39 NUREG-1280, Revision 2

When a tamper-safed or encapsulated item has been compromised, the licensee should undertake a remeasurement immediately. The maximum time after the alarm for completing a remeasurement to confirm the contents should normally not exceed 2 working days. The licensee should explain and justify any proposed extension of that time. An example of when additional time might be necessary would be if isotopic measurements were to be performed offsite.

When a vault or CAA providing protection equivalent to tamper-safing has been entered without authorization, when the prescribed vault protection has been compromised, or when other indications of loss of control are discovered, the entire vault contents must be accounted for within 3 calendar days by a piece count and attribute test of all items not tamper-safed or encapsulated, such as by weighing or NDA. The licensee should initiate remeasurement of all items in the vault or CAA not tamper-safed or encapsulated within 1 working day. If a longer period is proposed, the licensee should provide justification.

5.4 Item Discrepancies The MC&A plan should describe actions that the licensee will take in response to the following item discrepancies:

An item has apparently been destroyed without being recorded.

The integrity of a tamper-safed or encapsulated item has been compromised.

Unauthorized entry or other violation of control of a vault or a permanently CAA has occurred.

A statistically significant difference between the measured input and output value of an nontamper-safed item placed in a vault or CAA storage has been detected, and such difference exceeds 25 grams SSNM.

The actions in response to these discrepancies should include decision rules which will be the basis of acceptable resolution.

Acceptance Criteria:

An item loss assessment procedure has been included that details a logical sequence of actions to resolve an apparent loss. A typical assessment sequence (not necessarily in the order listed) might be the following:

Determine that the records are apparently correct by tracing the item identification and location information to its source data in inventory and production records.

Search other production and storage areas to determine whether the item was transferred without supporting documentation.

Identify all persons involved in the creation and movement of the item or items and question them for possible ways in which the item might have been misplaced or record errors made.

NUREG-1280, Revision 2 40

Extend the search to other locations, particularly those suggested by the persons involved.

Check for possible errors in the item records by evaluating the bulk material balances in the adjacent processing units.

Reinventory all items of that type in storage locations routinely used for such items.

Extend the inventory search to items of similar size and appearance.

A description of the licensees proposed course of action in response to a broken TID should include the following:

Place the item under surveillance immediately or in secured storage and remeasure it as soon as practicable (time limits specified) to determine whether SSNM is missing.

Perform blending, mixing, or splitting operations, if appropriate, to ensure that any samples taken for remeasurement are representative.

Compare (test) the difference between the original and confirmation measurement for statistical significance with a probability of no more than 5 percent of concluding that no SSNM is missing when in fact a loss has occurred. The quality of the remeasurement should be at least equivalent to the original measurement.

If the cause of the alarm is claimed to be the destruction of an item, such as by processing it to another form, without the act having been recorded, confirmatory evidence should be developed to support the conclusion. The plan should describe the types of confirmatory evidence that are expected to be applicable. The evidence will be acceptable if it is relevant, concrete, independent, and objective. Examples of such evidence include the following:

The measured density of a suspect solution is consistent with the predicted density, assuming the contents of the missing container had been added to the process.

The actual yield from a suspect unit process is consistent with the predicted yield from that process if it contained the contents of the missing item.

Two individuals can attest to the fact that the container was added to the process.

If an item is discovered as not being in its recorded location, such an event should be designated as an item discrepancy (with the time of such discovery being documented). If an item discrepancy is not resolved within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for Category IA items and within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for Category IB items, an alarm is declared. The licensee normally declares such an item as missing if not found or accounted for within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for Category IA items and 3 working days for all other items (relative to the time at which the item discrepancy was discovered).

A search for a misplaced item that was not tamper-safed or encapsulated may not be terminated without NRC permission until the item is located or evidence of its destruction is obtained. A claim that an item was destroyed without recording the fact may be accepted if independent confirmatory evidence of destruction is obtained. Searches for declared missing items may not be interrupted by idle time, such as weekends and holidays.

41 NUREG-1280, Revision 2

If an item is discovered as being compromised and more than 25 grams of SSNM are missing from the item, an MC&A alarm should be immediately declared.

If the integrity of an item has been compromised (i.e., the container seal or the encapsulation has been altered or broken), an appropriate response procedure is promptly initiated to determine whether any SSNM is missing.

Compromised items are placed under surveillance or in secure storage and are remeasured within specified time periods. The quality of the remeasurement is at least equal to that of the original measurement.

Whenever an item monitoring test results in an MC&A alarm, a 5 FKG (or greater) loss should be assumed until shown otherwise either by additional (i.e., extra) item monitoring tests or by a physical inventory. If, when verifying n randomly selected items for an item test, one or more defects are encountered and the quantity of missing SSNM associated with the compromised or missing items is substantially less than 5 FKG, an immediate additional group of randomly selected items from the same stratum should be tested. In this additional test, the sample size should be twice as large (i.e., equal to 2n) and should not include any of the defective items from the initial test. If no alarm results upon performing the additional 2n test, strong evidence will have been obtained that a 5 FKG loss from the stratum in question did not occur. Depending on the circumstances, additional item tests on other strata may be necessary to resolve an item alarm. If the quantity of missing SSNM associated with the initial alarm is 4.000 FKG or more (i.e., not substantially less than 5 FKG), the licensee should initiate a physical inventory of all items on hand.

5.5 Alarm Reporting As required by 10 CFR 74.57(c), a licensee must notify the NRC Operations Center of any MC&A alarm that remains unresolved beyond the time period specified for its resolution.

Notification is to occur within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months following the deadline for resolution or by the next working day when a weekend or holidays intervene. For alarm estimates that exceed 5 FKG, the notification that an MC&A alarm resolution procedure has been initiated is to occur within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of the alarm occurrence.

The intent of these requirements is that the NRC be made aware of potential SSNM losses in a timely manner so that appropriate actions can be initiated.

The MC&A plan should indicate how the responsibility for reporting unresolved alarms will be assigned in the organization.

The plan should also discuss the types of information that will be provided to the NRC and the schedule for updating the status of the unresolved alarms to the NRC.

Acceptance Criteria:

The appropriate NRC office will be provided with current, technically defensible information on the status of alarm resolution activities based on a mutually agreed upon schedule.

NUREG-1280, Revision 2 42

The responsibility for reporting unresolved alarms is assigned at a sufficiently high level of responsibility within the licensees organization to ensure that decisions on the need for reporting will be timely and unquestioned.

With regard to recurring losses, a significant loss trend is reported to the NRC within 1 week of its discovery, and the progress of the resulting investigation is reported monthly.

The information to be reported includes the magnitude of the discrepancy indicated by the alarm, the investigation procedure, the status of the investigation, the status of the facility, the planned remedial measures, and the status of the physical security system during the period.

The remedial measures include assignment of responsibility for the investigation to a technically competent individual, rechecking the response of the measurement system with certified standards, outlining a schedule of recalibrations of the key measurement systems if appropriate, in situ or cleanout measurements of holdup, and statistical evaluation of the material accounting data.

5.6 Alleged Thefts The regulations in 10 CFR 74.57(e) require that a licensee establish and maintain ability to respond rapidly to alleged thefts.

Alleged thefts are alarms that originate external to the MC&A program. Among these are any statements that diversion of SSNM has occurred communicated directly or indirectly, for example, to facility staff, the NRC, the Federal Bureau of Investigation, or the police. The statements may or may not include details such as the plant area from which SSNM was allegedly taken, which items were taken, a description of the containers or material allegedly taken, or other information in support of the allegation. This covers threats allegedly from within as well as from outside the facility. An external alarm may include other indications, such as an external assault that penetrated an MAA or the discovery that an MAA door had been opened from the inside.

The intent of this requirement is to have an established capability to respond rapidly to alarms occurring external to the MC&A program. The response capability should provide the information necessary to rapidly assess the validity of an alleged theft.

The MC&A plan should describe the item control system that will be maintained to readily determine the identity, quantity, and location of SSNM in item form. The description should include the forms, records, and document flowpaths. For cases in which records are not centralized, the plan should describe the means of record verification by MC&A personnel and the responsibility for maintenance and disposition.

The plan should also describe the emergency physical inventory procedure, including an indication of the status that each unit operation should be in to be inventoried and the status of each unit operation during its inventory.

The annex to the MC&A should provide estimates of the times needed to perform and reconcile the inventory and to determine the associated projected variance.

43 NUREG-1280, Revision 2

The plan should describe the protective measures that the licensee will implement to prevent loss, misplacement, or accidental destruction of inventory and item location records.

Acceptance Criteria:

From the description of the SSNM item record system, it is evident that the records of the identity and location of every item can be updated with sufficient speed to support the commitments that any randomly selected item within a vault can be located within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , and any item outside a vault can be located within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The capability also exists to locate all items within a vault within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and all items outside a vault or permanently CAA within 1 week.

Provisions are included for maintaining the availability of forms, tags, trained personnel, inventory listing, and other items that may be needed to initiate a plantwide physical inventory within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The emergency inventory capability is designed to help answer the following questions:

Can it be determined conclusively that SSNM is or is not missing from the facility?

What quantity is missing?

What material type is it? For example, what is its isotopic composition, its chemical form, and its physical size?

Over what time period could it have been diverted?

Which plant employees or other individuals might have had access to it during that time?

Which plant employees may be able to provide information useful for its recovery?

Appropriate safeguards are implemented to prevent loss, misplacement, or accidental destruction of the inventory and item location records.

The data collecting, recording, and auditing procedures provide reasonable protection against errors in the records.

5.7 Commitments and Acceptance Criteria In its MC&A plan, the licensee should provide definitive commitments that adhere to the regulatory requirements applicable to alarm resolution. A finding that the licensees MC&A plan for conducting alarm resolution activities is acceptable and in accordance with 10 CFR 74.57 will be based on, but not limited to, the acceptance criteria listed in Sections 5.1 through 5.6 above.

NUREG-1280, Revision 2 44

6. MANAGEMENT STRUCTURE AND PERSONNEL QUALIFICATION AND TRAINING 6.0 Regulatory Intent The intent of the 10 CFR 74.59(b) and 10 CFR 74.59(c) management structure and personnel qualification and training requirements is to ensure that licensees implement a management structure that permits effective functioning of the MC&A program and to ensure that the plant management structure will not adversely affect MC&A program performance. Documentation, review, and approval of critical MC&A procedures, as well as the assignment of the key functions to specific positions, eliminate ambiguities about what is to be done by whom. The management structure is meant to separate key MC&A functions from each other, thereby incorporating checks and balances that increase MC&A program reliability and make the theft or diversion of SNM/SSNM less likely. It is also meant to free MC&A management from conflicts of interest with other major functions such as production.

6.1 Corporate Organization The MC&A plan should describe the corporate structure and identify all corporate organization positions that have responsibilities related to MC&A at the licensees site. The plan should also describe corporate-level functions, responsibilities, and authorities for MC&A program oversight and assessments. At least one corporate official should have responsibilities pertaining to the control and accounting of all SNM/SSNM possessed by the licensee.

6.2 Plant or Site Organization The MC&A plan should describe the sites management structure with an emphasis on MC&A.

The plan should describe the site management structure to the extent that it can be clearly shown that the MC&A organization is independent of potentially conflicting responsibilities. This description should also indicate how responsibilities are assigned for the following functions:

overall MC&A program

SNM/SSNM custodianship

receiving and shipping of SNM/SSNM

analytical laboratories

bulk and NDA measurements

sampling operations

measurement control program

physical inventories

onsite SNM/SSNM handling operations 45 NUREG-1280, Revision 2

process monitoring

item monitoring

MC&A alarm resolution The plan should briefly describe each site-level position outside of the MC&A organization that has responsibilities relating to MC&A activities (e.g., sampling, mass measurements, analytical measurements, and measurement control). For each position, the plan should clearly describe the functions, responsibilities, and authorities.

6.3 Material Control and Accounting Organization The MC&A plan should provide an organizational chart and position-by-position description of the entire MC&A organization. An individual should be designated as the overall manager of the MC&A program, and the MC&A plan should demonstrate the independence of action and objectivity of decisionmaking of the MC&A manager. The individual should be in a position to recommend and initiate timely action for the control and accounting of SNM/SSNM, including delaying production if necessary, and should not be enmeshed in a hierarchical framework that could inhibit or compromise independent action. Two options for meeting the goal of organizational independence are for the MC&A manager to (1) report directly to the plant or site manager or (2) report to an individual who reports directly to the plant or site manager and who has no production responsibilities.

6.3.1 Responsibilities and Authority The plan should provide a description that clearly indicates the responsibilities and authority of each supervisor and manager for the various functions within the MC&A organization. The description should indicate how the activities of one functional unit or individual serve as a control over, or checks on, the activities of other units or individuals. The MC&A plan should explain how coordination is achieved and maintained between the MC&A organization and other plant organizational groups that perform MC&A-related activities. A definitive statement should be made specifying how the MC&A manager ensures appropriate review and approval for all written procedures pertaining to MC&A-related activities (and any future revisions thereto) that are issued both within and outside of the MC&A organization. In addition to the MC&A manager function, the plan should address the following functions at a minimum:

nuclear material accounting

measurement control program

process monitoring

item monitoring

alarm resolution

statistical applications NUREG-1280, Revision 2 46

Whenever more than one key MC&A function is assigned to the same person, the MC&A plan should clearly describe the checks and balances that preclude the following:

performance of accounting or record control functions by individuals who also generate source data

assignment of sole authority to any individual to overcheck, evaluate, or audit information for which he or she is responsible Examples of appropriate checks and balances include the following:

review of measurement data and calculations by another individual

maintenance of a duplicate copy of all source data and transfer forms under controls separate from the accounting function

performance of independent audits

separation of computer program maintenance from the program user function The management structure provides for assignment of a responsibility for SNM/SSNM undergoing processing and in storage to a single individual or group. Duties include but are not limited to the following:

maintaining appropriate inventory control over SNM/SSNM in their assigned area

authorizing and recording all movements of SNM/SSNM into and out of their assigned area

maintaining appropriate local MC&A records or ensuring that other records, such as production records, contain necessary MC&A information

participating in physical inventories as required

assisting in internal or external alarm resolution activities as required

ensuring that, when SNM/SSNM is processed in bulk form, only authorized persons have hands-on access to the material

notifying proper authorities of irregularities in material and MC&A data handling For some individuals in management or supervisory positions, modifications to procedures, such as restricted access without escort to certain areas, may be necessary to provide sufficient assurance that the program cannot be compromised.

6.3.2 Material Control and Accounting Procedures The MC&A plan should describe critical MC&A procedures, which are those written procedures that, if not performed correctly, could result in a failure to achieve one or more of the performance objectives of 10 CFR 74.3 and 10 CFR 74.51(a) and the program capabilities of 47 NUREG-1280, Revision 2

10 CFR 74.51(c). The MC&A plan should describe MC&A procedures developed to perform MC&A tasks, the features of these procedures that contribute to minimizing human errors in MC&A data, and the control methods the licensee uses to ensure that current procedures are in place and are being used appropriately. Configuration control is a method by which the current official copies of procedures are maintained and controlled. Procedures that may be used in configuration control include sign offs by a responsible person on the released version, numbering and dating versions, and periodic checks of the individual procedures under the control of the procedure custodian or holder to make sure that current copies are being used.

Control methods may include maintenance of a list of procedures, periodic review by operators and during audits, use of sign-off cover sheets, and validation during training sessions in which procedures are available for subsequent monitoring during NRC inspections. This set of critical MC&A procedures should, at a minimum, adequately address the following topics, regardless of which facility organizational group is responsible for the particular topic:

process monitoring

item monitoring

alarm resolution activities

sampling and measurements

measurement control program

accountability record system

physical inventories

detecting the loss of a goal quantity

evaluation of shipper-receiver differences

determination of SEID, active inventory, and ID

investigation and resolution of loss indicators

providing information to aid in investigations

MC&A recordkeeping

independent assessment of the effectiveness of the MC&A program

tamper-safing

designation of MBAs, item control areas (ICAs), and custodial responsibilities.

6.3.3 Human Errors The licensee should develop and implement MC&A procedures in a manner that ensures that the frequency and consequences of human errors will be minimized and to enhance the NUREG-1280, Revision 2 48

likelihood of detection when they do occur. This can be achieved by a system of checks and balances in MC&A information systems that involve generating, collecting, processing, computing, analyzing, summarizing, and reporting data. Specific procedures should be available to guide personnel in performing major or complex tasks associated with MC&A.

These procedures should be sufficiently explicit and comprehensive to promote error-free performance by the least skilled or least experienced person that will be assigned to perform the tasks specified by the procedures. Procedures should be self-contained to avoid the need to refer to supporting documents and written with flexibility in the sequence of events whenever possible. Knowledgeable personnel should prepare and review procedures before they are implemented. Lengthy or complex procedures should be validated by means of field tests to ensure their clarity, comprehensiveness, and effectiveness. Procedure terminology should be consistent with equipment, as should forms and other information to be employed by personnel at the facility.

The format of MC&A procedures is arranged to help to reduce the rate of human error and to detect mistakes. The complexity, sentence length, and grammatical structure should be appropriate to the educational level of the least qualified user. Short sentences with concise and unambiguous language are used, and the level of detail in instructions is adequate to avoid errors of omission. No more than three simple task elements are included per step, with more complex actions separated into additional steps. By restricting the amount of information that personnel are required to remember while performing a procedure, a greater probability exists that the procedure will be performed correctly. Remembering precise, numerical information is not a task that humans perform well. Using checklists or preprinted forms are methods to limit the amount of memorization required while reducing dependence on often bulky procedures.

Procedures should be formatted to allow experienced personnel to concentrate on major headings or capsule descriptions, while more detail is provided in clearly demarcated fashion for less experienced personnel. Procedures may be formatted in cookbook fashion for ease of use when appropriate. All steps and tasks should be stated as actions, and the sequence of steps and tasks should be performed in the same sequence to accomplish the objective of the procedure. Attention-getting warning and precaution notices should be placed immediately preceding applicable steps and, where required, should also be summarized at the beginning of the procedure. All required supplies, tools, test equipment, documents, and protective measures should be listed at the beginning of the procedure. All applicable referenced documents should be listed in one section of the procedure, quality control and quality assurance points should be identified, and decisionmaking cues should be clearly stated.

Subtasks and subtests should be set off with separate headings or by appropriate indentation.

The sequence of steps is logical and accurate, and unnecessary memory recall should be avoided. The need for personnel to perform calculations and conversions should also be avoided whenever possible. However, if lengthy tests and calculations cannot be avoided, data collection tables and data reduction aids should be provided. Preprinted forms for recording data should be utilized when practical, and multiple copies of forms, if needed, should be generated automatically in the data collection phase.

6.3.4 Job Performance Aids MC&A procedures may include job performance aids (JPAs), where applicable, that help to reduce the frequency of human errors. JPAs for highly complex MC&A tasks assist novice users in their performance while not hindering the performance of experienced users. Attributes of such JPAs include, but are not limited to, the following:

49 NUREG-1280, Revision 2

Terms and labels match common usage for equipment labels and legends.

Quantities and dimensional units correspond to referenced displays, documents, and information.

Uncommon and inconsistent abbreviations are avoided.

The presentation of illustrations, graphs, and tables, if used, is consistent throughout the procedure.

Checklists or data tables are provided for lengthy prerequisites, tests, and calculations.

Illustrations are used in place of long descriptions, where possible; are placed so that they can be referenced easily from the text section; and are clearly labeled and easy to read.

All tables and graphs are clearly labeled in quantitative terms.

Some examples of successfully used JPAs are illustrations and diagrams, graphs for interpolation, approximate times to complete specific jobs, clearly stated decisionmaking cues and clues to the correct decision given specific cues, and data reduction aids. JPAs are useful so long as they do not cause the procedure to become difficult to use because of too many aids, the wrong types of aids, or presentation in an inappropriate manner. A procedure written so that an experienced user can omit unnecessary aids meant for novice users is in itself a JPA and will encourage procedure usage.

6.4 Training and Qualification Requirements This section of the MC&A plan should describe the training programs to be established and maintained to ensure qualified personnel and to provide for the continuing level of qualification with respect to personnel assigned to MC&A responsibilities.

6.4.1 Training Program The training program should ensure that the individuals assigned key MC&A positions (i.e.,

those involving tasks for which mistakes could directly degrade the safeguards capabilities of the MC&A program) are trained to maintain a high level of safeguards awareness and are adequately prepared to perform their functions correctly with a minimum of errors. The program should be structured to define job requirements, establish minimum qualifications for candidates, train and qualify the candidates, and define requalification criteria. The description of the program should identify the training program structure, source of instructional material, and general training objectives.

The list of key positions or functions should include all those for which errors or faulty performance could directly degrade SNM/SSNM control and accounting. These include MC&A management positions and individual contributor positions having responsibility for key measurements, data analysis, preparation of accountability source documents, and collecting or recording of other data having a direct impact on loss detection, alarm response, and quality assurance functions.

NUREG-1280, Revision 2 50

The training program emphasizes the job purpose and scope; relationship to other positions, especially the MC&A positions; the role or significance with respect to MC&A; technical knowledge; understanding of duties, responsibilities, and procedures; and skill development.

The training plans provide for a reasonable balance of theory and practice or oral and written instruction versus demonstration and learning by doing, the use of on-the-job training for positions that are primarily operational or clerical, and individualized instruction based on performance goals whenever feasible.

The training program provides for training of personnel already experienced and functioning in MC&A positions when competency tests indicate that additional training is necessary. The criterion will be whether or not the individual can function at the level of proficiency called for in the qualification criteria.

6.4.2 Qualification Program The qualification criteria for the key positions are consistent with the position descriptions and focus on minimum levels of education and experience, knowledge of the job content and its purposes, types and levels of skills or proficiencies, and understanding of the safeguards role and its importance. The criteria are defined in terms of measurable performance goals whenever possible.

Tests for positions requiring measurements, calculations, or recording of data and information will include demonstration of correct and accurate job performance. When operating procedures or manipulative skills are required, the tests will include hands-on demonstrations on competence.

The annex to the MC&A plan should provide an example of a typical training program for one typical position, a tabulation of the key MC&A positions, and an example of the complete qualification criteria for a key MC&A position.

6.5 Material Control and Accounting Program Description The length of this section and its level of detail will depend on the information provided in the previous sections of this chapter. The licensee should describe the overall MC&A organization in a manner that explains how its MC&A program will effectively achieve the general performance objectives of 10 CFR 74.3 and 10 CFR 74.51(a)(1) and the program capabilities of 10 CFR 74.51(c).

The individual who has responsibility for each of the following MC&A-related functions should be specified by title:

overall MC&A program management

measurements

measurement control and statistics

accountability records 51 NUREG-1280, Revision 2

process monitoring

item monitoring

alarm resolution

physical inventories

custodial responsibilities (e.g., SNM/SSNM storage and movement controls)

investigation and resolution of indicators that suggest possible loss of SNM/SSNM

receiving and shipping of SNM/SSNM

analytical laboratories

MC&A recordkeeping system and controls The individual responsible for the overall MC&A program management should have no major non-MC&A-related responsibilities. Measurement responsibility may be divided on the basis of the type of measurements (e.g., analytical laboratory measurements, NDA measurements, bulk measurements, and sampling).

The MC&A program description should define the policies, instructions, procedures, duties, responsibilities, and delegation of authority in sufficient detail to demonstrate the separation of duties or overchecks built into the MC&A program.

6.5.1 Automation of Material Control and Accounting The MC&A plan should describe the methods and technologies used to automate MC&A functions and the features of these methods that contribute to minimizing human errors in MC&A data. MC&A activities associated with collecting and processing data, recordkeeping, and auditing should be automated where it is practical and advantageous to do so. MC&A data are directly collected, inputted, checked, manipulated, reported, and audited by computer when it is practical and advantageous to reduce the consequences and frequency of human error as much as practical.

6.5.2 Human Error Quality Control The MC&A plan should describe the quality control system that will be used to monitor the frequency and types of human errors. The plan should also describe the techniques that will be employed to minimize the frequency and consequences of human errors and enhance the likelihood that they will be detected when they do occur. The description should address use of the following:

Control methods to ensure that current procedures are in place and being used

JPAs

automated data processing NUREG-1280, Revision 2 52

personnel training and qualification

preprinted forms

multiple copy forms

data verification A quality control system should be in place to monitor the frequency of human errors and permit categorization of the types of errors encountered. Statistical quality control systems should be used to track the effectiveness of human error control measures and the frequency of human error in MC&A systems, as well as to alert management whenever the rate of human error is in an out-of-tolerance condition. Such a quality control system includes, but is not limited to, the following:

The quality control system is capable of determining if and when an individual, procedure, or process makes more errors than is reasonably expected.

The quality control system is capable of determining the following:

- the individuals who require retraining because of their frequency of committing errors

- the procedures and processes that should be revised to produce fewer human errors

Double checklists are provided to allow periodic, random auditing of data collection by a supervisor or other independent person who checks the results of the first persons work and signs off when the work is complete and accurate. The originator should check each data collection form to verify that the data are accurate.

When MC&A data processing is automated, quality control systems are also automated, so that out-of-tolerance conditions, human errors, and other warnings can be detected promptly.

A configuration management plan is established for vital MC&A equipment, computer software, and manuals.

Configuration control measures are performed systematically and immediately reflect all changes as they are made.

Procedures and technical manuals are stored, indexed, filed, and controlled in a manner that ensures easy retrieval and availability.

Estimates of human error rates are based on a human reliability analysis of the data collection process to determine a reasonable rate of human error in MC&A data for the specific licensee.

53 NUREG-1280, Revision 2

Reasonable estimates of human error rates include input regarding equipment design, plant policies and practices, and written procedures.

Reasonable estimates of human error rates include input regarding situational and personnel factors that may produce errors.

Any potential problems that can reasonably be resolved following a human reliability analysis are resolved and the estimates of a reasonable error rate recalculated.

6.6 Commitments and Acceptance Criteria In its MC&A plan, the licensee should provide definitive commitments that adhere to the regulatory requirements applicable to management structure and training and qualification. A finding that the licensees MC&A plan describing management structure and training and qualification is acceptable and in accordance with 10 CFR 74.59(b) and 10 CFR 74.59(c) will be based on, but not limited to, the following acceptance criteria:

The authorship, approval authorizations, and effective dates of MC&A policies and procedures will be documented and will involve appropriate management and technical staff.

The responsibilities and authorities for each position assigned a function having a significant impact on SNM/SSNM control and accounting (including all positions authorized to control SNM/SSNM movement, generate source data, define or implement measurement control requirements, and conduct data analysis) are clearly defined in a written position description that details the responsibilities for that position.

The qualifications and experience required for each position assigned SNM/SSNM control and accounting functions will be sufficient to permit adequate performance of the duties required of that position.

The descriptions in the MC&A plan of the management structure and assignment of duties and authorities show that those responsible for each MC&A function will have sufficient authority to perform the function in the intended manner.

The MC&A organization is separate from the production organization and is also separate from organizations that generate source data, if practical; otherwise, independence of the functions is attained by suitable controls and overchecks.

The responsibility for MC&A program management is designated to an individual at an organizational level sufficient to ensure independence of action and objectiveness of decisions. The overall management responsibility for the MC&A program is at a level at least comparable to the organization having responsibility for production or storage of SNM/SSNM, or a direct line of communication is provided to the management level which has authority to implement measures essential to effective MC&A.

NUREG-1280, Revision 2 54

No two key MC&A functions are assigned to the same person unless sufficient checks and balances are provided. The following limitations are a consequence of this criterion:

Individuals who generate source data, such as performing measurements, or who perform shipping and receiving activities do not perform any accounting or record control functions unless suitable overchecks are provided to prevent falsification of both source data and accounting records.

No individual has the sole authority to overcheck, evaluate performance, or audit information for which he or she is responsible.

No individual may have responsibility and control of both MC&A and physical protection functions unless independent cross-checks are in place to preclude defeat of the overall safeguards system. At a minimum, the cross-check must include countersigning by one other person of any SNM/SSNM transfer within an MAA and countersigning by two individuals for SNM/SSNM transfers out of an MAA.

All current critical MC&A procedures are made easily accessible to all affected individuals and, for each procedure, the following are maintained: (1) revision number, (2) date issued, (3) identity of who prepared the procedure, and (4) identity of who approved the procedure (as indicated by signature and date signed).

Sufficient checks and balances are incorporated to detect falsification of data and reports that could conceal theft or diversion of SNM/SSNM by an individual, including an employee in any position, and collusion between an individual with MC&A responsibilities and another individual who has responsibility or control within both the physical protection and the MC&A programs.

A training and qualification program for key MC&A positions and a method of demonstrating continued competency of personnel have been implemented and will be maintained. The program is periodically updated to reflect changes in job requirements as outlined below:

The description of the key job functions, the design of the training and qualification program, and the method of confirming qualifications of personnel are subject to the formal approval of the MC&A manager.

The continuing qualification of key personnel will be verified on an ongoing basis or at least every 2 years. The individuals designated for key positions do not assume the positions until they have demonstrated their competence through tests that will determine whether or not the individual satisfies the preestablished qualification criteria for the positions.

The facility organization and the MC&A policies and procedures are documented.

All critical MC&A procedures, and any revisions thereto, are reviewed and approved before their implementation.

55 NUREG-1280, Revision 2

Management policies are established, documented, and maintained to ensure that all critical MC&A procedures are adhered to, including measurement procedures used for accountability purposes.

NUREG-1280, Revision 2 56

7. MEASUREMENTS 7.0 Regulatory Intent The intent of the 10 CFR 74.59(d) measurement capability requirements is that licensees establish, utilize, and maintain a system of measurements to ensure that all quantities of SNM/SSNM (both element and fissile isotope) in their accounting records are based on reliable measurements.

The measurement systems used must be sufficient to do the following:

Substantiate the element and fissile isotope content of all SNM/SSNM received, produced, and transferred between areas of custodial responsibility; on inventory; or shipped, discarded, or otherwise removed from inventory.

Provide the necessary data for the performance of the material control tests required by 10 CFR 74.53(b).

Permit an estimation of the standard deviations associated with each measured quantity.

The measurement uncertainty associated with the values entered into the accounting records should be sufficiently small to ensure the limit specified in 10 CFR 74.59(e)(5), for the total MC&A measurement uncertainty (associated with a material balance), is not exceeded. Except for sealed sources and samples (that have been determined by other means to contain less than 10 grams of U-235, U-233, or plutonium each), all SNM/SSNM receipts are to be measured for the purpose of performing shipper-receiver evaluations. In the absence of any significant shipper-receiver difference, a licensee may book either its measured values or the shippers measured values. When recording shippers values (for SNM/SSNM receipts), the measurement uncertainty associated with the shippers values should be known and used in the determination of the SEID. It is also intended that a licensees measurement program provide bias estimates to be used in correcting ID values and shipper-receiver differences for significant measurement biases. Chapter 9 of this document discusses the estimation of measurement bias. The licensee should measure heterogeneous scrap that cannot be accurately measured in its as-received form after dissolution within 18 months of receipt.

7.1 Measurement Points The MC&A plan should identify and describe each measurement that is used for accounting purposes. Measurements (1) establish the quantities in each custodial area, MBA, or ICA and in the facility as a whole and (2) contribute to the desired capability to localize losses and to generate and assess alarms. Measurement points and sampling stations should be selected to provide quantitative information about material flows and inventories that will permit detection and localization of any loss or diversion or to confirm that no theft or diversion has occurred.

Typically, three functional types of MBAs and ICAs are present: (1) processing, (2) storage, and (3) receiving and shipping. The identification and definition of measurement points for processing MBAs are necessary because of the physical or chemical changes of the nuclear materials that occur in these MBAs. The storage and the receiving and shipping areas are typically ICAs. Typical processing MBAs include (1) processing areas, (2) decontamination and recovery areas, (3) laboratory areas, and (4) feed and product sampling and transfer areas.

57 NUREG-1280, Revision 2

The following measurement points are usually included, although the licensee is not limited to them:

facility receipts

transfers between areas of custodial responsibility

points at which SNM/SSNM product or intermediate products are produced

unit process boundaries

facility shipments, including product, scrap, and waste

effluent discharge points

significant sidestreams The MC&A plan should characterize materials and measurements for each measurement point.

One suitable means of presentation would be a coded chart showing the types of materials and the components of measurement involved at each measurement point (i.e., weight, volume, sampling, analytical assay, or NDA). The use of factors is acceptable whenever the uncertainty associated with the factor is smaller than the random error of an applicable process material (or item) measurement. Otherwise, the use of factors should be limited to those situations for which timely measurements are impractical. The plan should include a commitment to the effect that factors will be based on measurements, monitored, and updated when appropriate statistical tests indicate the need for updating. In the annex to the MC&A plan, the licensee should justify the use of factors in lieu of measurements.

The acceptability of applying nominal (or historic) SNM/SSNM factors to measurement of mass, volume, or density for material control tests will depend upon the following considerations:

availability of substitute materials

predictability of material composition

material accessibility.

These considerations influence whether a test as simple as a weight comparison will suffice as a means of loss detection or if a measurement for element and perhaps isotope is necessary.

7.2 Measurement Systems The MC&A plan should describe in detail each measurement system used for nuclear material accounting purposes. The principal elements and operations involved in the measurement systems for MC&A encompass mass (or weight) or volume determination, sampling, chemical analyses for element and isotope, and NDA. Each measurement system should also be defined or identified by its unique set of the following parameters: (1) measurement device or equipment used, (2) standards used for calibration, and (3) standards used for control.

Additionally, for analytical laboratory measurements, the following also should be identified:

(1) sampling technique and equipment used, (2) sample aliquoting technique, and (3) sample NUREG-1280, Revision 2 58

pretreatment methodology. Chapter 8 of this document describes the elements of the measurement control program (e.g., standards traceable to a national system) used for validating and determining control limits and precision and accuracy levels for each measurement system used for accountability.

The MC&A plan should describe each measurement system associated with bulk, analytical, and NDA measurements and should identify, as applicable, any other measurement systems used for accounting purposes that do not fall within these categories. These descriptions should provide sufficient information to demonstrate how the systems are implemented to ensure the capability to meet the precision and accuracy limits. The following sections provide examples of the types of information necessary for selected measurement systems.

7.2.1 Bulk Measurement Systems For each weighing system, the applicant or licensee should specify the type of weighing device, the type of containers weighed, material within the containers being weighed, capacity of the weighing device, range to be used, sensitivity of the device, and the calibration frequency. The description should include the capacity and the sensitivity of the scale (e.g., capacity not to exceed X kilograms, and sensitivity to be at least as good as Y grams).

For each volume measurement system, the MC&A plan should identify the vessel (e.g., tank, column), capacity of the vessel to which the measurement applies, the material being measured, the volume measuring device and instrumentation, the sensitivity of each device and system, the range of operation and calibration, and the calibration frequency.

7.2.2 Analytical Measurement Systems For each analytical measurement system, the MC&A plan should specify the following:

type of material or chemical compound being sampled and measured (e.g., plutonium dioxide (PuO2), plutonium metal or alloy, mixed oxide (PuO2-UO2), uranium hexafluoride (UF6), uranium alloy, uranium dioxide (UO2), uranyl nitrate solution (UNH))

sampling techniques

sample handling (i.e., preanalysis sample storage and treatment)

analytical method used

characteristics measured (e.g., grams of uranium or plutonium per gram sample or U-235 or U-233 isotopic concentration)

measurement interferences

expected measurement uncertainty

types of calibration standards and calibration frequency 59 NUREG-1280, Revision 2

7.2.3 Nondestructive Assay Measurement Systems For each NDA measurement system, the MC&A plan should identify the following:

the NDA equipment package (i.e., type and size of detector and type of associated electronics and computer interface, as appropriate)

the type of container measured

SNM/SSNM material type within container

sampling techniques, if applicable

attribute measured

measurement configuration (including source to detector distance)

calculation method

expected measurement uncertainties 7.2.4 Other Measurement Systems If applicable, the MC&A plan should also identify any other measurement systems used for accounting purposes that do not fall within the three categories discussed in Sections 7.2.1, 7.2.2, and 7.2.3 of this document.

7.3 Measurement Uncertainties The MC&A plan should provide the expected measurement uncertainties of the described measurement systems. The plan should also state the variance components for calibration, sampling, random, and systematic error for each measurement system. The units in which the errors are expressed should be clearly identified.

7.4 Measurement Procedures The licensee or applicant should demonstrate that measurement procedures (i.e., methods) are established, approved, and maintained. This can be accomplished by (1) making a definitive statement that an approved measurement procedure (i.e., methods) manual, or set of approved manuals, is established and maintained, (2) stating which organizational units are responsible for the preparation, revision, and approval of measurement procedures, and (3) defining the standards for periodic review of the procedures.

The licensee should make a clear statement defining how the facility will ensure that a measurement procedure cannot be used for accountability purposes without documented approval. Each procedure should be approved by the overall MC&A manager and by the manager of the organizational unit responsible for performing the measurement. The measurement control program manager should also approve measurement procedures.

NUREG-1280, Revision 2 60

The MC&A plan should provide a definitive statement that all SNM/SSNM quantities in the material accounting records are based on measured values and that measurement systems are maintained for the measurement of SNM/SSNM associated with the following:

additions to inventory (e.g., receipts)

withdrawals from inventory (e.g., shipments and measured discards)

material on ending inventory For receipt of material, the licensee may use the shippers measured values rather than its own measurements, provided that (1) a shipper-receiver comparison, based on attributes or confirmatory measurements, shows no significant shipper-receiver difference (as defined by 10 CFR 74.59(h)(1)(iii)), (2) in the case of a significant difference between shipper and receiver, no significant difference exists between the shippers value and the umpire value used to resolve the difference, or (3) the material in question is exempted from shipper-receiver comparison requirements (e.g., sealed sources and samples). However, when booking shippers values, the licensee should use the shippers measurement uncertainty when determining the SEID.

7.5 Scrap Control Heterogeneous scrap that cannot be accurately measured in its received form need not be measured until after dissolution within 18 months of receipt. The after-dissolution measurement should include measurement of both the resulting solution and any undissolved residues before any commingling with other scrap solutions or residues. In the meantime, the licensee should use the shippers value or an appropriate factor-based value for inventory purposes.

7.6 Commitments and Acceptance Criteria In its MC&A plan, the licensee should provide definitive commitments that adhere to the regulatory requirements applicable to measurements. A finding that the licensees MC&A plan describing measurement systems is acceptable and in accordance with 10 CFR 74.59(d) will be based on, but not limited to, the following acceptance criteria:

A system is established, maintained, and utilized for the measurement of all SNM/SSNM received, produced, and transferred between internal control areas; on inventory; or shipped, discarded, or otherwise removed from inventory, except for the following:

sealed sources that have been determined by other means to contain less than 10 grams of U-235, U-233, or plutonium each samples received, transferred between internal control areas, or on inventory that have been determined by other means to contain less than 10 grams of U-235, U-233, or plutonium each receipt of sealed sources, of any quantity, previously manufactured and shipped by the licensee and which are returned to the licensee, provided the unique identity and encapsulation integrity have not been compromised and the booked receipt quantity equals the previously shipped quantity for the involved sealed 61 NUREG-1280, Revision 2

sources heterogeneous scrap that cannot be accurately measured in its as-received form, provided such scrap is measured after dissolution within 18 months of receipt (to include measurement of both the resulting solution and any undissolved residues before any commingling with other scrap solutions or residues)

A system is maintained and followed for the development and use of written procedures, which includes documented review and approval of such procedures and any revisions thereof before use. Procedures will address the following:

preparing or acquiring, maintaining, storing, and using reference standards and standard reference materials calibrating measurement systems, performing bulk mass and volume measurements, conducting NDA measurements, obtaining samples, and performing laboratory analyses for element concentration and fissile isotope abundance recording, reviewing, and reporting measurement data and measurement results

A basic description or summary of each key measurement system which is utilized to generate SNM/SSNM quantities for accountability purposes is provided. A measurement system is defined as any instrument or device, or combination of devices, used to derive (1) an element concentration, (2) an isotope quantity, (3) a U-235 enrichment or isotopic distribution, (4) a bulk material mass (weight), or (5) a bulk material volume and which can be characterized by its random and systematic error components.

The set of key measurement systems, based on recent (or anticipated) measurement control data and modes of process operations, is expected to account for at least 90 percent of the total measurement uncertainty contribution to the SEID.

The recalibration frequency for each measurement system is compatible with its expected stability. Recalibrations for all measurement systems should be performed at frequencies compatible with widely established, or licensee-demonstrated, stability for each particular system.

All calibrations are made with the use of primary standards or primary reference materials (certified and issued by the National Institute of Standards and Technology, the New Brunswick Laboratory, or an equivalent organization) or with reference standards traceable to primary standards. The standards used for calibrations need not be representative of the unknowns to be measured by the system unless it is to be regarded as a bias-free system that is calibrated during each time of use, in which case the calibrations standards should be representative.

When determining an SNM/SSNM quantity by weighing, sampling, and analyses, the net weight of material in each item within a uniform material batch (or lot), such as blended PuO2 or UO2 powder, plutonium metal, or sintered UO2 pellets, should be determined by direct mass measurement. However, the element or isotope concentrations, or both, for NUREG-1280, Revision 2 62

the batch need not be determined for each container, but instead may be derived by sampling procedures, including the following:

- analysis of composite samples or measurements of representative items, objects, or samples selected by statistical sampling

- use of concentration or enrichment factors, or both, determined from historical averages, controlled input specification values, or empirical relationships when such values or relationships are periodically tested, their uncertainties or bounds have been determined to be within 2 percent of the factor value, and diversions with material substitution are improbable.

A program of measurement procedures and methods is maintained for all SNM/SSNM receipts, removals, and inventory items, and all quantities of SNM/SSNM in the material accounting records are based on measured values.

Measurement systems that are the key contributors to the total measurement standard error are identified. The list will be reviewed annually and updated as necessary. The systems on this list are considered to be key measurement systems, and their standard deviations are monitored and controlled by the measurement control program.

Measurement systems are maintained and utilized to substantiate the element and isotope content of all SNM/SSNM received, produced, or transferred between areas of custodial responsibility; on inventory; or shipped, discarded, or otherwise removed from inventory.

SNM/SSNM quantities transferred into and out of each unit process are based on measurements for mass, volume, element, and isotope, as necessary, to accommodate material loss detection tests.

Measurement methods are appropriate for the matrix and SNM/SSNM characteristics of the material measured.

Factors employed in process models are based on measurements and are updated at least annually.

63 NUREG-1280, Revision 2

8. MEASUREMENT CONTROL PROGRAM 8.0 Regulatory Intent The intent of the 10 CFR 74.59(e) measurement control requirements is that measurement systems (described in Chapter 7 of this document) used to establish SNM/SSNM accountability quantities be controlled by a formal measurement control program that results in a level of effectiveness sufficient to satisfy the capabilities required for detection, response, and accounting. The quality of SNM/SSNM measurements should be continually controlled such that the SEID is maintained within the limits specified in 10 CFR 74.59(e)(5), and measurement error contribution to the standard deviations associated with the material control tests required by 10 CFR 74.53(b) is minimized. It is also intended that the measurement control program provide bias estimates to be used for adjusting ID results and correcting shipper-receiver measurements for significant measurement biases.

8.1 Organization and Management The MC&A plan should describe the organization and management of the measurement control program in sufficient detail to demonstrate how the measurement quality assurance function is assigned and how independence from the analytical laboratory and other units performing either sample taking or measurements is maintained. The measurement control program manager should be at a management level that is sufficiently high to ensure objectivity and independence of action. Thus, the measurement control program manager could either report directly to the overall MC&A manager or, if in a different organizational unit, be on the same level as the MC&A manager.

The licensees measurement control program should be properly managed to ensure adequate calibration frequencies, sufficient control of biases, and sufficient measurement precision to achieve the capabilities required by 10 CFR 74.59(e).

8.1.1 Functional Relationships The MC&A plan should clearly define the relationship and coordination between the measurement control program manager, the analytical laboratory, and other measurement performing groups. The plan should provide adequate assurance that the measurement control program manager has the authority to enforce all applicable measurement control requirements.

8.1.2 Procedures The measurement control program procedures should be established and maintained in a manual that is kept current and readily available. This manual should contain all of the currently applicable written procedures pertaining to measurement control and measurement quality assurance. The MC&A plan should specify the responsibility for the preparation, revision, and approval of manual procedures. Individual measurement control procedures should have documented approval by the measurement control program manager. The procedures should address the following:

calibration frequencies and methods 65 NUREG-1280, Revision 2

standards used for calibration (i.e., description and storage controls)

standards used for control (i.e., method of obtaining or preparation and traceability)

control standard measurements

replicate sampling and replicate measurements

verification of process control instrumentation through comparison with other process instruments

control limits and control responses

generation and collection of control data

recordkeeping controls and requirements 8.1.3 Contractor Program Audits and Reviews If an outside contractor or offsite laboratory provides measurement services, the MC&A plan should describe the review program used to monitor the offsite measurements in accordance with 10 CFR 74.59(h)(4). Such reviews are to confirm that the contractor or offsite laboratory has an acceptable measurement control program to ensure that the use of the contractors measurements will not compromise the licensees ability to meet any measurement or measurement control requirement contained in its MC&A plan. The licensee should conduct an initial review of the contractors measurement control program before using measurements performed by the contractor or offsite laboratory.

All contractor or offsite laboratory assessment findings and recommendations should be documented and submitted to both the measurement control program manager and the overall MC&A manager within 30 days of completion of the review. The two managers should agree on corrective actions that should be taken, based on their evaluation of the report, and should transmit these findings to the contractor or offsite laboratory in writing. The licensee should not use measurements performed by such contractors or offsite laboratories until they have verified that the corrective actions have been instituted.

The persons who conduct a contractor review need not be employed by the licensee; but they should not be employed by, or in any way be associated with, the contractor or offsite laboratory so that the independence of the conclusions may be maintained.

8.2 Calibrations The MC&A plan should summarize the licensees calibration program and confirm that the licensee has written procedures covering the following topics:

calibration frequency for each measurement device or system

identification of the standards used for calibration of each measurement device or system NUREG-1280, Revision 2 66

protection and control of standards used to calibrate measurement systems to maintain the validity of their certified or assigned values

the range of calibration for each measurement device or system and the minimum number of calibration runs (observations) needed to establish a calibration Unlike control standards, standards used for calibrating measurement systems need not be representative of the process material or items to be measured by the calibrated device or system. If practical, the standard used during the calibration process should be subjected to all of the steps involved in the measurement process to which the process unknowns are subjected (e.g., sample pretreatment), but this need not always be the case. It is the primary measurement device, not necessarily the entire measurement system, that needs to be calibrated, especially when the primary measurement device is common to two or more measurement systems. For example, the Davies & Gray titrimetric method is often used to analyze samples for uranium concentration of two or more different material types (e.g., UF6, UO2, UNH solutions). In this case, more than one measurement system is involved because different sampling and sample pretreatment methods and different control standards are used.

The potassium dichromate titrant, however, is common to the systems; thus, the titrant is what is calibrated (or standardized) with a primary reference material, such as certified potassium dichromate (K2Cr2O7), certified urano-uranic oxide (U3O8), or certified uranium metal.

In the case of nonconsumable standards used to calibrate measurement systems (e.g., weight standards), the MC&A plan should specify the frequency of recertification of assigned values.

The recertification frequency should depend on how often the standards are handled, the standards stability, and the adequacy of the controls used to maintain the integrity of the standards. Biennial recertification of such standards is usually acceptable.

The MC&A plan should contain a definitive statement that no SNM/SSNM accountability value is based on a measurement that falls outside the range of calibration. The MC&A plan also should identify those measurement systems that are point calibrated. A point-calibrated measurement system is one in which the following conditions are true:

The entire measurement system is calibrated with a standard or set of standards that is representative of the process unknowns that are measured by the system. That is, the representative calibration standards undergo all of the measurement steps, and in the same manner, that the unknowns undergo.

One or more calibration standards are processed and measured along with each unknown or set of unknowns measured. That is, both the standards and the unknowns are measured during the same general time interval, with the same individual measuring both the standards and the unknowns.

The measurement values assigned to the process unknowns are derived from the measurement response observed for the standards that were measured along with the unknowns.

The measurement response for each unknown should fall within plus or minus 10 percent of the response for a standard measured at the same time as the unknown or, as in the case of a low concentration unknown, the difference between the unknowns 67 NUREG-1280, Revision 2

response and the standards response should be less than four times the standard deviation associated with the standards response.

Calibration procedures should be adequate to ensure that the measurement systems will generate reliable results. Considerations in this regard include the following:

The number of runs to establish the initial calibration is sufficient to establish a reproducible calibration.

The calibration range spans the anticipated range of process values, and standards for calibration are adequately spread over the range.

For point calibrations utilizing a single calibration standard, the unknowns should be within plus or minus 10 percent of the assigned value of the involved standard.

Control standard measurements should be spread out across the material balance period with the expressed objectives of monitoring calibrations for trends or sudden shifts and providing the necessary data for bias estimates.

Recalibrations are performed when a need is identified. Recalibrations may be necessary if any of the following circumstances exist:

A trend, shift, or out-of-control condition at the 0.001 level is detected.

A bias estimate is statistically significant at the 95 percent confidence level.

A change in process materials occurs that extends or shifts the needed range of calibration.

A change or modification is made to a measurement system that has the potential to affect measurement results.

8.3 Control Standards For those measurement systems that are not point calibrated, the licensee should establish and follow a defined method for the periodic measurement of control standards. Control standard measurements serve the dual purpose of (1) monitoring the stability of a previously determined calibration factor and (2) estimating the average system bias over a period of time (e.g., an inventory period). The MC&A plan should specify the minimum total number of control standard measurements during the time period, as well as the typical frequency, for each measurement system. Generally speaking, for each key measurement system, a minimum of two control standard measurements should be made during each week that the system is in use. For those key systems that are used less than 8 weeks during a given material balance period, more than two control standard measurements per week of system use may be necessary to provide a measurement system performance that is controlled such that the SEID will not exceed 0.1 percent of the active inventory.

The measurement control program should produce data that are representative of actual operating conditions and all errors that impact ID. The larger uncertainty estimates that NUREG-1280, Revision 2 68

collectively contribute 90 percent or more to the standard error of the ID estimator will be based on a minimum of 15 standard or replicate process material measurements, as appropriate.

The set of key measurement systems should include any system utilized to measure an SNM/SSNM quantity (during an inventory period) greater than 25 percent of the active inventory, regardless of its contribution to the SEID. The minimum number of control standard measurements can be reduced to eight for non-key measurement systems that measure from 10 to 25 percent of the active inventory. The minimum number of control standard measurements can be further reduced to four, respectively, for those non-key systems used to measure less than 10 percent of the active inventory quantity.

Key measurement systems for the current inventory period are any set of designated measurement systems (of the licensees choosing) which, based on the most recent previous period, account for at least 90 percent of the total measurement variance contribution to the SEID. The set of key measurement systems should include any system utilized to measure an SNM/SSNM quantity (during an inventory period) greater than 25 percent of the active inventory, regardless of its contribution to the SEID.

Control standards should be representative of the process material or items being measured with respect to matrix and SNM/SSNM concentration, unless it can be demonstrated that the nonrepresentative aspects have a negligible impact because measurement results are unbiased. To be representative, the standards need not always be identical to the process unknowns, but any constituent of the process material or any factor associated with a process item that produces a bias effect on the measurement should be present to the same degree as in the control standards. For scales used to weigh very large items, the control standard weights should be artifact standards (e.g., both empty and full containers) of certified mass to avoid a bias effect caused by buoyancy or point loading.

The licensee should maintain control measures that will ensure or confirm the continuing validity of standards assigned values. Examples of the types of controls that would be appropriate include the following:

storage of metal standard weights in a noncorrosive atmosphere

tamper-safing of NDA standards immediately after makeup

storage of solution standards in more than one container when usage will be over an extended time period (e.g., 1 month),

storage of standards with an affinity for moisture in a desiccator

remeasurement of the standard to confirm that its value has not changed For each measurement system that is not point calibrated, the MC&A plan should identify and describe the control standards to be used for control standard measurements. Along with material composition and matrix factors, changes in (among other things) temperature, humidity, line voltage, and background radiation can also induce biases. Biases also can be operator or 69 NUREG-1280, Revision 2

analyst induced. Therefore, the scheduling of control standard measurements should be based on the following considerations:

Does the variation between analysts or operators need to be considered and monitored?

Can environmental variables contribute to measurement bias?

Is bias likely to vary with respect to the time of day?

Is a particular bias likely to be long term, short term, or cyclic in nature?

Is bias a function of the process measurement values over the range of calibration (i.e.,

is the relative percent bias nonuniform over the range of calibration)?

What controls or procedures are needed to ensure that sampling or aliquoting of the control standard is representative of the sampling or aliquoting of the process material?

To estimate the bias for each measurement system, how much alike, in terms of chemical composition, uranium concentration, density, homogeneity, and impurity content, should the control standards be relative to the process unknowns?

8.4 Replicate Sampling For systems involving sampling, duplicate measurements performed on single samples or measurements of replicate samples, or both, are necessary to estimate the combined analytical plus sampling random error. For nonsampling measurement systems, such as NDA and weight measurement systems, the random measurement variance component can be derived from (1) replicate measurements performed on process items, (2) the data generated from the measurement of control standards, (3) calibration data, or (4) engineering evaluations.

The licensee should ensure that replicate samples are independent of one another. The number of replicate samples measured for each analytical measurement system that is designated as a key measurement system during an inventory period should be equal to one of the following:

(1) 100 percent of the accountability batches sampled (when less than 15 batches)

(2) the greater of 15 samples or 15 percent of the accountability batches sampled (3) 50 samples (when 15 percent of the batches is greater than 50)

For non-key analytical measurement systems, the minimum number of replicate samples to be measured during an inventory period should be equal to one of the following:

(4) 100 percent of the accountability batches sampled (when less than eight batches)

(5) the greater of eight samples or 10 percent of the accountability batches sampled (6) 25 samples (when 10 percent of the batches is greater than 25)

NUREG-1280, Revision 2 70

For each measurement system involving sampling and analysis, the MC&A plan should indicate (1) the number of samples taken and measured for each accountability batch measurement and (2) the number of analyses performed on each accountability sample. If two or more samples are used and one or more analyses per sample are performed for each accountability batch measurement, replicate requirements are automatically met. If, however, one sample per batch is normally used for accountability purposes, the replicate program should include a periodic taking of a second (i.e., replicate) sample. For NDA and mass (weight) measurement systems, replicate data can be obtained either from the repeat measurements on production items or by using the data generated from the control standard program. That is, each consecutive pair of control standard measurements (for a given NDA or mass system) can be regarded as a replicate pair.

The minimum number of replicate measurements performed during an inventory period for a given key NDA or mass system should be as given in items (1), (2), or (3), above, except that the numbers or percentages are in terms of items measured, rather than batches sampled.

Likewise, for non-key NDA and mass measurement systems, the minimum number of replicate measurements should be as given in items (4), (5), or (6) above. The scatter in the repeat measurements can be used to estimate the random error variance using a statistical technique known as the one-way analysis of variance. (The NRC recommends the statistical methods described in Jaech (1973) and Bowen and Bennett (1988) for satisfying the statistical requirements of 10 CFR 74.59(e); see also Chapter 9 of this document.) Replication not only improves the precision of results obtained from the statistical analysis of the measurement data, but it can also detect gross errors in the data.

8.5 Control Limits The methods of monitoring and controlling measurement performance should be adequate to ensure the reliability of the measurement systems used for MC&A purposes. Examples of acceptable methods include control charts and automated data analysis performed on an ongoing basis. The proposed method should be capable of providing timely information on the control status of measurement systems, including the possible presence of unacceptable trends.

The licensee is to establish and use both 0.05 (warning) and 0.001 (out-of-control) limits for control standard measurements for those measurement systems used for nuclear material accountability, in accordance with 10 CFR 74.59(e)(8). The licensee is also to use out-of-control limits for replicate measurements and measurement of replicate samples.

However, warning limits are optional for the replicate program. For point-calibrated systems, the assigned value of the standards measured along with the unknowns is assumed to be valid.

If the standards true value could change because of factors such as evaporation, moisture pickup, or oxidation, the value of the standard should be checked periodically. Therefore, control limits for the verification measurements associated with such standards should be established. This is especially true for those point-calibrated systems that use a single standard, or aliquots from a single standard, over any extended period of time.

When a system generates a control measurement that falls beyond an out-of-control limit, the system should not be used for accounting purposes until it has been brought back into control (i.e., within the upper and lower warning limit).

71 NUREG-1280, Revision 2

Control limits should be recalculated at a predetermined frequency and modified if necessary.

The MC&A plan should clearly explain how control limits are established and the frequency for redetermining them.

8.5.1 Measurement Control Data Analysis The licensee should plot measurement control data, such as control standard measurement results and the differences between measurement values of replicate pairs, to generate control charts. The licensee should review all control charts at least once every 2 weeks unless a measurement system was not used during that period. The review should assess the frequency of control data exceeding either the warning or the out-of-control limits and also provide an evaluation for any significant trends. For an established measurement system, a less frequent review period may be warranted.

8.5.2 Response Actions Either the analyst or the operator performing a control measurement or his or her supervisor should have the responsibility for promptly reporting any control measurement that exceeds an out-of-control limit. Such reporting should be made to the measurement control program manager (or his or her designee), who should have the responsibility and authority to carry out or direct the necessary response and corrective actions.

The MC&A plan should clearly define the minimum response and minimum corrective action requirements. In addition, the measurement control manager (or his or her designee) should be responsible for, and have the authority for, determining and executing additional response and corrective actions as deemed appropriate.

The minimum response to a reported incident of a control measurement exceeding an out-of-control limit should consist of the following:

(1) verifying that the measurement system in question has been taken out of service with respect to accountability measurements (2) documenting the occurrence of the event (3) performing at least two additional control measurements (4) performing additional control measurements, if the results of item (3) do not show the system to be back in control, using a different control standard or different replicate sample (as appropriate) or recalibrating the measurement system, or making any necessary system repairs (5) reviewing measurements performed on the system in question since the last in-control run to determine whether any items should be remeasured For those measurement systems that make a significant contribution to the SEID, the response to an out-of-control condition should also include the remeasurement of any samples (or items) that were measured before the out-of-control condition but after the last in-control measurement. The validity of the previous measurements can be established without a complete remeasurement of all the samples (or items) involved if remeasurement on a last in, first out basis is used. That is, the last sample (or item) measured before the out-of-control NUREG-1280, Revision 2 72

measurement, should be the first to be remeasured continuing in reverse order until two consecutive remeasurements are found to be in agreement with their initial measurement at the 95 percent confidence level.

The MC&A plan should describe specific measurement control program elements applicable to those measurement systems used for detection and response purposes. The estimated standard deviations of the material control test statistics are derived from the monitoring program data that are collected in such a manner that they represent the current performance of the process and measurement systems. Values obtained when the process is operating in an abnormal manner or when a significant process upset or anomaly has occurred will not be included in the data used to estimate the standard deviation. However, data are discarded only on the basis of preestablished objective criteria. Data may not be pooled over periods of time when significant process or measurement system changes have occurred. When data pooling is appropriate, statistical tests will be applied to demonstrate that the means and variances are from the same distribution at the 0.05-level of significance. The data will be tested for randomness (see Jaech (1977), Section 2.9.2, and Bowen and Bennett (1988)) and normality when tests, such as the F-test on variances, are distribution dependent.

The quality control program for monitoring detection system effectiveness should have as its key goal assurance that the estimates of standard deviations used in establishing action thresholds that comply with the detection probability criteria neither underestimate nor overestimate the true standard deviations of the tests. It is important to ensure that the estimate of the mean and standard deviation for each material control test reflects the actual operating conditions and error sources. Generally this is done by calculating these estimates from sets of material control test data, but it is very important to avoid serious inflation of the variability of the data that would result in the event of actual losses of SSNM or out-of-control process variables.

Therefore, both the measurement component and the overall standard deviation should be monitored for diagnostic purposes. Failure to consider all sources of noncorrectable variation, including normal process variations, would result in an unrealistically small estimate. Use of too small of an estimate could result in an action threshold being set too high to provide the loss detection probability required by 10 CFR 74.53.

The standard deviation of each material control test statistic is periodically checked by comparing an estimate of the current standard deviation with the prior value used in setting the alarm threshold. The estimate of the current standard deviation will be based on at least the 10 most recent values of a test statistic, whereas the reference value will be based on at least 20 values.

8.6 Commitments and Acceptance Criteria In its MC&A plan, the licensee should provide definitive commitments that adhere to the regulatory requirements applicable to measurement control. A finding that the licensees MC&A plan for measurement control is acceptable and in accordance with 10 CFR 74.59(e) will be based on, but not limited to, the following acceptance criteria:

The measurement control program produces data that are representative of actual operating conditions and all errors that impact the ID estimate. The larger uncertainty estimates that collectively contribute 90 percent or more to the SEID will be based on a minimum of 15 standard or replicate process material measurements, as appropriate.

73 NUREG-1280, Revision 2

The method to be used for estimating the SEID for the typical material balance, as shown in the annex to the MC&A plan, should meet the following criteria:

- All reasonable and probable sources of measurement error for the key measurement systems affecting IDs are included.

- The selection of the key measurements whose variances are to be included in calculating the standard error is justified by an analysis of the relative magnitudes of the variance components of a typical ID and their comparative effect on the SEID.

- Any measurement error standard deviations not actually determined by the measurement control program are shown to be reasonable either by comparison with published state-of-the-art measurement performance in similar applications (see such sources as Rogers (1983) 1) or with records of past performance data from the licensees facility. Records showing these data must be available to the NRC.

- The calculation of the SEID is performed in accordance with a recognized error propagation method or other defensible method based on sound engineering and statistical principles. Error propagation methods have been published in Bowen and Bennett (1988), Jaech (1973), and the International Atomic Energy Agencys (IAEAs) handbook on statistical concepts (IAEA, 1998).

Responsibility is assigned for planning, developing, coordinating, and administering a measurement control program to an individual who has no direct responsibility for either performing measurements or for SNM/SSNM processing or handling and who holds a position at an organizational level that permits independence of action and has adequate authority to obtain all of the information needed to monitor and evaluate measurement quality as required by 10 CFR 74.59(e).

Any contractor who performs MC&A measurement services conforms with applicable requirements in 10 CFR 74.59(d) and 10 CFR 74.59(e). Conformance should include reporting by the contractor of sufficient measurement control data to allow the licensee to calculate bias corrections and the standard error of the bias estimator.

Potential sources of sampling error are identified and process sampling tests using well-characterized materials to establish or verify the applicability of utilized procedures for sampling SNM/SSNM and for maintaining sample integrity during transport and storage are used to ensure that the samples accurately represent the material being sampled. Such sampling tests or sample integrity tests, as appropriate, should be conducted whenever the following occurs:

- A new sampling procedure or technique is utilized or new sampling equipment is installed.

1 For example, Rogers (1983) cites performance relative standard deviations of 0.65 percent for random error and 0.018 percent for systematic error using the Davies and Gray titrimetric method for measuring TRIGA alloy process material. For the determination of plutonium by redox (oxidation-reduction reactions) titrimetry, the relative standard deviations were 0.38 percent for random error and 0.038 percent for systematic error in the measurement of plutonium metal.

NUREG-1280, Revision 2 74

- A sampling procedure, technique, or sampling equipment is modified.

- Sample containers, sample transport methods, or sample storage conditions are changed or modified.

Current data are generated on the performance of each measurement system utilized for establishing measured values during an inventory period, such as estimates of bias, variance components for calibration, sampling, and repeat measurements (of the same sample). The program data should reflect the current process and measurement conditions existing at the time the control measurements are made.

Standards are used on an ongoing basis for the calibration and control of all bulk mass, NDA, and analytical measurement systems utilized for SNM/SSNM accountability.

Calibrations should be repeated whenever a significant change occurs in a measurement system or when program data indicate a need for recalibration.

Calibrations and control standard measurements should be based on standards whose assigned values are traceable to certified reference standards or certified standard reference materials. Additionally, control standards should be representative of the process material or items being measured by the measurement system in question.

Control measurements are conducted to provide current data for the determination of random error behavior. On a predetermined schedule, the program should include, as appropriate, the following:

- replicate analyses of individual samples

- analysis of replicate process samples

- replicate volume measurements of bulk process batches

- replicate weight measurements of process items and bulk batches or, alternatively, the use of data generated from the replicate weighings of control standard weights as derived from the control standard program

- replicate NDA measurements of individual process containers (items) or, alternatively, the use of data generated from the replicate measurements of NDA control standards as derived from the control standard program

Measurement system data are periodically evaluated, so that if the SEID exceeds established limits, the effect that has caused the SEID to be too large can be identified.

An investigation is promptly initiated and appropriate corrective action is taken whenever a control data point exceeds the control limit of 0.05; whenever a control data point exceeds the control limit of 0.001, the measurement system that generated the data should immediately be placed out of service with respect to MC&A measurements until the deficiency has been corrected and the system brought into control with the 0.05 control limits.

75 NUREG-1280, Revision 2

The licensee will confirm that the accountability measurements provided by a contractor are controlled by a measurement control program and that the contractors measurement control program is adequate by conducting audit and assessment reviews of the contractors program at intervals not to exceed 12 months.

A measurement control program is followed by which all measurement biases associated with measurement systems are estimated and bias corrections are applied by an appropriate procedure.

The calculation of the measurement contributions to the SEID are traceable to the appropriate measurement error data and to the calibration standards used.

The measurement systems have adequate calibration frequencies, sufficient control of biases, and sufficiently small standard deviations to achieve the requirements of 10 CFR 74.51(c). A measurement control program is used by both in-house activities and any contractor who performs MC&A measurement services for the licensee to ensure that the quality of the measurements is maintained on a level consistent with the NRC requirements in 10 CFR Part 74.

Analyses and evaluations are performed on the design, installation, preoperational testing, calibration, and operation of all measurement systems to be used for MC&A purposes.

Process and engineering tests are performed, using well-characterized materials, to verify the applicability of mixing and sampling procedures for SNM/SSNM and to ensure sample validity during transport and storage.

In general, current data are generated during the inventory period for establishing bias correction values, uncertainties on calibration factors, and random error variances.

However, data from past inventory periods may be used, for example, data from calibrations performed in previous periods.

Bias corrections are applied to individual items whenever a bias estimate exceeds twice the estimated standard deviation of the estimator and the rounding error of affected items. Otherwise, the impact of biases is applied as a correction to the ID. Bias correction adjustments to ID are not entered in the accounting ledgers.

When a statistically significant change occurs in the estimated standard deviation of a material control test statistic, the alarm threshold of the test is adjusted as necessary to ensure that a goal quantity loss of SSNM will be detected with the probability required by 10 CFR 74.53(b)(2). Additionally, the change will be investigated to determine the cause.

Contractors who perform MC&A measurement services will implement and maintain a control program for measurement control and human errors. The program will be of sufficient depth and intensity to preclude any degradation of the MC&A program.

The estimated standard deviations of the material control test statistics are maintained at or below a level sufficient to achieve the loss detection capabilities established under 10 CFR 74.53(b) without incurring an excessive rate of false alarms.

NUREG-1280, Revision 2 76

A statistical control system is maintained to ensure that measurements employed for MC&A purposes are obtained from measurement systems that are in a state of statistical control. Control limits are established at the 0.05 and 0.001 levels of significance.

When a process modification occurs, sufficient data are generated to provide a reliable estimate of the standard deviation applicable to the material control test.

The magnitude of the uncertainties associated with the process variabilities is determined and applied in the overall uncertainty (standard deviation) utilized in establishing alarm thresholds.

The cumulative shipper-receiver differences for each like material type are routinely monitored and when, for any 185 calendar day period, they are determined to be statistically significant and exceed the larger of 1 FKG or 0.1 percent of the quantity received, corrective action is taken to identify and correct measurement biases.

The methods used to estimate the SEID and the cumulative shipper-receiver differences will be based on commonly accepted principles.

Current inventory period control data are used to estimate the SEID and the standard deviations associated with the process differences. Data generated in immediately preceding material balance periods may be combined with current data when it can be demonstrated that the data are from the same distribution and the combined data are utilized to establish current period measurement uncertainty values.

77 NUREG-1280, Revision 2

9. STATISTICS 9.0 Regulatory Intent Proper use of statistics is important to ensuring that the regulatory requirements in 10 CFR 74.51, 10 CFR 74.53, 10 CFR 74.55, 10 CFR 74.57, and 10 CFR 74.59 are met. An effective statistical program will ensure that measurement systems perform within control limits, measurement uncertainties are calculated and propagated, the ID and SEID are determined, and significant shipper-receiver differences are identified. For example, 10 CFR 74.59(f)(1)(i) requires licensees to calculate the ID and SEID for the material balance period terminated by each physical inventory. Proper use of statistics is important to correctly propagate the uncertainties from all measurements into an accurate SEID value.

9.1 Determination of Measurement Uncertainties To achieve the objectives and capabilities of 10 CFR 74.3 and 10 CFR 74.51, each licensee or applicant should institute a statistical program that evaluates the MC&A data to ensure that (1) the measurement data are analyzed in a rigorous manner and (2) statistical tests and inferences concerning the status of the nuclear material possessed are appropriately tested.

The NRC sponsored the development of a comprehensive reference that specifically addresses the statistical treatment of MC&A data. The NRC recommends the statistical methods described in Jaech (1973) and Bowen and Bennett (1988) for satisfying the statistical requirements of 10 CFR 74.53, 10 CFR 74.55, and 10 CFR 74.59.

The MC&A plan should do the following:

Contain a detailed discussion of the procedures and methodologies for estimating measurement variance components.

Discuss how biases are determined and how bias corrections are applied, considering the following:

- how often biases are estimated

- how the bias effect on the measured quantity of material in an item is determined

- when and how bias corrections to items are made

- how their effect on ID is determined

- when and how bias corrections are applied to the ID

Describe the procedure and means for determining active inventory.

Provide all relevant information regarding the determination of the SEID.

Specify the methodology for determining ID threshold values. (See Chapter 10 of this document for additional information on ID limits and response actions.)

79 NUREG-1280, Revision 2

Error variances associated with calibrations should be determined and applied in accordance with the following:

For point calibrations, in which a standard is measured with each unknown, the uncertainty associated with the standard measurement is treated as a random error, while the uncertainty associated with the standards assigned value is treated as a fixed error.

For point calibrations, in which standards are run before and after a group of process samples and the average measured value of the standards is utilized in the element or isotope determination, the uncertainty associated with the standards average measured value is treated as a fixed error for the group of process samples.

For line or curve calibrations, the uncertainty associated with the calibration parameters is treated as a fixed error.

The estimated standard deviations of the material control test statistics should be derived from the monitoring program data that are collected in such a manner that they represent the current performance of the process and measurement systems. Values obtained when the process is operating in an abnormal manner or when a significant process upset or anomaly has occurred should not be included in the data used to estimate the standard deviation. However, data should be discarded only on the basis of preestablished objective criteria. Data should not be pooled over periods of time when significant process or measurement system changes have occurred. When data pooling is appropriate, statistical tests should be applied to demonstrate that the means and variances are from the same distribution at the 0.05 level of significance.

The data should be tested for randomness (see Jaech (1977), Section 2.9.2, and Bowen and Bennett (1988)) and normality when tests, such as the F-test on variances, are distribution dependent.

The quality control program for monitoring detection system effectiveness should have as its key goal assurance that the estimates of standard deviations used in establishing action thresholds that comply with the detection probability criteria neither underestimate nor overestimate the true standard deviations of the tests. It is important to ensure that the estimate of the mean and standard deviation for each material control test reflects the actual operating conditions and error sources. Generally this is done by calculating these estimates from sets of material control test data, but it is very important to avoid serious inflation of the variability of the data that would result in the event of actual losses of SNM/SSNM or out-of-control process variables. Therefore, both the measurement component and the overall standard deviation should be monitored for diagnostic purposes. Failure to consider all sources of noncorrectable variation, including normal process variations, would result in an unrealistically small estimate.

Use of too small an estimate could result in an action threshold being set too high to provide the required loss detection probability.

The standard deviation of each material control test statistic should be periodically checked by comparing an estimate of the current standard deviation with the prior value used in setting the alarm threshold. The estimate of the current standard deviation will be based on at least the 10 most recent values of a test statistic, whereas the reference value will be based on at least 20 values.

NUREG-1280, Revision 2 80

9.2 Determination of the Standard Error of Inventory Difference As defined in 10 CFR 74.4, Definitions, the standard error of inventory difference means the standard deviation of an ID that takes into account all measurement error contributions to the components of the ID. Including all measurement uncertainties, the SEID (for either uranium, U-235, plutonium, or U-233, as applicable) can be expressed as follows:

k SEID = [ (Gi)2 {(i)s2 + (i)r2/n} ]1/2 i=1 where k = number of measurement systems Gi = total grams uranium (or U-235) measured during inventory period by measurement system i (i)s = systematic error standard deviation for measurement system i (i)r = random error standard deviation for measurement system i n = number of batches (items) measured by measurement system i In theory, the SEID provides the uncertainty, at the 67-percent confidence level, of the ID estimate.

The MC&A plan should provide all relevant information regarding the determination of the SEID.

The plan should include a commitment that at least two individuals independently verify the correctness of the SEID calculation for each total plant material balance. If the SEID value is calculated by a computer, the verification by two or more persons involves ensuring that the input data used by the computer to calculate the SEID was correct.

The method to be used for estimating the SEID for the typical material balance, as shown in the annex to the MC&A plan, should be consistent with the following criteria:

All reasonable and probable sources of measurement error for the key measurement systems affecting IDs are included.

The selection of the key measurements whose variances are to be included in calculating the standard error is justified by an analysis of the relative magnitudes of the variance components of a typical ID and their comparative effect on the SEID.

Any measurement error standard deviations not actually determined by the measurement control program are shown to be reasonable either by comparison with published state-of-the-art measurement performance in similar applications (see such sources as Rogers (1983) and Reilly and Evans (1977)) or with records of past performance data from the licensees facility. Records showing these data should be available to the NRC.

The calculation of the SEID is performed in accordance with a recognized error propagation method or other defensible method based on sound engineering and 81 NUREG-1280, Revision 2

statistical principles. Error propagation methods have been published by Jaech (1973),

Bowen and Bennett (1988), and the IAEA (1998).

9.3 Bias Corrections From a statistical perspective, a bias estimate that does not exceed twice the standard deviation of its estimator should never be applied as an adjustment (correction) to the accounting records.

To obtain the best estimate of the true ID value, such bias estimates should be applied as a nonaccounting adjustment to the initially calculated ID (as obtained from the ID equation:

ID = BI + A R EI, where BI is the beginning inventory, A is additions to the inventory, R is removals from the inventory, and EI is the ending inventory). Such practice is not deemed necessary, however, for material balances pertaining to SNM of moderate strategic significance and is thus optional.

For biases that are significant, it is common practice to adjust the accounting values for individual items if the bias effect (as grams element and grams isotope) on the item is more than the rounding error for that item and, if less than the rounding error, to apply the bias as a nonaccounting adjustment to the ID. Under a well-designed and well-managed measurement control program, bias corrections to the accounting records should seldom, if ever, be necessary under the above-mentioned approach. Although the effect on an individual item from a significant bias should be negligible, the effect of that bias across hundreds or thousands of items (whose SNM/SSNM values were derived from the biased measurement system) could have a very significant impact on the ID value.

Nevertheless, in view of the very large quantity of SNM/SSNM that is of a safeguards significance, the NRC acceptance criteria does not normally call for applying bias corrections to either the accounting records or as an adjustment to ID unless the effect of a single significant bias or the net sum of all significant biases is unusually large.

At a minimum, to be consistent with the NRC acceptance criteria, a bias correction for a single key measurement system should be considered significant, and thus applied either as corrections to the accounting records or as an adjustment to the ID if (1) such bias exceeds twice the standard deviation of its estimator and (2) either or both of the following conditions are also true:

(1) Applying the correction would cause the ID to exceed three times the SEID.

(2) The bias is greater than 0.0100 percent relative.

Additionally, the net algebraic sum (expressed as grams SNM/SSNM) of all significant biases from measurement systems not defined as bias free, and which have not been applied as a correction/adjustment under condition (1) or (2) above, is statistically significant and is to be applied as a net adjustment to the ID if applying such correction would cause the ID to exceed three times the SEID.

NUREG-1280, Revision 2 82

The licensee should monitor all measurement systems affecting a material control test, ID estimate, or shipper-receiver comparison for bias, except as noted below. The intensity of the monitoring program is proportional to the significance of the measurement system for the test involved. The key measurement systems (i.e., those that contribute at least 10 percent of the estimated measurement standard deviation of a material control test, a shipper-receiver difference, or an ID estimator) should be tested for bias at least monthly except in the following circumstances:

The measurement system has been demonstrated to be quite stable and the results predictable.

The bias estimate of a measurement system utilized solely for material control test affects inputs and outputs equally and therefore the effects of bias cancel.

The bias estimate for a measurement system utilized solely for material control test is shown to be constant and does not impact the material control test.

The system is defined as bias free.

When the above conditions exist, the bias tests can be extended to 3 months or exempted altogether if the system qualifies as bias free.

The bias tests should be made using the mean of at least eight control standard measurements.

Bias corrections should be made to individual items if the bias exceeds twice the standard deviation of its estimator and the rounding error of affected items. Otherwise, bias corrections should be applied as corrections to the ID, unless the net sum of such biases is less than 50 grams of SSNM, in which case no correction to the ID is necessary.

All other measurement systems (unless bias free) should be monitored for bias and tested every 3 months except for those measurement systems involved with movement of material across the MAA boundary and a cross-check measurement is not performed. Such systems should also be tested monthly.

Measurement systems are statistically bias free if a representative standard is run for each unknown or set of unknowns measured at the same time or representative standards are measured before or after a group of process samples and the standards measurement response and assigned value, rather than any previous calibration information, are used in determining the value of the unknowns.

83 NUREG-1280, Revision 2

10. PHYSICAL INVENTORIES 10.0 Regulatory Intent The intent of the 10 CFR 74.59(f) physical inventory requirements is to ensure that licensees maintain inventory control and conduct physical inventories at intervals not to exceed 185 calendar days to confirm that a loss, theft, or diversion of SNM/SSNM has not occurred.

Periodic physical inventories enable a licensee to adjust accounts to accurately reflect the status of the SNM/SSNM inventory within a facility. Comparisons of the book inventory to the physical inventory (i.e., the ID) also serve as a quality control check on the performance of the material control tests employed for prompt loss detection. The subdivision of a facility into multiple process units and the performance of material control tests will enhance the resolution of significant IDs through better loss localization capability. Additionally, material control test results will be useful in pinpointing the time when an anomaly likely occurred.

10.1 General Description The applicant or licensee should provide a general description of how physical inventories of the plant will be planned, conducted, assessed, and reported.

The MC&A plan should contain a definitive statement that physical inventory functions and responsibilities are reviewed comprehensively with the involved individuals before the start of each physical inventory.

A book inventory listing, derived from the MC&A record system, should be generated just before the actual start of each physical inventory; such listing shall include all of the SNM/SSNM that the records indicate the licensee possesses at the inventory cutoff time.

The regulations in 10 CFR 74.59(f) require a licensee to conduct a physical inventory. The licensee is to report the ID and related information associated with each physical inventory to the NRC on NRC Form 327, in accordance with 10 CFR 74.17, Special Nuclear Material Physical Inventory Summary Report. In addition, if any material associated with material codes 20-E2 (i.e., moderately enriched uranium), 20-E1 (i.e., low-enriched uranium), 70 (U-233), 50 (plutonium), or 83 (Pu-238) is possessed by the licensee, such material is subject to the physical inventory requirements. The licensee should report each material code ID and associated information on separate NRC 327 forms.

10.2 Organization, Procedures, and Schedules The MC&A plan should explain the makeup and duties of the typical physical inventory organization. The plan should identify the individual having responsibility for the coordination of the physical inventory effort by position title. The MC&A plan also should indicate how the preparation and modification of inventory procedures are controlled.

The MC&A plan should contain a definitive statement that specific inventory instructions are prepared and issued for each physical inventory.

85 NUREG-1280, Revision 2

10.3 Description of Typical Item Strata The MC&A plan should describe the expected item population in terms of the following:

type of item (i.e., stratum)

expected range of the number of items within each stratum

the average elemental and isotopic content of the items within each stratum

the expected rate of item generation and consumption for each stratum 10.4 Facility Preparation The MC&A plan should describe the preparation of the facility for physical inventory. The description should include the following:

the basic approach to facility preparation (e.g., draindown, cleanout)

the degree to which any inventory prelisting will be utilized and the means of verifying the prelisted items

the means of controlling inventory listing forms and tags

the cutoff procedures for SNM/SSNM processing, transfers, and records adjustments to ensure an accurate recording of material transactions and inventory listing

the organization of the inventory teams, including the cross-checks to prevent falsification and minimize mistakes

the criteria, controls, and procedures for tamper-safing containers or vaults whose SNM/SSNM content (as established by prior measurement) will be accepted for inventory 10.5 Conducting Physical Inventories The MC&A plan should describe how physical inventories are conducted. The description should address the following:

the technique to ensure that all SNM/SSNM is inventoried and none is counted more than once

the measurements that will be performed specifically for inventory purposes

the use of prior measurement data, factors, and composite data

the degree to which process holdup will be cleaned out and the measurement of residual holdup NUREG-1280, Revision 2 86

the use of post-inventory inspection techniques (if employed)

The annex to the MC&A plan should include an example of a typical inventory listing by material type and quantity.

The plan should address the means for measuring or estimating residual process material (i.e.,

holdup) in detail. The plan should also discuss the change or variation in such deposited holdup from one physical inventory to the next.

The licensee should prepare a detailed inventory notice for each physical inventory. The notice should be issued to all involved parties and should contain instructions that define the timing and performance of various inventory steps and conditions under which the inventory is to be taken. Specific sampling points throughout the process and instructions on data submission to the accountability organization should be identified. The instructions should highlight any required deviation from normal inventory procedures contained in the plants operating procedures.

The MC&A plan should describe the procedures and methodologies associated with performing physical inventories in sufficient detail to demonstrate that valid physical inventories are conducted. Such description should include a general outline of the following:

organization and separation of functions

assignment of inventory teams and their training in the use of uniform practices

obtaining, verifying, and recording of source data

control of inventory forms

assurance that item counts verify the presence of each item while preventing any item from being counted more than once

implementation of cutoff and material handling procedures Decontamination and recovery is a complex operation involving the disassembly and decontamination of failed pieces of process equipment and recovery of uranium from various types of scrap materials. The basic inventory procedure should involve establishing a cutoff of movement of materials into the area and processing all materials to a measurable form, such as containers of solution or oxide. Except for the decontamination enclosure in which in-process solutions are mixed, sampled, and measured volumetrically, the inventory process should involve emptying and flushing process systems and piping, which then could be measured using NDA techniques to establish levels of residual holdup, if such holdup is significant.

The MC&A plan should describe special item storage and handling or tamper-indicating methods, which are used to ensure that the previously measured and recorded SNM/SSNM content values can be used for inventory purposes without remeasurement. In addition, the MC&A plan should outline how item identities are verified and how tampering with the contents of items will be detected or prevented.

87 NUREG-1280, Revision 2

Items that are not encapsulated, affixed with TIDs, or otherwise protected to ensure the validity of prior measurements need special attention. The MC&A plan should present the basis for determining which items are to be remeasured at physical inventory time and the justification of any proposed alternatives to measurement of any SNM/SSNM included in the inventory. The MC&A plan should describe the following:

the quality of the measurement methods used to verify original measurement values (for the parameter being measured)

the procedure for reconciling discrepancies between original and remeasurement values and for scheduling additional tests and remeasurements

the basis for discarding an original SNM/SSNM value and replacing it with a remeasurement value The MC&A plan should present the decision rationale for determining when the element and isotope factors for items, objects, or containers are measured directly for inventory and when they may be based on other measurements. For example, if the U-235 contained in liquid waste batches is derived by applying an average enrichment factor to the measured uranium element content, the plan should discuss the rationale for such practice (as opposed to measuring each batch for both uranium and U-235 content) and describe the method for establishing the average enrichment factor.

The MC&A plan should also contain a definitive statement that all items on ending inventory that have not been previously measured are measured for inventory purposes.

10.6 Inventory Reconciliation The MC&A plan should describe the reconciliation procedure, including the following:

the method of calculating the SEID

the criteria for investigation of IDs that exceed three times the SEID and 200 grams of plutonium or U-233 or 300 grams U-235

the method of establishing three times the standard deviation of historical IDs against which an ID that exceeds three times the SEID will be evaluated

the criteria for establishing the depth of investigation for excessive IDs and the types of investigative actions

the handling of prior period adjustments and measurement system biases that are applied as corrections to an ID

the method of adjusting the book records to the results of the physical inventory

the means of establishing the active inventory, including the source records that will be used in the computation NUREG-1280, Revision 2 88

10.7 Commitments and Acceptance Criteria In its MC&A plan, the licensee should provide definitive commitments that adhere to the regulatory requirements applicable to physical inventories. A finding that the licensees MC&A plan for conducting physical inventories is acceptable and in accordance with 10 CFR 74.59(f) will be based on, but not limited to, the following acceptance criteria:

An MC&A program will be maintained that is capable of confirming, at intervals not to exceed 185 calendar days, the presence of all SNM/SSNM expected to be present at a given time, based on the accounting ledgers, with the possible exception of waste materials transferred to (via DOE/NRC Form 741 transactions) and stored in holding accounts.

Each physical inventory listing will include all SNM/SSNM possessed on the inventory date, except for waste materials assigned to holding accounts (in accordance with the exception provided in 10 CFR 74.51(a)(2) and DOE/NRC Form 741 instructions). All listed SNM/SSNM quantities are to be based on measurements.

Unique identification for each item on inventory is provided and inventory records are maintained showing the identity, location, and quantity of SNM/SSNM for all such items.

All transfers of SNM/SSNM between designated internal control areas within the licensees site are documented.

Discrepancies in the identity, quantity, or location of items, objects, or containers of SNM/SSNM that are detected during a physical inventory will be corrected.

Procedures for tamper-safing containers or vaults containing SNM/SSNM are maintained and followed, which include control of access to, and distribution of, unused seals and records.

Procedures for confirming the validity of prior measurements associated with unencapsulated and unsealed items on ending inventory are maintained and followed.

Physical inventory procedures are maintained and followed to ensure the following:

The quantity of SNM/SSNM associated with each item on ending inventory is a measured value.

Each item on ending inventory is listed and identified to ensure that all items are listed more than once.

Cutoff procedures for transfers and processing are established so that all quantities are inventoried and none are inventoried more than once.

Cutoff procedures for records and reports are established so that all transfers for the inventory and material balance interval and no others are included in the 89 NUREG-1280, Revision 2

records for the material balance period in question.

Upon completion of the physical inventory, all book and inventory records, for total plant and individual internal control areas, are reconciled with and adjusted to the results of the physical inventory.

Measurements will be performed for element and fissile isotope on all quantities of SNM not previously measured.

Physical inventories are conducted according to written instructions for each physical inventory which do the following:

Assign inventory duties and responsibilities.

Specify the extent to which each internal control area and process is to be shut down, cleaned out, or remain static.

Identify the basis for accepting previously made measurements.

Designate measurements to be made for physical inventory purposes and the procedures for making such measurements.

The individual responsible for the conduct of the physical inventory is either free from potential conflicts of interest or is overchecked sufficiently to prevent compromising the validity of the physical inventory.

For each plant, physical inventories are conducted for all possessed SNM/SSNM at intervals not to exceed 185 calendar days.

Within 45 calendar days after the start of each physical inventory required by 10 CFR 74.59(f)(1)(i) and 10 CFR 74.59(f)(1)(v), the following actions should be taken:

For the material balance period terminated by the physical inventory, the ID and its associated SEID are calculated for both element and fissile isotope with respect to each applicable DOE/NRC material type code.

For each applicable DOE/NRC material type code, the book record of quantity of element and fissile isotope is reconciled and adjusted to the results of the physical inventory.

Any SEID estimate exceeding 0.1 percent of active inventory and any ID that exceeds three times the standard error and 200 grams of plutonium or U-233 or 300 grams U-235 is investigated and reported to the appropriate safeguards organizational unit within the NRCs Office of Nuclear Material Safety and Safeguards.

As an additional alternative to remeasurement of unsealed SNM/SSNM at physical inventory time, a program of routine process monitoring will be acceptable when the combination of the process monitoring program and the inventory procedures will achieve the same level of loss detection capability as that provided by a physical NUREG-1280, Revision 2 90

inventory in which all unencapsulated items are either tamper-safed or remeasured.

Any previously measured, but unsealed (or unencapsulated) SNM/SSNM that is on hand at the time of the physical inventory, and which is to be introduced into subsequent processing steps before inventory reconciliation, should be remeasured or have its prior measurement value confirmed by an acceptable alternative before the subsequent processing is initiated.

The SNM/SSNM content of groups of like items can be determined by averaging typical contents as determined by measurements of representative item samples of that material at the time of the inventory, if the licensee demonstrates that the SEID estimator includes any additional uncertainty resulting from this averaging method.

With respect to the processing of scrap generated in a prior period, the current period assigned value must be based on dissolver solution and dissolver residue measurements and not on the product of the scrap plant. This is because losses may occur during the separation and purification stage which should, in fact, be attributable to current period processing. Any difference between the prior period value and the value obtained from after dissolution plus residue measurements is to be treated as a prior period adjustment to the ID for the current period.

All SNM/SSNM values on the physical inventory listing must be based on measurements. Prior measurement values may be accepted for inventory provided they were determined on a measurement system subject to the licensees measurement control program and the containers were either tamper-safed, stored in an area that provided protection equivalent to tamper-safing, or encapsulated. Otherwise, the previously measured SNM/SSNM content of items on ending inventory must be verified by remeasurement.

Adjustments to reconcile the book inventory to the physical inventory will be in accordance with commonly accepted accounting practices, and the adjustments will be traceable and auditable.

The effect of prior period adjustments will be taken into account before the significance of the current period ID is assessed. Prior period adjustments could result from any of the following:

corrections of a recording or measurement error associated with material on beginning inventory

resolution within the current period of a statistically significant shipper-receiver difference involving material that was on beginning inventory

an adjustment to the initial receipt value pertaining to scrap, received in a prior period, resulting from a better measurement following dissolution of such scrap in the current period The appropriate procedure for dealing with biases not applied to individual items and for prior period adjustments is, for purposes of ID evaluation, to modify the ID quantity by adding or subtracting a quantity of SNM/SSNM equivalent to the net total of adjustments so as to obtain an adjusted ID that reflects the current period ID. ID bias corrections and prior period adjustments are not, however, applied as adjustments to the book inventory value.

91 NUREG-1280, Revision 2

When assessing the significance of current period material balance results by sequential analysis of prior period ID data, as required by 10 CFR 74.59(f)(1)(ii) whenever the ID exceeds three times the SEID, consideration should be given to the following relevant points:

The sequence of IDs used for analysis should possess essentially the same components as the current period. That is, the throughputs should be approximately the same (e.g.,

within plus or minus 25 percent), the same process units should be operational, and the process should not have undergone any major modifications. With respect to the unit operations, it is not essential that all units operate every period but rather that the grouping of IDs for analysis take into account which units were operative. As to process modifications, a major modification would be one that has a significant impact on measurement capabilities or holdup patterns. Significant means a change in the SEID of plus or minus 30 percent or greater.

The analysis of a sequence of IDs to establish a representative standard deviation must take into account the covariances that exist between adjacent (lag 1) and alternate (lag 2) pairs. The AMASS methodology (Lumb and Tingey, 1981) and INDEP (Lumb and Associates, 1986) provide two acceptable means of determining the historical standard deviations taking covariances into account.

The criteria against which the significance of a current period ID should be evaluated can be established by at least two different methods:

(1) The licensee could construct control chart limits using current and historical material balance closure data, where such limits for further action should be established at a level of significance of 0.01. The limits should be based on the statistical variance-covariance structure of the current ID and an appropriate sequence of previous IDs.

(2) The licensee could adopt three sigma control limits where sigma is determined as described in Chapter 9 of this document for the SEID.

In accordance with 10 CFR 74.59(f)(1)(i), the licensee must investigate excessive IDs. The following are actions that would be deemed appropriate as part of an investigation:

If the ID > 3 times SEID and 300 grams U-235 (200 grams plutonium or U-233), then the licensee should take the following actions:

(1) Review inventory listing to ensure that all items and item quantities have been listed and none listed more than once.

(2) Review measurement results for previously unidentified biases.

(3) Review inventory documentation and book records for human errors and make appropriate corrections.

(4) Review inventory documentation and book records for anomalies, and investigate any anomalies to determine the need for remeasurements.

(5) Review holdup estimates for reasonableness relative to historical data.

NUREG-1280, Revision 2 92

(6) Calculate a standard deviation (ID) representative of relevant historical ID performance.

If the ID < 3 times ID no additional investigative actions are needed.

If 5 FKG > ID > 3 ID:

(1) Compare material control test and item monitoring data with results of the physical inventory.

(2) Review results of trends analyses for all process units.

(3) Review conclusions of alarm investigations.

If 10 FKG > ID > 3 ID and 5 FKG, then the licensee should take the following actions:

(1) Compare material control test and item monitoring data with results of the physical inventory.

(2) Review results of trends analyses for all process units.

(3) Review conclusions of alarm investigations.

(4) Review plant security records.

(5) Conduct next inventory within 2 months or as directed by the NRC.

If the ID > 3 ID and > 10 FKG, then the licensee should take the following actions:

(1) Compare material control test and item monitoring data with results of the physical inventory.

(2) Review results of trends analyses for all process units.

(3) Review conclusions of alarm investigations.

(4) Review plant security records.

(5) Prepare facility for an immediate re-inventory.

(6) Remeasure a statistically determined sample of the items on hand at ending inventory for the material balance period in question that is sufficient to detect, with a 99 percent probability, at least one defective item if an actual loss of 5 FKG or more from the ending inventory quantity occurred. A defective item is one that has had some or all of its SNM/SSNM contents removed, and the quantity removed exceeds three times the combined standard error of measurement (when taking into account the measurement uncertainties of both the original measurement and the remeasurement.

93 NUREG-1280, Revision 2

(7) For shipments (other than waste) made during the period, contact the appropriate receivers and request shipper-receiver evaluation data. For those shipments not yet measured by the receiver, request immediate measurement and resulting shipper-receiver evaluation data. Review all shipper-receiver data for the period for possible biases, measurement errors, and loss indications.

The results of all physical inventories and of investigations and resolution actions following any excessive ID are recorded and auditable.

The licensee should describe any additional measures to be taken whenever a finalized ID (after applying any appropriate bias corrections and prior period adjustments) exceeds both three times the SEID and 200 grams of plutonium or U-233, or 300 grams of U-235 contained in highly enriched uranium, and the ID is not resolved within the reconciliation period of 45 calendar days. For example, the additional measures could include halting all SNM/SSNM processing. (Note: This applies to both positive and negative ID values.)

The concept of active inventory is adequately described and represents the quantity of material typically handled under normal plant operating conditions.

NUREG-1280, Revision 2 94

11. SHIPMENTS AND RECEIPTS 11.0 Regulatory Intent The intent of the 10 CFR 74.59(h)(1) shipments and receipts requirement is to ensure accurate identification and measurement of the quantities of SNM/SSNM shipped and received and to promptly detect and resolve all significant shipper-receiver differences. Timely and accurate quantification of the SNM/SSNM content of shipments and receipts is an essential component of an effective MC&A program. Shipper-receiver comparisons, on both an individual batch basis and on a total shipment basis, are important for confirming that either the shippers and receivers values are acceptable for establishing the book accounting quantities associated with received material or detecting unacceptable shippers or receivers values.

11.1 Receiving Procedure The first action to be taken upon receipt of SNM/SSNM should be the verification of the number of items, the item identities, and the integrity of individual items and the TIDs. In addition, SNM/SSNM receipts should be measured for total quantity (mass), element concentration (such as for PuO2, UO2, or uranyl nitrate solutions), and fissile isotope abundance (U-235 or U-233).

The validity of the shippers data should be substantiated with appropriate and timely receiver checks and measurements, including gross weight, adequate sampling techniques, NDA measurements (if appropriate), and destructive measurements (scrap excepted).

The MC&A plan should describe how materials are received, stored, and measured. The latter should include a description of the sampling techniques employed.

For any SNM/SSNM received, the licensee must provide all appropriate information on the DOE/NRC Form 741 that accompanies the shipment, in accordance with 10 CFR 74.15, Nuclear Material Transaction Reports. (Note: See NUREG/BR-0006, Instructions for Completing Nuclear Material Transaction Reports (DOE/NRC Forms 741 and 740M), for instructions and requirements for completing DOE/NRC Form 741.)

11.2 Evaluation of Shipper-Receiver Differences When shippers measurement uncertainty (or standard error) information is available, the following equation should define the combined measurement standard error:

combined standard error = [(S)2 + (R)2]1/2 where S = shippers measurement standard error R = receivers measurement standard error If the shipper's measurement uncertainty values are not available, the receiver can assume that the shippers measurement uncertainty is equal to (but no greater than) its own uncertainty. In NUREG-1280, Revision 2 96

this situation (i.e., both shipper and receiver have the same measurement uncertainty), the following equation reflects the combined measurement standard error:

combined standard error = [ 2 (R)2]1/2

= 1.414 R The difference between the shippers value and the receivers value, in terms of the total shipment, must be regarded as significant whenever the shipper-receiver difference exceeds twice the combined standard error and the larger of 0.5 percent of the amount of SNM/SSNM in the container, lot, or shipment or 50 grams of SSNM.

The MC&A plan should describe the method for evaluating shipper-receiver differences and investigating these differences if they are significant. The description should include the following:

the method of establishing the standard deviation of the shipper-receiver difference estimator under conditions when the shippers uncertainty estimate is available and when it is unavailable

the conditions under which a referee laboratory is involved and the criteria for selecting a referee laboratory

the bases established for concluding that a significant difference is resolved

the procedure for adjusting book records to accommodate resolution of the difference

the procedure for establishing and resolving differences involving scrap 11.3 Shipping Procedure The MC&A plan should describe the preparation and certification procedures for shipping SNM/SSNM. The description should include the following:

the measurement data and tamper-safing information provided to the group responsible for SNM/SSNM shipments

the cross-checks, including any item checks or measurements, made by the shipping group

the types of records maintained by the shipping group 11.4 Commitments and Acceptance Criteria In its MC&A plan, the licensee should provide definitive commitments that adhere to the regulatory requirements applicable to shipments and receipts. A finding that the licensees MC&A plan for processing shipments and receipts is acceptable and in accordance with 10 CFR 74.59(h)(1) will be based on, but not limited to, the following acceptance criteria:

Receipts are inspected promptly to verify the validity of the shipper's data. The following times are acceptable for completing the verification measures:

97 NUREG-1280, Revision 2

item verification24 hours seal integrity24 hours gross weight72 hours NDA measurements (if appropriate)120 hours0.00139 days 0.0333 hours 1.984127e-4 weeks 4.566e-5 months destructive measurements (scrap excepted)30 days

Times other than those indicated above would be acceptable with adequate justification.

Shippers values may be accepted and booked without receiver verification measurements for encapsulated items (e.g., fuel rods and elements), if an NDA measurement is not feasible. However, an exemption from 10 CFR 74.59(d)(1) would be necessary.

The investigation of statistically significant shipper-receiver differences should normally be completed within 3 months except when the difference exceeds 5 FKG. In the latter case, the discrepancy should be resolved within 30 days of the time that its existence is determined.

The NRC is to be notified of any inability to resolve any statistically significant shipper-receiver difference that exceeds the larger of either 50 grams SSNM or 0.50 percent of the SSNM quantity involved. Such notification is to be made within 30 days following the receipt of the material for differences that equal or exceed 5 FKG and within 90 days for differences that are less than 5 FKG.

The following stepwise analysis is an example of an acceptable approach for investigating a significant shipper-receiver difference:

The receiver reviews its data to check for possible entry errors, such as an incorrect number or the transposition of numbers.

The receiver then reviews source data, including the basic calculations and the associated measurement control data.

Assuming the difference remains unresolved, the receiver remeasures the SSNM content of the receipt.

If remeasurement fails to resolve the difference, the shipper is notified and requested to conduct a similar investigation.

If the two parties fail to resolve the difference, a referee laboratory should be involved. The shipper and receiver should mutually agree on the sampling procedure.

Unless contractual requirements dictate otherwise, the value closest to the referee's value is accepted and booked by both parties. If the referees value is NUREG-1280, Revision 2 98

not within statistical limits of either the shipper or receiver, but lies between the two, the referees value is used.

For purposes of shipper-receiver evaluation, a lot may be defined in several ways, including the following:

multiple containers of a material that has been blended by a procedure that has been demonstrated to produce a homogeneous product multiple containers filled from a master container of homogeneous material (e.g.,

UF6 cylinders) a quantity of scrap transferred on multiple transfer receipts (DOE/NRC Form 741) but combined for processing through recovery

The documentation of shipments and receipts should be completed and transmitted within the time specified in NUREG/BR-0006.

Only acceptable tamper-safing methods will be used, as described in Chapter 15 of this document and as agreed to with the receiver.

Results of shipper-receiver difference investigations, including corrective actions, are documented and retained for at least 3 years.

The element and isotopic content of SSNM shipped by the licensee are based on measurements obtained from measurement systems subject to the measurement control program.

99 NUREG-1280, Revision 2

12. SCRAP CONTROL 12.0 Regulatory Intent The intent of the 10 CFR 74.59(h)(2) scrap control requirements is to ensure that the regular processing of scrap with relatively large measurement uncertainties precludes such scrap being the source of a problem at the time of physical inventories. Inaccurate scrap measurements could cause an apparent ID or conceal a theft or diversion. Segregation of internally generated scrap from that received from off site until accountability is established ensures that potential anomalies in assigned values will be attributed to the appropriate facility. The licensee must establish a scrap control system that ensures that internally generated scrap is segregated from scrap from other licensees or contractors until accountability is established. The scrap control system should ensure that any scrap with a measurement standard deviation greater than 5 percent of the measured amount is recovered so that the results are segregated by inventory period and recovered within 185 calendar days of the end of the inventory period in which the scrap was generated, except where it can be demonstrated that the scrap measurement uncertainty will not cause noncompliance with 10 CFR 74.59(e)(5).

12.1 Location The MC&A plan should identify the scrap and waste quantities of contained SSNM with respect to source, storage, and disposition. The licensee may refer to process flow charts and plant operations descriptions included in the annex to the plan.

12.2 Processing The MC&A plan should describe the system for in-house processing of scrap, including recovery plant capacity, rate of recovery, and the estimated amount of scrap expected to be on hand at any given time. The plan should also describe any plans for shipments and for offsite recovery of scrap, as well as procedures for the control and discard of wastes containing SSNM, including procedures and capabilities for storage before discard.

12.3 Measurements The MC&A plan should describe the procedures for determining the SSNM content of scrap and waste, including the criteria and procedures for segregation, identification, and classification of various kinds of scrap to facilitate measurement. The plan should identify the types and quantities of scrap expected to have measurement uncertainties greater than plus or minus 5 percent (1).

12.4 Inventory Control The MC&A plan should describe scrap control measures that will be implemented to ensure that scrap measured with a measurement standard deviation greater than plus or minus 5 percent does not remain on inventory longer than 185 calendar days beyond the inventory period in which it was generated or that the measurement uncertainty associated with the scrap on hand will not cause noncompliance with 10 CFR 74.59(e)(5).

NUREG-1280, Revision 2 100

12.5 Recovery of Offsite Scrap The MC&A plan should describe procedures that the licensee will implement to ensure that scrap received for recovery from off site is segregated until accountability is established. The description should address segregation during storage and processing.

12.6 Commitments and Acceptance Criteria In its MC&A plan, the licensee should provide definitive commitments that adhere to the regulatory requirements applicable to scrap control. A finding that the licensees MC&A plan for processing scrap is acceptable and in accordance with 10 CFR 74.59(h)(2) will be based on, but not limited to, the following acceptance criteria:

Storage locations for scrap and waste are identified. Scrap and waste generation rates are estimated for each process unit. Methods for disposition of waste are described.

A comparison of generation rates and recovery capacity indicates that adequate recovery capability exists to preclude the buildup of excess amounts of scrap.

Special handling procedures for waste, such as conversion to a better measurable form or independent measurement verification, are described.

Proposed measurement techniques for specific scrap types are described, including the following where appropriate:

- material description

- specific NDA system to be employed

- container size

- mixing and blending operations

- sampling technique

- assay procedure

An estimate of the measurement uncertainties associated with each scrap type is included in the annex to the MC&A plan.

For those materials measured by NDA in 30-gallon drums or larger containers, the licensee should commit to an annual evaluation to demonstrate the continuing reliability of the measurement system. Possible evaluation techniques include a destructive analysis of a previously NDA-measured 30-gallon drum, a second NDA technique not subject to the same potential interferences as the primary technique, or a standard addition procedure.

101 NUREG-1280, Revision 2

The program segregating scrap generated off site from onsite scrap should be adequate to protect against commingling. Possible techniques to achieve this objective include the following:

- Retain customer scrap in shipping containers before recovery.

- Isolate customer scrap in a particular section of a vault or permanently CAA.

- Identify designated storage bins or shelves for application of limited access controls.

Where offsite recovery is utilized, the description of the program should include, at a minimum, the following information:

- types and estimated quantities of scrap to be shipped

- contractors program to ensure segregation of customer scrap

- basis for establishing accountability values

- contractor and shipper measurement responsibilities

- means of performing shipper-receiver comparisons

Segregation of customer scrap during processing is accomplished by cleaning the dissolver and accountability weigh tank before and after the recovery campaign.

Additional processing of dissolver residues should be handled in the same manner, unless the quantity involved is less than 1 FKG or the measurement uncertainty is less than plus or minus 5 percent at the one sigma level.

Scrap and waste will only be stored in approved locations and disposal of by approved methods.

Adequate onsite recovery capacity and adequate provision for offsite recovery exist to ensure compliance with the requirements of 10 CFR 74.59(e)(5).

Listed quantities of scrap and waste present during a physical inventory will be derived from measurements when possible. Otherwise, such SSNM quantities will be based on average historical factors, which in turn are derived from measurements performed on each type of scrap and waste in question.

Methods used to measure scrap and waste are subject to the measurement control program described in Chapter 8 of this document.

Scrap control procedures are in place that provide for (1) segregation of offsite scrap receipts from one another and from onsite-generated scrap until accountability and shipper-receiver differences have been established and (2) segregation of onsite-generated scrap by plant (when a licensee has more than one onsite plant) until after dissolution plus residue measurements are obtained.

103 NUREG-1280, Revision 2

13. ASSESSMENT AND REVIEW OF THE MATERIAL CONTROL AND ACCOUNTING PROGRAM 13.0 Regulatory Intent The intent of the 10 CFR 74.59(h)(4) assessment requirements is for the licensee to independently assess the MC&A program. It is intended that the review will be performed by knowledgeable, technically competent individuals free from conflicts of interest and that the deficiencies will be brought to the attention of plant management so that they will be corrected.

It should be emphasized that this review process is intended to be much more than a routine audit for compliance with existing procedures and commitments. Conclusions and recommendations relative to overall program effectiveness and to the adequacy of the program, including that of any contractor who performs SNM/SSNM measurements as part of the licensees MC&A program, to meet and satisfy regulatory intent should be made.

As required by 10 CFR 74.59(h)(4), licensees must perform independent assessments every 12 months to evaluate the performance of the MC&A program, review its effectiveness, and document managements action on prior assessment recommendations. Assessments must include an evaluation of the measurement control program of any outside contractor laboratory performing MC&A measurements for a licensee, unless the contractor is also subject to the requirements of 10 CFR 74.59(e).

13.1 General Description The licensee should independently review and assess the capabilities, performance, and overall effectiveness of its MC&A program at least every 12 months. The MC&A plan should describe the assessment and review program in terms of the following:

maximum interval between assessments

selection procedures for the assessment team

number of team members to be selected

qualification and expertise of team members

independence of individual team members from the MC&A responsibilities and activities they are reviewing and assessing

maximum elapsed time and minimum actual effort to be used for completion of the assessment and issuance of a final team report Generally, the entire MC&A program should be reviewed and evaluated during each assessment. When this occurs, intervals between assessments can be as much as 12 calendar months. However, if individual assessments only cover part of the MC&A program, individual subsystems should be assessed at intervals no greater than 6 calendar months. Thus, the type of assessment (partial or total) and the maximum interval between assessments should be specified. Interval means the elapsed time between either the start of or termination of successive assessments.

NUREG-1280, Revision 2 104

The responsibility and authority for the assessment program should be at least one level higher in the licensees organizational structure than that of the MC&A manager. Such responsibility should include selecting the assessment team leader and initiating corrective actions. Team members may be selected from the facility staff or from outside, but an individual member should not participate in the assessment of the parts of the MC&A program for which he or she has direct responsibility. Hence, the MC&A manager may not be a team member. Also, a given individual should not assess the parts of the program that are the responsibility of another team member if the other team member is assessing the given individuals area. The leader of the assessment team should have no responsibilities for managing any of the MC&A elements being assessed.

The actual number for any given assessment should depend on the knowledge and expertise of the team relative to MC&A activities and their experience in conducting assessments.

Personnel assigned to the assessment team should have demonstrated an understanding of the regulatory objectives and requirements of the MC&A program and should have sufficient knowledge and experience to be able to judge the adequacy of the parts of the program they review. The team should have authority to investigate all aspects of the MC&A program and should be given access to all necessary information.

To provide a meaningful and timely assessment, the review and evaluation process should not be protracted. The actual review and investigation activities should be completed in 30 calendar days, with an additional 15 calendar days allowed for completing and issuing a final team report.

13.2 Report of Findings and Recommendations The areas to be reviewed should encompass the entire MC&A program, and the level of detail of the reviews should be sufficient to ensure that the assessment team has made an adequate and reasoned judgment of the MC&A program effectiveness. The team report, at a minimum, should state findings pertaining to the following:

organizational effectiveness to manage and execute MC&A activities

management responsiveness to indications of possible losses of uranium

staff training and competency to carry out MC&A functions

reliability and accuracy of accountability measurements made on SNM/SSNM

effectiveness of the measurement control system in monitoring measurement systems and its sufficiency to meet the requirements for controlling and estimating both bias and SEID

soundness of the material accounting records

effectiveness of the process monitoring system in monitoring the status of material in process and detecting abrupt loss of SSNM

effectiveness of the item monitoring system in tracking and providing current knowledge of items 105 NUREG-1280, Revision 2

effectiveness of alarm resolution

capability to promptly locate items and effectiveness in doing so

timeliness and effectiveness of shipper-receiver difference evaluations and resolution of excessive shipper-receiver differences

soundness and effectiveness of the inventory-taking procedures

capability to confirm the presence of SNM/SSNM

capability to detect and resolve indications of missing SNM/SSNM On completion of each assessment, the findings and recommendations for corrective action, if any, should be documented. The written report should be distributed to the plant manager, the MC&A manager, and other managers affected by the assessment.

13.3 Management Review and Response to Report Findings and Recommendations Management should review the assessment report and take the necessary actions to correct MC&A program deficiencies. The management review should be documented within 30 days following the submittal of the assessment teams report, and it should include a schedule for the correction of deficiencies. Corrective actions, if any, that pertain to daily or weekly activities should be initiated promptly after the submittal of the final assessment report.

The MC&A plan should address resolution and followup actions associated with concerns identified in the assessment report. The plan should specify the individuals responsible for resolving identified concerns and the timeliness of such resolution.

13.4 Commitments and Acceptance Criteria In its MC&A plan, the licensee should provide definitive commitments that adhere to the regulatory requirements applicable to the independent assessment of the MC&A program. A finding that the licensees MC&A plan for independently assessing the effectiveness of the MC&A program is acceptable and in accordance with 10 CFR 74.59(h)(4) will be based on, but not limited to, the following acceptance criteria:

Independent assessments of the total MC&A program are performed at intervals not to exceed 12 calendar months and assess the performance of the program, review its effectiveness, and document managements action on prior assessment recommendations and identified deficiencies. Such assessments must include a review and evaluation of any contractor who performs SNM accountability measurements for the licensee, in accordance with 10 CFR 74.59(h)(4).

The periodic assessments will be comprehensive and sufficiently detailed to enable the assessment team to rate the MC&A program accordingly. The overall assessment objectives are to determine whether the MC&A program, as designed and implemented, is continuing to meet the general performance objectives and to identify weaknesses or deficiencies in the program design or performance that may need correcting.

NUREG-1280, Revision 2 106

The areas to be reviewed encompass the entire MC&A program and the level of detail of the reviews is sufficient to ensure that the assessment team has adequate information to make reasoned judgments of the MC&A program effectiveness. The following areas should be evaluated:

organizational effectiveness and management responsiveness to indicators of possible SNM/SSNM losses effectiveness of the process monitoring, item monitoring, and alarm resolution programs to detect any abrupt SSNM loss in a timely manner staff training and competency to carry out MC&A functions soundness of the material accounting records capability to promptly locate items timeliness and effectiveness of shipper-receiver difference evaluations and resolution of significant shipper-receiver differences soundness of physical inventory procedures and practices effectiveness of the measurement control system to monitor key measurement systems, establish bias estimates and measurement uncertainties, and meet the requirements for controlling the total MC&A measurement uncertainty associated with ID, in accordance with 10 CFR 74.59(e) and 10 CFR 74.59(f) capability to confirm the presence of SNM/SSNM capability to investigate and resolve anomalies and aid in any Government-led investigation pertaining to missing SNM/SSNM and to provide information that would aid in the recovery of missing SNM/SSNM

Generally accepted auditing principles are used to check each type of record in which a representative sample (of a sufficient number) of randomly selected records is examined.

Personnel assigned to the assessment team have an adequate understanding of the regulatory objectives and requirements of the MC&A program and have sufficient knowledge and experience to be able to judge the adequacy of the parts of the program they are asked to review. The team has authority to investigate any aspect of the MC&A program and has access to all relevant information.

An individual team member will not participate in the assessment of any part of the MC&A program for which he or she has direct responsibility. Also, an individual A will not assess any part of the program that is the responsibility of person B, if person B is assessing an area under the responsibility of individual A.

The entire MC&A program will be reviewed and evaluated during each single assessment (to be completed within an elapsed time that is short relative to the time 107 NUREG-1280, Revision 2

between changes in the MC&A program and is demonstrated to be able to include any such changes made during the review and assessment). Conducting two or more assessments during a 12-month interval, in which only part of the MC&A program is covered in each, is not deemed acceptable. That is, reviewing a single component of the MC&A program at 12-month intervals is not meaningful unless knowledge is obtained of how well the other components currently interact. Piecemeal review and evaluation is permissible, however, if each subprogram is covered at 6-month (or less) intervals.

The leader of the assessment team will have no responsibilities for performing or managing the functions being assessed.

The responsibility and authority for the assessment program and for initiating corrective actions should be (1) at least one level higher in the organization than the MC&A manager or (2) at a level equal to that of the onsite plant manager.

Reviews and assessments are performed either by qualified individuals from outside or qualified individuals from inside the facility organization whose work assignments and positions within the organization will not impair their ability to make objective judgments of the MC&A program capabilities and performance.

Each overall review and assessment will be conducted and completed in a timeframe that is short with respect to the time for changes to have occurred in the MC&A program and will include any such changes made during the time the review and assessment is being conducted.

The completion date for any review and assessment is defined as the date when the team submits its final written report (of findings and recommendations) to plant management. The start date is the first day in which one or more team members actually inspect records or interview MC&A personnel. Such start date will be documented.

The results of the assessment and recommendations for corrective action, if any, will be documented and reported to the plant manager and other managers affected by the assessment. Management will review the assessment report and take the necessary actions to correct MC&A program or system deficiencies. Such corrective actions (if any) that pertain to daily or weekly activities will be initiated within 40 calendar days following the submittal of the review and assessment final report.

Managements response to recommendations from the review and assessment, including any corrective actions ordered by management and the expected timeframe for completing such actions, will be documented within 30 calendar days following the submittal of the teams report.

NUREG-1280, Revision 2 108

109 NUREG-1280, Revision 2

14. DESIGNATION OF MATERIAL BALANCE AREAS, ITEM CONTROL AREAS, AND CUSTODIANS 14.0 Regulatory Intent The intent of the requirement to designate MBAs, ICAs, and assign custodial responsibilities in 10 CFR 74.59(h)(5) is to ensure that licensees establish various material control boundaries to minimize the occurrence of, and facilitate resolution of, MC&A anomalies, such as excessive IDs, missing items or nuclear material, and potential theft or diversion of nuclear materials. The intent is also to ensure that there is a designated individual who is responsible for having knowledge of the placement and movement of SNM/SSNM within a specified area and transfers into and out of the area. Such an individual should be vested with the authority to obtain the information necessary to accomplish his or her task and to ensure that activities are carried out in accordance with approved policies and procedures.

As required by 10 CFR 74.59(h)(5), a licensee must designate one or more MBAs, or a combination of one or more MBAs and one or more ICAs, and assign custodial responsibility in a manner that ensures that such responsibility can be effectively executed for all SNM/SSNM possessed under license. This regulatory provision provides flexibility for licensees to determine the appropriate MBA or ICA structures and design these areas as needed, thus enhancing the licensees capability to deter or detect unauthorized movement or removal of SNM/SSNM at the licensees facility.

14.1 Material Control Boundaries For accounting and control purposes, a facility is usually divided into a number of MBAs or ICAs in order to simplify the administrative controls and localization of material or item losses. The main purpose of an MBA or ICA is to know how much material or items should be in that area and to verify and monitor the material or items in that area. If the facility is small enough, or the number of material or item movements is small, one MBA or ICA may be sufficient. When there is a need to establish more than one MBA or ICA, the subdivision should be done according to the following practices:

Each MBA or ICA should be defined by a physical boundary

Any location in the facility should belong to one and only one MBA or ICA

Custodial responsibility within one MBA or ICA should be clearly assigned (i.e., to a single individual)

MBA or ICA subdivision should be implemented taking into account the material movements carried out in the areas and the administrative responsibilities involved.

The MC&A plan should describe how the licensee establishes various material control boundaries to minimize the occurrence of, and facilitate resolution of, MC&A anomalies.

Examples of such anomalies are excessive IDs, missing items of SNM/SSNM, and potential theft or diversion of SNM/SSNM. Regardless of the number and size of MBAs and ICAs used for control and accounting purposes, the structure should be clearly described and properly documented, including boundaries for each area and categories of material in each area. A type of MBA or ICA is exemplified by a storage area or a receiving and shipping area where items are received, stored, and released. Another type of MBA or ICA is one in which items or material batches are received and modified by a process (e.g., mixing, blending, or physical and chemical transformations).

NUREG-1280, Revision 2 110

Because MBAs and ICAs are important foundations for controlling and accounting for all SNM/SSNM in a facility, the MC&A plan should describe the process for how their locations are chosen. An MBA or ICA should correlate to physical or administrative boundaries and monitored locations. An MBA or ICA should be designed to limit losses to a specific area (i.e.,

the MBA should not be so large that it cannot localize inventory or process differences to a manageable level). In addition, an MBA or ICA should be designed such that the quantity of material or items in each movement into or out of each area can be determined, and the quantification of the physical inventory of material or items in each area can be determined, when necessary. For increased capability, smaller areas make control of material easier and reduce the size of the area to which an unauthorized removal or loss can be attributed. Each item or material batch at the facility should be assigned to an MBA or ICA and not to more than one MBA or ICA. Materials transferred into and out of an MBA or ICA must have quantitative measurements, as specified in the definitions of MBAs and ICAs in 10 CFR 74.4.

The MC&A plan should identify the areas into which the facility will be divided to ensure that custodianship can be effectively executed. Clarification can be provided by reference to facility drawings included in the annex to the MC&A plan.

14.2 Custodians The MC&A plan should describe the roles and responsibilities of the custodians for MBAs and ICAs. Each custodian should have direct interaction with the MC&A organization, and such individuals should be located within the physical operations area. When material is moved from one MBA or ICA to another, custody of the material and responsibility for its movement should be transferred from one custodian to another. Custodians who are responsible for more than one MBA or ICA should not have the authority to make material transfers between MBAs or ICAs which are under their direct control.

14.3 Commitments and Acceptance Criteria In its MC&A plan, the licensee should provide definitive commitments that adhere to the regulatory requirements applicable to designation of MBAs, ICAs, and custodians. A finding that the licensees MC&A plan for designation of MBAs, ICAs, and custodians is acceptable and in accordance with 10 CFR 74.59(h)(5) will be based on, but not limited to, the following acceptance criteria:

MBAs and ICAs should have a defined physical or administratively controlled area which allows for the physical and administrative control of nuclear materials such that the quantity of nuclear materials being moved into or out of the MBA is a measurement-based assigned value for element and isotope contents.

Except for the stipulations that all SNM/SSNM crossing custodial area boundaries must be measured in accordance with 10 CFR 74.4 and that custodians must be able to effectively execute their duties, there are no restrictions on how large an area can be.

However, different MAAs should have different custodians, and within an MAA, areas with widely divergent functions should have different custodians. An example of the latter situation would be a fabrication plant in which bulk material is handled in one area in the preparation of the fuel component of an element, and a second area is involved with machining and preparation of the element for higher tier fabrication.

111 NUREG-1280, Revision 2

A current listing of designated custodians and alternates should be maintained.

Custodians should be familiar with SNM/SSNM processing activities as well as MC&A functions. A minimum of 1 year of experience in each of these areas is desirable.

Custodians should not be production or process operations personnel so as to preclude the possibility of conflicts of interest.

MBAs and ICAs are established in such a way as to minimize the occurrence of, and facilitate the resolution of, MC&A anomalies.

MBA and ICA structures are properly documented and clearly described, including physical boundaries and categories of material in the individual MBA or ICA.

Custodians responsible for more than one MBA or ICA are not authorized to transfer material between MBAs and ICAs under their control to prevent misuse.

The SNM/SSNM processing facility is subdivided into a sufficient number of areas to ensure that custodial responsibilities can be effectively executed.

A custodian and a minimum number of alternates are designated for each area subdivision.

Clear directions should be provided on transferring material between MBAs or ICAs to help deter and detect unauthorized removal or substitution of material during movement.

Material transfers should be recorded in a timely manner.

Control measures should be appropriate for material relocations within an MBA or ICA and update to the records system should be made to reflect material relocations.

NUREG-1280, Revision 2 112

113 NUREG-1280, Revision 2

15. TAMPER-SAFING 15.0 Regulatory Intent The intent of the 10 CFR 74.59(f)(2)(i) tamper-safing provision is to require the establishment, maintenance, and protection of a tamper-safing program that will demonstrate that the licensee maintains and follows procedures for tamper-safing of containers or vaults containing SNM/SSNM or utilized for ensuring the validity of prior measurements. The program should include control of access to, and distribution of, unused seals and records which document the distribution, application, and destruction of tamper-safing devices, as well as routine inventory of unused tamper-safing devices. Records are to be retained for at least 3 years (or longer if specifically required by regulations external to 10 CFR 74.51), thereby providing a means for assessing the performance of the tamper-safing program and inspecting for compliance with regulatory requirements.

15.1 Characteristics of Tamper-Safing Devices Tamper-safing devices on containers or vaults is one level of protection used to secure the integrity of SNM/SSNM either when it is in transit or stored on site. The one overriding objective of TIDs is to ensure that no tampering or entry has occurred while the TID is on the container.

Therefore, for MC&A purposes, the degree of confidence in the selection of a TID sealing system will vary depending on its unique characteristics and intended use.

When selecting tamper-safing devices, licensees should consider the following:

Intended usethe determination the tamper-safing device is appropriate for the tamper-safing of the container and withstanding the working environment (i.e.,

temperature, moisture, repeated handling, dirt)

Applicationthe relative ease or difficulty of physically applying the tamper-safing device

Substitutionthe ability of a tamper-safing device to be destructively removed and replaced by new seals without detection

Removal and reapplicationthe ability of a tamper-safing device to be removed and reapplied without detection

Alteration of label datathe ability to alter recorded data on the tamper-safing device without the alteration being apparent

Integrity verificationthe degree of effort required to verify that the tamper-safing device is intact or indicates tampering The licensee should confirm a manufacturers claims that the removal of the seal is not possible without detection by testing potential tamper-safing devices to see whether they can be removed from the containers on which they are to be used. The licensee should confirm the results by following the manufacturers documented procedures and the samples used. The experiments should be documented, both with regard to what techniques were used to attempt to defeat the tamper-safing device and observations as to the degree of success in defeating NUREG-1280, Revision 2 114

the tamper-safing device. In lieu of testing by the licensee, similar tests conducted by an independent third party may be considered acceptable.

15.2 Use of Tamper-Safing Devices The MC&A plan may allow the use of tamper-safing devices to do the following:

Ensure the long-term validity of measurement data. The application of a tamper-safing device to an item containing measured quantities of nuclear materials may allow the licensee to maintain the validity of the original measured value, thus eliminating or decreasing the frequency of the need to remeasure the items to verify its nuclear material content.

Reduce the effort to conduct physical inventories or item control activities. The application of a tamper-safing device to a container housing multiple items may allow the licensee to maintain the validity of containers contents, thus minimizing the number of items required to be verified during a physical inventory or item control activity.

Provide assurance of integrity of in-transit material. The application of a tamper-safing device to a shipping container may allow the licensee to maintain the validity of the shipping containers contents and provide assurance that the integrity of the shipment has not been violated. To achieve this goal, the shipper should apply the tamper-safing device to the shipping container, verify the integrity of the tamper-safing device shortly before departure of the shipment, and provide the appropriate information (i.e., shipping container serial numbers, tamper-safing device type, and serial number) to the receiver.

Upon receipt of the shipment, the receiver should verify the shipping container serial numbers, tamper-safing device type, serial number, and tamper-safing device integrity.

Any discrepancies should be considered an MC&A anomaly and be addressed by the facilitys MC&A resolution program.

15.3 Description of Tamper-Safing Records The tamper-safing system should identify all records, forms, reports, and standard operating procedures used throughout the system. Such records should include, but are not limited to, the following:

receipt of purchased TIDs

issuance of TIDs

identification of the person applying the TIDs

identification of the person who is verifying the application of the TID

identification of the container to which the TID was applied, including the TID serial identification (if applicable)

removal and destruction of TIDs 115 NUREG-1280, Revision 2

routine inventory of unused and unissued TIDs

identification of roles and responsibilities, including the following:

designation of the TID control officer personnel approved to apply, verify, and destroy TIDs

training of personnel in the application, verification, and destruction of TIDs 15.4 Commitments and Acceptance Criteria The acceptability of a TID is based on an evaluation of the attributes of the device in relation to time to defeat the tamper-indicating features. The NRC has already deemed the following TIDs acceptable: Type E, pressure-sensitive, tamper-evident wire seals, fiber optic seals, and steel padlocks. Other tamper-safing devices may be equally acceptable. Licensees proposing to use TIDs not currently approved by the NRC must provide the appropriate information, including references, to enable licensing reviewers to assess the adequacy of the proposed TID type.

In its MC&A plan, the licensee should provide definitive commitments that adhere to the regulatory requirements applicable to the use of TIDs. A finding that the licensees MC&A plan for tamper-safing is acceptable and in accordance with 10 CFR 74.59(f)(2)(i) will be based on, but not limited to, the following acceptance criteria:

Unissued TIDs are stored in a locked container within a room that is locked when unoccupied or in an approved repository.

Blocks of TIDs issued to designated individuals are stored in a locked container within a room that is locked when unoccupied or in an approved repository.

Preferably a single individual, but no more than three individuals, none of whom have any responsibility for seal application or destruction, is designated as the TID control officer.

When TIDs are not in storage they are in the possession of authorized individuals (i.e.,

the TID control officer or person responsible for applying the TID). The number of available TIDs issued to these individuals should be limited to a single days use.

The licensee has in its possession a commitment from the seal manufacturer that plates or dies, or both, and production residuals are controlled and protected.

Upon removal, TIDs are destroyed (i.e., crimped, flattened, or otherwise rendered unusable) and properly disposed.

Only TIDs that are controlled and accounted for are used to maintain the validity of previously established SNM/SSNM quantities associated with items.

TIDs are only applied and removed by individuals authorized for that purpose.

NUREG-1280, Revision 2 116

Unused TIDs are controlled and inventoried.

Written procedures are maintained to ensure that individuals authorized to handle TIDs are properly trained.

Records of TID application, verification, removal, and destruction are documented, and control measures are implemented to prevent alteration of records concerning containers protected by TIDs.

117 NUREG-1280, Revision 2

16. RESOLVING INDICATIONS OF LOSS, THEFT, DIVERSION, OR MISUSE OF SPECIAL NUCLEAR MATERIAL AND STRATEGIC SPECIAL NUCLEAR MATERIAL 16.0 Regulatory Intent The intent of the 10 CFR 74.3(b) and 10 CFR 74.3(c) general performance objectives is that licensees be able to promptly detect, investigate and resolve indications of possible loss, theft, diversion, or misuse of SNM/SSNM, whether arising from errors or deliberate actions.

16.1 Methods and Procedures for Identifying Indicators The MC&A plan should discuss the means by which the licensee will resolve indicators of a possible loss, theft, diversion, or misuse of SNM/SSNM. The licensees resolution program should address the possible indicators of missing material. The MC&A plan should enumerate potential indicators that can be postulated and develop resolution procedures for each. Any anomaly could potentially be an indicator of loss, theft, diversion, or misuse of SNM/SSNM. An anomaly is an unusual observable condition (such as excessive discrepancies, missing items, broken TIDs, or other possible indicators) which might result from the theft, diversion, or other misuse of SNM/SSNM. The terms indicator and anomaly may be used interchangeably to describe a condition that may require further investigation to determine whether an actual loss, theft, diversion, or misuse of SNM/SSNM occurred.

The following are examples of possible indicators of missing SNM/SSNM:

lack of agreement between a physical inventory and its associated book inventory in which the ID is positive and exceeds three times the SEID and more than 300 grams of U-235 or 200 grams of plutonium or U-233

determination through the item control system that one or more items are not in their designated locations and the actual locations are not immediately known

discovery that an items integrity or its TID was compromised

information from the process control system indicating potential loss of material from the process system

an allegation of theft or diversion 16.2 System and Procedures for Investigating and Resolving Loss Indicators One or more MC&A procedures should address the system and practices for investigating and resolving loss indicators. The licensee should have well-defined procedures for promptly investigating and resolving indications of possible missing SNM/SSNM and procedures for rapidly determining whether an actual loss of SNM/SSNM has occurred. These procedures should include criteria for determining when an investigation of loss indicators can be concluded.

Resolving a loss indicator means that the licensee has determined that loss, including possible diversion or theft, has not occurred and is not occurring. For each type of indicator, the licensee NUREG-1280, Revision 2 118

should develop detailed resolution procedures and should describe or outline them in the MC&A plan.

Any investigation of an indication of a loss or theft should provide, whenever possible (1) an estimate of the quantity of SNM/SSNM involved, (2) the material type or physical form of the material, (3) the type of unauthorized activity or event detected, (4) the timeframe within which the loss or activity could have occurred, (5) the most probable cause, and (6) recommendations for precluding reoccurrence.

For indications that a loss or theft may have occurred, the resolution process should include (1) thoroughly checking the accountability records and source information, (2) locating the source of the problem, (3) isolating the exact reason for the problem within the area or processing unit, (4) determining the amounts of SNM/SSNM involved, and (5) making a determination that the indication is or is not resolved. The resolution procedures should be prepared so that no individual who could have been responsible for the potential loss would also be responsible for its resolution. If an investigation of an indicator results in a conclusion that the indication is true, such conclusion must be reported to the NRC within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months of its determination, in accordance with 10 CFR 74.11. The MC&A plan should specify the time allowed for resolution. In general, a time not exceeding 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months should be adequate.

16.3 Response Actions for Unresolved Indicators The MC&A plan should clearly define response actions to unresolved indicators, and these response actions should be on a graded scale appropriate to the level of potential safeguards significance. The plan should also define the responsibility and authority for initiating and executing such escalating levels of response actions.

For indicators of missing SNM/SSNM, the level of safeguards concern is related to factors such as the following:

the potential quantity of SNM/SSNM involved

the material attractiveness of the potential missing uranium or plutonium (in terms of fabricating a nuclear explosive device) relative to its type, enrichment, composition or form (e.g., U metal, U3O8, uranyl nitrate solution, UF6, scrap, or waste).

16.4 Documentation Requirements The MC&A plan should identify all documentation requirements associated with the licensee's program for the reporting, investigation, and resolution of missing SNM/SSNM indicators. The plan should define the licensees review and approval requirements and custodial responsibility.

At a minimum, documentation of the following should be included:

investigation procedures

resolution procedures

reporting of indicator to MC&A management, including date and time the indicator was reported, name of individual who discovered the indicator, and description of indication 119 NUREG-1280, Revision 2

investigation findings and conclusion, including resolution status, date issued, name and signature of principal investigator, and approval signature of MC&A manager

reports made to the NRC for unresolved indicators and for indicators determined to be real, including date and time the report was made, method of communication, and name of the NRC individual contacted Section 17.3 of this document describes additional types of information that may be necessary.

16.5 Commitments and Acceptance Criteria In its MC&A plan, the licensee should provide definitive commitments that adhere to the regulatory requirements applicable to investigating and resolving anomalies indicating possible misuse of SNM/SSNM. A finding that the licensees MC&A plan for resolving indications of loss, theft, diversion, or misuse of SNM/SSNM is acceptable and in accordance with 10 CFR 74.3(b) and 10 CFR 74.3(c) will be based on, but not limited to, the following acceptance criteria:

Adequate commitments are provided to ensure a high probability that an indicator of missing SNM/SSNM will be (1) recognized as an indicator, (2) promptly investigated, and (3) resolved.

A prompt investigation will be conducted by the licensee for all indications of possible loss, theft, diversion, or misuse of SNM/SSNM.

A cause or probable cause that is based on objective evidence will be assigned to each indication of possible loss that is investigated by the licensee.

Investigation and resolution procedures will provide for adequate overchecks to ensure that no individual who could have been responsible for a possible loss or theft of SNM/SSNM would be the sole or primary individual responsible for resolving the indicator.

No investigation relative to an indication of a loss or theft of SNM/SSNM shall be declared as completed but unresolved without first conducting a shutdown, cleanout inventory in which all unsealed SNM/SSNM is remeasured for element and isotope contents.

The results of all investigations of alleged thefts, and any indications of a loss of SNM/SSNM which remains unresolved after 30 calendar days will be reported to the appropriate NRC MC&A licensing authority.

NUREG-1280, Revision 2 120

17. INFORMATIONAL AID FOR ASSISTING IN THE INVESTIGATION AND RECOVERY OF MISSING SPECIAL NUCLEAR MATERIAL AND STRATEGIC SPECIAL NUCLEAR MATERIAL 17.0 Regulatory Intent The intent of the 10 CFR 74.3(d) general performance objective is for licensees to have ready and provide to investigators any information deemed relevant to the recovery of SNM/SSNM involved in a loss or theft. The burden is on the licensee to provide (without being asked to) all information that it recognizes as being relevant, as opposed to only providing information that the investigators are knowledgeable enough to request. This objective pertains to investigations and recovery operations, relating to actual (or highly suspected) instances of missing SNM/SSNM, which would be conducted by the NRC or other government agencies, such as the Federal Bureau of Investigations.

The 10 CFR 74.3(d) performance objective states that the licensee must be able to provide, in a timely manner, information to aid in the investigation and recovery of missing SNM/SSNM in the event of an actual loss, theft, diversion or misuse.

17.1 Types of Information The following information may aid the investigation and recovery effort:

data or observations that led the licensee to determine that a loss or theft of uranium or plutonium may have occurred

data, observations, and assessments associated with attempts to resolve the indication of missing material

the time period during which the material may have left the facility

the path and means by which the material may have left the facility 17.2 Information Indicating Possible Losses of Special Nuclear Material/Strategic Special Nuclear Material Information indicating that a loss of uranium or plutonium may have occurred can come from process or production yield data, physical inventory results, item control activities, and shipper-receiver comparisons. This information could include the following:

material accountability data records and reports

inventory records

ID and propagation of error calculations

inventory reconciliation reports NUREG-1280, Revision 2 122

indications of unrecorded or unauthorized removals of SNM/SSNM from storage or process locations

reports of apparent destruction or falsification of records pertaining to SNM/SSNM

records of broken TIDs or compromised item integrity

indications of unauthorized entry into SNM/SSNM storage areas

reports from monthly item status inspections

material receipt and log-in records

results from shipper-receiver difference evaluations

process quality assurance or production control records

documentation relating to an alleged or confirmed theft 17.3 Information on Resolving Indications of Missing Special Nuclear Material/Strategic Special Nuclear Material Chapter 16 of this document provides information associated with resolving indications of missing SNM/SSNM. This information and information that may be of aid in the recovery of missing material could include the following:

the type of unauthorized activity detected

the interval during which the loss may have occurred

the amount of material and form of the material involved in the loss

results of measures to validate indicators

results of extended measures to resolve indicators

results from special inventories (or reinventories) and tests performed

audit results of the SNM/SSNM accountability source data

assessments of measurement data and measurement controls

results from reviews of the MC&A program and status of corrective actions

history of indicator investigation and resolution activities

anomaly investigation and resolution procedures and conclusions

probable cause of the loss 123 NUREG-1280, Revision 2

any abnormal events that may have contributed to or caused the loss

the names of individuals who could have been responsible for the loss Much of the backup information necessary to assist in an investigation would be records maintained in the facility records system described in Chapter 18 of this document.

17.4 Commitments and Acceptance Criteria In its MC&A plan, the licensee should provide definitive commitments that adhere to the regulatory requirements applicable to providing information for assisting in the investigation and recovery of missing SNM/SSNM. A finding that the licensees MC&A plan for providing informational aid is acceptable and in accordance with 10 CFR 74.3(d) will be based on, but not limited to, the following acceptance criteria:

Procedures are in place for the efficient and timely gathering of relevant information to be provided to investigators to aid in the investigation and recovery activities associated with missing SNM/SSNM.

Information will be provided to appropriate government authorities to aid in their investigation of indications or allegations of missing material and in the recovery of SNM/SSNM in the event of a loss that could include theft or diversion.

NUREG-1280, Revision 2 124

18. RECORDKEEPING 18.0 Regulatory Intent The intent of the 10 CFR 74.59(g) recordkeeping requirements is to ensure that licensees establish and maintain specific records that demonstrate that the general performance objectives of 10 CFR 74.3 and 10 CFR 74.51(a), as well as the program capabilities of 10 CFR 74.51, 10 CFR 74.53, 10 CFR 74.55, 10 CFR 74.57, and 10 CFR 74.59, have been met. In accordance with 10 CFR 74.59(g), records must be retained for a minimum of 3 years (or longer if specifically required by 10 CFR Part 75, Safeguards on Nuclear Material Implementation of US/IAEA Agreement). Note that, in accordance with 10 CFR 74.19(b),

MC&A procedures (as documented in licensee records) must be retained until the Commission terminates the license.

Records provide a means for assessing the performance of the MC&A program and inspecting for compliance with regulatory requirements.

18.1 Description of Records The MC&A plan should identify all records, forms, reports, and standard operating procedures that show compliance with the requirements of 10 CFR Part 74. Such records should include, but are not limited to, the following:

documents that define changes in the MC&A management structure or changes in responsibilities relating to MC&A positions

procedures pertaining to any accountability-related measurement or sampling operations

forms used to record or to report measurement data and measurement results, including source data

forms and notebooks used to record calibration data associated with any accountability measurement system

forms and notebooks used to record quantities, volumes, and other data associated with the preparation of standards, both calibration and control, used in connection with accountability measurement systems

forms and official memoranda used to record or report measurement control program data, control limit calculations, and out-of-control investigations

forms listing and providing instructions associated with physical inventories

forms and formal worksheets used in the calculation of SEID, ID, and active inventory values

ledgers, journals, and computer printout sheets associated with the accountability system NUREG-1280, Revision 2 126

ledgers, journals, and computer printout sheets associated with the item control program, including TID usage and attesting to records

DOE/NRC Forms 741 and 742 and NRC Form 327

forms, memos, and reports associated with identification of, investigation of, and resolution of significant shipper-receiver differences

loss indication and alleged theft investigation reports

investigation reports pertaining to excessive IDs

official reports containing the findings and recommendations of MC&A program assessments and any letters or memos pertaining to response actions to assessment team recommendations

forms used for recording data associated with the item monitoring program

monitoring program status or summary reports

forms, worksheets, and calculations associated with process monitoring

records of training sessions including date given, topics covered, name of instructors, names and signatures of those attending

training, qualification, and requalification reports and records The MC&A plan annex or appendix should list examples of MC&A forms that are retained. The retained records and reports should contain sufficient detail to enable the NRC inspectors to determine that the licensee has implemented the program and plan capabilities of 10 CFR 74.51(c) and has met the general performance objectives of 10 CFR 74.3 and 10 CFR 74.51(a).

18.2 Program and Controls for Ensuring an Accurate and Reliable Record System The MC&A plan should describe the controls used to ensure that records are accurate and reliable.

The record system also should provide a capability for easy traceability of all SNM/SSNM transactions from source data to final accounting records.

The following topics should be addressed:

the auditing system or program to verify the correctness and completeness of records

the overchecks and balances for preventing or detecting missing or falsified data and records

the plan for reconstructing lost or destroyed SNM/SSNM records 127 NUREG-1280, Revision 2

the access controls used to ensure that only authorized persons can update and correct records

the protection and redundancy of the record system such that any act of record alteration or destruction will not eliminate the ability to provide a complete and correct set of SNM/SSNM control and accounting information needed to achieve the performance objectives of 10 CFR 74.3 18.3 Commitments and Acceptance Criteria In its MC&A plan, the licensee should provide definitive commitments that adhere to the regulatory requirements applicable to recordkeeping. A finding that the licensees MC&A plan for recordkeeping is acceptable and in accordance with 10 CFR 74.59(g) will be based on, but not limited to, the following acceptance criteria:

A record retention system is maintained for those records necessary to show that the MC&A program requirements of 10 CFR 74.51(c), have been met. Such records are retained for at least 3 years, unless a longer retention time is specified by 10 CFR 74.15(b), by 10 CFR Part 75, or by a specific license condition. The records referred to in 10 CFR 75.22, Accounting Records, and 10 CFR 75.23, Operating Records, and generated during any period that the facility is under IAEA safeguards are be retained for at least 5 years. Records of the following should be maintained current and should be retained for at least 3 years:

management structure, MC&A job descriptions, and MC&A policies and procedures accounting source data records (normally consisting of shipping and receiving forms, physical inventory forms, and the forms used for initially recording measurement and measurement control data) records of shipments and receipts and investigations of significant shipper-receiver differences plus the information used to resolve them measurement data for receipts, shipments, discards, and inventory calibration of measurement systems, measurement control data, bias estimates, and the statistical analyses of the measurement control data data used to demonstrate that the measurement system performance achieves the SEID limit specified in 10 CFR 74.59(e)(5) and the data necessary to perform the material control tests required by 10 CFR 74.53(b) physical inventory listings and inventory work sheets calculations of detection thresholds for excessive IDs of a safeguards significance (i.e., any ID that exceeds three times the SEID and specified minimal quantities)

NUREG-1280, Revision 2 128

calculations of the standard error of the ID and information used to reconcile an excessive ID reports of investigations and resolution of indications of loss of SNM/SSNM results of independent assessments and management action taken to correct any deficiencies identified

Records will be maintained on the quantities of SNM/SSNM added to and removed from the process.

The source data will be retained in its original form until the physical inventory and any subsequent ID investigations have been completed. After this time, any readable facsimile is acceptable for the remainder of the required retention period. All other records may be retained as hard copy, microfiche, permanent computer readable forms, or other permanently readable forms.

The records will be retrievable, sufficiently complete and detailed to permit auditing all parts of the MC&A program, and traceable back to original source data.

The records of the data that are the basis of the calculated SEID will permit traceability to the sources of the variances resulting from calibrations, bias adjustments, and random effects in the measurements. These records may be summaries of calibrations, bias tests, and variance monitoring data or control charts.

The record system will have sufficient redundancy to enable reconstruction of lost or missing records so that knowledge of the SNM/SSNM inventory is always available. The primary records, as contrasted with duplicate or backup records, will be protected against computer failure, fire or water damage, vandalism, and access by unauthorized persons.

All retained MC&A records should be readily accessible so as to meet time restraints relative to their use. In general, the record retention system should possess the capability to retrieve records used for measurement control or accountability within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months if the record was generated within the past 12 months, and within 7 calendar days if generated more than 12 months ago. Physical inventory listings should be available within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for the latest two physical inventories. Item control records should be retrievable in time to satisfy the criteria discussed in Chapter 8 of this document.

Overchecks or other controls including access controls for updating and correcting records are provided so as to prevent or detect errors in the records that would affect ID and item location.

Checks and balances are incorporated that are sufficient to detect falsification of data and reports that could conceal diversion of SNM/SSNM.

Access to MC&A information will be controlled to provide deterrence and detection of loss, theft, diversion, or misuse of SNM/SSNM.

129 NUREG-1280, Revision 2

Sufficient protection and redundancy of the record system is provided so that an act of record alteration or destruction will not eliminate the capability to provide a complete and correct set of control and accounting information that could be used to confirm the presence of SNM and SSNM, resolve indications of missing material, or aid in the investigation and recovery of missing material.

NUREG-1280, Revision 2 130

19. GLOSSARY The following terms are defined in the context of (1) their usage in this document or (2) how they should be used if contained in the material control and accounting (MC&A) plans submitted in accordance with Title 10 of the Code of Federal Regulations (10 CFR) 74.51, Nuclear Material Control and Accounting for Strategic Special Nuclear Material.

ADDITIONS TO INVENTORY-Quantities of special nuclear material/strategic special nuclear material (SNM/SSNM), of a given material type code, added to a plant inventory and which, before such addition, were not part of the plants total possessed quantity for the material type code in question.

ANOMALY-An unusual observable condition (such as excessive discrepancies, missing items, broken tamper-indicating devices or other possible indicators) that might result from theft, diversion, or other misuse of SNM/SSNM.

ARTIFACT STANDARD-A container or item, of certified mass, having a size, shape, and mass that is representative of a particular type of process-related item or container. Weighing error caused by buoyancy is eliminated by the use of artifact standards for scale calibrations.

ASSIGNED VALUE-A value assigned to a standard weight, standard material, or the like used for calibrating or controlling a measurement device or system for measuring SNM (e.g., mass, volume, SNM/SSNM concentration, or SNM/SSNM quantity). An assigned value may not necessarily be a certified value, but if not, it should be traceable to a certified standard. In any event, it is the best estimate of the standards true value.

CERTIFIED STANDARD-A standard weight, material, device, or instrument having an assigned value that is guaranteed to be within specified limits by a nationally or internationally recognized organization (e.g., bureau, laboratory) that issues or certifies standards.

CHECK STANDARD (BENCH STANDARD, WORKING STANDARD)-A standard, not necessarily traceable to a primary standard, that is used routinely (e.g., daily or weekly) to check (or verify) the reliability of a measurement device, instrument, or the like (including those of accountability measurement systems). Such standards are not, however, used for the actual calibration or control of accountability measurement systems.

COMBINED STANDARD ERROR-An error band derived from the respective standard error values associated with each of two measurements (usually independent of each other) performed on a given material quantity. For both measurement values (of the pair) to be regarded as being in agreement, they must not differ from each other by more than the calculated combined standard error, which is normally calculated by taking the square root of the sum of squared individual standard errors, as illustrated in the following equation:

combined S.E. = [(1)2 + (2)2]1/2 CONFIRMATORY MEASUREMENT-A measurement that confirms (within measurement uncertainty at the 95-percent confidence level) a previously established parameter (e.g., net weight, enrichment) associated with an SNM/SSNM item (or SNM/SSNM quantity), but which does not thoroughly verify the previously established element or isotope quantity assigned to NUREG-1280, Revision 2 132

such item. Confirmatory measurements are sometimes used as the basis for concluding that previous measurement values for plutonium (Pu), uranium (U), and U-235 or U-233 (or element and isotope) quantities are still valid.

CONTROL STANDARD-A standard that (1) is representative of the process material being measured and (2) is itself measured periodically to monitor for and to estimate any bias associated with the measurements of the process material in question. A control standard must be traceable to a primary standard or to a primary reference material.

CRITICAL MATERIAL CONTROL AND ACCOUNTING PROCEDURES-Those written procedures which, if not performed correctly, could result in a failure to achieve one or more of the eight general performance objectives of 10 CFR 74.3 and 10 CFR 74.51(a) or the program capabilities of 10 CFR 74.51(c).

DEPLETED URANIUM-Any uranium-bearing material whose combined U-233 plus U-235 isotopic content is less than 0.70 weight percent (wt%) (relative to total uranium elemental content).

ENDING INVENTORY-For each material type code, the total itemized quantity of SNM/SSNM possessed by a facility at the end of a material balance period, as determined by a physical inventory. The ending inventory quantity for any given material balance period is (by definition) exactly equal to the beginning inventory quantity for the next period.

ENRICHED URANIUM-Any uranium-bearing material which does not qualify as natural or normal uranium and whose combined U-233 plus U-235 isotopic content is 0.725 percent or higher by weight, relative to total uranium element content.

INVENTORY RECONCILIATION-The adjustment of the book record quantity of both element and fissile isotopes to reflect the results of a physical inventory. In the broad sense, inventory reconciliation also includes the activities of calculating (1) the inventory difference (ID) for the material balance period in question, (2) the uncertainty (i.e., the standard error of the inventory difference (SEID)) value associated with the ID, (3) the active inventory for the period, and (4) any bias adjustment or prior period adjustment associated with the ID value.

KEY MEASUREMENT SYSTEM-Any set of designated measurement systems (of the licensees choosing) which, based on the most recent previous period, account for at least 90 percent of the total measurement variance contribution to the SEID. Included within the set of key measurement systems should be any system utilized to measure an SNM/SSNM quantity (during inventory period) greater than 25 percent of the active inventory, regardless of its contribution to the SEID.

MATERIAL BALANCE-The determination of an inventory difference. A comparison, on a measured basis, of beginning inventory plus additions to inventory to ending inventory plus removals from inventory, for a given control area (or combination of control areas) over a specified period of time.

MATERIAL BALANCE PERIOD-The time span to which a material balance or physical inventory pertains.

133 NUREG-1280, Revision 2

MATERIAL TYPE CODES-Number codes for identifying basic material types with respect to source material (SM), SNM, and byproduct materials. The Nuclear Materials Management and Safeguards System (NMMSS) uses these codes to track U.S.-owned and U.S.-possessed materials worldwide. For SNM, eight material type codes have been assigned as follows:

CODE MATERIAL TYPE 10 Depleted Uranium 20 Enriched Uranium (*)

50 Plutonium 70 Uranium-233 (**)

81 Normal Uranium 83 Plutonium-238 (***)

88 Thorium 89 Uranium in Cascades

For U.S. Department of Energy/U.S. Nuclear Regulatory Commission (DOE/NRC) Form 742, material code 20 has four subcodes to denote enrichment range: E1, E2, E3, and E4. For NRC Form 327, material code 20 has two subcodes: LEU (low-enriched uranium) and HEU (high-enriched uranium).

- Uranium materials should be regarded as material code 70 if the U-233 isotopic abundance is greater than (1) 10.00 wt% relative to total uranium elemental content or (2) both the U-233 isotopic abundance is greater than the U-235 isotopic abundance and the U-233 isotopic abundance exceeds 5.00 wt% relative to total elemental uranium content; otherwise report as material code 10, 20, or 81, as appropriate.

- - Plutonium materials should be regarded as material code 83 if the Pu-238 isotopic abundance is greater than 10.00 wt% relative to total plutonium elemental content; otherwise, report as material code 50.

MEASURED DISCARD-A batch or quantity of waste whose SNM/SSNM content has been determined by measurement that (1) has been shipped to a disposal site, released to the environment, or stored on site and (2) has been taken off the accounting ledgers as part of the current inventory of possessed SNM/SSNM.

MEASUREMENT CONTROL PROGRAM-A managed program for monitoring and controlling both accuracy and precision of SNM/SSNM accountability measurements.

NATURAL URANIUM-Any uranium-bearing material whose uranium isotopic distribution has not been altered from its naturally occurring state. Natural uranium is nominally 99.283 wt%

U-238, 0.711 wt% U-235, and 0.006 wt% U-234. However, the terms natural uranium and normal uranium are practically used interchangeably for NMMSS purposes in the utilization of material code 81 for source material other than thorium.

NORMAL URANIUM-Any uranium-bearing material having a uranium isotopic distribution that can be characterized as being (1) 0.700 wt% to 0.724 wt% in combined U-233 plus U-235 and (2) at least 99.200 wt% in U-238. (Note: All natural uranium having a U-235 isotopic abundance in the range of 0.700 wt% to 0.724 wt% is normal uranium, but not all normal uranium is natural uranium.) See NATURAL URANIUM.

NUREG-1280, Revision 2 134

POINT-CALIBRATED MEASUREMENT SYSTEM-A measurement system in which the measurement value assigned to an unknown measured by the system is derived from the response obtained from the measurement of a representative calibration standard that was measured along with (i.e., at the same time as) the unknown. The standard must undergo all the measurement steps (e.g., aliquoting, sample pretreatment) in the same manner as the unknown. Point-calibrated measurement systems can be regarded as bias free, provided that adequate controls are in place to ensure the validity of the standards assigned value.

PRIMARY STANDARD-Any device or material having a characteristic or parameter (e.g.,

mass, uranium concentration, uranium isotopic distribution) whose value is certified (within a specified uncertainty) by a nationally or internationally recognized bureau, laboratory, or similar organization that issues or certifies standards.

PRIOR PERIOD ADJUSTMENT-Any correction (i.e., adjustment) to an ID value because of a correction applied to a component of beginning inventory after the inventory period started.

Such corrections may result from resolution of a shipper-receiver difference on material received during a prior inventory period, correction of a recording error, or the like. Because these types of corrections have nothing to do with current period losses or errors, and because the official beginning inventory value is not adjusted, an adjustment to the ID value (derived from the ID equation) is necessary to obtain an ID that reflects only current period activity.

RESIDUAL HOLDUP-Any SNM/SSNM that remains within processing equipment (including ventilation filters and ductwork) after system draindown or cleanout. If, at the time of physical inventory, the total quantity of residual holdup is significant, such holdup must be measured (or estimated on the basis of partial measurements and engineering calculations) and included in the physical inventory listing. The calculation of the SEID must include the uncertainty associated with a total measured or estimated residual holdup quantity.

RESOLUTION OF AN INDICATOR-A definitive determination (with auditable evidence) by the licensee that an indicated possible theft or loss of uranium or plutonium was a false indicator.

SHIPPER-RECEIVER DIFFERENCE-The difference between what a sending facility (i.e.,

shipper) claims was contained in a shipment of SNM/SSNM and what the receiving facility claims was received, where both the shipper's and receiver's values are based on measurement.

STANDARD-See definitions for CERTIFIED STANDARD, CHECK STANDARD, CONTROL STANDARD, PRIMARY STANDARD, and STANDARD REFERENCE MATERIAL.

STANDARD DEVIATION-The random error (at the 67-percent confidence level) associated with a single value of a data set, which in turn is also a measure (or indication) of the precision relating to a set of measurements (or set of data) pertaining to the same item or sample of material. Standard deviation is calculated as follows:

n standard deviation = S = { [ (xi - x )2] / (n-1) }1/2 i=1 where n = number of measurements performed 135 NUREG-1280, Revision 2

xi = the value obtained for the ith measurement for i = 1, 2, 3,,n x = the average value for all n measurements STANDARD ERROR-The random error (at the 67-percent confidence level) associated with the average, or mean, value of a data set derived from repetitive determinations on the same item or sample. Mathematically, standard error is the standard deviation divided by the square root of the number of individual measurements used to derive the mean value.

STANDARD REFERENCE MATERIAL-A material or substance that qualifies as a primary standard and whose concentration with respect to a nuclide or isotope, a chemical element, or chemical compound is certified within a specified uncertainty.

SYSTEMATIC ERROR-A unidirectional error that affects all members of a data set. The terms bias and systematic error are often interchanged. However, any determined bias (i.e., a bias estimated from control standard measurements) has an uncertainty value associated with it.

Thus, after correcting for any estimated bias, the uncertainty of that bias can be regarded as a systematic error. If an estimated bias is not applied as a correction, the combination of the bias plus its uncertainty should be regarded as the systematic error.

VERIFICATION MEASUREMENT-(1) A nondestructive assay measurement of an item conducted to verify that a previous nondestructive assay measurement value for isotope content of that item is still valid or (2) the reweighing and resampling of an item, batch, lot, or sublot and performance of chemical assays of the resample for element and isotope concentrations so as to verify a previously measured value for element and isotope content of the item (batch, lot, or sublot). Verification is achieved if the original and verification measurement values (for element and isotope quantities) agree within the range of measurement uncertainty (at the 95-percent confidence level).

NUREG-1280, Revision 2 136

137 NUREG-1280, Revision 2

20. REFERENCES

1. American National Standards Institute, Non-Destructive Assay Measurement Control and Assurance, ANSI N15.36, American National Standards Institute, New York, NY, 1983.

2. American National Standards Institute, Guide to Nuclear Facility Measurement Control, ANSI N15.41, American National Standards Institute, New York, NY, 1984.

3. Augustson, R.H., DYMAC Demonstration Program: Phase I Experience, LA-7126-MS, Los Alamos Scientific Laboratory, Los Alamos, NM, 1978.

4. Bowen, W.M. and C. A. Bennett, Statistical Methods for Nuclear Material Management, NUREG-4604, U.S. Nuclear Regulatory Commission, Washington, DC, 1988.

5. Bowen, W.M., Evaluation of Simultaneous Testing Procedures for Nuclear Materials Control and Accounting, NUREG/CR-2483 (PNL-4083), Pacific Northwest Laboratory, Richland, WA, March 1982.

6. Brouns, R.J. and F.P. Roberts, Training and Qualifying Personnel for Performing Measurements for the Control and Accounting of Special Nuclear Material, NUREG/CR-0773 (PNL-3020), Pacific Northwest Laboratory, Richland, WA, November 1980.

7. Brouns, R.J., F.P. Roberts, J.A. Merrill, and W.B. Brown, A Measurement Control Program for Nuclear Material Accounting, NUREG/CR-0829 (NL-3021), Pacific Northwest Laboratory, Richland, WA, June 1980.

8. Brouns, R.J., B.W. Smith, D.W. Brite, and C.O. Harvey, The Use of Process Monitoring Data for Nuclear Material Accounting: Vol. 1, Summary Report, NU CR-1670 (PNL-3396), Pacific Northwest Laboratory, Richland, WA, 1980. (Available in abbreviated form as R.J. Brouns and B.W. Smith, The Use of Process Monitoring Data to Enhance Material Accounting, Proceedings of the Institute of Nuclear Materials Management Meeting, IX, 688-96, Chicago, IL, 1980.)

9. Cobb, D.D., Sequential Tests for Near-Real-Time Accounting, Proceedings of the Institute of Nuclear Materials Management Meeting, X, Chicago, IL.

10. David, H.A., Order Statistics, John Wiley & Sons, New York, 1970.

11. Eggers, R.F., Detailed Response to Alarms, Technical Report to the U.S. Nuclear Regulatory Commission, Pacific Northwest Laboratory, Richland, WA, 1981.

12. Eggers, R.F., Design Aids for Estimating the Frequency of Occurrence of Unresolved Plan-Wide False Alarms, Technical Report to the U.S. Nuclear Regulatory Commission, Pacific Northwest Laboratory, Richland, WA, 1982.

13. Eisenhart, C., M.W. Hastay, and W.A. Wallis, Selected Techniques of Statistical Analysis, McGraw-Hill, New York, 1947.

NUREG-1280, Revision 2 138

14. Glancy, J.E., G. Borgonovi, S. Donelson, et al., Feasibility and Cost/Benefit of Advanced Safeguards for Control of Nuclear Material In-Process, SAI 01580-343LJ, Science Applications, Inc., La Jolla, CA, October 1980.

15. Graybill, P.A., Theory and Application of the Linear Model, Duxbury Press, North Scituate, MA, 1976.

16. Hakkila, E.A., J.W. Barnes, T.R. Canada, et al., Coordinated Safeguards for Materials Management in a Fuel Reprocessing Plant, Appendix (Part E), Vol. 11, Los Alamos Scientific Laboratory, Los Alamos, NM, 1977.

17. Hakkila, E.A., D.D. Cobb, H.A. Dayem, et al., Materials Management in an Internationally Safeguarded Fuels Reprocessing-Plant, LA-8042, Vols. 1 and 3, Los Alamos Scientific Laboratory, Los Alamos, NM, 1980.

18. Hawkins, R.L., R.L. Lynch, and R.F. Lumb, Using Advanced Process Monitoring to Improve Material Control, NUREG/CR-1676, Vol. 1 (NUSAC-566), Nuclear Surveillance and Auditing Corporation, McLean, VA, 1980.

19. Hurt, R.D., S.J. Hurell, J.W. Wachter, et al., Experimental Demonstration of Microscopic Process Monitoring, ORNL/TM-7848, Oak Ridge National Laboratory, Oak Ridge, TN, 1982.

20. International Atomic Energy Agency, Statistical Concepts & Techniques for IAEA Safeguards, 5th Edition, International Atomic Energy Agency, Vienna, Austria, 1998.

21. Jaech, J.L., Statistical Methods in Nuclear Material Control, TID-26298, National Technical Information Service, Springfield, VA, 1973.

22. Jaech, J.L., On Forming Linear Combinations of Accounting Data to Detect Constant Small Losses, Journal of Nuclear Materials Management, VI(4):37-42, 1977.

23. Johnston, J.W., R.R. Kinnison, J.S. Littlefield, and B.W. Smith, Methods for Recurring Loss Test, NUREG/CR-5002, U.S. Nuclear Regulatory Commission, Washington, DC, 1987.

24. Juran, J.M., ed., Quality Control Handbook, McGraw-Hill Book Company, Inc., New York, NY, 1951.

25. Lumb and Associates, Inventory Difference Evaluation Program (INDEP), 1986.

26. Lumb, R. and F. Tingey, Mathematical Derivation of the Automated Material Accounting Statistics System (AMASS), Nuclear Surveillance and Auditing Corporation, McLean, VA, 1981.

27. Markin, J.T., A.L. Baker, and J.P. Shipley, Implementing Advanced Data Analyses Techniques in Near-Real-Time Materials Accounting, Proceedings of the Institute of Nuclear Materials Management Meeting, IX, 3-244, Chicago, IL, 1980.

28. Miles, J.C., J.E. Glancy, and S.E. Donelson, Use of Process Monitoring Data for the Enhancement of Nuclear Material Control and Accounting, NUREG/CR-1013 139 NUREG-1280, Revision 2

(MLM-2643), Mound Laboratories, Miamisburg, OH, and Science Applications, Inc.,

La Jolla, CA, 1979.

29. Picard, R.R., NRCPAGE Applications Manual, NUREG/CR-4497 (LA-10638-M),

U.S. Nuclear Regulatory Commission, Washington, DC, 1986.

30. Reardon, P.T., S.W. Heaberlin, and R.F. Eggers, An Assessment Method to Predict the Rate of Unresolved False Alarms, Proceedings of the Institute of Nuclear Materials Management Meeting, XI, 278-282, Chicago, IL, 1982.

31. Reilly, T.D., N. Ensslin, H. Smith, and S. Kreiner, Passive Nondestructive Assay of Nuclear Materials, NUREG/CR-5550, U.S. Nuclear Regulatory Commission, Washington, DC, 1991.

32. Reilly, T.D. and M.L. Evans, Measurement Reliability for Nuclear Material Assay, LA-6574, Los Alamos Scientific Laboratory, Los Alamos, NM, 1977.

33. Rogers, D.R., ed., Handbook of Nuclear Safeguards Measurement Methods, NUREG/CR-2078 (MLM-2855), Mound Laboratories, Miamisburg, OH, 1983.

34. Rose, D.M. and F. W. Scholz, Statistical Analysis of Cumulative Shipper-Receiver Differences, NUREG/CR-2819 (BCS 40384-0), Boeing Computer Services Company, Tukwilla, WA, 1983.

35. Rudy, C.R., D.B. Armstrong, K.W. Foster, D.R. Rogers, and D.R. Hill, Controlled Unit Approach: An Application Manual, NUREG/CR-2538 (MLM-2881), Mound Facility, Miamisburg, OH, 1982.

36. Seabaugh, P.W., D.R. Rogers, H.A. Woltemann, et al., The Controllable Unit Approach to Material Control: Application to a High Throughput Mixed Oxide Process, NUREG/CR-1214, Vol. 1 and Vol. 2 (MLM-2532), Mound Laboratories, Miamisburg, OH, 1980.

37. Shewhart, W.A., Economic Control of Quality of Manufactured Products, D. Van Nostrand Co., New York, 1931.

38. Shipley, J.P., Decision-Directed Materials Accounting Procedures: An Overview, Proceedings of the Institute of Nuclear Materials Management Meeting, X, 281-287, Chicago, IL, 1981.

39. Smith, B.W., Development of MC&A Alarm Resolution Procedures, NUREG/CR-4108, U.S. Nuclear Regulatory Commission, Washington, DC, 1985.

40. Smith, B.W. and J. Razvi, Resolving MC&A Alarms from Process Monitoring in a Fuel Fabrication Facility, Proceeding of the Institute of Nuclear Materials Management Meeting, XIII, 302-329, Columbus, OH, 1984.

41. Stewart, K.B., The Loss Detection Powers of Four Loss Estimators, Joumal of Nuclear Materials Management, VII(3):74-80, 1978.

42. Swain, A.D. and H. E. Guttmann, Handbook of Human Reliability Analysis with NUREG-1280, Revision 2 140

Emphasis on Nuclear Power Plant Applications, NUREG/CR-1278, Sandia National Laboratories, Albuquerque, NM, October 1983.

43. Tanner, J., False Alarm Resolution Assessment Methodology, Technical Report to the U.S. Nuclear Regulatory Commission, Pacific Northwest Laboratory, Richland, WA, 1981.

44. Tingey, F.H., C.J. Barnhart, and R.F. Lumb, Resolving the Components of Process Variability and Estimating the Uncertainty of the LEID, NUSAC Report 752, Rev. 1, NUSAC, Inc., Reston, VA, 1983.

45. U.S. Code of Federal Regulations, Material Control and Accounting of Special Nuclear Material, Part 74, Chapter I, Title 10, Energy.

46. U.S. Nuclear Regulatory Commission, Instructions for Completing Nuclear Material Transaction Reports (DOE/NRC Forms 741 and 740M), NUREG/BR-0006, Rev. 7, June 2008.

47. U.S. Nuclear Regulatory Commission, Instructions for the Preparation and Distribution of Material Status Reports (DOE/NRC Forms 742 and 742C), NUREG/BR-0007, Rev. 6, December 2008.

48. U.S. Nuclear Regulatory Commission, Instructions and Guidance for Completing Physical Inventory Summary Reports (NRC Form 327), NUREG/BR-0096, October 1992.

49. U.S. Nuclear Regulatory Commission, Pressure-Sensitive and Tamper-Indicating Device Seals for Material Control and Accounting of Special Nuclear Material, Regulatory Guide 5.80, December 2010.

50. Wincek, M.A., K.B. Stewart, and G.F. Piepel, Statistical Methods for Evalating Sequential Material Balance Data, NUREG/CR-0683 (PNL-2920), Pacific Northwest Laboratory, Richland, WA, 1979.

141 NUREG-1280, Revision 2

NUREG-1280, Final Draft Guidance, Rev. 2, Acceptable Standard Format and Content for the Material Control and Accounting Plan Required for Strategic Special Nuclear Material.

Text

Navigation menu

Search