Engineering Papers⌕ Search

Engineering topics

Powell, Danny H

Publications and source records attributed to Powell, Danny H.

11 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2011

Insider Threat - Material Control and Accountability Mitigation

The technical objectives of nuclear safeguards are (1) the timely detection of diversion of significant quantities of nuclear material from peaceful uses to the manufacture of nuclear weapons or other nuclear explosive devices or for purposes unknown and (2) the deterrence of such diversion by the risk of early detection. The safeguards and security program must address both outsider threats and insider threats. Outsider threats are primarily addressed by the physical protection system. Insider threats can be any level of personnel at the site including passive or active insiders that could attempt protracted or abrupt diversion. This could occur by an individual acting alone or by collusion between an individual with material control and accountability (MC&A) responsibilities and another individual who has responsibility or control within both the physical protection and the MC&A systems. The insider threat is one that must be understood and incorporated into the safeguards posture. There have been more than 18 documented cases of theft or loss of plutonium or highly enriched uranium. The insider has access, authority, and knowledge, as well as a set of attributes, that make him/her difficult to detect. An integrated safeguards program is designed as a defense-in-depth system that seeks to prevent the unauthorized removal of nuclear material, to provide early detection of any unauthorized attempt to remove nuclear material, and to rapidly respond to any attempted removal of nuclear material. The program is also designed to support protection against sabotage, espionage, unauthorized access, compromise, and other hostile acts that may cause unacceptable adverse impacts on national security, program continuity, the health and safety of employees, the public, or the environment. Nuclear MC&A play an essential role in the capabilities of an integrated safeguards system to deter and detect theft or diversion of nuclear material. An integrated safeguards system with compensating mitigation can decrease the risk of an insider performing a malicious act without detection.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2011

Insider Threat - Material Control and Accountability Mitigation (Presentation)

Why is the insider a concern? There are many documented cases of nuclear material available for sale - there are more insider diversions than outsider attacks and more than 18 documented cases of theft or loss of plutonium or highly enriched uranium. Insider attributes are: have access, has authority, possesses knowledge, works with absence of timeline, can test system, and may act alone or support a team. Material control and accountability (MC&A) is an essential part of an integrated safeguards system. Objectives of MC&A are: (1) Ongoing confirmation of the presence of special nuclear material (SNM) in assigned locations; (2) Prompt investigation of anomalies that may indicate a loss of SNM; (3) Timely and localized detection of loss, diversion, or theft of a goal quantity; (4) Rapid assessment and response to detection alarms; and (5) Timely generation of information to aid in the recovery of SNM in the event of an actual loss, diversion, or theft from the purview of the MC&A system. Control and accountability of material, equipment, and data are essential to minimizing insider threats.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗
DOE OSTI2011

MC&A System Effectiveness Tool (MSET) (Presentation 2)

MSET is a self-assessment or inspection tool utilizing probabilistic risk assessment (PRA) methodology to calculate the system effectiveness of a nuclear facility's material control and accountability (MC&A) system. MSET analyzes the effectiveness of an MC&A system based on defined performance metrics for MC&A functions defined based on U.S. and international best practices and regulations. MSET analysis is based on performance of the entire MC&A system including defense-in-depth attributes and sensitivity analysis of changes in the system, both positive and negative. MSET analysis considers: accounting; containment; access control; surveillance capabilities of the system; and other interfaces with the physical protection systems that provide detection of an unauthorized action. MSET performs a system effectiveness calculation evaluation against a defined performance metric. MSET uses PRA techniques to analyze the MC&A system. MSET is a tool for evaluating the system effectiveness of MC&A systems during self-assessment or external inspection. MSET has been developed, tested, and benchmarked by the U.S. DOE. In collaboration with the U.S. DOE, Rosatom is developing a Russian version (MSET-R) planned for pilot implementation at select material balance areas in 2011. MSET has been shown to be an effective training and communication tool for MC&A.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2011

The MPC&A Questionnaire

The questionnaire is the instrument used for recording performance data on the nuclear material protection, control, and accountability (MPC&A) system at a nuclear facility. The performance information provides a basis for evaluating the effectiveness of the MPC&A system. The goal for the questionnaire is to provide an accurate representation of the performance of the MPC&A system as it currently exists in the facility. Performance grades for all basic MPC&A functions should realistically reflect the actual level of performance at the time the survey is conducted. The questionnaire was developed after testing and benchmarking the material control and accountability (MC&A) system effectiveness tool (MSET) in the United States. The benchmarking exercise at the Idaho National Laboratory (INL) proved extremely valuable for improving the content and quality of the early versions of the questionnaire. Members of the INL benchmark team identified many areas of the questionnaire where questions should be clarified and areas where additional questions should be incorporated. The questionnaire addresses all elements of the MC&A system. Specific parts pertain to the foundation for the facility's overall MPC&A system, and other parts pertain to the specific functions of the operational MPC&A system. The questionnaire includes performance metrics for each of the basic functions or tasks performed in the operational MPC&A system. All of those basic functions or tasks are represented as basic events in the MPC&A fault tree. Performance metrics are to be used during completion of the questionnaire to report what is actually being done in relation to what should be done in the performance of MPC&A functions.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗
DOE OSTI2011

Conversion of Questionnaire Data

During the survey, respondents are asked to provide qualitative answers (well, adequate, needs improvement) on how well material control and accountability (MC&A) functions are being performed. These responses can be used to develop failure probabilities for basic events performed during routine operation of the MC&A systems. The failure frequencies for individual events may be used to estimate total system effectiveness using a fault tree in a probabilistic risk analysis (PRA). Numeric risk values are required for the PRA fault tree calculations that are performed to evaluate system effectiveness. So, the performance ratings in the questionnaire must be converted to relative risk values for all of the basic MC&A tasks performed in the facility. If a specific material protection, control, and accountability (MPC&A) task is being performed at the 'perfect' level, the task is considered to have a near zero risk of failure. If the task is performed at a less than perfect level, the deficiency in performance represents some risk of failure for the event. As the degree of deficiency in performance increases, the risk of failure increases. If a task that should be performed is not being performed, that task is in a state of failure. The failure probabilities of all basic events contribute to the total system risk. Conversion of questionnaire MPC&A system performance data to numeric values is a separate function from the process of completing the questionnaire. When specific questions in the questionnaire are answered, the focus is on correctly assessing and reporting, in an adjectival manner, the actual performance of the related MC&A function. Prior to conversion, consideration should not be given to the numeric value that will be assigned during the conversion process. In the conversion process, adjectival responses to questions on system performance are quantified based on a log normal scale typically used in human error analysis (see A.D. Swain and H.E. Guttmann, 'Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications,' NUREG/CR-1278). This conversion produces the basic event risk of failure values required for the fault tree calculations. The fault tree is a deductive logic structure that corresponds to the operational nuclear MC&A system at a nuclear facility. The conventional Delphi process is a time-honored approach commonly used in the risk assessment field to extract numerical values for the failure rates of actions or activities when statistically significant data is absent.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2011

Data Analysis

Analysis of the material protection, control, and accountability (MPC&A) system is necessary to understand the limits and vulnerabilities of the system to internal threats. A self-appraisal helps the facility be prepared to respond to internal threats and reduce the risk of theft or diversion of nuclear material. The material control and accountability (MC&A) system effectiveness tool (MSET) fault tree was developed to depict the failure of the MPC&A system as a result of poor practices and random failures in the MC&A system. It can also be employed as a basis for assessing deliberate threats against a facility. MSET uses fault tree analysis, which is a top-down approach to examining system failure. The analysis starts with identifying a potential undesirable event called a 'top event' and then determining the ways it can occur (e.g., 'Fail To Maintain Nuclear Materials Under The Purview Of The MC&A System'). The analysis proceeds by determining how the top event can be caused by individual or combined lower level faults or failures. These faults, which are the causes of the top event, are 'connected' through logic gates. The MSET model uses AND-gates and OR-gates and propagates the effect of event failure using Boolean algebra. To enable the fault tree analysis calculations, the basic events in the fault tree are populated with probability risk values derived by conversion of questionnaire data to numeric values. The basic events are treated as independent variables. This assumption affects the Boolean algebraic calculations used to calculate results. All the necessary calculations are built into the fault tree codes, but it is often useful to estimate the probabilities manually as a check on code functioning. The probability of failure of a given basic event is the probability that the basic event primary question fails to meet the performance metric for that question. The failure probability is related to how well the facility performs the task identified in that basic event over time (not just one performance or exercise). Fault tree calculations provide a failure probability for the top event in the fault tree. The basic fault tree calculations establish a baseline relative risk value for the system. This probability depicts relative risk, not absolute risk. Subsequent calculations are made to evaluate the change in relative risk that would occur if system performance is improved or degraded. During the development effort of MSET, the fault tree analysis program used was SAPHIRE. SAPHIRE is an acronym for 'Systems Analysis Programs for Hands-on Integrated Reliability Evaluations.' Version 1 of the SAPHIRE code was sponsored by the Nuclear Regulatory Commission in 1987 as an innovative way to draw, edit, and analyze graphical fault trees primarily for safe operation of nuclear power reactors. When the fault tree calculations are performed, the fault tree analysis program will produce several reports that can be used to analyze the MPC&A system. SAPHIRE produces reports showing risk importance factors for all basic events in the operational MC&A system. The risk importance information is used to examine the potential impacts when performance of certain basic events increases or decreases. The initial results produced by the SAPHIRE program are considered relative risk values. None of the results can be interpreted as absolute risk values since the basic event probability values represent estimates of risk associated with the performance of MPC&A tasks throughout the material balance area (MBA). The RRR for a basic event represents the decrease in total system risk that would result from improvement of that one event to a perfect performance level. Improvement of the basic event with the greatest RRR value produces a greater decrease in total system risk than improvement of any other basic event. Basic events with the greatest potential for system risk reduction are assigned performance improvement values, and new fault tree calculations show the improvement in total system risk. The operational impact or cost-effectiveness from implementing the performance improvements can then be evaluated. The improvements being evaluated can be system performance improvements, or they can be potential, or actual, upgrades to the system. The RIR for a basic event represents the increase in total system risk that would result from failure of that one event. Failure of the basic event with the greatest RIR value produces a greater increase in total system risk than failure of any other basic event. Basic events with the greatest potential for system risk increase are assigned failure performance values, and new fault tree calculations show the increase in total system risk. This evaluation shows the importance of preventing performance degradation of the basic events. SAPHIRE identifies combinations of basic events where concurrent failure of the events results in failure of the top event.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2011

System Effectiveness

An effective risk assessment system is needed to address the threat posed by an active or passive insider who, acting alone or in collusion, could attempt diversion or theft of nuclear material. It is critical that a nuclear facility conduct a thorough self-assessment of the material protection, control, and accountability (MPC&A) system to evaluate system effectiveness. Self-assessment involves vulnerability analysis and performance testing of the MPC&A system. The process should lead to confirmation that mitigating features of the system effectively minimize the threat, or it could lead to the conclusion that system improvements or upgrades are necessary to achieve acceptable protection against the threat. Analysis of the MPC&A system is necessary to understand the limits and vulnerabilities of the system to internal threats. Self-assessment helps the facility be prepared to respond to internal threats and reduce the risk of theft or diversion of nuclear material. MSET is a self-assessment or inspection tool utilizing probabilistic risk assessment (PRA) methodology to calculate the system effectiveness of a nuclear facility's MPC&A system. MSET analyzes the effectiveness of an MPC&A system based on defined performance metrics for MPC&A functions based on U.S. and international best practices and regulations. A facility's MC&A system can be evaluated at a point in time and reevaluated after upgrades are implemented or after other system changes occur. The total system or specific subareas within the system can be evaluated. Areas of potential performance improvement or system upgrade can be assessed to determine where the most beneficial and cost-effective improvements should be made. Analyses of risk importance factors show that sustainability is essential for optimal performance. The analyses reveal where performance degradation has the greatest detrimental impact on total system risk and where performance improvements have the greatest reduction in system risk. The risk importance factors show the amount of risk reduction achievable with potential upgrades and the amount of risk reduction actually achieved after upgrades are completed. Applying the risk assessment tool gives support to budget prioritization by showing where budget support levels must be sustained for MC&A functions most important to risk. Results of the risk assessment are also useful in supporting funding justifications for system improvements that significantly reduce system risk.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2011

Summary

An effective risk assessment system is needed to address the threat posed by an active or passive insider who, acting alone or in collusion, could attempt diversion or theft of nuclear material. The material control and accountability (MC&A) system effectiveness tool (MSET) is a self-assessment or inspection tool utilizing probabilistic risk assessment (PRA) methodology to calculate the system effectiveness of a nuclear facility's material protection, control, and accountability (MPC&A) system. The MSET process is divided into four distinct and separate parts: (1) Completion of the questionnaire that assembles information about the operations of every aspect of the MPC&A system; (2) Conversion of questionnaire data into numeric values associated with risk; (3) Analysis of the numeric data utilizing the MPC&A fault tree and the SAPHIRE computer software; and (4) Self-assessment using the MSET reports to perform the effectiveness evaluation of the facility's MPC&A system. The process should lead to confirmation that mitigating features of the system effectively minimize the threat, or it could lead to the conclusion that system improvements or upgrades are necessary to achieve acceptable protection against the threat. If the need for system improvements or upgrades is indicated when the system is analyzed, MSET provides the capability to evaluate potential or actual system improvements or upgrades. A facility's MC&A system can be evaluated at a point in time. The system can be reevaluated after upgrades are implemented or after other system changes occur. The total system or specific subareas within the system can be evaluated. Areas of potential system improvement can be assessed to determine where the most beneficial and cost-effective improvements should be made. Analyses of risk importance factors show that sustainability is essential for optimal performance and reveals where performance degradation has the greatest impact on total system risk. The risk importance factors show the amount of risk reduction achievable with potential upgrades and the amount of risk reduction achieved after upgrades are completed. Applying the risk assessment tool gives support to budget prioritization by showing where budget support levels must be sustained for MC&A functions most important to risk. Results of the risk assessment are also useful in supporting funding justifications for system improvements that significantly reduce system risk. The functional model, the system risk assessment tool, and the facility evaluation questionnaire are valuable educational tools for MPC&A personnel. These educational tools provide a framework for ongoing dialogue between organizations regarding the design, development, implementation, operation, assessment, and sustainability of MPC&A systems. An organization considering the use of MSET as an analytical tool for evaluating the effectiveness of its MPC&A system will benefit from conducting a complete MSET exercise at an existing nuclear facility.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2011

US-Russian Cooperation in Upgrading MC&A System at Rosatom Facilities: Measurement of Nuclear Materials

Improve protection of weapons-usable nuclear material from theft or diversion through the development and support of a nationwide sustainable and effective Material Control and Accountability (MC&A) program based on material measurement. The material protection, control, and accountability (MPC&A) cooperation has yielded significant results in implementing MC&A measurements at Russian nuclear facilities: (1) Establishment of MEM WG and MEMS SP; (2) Infrastructure for development, certification, and distribution of RMs; and (3) Coordination on development and implementation of MMs.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗
DOE OSTI2011

Nuclear Material Control and Accountability System Effectiveness Tool (MSET)

A nuclear material control and accountability (MC&A) system effectiveness tool (MSET) has been developed in the United States for use in evaluating material protection, control, and accountability (MPC&A) systems in nuclear facilities. The project was commissioned by the National Nuclear Security Administration's Office of International Material Protection and Cooperation. MSET was developed by personnel with experience spanning more than six decades in both the U.S. and international nuclear programs and with experience in probabilistic risk assessment (PRA) in the nuclear power industry. MSET offers significant potential benefits for improving nuclear safeguards and security in any nation with a nuclear program. MSET provides a design basis for developing an MC&A system at a nuclear facility that functions to protect against insider theft or diversion of nuclear materials. MSET analyzes the system and identifies several risk importance factors that show where sustainability is essential for optimal performance and where performance degradation has the greatest impact on total system risk. MSET contains five major components: (1) A functional model that shows how to design, build, implement, and operate a robust nuclear MC&A system (2) A fault tree of the operating MC&A system that adapts PRA methodology to analyze system effectiveness and give a relative risk of failure assessment of the system (3) A questionnaire used to document the facility's current MPC&A system (provides data to evaluate the quality of the system and the level of performance of each basic task performed throughout the material balance area [MBA]) (4) A formal process of applying expert judgment to convert the facility questionnaire data into numeric values representing the performance level of each basic event for use in the fault tree risk assessment calculations (5) PRA software that performs the fault tree risk assessment calculations and produces risk importance factor reports on the facility's MC&A (software widely used in the aerospace, chemical, and nuclear power industries) MSET was peer reviewed in 2007 and validated in 2008 by benchmark testing at the Idaho National Laboratory in the United States. The MSET documents were translated into Russian and provided to Rosatom in July of 2008, and MSET is currently being evaluated for potential application in Russian Nuclear Facilities.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗