NBSIR 74-592

Safeguards Information System

Flows Associated With the

Pl ant Safeguards Authority [U)

John C. Schleter

Institute for Applied Technology

Technical Analysis Division

National Bureau of Standards

Washington, D. C. 20234

November 1974

Prepared for Division of Safeguards and Security

U. S. Atomic Energy Commission

Washington, D. C. 20760
I.

I
NBSIR 74-592

SAFEGUARDS INFORMATION SYSTEM

FLOWS ASSOCIATED WITH THE

PLANT SAFEGUARDS AUTHORITY (U)

John C. Schleter

Institute for Applied Technology

Technical Analysis Division

National Bureau of Standards

Washington, D. C. 20234

November 1974

Prepared for Division of Safeguards and Security

U. S. Atomic Energy Commission

Washington. D. C. 20 7 60

U. S. DEPARTMENT OF COMMERCE, Frederick B. Dent, Secretary

NATIONAL BUREAU OF STANDARDS. Richard W. Roberts. Director

TABLE OF CONTENTS

Page

ABSTRACT 1

INTRODUCTION 1

1. ASPECTS OF AN INFORMATION SYSTEM 2 1.1 Nodes 2 1.2 Flows 3

2. THE DECISION STRUCTURE 4

3. CONCEPTS EMPLOYED IN SIS 6

3.1 The Unit Process Concept 10

3.2 Logic of Response to Abnormal Situations 13

3.3 Diversion Path Analysis 18

4. DECISION RESPONSIBILITIES OF THE PLANT SAFEGUARDS

AUTHORITY 19

4.1 Tasks and Safeguards Activities 20

4.2 Information Needs 21

5. DETAILED INFORMATION FLOWS FOR THE PLANT SAFEGUARDS

AUTHORITY 22

5.1 General Node Description 36

5.2 Summary of Information Needs 36

5.3 Characterization of Node 36

REFERENCES 56

SAFEGUARDS INFORMATION SYSTEM FLOWS ASSOCIATED WITH

THE PLANT SAFEGUARDS AUTHORITY (U)

John C. Schleter

Technical Analysis Division

National Bureau of Standards

ABSTRACT

Increasing use of nuclear material Imposes additional emphasis on safeguards. The Technical Analysis Division, NBS , has been assisting the

AEC In performing systems studies directed to safeguards for nuclear

materials. A Safeguards Information System (SIS) is being developed so as

to provide the information and decision structure needed for assurance that

significant diversion to unauthorized use has not occurred in the past and,

further, that any significant diversion which might in future occur will be

detected in a timely manner. Although a comprehensive report is in preparation, a preview is considered useful at this time in order to familiarize

plant personnel, charged with development of plant safeguards Information

systems, with aspects of SIS. This report thus reflects material from the

forthcoming report and directs attention to the information flows related

to the key safeguards decision maker within the plant - the plant safeguards

authority. Terms and concepts are defined and their application is

Illustrated in the general case by highlighting decision responsibilities

and details of the safeguards information flows associated with him.

INTRODUCTION

Of constant concern to the AEC is the possibility of illicit removal of

special nuclear material (SNM) from authorized to unauthorized use. Such

removal is termed diversion, and should it occur, attention is directed to

the location where the SNM was last accounted for. Focus is thus on plants,

laboratories and transportation activities for each provides the potential

dlverter with direct access to SNM. The plants are of particular interest

due to the quantity of SNM generally on hand and the many varied opportunities made available to the dlverter by virtue of the complexity and size of

plant operations.

In order to minimize the possibility of diversion, consideration must

be given in advance to the various facets of the problem and, in particular,

to the methods by which material might be diverted and to the techniques by

which diversion might be detected. One common thread for unraveling this

complex problem is the flow of Information between personnel having decision

responsibility for safeguards. Adequate Information, when coupled with

plant implementation experience, leads to the design of a plant safeguards

system which serves as one mechanism for rapid diversion detection.

Forethought of the roles of the various decision makers permits

characterization of the information flows and allows one to make statements

concerning the information to be contained in such flows. To this end, the

Technical Analysis Division, NBS, has been assisting the AEC in developing a Safeguards Information System (SIS) so as to provide the Information and

decision structure needed for assurance that significant diversion has not

occurred in the past and, further, that any significant diversion which

might in future occur will be detected in a timely manner.

1
This report reflects portions of a forthcoming comprehensive report

"Framework of the Safeguards Information System (SIS)" [1] which is cur- rently being completed in greater detail and broader scope. The intent

here is to provide an example for designing plant systems by highlighting

the information flows associated with only one of the decision makers of

safeguards, the plant safeguards authority. Within the structure of SIS,

he is responsible for design and review of the plant safeguards information system and is the focal point of plant safeguards activities; most

types of information flows identified during the development of SIS therefore involve him in one way or another. These information flows may

provide plant personnel with an understanding of the aspects of a generalized information system and the description of their derivation may

serve as a guide when design of a plant-specific system is undertaken. In

essence, this report provides a background for understanding the SIS

concept, illustrates the procedure for its application and culminates in a complete description (in detailed outline form) of the information needs

and flows of this key safeguards decision maker.

1. ASPECTS OF AN INFORMATION SYSTEM

In order to develop and describe the detailed structure or framework

of an information system, be it the general SIS or a plant-specific SIS,

it is first necessary to understand, identify and state (precisely and

accurately) the objectives of the system. The objectives, in turn, must

reflect the goals of the activities which the information system is

intended to serve. For safeguards, the goal is protection of the public

and assurance with regard to threats from unauthorized diversion of SNM;

the objectives of a SIS concern provision of Information in event of

diversion or valid assurance that diversion has not, in fact, occurred.

It remains to identify the system elements which comprise a SIS and to

determine their relationships.

To be effective, SIS must be extensive and comprehensive in terms of

spatial and temporal coverage and with respect to numbers of people and

types and amounts of information. It is therefore necessary to conduct a logical breakdown and examination of system elements and their interrelationships to ensure that system objectives are achieved. Some concepts

which are usually associated with information system analysis are useful

in giving adequate consideration to each element so that none is overlooked.

In particular, the concepts of nodes and flows together with content of

nodes and purposes, methods and content of flows have been found to be

useful.

1. 1 Nodes

In the context used here, the concept of nodes encompasses:

• physical locations, such as an AEC Field Office, a plant or

a sub-unit of a plant;

2
• decision points or decision makers within locations where

safeguards decisions' are reached as to the existence of

abnormal situations^ and the status of design, modification

and operation of the safeguards system;

• analysis points or analysts within locations where SIS

analysis is performed;

• sources within locations where data and information are generated (data sources and information sources) ; and

• activities performed at locations, principally of a review

nature, such as surveys and inspections.

The content of nodes refers to documentation maintained in the node

and includes:

• records and reports, either manually prepared or computer

generated (using data elements accruing in this or another

node)

;

• files in the form of papers, computer cards ("punched"

cards), or magnetic- tapes , - drums or -disks;

• logs prepared in this or another node; and

• procedure manuals prepared in this or another node.

1. 2 Flows

The concept of flow refers to the transmittal of data and information

from an origin to a destination, that is, between any two nodes. A flow

involving an intermediate node can be considered as two separate flows of

the same information or data, where the intermediate node is the destination on the one hand and the origin on the other. There are three important

aspects of a flow: purpose, method, and content.

The purpose of flow refers to the reason for the transmittal and divides

flows into two types:

• reporting flows, the contents of which serve as the basis for

actions or decisions; and

• administrative flows, which serve only to inform.

The methods of flow fall into two genral classes:

• oral flows include direct conversation between individuals or other means of voice communication, such as telephone or radio;

and

• written flows consist of hardcopy reports (either manually

prepared or computer generated). Teletype (TTY) messages,

output from data links and computerized video displays (CRT

displays)

.

The content of flows include:

• data elements such as

- measurements and

- identifications;

1 "Decisions" include all responsibilities for safeguards actions

.

2 An "abnormal situation" means an occurrence inconsistent with that

expected which can be related to possible diversion.

3
• information elements, for example,

- processed data of any type, including

mental computations,

aggregations

,

comparative analyses, and

statistical analyses,

- observations

- probabilities,

- evaluation of probabilities

- historical perspective,

- conclusions, and

- assurance statements;

• alerts; and

• alarms.

The relationships of flows among nodes can best be represented

schematically. A general set of symbols has been adopted (given in

figure 1) for the entities described above, and many of them are used in

the schematic diagrams appearing later in this report; all are used in

the comprehensive report. [1].

2. THE DECISION STRUCTURE

The safeguards system is composed of a great many decision makers who,

depending upon their relative position within the system, may be called

upon or be responsible for a number of different types of judgments. In

order to comprehend the information flows associated with the plant safeguards authority, it is necessary to place him in proper context among

the decision makers and identify those with whom he interacts.

Before doing this, however, a brief discussion of safeguards decisions

is in order. The decisions reached by cognizant personnel, based on information made available through SIS, allow statements about diversion to be

made with assurance (e.g., that diversion has not taken place in the past,

or that, should diversion occur in future, indication will be given in

timely manner). Decisions, may, for example, be related to abnormal

situations, timely indication or the adequacy of available information, to name but a few. All decisions contribute toward the confidence given to

the public that the safeguards system is working.

Each decision maker contributes an assessment of whether or not the

system is adequate in meeting safeguards goals for his level of responsibility and for those levels subordinate to him. Thus, decisions made at

each level serve as inputs for statements related to assurance, generally

made at higher levels in the system. For purposes of SIS, decision

responsibilities may be divided into two types: those pertaining to

system operation and those pertaining to system design and modification.

The former include recognition of any abnormal situations which develop

and also determination that the system is operating properly as a matter

of routine. Such responsibilities properly fall to those within the plant

who oversee daily operations. System design and modification responsibilities entail judgment of the adequacy of procedures and performance of

the system for satisfying safeguards goals and are the province of

management.

4
LOCATION INSPECTION ACTIVITY

INFORMATION OR

DATA SOURCE

DATA ACQUISITION

ANALYSIS POINT DECISION POINT OR PERSON

MAKING DECISION

ORAL INFORMATION FLOW WRITTEN INFORMATION FLOW

ORAL OR WRITTEN INFORMATION

FLW (AT FACILITY OPTION)

ADMINISTRATIVE INFORMATION

FLOW

HARDCOPY REPORT FILES AND LOGS OF INFORMATION

OR DATA (PAPER, CARD OR MAGNETIC)

COMPUTERIZED VIDEO DISPLAY

(CRT DISPLAY)

Figure 1 SIS Framework Symbols

5
As will be seen, the latter are primary decision functions of the

plant safeguards authority. (Additional decision functions are described

in a latter section). Although each decision maker within the system has

specific decision functions, the purposes of this report do not require

that they be detailed here. The nature of the decisions required of the

decision makers, however, govern the detailed content of the nodes and

establish the specific methods and content of the information flows.

Decision makers are identified and listed in Table 1, grouped into

the following categories: the process line, storage, shipping and

receiving, transportation, others with SNM access, physical security and

management. As one descends through these groups, the accessibility and

directness of information concerning items of SNM subject to diversion

increases. Several secondary decision makers are included in the table

for completeness. These decision makers are located at the management

level, and their activities do not primarily address safeguards functions.

They are, however, informed of any abnormal situations and may be called

upon to make administrative decisions with regard to such a situation.

In a given facility, one individual may have decision-making

responsibilities ascribed in this report to more than one decision maker.

Further, the term decision maker refers not only to the individual having

ultimate responsibility for a given set of safeguards decisions but also

to members of his staff who contribute to his decision making functions.

Organizational structures differ among facilities, hence the titles used

in this report may not apply universally; in a specific plant personnel

must be related by means of significant tasks and responsibilities to the

generic titles used here.

Figure 2 emphasizes the relationships among decision makers, the data

sources and information sources. Data sources for decisions, indicating

proximity or detailed information about specific items of SNM, are shown near the bottom of the figure. Above each data source is shown the

relative level of decision maker or analysis associated with it. The

vertical relationship of the decision structure to the data sources as shown in Figure 2 applies through the plant management level. Above that

level, however, decision makers are concerned with broader groupings of

data sources, such as several facilities within a field office or several

field offices.

Table 1 and Figure 2 locate the organizational position of the plant

safeguards authority within the safeguards decision making hierarchy.

3. CONCEPTS EMPLOYED IN SIS

During the evolution of the general SIS, concepts of the unit process,

a logic of response to abnormal situations and diversion path analysis were

developed. These concepts have become integral components of the information flows associated with the plant safeguards authority, as well as all

decision makers of the system, and a brief statement of each concept is,

therefore, essential to full understanding of the information flows

described later in this report.

6
MANAGEMENT

THE PRESIDENT

THE JOINT COMMITTEE ON ATOMIC ENERGY (JCAE)

THE ATOMIC ENERGY COMMISSION (AEC)

AEC GENERAL MANAGER

AEC ASSISTANT GENERAL MANAGER FOR NATIONAL SECURITY, HEADQUARTERS

AEC DIRECTOR OF REGUIATION , HEADQUARTERS

AEC DIRECTOR, DIVISION OF SAFEGUARDS A^jD SECURITY, HEADQUARTERS

CHIEF, INTERNAL SECURITY BRi\NCH , HEADQUARTERS

CHIEF, MATERIALS A.\D PLANT PROTECTION OPERATIONS BRANCH, HEADQUARTERS

AEC APPRAISER, HEADQUARTERS

FIELD OFFICE MANAGER

FIELD OFFICE SOURCE AND SPECIAL MATERIALS REPRESENTATIVE (SS REP)

FIELD OFFICE DIRECTOR OF SECURITY

AEC SURVEY INSPECTOR, FIELD OFFICE

AEC SECURITY INSPECTOR, FIELD OFFICE

REGIONAL TRANSPORTATION CONTROL

PLANT Mi\NAGER

PLANT SAFEGUARDS COMMITTEE

PLANT SAFEGUARDS AUTHORITY

PLANT PRODUCTION CONTROL MANAGER

PLANT PHYSICAL SECURITY DIPvECTOR

PHYSICAL SECURITY

PLA1>IT GUARD CAPTAIN

PLANT GUARD

R6cD AND LABORATORY

R&D AREA SUPERVISOR

R&D AREA SNM CUSTODIAN

R&D APvEA TECHNOLOGIST

ANALYTICAL LABORATORY SUPERVISOR

ANALYTICAL LABORATORY SNM CUSTODIAN

ANALYTICAL LABORiVTORY CHEMIST

TRANSPORTATION

SNM TRANSPORTATION CUSTODIAN-DRIVER OR COURIER

SHIPPING AND RECEIVING

SHIPPING DOCK FOREMAN

SHIPPING DOCK CLERK

STORAGE

PIANT PHYSICAL INSPECTOR

VAULT MAIUGER

PROCESS imE

PROCESS ENGINEER-U:nT PROCESS OR MATERIAL BALANCE AREA

SNM CUSTODIAN-Mi\TERIAL BALANCE AREA

PROCESS FOREM^XN-M'^TERIAL BALANCE AREA

PROCESS OPERATOR-U^^IT PROCESS

Table 1 The Safeguards Decision Makers

7
8
'INC

> a.

tJU O ui

O ft. >-' O W

9
3 . 1 The Unit Process Concept

The unit process is the basic "building block" for SIS design.

Nuclear plant processes are complicated, involving material flows dependent on many variables and usually unique to a given plant. Consequently, x in order to perform a systematic safeguards analysis for a given plant,

its material flows and data variables must be characterized. It then

becomes possible to apply analytical techniques to large industrial

facilities, such as nuclear plants, where plant operator processes and

procedures are complex, highly interrelated and constantly changing.

Early in the SIS evolution, it was found that many processes could not

be adequately analyzed because the available variables did not permit

relating material flows to one another. The typical problem stemmed

from attempts to examine data from too large a portion of the process.

Also, it was noted that the lack of information about unmeasured recycle

strongly affected data related to material flows external to the portion

of the process under study. The unit process concept was developed to

overcome these problems, helping to achieve modular construction of an arbitrary nuclear plant from the standpoint of SIS.

In this concept the overall process stream of a plant is subdivided

into many smaller operations (the unit processes) , each of which

introduces a "branch point" in the process stream, a location where

material changes its physical or chemical form or composition, or where

a by-product is generated (e.g., recycle, scrap or waste). The combination of two sources of feed material into a single product or the

machining of a casting, producing product and scrap, are examples of

activities within simple unit processes. More types of material flows

may be involved, the key to the concept being that each flow can be well

characterized in terms of material quantity, quality and destination.

Nine types of material flows (illustrated schematically in Figure 3) are identified in relation to the general unit process; all flows need not be

utilized in the operations of a specific unit process. The nine types

are

:

• feed (from the preceding unit process or plant storage)

;

• product (to the next unit process or plant storage)

;

• recycle (characterized feed-back within a unit process)

;

• recycle from another unit process;

• recycle to another unit process;

• scrap to recovery;

• waste to measured discard;

• samples to the laboratory; and

• material unaccounted for (MUF)

.

The modular aspects of the unit process concept as applied to a hypothetical plant is illustrated in Figure 4. In this example, it is

observed that the scrap recovery areas, S.l through S.ng, do not involve

all possible flows. Further, it is seen that a number of unit processes

combine to form a single material balance area (MBA) , usually considered

(by the AEC) as the smallest sub-unit within a plant for purposes of

accounting and inventory information.

10
1. FEED (FROM THE

PRECEDING UNIT

PROCESS OR PLANT

STORAGE)

4. RECYCLE FROM

ANOTHER UNIT

PROCESS

THE UNIT PROCESS

3. MEASURED OR

CHARACTERIZED

RECYCLE FROM THIS

UNIT PROCESS

2. PRODUCT (TO PLANT

STORAGE OR THE NEXT

UNIT PROCESS)

' 9. MATERIAL UNACCOUNTED FOR

8, SAMPLES TO LABORATORY

7. WASTE TO MEASURED DISCARD

6. SCRAP TO RECOVERY

RECYCLE TO ANOTHER UNIT PROCESS

Figure 3 Unit Process Material Flows

11
g Q

g !-) U

O 3 <

[

pp Z Q £^ S O O

[HS DC H

12
3. 2 Logic of Response to Abnormal Situations

This concept suggests a set of guidelines which might be implemented

as policy for directing response to observed abnormal situations. There

are four principle ideas incorporated in this concept:

o two-level reporting;

o resolution feedback;

o the abnormal situation log; and

o the elapsed time clock.

A logic diagram of the interrelationship of these principles for

decision and action steps in the face of an abnormal situation is

illustrated in Figure 5. The levels "n" , "n+1" and "n+2" of Figure 5 refer to a set of relative action levels of decision makers in the

safeguards decision structure (Figure 2). The cognizant decision maker

to be identified at each level is determined by the abnormal situation

reporting flow for each data source, shown superimposed on the decision

structure in Figure 6, and the time required for resolution. As an example, for the "material in process" data source at discovery of an abnormal situation, observation and subsequent action rests with the

process foreman (level "n+1") and review and administrative follow-up

with the process engineer (level "n+2") . If the abnormal situation is

unresolved within prescribed time, additional resources must be called.

For this round of investigation, level "n" shifts to the process foreman,

level "n+1" to the process engineer and level "n+2" to the plant safeguards authority. Each call for additional resources reflects the

increased seriousness of delayed resolution and brings the next higher

decision maker and his information to the investigative team.

Two-level reporting is the thesis that any abnormal situation be

reported not only to the logical, immediate supervisor (who is required

to take necessary action) , but also to the next higher echelon. This has

the effect of insuring that action is taken in an abnormal situation and

that action is not delayed in hopes of resolution. Moreover, with twolevel reporting, a scattering of abnormal situations throughout a plant,

each not especially unusual in its area, will not go unnoticed in the

aggregate.

Resolution feedback is important not only for the obvious functional

purpose of terminating lower level response when the apparent abnormality

was caused innocently, but also for deterrence, yet another goal of

safeguards. That is, the system response is believably demonstrated to

individuals at lower levels and they became aware that action is taken in

reply to a report of an abnormal situation. In contrast, the belief that an abnormal situation will be ignored encourages the tendency either to

fail to report the abnormal situation or to assume that others will fail

to report, making it possible to divert material without getting caught.

The abnormal situation log is kept by each decision maker at the

facility level, (see Figure 2) except the plant manager and the plant

safeguards committee. It is a record of each abnormal situation occurring

in a data source over which the decision maker has cognizance. It includes

references to the data which first indicated the abnormal situation, all

13
AI.I.HWARI.f: TIMK

IINRKSOLVED

SUPKRVISORY

ACTIVITIES AT LEVEL

ALLOWABLE TIME EXCEEDED

CALL ADDITIONAL

RESOimCES : REPLACE "n" BY "n+1"

MAK£ LEVEL "n+2" ABNORMAL

_S2TUATI0N_ENTRY DESCRIPTION AND TIME

COMPLETE ABNORMAL SITUATION l(K INNOCENT CAUSE

;

OPERATIONAL ERROR; SYSTEM DESIGN PROBLEM

RESOLVED

MAKE ABNORMAL

SITUATION LOG ENTRY DESCRIPTION

UNRESOLVED

ALLOWABLE TIME EXCEEDED

ALLOWABLE TIME

L

£V

EL

"n+2'

EXAMINE SITUATION

IN LIGHT OF LEVEL "n+l" INFORMATION

NOT EXCEEDED

VERIFY EXISTENCE

USING LEVEL "n" INFORMATION

START ELAPSED

TIME CLOCK REPORT EXISTENCE

OF ABNORMAL

SITUATION TO LEVEL "iM-2"

L

EV

EL

MAKE ABNORMAL

SITUATION LOG ENTRY DESCRIPTION AND TIME

^.•NRESOLVED

ALLOWABLE TIME EXCEEDED

MAKE ABNORMAL

SITUATION LOG

t^.'TRY DESCRIPTICH, time" AND RESOLUTION

ALLOWABLE TIME NOT EXCEEDED

ACTICN TAKEN AT LEVEL "n"

NOTIFY LEVEL "n+l" OF ABNORMAL

SITUATION

INCOMING INFORMATION

INDICATION OF ABNORMAL

SITUATION

EXAMINE SITUATION

IN LIGHT OF LEVEL "n" INFORMATION

MAKE ABNORMAL

SITUATION LOG

PNTRY DESCRIPTION, TIME

A'.'D RESOLUTION

Figure 5

FEEDBACK AND RESOLUTION Logic Diagram for Actions Related to Abnormal Situations

14
pertinent dates and times, the response and the resolution of the situation.

Innocent causes of abnormal situations are also listed, and should the indication be due to an error in system design or to a process-related problem,

this will become apparent. The system can then be modified for improved

handling of indications from innocent causes in the future. When within the

purview of the decision maker, recommendations for solutions to system design

problems should also be included in the log.

The records maintained as the abnormal situation log are essential for

evaluation of the system and are fundamental to modifications of its design.

It contains key evidence that the system is functioning at a given location

and helps to give assurance for reporting of future abnormal situations.

A pattern of abnormal situations traceable to a given individual or processing areas will also become apparent so that corrective action can be taken.

The "elapsed time clock" effectively restricts the total time, ET^^, to

be allowed for investigation, establishment of an innocent cause, or resolution of an abnormal situation before additional action must be taken.

At a given level "n" (as shown in Figure 5) , this maximum allowable time may

be characterized as: ET = f(MA, S , S , S , n), n MIS

where

^ MA = material attractiveness , S = mass sensitivity'^,

. . 5 = time sensitivity ,

S = space sensitivity , and

n = cognizant person or decision level.

A means of expressing the idea that when several material types (i.e.,

the nuclear properties of the SNM) or descriptions (i.e., the physical

or chemical form of the SNM as distinguished from material type) are subject to illicit removal from an area, some may be more desirable to

a diverter than others because of the ready or easy adaption to intended

end-use

An attribute of diversion indication for denoting that in the event of

a diversion of a threshold mass of X grams, there is at least a p%

probability that a signal in the information (i.e., an abnormal situation) will result which will serve to initiate additional investigation.

Also, the specification of the quantity of the threshold mass. An attribute of diversion indication for denoting that in the event of

diversion, there is at least a p% probability that there will be a signal in the information (i.e., an abnormal situation) observed wthin

d days. Also, the specification of the time interval within which

observation should occur. An attribute of diversion indication for denoting that in the event of

diversion, there is at least a p% probability that there will be a signal

in the information (i.e., an abnormal situation) pinpointing the areas wherein removal occurred and highlighting the personnel having access to

the SNM. Also, the specification of the area and personnel.

15
16

It must be remembered, however, that "ETj^" is a function of "n" , and must

therefore be re-evaluated each time "n" is incremented. In general, "ET^"

will decrease as "n" increases.

The elapsed time clock is interrogated at the three decision points

(refer to Figure 5) designated "Elapsed Time Check". The interrogation

indicated at level "n+2" is included to imply two-level reporting (that is

the cognizant person at level "n+2" has a responsibility to see that action

is taken at level "n+1" within the specified elapsed time). Once the

allowed time has elapsed, the next level of assistance and responsibility

must be called upon as a matter of routine. This concept removes from

negotiation the decision as to whether or not to call for help since it

insures that additional resources will be brought in to resolve abnormal

situations when necessary.

Since each abnormal situation implies the possibility of diversion,

time is of the essence: there must be no unnecessary delay in sounding an alarm when an alarm is warranted. With a fixed time schedule for alerting

the next higher echelon, no judgment in regard to elapsed time need be

exercised by the decision maker. The concept prevents adoption of a "wait

and see" attitutde, and further insures that abnormal situations likely

due to diversion will be identified in a timely manner as not being due to

innocent cause. The abnormal situation log, with the requirement for noting times,

will help to determine whether the elapsed time requirement is being adhered

to and will, in turn, allow time-response assurance statements to be made.

Thus, the elapsed time clock is perhaps the most important element of the

concept for, by assuring that the time sensitivity of safeguards is met, it

dictates the making of a timely response to possible diversion.

When the decision maker realizes that an abnormal situation exists, it

is incumbent upon him to act. Choice of action is, in itself, a decision

responsibility and is dependent upon the diversion path. Each decision

maker is exposed to a number of diversion paths^, depending upon the data

source over which he has purview, and can often observe more than one abnormal situation for a specific path. Each of the abnormal situations is

observed by means of an available element of information which enables him

to recognize the situation and initiate his actions. The choice of the

sensitive element of information which allows recognition of the abnormal

situation results from application of the last concept, diversion path

analysis.

3. 3 Diversion Path Analysis

The key to safeguards at the plant level is recognition of the

existence of the abnormal situation, one which prompts the question: "Has

diversion occurred?" The recognition responsibility resides with one of

the decision makers identified earlier who, when specified for a given

plant area, must be provided with mechanisms to alert him to action based

on available information and the possible ways material could be diverted

from the area.

7 The complete and detailed description of a modus operandi and rationale,

devised as an independent method, for illicitly removing and concealing

the removal of SNM.

18
For a decision maker to become quickly aware of a relevant abnormal

situation and its potential significance, his area of responsibility must

be analyzed in advance and diversion paths made known. In the scope of

SIS, such analyses would be performed by the plant safeguards authority

(or a member of his staff) , assisted by the process engineer^ and process

foreman of the area under scrutiny, subject to review by the AEC Field

Office. The procedure for directing the systematic analysis is termed

diversion path analysis (DPA) . Details of the steps used in applying the

procedure are given elsewhere [2]; in brief all conceivable diversion

possibilities are identified and classified in descending order of

seriousness and likelihood of occurrence. Information elements and safeguards activities are matched to possible diversions and the information

used in the design of SIS is generated in order to satisfy the safeguards

objectives. Concomitantly, consideration is also given to innocent

explanations of seemingly alarming situations so that the decision maker

has an informed basis for his actions.

The DPA concept is vital in safeguards. The cognizant authority

at each level must be confident that, insofar as possible, all diversion

paths have been examined, that these paths have been systematically

ordered or ranked by establishable criteria; and that attention is focused

on the more probable paths, at the same time reducing or eliminating

further consideration of less probable ones. Once diversion paths have

been traced, the data elements and their respective sources (either currently

available or readily made available) are identified. These data elements

are used to derive a set of variables, which are in turn analyzed either

numerically or comparatively as diversion indicators. Identification of

data elements relative to the most probable paths, individually considered,

and performance of associated data analyses permit the cognizant decision

maker to conclude at a high level of confidence whether or not diversion

has occurred. His assurance may be expressed in the form of statements

which provide information about the probability that verification, accounting

and the adopted procedures accurately reflect the current status and operation

of the safeguards system.

4. DECISION RESPONSIBILITIES OF THE PLANT SAFEGUARDS AUTHORITY

Having conceptualized the general types of information which decision

makers need to carry out their safeguards activities, specific responsibilities and activities of the plant safeguards authority must be examined

in detail in order to prescribe the information he requires.

The title "plant safeguards authority" is generic and was established

during the evolution of SIS. The safeguards tasks and activities assigned

to the plant safeguards authority have been laid down in accord with the

overall SIS structure and serve as a guide which, when applied, will

assure that all tasks and activities are performed and that the content of

the information flows is complete.

The process engineer is the professional (or professionals) directly

responsible for improvements to the process and for the specification

of the internal and process controls to be used in the process area.

19
At some facilities another designator may be used (for example,

Nuclear Materials Control) , or the safeguards tasks and activities here

prescribed may be performed by more than one person. Thus, for a specific

plant, safeguards tasks, activities and responsibilities must be examined

in light of this guide in order to pinpoint the individual most nearly

matching this decision maker. If the tasks actually performed by the

identified individual are not those prescribed by SIS, a careful review

is in order. Consideration might be given to plant task reassignments as

a means of better approximating SIS. If this is infeasible for administrative or other reasons, great care must be exercised in the design of

the plant SIS in order to insure that all safeguard tasks, activities and

responsibilities set-forth in the general SIS are assigned to specific

decision makers and that the associated information flows accurately

reflect these assignments.

4. 1 Tasks and Safeguards Activities

The plant safeguards authority has first-line responsibility for

decisions pertaining to safeguards system design, modification and

operation. With assistance from process engineers and process foremen of

the unit processes or MBA's under scrutiny, he conducts the diversion path

analysis [2]. For each process area under analysis, he determines whether

all pertinent path ordering parameters are considered, that all paths

having a relative path weight greater than boundary conditions set forth

in corporate or AEC guidelines are exhaustively analyzed, and that each

analysis is properly documented. He is responsible for decisions that

time factors associated with the elapsed time clock (Section 3.2) are realistic and sufficient, and that diversion path documentation accurately

reflects the diversion paths, abnormal situations to be observed, possible

innocent causes, information needs and responses of the observer, and

cognizant persons to be notified in event of an abnormal situation. He

verifies that internal control procedures incorporate observation for and

reporting of abnormal situations highlighted as diversion indicators.

Irregular event procedures dictate, upon notification by the plant

guard captain, that the plant safeguards authority initiate appropriate

safeguards actions such as special inventory of the area involved, call for

computer preparation of current inventory lists for unit processes and

MBA's in the area, etc.

When notified by the production control manager that a portion of

the process is under revision, the plant safeguards authority conducts

the review and up-dates the diversion path analyses relating to the

affected unit processes to insure that the analyses include any new diversion paths which result from the change and to delete old paths which are no longer applicable.

He is responsible for design of sampling plans on which are based the

computer generated random lists for use by the plant physical inspector^;

The plant physical inspector performs random inspections of the facility,

within the plant perimeter, directed specifically towards safeguards

rather than physical security. Included are spot-checks for item presence

using a list of items which is randomly generated from the general inventory file maintained in the plant data processing system and observations

(on a random and unannounced basis) for lapses in procedures.

20
for initiating the establishment and improvement of measurement programs

which are aimed at reducing uncertainty of measurements and uncertainty

of MUF, particularly if such programs are not specifically required for

production control; and the development of experimental procedures which

verify measurement and MUF uncertainty calculations, indicator sensitivity

and overall system operation. Each of these tasks and responsibilities

lead to decisions that the overall system is properly designed or that

necessary modifications are expeditiously accomplished.

Further responsibilities include design of the plant materials

accounting and other internal control procedures. Since data elements

collected for accounting and control (even though later aggregated for

reporting purposes) are often analogous to those needed for safeguards,

the plant safeguards authority is responsible for decisions that accounting

and control information and data accurately reflect material and information flows within the plant. He also assures that duplication of data

taken for each purpose (safeguards, accounting or internal control) be

minimized through careful design of all systems.

He is responsible for the daily operation of the system and for

decisions related to system operation which include evaluation of MUF and

the uncertainty of MUF, resolution of shipper-receiver differences (S-R's)

between plant MBA's and the plant and other facilities, physical inventory

verification through activities of the plant physical inspector (general

inventory activities are performed by production control), and audit,

review and verification of all facets of safeguards procedures associated

with plant MBA' s. The plant safeguards authority is the focal point for safeguards interactions between the production side of the plant, through the process

engineers, and the quality control laboratories with reference to calibration and measurement control programs. He is also responsible for safeguards

interaction, through the plant manager, with the cognizant AEC Field Office

SS Rep and is the principal contact within the plant during AEC Field Office

Survey inspections.

4.2 Information Needs

In order to carry out his responsibilities for system design,

modification, and operation, and reach meaningful decisions, the plant

safeguards authority requires the following information:

• facility-wide SNM accounting records;

• results of physical inventories;

• current and historical facility MUF data;

• narrative explanations of historical MUF;

• current and historical S-R data (inter- and intra-plant)

• calibration program measurement data;

• data on uncertainty of measurements;

• production control data;

• changes in production operations within unit processes;

• full particulars of irregular events such as fires,

demonstrations or natural disasters; and

• overall knowledge of attractiveness, form and quantity

of SNM in MBA's and unit processes.

21
5. DETAILED INFORMATION FLOWS FOR THE PLANT SAFEGUARDS AUTHORITY

The detailed information flows associated with the plant safeguards

authority within the SIS structure, are defined once the interacting nodes

and flows are identified, the interrelationships set forth, and the node

content and flow content listed. This is not meant to imply, however, that once defined, the structure cannot or should not be changed. The concept

of SIS, when correctly applied, permits modification of those portions of

the structure subject to change because of new objectives or needs without

requiring overhaul of the entire SIS. The caveat given above regarding

review of safeguards tasks, activities and responsibilities of personnel in

a specific plant, must, none the less, be observed.

Details of the information content and flow associated with the plant

safeguards authority will be presented in terms of the SIS structure rather

than in terms of an actual operating system. In actual practice, a plant's

SIS document must be specific. For example, it might state in relation to an abnormal situation observed by a process foreman. A, in an MBA Q3:

"Upon observing abnormal situation Sn, A will: (1) notify B (his process

engineer) by telephone within M minutes; (2) complete abnormal situation

reporting form F (shown in exhibit E) ; (3) file the original of the form

in the abnormal situation log L, kept in MBA Q3 at a designated location;

and (4) forward copy 1 of the form to B and copy 2 to C (the plant safeguards authority) within H hours." Further, the plant SIS document would

list all abnormal situations, S^^, for the given unit process or MBA, state

explicitly the allowable elapsed times, M and H, associated with each

situation or class of situations, and give names, job titles, phone numbers

and plant addresses of the individuals, B and C, referred to in the

statement. In contrast, the general description for the plant safeguards

authority which follows will indicate simply "abnormal situation information will be transmitted from X to Y" and will indicate generically who

the decision makers are. Emphasis is placed on the flows, methods of flow,

forms and documents to be used (in general terms) , and the general distribution paths for the documents and forms. AEC forms are referenced by number,

but forms and documents likely to be plant specific are described only in

general terms.

The information flows associated with each of the nodes of SIS are addressed in detail in the comprehensive report [1]. It is useful, at this

point, to introduce some of these details , summarized in the form of several

lists, in order to further pinpoint the plant safeguards authority within

the general framework. The nodes of SIS, subdivided by location, decision

maker, data generating activities and information generating activities are listed in Table 2. The flows are listed in Table 3 as a function of endpoint node, including flows for reporting purposes between decision makers

and flows to information and analysis systems. The content of the SIS information flows is listed, in general terms, in Table 4.

Most of the flows listed in Table 3 are bi-directional, that is,

information is transmitted from either end-point node to the other. Content

of the flow, however, usually depends on the direction of flow. For

example, the process engineer forwards to the plant safeguards authority

22
LOCATIONS

A. Top echelon of Government

lo Office of the President

2. Office of the Joint Committee on Atomic Energy

B. AEC Headquarters

C. International Atomic Energy Agency

D. Computer Sciences Division, NMIS Department, Oak Ridge

E. AEC Field Offices

F. Law enforcement units

1. Local police

2. Federal Bureau of Investigation Field Offices

3. Federal Bureau of Investigation Headquarters

G. Transportation elements

1. Regional Transportation Control Centers

2. Transportation units enroute

H. Independent AEC laboratories

I. Plants

1. Processing areas

2. R&D areas

3. Analytical laboratories

4. Storage areas

5. Shipping and receiving areas

6. Nuclear materials control unit

7. Corporate internal audit unit

8. Physical security

9. Central data processing

10. Management

DECISION MAKERS

A. Management (reporting channels)

lo The President

2. The Joint Committee on Atomic Energy (JCAE)

3. Atomic Energy Commission, Headquarters

a. Commissioners

b. General Manager (GM)

c. Assistant General Manager for National Security (AGMNS)

d. Director of Regulation

e. Director, Division of Safeguards and Security (DSS)

f. Assistant Director for Inspection and Appraisal (A/D I&A) , DSS

g. Chief, Inspection and Appraisal Branch (I&A Branch), DSS

h. Chief, Internal Security Branch (IS Branch), DSS

i. AEC Appraiser

4. Atomic Energy Commission, Field Offices

a. Manager

b. Source and Special Materials Representative (SS Rep)

c. Director of Security

d. AEC Survey Inspector

e. AEC Security Inspector

5. Regional Transportation Control

6. Plants

a. Manager

Table 2 The Nodes of SIS

23
bo Plant Safeguards Authority

c. Physical Security Director

B. Management (administrative channels)

1. Director, Federal Bureau of Investigation

2. Atomic Energy Commission, Headquarters

ao Directors, program divisions

b. Directors, staff divisions

3. Plants

a. Safeguards Committee

b. Production Control Manager

C. Investigative Forces

1. Agents, Federal Bureau of Investigation, Headquarters

2. Agents, Federal Bureau of Investigation, Field Offices

D. Transportation

1. SNM Transportation Custodian, Driver

2. SNM Transportation Custodian, Courier

E. Plant

1. Physical Security

a. Guard Captain

b. Guard

2. R&D Area

a. Supervisor

b. SNM Custodian

c . Technologist

3. Analytical Laboratory

a. Supervisor

b. SNM Custodian

c. Chemist

4. Shipping and Receiving

a. Shipping Dock Foreman

b. Shipping Dock Clerk

5. Storage

a. SNM Custodian (MBA)

b. Plant Physical Inspector

c. Vault Manager

6. Process Line

a. Process Engineer (Unit Process or MBA)

b. SNM Custodian (MBA)

c. Process Foreman (MBA or Several Unit Processes)

d. Process Operator (Unit Process)

III. DATA GENERATING ACTIVITIES

A. Material Transfer Activities

1. Receiving

a. Observations

1) Material from Off-site

2) Internal Transfers

b. Measurements

1) Material from Off-site

2) Internal Transfers

Table 2 (continued) The Nodes of SIS

24
2. Shipping

a. Observations

1) Material going Off-site

2) Internal Transfers

b. Measurements

1) Material going Off-site

2) Internal Transfers

B. Material Processing Activities

1. Batch Make-up

2. Sampling

3. Changing of Form

a. Physical

b. Chemical

c. Isotopic

4. Control Measurements

a. Process

b. Quality

C. Internal Control Activities

1. Health and Safety

a. Measurements

b. Monitoring

2. Physical Security Observations

3. Diversion Path Analyses

4. Abnormal Situation Activities

5. Internal Audit

D. Material Balance Accounting Activities

1. Striking the Balance

2. Inventory Taking

3. Composition of Ending Inventory (COEI)

4. Inventory Verification

E. Analytical Laboratory Measurements

F. R&D Area Measurements

G. Scheduling Activities

1. Preparation of Work Orders by Process Engineer

2. Scheduling Work Orders

a. Analytical Laboratory Supervisor

b. R&D Area Supervisor

3. Preparation of Plant Schedules by Production Control Manager

H. Plant Safeguards Committee Recommendations

I. Plant Safeguards Authority Reports To:

1. Plant Manager

2. AEC Field Office

J. AEC Survey Activities

1. Sampling and Independent Measurements

2. Independent Inventory Verification Observations

3. Other Observations

K. AEC Appraisal Activities

IV. INFORMATION GENERATING ACTIVITIES

A. Data Processing Activities

Table 2 (continued) The Nodes of SIS

25
1. Plant Process Areas

2. Plant Central Data Processing Facility

3. Plant Accounting Activities

4. Computer Sciences Division, NMIS Department, Oak Ridge

5. AEC Headquarters

B. Diversion Path Analyses

C. Reaching Conclusions Based On:

1. Abnormal Situation Information Assessment

2. Evaluation of Process Data Obtained from all Data Processing

Activities (IV. A.)

3. AEC Survey Evaluations

a. General

b. Material Balance Accounting

1) Measurement Systems

2) Record Systems

3) Book Inventory

4) Physical Inventory

5) Measurement Control Program

6) Uncertainties in Measurements

7) Calculation of Uncertainty in MUF

8) MUF Analysis and Evaluation

c. Systematic Analytical Alerting and Assurance Procedures

1) Review of Procedures

2) Review of Diversion Path Analyses

3) Review for Completeness

4) Review of Abnormal Situation Logs

5) Evaluation of Procedures

d. Review of Abnormal Situations Observable by AEC Survey

Inspector

4. AEC Appraisal Evaluations

a. General

b. Personnel

1) Capability

2) Performance

c. Field Office Survey Activities

1) On-site Reviews

2) Work Papers

3) Resulting Assurance Statements

D. Generation of Assurance Statements

1. Within Plant

a. Process Areas

1) Process Operator to Process Foreman

2) Process Foreman to Process Engineer

3) MBA SNM Custodian to Process Engineer

4) Process Engineer to Plant Safeguards Authority

b. Physical Security

1) Plant Guard to Plant Guard Captain

2) Plant Guard Captain to Physical Security Director

3) Physical Security Director to Plant Safeguards Authority

Table 2 (continued) The Nodes of SIS

26
c. R&D Areas

1) R6cD Technologist to R&D Supervisor

2) R&cD SNM Custodian to R&D Supervisor

3) R&D Supervisor to Plant Safeguards Authority

d. Analytical Laboratory

1) Laboratory Chemist to Laboratory Supervisor

2) Laboratory SNM Custodian to Laboratory Supervisor

3) Laboratory Supervisor to Plant Safeguards Authority

e. Storage Areas

1) Vault Manager to Plant Safeguards Authority

2) Plant Physical Inspector to Plant Safeguards Authority

f. Off-site Shipping and Receiving

1) Shipping Dock Clerk to Shipping Dock Foreman

2) Shipping Dock Foreman to Plant Safeguards Authority

g. Management

1) Plant Safeguards Authority to Plant Manager

2) Physical Security Director to Plant Manager

3) Plant Safeguards Committee to Plant Manager

2. Transportation

a. SNM Transportation Custodian to Regional Transportation Control

3. Between Plant and Field Office

a. Plant Manager to SS Rep

b. Plant Manager to Field Office Manager

c. Physical Security Director to Director of Security

4. Within Field Office

a. AEC Survey Inspector to SS Rep

b. Regional Transportation Control to SS Rep

c. Regional Transportation Control to Director of Security

d. SS Rep to Field Office Manager

e. AEC Security Inspector to Director of Security

f. Director of Security to Field Office Manager

5. Between Field Office and AEC Headquarters

a. Field Office Manager to Director, DSS

b. Director of Security to Chief, IS Branch, DSS

c. Director of Security to Director, DSS

6. AEC Headquarters and Top Echelon of Government

a. AEC Appraiser to Chief, I&A Branch, DSS

b. Chief, I&A Branch, DSS, to A/D, I&A, DSS

c. Chief, IS Branch, DSS, to Director, DSS

d. A/D, I&A, DSS, to Director, DSS

e. Director, DSS, to AGMNS

f. AGMNS to CM

g. GM to AEC Commissioners

h. GM to JCAE

i. AEC Commissioners to JCAE

j. AEC Commissioners to the President

k. The President to the Public

Table 2 (continued) The Nodes of SIS

27
BIDIRECTIONAL REPORTING FLOWS OF INFORMATION

R-OOl President - AEC Commissioners

R-002 JCAE - AEC Commissioners

R-003 JCAE - GM

R-004 AEC Commissioners - GM

R-005 AEC Commissioners - Director of Regulationl

R-006 GM - AGMNS

R-007 AGMNS - Directo

R-008 Director, DSS - R-009 Director, DSS - R-OlO Director, DSS -

•, DSS

A/D, l&A, DSS

Chief, I&A Branch, DSS

Field Office Manager

R- 011 Director

,

DSS - SS Rep

R- 012 Director

,

DSS - FBI Headquarters

R- 013 Director

,

DSS •- Field Office Director of

R- 014 Director

,

DSS - Chief, IS Branch, DSS

R- 015 A/D, I&A, DSS - Chief, I6cA Branch, DSS

R-016 Chief, l&A Branch, DSS - AEC Appraiser

R-017 Chief, IS Branch, DSS - FBI Headquarters

R-018 Chief, IS Branch, DSS - AEC Appraiser

R-019 Chief, IS Branch, DSS - Field Office Director of Security

R-020 AEC Appraiser - SS Rep

R-021 AEC Appraiser - Field Office Director of Security

R-022 Field Office Manager - SS Rep

R-023 Field Office Manager - Field Office Director of Security

R-024 Field Office Manager - Plant Manager

R-025 SS Rep - Regional Transportation Control

R-026 SS Rep - AEC Survey Inspector

R-027 SS Rep - Plant Manager

R-028 SS Rep - Plant Safeguards Authority

R-029 Field Office Director of Security - Local FBI

R-030 Field Office Director of Security - Local Law Enforcement

R-031 Field Office Director of Security - SS Rep

R-032 Field Office Director of Security - Regional Transportation Control

R-033 Field Office Director of Security - AEC Security Inspector

R-034 Field Office Director of Security - Plant Manager

R-035 Field Office Director of Security - Physical Security Director

R-036 AEC Survey Inspector - Plant Manager

R-037 AEC Survey Inspector - Plant Safeguards Authority

R-038 AEC Survey Inspector - AEC Independent Laboraotry

R-039 AEC Security Inspector - Plant Manager

R-040 AEC Security Inspector - Physical Security Director

Table 3 SIS Information Flows as a Function of End-Point Node

28
BIDIRECTIONAL REPORTING FLOWS OF INFORMATION (continued)

R-041 Regional Transportation Control - SNM Transportation Custodian

R-042 Plant Manager - Plant Safeguards Committee

R-043 Plant Manager - Plant Safeguards Authority

R-044 Plant Manager - Production Control Manager

R-045 Plant Manager - Physical Security Director

- Plant Safeguards Authority

- Production Control Manager

- Physical Security Director

- Plant Safeguards Authority (other

- Production Control Manager

R-046 Plant Safeguards Committee

R-047 Plant Safeguards Committee

R-048 Plant Safeguards Committee

R-049 Plant Safeguards Authority

R-050 Plant Safeguards Authority

R-051 Plant Safeguards Authority

R-052 Plant Safeguards Authority

R-053 Plant Safeguards Authority

R-054 Plant Safeguards Authority

R-055 Plant Safeguards Authority

R-056 Plant Safeguards Authority

R-057 Plant Safeguards Authority

R-058 Plant Safeguards Authority

R-059 Plant Safeguards Authority

R-060 Plant Safeguards Authority

R-061 Plant Safeguards Authority

R-062 Plant Safeguards Authority

R-063 Production Control Manager

R-064 Production Control Manager

R-065 Production Control Manager

R-066 Production Control Manager

R-067 Physical Security Director

R-068 Physical Security Director

R-069 Physical Security Director

R-070 Physical Security Director

- Physical Security Director

- Process Engineer

- R&D Supervisor

- Analytical Laboratory Supervisor

- Plant Physical Inspector

- Plant Guard Captain

- MBA SNM Custodian

- R6tD SNM Custodian

- Laboratory SNM Custodian

- Process Foreman

- Shipping Dock Foreman

- Vault Manager

- AEC Survey Inspector

- Process Engineer

- MBA SNM Custodian

- Vault Manager

- AEC Security Inspector

- Plant Guard Captain

- Plant Guard

- Local FBI

R-071 Physical Security Dire

R-072 Process Engineer - AEC

R-073 Process Engineer - Pro

R-074 Process Engineer - R6cD

R-075 Process Engineer - Ana

ctor - Local Law Enforcement

Survey Inspector

cess Engineer (another MBA)

Supervisor

lytical Laboratory Supervisor

R-076 Process Engineer - MBA SNM Custodian

R-077 Process Engineer - Process Foreman

R-078 Process Engineer - Process Operator

R-079 Process Foreman - AEC Survey Inspector

R-080 Process Foreman - MBA SNM Custodian

Table 3 (continued) SIS Information Flows as a Function of

End-Point Node

29
BIDIRECTIONAL REPORTING FLOWS OF INFORMATION (continued)

R-081 Process Foreman - Process Foreman (adjacent process of MBA)

R-082 Process Foreman - Process Operator

R-083 Process Operator - Plant Safeguards Authority

R-084 Process Operator - MBA SNM Custodian

R-085 Process Operator - Process Operator (same or adjacent unit process)

R-086 R&D Supervisor - R&D SNM Custodian

R-087 R&D Supervisor - R&D Technologist

R-088 R&D SNM Custodian - R&D Technologist

R-089 R&D Technologist - Plant Safeguards Authority

R-090 Analytical Laboratory Supervisor - Laboratory SNM Custodian

R-091 Analytical Laboratory Supervisor - Laboratory Chemist

R-092 Laboratory SNM Custodian - Laboratory Chemist

R-093 Laboratory Chemist - Plant Safeguards Authority

R-094 MBA SNM Custodian - AEC Survey Inspector

R-095 R&D SNM Custodian - AEC Survey Inspector

R-096 Laboratory SNM Custodian - AEC Survey Inspector

R-097 MBA SNM Custodian - MBA SNM Custodian (adjacent MBA)

R-098 MBA SNM Custodian - R&D SNM Custodian

R-099 MBA SNM Custodian - Laboratory SNM Custodian

R-lOO R&D SNM Custodian - R&D SNM Custodian (another R&D area)

R-101 Laboratory SNM Custodian - Laboratory SNM Custodian (another laboratory)

R-102 Plant Physical Inspector - AEC Survey Inspector

R-103 Plant Physical Inspector - Plant Manager

R-104 Plant Physical Inspector - MBA SNM Custodian

R-105 Plant Physical Inspector - R&D SNM Custodian

R-106 Plant Physical Inspector - Laboratory SNM Custodian

R-107 Plant Physical Inspector - Vault Manager

R-108 Vault Manager - AEC Survey Inspector

R-109 Vault Manager - Process Engineer

R-110 Vault Manager - MBA SNM Custodian

R-111 Vault Manager

R-112 Vault Manager

R-113 Vault Manager

R-114 Vault Manager

R-115 Vault Manager

- R&D SNM Custodian

- Laboratory SNM Custodian

- Process Operator

- R&D Technologist

- Laboratory Chemist

R-116 Vault Manager - Plant Guard

R-117 Shipping Dock Foreman - AEC Survey Inspector

R-118 Shipping Dock Foreman - Regional Transportation Control

R-119 Shipping Dock Foreman - Plant Manager

R-120 Shipping Dock Foreman - Vault Manager

Table 3 (continued) SIS Information Flows as a Function of

End-Point Node

30
BIDIRECTIONAL REPORTING FLOWS OF INFORMATION (continued)

R-121 Shipping Dock Foreman - Shipping Dock Clerk

R-122 Shipping Dock Clerk - Plant Safeguards Authority

R-123 Shipping Dock Clerk - MBA SNM Custodian

R-12A Shipping Dock\ Clerk - R&D SNM Custodian

R-125 Shipping Dock Clerk - Laboratory SNM Custodian

R-126 Shipping Dock Clerk - Process Operator

R-127 Shipping Dock Clerk - Shipping Dock Clerk (another facility)

R-128 Plant Guard Captain - AEC Security Inspector

R-129 Plant Guard Captain - Plant Manager

R-130 Plant Guard Captain - Plant Guard

R-131 Plant Guard - Plant Safeguards Authority

R-132 Plant Guard - Shipping Dock Foreman

R-133 Plant Guard - Plant Guard

R-134 SNM Transportation Custodian - SS Rep

R-135 SNM Transportation Custodian - Shipping Dock Clerk

BIDIRECTIONAL INFORMATION FLOWS TO INFORMATION AND ANALYSIS SYSTEMS

S -001 NMIS - Director, DSS

S -002 NMIS - AEC Appraiser

s -003 NMIS - AEC Survey Inspector

s -004 NMIS - SS Rep

s -005 NMIS - Plant Safeguards Authority

s -006 NMIS - Plant Data Processing System (PDPS)

s -007 PDPS - AEC Survey Inspector

s -008 PDPS - Plant Manager

s -009 PDPS - Plant Safeguards Authority

s -010 PDPS - Process Engineer

s -Oil PDPS - SNM Custodian (MBA, R&D or Laboratory)

s -012 PDPS - Process Foreman

s -013 PDPS - Process Operator

s -014 PDPS - Shipping Dock Foreman

s -015 PDPS - Shipping Dock Clerk

s -016 PDPS - Plant Physical Inspector

s -017 PDPS - Vault Manager

Safeguards activities of Director of Regulation beyond scope of study.

Information flows associated with Licensees are excluded from list.

PDPS comprised of plant safeguards data base and related materials ac- counting and data monitoring activities. It may be located centrally or be dispersed throughout the plant and can be computerized or manual.

Table 3 (continued) SIS Information Flows as a Function of

End-Point Node

31
I, ABNORMAL SITUATION INFORMATION

A. Discovery

1 . How much

2. From where

3. Kind of material

4. First observation

5. Time window for occurrence

6. How indicated

7. Possible innocent causes of indication

8. Who made first report

9. Personnel possibly involved

B. Investigation

1. Past actions taken

2. Current actions

3. Future actions to be taken

4. Correlative and corroborant information

a. Within node discovering abnormal situation

b. Outside of node discovering abnormal situation

II. MATERIAL ACCOUNTING INFORMATION

A. Transfer information

B. Inventory information

C. Inventory change information

1. Production

2. Accidental loss

3. Decay

4. Burn-up

5. Measured discard

D. Material balance accounting information

1. MUF

2. Components of MUF equation

3. Known, localized contributors to MUF

4. Uncertainty of MUF

5. Principal contributors to uncertainty of MUF

6. Prior period adjustments

III. DIVERSION PATH ANALYSIS INFORMATION

IV. SURVEY INSPECTION AND APPRAISAL INFORMATION

V. ASSURANCE INFORMATION AND ASSURANCE STATEMENTS

VI. MANAGEMENT INFORMATION

A. Safeguards policy

B. Other administrative directives related to safeguards

VII. TECHNICAL INFORMATION

A. Measurements performed

1. Chemical

2 . Physical

3. Non-destructive

B. Calibration techniques

C. Standards

D. Evaluation of measurements

E. Evaluation techniques

F. Analysis techniques

VIII. INFORMATION IN RESPONSE TO SPECIAL SAFEGUARDS RELATED REQUESTS

Table 4 Content of SIS Information Flows

32
information and reports on abnormal situations, analytical surveillance

exception reports, notification of changes in process operations which

necessitate review of diversion path analyses, safeguards system design

and modification information and suggestions, diversion path analysis data

and information, general observations about process operations and notification of safeguards related problems. On the other hand, the plant safeguards authority returns to the process engineer the results of diversion

path analyses for his area, innocent cause, resolution or other feedback

information about reported abnormal situations, allowable elapsed times

for reporting abnormal situations, solutions to safeguards problems and

safeguards policy.

The following procedure is used for characterizing a node in detail.

Keeping in mind the specific information needs derived from safeguards

tasks, activities and responsibilities incumbent on the node, review is

made of information and data generating activities within the node

(description of the node) , and of the documentation concerning node

activities which is prepared and/or maintained in the node (content of

the node). The identities of other nodes with which this node interacts

are derived through examination of the description and content of this

node and of each of the other nodes, at all levels in the SIS structure

(see Figure 2), in order to determine the available sources for the

information needed by this node and, in light of the information needs of

other nodes, in order to specify the information which this node is

capable of furnishing. Such examination reveals the information and data

to be transmitted (content of flows) from and to the identified nodes

and divides reporting from administrative flows (purpose of flow). Whether

the flow is oral or written (method of flow) is also revealed and is

contingent upon both the content of flow and the identity of the interacting node. The method of flow is also governed, in part, by some basic

premises, applied system-wide, regarding certain contents of flow. For

example, the notification of abnormal situation alerts and alarms should

be made quickly, whereas the supporting reports (which might be used for

investigative actions or at the time of system review) should be prepared

within some specified time while events are still fresh in the mind. Thus,

this premise dictates an oral flow (probably by telephone) in the case of

alerts and alarms and a written flow (because of the intended end-use) in

the case of the supporting report. Another premise relates to the

supporting report as prepared by nodes at lower levels of the SIS structure

(e.g., a process operator). The report is required to be brief, giving only

pertinent facts (date, time and location of discovery, identification of

discoverer, nature of the event, SNM type and estimated quantity involved,

and initial actions taken). Brevity is dictated in order to reduce cumbersome report preparation which might deter filing and, further, to minimize

reporting costs in cases of innocent cause. The procedure is applied in an iterative manner starting with a node

at the lowest level in the decision structure. In the development of SIS

the process operator node was the first to be characterized: his operational

duties bring him into contact with SNM which makes him a first-hand observer

of abnormal situations, the data and information which he receives and sends

is well established, and his information needs (derived prior to undertaking

33
the detailed characterization) and safeguards tasks, activities and

responsibilities are not complex. (Such a decision maker would serve well

as the starting point for design a plant SIS.)

When the process operator node was first reviewed, attention was given

to the information and data received, tempered by Information needs, noting

the sources. The data which results from operational activities was noted

together with the records and logs he maintains and the forms and reports

which he prepares. Further note was made of each decision maker to whom he

sends forms and reports and those who review his records and logs; such

decision makers would normally be prescribed in operating and/or internal

control procedures. All of this information was recorded in a suitable

format (an example of which is shown later with reference to' the plant

safeguards authority) and a schematic drawing was prepared to indicate the

identified details. The detailed characterization of the node at the next

higher level in the SIS structure (process foreman) was then begun, building

on the characterization of the process operator. The procedure was repeated

until the detailed characterization of each node was accomplished.

As one characterizes nodes at higher levels in the structure, the

complexity of the contents of the nodes and contents of the flows increases.

Particularly for higher level nodes, the schematic drawing of completed

nodes becomes important. The identity of interacting nodes at lower levels,

as well as the content of the information flows from these nodes, are readily apparent through study of the diagrams. Thus, comparison of the

diagrams assures completeness and reduces the possibility of missing any

flows. Further, as one characterizes nodes at higher levels in the structure,

it may be found that an information flow to a lower level node was not

recognized earlier or that the content of a flow was incorrectly or, more

generally, incompletely perceived. The schematic provides a means for

quickly detecting the error. Discovery of such errors necessitates an iteration through all completed characterizations in order to up-date the written

narratives and schematic drawings of affected nodes.

By carrying the procedure to completion, one is assured that all elements

listed in Tables 2, 3 and 4 are addressed, that all interacting nodes are accounted for, and that the content of the information flowing through the

system leads to satisfaction of safeguards goals.

With this background on procedure in mind, the detailed characterization

the plant safeguards authority node can now be stated. It is presented in

the format used in the comprehensive report [1] for each node of SIS: the

general node description (location and decision maker) ; summary of the

information needs (as derived in Section 4 above) ; and the characterization

of the node in terms of (1) incoming information flows, (2) information and

data generated, (3) records maintained, (4) records and reports prepared, and

(5) outgoing information flows.

The general node description and summary of information needs are repetitious, but are restated here in order to bring together all pertinent

information about the node. The characterization is given in outline form in

order to present the details as concisely as possible. Study of the outline

reveals the nodes with which the plant safeguards authority interacts and the

content of the information flows received from and sent to these nodes. The

content of the plant safeguards authority node itself is also revealed.

34
The schematic drawing of the detailed characterization is shown in

Figures 7 and 7a using the symbols from Figure 1. Symbols with solid borders

represent characteristics directly associated with the plant safeguards

authority, whereas dashed borders indicate interacting characteristics from

adjacent nodes. Space limitations prevent complete annotation of the content

of flows; numbered circles refer the reader to the similarly keyed listing

appearing above Figure 7a (for annotations of the contents of flows to higher

levels in the SIS structure) and also (for all interacting nodes) to

similarly keyed section in the outline where the description of the contents

of a particular flow is given. Decision makers who prepare reports flowing

to the node are identified by means of small, labelled, dashed diamonds.

The identity of the decision makers, thus labelled, is given in the list

above and to the left of Figure 7a; upper case letters are used to designate groups of decision makers, each of whom sends information having the same general content as indicated, and lower case letters are used to

designate individual decision makers.

By setting down the detailed description of SIS in the manner described,

two aims are achieved. First, insurance is given that all pertinent information is transmitted along the flows indicated in Table 3, that all flow

contents listed in Table 4 are considered, that the decision maker receives

only the information he needs in order to reach his decisions and is not

overburdened with extraneous information, and that a system of checks and

balances is maintained between nodes, allowing decision makers to present

meaningful assurance statements.

Second, it should be apparent that design of an information system to

satisfy safeguards goals is rather laborious and time consuming. Thus,

when design of a plant-specific SIS is undertaken, the bulk of the effort

required of the designer has already been done for him and the benefits

accruing from the first aim are automatically assured if the safeguards

tasks, activities and responsibilities of plant personnel can be brought

into line with those set-forth in the general SIS.

35
5.1 General Node Description

Location: PLANT

Decision Maker: PLANT SAFEGUARDS AUTHORITY

5 . 2 Summary of Information Needs

Facility-wide SNM accounting records

Results of physical inventories

Facility MUF and uncertainty of MUF data with description of sources Narrative explanations of MUF

Current and historical S-R data (inter- and intra-plant)

Calibration program measurement data

Data on uncertainty of measurements

Production control data

Changes in production operations within unit processes (periodic)

Full particulars of irregular events such as fires, demonstrations

or natural disasters

Overall knowledge of attractiveness, form and quantity of SNM in

MBA' s and unit processes

5 . 3 Characterization of Node

Information flows associated with the node are illustrated schematically

in Figures 7 and 7a, and pertinent details of the content of the node and

content of the flows are given in the following outline.

INCOMING INFORMATION FLOWS TO THIS NODE

A. From process foreman

1. Abnormal situation reports and/or copies of log entries

a. If discoverer is sender (copy of log entry)

1) Date and time of discovery

2) Identification (man- or badge-number) of discoverer

3) Statement of pertinent facts

a) Material type

b) Quantity

c) Location

d) Initial actions taken

b. If discoverer is subordinate of sender (report)

1) Date and time of notification

2) Identification of process operator

3) Unit process involved

4) Actions taken for abnormal situation verification

5) Date and time process engineer notified by process

foreman if abnormal situation unresolved during

allowed elapsed time

6) Statement of resolution if abnormal situation

cleared-up using information available to process foreman but not to process operator

36
a) Explanation of innocent cause, or

b) Description of operational error, or

c) Indicator of safeguards system design

error

2. Diversion path analysis information

B. From MBA SNM custodian

1. Copies of abnormal situation log entries

a. Date and time of discovery

b. Identification (man- or badge-number) of discoverer

c. Brief statement of pertinent facts

1) Material type

2) Quantity

3) Location

4) Initial actions taken

C. From process engineer

1. Abnormal situation information and alerts

a. Discovery

b. Investigative

c. Innocent cause

d. Resolution

2. Abnormal situation reports and/or copies of log entries

a. If discoverer is sender (copy of log entry)

1) Date and time of discovery

2) Identification (man- or badge-number) of

discoverer

3) Complete statement of pertinent facts

a) Material type

b) Quantity

c) Location

d) Analytical surveillance indicator

e) Diversion path description

f) Initial actions taken

b. If discoverer is subordinate of sender (report)

1) Date and time of notification

2) Identification of process operator, process foreman

or MBA SNM custodian

3) Unit process or MBA involved

4) Actions taken for abnormal situation verification

5) Date and time plant safeguards authority notified

by process engineer if abnormal situation un- resolved during allowed elapsed time

6) Statement of resolution if abnormal situation

cleared-up using information available to process

engineer but not to discoverer

a) Explanation of innocent cause, or

b) Description of operational error, or

c) Indicator of safeguards system design error

3. Analytical surveillance exception reports

4. Changes in process operations or in production control

rules, regulations and procedures which make diversion

path analysis review necessary

37
5. Information from periodic review of safeguards aspects

of plant-specific rules, regulations and procedures

which govern unit process or MBA production activities

6. Other information

a. Safeguards system design and modification information

b. Diversion path analysis information

c. Observations relating to MBA or unit process

activities

d. Notification of problems arising from MBA or unit

process activities

e. Assurance information

From R&D SNM custodian

1. Copies of abnormal situation log entries

a. Date and time of discovery

b. Identification (man- or badge-number) of discoverer

c. Brief statement of pertinent facts

1) Material type

2) Quantity

3) Location

4) Initial actions taken

From R&D supervisor

1. Abnormal situation information and alerts

a. Discovery

b. Investigative

c. Innocent cause

d. Resolution

2. Abnormal situation reports and/or copies of log entries

a. If discoverer is sender (copy of log entry)

1) Date and time of discovery

2) Identification (man- or badge-number) of

discoverer

3) Complete statement of pertinent facts

a) Material type

b) Quantity

c) Location

d) Diversion path description

e) Initial actions taken

b. If discoverer is subordinate of sender (report)

1) Date and time of notification

2) Identification of R&D technologist or R&D SNM

custodian

3) R&D area involved

4) Actions taken for abnormal situation verification

5) Date and time plant safeguards authority notified

by R&D supervisor if abnormal situation unresolved

during allowed elapsed time

6) Statement of resolution if abnormal situation

cleared-up using information available to R&D

supervisor but not to discoverer

a) Explanation of innocent cause, or

b) Description of operational error, or

c) Indicator of safeguards system design error

38
R&D results applicable to safeguards (if performed)

Information from periodic review of safeguards aspects

of plant-specific rules, regulations and procedures

which govern R&D area activities

Other information

a. Safeguards system design and modification information

b. Diversion path analysis information

c. Observations relating to R&D area activities

d. Notification of problems arising from R&D area activities

e. Assurance information

om laboratory SNM custodian

Copies of abnormal situation log entries

a. Date and time of discovery

b. Identification (man- or badge-number) of discoverer

c. Brief statement of pertinent facts

1) Material type

2) Quantity

3) Location

4) Initial actions taken om analytical laboratory supervisor

Abnormal situation information and alerts

a. Discovery

b. Investigative

c. Innocent cause

d. Resolution

Abnormal situation reports and/or copies of log entries

a. If discoverer is sender (copy of log entry)

1) Date and time of discovery

2) Identification (man- or badge-number) of discoverer

3) Complete statement of pertinent facts

a) Material type

b) Quantity

c) Location

d) Diversion path description

e) Initial actions taken

b. If discoverer is subordinate of sender (report)

1) Date and time of notification

2) Identification of analytical chemist or laboratory

SNM custodian

3) Laboratory involved

4) Actions taken for abnormal situation verification

5) Date and time plant safeguards authority notified

by analytical laboratory supervisor if abnormal

situation unresolved during allowed elapsed time

6) Statement of resolution if abnormal situation

cleared-up using information available to

analytical laboratory supervisor but not to

discoverer

a) Explanation of innocent cause, or

b) Description of operational error, or

c) Indicator of safeguards system design error

39
3. Calibration program data

' a. Measurements

b. Uncertainties associated with various types of

measurements

1) Balances

2) Analytical procedures

3) Isotoplc concentration determinations

4) Non-destructive assay or test

4) Sampling

4. Results of specially requested measurements

5. Information from periodic review of safeguards aspects of

plant-specific rules, regulations and procedures which

govern analytical laboratory activities

6. Other Information

a. Safeguards system design and modification Information

b. Diversion path analysis information

c. Observations relating to analytical laboratory

activities

d. Notification of problems arising from analytical laboratory activities

e. Assurance Information

From vault manager

1. Abnormal situation information and alerts

a. Discovery

b. Investigative

c. Innocent cause

d. Resolution

2. Copies of abnormal situation log entries

a. Date and time of discovery

b. Identification (man- or badge-number) of discoverer

c. Brief statement of pertinent facts

1) Material type

2) Quantity

3) Location of vault

4) Location in vault

5) Initial actions taken

From plant physical Inspector

1. Abnormal situation information and alerts

a. Discovery

b. Investigative

c. Innocent cause

d. Resolution

2. Copies of abnormal situation log entries

a. Date and time of discovery

b. Identification (man- or badge-number) of discoverer

c. Brief statement of pertinent facts

1) Material type

2) Quantity

3) Location

4) Initial actions taken

40
3. Routine reports of observations and inspections

4. Other information

a. Notification of problems arising from inspection

activities

b. Diversion path analysis information

c. Assurance information

From shipping dock clerk

1. Copies of abnormal situation log entries

a. Date and time of discovery

b. Identification (man- or badge-number) of discoverer

c. Brief statement of pertinent facts

1) Material type

2) Quantity

3) Location

4) Initial actions taken

From shipping dock foreman

1. Abnormal situation information and alerts

a. Discovery

b. Investigative

c. Innocent cause

d. Resolution

2. Abnormal situation reports and/or copies of log entries

a. If discoverer is sender (copy of log entry)

1) Date and time of discovery

2) Identification (man- or badge-number) of

discoverer

3) Brief statement of pertinent facts

a) Material type

b) Quantity

c) Location

d) Initial actions taken

b. If discoverer is subordinate of sender (report)

1) Date and time of notification

2) Identification of shipping dock clerk

3) Shipping dock area involved

4) Actions taken for abnormal situation verification

5) Date and time plant safeguards authority notified

by shipping dock foreman if abnormal situation

unresolved during allowed elapsed time

6) Statement of resolution if abnormal situation

cleared-up using information available to shipping dock foreman but not of shipping dock clerk

a) Explanation of innocent cause, or

b) Description of activity error, or

c) Indicator of safeguards system design error

3. Shipping dock activity reports

a. Items and/or containers received

b. Items and/or containers transferred on-site

c. Items and/or containers shipped

4. Notification of receipts or shipments

41
Confirmation that regional transportation control has

been notified of receipt or shipment

Other information

a. Safeguards system design and modification suggestions

b. Diversion path analysis information

c. Observations relating to shipping dock activities

d. Notification of problems arising in shipping dock area

e. Assurance information

om plant guard captain

Abnormal situation reports and/or copies of log entries

a. If discoverer is sender (copy of log entry)

1) Date and time of discovery

2) Identification (man- or badge-number) of

discoverer

3) Statement of pertinent facts

a) Location

b) Circumstances

c) Initial actions taken

b. If discoverer is subordinate of sender (report, administrative flow)

1) Date and time of notification

2) Identification of plant guard

3) Area of facility or perimeter involved

4) Actions taken for abnormal situation verification

5) Date and time physical security director, plant

safeguards authority and plant manager notified by

plant guard captain if abnormal situation unresolved

during allowed elapsed time

6) Statement of resolution if abnormal situation

cleared-up using information available to plant

guard captain but not to plant guard

a) Explanation of innocent cause, or

b) Description of operational error, or

c) Indicator of safeguards preventive system

design error Information from periodic review of abnormal situation log,

prepared by plant guard captain, when verification is made

that physical security system, as it applies to safeguards,

is correctly designed and properly functioning

Other information

a. Breach of physical security which poses a safeguards

problem such as attempted or successful entry or exit

of unauthorized personnel at controlled area or attempts

to bring unauthorized material through doorway monitor

or past gate guard

b. Notification of irregular events

1) Fires or accidents

2) Demonstrations

3) Natural disasters

c. Information on material recovery

42
From process operator, process foreman, MBA SNM custodian,

process engineer, R&D technologist, R&D SNM custodian, R&D

supervisor, laboratory chemist, laboratory SNM custodian,

analytical laboratory supervisor, vault manager, plant

physical inspector, shipping dock clerk, shipping dock

foreman, plant guard and plant guard captain

Based on periodic review of abnormal situation logs

prepared by these decision makers, information for modification of plant safeguards system or for verification

of correct design and proper functioning.

From production control manager

1. Abnormal situation information

a. Investigative

b. Innocent cause

c. Resolution

2. Production information

a. Production control data

b. Changes in process operations

c. Changes in plant-specific rules, regulations

and procedures

3. Information from periodic review of safeguards related

production control rules, regulations and procedures

for verification of assurance statements and of cor- rectness of design and proper functioning of safeguards

system

4. Other information

a. Safeguards system design and modification information

b. Diversion path analysis information

c. Observations of process area activities

d. Notification of problems arising from process area activities

e. Assurance information

From physical security director

1. Abnormal situation information

a. Discovery

b. Investigative

c. Innocent cause

d. Resolution

2. Abnormal situation reports from subordinates

a. Date and time of notification

b. Identification of plant guard captain or plant

guard

c.' Area of facility or perimeter involved

d. Actions taken for abnormal situation verification

e. Date and time plant safeguards authority, plant manager

and FBI and/or local law enforcement authorities notified by physical security director if abnormal situation

unresolved during allowed elapsed time

f . Statement of resolution if abnormal situation cleared-up

using information available to physical security

director but not to plant guard captain

1) Explanation of innocent cause, or

43
2) Description of operational error, or

3) Indicator of safeguards preventive system design

error

3. Information from periodic review of safeguards aspects of

physical security rules, regulations and procedures, preventive system analyses and abnormal situation reports for

verification of assurance statements and of correctness of

design and proper functioning of physical security system

as it applies to safeguards

4. Preventive system analyses data

5. Law enforcement information from local FBI or law enforcement authorities about off-site events

a. Discovery

1) Illegal possession outside plant perimeter

2) Cached outside plant perimeter

b. Investigative

c. Resoloution and/or recovery

6. Irregular event information

a. Fires and accidents

b. Demonstrations

c. Natural disasters

7. Other information

a. Safeguards system design and modification information

b. Diversion path analysis information

c. Observations concerning physical security system

d. Notification of short term physical security problems,

breach of physical security or irregular event which

might require ad hoc response such as special inventory of area involved

e. Assurance information

From plant safeguards committee

1. Requests for information, suggestions, ad hoc studies

and diversion path analysis summary reports and workpapers of specific unit processes or MBA's

2. Decisions of plant safeguards committee

a. For plant safeguards authority activities

b. To be passed to process engineer, R&D supervisior,

analytical laboratory supervisior, vault manager,

plant physical inspector and shipping dock foreman

From plant data processing (depending on sophistication of

plant data processing system and facility-specific procedures

and personnel responsibilities)

1. Facility-wide SNM accounting records

2. Physical inventory data

3. Current and prior period facility MUF data

4. Narrative explanations of prior period MUF

5. Current and prior period S-R data (inter- and intra-plant)

6. Analytical surveillance results and reports

7. Safeguards exception reports and alarms

From plant manager

1. Requests for assurance information

44
2. AEC safeguards policy and related corporate policy

3. Results of AEC survey inspections as they relate to

safeguards

From plant safeguards authority at another facility

1. S-R information and data

a. Notification

b. Investigation

c. Resolution

2. Other facility shipping

a. Notification by telephone of shipment and estimated

time of arrival

b. Teletype (TTY) confirmation of shipment

1) Date and time of shipment

2) Estimated time of arrival

3) Items or containers shipped

a) Type

b) Quantity

c) Contents

d) Seal numbers

4) Carrier information

a) Transportation contractor identification

b) SNM transportation custodian identification (if

applicable

c. Receiver's copies of Form AEC 741

3. Other facility receiving

a. Notification by telephone of receipt

b. Teletype (TTY) confirmation of receipt

1) Date and time of receipt

2) Items or containers received

a) Type

b) Quantity

c) Condition

d) Seal numbers

c. Shipper's copies (returned from receiver) of Forms

AEC 741 and/or AEC 284

From regional transportation control

1. Notification of transportation abnormal situation involvin

facility shipment

2. Requests for additional information

3. Investigative information

4. Resolution information

From AEC survey inspector

1. AEC safeguards policy and directives

2. Results of AEC sponsored R&D applicable to facility safeguards system

3. Requests for additional samples during on-site evaluation

4. Requests for additional information on any safeguards

related phase of facility activity during on-site or offsite evaluation

5. Preliminary findings, suggestions and recommendations made

during exit interview

45
V. From SS rep

1. Requests for information, resolution or investigation of

specific safeguards situations and/or problems

2. Follow-up information on suggestions or recommendations

3. Results of AEC sponsored R&D applicable to facility safeguards system

4. Off-site analytical laboratory results (when applicable)

5. AEC safeguards policy and directives

W. From NMIS

1. Requests for information about shipments and receipts

a. S-R

b. Measurement uncertainties

c. Data verification

d. Resolution information

2. Material transaction error reports

3. Material accounting balance for plant verification

INFORMATION AND DATA GENERATED AT THIS NODE

A. Information for diversion path analyses

B. Analytical surveillance data

C. Analytical surveillance exception data

D. Information for safeguards system design and modification

E. Abnormal situation existence verification

F. Abnormal situation investigation and resolution information

G. Elapsed time information

H. Assurance information

RECORDS MAINTAINED AT THIS NODE

A. Diversion path analyses

B. Safeguards system design records

1. Design plans

2. Suggested modifications forwarded by facility personnel

C. Abnormal situation records (all sources)

1. Notifications

2. Investigations

3. Innocent causes

4. Resolutions

D. Safeguards policy

1. AEC

2. Corporate

E. Plant-specific rules, regulations and procedures for production,

R&D and laboratory activities which interact with safeguards

activities

F. Historical AEC survey inspection records as they relate to

safeguards

G. Plant safeguards committee recommendations, decisions and

requirements

H. Current and historical records (may be maintained by plant data

processing system for rapid recall by plant safeguards authority

1. Analytical surveillance

2. S-R

3. MUF

4. Uncertainty of MUF

5. Inventory

46
6. Routine physical inspections

7. Calibration program

8. Transportation

9. Material receipt and transfer (inter- and intra-plant)

10. Item identity change

11. Assurance records

IV. RECORDS AND REPORTS PREPARED AT THIS NODE

A. Diversion path analyses

B. Safeguards system design and modification reports

C. Plant-specific rules, regulations and procedures for safeguards

activities

D. Records of assurance statements

(32) E. Abnormal situation reports

^"^^ 1. Date and time of notification

2. Identification of notifier

3. Area of facility involved

4. Actions taken for abnormal situation verification

5. Date and time physical security director, plant manager

and FBI and/or local law enforcement authorities (through

physical security director) notified by plant safeguards

authority if abnormal situation unresolved during allowed

elapsed time

6. Statement of resolution if abnormal situation cleared-up

using information available to plant safeguards authority

but not to other plant personnel

a. Explanation of innocent cause, or

b. Description of operational error, or

c. Indicator of safeguards system design error

F. Reports to plant safeguards committee

G. MUF and uncertainty of MUF records

H. Shipper's copies of Form AEC 741 and receiver's copies of

Forms AEC 741 and AEC 284

I. Safeguards activity reports

J. Assurance reports

V. OUTGOING INFORKA.TION FLOWS FROM THIS NODE

^32^ A. To process engineer

1. Diversion path analyses for his process area

2. Abnormal situation information

a. Elapsed time allowed before notifying next echelon

(each type of abnormal situation)

b. Innocent cause or resolution

c. Feedback

3. Solutions to problems

4. Decisions of plant safeguards committee

5. Safeguards policy from plant management

B. To R&D supervisor

1. Diversion path analyses for his R&D area

2. Abnormal situation information

a. Elapsed time allowed before notifying next echelon

(each type of abnormal situation)

b. Innocent cause or resolution

c. Feedback

47
Solutions to problems

Requests for special R&D

Decisions of plant safeguards conunittee

Safeguards policy from plant management

analytical laboratory supervisior

Diversion path analyses for his analytical laboratory

area Abnormal situation information

a. Elapsed time allowed before notifying next echelon

(each type of abnormal situation)

b. Innocent cause or resolution

c. Feedback

Solutions to problems

Requests for information and data

a. Calibration program

b. Measurement uncertainties

c. Non-routine measurements

d. Special samples

Decisions of plant safeguards committee

Safeguards policy from plant management

vault manager

Solutions to problems arising from vault activities

Abnormal situation information

a. Elapsed time allowed before notifying next echelon

(each type of abnormal situation)

b. Innocent cause or resolution

c. Feedback

Decisions of plant safeguards committee

Safeguards policy from plant management

plant physical inspector

Solutions to inspection activity problems

Abnormal situation information

a. Elapsed time allowed before notifying next echelon

(each type of abnormal situation)

b. Innocent cause or resolution

c. Feedback

Decisions of plant safeguards committee

Safeguards policy from plant management

shipping dock foreman

Solutions to shipping dock activity problems

Decisions of plant safeguards committee

Safeguards policy from plant management

Receiving activities

a. Notification of material to be received (may be

Teletype (TTY) notification by shipper)

b. Routing for material to be transferred on-site afte

receipt

c. Abnormal situation information

1) Elapsed time allowed before notifying next echel

(each type of abnormal situation)

2) Innocent cause or resolution

48
3) Feedback

Shipping activities

a. List of items and/or containers to be shipped

b. Authorization for shipment

c. Bill of lading to accompany shipment

d. Shipping labels

e. Information on seals

f. Designation of carrier

g. Information for verification of credentials of SNM

transportation custodian

h. Special handling instructions

i. Abnormal situation information

1) Elapsed time allowed before notifying next echelon

(each type of abnormal situation)

2) Innocent cause or resolution

3) Feedback

plant guard captain

Notification of abnormal situation where immediate action

may result in apprehension and recovery

Notification of recovery of misplaced material

production control manager

Change in safeguards system necessitating modified

production regulation or procedure

Safeguards policy decisions from plant management

Safeguards system design and modification reports

Diversion path analysis reports

physical security director

Modifications in safeguards system which require modified

plant-specific physical security rules, regulations or procedures

Safeguards policy decisions from plant management

Diversion path analysis reports

plant safeguards committee

Information and data specifically requested

a. Details of facility activities relevant to safeguards

1) Operational activities

a) Material flows

b) Material residence times

c) Material attractiveness

d) Changes in material form (physical or chemical)

e) Quality control measurements

f) Process control measurements

g) Measurement programs

h) Measurement points and techniques

i) Statistical analyses of measurement data

j) MUF and uncertainty in MUF calculations and

supporting information

2) Current and prior period accounting information

3) Manuals specifying facility rules, regulations

and procedures

a) SNM control

49
b) Internal control

c) Process control

d) Quality control

e) Health and safety

f) Physical security

4) Corporate safeguards policy

b. Details of facility safeguards system

1) Design

2) Modifications since last AEC survey or meeting of

committee

3) Diversion path analyses

a) Abnormal situations considered

b) Ranking and coverage

c) Available variables

d) Indicator chosen

e) Mass, time and space sensitivity of selected

indicator

4) Mass, time and space sensitivity of overall system

c. Abnormal situation logs

1) Log entries

2) Responses

3) Innocent causes

4) Resolutions

5) Frequency of entries

6) Modifications to abnormal situation responses

resulting from analysis of abnormal situation log

entries

d. Allowable elapsed times for specific abnormal situations

e. Assurance information

Results of ad hoc studies

Suggestions and recommendations ^ 4. Diversion path analysis summary reports and workpapers

5. Diversion path analysis up-date information necessitated

by changes in process operations or production-control or physical-security rules, regulations and procedures

6. Assurance reports

7. Records and reports for periodic review by committee

a. Abnormal situation records and reports

b. Current and prior period accounting records and reports

c. MUF records

d. Safeguards system design and modification records

and reports

e. Safeguards activity reports

f. Assurance statement records

g. AEC survey inspection records

h. Rules, regulations and procedures

i. Safeguards policy records

8. New information for committee action or review and/or

follow-up information

a. Abnormal situation information, alerts and intelligence

from any source

® {I:

50
b. Information from process engineer, R&D supervisor,

analytical laboratory supervisor, plant physical

inspector and shipping dock foreman concerning their areas of responsibility

1) Periodic reviews of plant-specific rules, regulations and procedures

2) Safeguards system design and modification suggestions

3) Diversion path analysis information

4) Observations of activities

5) Notification of problems

6) Assurance

c. Periodic reviews of abnormial situation logs, diversion

path and preventive system analyses

d. Inter- and intra-plant S-R

e. MUF evaluations

f. Breach of physical security which poses safeguards

problem

g. Irregular event information

h. Investigations of specific abnormal situations

i. Verification of assurance statements and of correctness

of design and proper functioning of overall plant

safeguards system

j. Results of AEC surveys and follow-ups

Problems having safeguards significance which require

AEC and/or corporate decisions to effect solution

Information for follow-up to Field Office suggestions

or recommendations

Assurance information

plant data processing

Requests for information and data (facility-wide, MBA

or unit process)

a. SNM accounting records

b. Physical and book inventory data

c. Current and prior period MUF data, uncertainty of MUF

and narrative explanations

d. Current and prior period S-R data (inter- and intraplant)

e. Analysis results and reports

1) Analytical surveillance

2) Safeguards exception reports

plant manager

Abnormal situation information, alerts and intelligence

a. Discovery

1) Material missing, misplaced or found on-site

2) Material found outside plant perimeter

a) Illegal possession

b) Cached

3) Covert threat to plant

b. Investigative

1) On-site

a) Plant personnel findings

51
b) FBI findings

2) Off-site

a) Local law enforcement agency findings

b) FBI findings

c. Innocent cause

d. Resolution and/or recovery

Abnormal situation reports

a. If plant safeguards authority is discoverer

1) Date and time of discovery

2) Identification (man- or badge-number) of discoverer

3) Complete statement of pertinent facts

a) Material type

b) Quantity

c) Location

d) Analytical surveillance indicator

e) Diversion path description

f) Initial actions taken

4) Date and time production control manager, physical

security director, plant manager, SS rep and FBI

and/or local law enforcement authorities (through

physical security director) notified by plant

safeguards authority if abnormal situation

unresolved during allowed elapsed time

5) Statement of resolution if abnormal situation

cleared-up using information available to plant

safeguards authority

a) Explanation of innocent cause, or

b) Description of operational error, or

c) Indicator of safeguards system design error

b. If process engineer, R&D supervisor, analytical

laboratory supervisor, vault manager, plant physical

inspector, shipping dock foreman, plant guard

captain, production control manager or physical

security director is discoverer

1) Date and time of notification

2) Identification of notifier

3) Area of facility or perimeter involved

4) Actions taken for abnormal situation verification

5) Date and time production control manager, physical

security director, plant manager, SS rep and FBI

and/or local law enforcement authorities (through

physical security director) notified by plant

safeguards authority if abnormal situation unresolved

during allowed elapsed time

6) Statement of resolution if abnormal situation cleared

up using information available to production control

manager, physical security director nr plant safeguar

authority but not to discoverer

a) Explanation of innocent cause, or

b) Description of operational error, or

c) Indicator of safeguards system design error

52
3. Administrative information

a. Safeguards system design and modification reports

b. Safeguards activity reports

c. Diversion path analysis summary reports

d. Assurance reports

4. Other Information

a. Problems having safeguards significance which require

AEC and/or corporate decision to effect solution

b. Assurance information

M. To plant safeguards authority at another facility

1. S-R information and data (see I.S.I.)

2. Teletype (TTY) confirmation of shipments or receipts

a. This facility shipping (see I.S.2.b.)

b. This facility receiving (see I.S.3.b.)

N. To regional transportation control

1. Teletype (TTY) confirmation of shipments or receipts

a. This facility shipping (see I.S.2.b.)

b. This facility receiving (see I.S.3.b.)

0. To AEC survey inspector

r 1. Details of facility activities relevant to safeguards

J (same as V.J.I.)

1 2. Records and reports associated with safeguards (see

V.J. 7.)

3. Assurance information and records

P. To SS rep

1. Abnormal situation information, alerts and intelligence

(same as V.L.I.)

2. Abnormal situation reports (same as V.L,2.)

3. Copies of Forms AEC 741 and/or AEC 284 for receipts and

Form AEC 741 for shipments

r 4. Safeguards system design and modification reports

< 5. Safeguards activity reports

6. Diversion path analysis summary reports

7. Problems having safeguards significance which require AEC

decision to effect solution

< 8. Follow-up information on Field Office suggestions or rec- ommendations

9. Assurance information

Q. To NMIS

1. Forms AEC 741 and AEC 284 information on receipts and

shipments (if facility has direct input)

2. S-R information

3. COEI information

53
Figure 7 SIS Information Flows Associated with

PLANT SAFEGUARDS AUTHORITY

54
PLANT SAFEGUARDS AUTHORITY

(ANOTHER FACILITY) <b > PHYSICAL SECURITY DIRECTOR X

<c > PRODUCTION CONTROL MANAGER

Cd > PROCESS ENGINEER X

< e >R&D SUPERVISOR

REQUESTS FOR INFORMATION, AND

DECISIONS AND RECOMMENDATIONS

< B >"<

, J ANALYTICAL LABORATORY \/ •^SUPERVISOR PLANT GUARD CAPTAIN

/V PROCESS FOREMAN <,g> SHIPPING DOCK FOREMAN

> ^

MBA SNM CUSTODIAN RM) SNM CUSTODIAN

yv LABORATORY SNM CUSTODIAN <h>PLANT PHYSICAL INSPECTOR ^ VAULT MANAGER

SHIPPING DOCK CLERK

PROCESS OPERATOR R&D TECHNOLOGIST

LABORATORY CHEMIST

PLANT GUARD

REQUESTS FOR ASSURANCE INFORMATION,

(T9)a£C AND CORPORATE SAFEGUARDS POLICY, AND RESULTS OF AEC SURVEY INSPECTIONS I^S-R INFORMATION AND DATA, AND NOTIFI- ACTION OF SHIPMENTS AND RECEIPTS

AEC SAFEGUARDS POLICY, R6.D RESULTS, @ REQUESTS FOR SAMPLES AND INFORMATION, AND EXIT INTERVIEW INFORMATION REQUESTS FOR SAFEGUARDS AND FOLLOW- -UP INFORMATION, R&D AND LABORATORY

RESULTS. AND AEC SAFEGUARDS POLICY ^S-R INFORMATION AND DATA

DIVERSION PA'I'M ANALYSIS SUMMARY

REPOR TS AND WOH Kt^Al'i:RS , ASSURANCE

REPORTS, AND RECORDS AND REPORTS

FOR PERIODIC REVIEW

(43) REQUESTS FOR INFORMATION AND DATA ABNORMAL SITUATION INFORMATION, ALERTS AND INTELLIGENCE

REQUESTED INFORMATION AND DATA, RESULTS OF STUDIES, SUGGESTIONS AND

RECOMMENDATIONS, PROBLEMS, AND NEW, FOLLOW-UP AND ASSURANCE INFORMATION

(5^ DIVERSION PATH ANALYSIS SUMMARY

(52) REPORTS, AND SAFEGUARDS DESIGN AND ACTIVITY REPORTS NOTIFICATION OF PROBLEMS, FOLLOW-UP AND ASSURANCE INFORMATION

ABNORMAL SITUATION REPORTS ADMINISTRATIVE INFORMATION NOTIFICATION OF PROBLEMS AND ASSURANCE INFORMATION .TELETYPE (TTY) CONFIRMATION OF

' SHIPMENT DESCRIPTION OF FACILITY SAFEGUARDS ACTIVITIES AND SYSTEM, AND ABNORMAL SITUATION RECORDS ASSURANCE INFORMATION AND RECORDS MATERIAL TRANSACTION DATA

^ 2 w

' PLANT ^ PHYSICAL

.INSPECTOR, ^

> I <

-ftNALYTICAt LABORATORY > ' < ^UPERVISO!^' SUPERVISOR

SHIPPING

DOCK FOREMAN , > I PROCESS

PLANT GUARD

CAPTAIN

-» _ J

ABNORMAL SITUATION INFORMATION, DIVERSION PATH ANALYSES, SOLUTIONS TO PROBLEMS, PLANT SAFEGUARDS

COMMITTEE DECISIONS AND SAFEGUARDS POLICY (32) REQUESTS FOR SFECLAL R&D, ABNORMAL SITUATION INFORMATION, DIVERSION PATH ANALYSES, SOLUTIONS TO PROBLEMS, PLANT SAFEGUARDS COMMITTEE DECISIONS AND SAFEGUARDS POLICY (33)

REQUESTS FOR INFORMATION AND DATA, ABNORMAL SITUATION INFORMATION, DIVERSION PATH ANALYSES, SOLUTIONS TO PROBLEMS, PLANT SAFEGUARDS COMMITTEE DECISIONS AND SAFEGUARDS POLICY (tS)

Figure 7a SIS Information Flows Associated with

PLANT SAFEGUARDS AUTHORITY

55
REFERENCES

[1] Murphey, William M. , Schleter, John C. and Maltese, Marcia D. K

Framework of the Safeguards Information System (SIS) , (draft in

preparation)

.

[2] Murphey, William M. and Schleter, John C. , Practicality of

Diversion Path Analysis , NBS IR 74-524, July 1974.

56
NBS-114A (REV. 7-73)

U.S. DEPT. OF COMM.

BIBLIOGRAPHIC DATA

SHEET NBSIR 74-592

2* Ciov't Accession

No.

3. Rcc ipient '.s Acces.sion No.

4, TI I L h AND sU ti 1 1 1 Lr, Safeguards Information System Flows Associated

With The Plant Safeguards Authority

5. Publication Date November 1974

6. Performing Or ganization ( - od '.^

7. AUTHOR(S)

John C. Schleter

8. Performing Organ. Report No. NBSIR 74-592

9. PhRFORMING ORGANIaAIION NAMe. AND AUUKhaii

NATIONAL BUREAU OF STANDARDS

DEPARTMENT OF COMMERCE

WASHINGTON, D.C. 20234

10. Pro|Cct/Ta,sk/Work Unit No. 4314429

11. Contract /Qjaot No. AT (49-2) - 1165

12. Sponsoring Organization Name and Complete Address (Street, City, St3te, ^IP)

Division of Safeguards and Security

Atomic Energy Commission

Washington, D. C. 20545

13. Type of Report & Period Covered

Interim

14. Sponsoring Agency Code

15. SUPPLEMENTARY NOTES

16. ABSTRAC~T (A 200-word or less factual summary of most si^ificant information. If document includes a significant

bibliography or literature survey, mention it here.)

Increasing use of nuclear material imposes additional emphasis on safeguards.

The Technical Analysis Division, NBS, has been assisting the AEC in performing

systems studies directed to safeguards for nuclear materials. A Safeguards

Information System (SIS) is being developed so as to provide the information

and decision structure needed for assurance that significant diversion to

unauthorized use has not occurred in the past and, further, that any significant

diversion which might in future occur will be detected in a timely manner. Although a comprehensive report is in preparation, a preview is considered useful at this time in order to familiarize plant personnel, charged with

development of plant safeguards information systems, with aspects of SIS. This

report thus reflects material from the forthcoming report and directs attention

to the information flows related to the key safeguards decision maker within

the plant - the plant safeguards authority. Terms and concepts are defined and

their application is illustrated in the general case by highlighting decision

responsibilities and details of the safeguards information flows associated

with him.

17. KEY WORDS (six to twelve entries; alphabetical order; capitalize only the first letter of the first key word unless a proper name; separated by semicolons

)

Nuclear materials information systems; Nuclear materials safeguards; Safeguards

18. AVAILABILITY Unlimited 19. SECURITY CLASS

(THIS REPORT)

21. NO. OF PAGES

1_X^ For Official Distribution. Do Not Release to NTIS

AEC will effect distribution UNCL ASSIFIED

56

1

^ Order From Sup. of Doc, U.S. Government Printing Office Washineton, D.C. 20402. SD Cat. No. C13

20. SECURITY CLASS

(THIS PAGE)

22. Price

1 ; Order From National Technical Information Service (NTIS)

Springfield, Virginia 22151 UNCLASSIFIED

USCOMM-DC 29042-P74