Regulatory Guide 5.24
| ML003740017 | |
| Person / Time | |
|---|---|
| Issue date: | 06/30/1974 |
| From: | Office of Nuclear Regulatory Research |
| To: | |
| References | |
| RG-5.24 | |
| Download: ML003740017 (6) | |
June 1974 U.S. ATOMIC ENERGY COMMISSION
REGULATORY GUIDE
DIRECTORATE OF REGULATORY STANDARDS
REGULATORY GUIDE 5.24 ANALYSIS AND USE OF PROCESS DATA FOR THE PROTECTION
A. INTRODUCTION
Section 70.51, "Material Balance, Inventory, and Records Requirements," of 10 CFR Part 70, "Special Nuclear Material," specifies certain requirements for persons licensed to possess or use special nuclear material (SNM). Paragraph (eX))
of §70.51 requires that certain licensees'
maintain procedures for the control of special nuclear material at their facilities which shall include unique identification of items or containers containing special nuclear material in process;
inventory records showing the identity, location, and quantity of special nuclear material for all such items;
and records of the source and disposition of all such items. Proposed §70.58, "Fundmental Nuclear Material Controls," 2 would require that the licensee establish, maintain, and follow a system of storage and internal handling control to provide continuous knowledge of the identity, quantity, and location of all special nuclear material contained withirn the facility in discrete items and containers. Paragraph (b) of §7022, "Contents of Applications:' further requires certain applicants to include in their application a full description of their program for the control of and accounting for special nuclear material which will be in their possession under license, including procedures by which process losses are determined. Finally, §70.52, "Reports of Accidental Criticality or Loss of Special Nuclear Material," requires that each licensee promptly report to the Commisson
'Licensees authorized to possess at any one time special nuclear material in a quantity exceeding one effective kilogram and to use such special nuclear material for activities other than those involved in the operation of a nuclear reactor licemed pursuant to 10 CFR Part 50 or those involved in a waste dispoml operation; as sealed sources; or as reactor irradiated fuels involved in research, development, and evaluation program in facilities other than irradiated fuel reprocesaing plants.
"2 Published for comment in the. Federal Register on September 25, 1973 (38 FR 26735).
any loss, other than normal operating loss, of special nuclear material.
This guide describes and identifies characteristics of a facility information system acceptable to the Regulatory staff for analyzing and using process yield and other information from run sheets, operating logs, and job orders to enhance material control by early detection of special nuclear material thefts.
B. DISCUSSION
Since the statutory authorization of private
.ownership of special nuclear material, the AEC has required that persons licensed and authorized to possess and use such material establish records and reporting procedures to assure proper control of special nuclear material and submit periodic reports to the AEC
concerning the disposition of special nuclear material.
Material transaction reports, internal control records, and physical inventory reports and records are the subjects of other regulatbry guides issued 3 or under development.
Although frequent inventory verification (inventory testing) procedures may be voluntarily implemented by plant management, process data anomalies (e.g.,
abnormal unit process yield or a missing container)
detected by the process operator may be the first indication that special nuclear material has been stolen.
To effectively utilize process data for the detection of possible theft of special nuclear material, a number of preliminary tasks must be undertaken:
"* Significant data anomalies must be identified,
"* The magnitude of normal fluctuations must be determined,
' Regulatory Guide
5.13.
"Conduct of Physical Inventories."
USAEC REGULATORY GUIDES
Regulatory Guides e issued to deOtibe end make evoilable to the public methods acinptble to the AEC Regulator sts" Of implementing SPMcific P"
of the Commion's regulitions. to delineste techniques used by "1te sta in inalluating specific Problent or postulaetd accidents. 0, to Providef guidenbl to appliinnts. Reguletory GuideF are not substitute$ for regiuletiones end cotlW101 with them is not required. Methods and loutiotte different from those an out in the guides will be acceptable if they provide a bsis for the findings requishte to the i*suanc or continuance of a permit or license by the CoMiMnition.
Published gutdit will be revised periodically, as appropriate. 10 eccoM-moate commients and to reflect new information or experience.
copiesof apubised guides nay be obtained by requert windioting the divisins deuired to the U.S. Atomic Enrgy CO"m.it0 00.2 Attention: Ditotr of ROQUIeoty Stcnde*ie. Comntuns mid ul'5 fr lroprowflinits in tha ami i encocuried and shiould te sent to the Seciula'V
of the Commiggion. U. .AtOmic Energy C
- mlolion.
Washington, Mc. 20"45 Attention: Chief. Public P odinp Staff.
The guides we jmased in thm followlin ten Iro'd dinin~ns:
1. Power Reactors
2. Reseerch eid Test Reactor'
3. Fuels nd Meteris Facilities
4. 'Environmental end Siting
5. Materials and Plant Protection
6. Products
7. Trensportation
a. Occupetionel Health
9. Antitrust Review
1
0. General
"* The investigation of detected anomalies must consider possible innocent c.,uses of the anomaly,
"* The information flow must assure that unresolved anomalies are promptly investigated,
"* Sufficient information must be compiled and maintained for retrieval to assure an effective reconstruction of circumstances associated with a detected theft.
I.
Theft Mode Analysis-A Procedure for Identifying Useful Data Elements Theft mode analysis is a procedure whereby the modus operandi of a thief can be categorized by a small number of general features, each of which can be considered separately to identify and rank, with respect to likelihood, the different options within each category.
Theft mode analysis is used herein for the specific purpose of identifying process data elements of potential significance as an indicator of SNM theft. For the purposes of this guide, which does not address security measures, theft mode analysis is limited to detecting theft by an insider-one authorized access to the material. Obviously, an individual not auhorized access who has successfully escaped physical detection may be foiled as well owing to the potentially quick discovery of the theft.
Table 1 outlines the main characteristics of a theft attempt by which an ordering by probability of various theft modes can be effected. Table 2 identifies examples of subcategories of those classifications that might be appropriate to a particular facility, and Table 3 depicts the process of assigning estimated weighting (relative likelihood that a particular option (subcategory) would be utilized by a thief) to each of the subcategories based on knowledge of the particular plant and process. As a description of a possible theft, the weighting factor is a measure of the probability that the means of accomplishing that theft will have incorporated that particular subcategory.
The factors are therefore multiplied in turn for each permutation of subcategories (Table 4) and rearranged in order of decreasing relative likelihood (Table 5). (Note: This is still an estimate no more valid than the individual weighting factors assigned to each subcategory. The approach, however, enables the analyst to concern himself with one theft mode characteristic at a time.) Such an analysis provides a means of ranking various theft modes and allows the subsequent identification of those elements of process data which would depart from a norm if a theft by the more likely modes were to have occurred.
Such an analysis can be applied to an entire process material balance area, internal material control areas, individual process lines, or unit processes. For a relatively large area, the large variety of types of in-process material of different attractiveness and opportunities for theft may complicate the idetitification of process data elements affected by a theft. The trade-off between an extensive list of material attractiveness subcategories and repeat analysis of smaller material control areas depends on the type and location of in-process material at a particular facility.
If the identification of subcategories has been done carefully, one can reasonably assume that essentially all of the theft modes of potential use to an insider are identified by the combinations of characteristics in Table 5. Further, the ratio of a running total of the relative likelihood identified in the last column to the total of all entries in that column is a measure of the likelihood that, should a theft occur, it will he characterized by one of the modes making up the running total.
Table 5 indicates that, for the hypothetical example used, approximately 95% of the plausible theft events by a lone individual that are at least as likely as a theft event by two in collusion could be expected to 'e of a type depicted by the first 29 entries of Table 5. 7ie information in Columns 1, II, and V indicatr that the production data affected by these 95% would be !hose data affected by a simple removal of product, fe:-d, or in-process materials with no attempt having seer: n'.-de to conceal that fact other than perhaps subsi -,.-it!-F, i;.C.:t material or altering tag or log entries to foil a weight check. The magnitude of the effect will depend on the target sensitivity for the system and the highest rnimber in Column III. For example, an assumed mass sensitivity of 500 grams of special nuclear material would indicate that the magnitude of the expected anomaly would correspond to a single removal of material containing approximately 50 grams (500 grams divided by 10) of special nuclear material. The information in Columns IV
and VI of Table 5 is most useful for guiding the development of suitable investigative actions which would be implemented after the anomaly is discovered.
2.
Data Base for Estimating the Magitude of Normal Fluctuations Having determined the magnitude of an anomaly which must be detected if the target sensitivity is to be realized for 95% of the plausible thefts, normal fluctuations in that process parameter must be estimated. This can be based on the estimated performance of planned measurement technicues, the estimated production consistency from unit processes, the sensitivity of quality control analyses, and experience with a particular process or piece of equipment or with similar equipment at other plants of the same or another company. If the estimated normal fluctuations would mask the anomaly, use of such signals for that plant would provide an indication of possible theft for 95% of the plausible modes only for a higher mass sensitivity (perhaps 1200 grams of SNM)
and a change in production procedures (e.g., reduced process fluctuations, smaller material containers, more
5.24-2
quality assurance checks, etc.) would be required to render smaller anomalies discernible.
3.
Verification In addition to a mass sensitivity, .the analysis of theft modes should consider the time lag from first detection of the anomaly until recovery plans are initiated and the AEC is notified of a potential theft of material.
Investigative actions taken to verify the validity of a detected anomaly as a signal of a bona fide theft should be gauged to the variety of innocent causes for such an anomaly. A response based on an established hierarchy of decision makers (levels of responsibility for taking investigative actions)
can provide such timely verification. Further, a time limit imposed on each decision level for identification of the innocent cause also assures that anomalies will be promptly resolved or passed on to a higher level of management authorized to implement a more extensive investigation.
4.
Record Rentention to Aid Recovery In addition to providing a basis for evaluating the sensitivity of process data anomalies as an aid to material control, records allow reconstruction of the circumstances surrounding a detected theft and identification of salient characteristics of the stolen material. Such informatiofi can aid recovery measures and provide a basis for revising procedures.
5.
Examples of Investilptive Procedures Utilizing a Decision Hierarchy Response to an anomaly can take the form of an abnormal situation action sheet which would be prepared for each process operator and management official in the plant. The following scenarios indicate how such a system might actually work in practice.
a.
Abnormal yield A process operator notes on the basis of experience or posted normal values that the yield from a particular batch process is significantly less than normal.
He notifies his area foreman, (who may, for example, have had the process charged with a short batch to complete a particular job run) and immediately checks for material held up in the process or for an error in the product measurements. After ten minutes the foreman notifies his superior, for example, the MBA custodian, and initiates a check of the unit process run sheets, emptied process material containers, and material transfer documents to his area to assure that the proper amount of material had been charged and also checks scrap and waste streams from the process. After an hour the MBA custodian notifies the process engineer and begins an earnest search, calling for special product quality and measurement control checks and verifying when last the contents of the proces.& containers had been measured (such as transfer into the MBA,
origination of the item, previous physical inventory, etc.). After another four hours the process engineer notifies the plant shift supervisor and calls for an immediate physical inventory of all materials having passed that process step after the anom-ly was detected, a check and verification of the contents of all containers in the MBA, and a listing of all persons who may have had access to the material. If the mate;ial is not found within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> of his being notified, the shift supervisor calls for a shutdown inventory and notifies the plant manager and the AEC.
b.
Missing container A process operator is instructed by his job sheet to put the SNM of container A06 into process. However, upon going to get item A06, he discovers that it is not in the store of material awaiting processing. He then notifies his area foreman (who may, for example, have had another operator take the item for a QC sample) and immediately checks around the area to see if A06 was misplaced on the pallet, has a smeared tag, etc. After ten minutes the foreman notifies his superior, for example, the MBA custodian, and initiates a check of the unit process run sheets, empty containers, and process transfer documents to his area and also checks the area from which the container was supposed to have come.
After an hour the MBA custodian notifies the process engineer and begins an earnest search, checking to see when last the presence of Item A06 had been verified (such as transfer into the MBA, origination of the item, previous physical inventory, etc.). After another four hours the process engineer notifies the plant shift supervisor and calls for 100% inventory of containers in the concerned MBA, a check and verification of run sheets of similar processes in the MBA, and an item check of other MBAs. If the material is not found within
6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> of his being notified, the shift supervisor calls for a shutdown inventory and notifies the plant manager and the AEC.
C. REGULATORY POSITION
The following characteristics form a basis acceptable to the Regulatory staff for the analysis and use of production data anomalies as a means of early detection of thefts of special nuclear material:
1. Classification of Theft Modes.
In classifying theft modes, the following characteristics should be considered:
a.
Material attractiveness b.
Record modification c.
Distribution of amounts stolen d.
Removal mode e.
Number of individuals involved f.
Type of individual
5.24-3
2.
Performance Characteristics.
Performance chacteristics should be consistent with the following assumptions:
a.
All abnormal situations reported to the material balance -area custodian should be recorded as exception reports.
b.
The prescribed response to an anomaly for each level -of management should be consistent with the magnitude of the anomaly and the number of innocent events which could have caused it.
c.
The mass sensitivity should be consistent with the ability to detect 95% of the plausible theft modes as may be perpetrated by an individual granted access to the area.
d.
The time lag (from detection of the anomaly-first indication of a potential theft-until notification to the AEC) should not exceed 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
e.
To provide adequate records to suport an effective reconstruction of circumstances associated with a theft, records should be maintained as follows:
(1) All production information identified for use in determining innocent causes for process data anomalies should be maintained at least until the close of the second inventory period following thc one for which those data apply and should be retrievable within four hours of a request for such information.
(2) Exception reports, data actually used to identify the innocent cause of detected anomalies, summary (inventory period) reports of produclion activities, records of inter-MBA material ran.fers, and personnel access logs should be maintained for rive years following their preparation and should be available to the AEC within seven days of a request for such information.
3.
Assurance Statement The degree of protection afforded by analysis and use of process data anomalies should be expressed in terms of an assurance statement as follows: "Analysis of anomalies in process data will, within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of occurrence of that anomaly, detect an estimated 95% of plausible thefts of -
grams or more of by a lone individual who normally has access to the material."
TABLE 1 CHARACTERISTICS OF THEFT ATTEMPT
(INSIDER)
TARGET MATERIAL (MATERIAL ATTRACTIVENESS)
RECORDS (FORGERY OF RECORDS)
DISTRIBUTION OF STOLEN AMOUNTS (SINGLE OR MANY)
NUMBER OF INDIVIDUALS
REMOVAL MODE (SIMPLE REMOVAL OR SUBSTITUTION)
TYPE OF INDIVIDUAL
5.24-4
TABLE2 EXAMPLE: CLASSIFICATION OF THEFT MODES
MATERIAL ATTRACTIVENESS.
A.
FEED OR PRODUCT
B.
RECYCLE
C.
SCRAP FOR RECOVERY
D.
SAMPLES TO LAB
E.
WASTE TO MEASURED DISCARD
F.
IN-PROCESS MATERIAL
II.
RECORD CHANGE
A.
NO RECORDS CHANGED
B.
RECORDS CHANGED
1.
MEASUREMENT DATA
a.
GROSS WEIGHT
b.
NET WEIGHT
c.
CONCENTRATION
d.
ISOTOPIC
2.
LE OF MEASUREMENT INFORMATION
a.
GROSS WEIGHT
b.
NET WEIGHT
c.
CONCENTRATION
d.
ISOTOPIC
3.
CHANGE IN MATERIAL USE INFORMATION
(WHAT MATERIAL SHOULD HAVE BEEN USED OR WAS USED
FOR)
4.
CHANGE IN SAMPLING PLAN
III.
DISTRIBUTION OF STOLEN AMOUNTS
A.
SINGLE THEFT
B.-
MANY SMALL UNIFORM OR RANDOM THEFTS
IV. NUMBER OF INDIVIDUALS
A.
SINGLE PERSON
B.
TWO PERSONS IN COLLUSION
C.
MORE THAN TWO PERSONS
V.
REMOVAL MODE
A.
SIMPLE REMOVAL
B.
SUBSTITUTION OF INERT MATERIAL (CONCENTRATION CHANGE)
C.
SUBSTITUTION OF DIFFERENT SPECIAL NUCLEAR MATERIAL
VI.
TYPE OF INDIVIDUAL
A.
PROCESS OPERATOR
B.
NUCLEAR MATERIALS CONTROL PERSONNEL
C.
EMPLOYEE
FROM
ANOTHER
MATERIAL
BALANCE
AREA
PROCESS AREA (WITH PROCESS KNOWLEDGE AND UNDERSTANDING
OF RECORDS)
- In terms of potential utility-explosive, contaminant, adverse public opinion-and handling ease.
5.24-5
TABLE 3 EXAMPLE: WEIGHTING OF SUBCATEGORIES
I. MATERIAL
II. RECORD
III
DISTRIBUTION
IV. NO. OF
V. REMOVAL
VI. TYPE OF
ATTRACTIVENESS
CHANGE
PEOPLE
MODE
PERSON
FEED
1.0
NONE
1.0
SINGLE
1.0
ONE
1.0
SIMPLE
1.0
OPERATOR
1.0
PRODUCT
1.0
GROSS WEIGHT
2
.9 TWO
.3 SUBSTITUTION
MBA
IN-PROCESS
.7 CHANGE
1.0
3
.8 THREE
.1 OF INERT
.7 CUSTODIAN
.5 RECYCLE
.3 NET WEIGHT
4
.7 ISOTOPIC
EMPLOYEE
SCRAP,
CHANGE
1.0
5 to 10
.4 SUBSTITUTION
.1 FROM ANOTHER
SAMPLES,
CONCENTRATION
.5 MORE
MBA
.1 WASTE
.1 LE CHANGE
.1 THAN 10
.1 TABLE 4 EXAMPLE: COMBINING OF WEIGHTING FACTORS
I. MATERIAL
1
1. RECORD
III. DISTRIBUTION
IV. NO. OF
V. REMOVAL
VI. TYPE PERSON
VII. RELATIVE
ATTRACT-
CHANGE
PEOPLE
MODE
(MBA)
LIKELIHOOD
I VENESS
I
I
I
I
ISOTOPIC LE
(.02) I MORE
(1.0)1 ONE
THAN
(.1)
(1.0)1 TWO
(.3)
(.1)
(.11 THREE
THREE
SIMPLE
(1.0)
OPERATOR
(1.0)
"MBA CUSTODIAN
(.5)
"ANOTHER MBA
(.1)
SUBST.
(.7)
ANOTHER MBA
(.1)
"MBA CUSTODIAN
(.5)
"OPERATOR
(1.0)
SIMPLE
(1.0)
OPERATOR
(1.0)
"MBA CUSTODIAN
(.5)
"ANOTHER MBA
(.1)
SUBST.
(.7)
ANOTHER MBA
(.1)
"MBA CUSTODIAN
(5)
"OPERATOR
(1.0)
SIMPLE
(1.0)
OPERATOR
(1.0)
"MBA CUSTODIAN
(.5)
"ANOTHER MBA
(.1)
SUBST.
(.7)
ANOTHER MBA
(.A)
"MBA CUSTODIAN
(.5)
"OPERATOR
(1.0)
ISO1 OPIC
(.1)
ANOTHER MBA
(.I)
SUBSr.
1.0
0.5
0.1
0.07
0.35
0.7
0.3
0.15
0.03
0.02
0.11
0.21
0.1
0.05
0.01
0.01
0.04
0.07
2xloq NONE
(1.0) 1 ONE
FEED
(1.0)
WASTE
(.01)