NATL INST OF STAND & TECH

A111D7 E2kM03

NBSIR 74-524

NI6T

publications REFERENCE

Practicality of Diversion Path Analysis

William M. Murphey

John C. Schleter

Institute for Applied Technology

Technical Analysis Division

National Bureau of Standards

Washington, D. C. 20234

July 1974

QC

100

.1)56

74-524

1974

Prepared for Division of Safeguards and Security

U. S. Atomic Energy Commission

Washington, D. C. 20760

NBSIR 74-524

PRACTICALITY OF DIVERSION PATH ANALYSIS

William M. Murphey

John C. Schleter

Institute for Applied Technology

Technical Analysis Division

National Bureau of Standards

Washington, D. C. 20234

July 1974

Prepared for Division of Safeguards and Security

U. S. Atomic Energy Commission

Washington, D. C. 20760

U. S. DEPARTMENT OF COMMERCE, Frederick B. Dent. Secretary

NATIONAL BUREAU OF STANDARDS, Richard W. Roberts. Director

TABLE OF CONTENTS

Page

ABSTRACT 1

1. PERSPECTIVE ....... o . . . 1

2. APPLICATION OF DPA .............. 2 2.1 Diversion Path Analysis . . 2 2.2 Purpose „ 2 2.3 Choices ....... o ....... ... . 3

2.3.1 Mass Sensitivity Boundary Value . . . „ „ 3

2.3.2 Time Sensitivity Boundary Value ... 5 2.3.3 Relative Weight Factors for Material Attractiveness ... 5 2.4 Conduct of DPA . , 5 2.4.1 Data Gathering ....... 0 ..... . 7 2.4.1.1 Establish the Bounds of the DPA 7 2.4.1.2 Identify the Unit Processes 7 2.4.1.3 Detailed Examination of the Unit Processes ... 9

2.4.1.4 Diversion Inquiry Session 9 2.4.2 Analysis 11

2.4.2.1 Process and Internal Control Understanding ... 11

2.4.2.2 Consideration of each Generalized Diversion - Path ......... ........ 18

2.4.2.3 Summarizing Diversion Path Data ........ 22

2.4.3 Documentation . ................ 23

2.4.3.1 Workpapers ..... 23

2.4.3.2 The Summary Report 27

2.4.4 Results of the Test of the DPA Procedure ... 27

3. SUMMARY 29

ACKNOWLEDGMENT ........ . ...... 29

REFERENCES

.

29

GLOSSARY 30

PRACTICALITY OF DIVERSION PATH ANALYSIS*

William M. Murphey and John C. Schleter

Technical Analysis Divisipn

National Bureau of Standards

ABSTRACT

One can define the safeguards system for nuclear material as the

set of all protective actions taken to prevent or to deter attempts to divert

nuclear material to unauthorized use„ Maintenance of effective safeguards

requires a program for routine assessment of plant safeguards systems in

terms of their capabilities to satisfy safeguards aims. Plant internal control systems provide capabilities for detection of unprevented diversion and can provide assurance that diversion has not occurred. A procedure called

Diversion Path Analysis (DPA) enables routine assessment of the capabilities

of internal control systems in this regard and identification of safeguards

problem areas in a plant. A framework for safeguards system design is also

provided which will allow flexibility to accommodate individual plant circumstances while maintaining acceptable diversion detection capability. The

steps of the procedure are described and the practicality of the analytical

method is shown by referring to a demonstration test for a high throughput

process where plant personnel were major participants. The boundary con- ditions for the demonstration case are given, along with some conclusions

about the general procedure.

1. PERSPECTIVE

For safeguards, protective actions taken to prevent or to deter

attempts to divert nuclear material to unauthorized use may be classed as subsystems by means of which one or more adversary actions may be countered.

Thus, the subsystem for prevention of unauthorized access to a facility

addresses open attack, surreptitious entry, misrepresentation without con- cealment of the attempt, etc., on the part of the adversary. The detection

of unprevented theft represents yet another subsystem.

Plant internal control systems have inherent capabilities for

detecting unprevented diversion, for providing recovery information, and can

also assist in providing assurance that diversion has not occurred. However,

a procedure is needed for routine assessment of the capabilities of internal

control systems for indicating unprevented diversion; for identifying safeguards problem areas within a plant; and for substantiating assurance statements. The procedure should also provide a framework for subsystem design

which will allow flexibility in accommodating individual plant circumstances

while maintaining acceptable overall diversion indication sensitivity. Such

a procedure, named Diversion Path Analysis** (or DPA) has been developed and

is nearing completion as an operational tool.

* Work supported by the U. S. Atomic Energy Commission, Division of Safeguards and Security

** Specialized terms associated with DPA are listed in a glowwary at the end

of the paper.

1
2. APPLICATION OF DPA

2.1 Diversion Path Analysis

Although originally designed for the assessment of internal control

procedures, the concepts underlying DPA are also applicable to other

safeguards subsystems. The following sequence focuses on the steps employed

in the analysis:

9 identification of significant parameters for description of

diversion possibilities;

• determining the possible ranges of values of the parameters;.

• ordering the possibilities by means of the chosen trade-off;

« assessment of a system or a system design in terms of

- uncovered "holes" (or weak points) revealed through

the standard list of possibilities, and

- extent of coverage within prescribed tolerance.

The procedure may be broadly applied to the facility perimeter

system for control of facility access, to the material perimeter system for

control of access to material, and the facility perimeter system for control

of removal of material from the facility. However, in the present context

DPA is discussed as a means for assessing internal control systems to detect

covert diversions through systematic examination of paths, proceeding in

order of relative path complexity and material attractiveness and in light

of all pertinent knowledge about protecting, handling, and storing Special

Nuclear Material (SNM) in the area being assessed. The coverage of a particular diversion path is evaluated by assessing the mass, time, and space

sensitivities of indication of diversion.

2.2 Purpose

DPA is intended to provide information for management decision; to

locate "holes" in systems for detecting unprevented theft; to balance

resource allocation on a subsystem scale; and to provide assurance that

absence of signal implies that no diversion has occurred within the

boundary conditions of the analysis.

Information generated by the DPA allows management to decide

whether the internal control system needs to be modified and how this should

be done, as well as whether there is cause for alarm. The internal control

system may be changed relative to the raw data inputs, data analyses, or internal control procedures. On a continuing basis, management can review

experience with abnormal situations; if their frequency is high, perhaps

internal controls should be altered to reduce signals arising from innocent

causes. However, any decision to modify or upgrade procedures should be

supported by a specific statement (which results from DPA) of the diversion

possibilities to be covered by the additional abnormal situation test.

Should DPA indicate that all diversion path possibilities are covered within

prescribed boundary conditions, coverage should be explicitly

recognized and "no action" is justified.

2
When an abnormal situation is observed, DPA generated information

specifies those diversion possibilities which could precipitate the abnormal

situation and indicates material availability, opportune times for removal

and persons having authorized access during the period in question. The

DPA also supplies a relatively objective list of possible innocent causes

of any abnormal situation under investigation. This permits careful review

and examination of other possible causes, generated after the fact under

pressure for resolution, to assess their validity.

A key aim of DPA is the location of "holes" in the current system;

diversion paths which are not adequately countered within time and mass sensitivity boundary conditions. Through analysis, such paths are highlighted

and, oftentimes, easily implemented countermeasures come readily to mind.

The unprevented theft detection subsystem may be balanced, for resource allocation purposes, relative to the different possibilities for

removing material. Such balance is achieved through an ordering procedure

for generalized diversion paths which is inherent with DPA.

Assurance statements apply to the design, implementation or operation of the system during the preceding time period. DPA supports

assurance statements related to design of systems for detection of unprevented

theft, providing a specific list of diversion possibilities covered by the

system.

2.3 Choices

The DPA procedure requires making a set of choices which influence

the resultant characterization of the system with respect to safeguards

goals. Some choices pertain to the degree of risk to be tolerated, while

others relate to uniformity and consistency if DPA is to be applied to a number of areas within a plant or to a number of plants. Selection of

options entails establishment of rationales and, perhaps, alternative

characterizations. This was highlighted during a DPA test, particularly

when ordering the diversion possibilities to be considered and the

decisions of "how far to go" with regard to degree of path complexity for

various materials present in the process area. Three fundamental choices

apply to the analysis of any area, namely: mass sensitivity, time sensitivity

and the relative weights assigned for material attractiveness.

2.3.1 Mass Sensitivity Boundary Value

Mass sensitivity refers to the ability to detect a single diversion

of X grams or a series of diversions totaling at least X grams. The

limiting value established for X dictates whether available indicators

provide adequate coverage for a given diversion path even though other

procedures having better mass sensitivity may be available. If the

selected level is seen to be attainable by means of some procedure, no further analysis need be applied to that diversion path.

For purposes of analysis, the mass sensitivity value has been

selected as l/10th of the approximate amount of material which might suffice

for a crude explosive. Thus, plutonium and U-233 might be assigned a mass

sensitivity of 500 grams of contained fissile (Pu-239 + Pu-241) . A mass sensitivity of 2.5 kg contained fissile might be chosen for U-235 and U-238

which leads to the mass sensitivity/enrichment relationship shown in

3
Figure 2.1 Mass Sensitivity as a Function of Enrichment

4
figure 2.1. For the DPA test, the establishment of 500 grams Pu as the mass sensitivity was further rationalized on the basis of economics of information

precision and observed process fluctuation and control.

2.3.2 Time Sensitivity Boundary Value

The choice of time sensitivity was rationalized through the

economics of detection, the response time needed for preventing the

event, or end-use of the material, and for recovery. In establishing

time sensitivity, attractiveness of material must also be considered in

light of possible events which might be perpetrated using the particular

material type and description.

For the practicality test, indication of diversion within 24

hours for a single removal or within 24 hours of the last removal of a series was chosen as the time sensitivity boundary value for very attractive

materials. If some indicator would meet this time sensitivity, a particular

path coverage was considered adequate.

2.3.3 Relative Weight Factors for Material Attractiveness

When materials of several types or descriptions are subject to

illicit removal from an area, they may vary in desirability by virtue of

their relative adaptability to the diverter's intended end-use. Material

attractiveness must therefore be viewed in terms of resources, effort

and personal risk to the diverter which will be involved in transforming

the diverted material into a detonatable form.

2.4 Conduct of DPA

During DPA development, it was estimated that a team of three

members of the plant staff could perform the analysis of an area; the area would encompass a Material Balance Area (MBA) or about 10 unit processes,

whichever is less. The team would be composed of the area process engineer*

and process foreman and a representative of the plant safeguards authority.

The process personnel bring to the team first-hand knowledge and can quickly provide complete and detailed descriptions and information about

the process and its operation. The plant safeguards authority representative

brings knowledge of the DPA procedure and is responsible for performing

the analysis. The practicality test verified that this composition is

adequate for a DPA team.

Three basic steps are followed, each entailing a number of

activities; these are schematically illustrated in figure 2.2. Data

gathering refers to establishing the bounds of the analysis and those

activities related to gaining thorough understanding of the conduct of

the process, its operation and its performance. Information and data

gained in this step allows a realistic analysis of the internal control

system and provides knowledge of processing situations which would be

considered unusual by the operators, process foreman or process engineer.

Analysis of diversion paths is the systematic consideration of

possible means of removing nuclear material from the process area and,

* The process engineer is the professional (or professionals) directly

responsible for improvements to the process and for the specification

of the internal and process controls to be used in the process area.

5
o

DECISION TO DESIGN OR

REVIEW THE PLANT

SAFEGUARDS SYSTEM

r 1•

i 1

a

Figure 2.2 Basic Steps of Diversion Path Analysis
if successful, how the removal would be discovered or indicated. Routine

documentation of the DPA is accomplished through the workpapers and the

summary report. The workpaper document provides a complete permanent record

which accurately reflects the analysis performed and serves as the basis for

follow-up in the event of safeguards problems and for verification of

statements made in the summary report. Completeness of the workpapers is

essential to providing assurance about the correctness and adequacy of

the design of the internal control system.

The summary document for each DPA pinpoints possible problem

areas in the plant safeguards system,, Since they are routinely reviewed

by management, the content should stand alone providing concise information

needed for overall evaluation and management decisions <> It is essential

that results and conclusions of the summary report be supported by and

be traceable to the workpapers.

2.4.1 Data Gathering

There are four facets associated with data gathering each composed

of a number of activities as illustrated in figure 2.3

2.4.1.1 Establish the Bounds of the DPA

Explicit agreement must be reached among the team members as to

what portion of the facility is to be analyzed. Later, a review is made

to ensure that no portion of plant activities has been neglected. There

are three types of bounds to the analysis, the first of which is the

process bound, an explicit statement of the process activities encompassed

by the analysis. Second is the materials accountability bound. Because

of the independence of measurements, personnel and geographic localization

of currently defined MBA's, an analysis will rarely cross an MBA boundary.

However, large or very complex material balance areas may be subdivided

for purposes of analysis into groups of about ten unit processes. Third

is the personnel bound, that is, which personnel are explicitly to be

considered as potential diverters for the area under scrutiny. Those to

be included in the class of potential diverters cannot conduct the

analysis

In the practicality test, the process bounds began with acceptance

of material coming into an MBA and ended with shipment verifications as the material was transferred to the following MBA. The accountability

bounds were the material balance area, and the personnel bounds were all

process operators assigned to the area, outside visitors who might be in

the area, plant employees assigned to other material balance areas,

construction personnel who would not be plant personnel but who have

access to the interior of the plant, and persons not authorized to be in

the area.

2.4.1.2 Identify the Unit Processes

For purposes of analysis, the overall process stream of a plant

is subdivided into many smaller operations, called unit processes, each

of which is characterized by a "branch point" in the process stream,

that is, where material changes its physical or chemical form or composition,

or where by-product, such as recycle or scrap, is generated. Further

details of the concept and identification of unit processes have previously

been described [1],
DATA GATHh

ESTABLISH THE BOUNDS OF THE DPA

PROCESS BOUNDS

ACCOUNTABILITY BOUNDS

PERSONNEL BOUNDS

IDENTIFY THE UNIT PROCESSES

DETAILED EXAMINATION OF THE UNIT PROCESSES

STEPS IN THE PROCESS

IMPORTANT PROCESS VARIABLES

INCOMING MATERIAL FLOWS

OUTGOING MATERIAL FLOWS

RECORDING AND MEASUREMENT ACTIVITIES

INSTRUCTION FLOWS

CHECKS AND VERIFICATION FOR PROCESS COMPLETION

PROCESS CONTROLS

QUALITY CONTROLS

MATERIAL ACCOUNTING ACTIVITIES

DIVERSION INQUIRY SESSION

CHOICE OF DIVERSION INDICATION SENSITIVITY OBJECTIVES

MASS

TIME

SPACE

MATERIALS LIST AND CHOICE OF RELATIVE MATERIAL

ATTRACTIVENESS

DIVERSION PATH DISCUSSION

FOR EACH MATERIAL;

IN ORDER OF MATERIAL ATTRACTIVENESS;

IN GENERAL ORDER OF PATH COMPLEXITY:

IDENTIFICATION OF DIVERSION PATHS

ELIMINATION OF IMPOSSIBLE PATHS

FOR EACH ABNORMAL SITUATION; THE OBSERVER, MASS

SENSITIVITY, TIME SENSITIVITY, INNOCENT CAUSES

DETERMINATION OF CURRENT COVER

DETERMINATION OF POSSIBLE FUTURE COVER

ABNORMAL SITUATION OBSERVED OBSERVER IDENTIFICATION

MASS SENSITIVITY

TIME SENSITIVITY

INNOCENT CAUSES

INDICATION SENSITIVITY OBJECTIVE GUIDELINES

MASS

TIME

SPACE }

AS A FUNCTION OF MATERIAL ATTRACTIVENESS

Figure 2.3 Activities Associated with the DPA Data Gathering Step

8
Each unit process, identified in the previous step, is now

examined in depth in order to assure that the points indicated in figure

2.3 under this heading are fully understood by each member of the DPA

team. Topics discussed while carrying out this step in the course of

the practicality test are listed in table 2.1.

The detailed examination results in an annotated material and

information flow diagram for each unit process. Preparation of these

diagrams is, however, reserved until the analysis step described below.

2.4.1.4 Diversion Inquiry Session

The diversion inquiry session provides a forum for quickly

interchanging raw information among members of the DPA team in order to

expose diversion possibilities and their covers. Our experience has

been that plant personnel of the caliber composing the team have already

given thought to means of removal and can readily make suggestions as to

which paths are possible and the status of current cover. Major points

to be discussed in the session are set forth in figure 2.3.

• Choice of Diversion Indication Sensitivity Objectives

Sensitivity objectives, possibly in the form of guidelines

may be established in the future for purposes of consistency and

comparability between DPA's. In the interim, corporate establishment of

objectives can contribute toward this goal. Otherwise, the choice of

sensitivity Objectives falls to the DPA team. The choices of mass and

time sensitivities for the practicality test have already been discussed,

space sensitivity was automatically restricted to the MBA under scrutiny.

« Materials List; Material Attractiveness

i The list of materials, different material types (if more than

one is present in the process area) and different material descriptions

(chemical and physical forms) will be a direct output of the detailed

examination of the unit processes. Relative material attractiveness

(pending a uniform choice or more specific guidelines) must then be opted.

• Diversion Path Discussion

The heart of the diversion inquiry session is consideration

of all conceivable diversion possibilities. Adequately covered paths can usually be dismissed quickly at this point, leaving the remaining time for

discussion of paths not currently covered. In the practicality test, the

foreman and process engineer possessed knowledge which allowed rapid

dismissal of many diversion paths as meaningless, permitting focus on more

meaningful potential paths.

9
A. CHEMISTRY

1. CHEMICAL EQUATIONS

a. REACTIONS

b. ENERGY RELATIONS

c. REACTION RATES

2. RESULTS

a. EXPECTED (THEORETICAL)

b. EXPERIMENTAL (CHEM R&D)

B. CHEMICAL ENGINEERING

1. CHEMICAL ENGINEERING CONSIDERATIONS

2. PROCESSING PROBLEMS

a. POSSIBLE CAUSES OF LOW Pu IN SCRAP

b. POSSIBLE CAUSES OF HIGH Pu IN SCRAP

c. OTHER PROBLEMS

C. FAMILIARIZATION WITH PROCESS AREA

D. PROCESS PROCEDURES

1. OPERATION

2, OPERATION n

3. OPERATION

4. OPERATION 4

OPERATION 5 J

OPERATOR ACTIVITIES

FORMS COMPLETED

ROUTING OF FORMS

EACH TO J RECORD MAINTENANCE

INCLUDE ] RECORD ACCESSIBILITY

ENGINEERING CALCULATIONS

ENGINEERING JUDGMENTS

EXPERIENCE ^ENGINEERING DECISIONS

1. YIELDS

2. FREQUENCY AND CAUSES OF BAD YIELDS

3. OTHER PROCESS PROBLEMS

4. MISPLACED MATERIAL (RESOLUTION TIME AND EXPLANATIONS)

5. RESIDENCE TIMES FOR MATERIAL IN VARIOUS PROCESS STEPS

6. RESIDENCE TIME OF SCRAP IN STORAGE

7. COMPARISON OF BY-DIFFERENCE SCRAP TAG VALUES AND RECOVERY VALUES

8. NDA EXPERIENCE WITH SCRAP

9. PRIOR PERIOD ACCOUNTING ADJUSTMENTS

10. ACCOUNT MUF VALUES

Table 2.1 Topics Discussed For Detailed Examination of Unit

Processes During Practicality Test

10
Typical questions were: "If you were after such-and-such

material, what specifically would you take and how would you do it?"

The ensuing discussion led to "How would you know the removal had occurred?"

and "How could you determine this type of falsification, substitution or whatever more quickly?" . Although the discussion concentrated on more

complicated paths, information was also provided about the coverage of less

complicated paths, usually expressed as "you wouldn't do that because...".

The sequence of analyzed paths is soon terminated at a point where remaining paths have relative weight values less than the

pre-selected boundary conditions (related to credibility as a function of

path complexity) ; another material is then selected for consideration.

The procedure ends when each material in the precess area has been considered

at all locations where that material may be found.

2.4.2 Analysis

Data gathering and the inquiry session illuminate the safeguards

status of the area under scrutiny, and analysis provides assurance of

completeness. One is thereby assured that there are no paths which are either uncovered or only marginally covered (that is there are no "holes"

in the internal control procedures) within the boundary conditions. The

analysis portion of the DPA is illustrated in figure 2.4. Each step is

amplified below.

2.4.2.1 Process and Internal Control Understanding

• Generate the Information and Material Flow Diagrams

The data are analyzed to isolate the following information and

material flows for each unit process:

- incoming material and information flows;

- information and data generated at this node;

- records maintained at this node;

- records and reports prepared at this node;

- outgoing material and information flows; and

- other characterizations of the node such as material handling activities.

The resulting information is summarized in an annotated diagram,

shown for the general case in figure 2.5 and for a particular unit process

examined in the course of the practicality test in figure 2.6. Accompanying

these diagrams are notes in which the material and information flows are

detailed. The notes shown in outline form in tables 2.2 and 2.3 correspond

to the diagrams in figures 2.5 and 2.6, respectively. It may be observed

that the diagrams and notes are less complex for the actual unit process

than for the generalized case since the latter must include all possible

flows, many of which may not apply in a particular situation.

• Numerical Analysis of Process Data

The end result of numerical analysis of process data is a characterization of all variables which might reasonably be expected to

have safeguards significance by manifesting abnormal fluctuation should

11
ABNORMAL SITUATION OBSERVED OBSERVER IDENTIFICATION

MASS SENSITIVITY

TIME SENSITIVITY

INNOCENT CAUSES

INDICATION SENSITIVITY OBJECTIVE GUIDELINES

MASS

TIME

SPACE }

AS A FUNCTION OF MATERIAL

ATTRACTIVENESS

ANALYSIS

PROCESS AND INTERNAL CONTROL UNDERSTANDING

INFORMATION AND MATERIAL FLOW DIAGRAMS

EXPLANATORY OUTLINE

NUMERICAL ANALYSIS OF PROCESS DATA

TIMING INFORMATION

CONSIDERATION OF EACH GENERALIZED DIVERSION PATH

ORDERED DIVERSION PATH CHECK LIST

CONSIDERATION OF EACH PATH IN ORDER OF

EACH MATERIAL

NO COLLUSION

COLLUSION

DIVERSION PATH NOTES

DIVERTER

MATERIAL

CONCEALMENT SCHEME

ABNORMAL SITUATION

POSSIBLE INNOCENT CAUSES OF ABNORMAL SITUATION

SENSITIVITY AS A FUNCTION OF DISTRIBUTION OF

DIVERTED AMOUNTS

DIVERSION PATH CHECK-OFF DATA

SUMMARIZATION OF DIVERSION PATH DATA

ABNORMAL SITUATION LIST

LIST OF DIVERSION PATHS FOR GIVEN ABNORMAL SITUATION

DIVERSION PATH- -ABNORMAL SITUATION CROSS-REFERENCE TABLE

INTERNAL CONTROL HISTOGRAM CHARACTERIZATION

NO COLLUSION

FOR EACH MATERIAL

FOR ALL MATERIALS

COLLUSION

FOR EACH MATERIAL

FOR ALL MATERIALS

SINGLE PARAMETER MEASURE

Figure 2.4 Activities Associated with the DPA Analysis Step

12-
co

i-l CD

4-1 1-4 U CO

CO

cuo

o

u

Cu

c

to cu 4) -O

> CU •H B

4-1 i-l U CO at 4-i d

60 O

B O

1-1> H

i-* O

aty 6

01 01 H 4J

i—I a) a r-4 a. x co co

•H .-4 X —' Cu 4-1 Cu CO 4J CO Cu c

HI m C

E i-i O

0) w -4 U co 3 OS M

COCO

41o

o

Cu

CO M

01 '—

01O 00 o c U -M

Cu M

3

01 3

CU •«-! o

O CO U 4J a. c

<u *j e

•H 0) C U

3 3

CM 3 M M CU X B

O

CO cu

if CM C *J

CU 01 co

CO 4-1 o u 00 u 4J c

1-f c a CU 0 CO o CO

CO cu 10 CD CM >,U-I •H 1-1 a

>. e 4J CO CO f—

t-l 4-1 o

rH CD u cu •r4 c •—I CO Cu CO 1-1

ca M QJ •H CO co x 0 3 4-1 C 3 Cu 4J M M 3 4J t-l 4J CO

CO CO co at u CO CO Cu i-l l-l LU

CO CO > c 3 Cu Cu co cu a

o cu 1-1 i-t I-I CO Cu O 1-4 E 1—

4J CO CO CO 3 o z

a. nj CJ 4J •M 4-1 O I-I 4J tg 0 0) CO B CO s H co i-i 01 3 E CO CO

4J 4J at 0 o 01 -O CO x 0 M 0! i--5 o <d i-i i-l 60 y u 4J

co 1-4 4J u a U 01 0 u c

•H M

Cu M O

O M

Cu —4 CU

CO co

i-l O i-4 U

> C Cu J

•M 3 Cu

4J CM i-l E y X 0)

CO X W 4J

CM i-l M CM

cm co -a o co

CO CM

at o y

OM O

cu cu X!

4J CJ

t4 4J CO y CO CO

C

COH CM

CU 4J C -a i-4 oi 3 CO >M 4J -o c CU3 O a

3 CO 01 E 0) 01 cu O CO c cu 4-1 a

> -o < cu J3 o ca a > ca •o

CO M C o X 4J o cu O .M M s .X U 4J

CO cu cu z U O 1-1 1-4 I-l CJ CU ao cu CJ 0 cd O CO Cu Cu M Cu 01 CO CO Cu 01 «H >

u XI cu CO J= X 4-1 01 X M M o o a « XI o 4J > t4c •

4J CJ

•Mc • O a CJ Cu

bse CN CO <f D -i CN CO o

at3 4-1

4-' or •M < cc H 5) 0' CO Z CJ I—

i-l o O

CO 1-4

CU CO

co a

XI OS o op

a w 7'

O 4J U

B -M ..4 Xi c c < D 3

0 ©

3O

Io

cuu

u

0) ca ca u to

01 41 CM O

co C

e m

CO Cu M

4J U

1-1 C 3

CO

4-1 e C an o 0 -M CO i-l 01 «M 4J « O M CO O 41 4) CJ 41 I-l 4J i-l > CO VM

i-i h S i-i 01 O u

CJ CM <M 41 41 O Cu M CO co

4-1 t-4 CO CO CU T3 U T3 C C

41 i-l CO C 4J CO

1-1 X> 4-1 CO

co 60 C C

4J i-l O O

e oi cj i-i O S 4J

CJ I JZ CJ O 3 M CJ CO M

O 01 41 4J Si CO

CO CJ M B E O -M

41 4-1 CM u e e

i-i at cu o

•O 3 i-l CM C i—I 4J O 41 CO CJ Cu > 3

4-i cu *a

CO "O 60 O

•r4 C CO U J H H £

«

y

41 B

U 0) C "H

01 M

CU m a

41 X

Cu 41 X

41 S

•o -a C 81

CO ^ E

CO 6£ E

oi >> M ^

0 X CM CO X 01 O

01 u

01 Cu

CJ w

o

U B

Cu O

CM

B co 5 a

4J O

CO <4-4

1-4 C

CU 1-4 Cu0 BO

ca i-l 01 4J

41 3

CJ X

O i-l U U a 4J

01

,-1 -H

CO tJ aos

O i z en

oi o 60 M i-l —

3 CM CM

So

•H 41 O

VM XI 4-1 4J C 41

i-l >M O

o c

?s 'J - 1 T3

i-M CI &

cu l-l y 4i •M 01 M

ij -a i u c co

CM O

O "»-l

c W i-l

41u

Cu

CMO

H

01a

•HO

4-1 c M O « y M

ce m

o- o

cuu e

Cu CU

CU T3O

cu T3

4)Cu

4J X! E

60 M

•M O

CU CM

i—

4J CO

cu y

a 1-4E M CU o x;

0

co

co

01y co O 01 U i-l Cu 4J

1-1 4J >

$i!t4 OVO S Hi!

•M y y z 60 co M O oi B E

41 CU i-l M CO i-l W

u x y h oi i-4 o

CO 4J <fi CJ <D U-l a 25 o > c

01 CM CD 2 M CO 1-1

T3B ^ c0 COU

CO X -4 E

•H 3

CO B

4J

41 T3 3

O

4J i-l B 41

41 x> c

•H B

4J 41 u >

41 -M

Ou 60

4-i 60

CO <->

CO H

co . O CO

co

CO CO O >,S

m x; z U CU CO

•au u 0 cu

cj cu

41 01

I-i B

CO

I-i I-i 01 H

XI

COB

O

•M B

4J O

CO -M

l-l 4J

4) COo

M CM O 6

ca 01 B 01 O 3

co41y

o

wa

CM

COa

CO B M

CO 4J

U CO 01 u

3 i-4 3 CU u u y 4J

CO

3

oXCOa

o

a -h

CO 4-1 E 2 41 E

•a

CO C

co co

41y • O >i M -4 C M

41 ao a

e o

•M u

T-i a

XI

CO 60 a a

41 i-l CO

4-1 C

S CO O O M i-l •M 01 4J

4-1 CU CO 2 O 3

E 4J M CO 1-4 O 1-4 CO C CO i-4 |-| 4J

i-4 CO .3 E

•o o o

cu m B

4-1 CU X

y co

41 4J Cu co 60 x sz e

41 4J *l

41 M 3

4J CO •H > 5 6

4J O

y w

CO CM

CO r-4 CO CO

41 i-l CJ U

O 01 M

Cu COE

4WJ S

C co 3 M

•O U X

o

, e X 01 M -4 O X

* 2

CM Cu O

>. 4J Cu-H O >

y i-t

>> oi

CO 01 E cd E O

B co M S

HN(O^IOO-4CM(n

S E z

tO CMo 2 CO

1-1 E J

O

t-4 •

ft. T—l

u

o

01 CM CM

41 B y co i-i o oi U 41 01 Cu y b

O t4

41 tl 14

i-4 Cu 3

B O 3 |

«!

I-i •

(14

cu 3 X o

c O Jj!

4J CO

01 U -M i-l 60 Cu

eg u c

CO 4-1 M -M

01 u

CO Cu CO

CO O cm

B O

O 4J

4-1 e

y o

3 -M M 4J

i-l co

CO N B -M

l-l o

J"! X

t-l -M

X

41B

60 »-\ s c

•M O

>. -4

CM 4J -M CO 4J 3

O 4J a -m

co C

4) o

t-l «—I —4 O CO 4-1 >H E 3

41 U t-i X O O

B CO T3 X 01

41 CO M

3O <M M

-4 O O

i—

CO 41 41 Cu CO

II ^ 3

E 4-1 CO

CO C

41 CU CO TJ

-m t-i ^ cm c o 1-4 cu e

M O CUX

P- co co <J

CO

I «

60 01 C ^ •H O

d

to !-> X

I c

c3

•i-l T3

i-i a>

0) w

4-1 -l-l

Cfl CU O

c

O J=

•i-l 4-1 4J t4

tO IS o ai CW 4-1 M -i-l u

IW O o to

CO

I to < I I—

•r-l CO

C3 S

4-1 O

0) r-4 O Eh

CM

01 0

CO H

13
<

> r-4 _

t-4 OJ> C8

CI >. r4 4)

l-i I -o

44 O t-l

' 3

'

u

O

O. 44 o> sou 1- C 9) •o

9

01

cj cd

o> 3 c 44 •H fi 00 CO c

0) r-4CO

-i m x> . XJ E 03 c c ctj c

o o> o

rl Cl « fl

01 44 XI CJ CJ C O CO

ft i-l 44

4)CO fl 3 Mumu u

o

CU 44

cj e

U 01

00 N E O i-l fl E

4-> g e -h

i-i x:

CJ o

a. 1-4 O J23

CO

c e

ft O

u

CJu a> r e

0)

fl la U CO i-l

o) e c i-i ot

CO U fl 1-t O

CJ C 2-S

Q.

4) -d J3 E

CO00 o> X.u

CO a

o o> u u ti u a jj

CO > CO

1-1 44 u

o

60 o a

CO CH O he in;CO

re

01 C O C 44 la 14-1

J= a •H 0) j= i-l e 4-1 •v u

CJ a. x: la la fl 00 u 0 O CO 01 XI 3 c

0 CJ CO i-i CO •H

U-l cu co 3 >>XJ i—i c r-4 CL) i-l

' 05 o o h 01 c 4-1 B5 fi u 00 o CO 01

01 u C 14-1 O -a E O a) u i-l a. h 0 0 CJ c i-l ~a la 3 I-l Sa OJ !-i u 3 Xi U-l a. < CO O o cu u

Cl u 0) 6 o CO 0) 01 CO > H 1-1 h ll O si

U r4 O CO o. e

OJ 1-4

t-i o

c

X)

co

4»"> fl . rH

•4-4 aa o B "O

cd o

01 g q9 < 1-3 44 «j fl 4J

CO OJ £ < PP CO 03 •a co

CJ 44 13? s j2 3 E O 3

xz 09 4-1 4J £ CJ 44 W

>> c c < 4J s

44 CO

CO 0) CO .Ul 4J f3 44 B 3 4-1

4-1 c 14 1-1 c X c OJ j«4 01 CJ —

i-4 o» 05 OJ OJ CJ 01 (4 3 /—14 3

la j; a 14-4 u-l u <u 14 01 c« 44 OJ as co 44 o u U-l < U4 81 a OJ U-4 1= > 05 >^ U4 2 > 0) XI cd fl g

fl U-l CJ cu U4 fl 4^ U4 C/3 w fl

iJ 00 3 "O •o U-l |4 <44 fl E |4 fl s

3 o 00 00 fi 41 14 •a ai 01 •o 01 |4

CO r4 01

14-4 b 14 4-1 "O U4 "O M j3 r-4 PP PP § as .C 01 fl o £ o U-4 u 4U S CJ CJ 14 CJ r-4 eg b cd c 01 1-1 fl |4 o o CJ TJ o CO o CJ M 01 o "0 o 44 f-l 44 r-4

l-i .<-] i-i E CJ E 01 B cd CJ 01 < c cd £6

CO 4J 4J 44 CO CM 01 01 |4 la 0) E 01 o o E PP 01 CJ O

3 cd c CJ co U-l 0) 4J §

o 0 4J a H •H T3 § S u •H o

00 3 CO c 1-1 ft Oj 44 fl 05 01 44 CO 0) 4J TJ

01 -U r-4 3 B T3 c CO 05 u 05 0) U-4 >, oo 01 U4 >>

U4 ft Cu U-4 i-i i-4 E i4 1 e U-l r-4 6 B 6 U4 r-4 /-v csO

eg CO |4 U-l a 9 c 0 U-l ft 5 ^4 CO 44 fl -r4 co fl Cd 44 B

Cfl I—

0) rB >,

F-l CO co

CO o CO

CO

U-lo

fi 05 14 x>

CO •a

!a U4O 95 CO *0 B

CO CO CLfl CU 05 CO "O B CO Cd -r4 i4

o,

44 co 4-1 u CO 01 0) 0) CO c CO f—

CO CO C 00 fl CO B B w 00 Cu c e 01 kJ CO 0) u

a

u E CO (0 •H CO u "O 01 ° fl 0 £. 0) fl fl o -4

a) vi J-l n. q 01 CJ o o O co OJ CJ H 0) 05 OJ CJ ^ ^ >>f4 CO CJ >>r-l j3 o cd O O •F-l o M co |4 I-i 01 o 01 CJ CO CO fl Cu o CO 05 c 1-1 O ^ 0 CO CO c |4 O co Cu c J3 1-4 Z 4J O. Cu U4 u o 00 o CJ «J TJ Cu CO 14 CO CO co o B CO u co co CO O B

i-i o. •r4 CU c 0 1-1 CO u .-1 |4 fl CO CU /*N CJ QJ fl 44 ,C 00 CO Cu r*"\ 01 01 fVJ 44 XJ

-o co [14 > 4-1 fi 4-1 t> |4 a, |4 c 44 CO x; V 14 CJ CJ o CS CJ B CJ 14 cj o o ed U 00 c o i-4 4-1 fl fl 01 D. o >, la 01 05 CJ i-l O o O o 14 01 fl o 44 0 O 0 o 14 OJ B

CO M-4 U-l c 4-1 •-4 c •o c > 4J 4J 4J r-4 a 01 14 (4 o fi 4J IJ L4 44 O 44 > o fl iJ |4 |4 44 O 44 fl o 1-4 cd c/3 O c 3 0) 3 fl <u •-4 05 fl CO > 3 01 0 14 B CO a Cu CO Xl fl u B Cfl Cu Cu (fi 43 _ Cu u u eg 3 H 01 i4 e d C OS o co XI 4J Cu 3 l-i 3 cd a oi CL 3 14 59 Cu

01 £ 01 XJ O E o E CJ C 3 u 3 cd CJ CO cd 0) 4J 4J CJ r-4 u3 o 01 44 4J o fl

Oi 0> > CJ M 00 00 O i-l o 0) 3 o o 01 0) 0 1-1 i-l ^-1 Cu fl •H Oh 01 4J r-4 CL •H i4 OS 43 c •i-4 C H

00 «£

i-l N

C s u CO I-l 14 0 U4 O o 4J H E 4J 01 •r4 cd o E B r-4 |4 fl CO o B B r-l w CO

.-1 > co •H •-4 U-l U4 00 4J 4-1 4J Cu c B 3 3 CO B c 3 3 cd 00 01 I-l -o --4 c H

f-4 o O i—l o 3 0 CO C/5 CJ CO CJ 3 o CO CO u cd OJ c V* a) CO (-4 01 4-1 CO 01 CO fl 4-1 CO OJ 05 CO 4J 4U CO fl CO 01 0) fl CJ 44 .-4 05 01 01 fl OJ .y

01 oj oi a o u fl «~4 fl 3 y fl r*4 01 iH -H CO 00 44 OJ 00 00 < 4-1 |4 1-4 00 44 01 00 60 <: 44 |4 •H

cj co- xi w CO 01 3 (4 o u o 3 i-i u f—1-4 Cu 0) 14 05 a CO CJ CO CO t»» CO CO s CO o cd cd pp u u as o o

Cd CO

CO •H E H j3 1-1 •o 01 01 —I -o 0) a V CO 4J OJ 01 fl 14 o 1-4 |4 1-4 1 1-1 H o r-4 1 co -o < O cx o 4-1 u 4-1 1—1 O 4J CJ B i-l 14 CO 44 CJ •a 0) 14 o o CO O U4 3 01 >4 cd a <44

01 o B .—i I-l CO OJ CO o M cd 0) « CO CJ CO « o a) CU CL 44 44 M c ifl U4 o Cl Cl 44 44 14 s 3 U4

CJ •-4 o 4-1 2 cd E Ph S3 2 U4 Oi s OS CO 3 S 14 CJ o C/3 Cfl O < OS O r-4 o W CO 0 < OS o o I-l •rl CJ <J fi 0 a 01 r-4

I-l 01 U5 u 1-1 M • • o

O. Oh i4 01 CS u "O H «8 X) CJ OJ U-l oo x: 4J cd Xj O •a 01 U4 fa cd .O CJ •o oi U4

CJ

B • 3 iH

e 0

i4 cd 3 tJ

1-4 OJ « X! B 44

. O

•r4 U4

44 O

CuO BO

cd

01 CJ 44 O

CO r-4

CO

B

fi O O fl

3 B

O- CO

co x:

*H CL 4= O

co S

35 O

05

• XI B B

01 CJ 44 CL

CO OJ >i XI

CO XI

00 B

C cd

CJ I .C "H

44 B

fl

U4 E

o

x>

oi o> O 44 B co

CO o

B -r4

CJ XI

44 01 B XI

i4

CO - E f4

CO

!-i 3 O B

u-i COE

Xi

oj>, 01 0 05

1-4 CO Cu XI E

01 CO 44 S co

01 T3

4J

05 XI

t>s 01

01 • I £•0 0

44 01 01 EXIfl

44 O

U4 E

14 CJ 01 44 CU fl- 3

cd iJc

OJ 05 E

CO 05 OJ CO 01

0 44

co

01 I r-l fl

XI CO CO fl ft 3

la XT

cd cj > cd •v 01 B B

cd i-i -4

cd i 44 B

CO O

x; w

I i 14 B

O CO U4S 14

•r4 01

43 >-i S

01 • 44 (d

CO • >>>

00 14 B O

CO>> e

X. r-4 44 CO i—

CO E CO Cu CO -r414 B CO CJ O 44 44 i4 CO (0

CO XI E

01 U4 > O

4-1 O CO r*. CO 44

H O

Cu In

CJ -4 oHa co

CO 60 -4

XI 05 B

01 O

•« CU i4

<-> >. 44

14 44 CO

01 E

44 XI C

3 B O

Cu CO U4 E B 0 « -.4 CJ CO

1 05 "

r-4 OJ XI

CO O 01

14 O CO3

CO CO c Cu

U4 01 XI 01 CO 44 01

CO xz XI 44

114

44 OJ

01 |4 §

-H

CO XI

(4

CO XI

Cu OJ 44 B 44 O fl fi E

44 CO CJ E

3 cd XI 14 0 44 H

Cl CJ 43 XIE >i

CO r-4 r-4

*» CO

01 cj 00 fl B C

cd JZ 44 o

44 B

• B CO E 2

e

01 O 01 44 CJ |4

CO O O

>s CO U4

CO XI CO 60 E co 6 co oi

co CO 05 |4

CO 44

01 CO o xi o

14 B

CL O

co 3

XI X) 44 O B

44 14 01 B CU 05 44 44

CO

r-4 « OJ D.XJ X

OJ

01 CO XI 43 3 r-4 44 3

XI!

o

U4u

oiCu

co

oi

14

cd

co

03 ^01 CO

CJ B

O O

|4 fl a 44

CJ

CO

03O

ft,

CJ 14 U 44 M rV,H

cd3

00

o 01 U4 0) fl h 5

44 44 00 0 e CO la ij 14 CO CO CO E fi 1 U-l CO U4

CO 14 cd CO >> 44 U4 E

01 •H r-4 x: a U4 —

•rl i-4 CJ U4 o 0 >» O cd CO 0 E CJ M 1-4 fl u o o t-. O u U rl CL 44 la 44 >i 4-1 OJ O SJ B U4 fl r-l c 2 4-1 44

01 fl 44 43 01 U4 CS CO ^—

\

rfi CO c fl > B U4 E CO 44 CO 44 01 05 a CO o c

44 B XI CO t4 44 01 O

E Cu 01 ft o CU > ? fl

cO •r4 E Cl 4J •i-4 o Cu 0 44 x; 01 Cu E cd 0) E O E CJ 44 CJ •r4 OJ o OJ CJ 01 3

01 JS 44 CO >> 01 u |4 14 u B |4 CO fl 01 14 14 cd r*. 44

OJ cd fl o 01 o 1-4 0 CO rC •H U4 U-l U4 44 44 U4 la 44 XI 44 B

4-1 XI o o O i4 B O cd •r-l fi o 0 > 01 B CO u B

4-1 B c B ft > c 00 0 co 01 O

H CO O o o 4-1 B o c ft o 00 —1 u

01 3 -r-l •rl fi CJ H •1-1 fl 44 CL cd 44 o

CJ i-l 44 44 ffl 44 > !0 E cd 3

CO CO cd CO <—

cd •rl N Cfl N

E CJ CJ CJ co cd CJ 01 fl 01 E l4 U4

i-4 fl •H co a ft CJ M 00 rl 0

E CO U4 UJ U4 0) fi U4 01 0 ca 44 O

O •rl fl -r4 CJ 05 •rl u rC |4 t—

r- ("I •f4 < 44 .u 44 0 U 44 o 3 44 Cl

CO 0 o 0 H 0) c 3 i-l tfl 3 O

•Ho Z S z CL > fl < 03 > < 0

0) 0 O

TJ H r-4 CM m u-i H i—

C CO O fl3

4J o* a u

o cd

44 CO G 44

cd cd r4 -0

CU

44

44 B

Cd Cd W r4

O.

CO 44 O

BO

44 i4 3 44 CL Cd 4= CJ 003 U4 O fl

rl 44 X! E

44 OJ

) XJ 6 fl O

X) -rl < 44 44 44

B

01 05

O

03 14

05 CU

Sa B

cu n

o • H -4

CJ

'—' B

|4 • O

01 02 —4

44 • 44 B > CJ

Oi —i 3

X)

oi E C

XI 01 la 44 pa >> 03

<0 • E co cd

|4 r4

01 O

44 14 01 44 b a

cd o U CJ

cdCu

44 XI fl B 1-4 co id3

r4 rf O

rl U

44 O

E ft O

0 MU 03

CO CO 44

05 X3 01

01 0> 01

cj cj x. O CO CO

rl rl

O-i fa co n •} Q

B §

O -rl

fl 01 J* ^

o >

CS fl

44

CO u

co cs 41

CJ C3 o to

14 01 Cu Oo

4-1 N

fl .- B

3 44 fl o s

44 3

o o C fl E

U4 •H e 0 44 •H la B 44 o U4 CO 44 U4

•rl CS ua E e

CS E B r4 f-4 60 B la fl o 0) B

co o 0 01 ua 6 |4 fl

44 rl U4 01 CO B O co

14 44 B > 3 fl r4 CO fi o CO •rl fi cd 44 B u

Cl 3 44 CJ B CO O cd

CJ 44 >> CO 0 eft U fl rl 60 44 fl 4J 03

05 OJ fl E 44 o cfl 0

CO > 44 01 3 U4 > 01 3 f-4 O CO CJ r-4 E la r-t 44 id CJ 01 O O •rl 0) X)

cd E CO > C CO CO O

44 M -rl E E 01 14 X) u

C/5 no a i-i W oi he O PUJ XI ij

CJ < •O CJ XJ o cd XI

©

'14
<m > MBA SUM CUSTODIAN V

Figure 2.5 Information and Material Handling Flows Associated with

Generalized Unit Process

15
O • O • • • • 04H

01o

4J rl

U

B

«a « m at

01

M rl 4)

a at at w-i O u i u g B «-a

_O JS « <4-I 'H 14-1 60 O. M

fl) « 01

_

Ki (U 3 O «

01 0 (S)

K

tsl

O

X

hM c c o o u

Tlco

60

C!

T3

cd

CU 4J

cd SC

cdCo

•l-l 4J

cdBuoo

CO

CN

0) I—

XI

cd H

CsJO

•u

cd

S-i <uao

16
o

rrl

Ml

.-J •oc

cd as

u

id o

•,-1 4-1 CO

a;

M

01CL O

J=

C

COCo «

4J

TO «0

•r-(

a

U o O

03 c (0 < 3

00

i-t fa

17
material be removed at some point of the process. Possible types of numerical

analysis of process data were covered in detail in an earlier paper [1]

• Timing Information

Timing information may come from interview, the opinions of

the foreman, etc., or from analysis of process data. Impressions may not be

entirely accurate, so timing information gained through interview should be

verified, when possible, by process data. The information required for

establishing time sensitivity is: - residence time of all materials at intermediate

points

- time for completion of operations;

- time between measurement and incorporation of the

measurement into the safeguards system;

- time between completion and analysis of information

on forms

- time between notice of an abnormal situation and

response; and

- inventory frequency.

2.4.2.2 Consideration of each Generalized Diversion Path

Central to diversion path analysis is the systematic consideration

of paths or diversion possibilities.

1 • Ordered Diversion Path Check List

A standard check list of diversion path possibilities is

generated based oil diversion path parameter combinations, an accepted set

of relative weight factors, and a path ordering program. In generating the

list, one can use the generic names for material attractiveness or the material

descriptions specific to the process under analysis.

The relative weight factors associated with material attractiveness

and path complexity, the latter being the remaining parameter values taken

collectively, combine to form the relative path weight; they thus enter into

safeguards significance in two ways. First, they determine the order in which

paths are to be examined and second, they determine which paths lie below the

cutoff and are not to be examined in depth. In selecting the cutoff point, one must consider credibility of paths as a function of complexity and of material

attractiveness. Paths just below the chosen cutoff should be examined at least

cursorily to assure that no credible paths have been neglected, otherwise the

cutoff decision must be re-examined.

The diversion path parameters, parameter values, and associated

relative weight factors used in the practicality test are shown in generalized

form in table 2.4. As discussed in an earlier paper [1], a product of

relative weight factors determines a relative path weight and enters the

implicit trade-off between material attractiveness and path complexity. The

first page of a standard list using generic material descriptions is shown in

table 2.5. A forthcoming paper [2] will provide a more complete description

of the path ordering program and procedures.

18
DIVERSION PATH PARAMETER'S RELATIVE WEIGHT FACTOR

MATE6 I AL AT TR AC T I VFNF SS (Ml

Ml FEED PRODUCT I. 000000

M2 R ECYCLE o 500000

M3 SCRAP o . ?ooooo

M4 LAB SAMPLES 0 . 1 DOOQO

M5 WASTE o « n i oooo

RECORDS (F)

Fl NO FALSIFICATION 1 .000000

F2 FALSIFY NOM M EASUREMEN T DATA o q n n o o o F3 FALSIFY GROSS AND/C NET WT 0. p 00000

F4 FALSIFY CONCENTRATION MEASMT o sonnno

F5 FALSIFY NET/COS UNCERTAINTY n ?noniio

F6 FALSIFY ISOTOPIC COMPOSITION o i noono

F7 FALSIFY CONC/ ISOTOPIC UNCERT 0 070000

DISTRIBUTION OF DIVERTED AMOUNTS \D\

Dl 1 1 . uoouuo

02 2 0.707 107

D3 3 0 . 5773*10

D4 4 0W .1 500000 ^ u U -J u w D5 5 0.4W214

D6 6 o 40 fl ? 4 A D7 7 0. 377964

D8 fl 0.353553

D9 0.333333

DIO 10 Q. 316228

Dll 15 0. 25^199

D12 20 0.223607

D13 25 0.200000

D14 30 0.182 574

D15 35 0.169031

D16 40 0.158114

D17 45 0-149071

DIB 50 0. 141421

REMOVAL MODE |R)

RL S I MP LE 1 . 000000

R2 SUB-INERT 0. 700000

R3 SUB-ISOTOP IC 0.1 00000

NUMBER OF INDIVIDUALS (!)

U 1 1 s UU J JUU

12 2 13 3 U 1 i i 14 4 0.037036

15 5 0.01 ? 45

16 6 0.004115

17 7 0.001 372

18 8 0.000457

19 9 0.000 152

1 10 10 0 . 00005

TYPE OF INDIVIDUAL (P)

PI INSIDER 1.000000

P2 OUTSIDE EMP 0.500000

P3 OUTSIDE VSTP 0.100000

P4 UNAUTHORIZED 0. 100000

Table 2.4 Diversion Path Parameters, Parameter Values and Associated

Relative Weight Factors

19
^5

> IS

3

C A O

at t- o. X

is

I UJX

</> X X 4 —

a. x

o o o f- o •0 o o in O m o o o in O © # I*" re in tv. Q o Ci q c> c m o O o x rt cr >o x x o o o c o If o m a o — c o r- cr c — -T V o a ft; Ct p» J-\ IT m o O o js ci o* — a im o s o ci c coo c o C I CN* •M r -5 o 0 j>* r- r- .Ti m n o o o o o o o O o r» m o o» o o o - O N ^ <x ftj o n r- r- ci c d o o 3 -i a m c «

o o o ci ^. >o «o — o o o 0" J IT * * o o cr in in in in IP m in ^ cl i\l ftj «•* o o- <r jj o J1 J" J1 J1 IT L^ in *•*** -J- J- c Cl ct ci Cl ci Ci ci —1 Cl Cl C\ r

o o o o o o c O O 3 n o o 3 O O O o o o o o O o O 3 O O O o o o o o o o o

a a ci a c u. o

U. U. U UJ u c u

C 3 3 0 O — 3

a a. a a or a a a a

ll 4JU.-LLOiUUJliJiL C3CC3C333

a a aajuiuunCLU.ci(iuo a a

lumuu.iuCwiiiJjJCujiuu.^ujaj 3 3 C C 3 -• ODC3 - OCCOOO

O — — —

Sl CD in c/

a a i a a a a

T Z H E 3. Z Z

l/i (A CI (/> t/1 1/1 i/1

7U1LU.ZUZUJUJ

•- -I _J _l — _)~_I_J

I a a a i a. i & a lis J CO ST CO X Z 3~ — — 3— 3~~ i/> i/) i/j m/i i/i i/i i/- i/i

a a a a or or H t in iii hi mi ii i Zmnziuujiuii7Z2u,uiiuruui

— 1 I — l_J_l_l — — — _1 _1 -J — -I -J

I a a i a a a a l | i a a a | n a

czr. cziiiooaiiigiii

1/1 l/H/WW/ll/)l/)l/l^ll/)l/il^l/ll/)l/ll/l

fti-< r\i « o nj —i ci * -« N»i**m«n«i^ ftjr~'OmirvrgftJcC"J>s>"<r-o,'>Ocieo

CO

CO

P-l d

o

•r-t CO

a)>

0)N

cOU

Qico

O X O < < < t- < 4 <t «3 t- »- 4 <

— »- Ol 1- t- k- t- k- 1- »- t- z Z V- t- »-

1/1 4 a. < < < X X < m X < < 3 X < X m l/l 4 X X 4

a a. UJ o

a o Q

t- t- o

UJ Q a a

1- Q O 4LU

EA o

t- t- a

> t- UJ t- Ul >- LU LL t— £ LU l- i- i- LL LL t- »- UJ z z H Lj ll — 3 Ui ? Z z Z z z z T Z z Z z Q a u. LU UJ UJ UJ Z LL UJ LU LL LU z z LU LL

t- T a jr V a Oi Z O or z z o a Z s; a c o z or a z

U. 3 Ui c Up LLl o t: LL o LL LL LU Lj C LL LU 13 LU CJ o UJ c c- Ci a C >. a' L- O a fj "V a Lt >. 1- L- a >. or 3 c 3 o o 3 < 9 3 3 c e a 4 4 3 c o 3

15 1 z 1/1 z z z i^i Z Z 7- in z f Z in z m z l/l in in Z or z z m Z z z m z

u. C < ' < c Cl «3 < o < < « c K o « « L. « a >a < < O 4 •a < o t- a £

CJ u 4 Cj 4 < < O

UJ LJ UJ LlJ i— JJ UJ LJ LU z UJ — UJ «•

OL »- sr z L/) t/i Z UJ z 1- z i- z m in 1- z in r— UJ L- LU H" Z 1- in in Z 1- LU h- • < i/i a < < to en < i_J < i/i < < in in •a LO < i_> 4 O 4 4 4 m in 4

O in <_> LJ z z Li C C 2- o LJ z u C l_l z LJ C C <-> z o u z c z L_> 1_ Z O C C Z U

a. * r- a e c< — a u. r o a c — c o u o. c C or •-" c — c c — u. a o —

Li -i LL c LL LL «* u. o o z u. L_' LL O u. 2 U u. 2 c o LL O LL l_) u. o LL LL z u. O O Z LL *

l/l >- > L'l I/" > 5» in 5- >- >- m in > (n > >• m >- in m > > J- ot > >- >- ci >• in > I/" in >• m > > > in • —1 LL u. —1 LL LL —1 LL LL X -j —

u. _J Ll LL _i u. u. tL -J L- u- U 1 IL LL _J _J LL _1 LL U. U. _J

«a < < < ~ a •a «3 •s — < t3 < — 4 4 ~ 4 < — 4 — 4

• u- LL LL O L"l LL l/l L/l 1/1 u. U. in LL V' m LL in LL in to in li- in m in ll in LL in U> LL in ll in m m u. -J —1 _J —J _j _J _j -j -J _J _j 1 *J -j —i _j _j » o < < < I- <I < < n 3 < 'J < < o < 3 o < < o < < 4 O 4 O 4 o c- 4 C 4 4 4 a u. z z LL LL Z U. LL LL z 2. LL z a. LL z u- J? Ua LL LL z a. LL u. z LL £ LL 2 JL LL j_ X LL u. z

4-J CO •H

CO

4-1o

<u60

CO Pd

COu

•r-l

• -I JJ

c

3 Q Q

JJ CL UJ a a a

-i JJ UJ > > >

1- L- r— r- L- »- L- t- h- »- L— t-- »- t- I" V- f K y t- L- |— 1- 1- 1- p- f- t- t- H- 1-

l_> o o 1_> u •_) IV LJ O lj O LJ o O u LJ 1_J i_> LJ O UJ 1_) O l_) LJ LJ O o o u o U LJ o o u o 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3

Q O a CJ 5 LJ o a a 3 Q c a a U a 3 3 LJ 3 a LJ 3 3 O O 3 3 3 3 3 3 Cj 3 3 a o a O o c o o Cj o <- o Cj 3 o c O 3 C' c- C" c CJ QDU Tl O O O C) tr O n 3 o o o o

OL a or J. Ol a Ol LL LT Ll a at a UK JL a ll a Ol cc J_ at JL a ll. u. OL a. a. Ct UL iK , u a. a. Ol a ul Ol a a a o. a Ol a a a a a a a. a a O. Ll & a a o a o. a a a Q a a a a a Q. a a a. a. a a

C c c o c c; Q c o o c 3 c o c 3 c c LJ 3 o D Q O 3 O o 3 3 3 O 3 3 3 c o o c

LL LL UJ Lj UJ LL LU LL u. LL LU Lw LL lL Uj LL UJ LL ILLL Lu LU UJ lu j_ UJ UJ LU UI LU lu LU UJ IL LU UJ UJ UJ LU LU LU UJ LU L. UJ UJ LU Ui LU LU LU LU UJ u. UJ LL UJ LU UJ UJ LU Uj LL LU UJ UJ UJ UJ

IM Lft •0 X o~ o IS) l-l in cc j- o M 1*^ »• n jo r- CO LT O — <SI •J- r\ o f— aj J* o

M ftj INI ISI t\l INI f\| m l-i Ci m Cl CI CI Cl Cl Cl J>

LO

CM

0) i—

uO

CO H

J a O

3 Z

Z tJJ 3

a u. •

20
It was found useful to separate the generated ordered

paths into two groups, the first of which comprised all paths with relative

weight 0.1 or greater. The second group consisted of paths with relative

weights less than 0.1 to bring the total number of paths to 3000. Remaining

paths had relative weights still smaller than those of listed paths. Within

the major groups, sub-groups were formed, classifying in turn by material

attractiveness and the number of individuals working in collusion. Ordering

within sub-groups by relative weight was then carried out. In all, the first

group had 192 paths associated with feed-product, 99 with recycle, 14 with

scrap, 1 with lab samples and none with waste. The number of paths for a given material attractiveness category, however, depends on the choice of

material attractiveness relative weight factors; the sensitivity in choosing

parameter values is currently being examined. The effect of the weight factors

on system characterization and total coverage is small because the list is

used only for ordering the sequence of path examination. In fact, if all

paths can be covered, then the weight factors have no effect.

• Consideration of each Path in Order

The path list is then used as a guide to analyze diversion

possibilities. For a given material, starting with persons acting alone, the

internal control system is checked for possible diversion paths satisfying

the generalized path parameters. Any diversion possibilities are recorded,

along with possible corresponding indicators of an abnormal situation. Actual

diversion paths may not match generalized diversion paths on a one-for-one

basis. More actual paths may derive from material in the process or the

make-up of potential diverters (from among the process operators, for example).

Conversely, a simple diversion path may correspond to several generalized

paths, as in the case of different numbers of separate removals in a series to

add up to the desired mass sensitivity. Physical constraints of a process may

preclude some paths. For example, if all process samples are about 10 grams,

500 grams cannot be obtained with only one removal. The basis for physical

exclusion of any paths should be recorded.

• Diversion Path Notes

Diversion path notes in the workpapers are the documentation of the

considerations given each diversion path. They should include:

- diverter - the person or persons who are the potential

diverters;

- material - the amount, type, chemical form, physical

form, and authorized location of the material to be

taken;

- concealment rationale - why the diverter chooses a given

type of concealment, including the size of the individual

diversions in a series, explicitly what information is

falsified, how that falsification will conceal the

diversion, and the removal mode (see table 2.4);

- abnormal situation - a description of the first

observable indication of abnormal situation resulting

from the diversion;

21
- related innocent causes - unusual circumstances which

would innocently cause the same abnormal situation

(possible causes of false alarms) ; and

- sensitivity as a function of the distribution of

diverted amounts, that is, if the time sensitivity is a function of the number of separate removals in a series (see table 2.4).

• Diversion Path Checkoff Data

The checkoff procedure is used to record the worst time sensitivity

for a set of specific paths satisfying a generalized diversion path in the

check-off column (table 2.5). If that worst time sensitivity is within the

boundary condition, one proceeds to the next generalized path, otherwise,

consideration is given to other possible abnormal situations which are not

currently observed but which might provide the desired indication.

For example, a second copy might be added to work instructions;

by denying the diverter access to that second copy, the foreman's comparison

of the completed work form with the second copy would reveal falsification

with respect to material used in the process, its identity, or other data on

the work forms.

Similarly, a shadow measurement of the canned and tagged final

product or material going into storage would uncover substitution of inert

material.

Failure to identify a way to cover the diversion path within the

time boundary condition is recorded in the third column of the check-off

list. Data in the check-off columns form the basis for generation of the

characterization histograms.

2.4.2.3 Summarizing Diversion Path Data

• Abnormal Situation List

All abnormal situations which are related to the diversion

possibilities considered during the analysis are listed. It is useful to

number the abnormal situations notes as well as those for diversion paths

for ease of reference.

• List of Diversion Paths For a Given Abnormal Situation

The paths to be investigated following observation of an abnormal

situation are listed. A standard operational procedure is followed to

determine if the observed situation is due to an innocent cause and, if

not, then to initiate investigative action. For example, observation of a bad yield as the abnormal situation should lead to routine inquiry to verify

that the stated amount of SNM was in the scrap, recycle or waste streams

related to that yield value. If the abnormal situation is not innocently

resolved, then it is necessary to start an investigation, and knowledge of

potential paths for the given abnormal situation comes into play.

• Diversion Path - Abnormal Situation Cross-Reference Table

The diversion path - abnormal situation cross-reference table is a tabulated summary of information contained in the list of diversion paths

22
considered during the analysis. It displays the diversion paths which have

a detection time sensitivity problem; sensitivities as a function of number

of removals (where that is applicable) ; and the abnormal situation for each

diversion path. The first page, with certain deletions, of the diversion

path - abnormal situation cross-reference table from the practicality test

is shown in table 2.6.

• Internal Control Histogram Characterization

The purpose of every aggregation of raw data is to highlight seme aspect of results of the analysis. For the internal control histogram, the

object is to allow a relatively high level manager to see at a glance which

analysis areas have safeguards problems and, in the context of the known

boundary conditions, to furnish insight as to what can be achieved by including

additional abnormal situation observations in the internal control system.

Figure 2.7 illustrates an internal control histogram generated

during the practicality test and the change in system coverage stemming from

additional observations for abnormal situations. The bars represent the

fraction of the generalized diversion paths falling within each relative

path weight range, which are detected as abnormal situations within the

indicated time sensitivity ranges. The data for the upper histogram came from the diversion path list in conjunction with a knowledge of the

characteristics and time response of the abnormal situations. For the lower

(modified coverage) histogram, a new set of data was generated by considering

the change in each of the time sensitivities resulting from some additional

observations in the internal control system.

• Single Parameter Measure

A further level of aggregation of DPA data has been considered.

The weights reflecting the relative usefulness to safeguards recovery response

may be combined from histogram information into a single, normalized number

through a weighted summing. This becomes an aggregated index of the usefulness of the particular internal control system for safeguards. As for the

internal control histogram, it is essential that a safeguards problem be

reflected by such a composite index, and that the index not indicate a safeguards problem when, in fact, there is none.

2.4.3 Documentation

2.4.3.1 Workpapers

The workpaper document provides evidence of and basis for

conclusions from the analysis, as well as motivation for and justification

of recommended modifications to the internal control system. It also

provides assurance to plant management of the validity of the safeguards

properties of the internal control system, a basis for assurance to the

AEC regarding internal control system diversion detection sensitivity,

and a basis for investigating an abnormal situation which cannot be

immediately ascribed to an innocent cause. After the analysis step, all information in hand must be reviewed

for consistency, completeness and understandibility . Figure 2.8 summarizes

items which should appear in the workpapers, including most information

and data collected for the study.

_ 23
CURRENT FUTURE

DISTRIBUTION ABNORMAL

IVERS ION OF DIVERTED SITUATION COVER

PATH AMOUNTS NUMBER TIME

(DP) (AS) (DAYS)

1 1-10 1

2 1-10 2

3 1-10 3 3 1-10 4

4 1-10 4

5 1-10 5

5 1-10 5

6 1 9

2 3 10

6 4-10 J

7 1 47

8 1-10 13

9 1 16

9 2-4 17

9 5-10 18

10 1 19

10 2-4 19

10 5-10 20

11 1 19

11 2-4 19

11 5-10 20

13 1 16

13 2 17

13 3-5 18

13 6-10 20

1 u 1-10 A — 1U 4LX. 15a 1-10 22

15b 1-10 5 15c 1-10 24

15d 1-10 25 to 1kg

15d 3-10 5 15e 1 26

15e 2-4 27

15e 5-10 5 15f 1 26

1 C £ 15f 2-4 27

15f 5-10 5 16 1-10 5 16 1-10 5 17 1-10 S 18a(l) 1,2 17

18a(l) 3-10 18

18a(2) 1-10 5 18b (1) 1 30

18b(l) 2-5 27

18b(l) 6-10 5 Table 2.6

18b (2) 1-10 31

18c 1-10 31

ABNORMAL

SITUATION COVER

NUMBER TIME

(AS) (DAYS)

MATERIAL

ATTRACTIVENESS

OH

Typical Page of a Diversion Path--

Abnormal Situation Cross-Reference Table

24
T3

COU

CDc

CD o

T3

CO

4J 3 w

O

w

co

a

o

•r< U

O

S-i

Number

of Paths

MATERIAL 1

Current

Coverage

1.0 0.9 0.8 0.7 0.6 0.5 OA 0.3 0.2 Relative Path Weight

Number

of Paths

Possible Future

Coverage - With

Additional Abnormal

Situations Observed

TIME

SENSITIVITY CODE

One day or less

Seven days or less

Thirty days or less

Mora than thirty days

i.o 0.9 as 0.7 as o.s 0.4 0.3 0.2 ai

Relative Path Weight

Figure 2,7 Internal Control Histograms

25
DOCUMENTAT ION - -WORKPAPERS

INQUIRY SESSION NOTES

PROCESS NOTES

PROCESS FORMS

PROCESS DESCRIPTION

INFORMATION AND MATERIAL FLOW DIAGRAMS

NUMERIC SENSITIVITY DATA

NUMERIC ANALYSIS

DIVERSION PATH ANALYSIS

DIVERSION PATH NOTES

DIVERSION PATH CHECK-OFF DATA

ABNORMAL SITUATION LIST

LIST OF DIVERSION PATHS FOR GIVEN ABNORMAL

SITUATION

DIVERSION PATH- -ABNORMAL SITUATION CROSS

REFERENCE TABLE

SUMMARY STATEMENT DATA

FOR HISTOGRAMS

FOR SINGLE PARAMETER MEASURES

Figure 2.8 DPA Documentation Activities -- Workpapers

26
2.4.3.2. The Summary Report

The summary report presents highlights for management review

of pertinent facts and conclusions contained in the workpapers. It

should be sufficiently detailed and complete to allow understanding by a manager who is only generally familiar with the process. The contents,

summarized in figure 2.9, state briefly the bounds of the analysis,

process description, summary of the numerical analysis, timing information,

number of paths analyzed, worst case information under current and

future coverage, and characterization of the internal control system

relative to safeguards goals.

2.4.4 Results of the Test of the DPA Procedure

A DPA was conducted with plant personnel performing the major

role in data gathering and provision of base information on diversion

paths through the inquiry session. NBS took the basic data and generated

the remaining diversion path information, the workpapers and the summary

report. The results are presented in distilled form to protect company

proprietary information. i "Holes" are identified in the system through the DPA procedure

by highlighting specific actions which might be taken by the diver ter.

Often, not much imagination is required to specify additional internal

control procedures to cover the diversion possibility.

Conclusions from the test' were:

• The systematic conduct of a comprehensive DPA is feasible and

can be performed without excessive expenditure of time and effort by plant

personnel "knowledgeable of the process area under consideration;

• DPA can be used to characterize in-plant information,

procedures, measurements and controls with respect to safeguards goals

using general, straightforward analysis techniques. Validity of the

analysis is critically dependent on knowledge of process practices actually

employed, in contrast to practice as specified in manuals. Further, DPA

provides a means of demonstrating additional coverage of diversion

possibilities which might be gained through modification of present plant

practice; * * * * "** "

v "

• A number of parameters were identified which permitted a choice

for value. When made, such choice could be supported by a rationale which

was not necessarily amenable to determination by objective analysis. The

choices constituted the general boundary conditions for considering and

ordering generalized diversion paths as a function of path complexity and

material attractiveness. For the DPA, it is essential that the ordered

list of generalized diversion paths be complete and present all diversion

path parameter value combinations for consideration. Some will be impossible

because of process constraints in the specific case; these need be given no further consideration.

-27
DOCUMENTATION --SUMMARY REPORT

DATA

BOUNDS OF THE ANALYSIS

PROCEDURE SUMMARY

PROCESS DESCRIPTION

NUMERIC SENSITIVITIES

TIMING INFORMATION

ANALYSIS

MATERIALS AND MATERIAL ATTRACTIVENESS

PATH ORDERING PROGRAM

RESULTS OF SYSTEMATIC CONSIDERATION OF PATHS

ABNORMAL SITUATIONS OF IMPORTANCE

DECISION STRUCTURE AND DECISIONS

FINDINGS

CURRENT COVERAGE

INTERNAL CONTROL CHARACTERIZATION HISTOGRAMS

WORST CASE INFORMATION

RECOMMENDED COVERAGE

ADDED ABNORMAL SITUATION OBSERVATIONS

ADDED PROCEDURES

INTERNAL CONTROL CHARACTERIZATION HISTOGRAM

REMAINING WORST CASE INFORMATION

Figure 2.9 DPA Documentation Activities Summary Report

28
• The DPA of a specific process area was completed based on the

choice of one set of relative weight factors. Additional information is

needed, however, of the effect of alternative assignments for relative

weight factors, and mass and time sensitivity limits. Also the analysis

procedure used in this initial DPA led to a characterization, by means of

histograms, of the safeguards effectiveness of the internal control system;

alternative means should be explored and tested.

3. SUMMARY

This paper reflects current understanding of the context and

steps of a routine diversion path analysis as applied by plant personnel

to internal control systems. The basic steps of data gathering, analysis

and documentation were discussed. In particular, emphasis was placed on

the analyses steps for understanding process and internal control;

consideration of diversion paths ordered according to generalized diversion

path parameter combinations; and generation of histograms characterizing

the safeguards usefulness of internal control systems for safeguards

goals.

Conclusions from the most recent test of DPA were presented,

demonstrating that it is possible, practical and feasible (without

excessive cost) for plant personnel to carry out routine DPA. The

foreman and process engineer, together with a representative of the

plant safeguards authority group, should form the DPA team. The coverage

provided by the internal control system and possible alternatives can be

analyzed and results presented to fairly represent safeguards usefulness

of the system.

ACKNOWLEDGMENT

The authors gratefully acknowledge the assistance provided by Rocky

Flats personnel in carrying out the practicality test.

REFERENCES

[1] Murphey, W. M. , Schleter, J.C., and Maltese, M. D. K. , Internal

Control vis-a-vis Diversion Path Analysis , Nuclear Materials

Management 2> 232 (1973)

[2] Leyendecker, E. E. and Schleter, J. C. , A Generalized Diversion

Path Ordering Program , NBS Report (in preparation)

[3] Internal Control - Elements of a Coordinated System and its

Importance to Management and the Independent Accountant , American Institute of Accountants, Report, 1949.

29
GLOSSARY

ABNORMAL SITUATION

An occurrence inconsistent with historical experience and/or normal

process operation which can be related to possible diversion of SNM.

BOUNDARY CONDITION

A specific value assigned to a variable for the purpose of delimiting

an analysis.

COVERED PATH (COVERED)

A diversion path for which indication of an abnormal situation would

result, within the mass and time sensitivity boundary conditions, if

diversion were attempted by means of that path.

DISTRIBUTION OF DIVERTED AMOUNTS

A diversion path parameter for describing the mass of SNM in, and

number of, separate removals included in a diversion path.

DIVERSION

The illicit removal of SNM from uses permitted by law or treaty

(theft, robbery, or unauthorized or illegal acts committed by

persons in authority) . The authorized transfer of SNM from one use

to another in the materials management sense, also called diversion,

is not considered a part of these studies.

DIVERSION PATH (PATH)

The complete and detailed description of a modus operandi and

rationale, devised as an independent method, for illicitly removing

and concealing the fact of removal of SNM.

DIVERSION PATH ANALYSIS

A procedure for directing systematic analysis of diversion paths,

ordered according to relative path complexity and material

attractiveness, in light of all pertinent information about

protection, handling and storing of SNM in the area under scrutiny.

How well a particular diversion path is now or might in future be

covered is evaluated by assessing the mass, time and space

sensitivities of indication of attempted diversion.

DIVERSION PATH PARAMETER

A variable associated with a generalized diversion path description,

such as: (1) material attractiveness; (2) falsification of records;

(3) distribution of diverted amounts; (4) removal mode; (5) number of

individuals; and (6) type of individual.

DIVERSION PATH PARAMETER VALUE

An attribute of a diversion path parameter.

FALSIFICATION OF RECORDS

A diversion path parameter for referencing deliberate recording of

differences between information or data elements and current reality

as a part of the concealment plan of the diverter.

30
GENERALIZED DIVERSION PATH

A description, in terms of diversion path parameters, of a potential

means for illicitly removing and concealing the removal of SNM.

INSIDER

A diversion path parameter value of the parameter for type of

individual, indicating an employee who is authorized access to both

the plant-site and to the SNM.

INTERNAL CONTROL

The plan of organization and all of the coordinate methods and

measures adopted within a business to safeguard its assets, check the

accuracy and reliability of its accounting data, promote operational

efficiency, and encourage adherence to prescribed managerial

policies [3] .

MASS SENSITIVITY

An attribute of diversion indication for denoting that in the event of

a diversion of a threshold mass of X grams, there is at least a p%

probability that a signal in the information, i.e., an abnormal

situation, will result which will serve to initiate additional

investigation. Also, a boundary condition for specifying the quantity

of the threhold mass.

MATERIAL ATTRACTIVENESS

A diversion path parameter for expressing the concept that when

several material types or descriptions are subject to illicit

removal from an area, some may be more desirable to a diverter than

others because of the ready or easy adaptation to intended end-use.

MATERIAL DESCRIPTION

The physical form (solid, liquid or gas) and chemical form

(composition, pur ity} concentration, etc.) of the SNM as distinquished

from material type.

MATERIAL TYPE

The nuclear properties of the SNM (depleted-U, enriched-U, Pu-240

content, etc.).

NUMBER OF INDIVIDUALS

A diversion path parameter for indicating the number of persons

participating in the diversion. Two or more persons acting in

concert are considered to be in collusion and using the same diversion path. When acting independently, even if removing SNM

from the same area, they are considered to be using different

diversion paths.

OUTSIDE EMPLOYEE

A diversion path parameter value of the parameter for type of

individual, indicating an employee who is authorized access to the

plant-site but not to the SNM.

31
OUTSIDE VISITOR

A diversion path parameter value of the parameter for type of

individual, indicating a non-employee who is authorized access,

under escort, to both the plant-site and to the SNM.

PATH COMPLEXITY

The collective consideration, for a generalized diversion path,

of all diversion path parameters except material attractiveness

which serves to express the interrelationship of these parameters,

RECYCLE

SNM suitable for use in another unit process without undergoing

prior chemical processing.

RELATIVE PATH WEIGHT

The numerical value derived as the product of relative weight factors

(one for each diversion path parameter to reflect both material

attractiveness and path complexity) as a means of expressing relative

order or rank of generalized diversion paths.

RELATIVE WEIGHT FACTOR

The relative numerical value assigned to a particular diversion path

parameter value.

REMOVAL MODE

A diversion path parameter for indicating one of three removal

mechanisms available to a diverter, namely: (!) removal of SNM

without replacement of any kind (simple theft) ; (2) removal of SNM

accompanied by substitution of inert material; and (3) removal of SNM

accompanied by substitution of SNM having different isotopic

composition.

SCRAP

SNM which must be sent to chemical recovery before further use is

possible.

SENSITIVITY

See MASS SENSITIVITY, TIME SENSITIVITY and SPACE SENSITIVITY.

SPACE SENSITIVITY

An attribute of diversion indication for denoting that in the

event of diversion, there is at least a p% probability that there

will be a signal in the information (i.e., an abnormal situation)

pinpointing the area wherein removal occurred and highlighting the

personnel having access to the SNM. Also a boundary condition for

specifying the area and personnel included in the analysis.

TIME SENSITIVITY

An attribute of diversion indication for denoting that in the event

of diversion, there is at least a p% probability that there will be

a signal in the information (i.e., an abnormal situation) observed

within d days. Also a boundary condition for specifying the time

interval within which observation should occur.

32
TYPE OF INDIVIDUAL

A diversion path parameter for expressing one of four levels of access authorization possessed by a diverter, namely: (1) insider;

(2) outside employee; (3) outside visitor; or (4) unauthorized person.

UNAUTHORIZED PERSON

A diversion path parameter value of the parameter for type of

individual indicating a non-employee who is not authorized access

to either the plant-site or to the SNM.

UNIT PROCESS

The subdivision (for purposes of analysis) of the overall process

stream of a plant into many smaller operations (the unit processes)

,

each of which is characterized by a "branch point" in the process

stream, where material changes its physical or chemical form or composition, or where by-product, such as recycle or scrap, is

generated.

33 ,
NBS-1 14A (REV. 7-73)

U,S. DEPT. OF COMM.

BIBLIOGRAPHIC DATA

SHEET

1. PUBLICATION OR REPORT NO.

NBSIR 74-524

2. Gov't Accession

No.

3. Recipient's Accession No.

4. TITLE AND SUBTITLE

PRACTICALITY OF DIVERSION PATH ANALYSIS

5. Publication Date July 1974

6. Performing Organization Code

7. AUTHOR(S)

William M. Murphev and

J ohn C . S chls t.a r anTzat

8. Performing Organ. Report No. NBSIR 74-524

9. PERFORMING ORG ION NAME AND ADDRESS

NATIONAL BUREAU OF STANDARDS

DEPARTMENT OF COMMERCE

WASHINGTON. D.C. 20234

10. Project/Task/Work Unit No. 4314429

11. Contract/Grant No.

12. Sponsoring Organization Name and Complete Address (Street, City, State, ZIP)

Division of Safeguards and Security

U. S. Atomic Energy Commission

Washington, D. C. . 20760

13. Type of Report & Period Covered

Final Report

14. Sponsoring Agency Code

15. SUPPLEMENTARY NOTES

16. ABSTRACT (A 200-word or less factual summary of moat significant information. If document includes a significant

bibliography or literature survey, mention it here.)

One can define the safeguards system for nuclear material as the

set of all protective actions taken to prevent or to deter attempts to divert

nuclear material to unauthorized use. Maintenance of effective safeguards

requires a program for routine assessment of plant safeguards systems in

terms of their capabilities to satisfy safeguards aims. Plant internal con- trol systems provide capabilities for detection of unprevented diversion and can provide assurance that diversion has not occurred. A procedure called

Diversion Path Analysis (DPA) enables routine assessment of the capabilities

of internal control systems in this regard and identification of safeguards

problem areas in a plant. A framework for safeguards system design is also

provided which will allow flexibility to accommodate individual plant circumstances while maintaining acceptable diversion detection capability. The

steps of the procedure are described and the practicality of the analytical

method is shown by referring to a demonstration test for a high throughput

process where plant personnel were major participants. The boundary con- ditions for the demonstration case are given, along with some conclusions

about the general procedure.

T7. KEY WORDS (six to twelve entries; alphabetical order; capitalize only the first letter of the first key word unless a proper name; separated by semicolons)

Analysis; Diversion of Nuclear Materials; Diversion Path Analysis;

Internal Control System Characterization; Nuclear Material Safeguards;

Safeguards

19. SECURITY CLASS

(THIS REPORT)

UNCLASSIFIED

21. NO. OF PAGES

33

20. SECURITY CLASS

(THIS PAGE)

UNCLASSIFIED

22. Price

18. AVAILABILITY £T Unlimited

I-1

For Official Distrib ution. Do Not Release to NTIS

1

1 Order From Sup. of Doc, U.S. Government Printing Office Washington, D.C. 20402, SD Cat. No. CH

I

1 Order From National Technical Information Service (NTIS)

Springfield, Virginia 22151 USCOMM-DC 29042-P74

'^6-191*