DOE-STD-1194-2019, Nuclear Materials Control and Accountability

NOT MEASUREMENT SENSITIVE DOE-STD-1194-2019 SEPTEMBER 2019 ──────────────── DOE STANDARD NUCLEAR MATERIALS CONTROL AND ACCOUNTABILITY U.S. Department of Energy AREA SANS Washington, D.C. 20585 DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. DOE-STD-1194-2019 i This page is intentionally left blank. DOE-STD-1194-2019 ii TABLE OF CONTENTS FOREWORD ...................................................................................................................................................... iii 1 . SCOPE ...............................................................................................................................................................1 2. PURPOSE ...........................................................................................................................................................1 3. APPLICABILITY ...............................................................................................................................................1 4. REFERENCES ...................................................................................................................................................1 5. ACRONYMS AND DEFINITIONS ...................................................................................................................4 6. SPECIFICATIONS .............................................................................................................................................7 6.1 Program Management .................................................................................................................................7 6.1.1 Program Management Objectives ..........................................................................................................7 6.1.2 Material Control and Accountability Organization and Resources .......................................................7 6.1.3 Material Control and Accountability Plan ..............................................................................................8 6.1.4 Personnel Training and Qualification .....................................................................................................9 6.1.5 Change Control .....................................................................................................................................11 6.1.6 Incident Investigation and Reporting ..................................................................................................12 6.1.7 Performance Testing .............................................................................................................................12 6.1.8 Material Control and Accountability Assessments .............................................................................16

6.2 Material Control .........................................................................................................................................19 6.2.1 Nuclear Material Categorization ..........................................................................................................19 6.2.2 Graded Nuclear Material Control .........................................................................................................27 6.2.3 Access Controls ....................................................................................................................................28 6.2.4 Material Surveillance ...........................................................................................................................29 6.2.5 Deactivation and Decommissioning .....................................................................................................38 6.2.6 Termination of Safeguards ..................................................................................................................39 6.2.7 Returning Materials to the Active Inventory .......................................................................................40 6.2.8 Overview of Process to Terminate Safeguards on Nuclear Material 41 6.3 Measurements ............................................................................................................................................45 6.3.1 Types of Measurements ........................................................................................................................45 6.3.2 Measurement Methods and Procedures ................................................................................................46 6.3.3 Selection and Qualification of Measurement Methods ........................................................................48 6.3.4 Measurement Control Program ............................................................................................................49 6.3.5 Calibration and Standards .....................................................................................................................52 6.3.6 Control Limits ......................................................................................................................................53 6.4 Accounting .................................................................................................................................................58 6.4.1 General Accounting Practices ..............................................................................................................58 6.4.2 Account Structure .................................................................................................................................59 6.4.3 Accounting Systems .............................................................................................................................60 6.4.4 Accounting Data and Records ..............................................................................................................61 6.4.5 Accounting Reports ..............................................................................................................................63

6.5 Physical Inventory .....................................................................................................................................67 6.5.1 General Inventory Procedures ..............................................................................................................67 6.5.2 Scheduling and Planning Inventories ...................................................................................................69 6.5.3 Automated Physical Inventories ...........................................................................................................69 6.5.4 Inventory of Unmeasured, Poorly-Measured, Irradiated, and Inaccessible Materials .........................70 6.5.5 Evaluating Inventory Programs ............................................................................................................71 6.5.6 Inventory Reconciliation ......................................................................................................................71 6.5.7 Special (Emergency) Inventories ........................................................................................................72 DOE-STD-1194-2019 ii APPENDICES ........................................................................................................................................................... Appendix A: Suggested MC&A Plan Format ...................................................................................... A-1 Appendix B: Graded Safeguards Table ..................................................................................................B-1 Appendix C: Special Nuclear Materials ................................................................................................C-1 Appendix D: Other Accountable Nuclear Materials ............................................................................ D-1 CONCLUDING MATERIAL ...............................................................................................................................79 DOE-STD-1194-2019 iii FOREWORD This Department of Energy Standard is for use by all DOE elements. Beneficial comments (recommendations, additions, and deletions) and any pertinent data that may improve this document should be mailed to the U.S. Department of Energy; Office of Environment, Health, Safety, and Security; Office of Security Policy, GTN/AU- 51; 1000 Independence Ave., SW; Washington, DC 20585-1290. DOE Technical Standards do not establish requirements. However, all or part of the provisions in this Standard can become requirements under the following circumstances: (1) They are explicitly stated to be requirements in a DOE requirements document (e.g., a purchase requisition); (2) The organization makes a commitment to meet a Standard in a contract, implementation plan, or program plan; or (3) When incorporated into a contract. Throughout this Standard, the words “must” or “shall” are used to denote actions that must be performed if the objectives of this Standard are to be met. If the provisions in this Standard are made requirements through one of the three ways discussed above, then the “shall” statements would become requirements. Goals or intended functionality are indicated by “will,” “may,” or “should.” It is not appropriate to consider that “should” statements would automatically be converted to “shall” statements as this action would violate the consensus process used to approve this standard.

This Standard was prepared following requirements for due process, consensus, and approval as required by the U.S. Department of Energy Standards Program. Consensus is established when substantial agreement has been reached by all members of the writing team and the Standard has been approved through the DOE directives approval process (REVCOM). Substantial agreement means much more than a simple majority, but not necessarily unanimity. Consensus requires that all views and objections be considered, and that a concerted effort be made toward their resolution. DOE-STD-1194-2019 5 NUCLEAR MATERIAL CONTROL AND ACCOUNTABILITY 1. SCOPE This document describes establishing and maintaining a Material Control and Accountability (MC&A) program, where each MC&A program element is a part of a quality MC&A program. Each site/facility operator needs to establish a sustainable, effective graded safeguards program for the control and accounting of nuclear materials to detect and deter theft and diversion, and to prevent the unauthorized control of a weapon, test device, or materials that can be used to make an improvised nuclear device. The MC&A program implements a defense-in-depth system to ensure that all accountable nuclear materials are in their authorized location and being used for their intended purposes such that single component failures will not result in significant vulnerabilities. An effective and efficient MC&A program is based on the strategic and monetary value of the nuclear material. Under the current MC&A DOE Order 474.2, Nuclear Material Control and Accountability, site/facility operators have many alternatives with regard to how their MC&A program is designed, managed, and operated. This technical standard is one methodology that can be used to achieve the desired compliance. The Technical Standard provides an acceptable MC&A approach commonly or typically used throughout the DOE and NRC. In the final analysis, DOE line management reviewer must make a judgment as to whether the site/facility operator can achieve, with high probability, the objectives stated in DOE O 474.2. 2. PURPOSE The purpose of this technical standard is to provide site/facility operators with an accepted compliance-based means that is acceptable in meeting DOE metrics for MC&A policy requirement objectives. This is not intended to expand on the DOE O 474.2. 3. APPLICABILITY This Technical Standard can be used by all site/facility operators with accountable nuclear materials and in so doing, will meet all requirements in DOE O 474.2. It also provides MC&A assessment guidance that can be used by DOE and NNSA to evaluate the adequacy of MC&A programs and MC&A Plans. 4. REFERENCES a. DOE O 200.1A Chg 1 (MinChg), Information Technology Management, dated 1- 13-17 b. DOE O 205.1B Chg 3 (PgChg), Department of Energy Cyber Security Program, dated 9-21-14 c. DOE O 243.1B Chg 1 (Admin Chg), Records Management Program, dated 7-8-13 DOE-STD-1194-2019 6 d. DOE O 251.1D, Departmental Directives Program, dated 1-17-17 e. DOE O 413.3B Chg 5 (MinChg), Program and Project Management for the Acquisition of Capital Assets, dated 4-12-18 and series of 20 Guides dated 11-07 thru 8-30-19 f. DOE O 430.1C, Real Property Asset Management, dated 8-19-16 g. DOE O 470.3C, Design Basis Threat (DBT) Order, dated 1123-16 h. DOE O 470.4B Chg 2 (MinChg), Safeguards and Security Program, dated 1-17-17 i. DOE O 473.3A Chg 1 (MinChg), Protection Program Operations, dated 1-2-18

j. DOE O 471.6 Chg 2 (Admin Chg), Information Security, dated 5-15-15 k. DOE O 472.2 Chg 1 (PgChg), Personnel Security, dated 7-9-18 l. DOE O 474.2 Chg 4 (PgChg), Nuclear Material Control and Accountability, dated 9-13-16 m. DOE O 422.1 Chg 2 (Admin Chg), Conduct of Operations, dated 12-3-14 n. DOE Administrative Records Schedule 18: Security, Emergency Planning, and Safety Records, Rev.1, dated 6- 07 o. International Target Values 2010 for Measurement Uncertainties in Safeguarding Nuclear Materials, IAEA Report STR-368, published November 2010 p. C.W. Coates, B.L. Broadhead, A.M. Krichinsky, R.W. Leggett, M.B. Emmett, J.B. Hines, Radiation Effects on Personnel Performance Capability and a Summary of Dose Levels for Spent Research Reactor Fuels, ORNL/TM-2005/261, Oak Ridge National Laboratory (December 2005) q. ASTM C 1215-18. Standard Guide for Preparing and Integrating Precision and Bias Statements in Test Methods Standards Used in the Nuclear Industry r. Nuclear Materials Management and Safeguards System (NMMSS) User Guide-Rev. 2.1 via web link Go to https://www.energy.gov/nnsa/nuclear- materials-management-and-safeguards-system-nmmss, Reporting requirements and resources), dated April 2017 s. Guide to the Expression of Uncertainty in Measurement, Joint Committee for Guides in Metrology, (GUM 1995 with minor corrections) published, September 2008 https://www.directives.doe.gov/directives-documents/400-series/0470.3-BOrder-c https://www.energy.gov/nnsa/nuclear-materials-management-and-safeguards-system-nmmss,%20Reporting%20requirements%20and%20resources),%20dated%20April%202017 https://www.energy.gov/nnsa/nuclear-materials-management-and-safeguards-system-nmmss,%20Reporting%20requirements%20and%20resources),%20dated%20April%202017 https://www.energy.gov/nnsa/nuclear-materials-management-and-safeguards-system-nmmss,%20Reporting%20requirements%20and%20resources),%20dated%20April%202017 DOE-STD-1194-2019 7 t. References commonly used in the Safeguards and Security Program are located on the Policy Information Resource website http://pir.doe.gov 5. ACRONYMS AND DEFINITIONS ACRONYMS: BI Beginning Inventory CFO Cognizant Field Office DAC Daily Administrative Check DoD The U.S. Department of Defense DOE The U.S. Department of Energy EI Ending Inventory IAEA International Atomic Energy Agency LA Limited Area LANMAS Local Area Nuclear Material Accountability Software LEID Limit of Error for Inventory Difference MAA Material Access Area MBA Material Balance Area MBR Material Balance Report MC&A Material Control and Accountability NBL New Brunswick Laboratory Program Office NDA Nondestructive Assay NIST National Institute of Standards and Technology NMMSS Nuclear Materials Management and Safeguards System NNSA National Nuclear Security Administration NOL Normal Operating Losses NRC Nuclear Regulatory Commission NTC National Training Center ONMI Office of Nuclear Materials Integration PA Protected Area PPA Property Protection Area PVD Programmatic Value Determination REVCOM Review and Comment, for the U.S. Department of Energy Directives System RFID Radiofrequency Identification RIS Reporting Identification Symbol SAMS Safeguards Management Software SNM Special Nuclear Material TID Tamper-Indicating Device ToS Termination of Safeguards VA Vulnerability Assessment http://pir.doe.gov/ DOE-STD-1194-2019 8 DEFINITIONS: Accountable Nuclear Material is all material regulated by DOE O 474.2

Active inventory is the sum of additions to inventory, beginning inventory, ending inventory, and removals from inventory, after all common terms have been excluded. Common terms are any material values, which appear in the active inventory calculation more than once and come from the same measurement. Beginning inventory (BI) is the book inventory quantity at the beginning of an inventory period. Confirmation Measurement is a qualitative or quantitative measurement made to verify the integrity of an item by testing whether some attribute or characteristic of the nuclear material in the item is consistent with the expected attribute or characteristic of the material. The measurement method used for confirmatory measurements must be capable of determining the presence of a specific attribute of the material, consistent with valid acceptance, and rejection criteria. Critical System Element is a component or subcomponent of a safeguards and security protection system that directly affects the ability of the system to perform a required function. Critical components may be equipment, procedures, or personnel. Highly Irradiated is material sufficiently radioactive to ensure a high probability of failure of task(s) by an adversary. The determination of high probability of failure of task(s) must be coordinated with the sites risk assessment and/or other assessments performed by the site. Inventory difference (ID) is the arithmetic difference obtained by subtracting the quantity of SNM tabulated from a physical inventory from the book inventory quantity. Book inventory quantity is equivalent to the beginning inventory (BI), plus additions to inventory (A) minus removals from inventory (R), while the physical inventory quantity is the ending inventory (EI) for the material balance period in question (as physically determined). Thus mathematically, ID = (BI + A-R) -EI or ID = BI + A-R-EI. ID is sometimes also referred to as material unaccounted for in the international community. Key Measurement Point is a location where nuclear material appears in such a form that it may be measured to determine material flow or inventory. This includes, but is not limited to, 1) inputs and outputs for material balances areas, 2) measured discards, 3) process sampling locations, and 4) locations where holdup can be quantified. Material Balance is a calculation evaluating the physical inventory of nuclear material actually present in an area using beginning and ending inventories after considering transfers of nuclear material into and out of the material balance area. DOE-STD-1194-2019 9 Material Balance Area (MBA) is an area that is both a subsidiary account of materials at a facility and a single geographical area that has defined boundaries and is an integral operation. It is used to identify the location and quantity of nuclear materials in the facility. Physical inventory is the determination on a measured basis of the quantity of special nuclear material on hand at a given time. The methods of physical inventory and associated measurements will vary depending on the material to be inventoried and the process involved. Random Error is the statistical fluctuation from the mean observed in measured data. This fluctuation may be positive or negative and can stem from limitations in the precision of the measurement device, user behavior, and the statistical nature of radioactive decay.

Reportable Quantity is the amount of accountable nuclear material for which changes in quantity, form, composition, location, or program code must be reported to the National Nuclear Materials Management and Safeguards System (NMMSS), as required by DOE O 474.2. Systematic Error is a unidirectional error that affects all members of a data set. This error is a deviation of the expected value of a random variable from a corresponding correct value. The terms "bias" and "systematic error" are often interchanged. However, any determined bias (i.e., a bias estimated from control standard measurements) has an uncertainty value associated with it. Thus, after correcting for any estimated bias, the uncertainty of that bias can be regarded as a systematic error. If an estimated bias is not applied as a correction, the combination of the bias, plus its uncertainty, should be regarded as the systematic error. Systematic error remains constant over replicate measurements. Tamper-Indicating Device (TID) is a device that may be used on items such as containers and doors, which because of its uniqueness in design or structure, reveals violations of containment integrity. These devices on doors (and fences) are more generally called security seals. Verification Measurement is a quantitative re-measurement of the amount of nuclear material in an item made to verify the quantity of nuclear material present. Verification measurements, when used to adjust accountability records, must have accuracy and precision comparable to, or better than, the original measurement method DOE-STD-1194-2019 10 6. SPECIFICATIONS 6.1 PROGRAM MANAGEMENT 6.1.1 Program Management Objectives (a) The program ensures that documentation is sufficient to maintain a comprehensive, effective, and cost-efficient program to control and account for nuclear materials. (b) The program defines MC&A system elements with performance goals that reflect consequence of loss or misuse of the material managed by the program. (c) The program must be graded (i.e., graded protection and graded safeguards) based on the consequence of loss and contain control and accounting mechanisms for nuclear materials. (d) The program establishes and maintains an evaluation program that monitors the effectiveness of the MC&A system. (e) The program responds effectively and efficiently to material loss indicators, anomalous conditions, and degradation of system performance. (f) Program management ensures the integration of MC&A with Safeguards & Security and other site programs. 6.1.2 MC&A Organization and Resources Site/facility operators need to implement a management structure that permits effective functioning of the MC&A program. Additionally, personnel and equipment resources need to be clearly delineated. Eliminating ambiguities, about what is to be done by whom, will help to counter the defeat of the system through neglect, deceit, or falsification, and will free MC&A management from conflicts of interest with other major responsibilities, such as mission-related objectives. 6.1.2.1 The site/facility operator management structure shall provide effective control of accountable nuclear materials. 6.1.2.2 The MC&A organization shall be independent of plant/facility operation organizations, such that MC&A objectives are met regardless of plant mission concerns. 6.1.2.3 The internal controls that ensure separation of duties shall be documented. An individual shall not have sole authority to oversee, evaluate performance, and audit information for which he/she is responsible.

6.1.2.4 MC&A organization, management structure, lines of authority and points of interface shall be documented. Functions and responsibilities of the personnel of the MC&A organization may be delineated on an organizational chart. DOE-STD-1194-2019 11 6.1.2.5 MC&A activities shall be coordinated and integrated with those of the analytical and nondestructive assay (NDA) laboratories, site protection programs, operations, safety, and emergency planning. 6.1.2.6 Responsibilities and authorities for all MC&A activities shall be defined and documented. At a minimum, the following organizational units and their functions shall be addressed: MC&A and nuclear materials management organizations. Security organization that has responsibility for security systems, control of locks, assisting in vault ingress and egress, monitoring SNM transfers and when assigned, the performance testing of SNM portal monitoring, material surveillance and access controls. Operational organizational units that have responsibility for processing or testing nuclear materials, process monitoring, conducting inventories, nuclear material transfers, and appointing tamper-indicating device (TID) custodians, TID applicators/verifiers, and material balance area (MBA) custodians or representatives (when not assigned to the MC&A organization). Measurement organizational units that have responsibility for activities associated with destructive and nondestructive measurements and their functionality in relationship to process and accountability measurements, including waste measurements and holdup measurements. Administrative organizational units that perform planning, assessments, testing, training, document preparation, internal audits and incident reporting. 6.1.2.7 Line Management shall ensure that the resources and personnel needed to implement and maintain an effective MC&A program are identified, documented, and available for work on that project. 6.1.3 MC&A Plan The approved MC&A Plan provides the safeguards authorization for the site/facility operator to possess accountable nuclear materials and specifies how those materials are accounted for and controlled on a graded safeguards basis. It includes all fundamental commitments that define the bounds within which the MC&A program will function and the detailed level of performance. The MC&A plan shall define the critical system elements for the MC&A Program and if there are none, the plan shall state this. Development of performance goals should be methodical and address areas where the most benefit will be achieved within the constraints of existing resources. 6.1.3.1 The MC&A Plan shall accurately describe the overall MC&A program and its associated system of controls in sufficient detail to allow evaluation by DOE/NNSA oversight organizations (The MC&A Plan may be documented similar to the example outlined in Appendix A). DOE-STD-1194-2019 12 6.1.3.2 The site/facility operator shall identify key measurement points and types of measurements in a process map or description (e.g., plan of the day); transfer operations showing transfer documentation and checks to be performed; and physical inventories showing the interrelated activities of materials handlers, measurement personnel, accountants, and statisticians, as applicable. 6.1.3.3 Procedures referenced in the body of the MC&A Plan or detailed in an appendix may be changed without DOE approval, provided plan commitments and capabilities are not degraded as a result of the change.

6.1.3.4 Procedures shall be established by the site/facility operator for emergency conditions and periods when MC&A systems are inoperative. These measures shall ensure that access to or removal of SNM would be detected during these periods. 6.1.3.5 The MC&A Plan shall describe how MC&A will be implemented following new construction projects and renovations to existing process areas. Changes to site operations shall be evaluated for impact to MC&A programs prior to implementation. 6.1.3.6 The MC&A Plan shall include a description of which MC&A records will be retained and the length of time they will be retained as required by DOE O 243.1B Chg 1 (Admin Chg), Records Management Program. 6.1.3.7 During surveys, DOE line management will further evaluate the Plan by inspecting and testing MC&A elements against the program element objectives, and evaluating overall MC&A system effectiveness. 6.1.4 Personnel Training and Qualification In order to ensure that the MC&A program is implemented effectively and as described in the MC&A Plan, personnel at all levels of all organizations with MC&A duties and responsibilities need to be knowledgeable of the MC&A plan and the program it represents. A familiarization of operations coupled with the MC&A Training and Qualification Program can help ensure that these individuals are adequately prepared to perform their functions correctly. 6.1.4.1 The MC&A Training and Qualification Program should have an overview of the training management and tracking system used to ensure that only qualified personnel perform MC&A tasks. 6.1.4.1.1 The MC&A Training and Qualification Program shall have training that is evaluated at the site level for consistency with DOE policy and needs; this evaluation may be provided by an independent external resource. 6.1.4.1.2 The MC&A Training and Qualification Program shall be documented and: • Identify MC&A jobs and their requirements, • Establish minimum qualifications for candidates, • Provide training materials sufficient to ensure that candidates understand applicable procedures and are qualified to carry out their assigned duties, and • Define re-qualification criteria. DOE-STD-1194-2019 13 6.1.4.1.3 Training plans shall be derived from a valid needs analysis and periodically reviewed, at least annually, to ensure that they are current with MC&A jobs requirements. The training plans shall identify: • Training goals and objectives for each lesson • Positions that receive MC&A training • Types of training used (e.g., on-the-job, classroom, or computer based) • Whether the training is initial or refresher • Whether training is knowledge- and/or performance-based • Lesson materials • Student evaluation and pass/fail criteria • Criteria for granting and documenting equivalency in the training records system 6.1.4.1.4 Training that meets analysis requirements can be provided by external resources such as commercial vendors or other Government training agencies (e.g., National Training Center). 6.1.4.1.5. A system of managing MC&A training records shall be developed and maintained with: • Dates of courses, course title, personnel attendance, and scores/grades achieved, where applicable • Retention of records in electronic or hardcopy form • Retention of records of training provided at the NTC recorded by the NTC and the organization sponsoring the individual

• Retention of records of training provided at other facilities, including contractor or other Government facilities (records are provided to and retained by the organization sponsoring the individual) • Re-qualification frequency, if applicable 6.1.4.2 Measurements Training Measurements are the basis for nuclear materials accountability, and as such, specific training needs shall be afforded to individuals responsible for making these measurements and evaluating measurement results. 6.1.4.2.1 In addition to the MC&A Training and Qualification Program requirements stated above, the training needs for personnel who perform sampling and bulk measurements, NDA measurements, and destructive assay measurements shall be documented in a measurement or training plan and implemented. 6.1.4.2.2 The measurement or training plan shall include the qualification criteria for acceptable levels of proficiency prior to personnel performing measurements. When changes are made to measurement instruments or methods being used, the associated training plan(s) shall be reviewed and updated as appropriate. DOE-STD-1194-2019 14 6.1.4.2.3 Measurement personnel who perform destructive analyses shall demonstrate proficiency for each method at least once a day (i.e. day on which measurements are made) or for each batch. It is acceptable to demonstrate re-qualification based on performance of the measurement on a routine basis. 6.1.4.2.4 Personnel shall be knowledgeable of the appropriate standards for each measurement system. Where sampling of bulk material is necessary, personnel shall be familiar with the sampling and sub-sampling programs that are implemented to ensure that portions of bulk material taken for measurement are representative of the total bulk material and that sampling errors are minimized. 6.1.5 Change Control A change control process shall be used to ensure that changes to a procedure, process, or measurement system are introduced in a controlled and coordinated manner. Change control ensures sufficient diligence to reduce the likelihood of introducing unnecessary changes, or error, to a system or process. The goals of a change control procedure should include minimal disruption to services, reduction in back-out activities, and cost-effective utilization of resources involved in implementing change. 6.1.5.1 The MC&A Plan shall be under change control. Conflicts in upgrading or changing procedures, processes, systems, or software that are integral to MC&A reporting and accountability should be avoided. The procedure development, review, revision, and approval process in DOE O 422.1, Chg 2, Conduct of Operations, Attachment 2, Section 2, p. Technical Procedures, should be followed. The following is an example of a change control process: 1. Request for change: The site/facility operator (MC&A personnel) initiates this by making a formal request. The management change control team then records and categorizes that request. This categorization would include estimates of importance, impact, and complexity. 2. Assessment of impacts: Those tasked with assessing impact perform a risk analysis, typically by answering a set of questions to characterize risk to both the system and to the process. If the change requires more than one type of assessment, the head of the change control team will consolidate these. Finally, a determination is made of who should carry out the change. Everyone with a stake in the change then meets to determine whether there is a technical justification for the change. The change is then sent to the operations team for planning.

3. Plan: Management assigns the change to a specific team, usually one with the specific role of carrying out this particular type of change. The team's first job is to plan the change in detail, as well as construct a backup plan in case the change needs to be backed out. DOE-STD-1194-2019 15 4. Test/Approve: If all affected agree with the plan, the delivery team builds the solution, which is then tested. They then seek approval and request a time and date to carry out the implementation phase. 5. Implement: The site/facility operator shall determine a time, date, and cost of implementation. Following implementation, it is usual to carry out a post-implementation review which would take place at another meeting. 6. Close Change Action: When all agree that the change was implemented correctly, the change action can be closed. 6.1.6 Incident Investigation and Reporting When an incident involving an actual or potential loss of nuclear material is indicated, prompt actions are necessary to correctly identify the cause in a timely manner. Prompt resolution will facilitate recovery of “lost” or stolen material, when the following exist: • memories of events leading up to an alarm are fresh, • details of the event can be reliably reconstructed from first-person testimony when only a short time has passed • materials are still available for re-measurement, and • few changes in process conditions, inventories, in-process holdup, and item locations have occurred. 6.1.6.1 An incident shall be reported to DOE line management in accordance with the reporting requirements, stated in DOE O 470.4B, Chg 2 (MinChg), Safeguards and Security Program. 6.1.6.2 The site/facility operator’s alarm resolution program shall identify the type of anomaly and its cause. 6.1.6.3 Actions shall be taken to ensure that investigation and resolution occurs in a timely manner. 6.1.7 Performance Testing Performance testing is required to document MC&A system element and procedure capability. It is used to validate functional requirements, system operability, and effectiveness of implementation. Performance testing supports validation of vulnerability assessments and self-assessments, and shall be conducted with the highest regard for the safety and health of personnel, protection of the environment, protection of Government property, and national security interests. When used to support vulnerability assessments, consideration DOE-STD-1194-2019 16 shall be given to depict a level of realism for tests to be representative of the capabilities of current DOE O 470.3C, Design Basis Threat (DBT) Order. 6.1.7.1 The site/facility operator shall establish an MC&A Performance Testing Program to evaluate MC&A system elements that can detect a threat in time to detect loss or diversion, as well as elements that assure SNM is properly protected and is in accountability. Critical system elements may include equipment, procedures, and people. 6.1.7.2 Each MC&A system element or elements identified by the MC&A Performance Testing Program shall be tested for effectiveness, covering the range of performance parameters required in the MC&A Plan. These tests, and the number of tests needed, shall be conducted: • On a schedule based on a combination of graded safeguards, system reliability, and past performance testing results, • After any equipment repairs, and • After each inoperative or ineffective state for MC&A systems.

6.1.7.3 Safeguards and security performance tests involving MC&A system elements shall be performed at least every 365 days (annually not to exceed twelve months). The test shall be based on a comprehensive site or facility threat scenario that demonstrates overall facility safeguards and security system effectiveness. When vulnerability assessments are conducted, comprehensive threat scenarios documented in the vulnerability assessment shall be used. 6.1.7.4 The following MC&A system elements shall, as applicable, be tested: (1) Access controls for Category I and II quantities of SNM - Performance tests for access controls shall be designed and conducted to evaluate the effectiveness. The tests conducted shall demonstrate detection of unauthorized access with at least a 95 percent probability. Testing of access controls shall be facility- specific, and the scope and the extent of the testing shall be documented by the site/facility operator and approved at a level as specified in the MC&A Plan. (2) Material surveillance activities for Category I and II quantities of SNM - Performance tests shall be designed and conducted to evaluate the effectiveness of material surveillance activities. The tests conducted shall demonstrate detection of unauthorized actions, with at least a 95 percent probability. Material surveillance testing shall be facility-specific, and the scope and the extent of the testing shall be documented by the site/facility operator, and at a level as specified in the MC&A Plan. (3) Tamper-indicating device application and record system - The TID record system shall accurately reflect the location and identity of TIDs for at least 99 percent of the TIDs inspected. The TID program shall ensure that TIDs are properly in place for at least 95 percent of the TIDs inspected. DOE-STD-1194-2019 17 a. To comply with the TID performance requirement, TIDs shall be inspected for all items selected for physical inventory and/or transfer. b. Inspection to ensure TIDs are properly in place shall include checking to see that the TID has been properly applied and the integrity of the TID has not been violated. c. Performance shall be verified at least every 365 days (e.g., annually not to exceed twelve months) except for facilities whose physical inventories are conducted less frequently than once a year. For such facilities, performance shall be verified at the same frequency as inventories are conducted. d. Inspection for this requirement shall not require destruction of properly applied TIDs, whose integrity has not been violated. Example 6.1.7-1 During the fiscal year, a facility makes 1,600 transfers. Transfer checks involve examination of all items bearing TIDs. During the course of the fiscal year, of the items transferred, 1,000 of them bore TIDs. Physical inventory activities involved the inspection of 500 items with TIDs. There is a procedure requirement to check that the TID is accurately reflected in the records and validate that the TID is properly in place. In this case, transfers and inventory are activities that are independent of one another. Therefore, we have made 1,000 TID checks on transfers and 500 TID checks at inventory, for an overall total of 1,500 checks. Procedures require the facility to report any discrepancies. During the fiscal year, there is a report of 2 TIDs incorrectly identified (transposition errors) and 1 TID improperly applied. The calculations required are as follows: 2/1500 = 0.0013 X 100% = 0.13% (incorrectly identified) 1/1500 = 0.0006 X 100% = 0.06% (not properly in place)

As these calculations demonstrate, in both cases, the 99 percent and 95 percent requirement is met. (4) SNM and Metal Portal Monitoring - Performance testing requirements shall include those necessary to verify vulnerability assessments, detection requirements, and applicable tests described in ASTM International Standard Guides. (5) Accounting Record System - The accounting record system shall accurately reflect item identity and location for at least 99 percent of items selected for physical inventory and/or transfer. If more than 1 percent of the accounting records selected is found to be in error, corrective actions shall be taken for the accounting system as a whole. Prior definition of what constitutes an error shall be specified. Performance shall be verified at least every 365 days (e.g., annually, not to exceed twelve months) except for facilities whose physical inventories are conducted less frequently than once a year. DOE-STD-1194-2019 18 For such facilities, performance shall be verified at the same frequency as inventories are conducted. (6) Confirmation/Verification Measurements - For Category I and II items, acceptance/rejection criteria for verification measurements and, where technically feasible, for confirmatory measurements, shall be based on the standard deviation for the measurement method under operating conditions. Control limits for such criteria shall be set at no wider than three times the standard deviation for the method. The control limits shall be reviewed and approved by DOE line management (7) Inventory Difference Control Limits for MBAs - For Category I and II, MBAs, limits-of-error of inventory differences shall not exceed a 2 percent of the active inventory during the inventory period and shall not exceed a Category II quantity of material. For Category III and IV, MBAs, limits-of-error of inventory differences shall not exceed a specified percentage of the active inventory during the inventory period to a maximum of a specified quantity; the specified percentage and maximum quantity shall be approved by DOE line management. The term “active inventory” means the sum of additions to inventory, beginning inventory, ending inventory, inventory adjustments, and removals from inventory after all “common terms” have been excluded (in this context, “common terms” are material values that appear in the active inventory calculation more than once and come from the same measurement). Example 6.1.7-2 The below data were observed at the end of an inventory period for a Category I MBA within a conversion facility that receives plutonium oxide (PuO2) and converts it to plutonium metal. Are the limits of error of the inventory difference (LEID) excessive? Inventory Difference (ID): 2,600 g Pu LEID: 3,100 g Pu Active Inventory: 85,000 g Pu The LEID of 3,100 g Pu exceeds 0.02*85,000 g Pu = 1,700 g Pu, which is two percent of the active inventory. Furthermore, if all of the SNM is conservatively assumed to be Attractiveness Level B (plutonium metal), the LEID of 3,100 g Pu also exceeds 2,000 g Pu, which is the upper limit of a Category II quantity. Investigate the ID because it exceeded the upper limit of a Category II quantity and investigate the LEID because it exceeded 2% of the active inventory limit. 6.1.7.5 The program shall include a comprehensive set of tests and a frequency of testing that confirm the capability of implemented and operating MC&A elements. The

DOE-STD-1194-2019 19 scope and frequency of testing shall be based on the graded safeguards concept with greater testing for Category I locations of SNM than for Category IV locations. Example 6.1.7-3 A site has three Category I MBAs. Two of the MBAs are processing areas; the third is a storage MBA. There are also six Category III MBAs and eight Category IV MBAs. The DOE approved MC&A plan states that for performance testing activities, Category I MBAs are weighted five times more heavily than Category III MBAs. The site performance test plan calls for 50 performance tests to be conducted during the year. What are possible testing frequencies for the conduct of performance tests? Answer: Commensurate with a graded safeguards approach, the performance testing emphasis should be on the three Category I MBAs. The table below lists several potential combinations. As the table illustrates, the requirements that 1) Category I MBAs are weighted five times more heavily than Category III MBAs and 2) 50 performance tests must be conducted, can be met using one of several combinations. However, the grade safeguards approach will likely exclude certain combinations, e.g. iteration 4. 6.1.7.6 A description of the MC&A Performance Testing Program shall be provided that includes the development, implementation, revision, and recordkeeping of test plans and the preparation of reports. Recordkeeping of performance tests shall be capable of providing an audit trail that clearly shows the relationship between test data and test documentation. 6.1.7.7 MC&A program documentation shall address actions to be taken in the event of unsatisfactory test performance. Unsatisfactory performance is determined from criteria specified in test plans. At a minimum, site/facility operator shall develop corrective action plans and, where necessary, take compensatory measures in response to unsatisfactory performance. MC&A program documentation shall specify when operations protected by inadequate MC&A measures are altered or suspended. 6.1.7.8 The MC&A program shall be considered in a degraded mode until such testing has confirmed the operability of all applicable performance parameters. Compensatory Category I Category III Category IV Total Tests Criteria Met? Iteration 1 25 5 1 31 N Iteration 2 35 7 2 44 N Iteration 3 38 9 3 50 N Iteration 4 30 10 10 50 N Iteration 5 40 5 5 50 Y DOE-STD-1194-2019 20 measures may be required during such degraded modes. System elements shall be evaluated for continuing operability through the conduct of operability tests. 6.1.8 MC&A Assessments MC&A assessments are periodically conducted to: • Provide assurance to the site/facility operator, and the DOE that safeguards and MC&A interests and activities are protected at the required levels • Provide a basis for management decisions regarding the MC&A implementation program, including allocation of resources, acceptance of risk, and mitigation of vulnerabilities • Identify MC&A program strengths and weaknesses • Provide documentation of compliance- and performance-based oversight activities. MC&A system effectiveness is determined using assessments and performance testing to ensure that all elements of the MC&A program are functioning correctly and as planned.

6.1.8.1 The site/facility operator shall establish a self-assessment program to assess the integrity and quality of its MC&A systems and procedures. The program shall determine the effectiveness of the MC&A system, under both normal operations and emergency conditions, in deterring, detecting and responding to the unauthorized removal of SNM from its authorized location and other unauthorized activities. 6.1.8.2 The scope and content of self-assessments shall be graded based on MBA category and be documented with the following topics: • Identification of abnormal situations; • Loss mechanisms, loss detection capabilities, and localization of inventory differences; • Selection, maintenance, calibration, and testing functions to ensure proper equipment and system performance; • MC&A system checks and balances, including separation of responsibilities and duties, used to identify irregularities and detect tampering with materials or MC&A system components; • Change controls, including authorization requirements, to detect unauthorized or inappropriate modification of system components, procedures, or data. The change control system shall address requirements for review, authorization, documentation, notification, and controls on equipment selection, procurement, and maintenance; DOE-STD-1194-2019 21 • Procedures or checks to ensure the reliability and accuracy of MC&A data and information; • Performance testing conducted by the facility operator. This portion of the assessment should address the design of performance tests and the results obtained by the testing program since the last assessment; • Procedures for emergency conditions and for periods when MC&A system components are inoperative; • Material containment, material access, and material surveillance procedures; • Physical inventory program and reconciliation practices; • Accounting system procedures, capabilities, and sensitivities; • Measurement control program; and • TID programs. 6.1.8.3 The self-assessment program shall have a documented schedule, which will be provided to DOE line management with updates whenever schedule changes are made. In addition to scheduled assessments, assessments shall be conducted prior to start-up of new facilities or operations, whenever changes are made in facilities, operations, or MC&A features that might alter the performance of the MC&A system, and whenever performance test and assessment results indicate a decline in performance. 6.1.8.4 The results of performance tests and the assessments of the above MC&A elements shall be incorporated into an annual evaluation of MC&A system capabilities. This MC&A system effectiveness evaluation shall be used to support the identification of MC&A resources and personnel needed to meet program objectives. 6.1.8.5 Self-assessments shall be performed by qualified personnel who are organizationally independent of process operations. 6.1.8.6 Findings from MC&A self-assessments, shall be maintained in a tracking system and include a corrective action plan. The corrective action plan shall include: • Schedule for completion • Compensatory measures, when a vulnerability to SNM or the MC&A system is identified • Evaluation for trends to identify systemic and systematic causal factors. 6.1.8.7 In addition to the assessments described above, knowledgeable personnel, independent of the MC&A organization, shall conduct internal audits to fairly DOE-STD-1194-2019 22

evaluate the MC&A function for compliance with internal plans and procedures. The frequency of these audits shall be specified in the MC&A Plan. DOE-STD-1194-2019 23 6.2 MATERIAL CONTROL An effective material control program element ensures that nuclear materials are properly protected and that they are not removed from their authorized location without approval or timely detection. The objectives of a nuclear material control system are to: • Detect, assess, and prevent unauthorized access to nuclear material. • Detect, assess, and communicate alarms to response personnel in time to impede unauthorized use of nuclear material. • Provide loss detection capability for nuclear material, and when not in its authorized location, be able to provide accurate information needed to assist in locating the material in a timely manner. • The material containment and surveillance program in conjunction with other security program elements must have the capability to detect, assess, and respond to unauthorized activities and anomalous conditions/events. • In coordination with security organizations, material control measures, assure that appropriate protection and controls are applied to nuclear materials, according to the quantity and attractiveness of the material. 6.2.1 Nuclear Material Categorization The material category of SNM locations (e.g., MBAs, material access areas (MAA), protected areas (PA), and facilities) shall be determined to establish the required protection levels. Using the quantities of SNM present, and the attractiveness level and categorization steps below, the material category is determined directly from Appendix B, Graded Safeguards Table. 6.2.1.1 The attractiveness level of SNM shall be determined and used to assign category designation to nuclear materials and their locations. The attractiveness level determination is performed before consideration of the irradiation levels. DOE O 474.2, Nuclear Material Control and Accountability, ranks SNM based on their usefulness in constructing a weapon and/or an improvised nuclear device. The attractiveness level ranking, ranges from Attractiveness Level A materials, which are directly usable as a weapon and/or an improvised nuclear device to Attractiveness Level E materials, which require difficult and complex processing before they can be used to construct a weapon and/or improvised nuclear device. For Attractiveness Level B through E, the determination shall be made using the decision tree shown in Figure 6.2-1. Weight percent SNM is calculated separately for each type of SNM present, by dividing the weight of the SNM in an item or sample by the net weight of the item or sample. The net DOE-STD-1194-2019 24 weight is the weight of the material containing the SNM without simple mechanical removal of cladding or packaging that is determined by a qualified measurement method. The weight % SNM used in the calculation is the element weight % that is determined by a qualified measurement method. For plutonium, U-233, or U-235, the enrichment, isotopic content, or atom % SNM should come from measurements of the isotopic composition. However, historical or “flow sheet” values for Pu-239 isotopic content may be assumed. Calculating atom % is only necessary for possible Attractiveness Level B SNM. Chemical compounds of SNM and SNM metal that are < 50% enriched cannot exceed the 50 atom % criterion. In addition, even if the SNM is present as metal, it is only necessary to determine atom % if the SNM exceeds 50 weight %. Atom% is calculated using the following formula:

The sum in the denominator of the equation is over all known and quantified elements in the material. Weight% is calculated using the following formula: DOE-STD-1194-2019 25 MATERIAL TYPE U-235 Pu or U-233 Pu-238 ENRICHMENT % ISOTOPIC CONTENT < 20 ≥ 50 < 20% ≥20% - ≤60% > 60% PHYSICAL FORM WEIGHT % SNM E E > 0.1 ≤ 0.1 E D ≥1 - <25 < 1.0 > 25 D E C SOLID SOLUTION WEIGHT % SNM CONCENTRATION GRAMS/LITER ≥ 10 < 10 CHEMICAL FORM COMPOUND METAL C WEIGHT % SNM ≤ 50 > 50 C ATOM % SNM ≤ 50 > 50 C B Boxes are questions or decisions; answers are given along the lines. The result is a letter representing the attractiveness level. Figure 6.2-1. Decision tree for determination of material attractiveness level for special nuclear material (SNM). ≥20 - <50 WEIGHT % SNM ≤ 0.1 > 0.1 E D WEIGHT % SNM ≤ 0.1 > 0.1 E D DOE-STD-1194-2019 26 a. Attractiveness Level A: Weapons and test devices; partially assembled weapons and test devices sufficient to construct an improvised nuclear device using commercially available parts and materials. b. Attractiveness Level B: Pure forms of SNM with a total SNM content exceeding 50 atom percent; that is, greater than half of the atoms present in the material shall be SNM. The SNM can be used in its existing form, or that can be utilized after simple mechanical removal of cladding, packaging, or matrix material to produce a weapon/improvised nuclear device through casting, forming, or other nonchemical operations. c. Attractiveness Level C: High-grade SNM that can be easily converted to metal. Generally, these materials are of high purity and require relatively little processing time or effort to obtain Level B material. d. Attractiveness Level D: Low-grade SNM that are more dilute or of lower purity than Level C materials, and require greater processing time or greater processing complexity to convert to metal than Level C materials. e. Attractiveness Level E: All accountable nuclear materials that do not meet the criteria for Attractiveness Level A through D. 6.2.1.1.1 Combined with the radiation dose rate, weight and weight percent SNM can enter into a site’s decision to assign a lower attractiveness to an item. If any of the following conditions exist, then the Attractiveness Level of accountable nuclear materials, with a high dose rate, may be assigned protection at a lower Attractiveness Level: 6.2.1.1.1.1 Radiation: Items can be considered highly irradiated and may be protected as attractiveness level E. For radiation to be a mitigating factor, the radiation environment may be taken into consideration after determining the attractiveness level. A way to determine whether protection appropriate to a lower attractiveness level may be acceptable is as follows: • Obtain adversary task list and the task time for each. • Determine cumulative radiation dose upon completion of each task. • Determine whether all tasks would be completed before incapacitation. • If all tasks unlikely to be complete then attractiveness level E. 6.2.1.1.1.2 Net Weight: Item net weight can be considered, if an item is sufficiently heavy that removal from its location requires the use of special tools or equipment, and those tools or equipment are controlled, locked and alarmed. For weight to be considered a mitigating factor, the item shall: DOE-STD-1194-2019 27 • Weigh 100 kg or more after all mechanically attached material is removed; and

• Contain less than 2 kg plutonium or less than 5 kg U-235 (greater than 20 percent enriched) if the SNM were separated from the other materials. A net weight of 100 kg or more combined with the high radiation level makes removal of an item very difficult for an individual adversary. Movement time, and the associated exposure may also be considered when determining categorization. For example, when a single item contains less than a quantity necessary for an improvised nuclear device (i.e. multiple items can be removed to attain a quantity of concern), the increased radiation exposure expected during task performance may justify a reduction in attractiveness level, despite the item(s) having a mass of less than 100 kg. 6.2.1.1.3 Weight Percent: Item weight percent can be considered, if the item contains less than one weight percent plutonium or less than one weight percent U-235, when the uranium enrichment is greater than 20% U-235. However, weight percent shall be calculated without mechanically attached material. Also, if items such as fuel rods contain end caps containing no SNM, the weight percent shall be calculated as if the end caps have been cut off. Any decision to reduce the attractiveness level of nuclear material shall be supported by an analysis that documents any change in risk by assigning a lower attractiveness level. Examples 6.2.1-1 Attractiveness Level Determination Using the decision tree in Figure 6.2-1 Scenario 1: Unirradiated plates of 90 weight percent plutonium (Pu) cladded with zirconium. Collectively, the Pu isotopes constitute 77 atom percent of the total material. In using the decision tree to determine the attractiveness level, start with the material type. Since Pu is the primary constituent, we are on the central arm of the decision tree, leading to physical form. As a solid with > 10 % Pu, the question then becomes “What is the physical form of the material?”. Though the item is clad in zirconium, the material is not a compound. Thus, this is considered a metal. Finally, the 77 % atom percentage of SNM means that this material should be assigned an attractiveness level of B. Line SNM Attribute Characteristic Decision 1 Material Type Pu 2 Physical Form Solid 3 Weight% SNM (Pu) ≥ 10% 4 Chemical Form Metal DOE-STD-1194-2019 28 5 Weight% SNM (Pu) > 50% 6 Atom% SNM (Pu) > 50% Attractiveness Level B Scenario 2: Uranium oxide (UO2) containing uranium enriched to 25 weight percent U-235. The U-235 isotope constitutes 22 weight percent of the total material. The isotope of interest is 235U. This takes us down the left arm of the decision tree, with the next decision point based on uranium enrichment. Because the enrichment is less than 50%, we need not consider the material form. Thus, the stated enrichment of 20% - 50% leads us to evaluate weight percentage to determine if the attractiveness level is D or E. Because the weight percentage exceeds 0.1%, the material is assigned an attractiveness level of D. Line SNM Attribute Characteristic Decision 1 Material Type U-235 2 Enrichment% ≥ 20% and < 50% 3 Weight% SNM (U-235) > 0.1% Attractiveness Level D

6.2.1.2. Determination of category involves grouping materials by type, attractiveness level, and quantity. Material quantities are element weights for plutonium and isotope weights for uranium-235 (U-235) and uranium-233 (U-233). For the purposes of category determination, quantities of plutonium Material Type Code 40 and Material Type Code 50 are combined and considered as one material type. The Material Types can be found in Appendix C Special Nuclear Materials and Appendix D Other Accountable Nuclear Materials. Directions for determining the material category when multiple material types and attractiveness levels shall be considered are provided in the following paragraphs. a. One Material Type, One Attractiveness Level. Sum the material in the attractiveness level and determine the category from Appendix B, Graded Safeguards Table. b. One Material Type, Multiple Attractiveness Levels (where a Category III or greater quantity of B-level material is included). (1) Determine the amounts of SNM for materials in each of attractiveness levels B, C, and D. (2) Calculate the “effective” quantity for attractiveness levels B and C by multiplying the quantity in attractiveness levels B and C by the appropriate factors in Table 6.2-1, Effective Quantities. (3) Sum the effective amounts in attractiveness levels B and C. DOE-STD-1194-2019 29 (4) Compare the total effective amount, as calculated in section 6.2.1 .2.b (3) above, to the amounts in attractiveness level B from Appendix B, Graded Safeguards Table. (5) Compare the amount of attractiveness level D to Appendix B, Graded Safeguards Table. (6) The material category is the highest level of material category determined using the procedures in sections 6.2.1.2.b (1) through 6.2.1.2.b (4), or in section 6.2.1.2.b (5). c. One Material Type, Multiple Attractiveness Levels (where less than a Category III quantity of B-level material is included). (1) Determine the amounts of SNM for all attractiveness levels. (2) Compare the total amounts in each level to those in Appendix B, Graded Safeguards. (3) The material category level is the highest level of the material categories determined using the procedures in sections 6.2.1.2.c(1) and 6.2.1.2.c(2) d. Multiple Material Types. (1) Determine the category for each material type following the above procedures. (2) The category is that determined for the individual material type that requires the highest level of protection. Table 6.2-1: Effective Quantities Attractiveness Level Pu/U-233 Factor U-235 Factor B 1 1 C 1/3 ¼ 6.2.1.3. Roll-up is the accumulation of smaller quantities of SNM to a higher category, based upon the categorizations steps listed above. In order to determine the credibility of roll-up, the attractiveness level, quantity and location shall be known for all SNM. Activities, such as pre-approved transfers by both the MC&A organization and the shipping and receiving MBA custodians, phone-ahead authorizations, or preliminary calculations by the accounting system with computerized notification, shall be used to monitor roll-up. Unless it has been demonstrated by a vulnerability assessment that roll-up is not credible, SNM shall be safeguarded and protected based on the total quantity of SNM for a location (e.g., MAA, PA, building, or group of buildings). 6.2.1.4 Facility protection strategy changes resulting from changes in safeguards category based on materials holdings at the facility and the credibility of rollup shall be reviewed and approved by DOE line management.

DOE-STD-1194-2019 30 Table 6.2-2: Example of Rollup Determination MBA Category Where Located Quantity of Category B Material Quantity of Category C Material 1 III LA Inside PA Pu: 199 grams Pu: 1,800 grams 2 III LA Inside PA Pu: 199 grams Pu: 1,800 grams 3 III LA Inside PA Pu: 199 grams Pu: 660 grams 4 III In LA Outside PA HEU: 150 gU-235 HEU: 3,200 gU-235 5 III In LA Outside PA HEU: 150 gU-235 HEU: 2,950 gU-235 Analyses: The questions that must be answered are: (1) Do the three Category III MBAs inside the PA total to a Category I quantity? (2) Do the two Category III MBAs outside the PA total to a Category II quantity? The answer to (1) is found by: 199+ 199 + 199 + 1/3 (1,800 +1,800 + 660) = 597 + 1420 = 2017 (see DOE O 474.2, Attachment 2, Table B) This is a Category I quantity and, therefore, should be protected in an MAA. The inventory of one MBA could also be reduced by 200 grams of B material or 600 grams of C material and the roll-up would be less than a Category I quantity. The answer to (2) is found by: 150 + 150 =300 g of B material is less than a Category III quantity, but 3,200 + 2,950 = 6,150g U-235 which is a Category II quantity and must be in a PA. DOE-STD-1194-2019 31 Table 6.2-3. Additional Attractiveness Level E Criteria for SNM 6.2.2. Graded Nuclear Material Control To effectively control and account for nuclear materials and meet the nuclear material control system objectives stated above, the site/facility operator shall establish and follow a graded nuclear material control program that provides the greatest relative amount of control and accountability for the types and quantities of SNM that can be most effectively used in a nuclear explosive device. 6.2.2.1. The nuclear material control measures for Category I locations shall, at a minimum, consist of those measures shown in Table 6.2-4, Nuclear Material Control Measures for Category I SNM. 6.2.2.2. The nuclear material control measures for Category II locations shall, at a minimum, consist of those measures shown in Table 6.2-5, Nuclear Material Control Measures for Category II SNM. Description/Form Maximum SNM concentration* (wt%) for MC&A and physical protection termination Maximum SNM concentration* (wt%) for only physical protection equivalent to Category IV SNM solutions and oxides: nitrate, caustic or chloride solutions, contaminated/impure oxides, metal fines and turnings, glove box sweepings 0.1 N/A SNM amenable to dissolution and subsequent separation: pyrochemical salts, chloride melt, hydroxide cake, floor sweepings, alumina, condensates reduction residues, sand, slag, and crucible, magnesium oxide crucibles spent fuel and spent fuel residues 0.1 0.2 SNM in organic matrixes or requiring mechanical separation disassembly and subsequent multiple recovery operations: HEPA filters, organic solutions, oils and sludges, graphite or carbon scrap, surface contaminated plastics, metal components, combustible rubber 0.2 1.0 SNM bound in matrix of solid, sintered, or agglomerated refractory materials: SNM embedded in glass or plastic, high-fired incinerator ash, spent resins, salt sludges, raffinates, and sulfides 0.5 2.0 SNM microencapsulated in refractory compounds or in solid-dilution: vitrified, bituminized, cemented, or polymer-encapsulated materials, SNM alloyed with refractory elements (tungsten, platinum, chromium, stainless steel); ceramic/glass salvage 1.0 5.0

*SNM weight percent is based on element weight for plutonium and isotope weight for U-235 and U-233. DOE-STD-1194-2019 32 6.2.2.3. The nuclear material control measures for Category III locations shall, at a minimum, consist of those measures shown in Table 6.2-6, Nuclear Material Control Measures for Category III SNM. 6.2.2.4. The nuclear material control measures for Category IV locations shall, at a minimum, consist of those measures shown in Table 6.2-7, Nuclear Material Control Measures for Category IV SNM and Other Accountable Nuclear Materials. 6.2.2.5. The nuclear material control measures for Other Accountable Nuclear Materials locations shall, at a minimum, consist of those measures shown in Table 6.2-8, Nuclear Material Control Measures for Other Accountable Nuclear Materials. 6.2.3. Access Controls The site/facility operator shall develop and maintain a system for controlling access to nuclear material and nuclear material accounting data and equipment, consistent with the graded safeguards concept. 6.2.3.1 The site/facility operator shall identify persons authorized access for each MBA that have a need for access to perform assigned duties, or have a need to access nuclear materials, and shall allow access to only those persons. 6.2.3.2 This list shall be prepared and maintained by the Facility or Building Manager with concurrence by the MC&A Manager. Personnel on an authorized access list shall: • have the DOE-required security clearance for the category of material in the area as designated in DOE M 470.4-5, Personnel Security, • have a need to access for their job function, • know the safeguards and security requirements for the area and be trained in the appropriate MC&A procedures for their function. 6.2.3.3 The system for controlling access shall consist of procedures and/or equipment, consistent with the requirements in DOE O 473.3A Chg 1 (MinChg), Protection Program Operations, and is capable of detecting unauthorized access and communicating this information to assessment and response personnel. 6.2.3.4 The system shall function during normal, as well as unusual and emergency conditions. 6.2.3.5 In defining access controls for nuclear materials, the site/facility operator can designate certain materials, as inaccessible. The following cases are considered inaccessible when accompanied by a justification: • The nuclear material precludes diversion because of high temperature, chemical reactivity, radioactivity, or other chemical or physical property. DOE-STD-1194-2019 33 • The removal of nuclear material from its authorized location cannot be accomplished because the tools or equipment needed for its removal are not available or would be readily detected. Justification for determining inaccessibility shall be documented and supported by an assessment that considers adversary actions, nuclear material characteristics, engineered systems and barriers, administrative procedures, and site/facility response actions. 6.2.3.6 For SNM that is accessible, the site/facility operator shall implement procedures to minimize the quantity of material that is not in the storage configuration for the MBA category in which it resides. When SNM is not in storage, it shall be considered “in use” which means that it is actively involved in a process, experiment, measurement, transfer, or other operation approved for the MBA. 6.2.3.7 For each system used for nuclear material accounting data, the site/facility operator shall control access to material control and accounting data and information.

a. The site/facility operator shall identify persons that can enter, change, or access nuclear information and data. b. The site/facility operator shall use administrative procedures, surveillance systems, and physical security systems as mechanisms to deny and detect unauthorized access to data-generating and recording devices, measurement equipment, tamper-indication devices, and other types of equipment used in MC&A activities. c. Original source documents that are used to define inventories and measurement data shall be protected from deliberate alterations that could change the accounting record data. d. Original source documents that require alterations that could change accounting record data shall be verified and signed by a second authorized person. 6.2.4. Material Surveillance The material surveillance program is primarily concerned with detection of insider adversary activities, and is, therefore, a collection of information through devices and/or personnel observation to detect unauthorized movements of nuclear material, tampering with containment of nuclear material, falsification of information related to location and quantities of nuclear material, and tampering with safeguards devices. In order for visual surveillance to be considered effective, the person(s) observing shall be capable of recognizing unauthorized activities, correctly assessing the situation, and reporting the activities to appropriate response personnel in time to deter theft, diversion, or radiological sabotage. If the recognition, assessment, or reporting is not effectively implemented, then DOE-STD-1194-2019 34 the visual surveillance methodology is deficient, and additional means shall be used to ensure detection and response. 6.2.4.1 Authorized locations. Nuclear material locations shall be identified and be consistent with Security Plans and vulnerability assessments. Authorized locations can be fixed, i.e., vault and shelf location; or in-transit between MBAs or offsite shipments and receipts. a. The authorized location for nuclear material, in use or in storage, shall be the documented location in MC&A records whether in an MBA, vault, room, glove box, process line or transit vehicle. Any item found not in its assigned location should be considered as potentially diverted until it is proven otherwise. b. If any of the following conditions are not met, then nuclear material in-transit are in an unauthorized location and should be considered as potentially diverted until proven otherwise: • The item is in a transfer device authorized for the transfer of nuclear material • The item was placed in the transfer device at an authorized loading point by personnel authorized to place nuclear material in the transfer device • The transfer device is operated by personnel authorized to operate the device and to transfer nuclear material • The transfer device is en route on an authorized route between the loading point and the authorized destination • The transfer device makes no unauthorized stops while en route, and the transfer time between source and destination does not exceed the maximum time established by the site/facility operator for transfer. • The item is removed from the transfer device only at the authorized destination, and by personnel authorized to remove nuclear material.

6.2.4.2 Two-Person Rule. When the Two-Person Rule is used as a material surveillance measure or administrative control, the two authorized persons assigned responsibility for maintaining direct control of the items shall be physically located where they have an unobstructed view of each other and/or the item(s), and can positively detect unauthorized or incorrect procedures. a. These individuals shall have training appropriate to the reason for access, and shall not have conflicting job duties; i.e., protective force personnel should not be the witness (second person) for custodian or process activities. Procedures for implementing the two-person rule shall be documented. DOE-STD-1194-2019 35 b. When the Two-Person Rule is implemented, surveillance shall be sufficient to ensure that unauthorized or unaccompanied authorized personnel cannot enter the area undetected (e.g. when the door is unlocked or open). c. When sufficient electronic control measures are in place, two-person rule requirements may be modified or removed. These measures shall be extensively tested, validated, and approved. Examples of electronic control methods include: • Video intrusion detection or similar hardware/software systems that provide continuous monitoring of items or locations • Alarm systems that would prompt a response prior to a person gaining access to Category I or II material 6.2.4.3 Daily Administrative Check (DAC). A DAC is a methodology that is used in Category I MBAs to detect anomalous conditions and to determine that SNM is not in unauthorized locations. a. DAC programs shall be described in the MC&A Plan and can consist of various safeguards and security features already in place or may take advantage of routine production procedures. The DAC program description shall include the following: • Duties, authorities and/or responsibilities of each organization involved in performing, reviewing, resolving, and reporting the DAC • Areas and/or items requiring a DAC • Methodologies or techniques used in performing a DAC • Personnel responsible for performing a DAC and the training required • Recordkeeping requirements, including forms used, reports generated, retention periods, and signature requirements • Anomaly identification, response and notification procedures. b. SNM locations and credible paths identified in vulnerability assessments shall be included in the checks. c. The DAC shall be performed by facility personnel each day that the MBA is entered and shall be performed in all rooms entered if the MBA consists of more than one room. d. The DAC shall consist of visual inspection, which can include checks of TID integrity, checks of DOE approved locks, confirmation of serial numbers or other identifiers for individual items, item counts, confirmation of SNM locations or other checks that would provide DOE-STD-1194-2019 36 obvious indicators of abnormalities or discrepancies. Surveillance technologies such as camera systems, alarm systems, metal and/or SNM portal monitors can be used to assist in checking locations and SNM. e. On workdays in which an entry is not made into an MBA, the status of the intrusion detection system shall be checked and documented. 6.2.4.4 Tamper-Indicating Device (TID). An item is tamper-indicating when it is constructed or protected with a TID such that a malevolent act cannot be accomplished without permanently altering the item or TID in a manner that would be obvious during visual inspection. Tamper indication, in conjunction with other material control and security measures, provides assurance that an item has not been altered in some way since the last time it was inspected or since the item was made tamper-indicating.

a. DOE considers the TID an effective indicator of container violation only when items are under a DOE-approved material surveillance program appropriate for the category of material in the area. The material surveillance program shall have demonstrated effective performance while items are in that location. If the material surveillance program malfunctions for a period of time greater than that required to defeat a TID, then TIDs in that area provide little or no assurance of container integrity. b. A TID applied to a container in a Category I or II MBA with effective material surveillance measures in place provides greater assurance of container integrity than a TID applied to a container in a Category III or IV MBA, also with effective material surveillance measures in place for the area. However, since the material in the container is less attractive and/or smaller in quantity, the application of a TID still has value in meeting the objectives of a TID program albeit less than for higher category areas. When TIDs are considered for vulnerability assessments or system performance evaluations, the site/facility operator shall determine the value of TIDs in meeting the program objectives. c. When a site/facility operator uses TIDs, the TID program shall consist of the following elements: 1) Acquisition/Procurement/Destruction. Procurement procedures specify that vendors provide assurance that the TIDs are unique and are not duplicated for another customer. A TID administrator is assigned responsibility to account for TIDs received from vendors and ensure that they are destroyed when removed from an item or location. Once a TID is removed or violated, it shall be destroyed to a level that, if reapplied, it would not pass an integrity check. Destruction procedures specify how to render TIDs ineffective and prevent their reuse. 2) Types of TIDs Used and Containers or items that are intrinsically tamper indicating. The MC&A Plan or associated TID manual DOE-STD-1194-2019 37 describes the types of TIDs used and how the TIDs are applied. Containers or items considered inherently tamper-indicating are listed as such in the MC&A Plan. 3) Unique TID Identification. The TID has unique characteristics such as sequential serial numbers, logos, etc. Uniqueness of TIDs increases the defense-in-depth by making them more difficult to duplicate. When a TID has multiple sides consisting of separate parts (e.g., Type E cup seal), each part shall have the same unique identification markings so that a portion of the TID cannot be replaced without evidence of tamper. 4) Storage. TIDs are stored in a locked repository with key or combination access when they are received onsite by the TID administrator. The TID administrator distributes the seals to TID custodians who are responsible for similar storage of the TIDs until they are applied. 5) Issuance. TIDs are accountable from cradle to grave. Logs are maintained that record each transfer of TIDs, (i.e., from TID Administrator to TID Custodian and from TID Custodian to TID applicator). When TIDs are applied, a record shows who applied the TID, who observed the TID being applied, and when and to what container the TID was applied. When a TID is removed and destroyed, a record of destruction is maintained identifying who removed the TID, date of removal and who witnessed the removal.

6) Personnel Authorized to Apply, Remove, and Dispose of TIDs. Personnel responsible for use and control of TIDs are clearly identified and training requirements are documented. Only personnel who have completed the training program are authorized custodians, appliers, and verifiers. 7) Procedures for TID Application and Removal. Each TID type used by the site/facility contractor for SNM containers and locations has a documented application and removal procedure. Procedures may be part of MBA procedures or a general procedure applicable to all MBAs. 8) Frequency and Method of TID Verification. The TIDs are properly applied and the integrity of the TID has not been violated for at least 95 percent of the TIDs inspected. The TID record system accurately reflects the location and identity of TIDs for at least 99 percent of the TIDs inspected. Accuracy of location and identity is obtained from routine physical inventories and from transfers of material between MBAs. The MC&A Plan shall specify how the “counting” of accuracy, identity, location, and correct application are recorded. 9) Procedures for Responding to and Reporting TID Violations. • The MC&A program shall specify who is responsible for checking TIDs and reporting anomalies. DOE-STD-1194-2019 38 • Although the program is the responsibility of the MC&A organization, many other groups are the actual end-user of the TID program. • Line personnel, operators, MBA custodians, etc. are all possible users. • The individual(s) discovering the violated TID shall notify supervision immediately and report the TID condition, identification number, container number and location. • The procedures shall specify who is responsible for reporting an anomaly that is a DOE-reportable occurrence. • When the TID integrity or container has been violated, the container contents shall be verified. • When a TID is accidentally violated in a Category III or IV MBA, a replacement TID may be applied without further verification. • When a TID is accidentally violated in a Category I or II MBA and the damage is witnessed by two authorized individuals knowledgeable of TID procedures, a replacement TID may be applied without further verification. • If the condition that caused the TID to be violated is determined and the contents are verified, a replacement TID can be applied. • A suspect TID shall be held until investigation has resolved the situation and the TID administrator approves disposal of the TID. 10) Frequency and Method of Internal Program Audits. Performance shall be verified at least annually (at least every 12 months) except for facilities whose physical inventories are conducted less frequently than once a year. For such facilities, performance shall be verified at the same frequency as inventories are conducted. Auditors are not associated with the TID program. Auditors check the serial numbers of the seals against the log books and seal inventory of unused seals; identify weaknesses in the seal program; investigate discrepancies in the seal inventory; verify seal applications and destruction; verify that deficiencies in the TID program have been corrected; and check for deviations from established procedures. 6.2.4.5 Process Monitoring. Process monitoring is a methodology to ensure that SNM is in its authorized location and when effectively implemented, it is a useful tool to detect anomalous process conditions and indicate losses of SNM well before the scheduled physical inventory. If this methodology is used, the MC&A Plan shall describe:

• the methodology for division of processes into units for the detecting the loss of control of a significant quantity. The units shall be consistent with accessible measurements points that result from the process design. There DOE-STD-1194-2019 39 is no limit or restriction on the number of units into which a process or facility can be divided. • the material control tests used for detecting abrupt losses of bulk material from a single process unit, the loss detection capability, and the timeliness of the detection. • the alarm threshold (critical value), which if exceeded initiates alarm resolution procedures. Example 6.2.4-2 As an example of a process monitoring program, unit processes would be tested weekly by monitoring inputs and outputs and comparing the process difference result to expected values. The test would have at least a 95 percent probability of detecting the loss of a Category I quantity during the week from accessible process locations. In addition, the process monitoring program would also include a trend analysis to evaluate statistically significant recurrent loss or gain from each unit process or loss and subsequent gain in successive unit processes. Process difference estimates that exceed both 3 times the standard deviation of their estimator and 50 grams would be investigated. Investigations would be resolved prior to the next weekly test. 6.2.4.6 Item Monitoring. Item monitoring is a methodology that can be used in Category I and II areas as part of the material surveillance program to ensure timely detection of the loss of items that total a significant quantity. SNM is considered to be an item if it meets one of the following criteria: (1) uniquely identifiable material, e.g., piece part, inside or out of a glove-box line (2) stored within a vault (3) encapsulated (4) within a tamper-indicating sealed container (5) stored in an area with controlled access that provides protection at least equivalent to tamper-indicating. If this methodology is used to verify the presence and integrity of selected SNM items on a periodic basis, the MC&A Plan shall describe the: • item monitoring sampling method, including the sample size selection equations, the inventory stratification plan, and the method of selecting the actual items to be verified DOE-STD-1194-2019 40 • extent to which cyclic, dynamic, or perpetual inventory data and production records are used to modify or supplement the sample size, sample selection, or item verification • minimum loss detection sensitivity and maximum time period between item verification for each stratum of SNM. • actions to be taken when loss detection sensitivity is exceeded, including timeliness for resolution. • item selected for monitoring that does not exist because it has been processed will be reviewed for documentation to ensure that the item was processed as specified. The frequency of tests for missing items should be graded according to the relative attractiveness of the material type of the item, the ease with which the item could be diverted without being observed and the degree of surveillance and containment provided by the material control and physical security systems.

The magnitude of the formal item verification effort can be adjusted to take credit for other means of confirming the presence and identity of items with applied TIDs. Process control and accounting, quality control testing, and other production operations routinely generate information that can serve to verify the identity and presence of items with applied TIDs. These sources can be used in lieu of item verification provided the frequency and loss detection sensitivity requirements of the item verification procedure are met and the use of the data for this purpose is not predictable. Example 6.2.4-3 In conjunction with installed material surveillance measures in a facility, item monitoring for Category I and II items in process areas is performed weekly by randomly selecting items and locating them in an MBA. Using the same sample size as for the items in process, the item monitoring within storage areas is performed every 2 months by randomly selecting and locating items. The sample size n is computed using the approximation n = N (1- β1/d), where N is the population size, d is a conjectured or assumed number of defects (altered or missing items that cannot be reconciled or located), and β is a tolerable probability that none of the defects will appear in a random sample of size n, if there are in fact d defects within the population. In other words, β represents an acceptable probability of not sampling any of the d defects and therefore erroneously concluding that the population contains less than d defects, when the actual number of defects is equal to d. The equation provides a suitable estimate of the required sample size, provided that the sample is large (at least 30) and is a small proportion of the population (less DOE-STD-1194-2019 41 than 10%) and that the number of defects is also a small proportion of the total population (less than 10%). For a population of N=1000 items containing 10% defective items (d=100), a random sample of size n=30 will select one or more of the defects with 0.95 probability (i.e., β=0.05). Numerically, the sample size is computed as 1000*(1-0.050.01) = 29.5 ≈ 30 For this example, the computed sample size is such that 95% of all samples (of size 30) that are randomly selected from a population having 10% defectives will result in at least one defect being drawn in the sample. The ‘probability of loss detection’ (1- β) and the associated ‘loss detection sensitivity’ (d) must be approved by DOE line management. Once these are specified, the number of items n to be selected from a population of size N is calculated from the equation. The same equation can be used for determining the number of items to be evaluated during a physical inventory, where in that case, d (a percentage of the total population) is called the ‘minimum detectable defect’ and (1- β)*100% is called the ‘confidence level.’. See Section 6.5.1.3 and Table 6.5-1. 6.2.4.7 Transfers. When nuclear material is transferred from one MBA to another or shipped to or received from an offsite location, checks shall be made to ensure that there are no anomalous conditions. a. The items being transferred shall be checked by both the shipper and receiver against authorized transfer forms or computer records to ensure that only the correct items are being moved and the container integrity has not been violated. b. When the nuclear material passes an MAA or PA portal, the items shall be checked by the protective force against the transfer documentation.

c. When the nuclear material being transferred between MBAs is not an item, the material characteristics, such as volume, weight and radiation signature shall be checked when it is shipped and when it is received by an MBA custodian. d. When nuclear material is received into an MBA, the transaction is promptly entered into the accountability records. e. When an onsite transfer of a Category I or II quantity occurs, a time limit for the transfer shall be established and monitored such that a protective force response is initiated if the time limit is exceeded. 6.2.4.8 Waste Monitoring. All liquid, solid, and gaseous waste streams leaving a material access area shall be monitored for SNM. DOE-STD-1194-2019 42 a. Instrumentation shall be maintained and controlled to ensure that it is capable of detecting, in combination with other detection elements, the removal of a Category I quantity of SNM through a credible theft or diversion scenario, as determined by a Vulnerability Assessment (VA). b. Monitoring instrumentation can be semi-quantitative, provided that the monitors used are capable of detecting gamma/neutron radiation characteristics of the type specified for the SNM in the area. c. Environmental and waste management instrumentation can be used if the detection objective is met and anomaly reporting is directly made to a security organization where a proper response can be initiated. 6.2.4.9. Portal Monitoring. Portal monitoring refers to monitoring personnel and vehicle egress from an MAA and PA. a. The systems used for portal monitoring shall meet the requirements specified in DOE O 473.3A Chg 1 (MinChg), Protection Program Operations. b. The SNM and metal detectors in combination shall detect unshielded and shielded test sources described in ASTM portal monitoring standards. 6.2.5 Deactivation and Decommissioning (D&D) There are two general cases associated with the D&D of a facility containing accountable nuclear material: (1) The facility was previously placed in an inactive condition and safeguards has been terminated on all accountable material in the facility, and (2) The facility transitions directly from the operations phase of its life-cycle into the D&D phase. 6.2.5.1 D&D for Inactive Facilities a. Identify the total quantity of accountable material to be removed from the facility and coordinate with Physical Security to develop a security plan that provides the appropriate degree of security for the material being removed from the facility. b. Make a determination of the need to return any of the material being removed to the active inventory. If this is required, use the process defined in section 6.2.7. c. Conduct oversight of all measurements on material removed to ensure the measured values are in reasonable agreement with the holdup values assigned to the areas from which the materials were removed. d. Obtain approval to terminate safeguards on materials that were returned to the active inventory if required using the process in 6.2.6. 6.2.5.2 D&D for Active Facilities DOE-STD-1194-2019 43 a. Conduct removal of material from the facility (or a portion of the facility) until a sufficient removal has occurred to permit termination of safeguards on the facility (or portion of the facility). b. Obtain approval to terminate safeguards on the facility (or portion of the facility) using the process in section 6.2.6. NOTE: The approval for termination may be obtained as a process description that identifies the methodology that will be used to reduce the inventory in a portion of a facility to a level that will permit the termination of safeguards.

6.2.6 Termination of Safeguards Termination of safeguards is a process by which nuclear materials are removed from accountability and control in the MC&A, however; materials for which safeguards are terminated still need to be protected and controlled pursuant to other DOE security directives or site policy based on the specific details of the material and/or location (i.e. physical protection requirements commensurate with the attractiveness and category of the material). Termination of safeguards implies that a waste management organization will continue to control, protect, and account for the material in accordance with waste management regulations. 6.2.6.1 Safeguards can be terminated on nuclear materials provided the following conditions are met: a. If the material is SNM or protected as SNM, it shall be Attractiveness Level “E” and have a measured value. b. The material has been determined by DOE line management and the Office of Nuclear Materials Integration (ONMI) to be of no programmatic value to DOE. c. The radiological sabotage risks associated with the materials have been evaluated and additional measures beyond waste management regulations put in place to ensure that protection requirements, if applicable, will be met after safeguards termination. Only nuclear materials that are of radiological sabotage concern need to be evaluated against this requirement. d. The material is transferred to the control of a waste management or D&D organization where the material is accounted for and protected in accordance with waste management regulations. The material shall not be collocated with other accountable nuclear materials. e. When considering safeguards termination of SNM other than Attractiveness Level “E”, the DOE/NNSA Departmental Element shall approve the termination request after consultation with the AU Office of Security. f. If SNM Category II or greater is being considered for termination, a security analysis for theft or diversion must be performed, and approval received from the responsible DOE/NNSA Departmental Element. DOE-STD-1194-2019 44 6.2.6.2 Terminating safeguards on SNM holdup can occur only after the holdup has been measured and properly credited to the accountability books. Unless demonstrated to be otherwise, the attractiveness level and/or category of SNM in process holdup shall be considered to be the highest attractiveness level and/or category of the total SNM put into the process during its lifetime. Hold up can be designated recoverable or unrecoverable. a. “Recoverable holdup” is the material that can be recovered during D&D operations. This material may have been affixed to system components and materials, but during D&D the material will loosen or become retrievable. Within the accounting system this type of material is also referred to as “process holdup”. b. “Unrecoverable holdup” is material that is inaccessible in the facility even during the D&D process. This material is embedded in and affixed to system components (equipment holdup) and material (glass, plastics, metals, concrete slab, etc.). This holdup is considered beyond economical and technical recovery. 6.2.6.3 Management of Terminated Materials - The MC&A organization shall coordinate with the Security organization to provide accountability information (Attractiveness and Category) for terminated materials. This includes materials exhumed from waste trenches, removed from inactive facilities, etc. This information will permit the determination of the proper physical security protection measures as specified in DOE O 473.3A Chg 1 (MinChg), Protection Program Operations.

6.2.7 Returning Terminated Materials to the Active Inventory Material for which safeguards have been terminated may be returned to active inventory only if programmatic needs have changed and the material type and/or composition is not otherwise available. Accountability values for material being returned to the active inventory will be established using one of the following methods: 6.2.7.1 Perform an accountability measurement on the material and use the value obtained as the accountability value. 6.2.7.2 Perform research to establish the history associated with the material: (1) The accountability value for the material at the time of safeguards termination, (2) Evidence that the material has remained in a condition that ensures it has not been tampered with, for example, an intact TID, storage in a location considered to provide assurance of tamper detection, etc. a. Perform verification measurement(s) to provide evidence that the item(s) has/have not been tampered with. (3) Return the material to the active inventory using the value obtained from the historical research. DOE-STD-1194-2019 45 6.2.8 Overview of Process to Terminate Safeguards on Nuclear Material Terminating safeguards on nuclear material is a process that involves the site, their Program Office, ONMI and the Office of Security. • Determination by site that nuclear material has no programmatic use or is excess • Request from site for a Programmatic Value Determination (PVD) to: o the Office of Nuclear Materials Integration (ONMI) (use fillable format provided by ONMI) and o Program Office • Review of information provided by site by ONMI and Program Office • Final PVD made by ONMI and notification to requesting site • Preparation of a Termination of Safeguards (ToS) request to sites Program Office including the ONMI determination in request • Consultation request for ToS from Program Office to the Office of Security including all information from the site and ONMI • Review of information by Office of Security • Response sent from Office of Security to the Program Office • Approval or disapproval of ToS by Program Office after receipt of consultation and conveyance of decision to the requesting site DOE-STD-1194-2019 46 Table 6.2-4: Nuclear Material Control Measures for Category I SNM

Category I MBAs are located in a Material Access Area. Authorized activities and the authorized locations for nuclear materials in each MBA are identified. When in use, SNM is controlled by two authorized and trained personnel with a “Q” security clearance (See Section 6.2.4.2 - Two- Person Rule) and who participate in a Human Reliability Program that has demonstrated effective performance. One person meeting these requirements may access the area when a vulnerability assessment shows that direct access to Category I quantities of SNM is not possible without detection, or there is a system of hardware, procedures, and administrative controls sufficient to ensure that no unauthorized accumulation of a Category I quantity of material occurs without timely detection. When not in use, SNM is stored in vaults or vault-type rooms meeting the requirements of DOE O 473.3A Chg 1 (MinChg), Protection Program Operations. Two authorized and trained individuals are present when opening and closing storage areas. Security devices or protective force personnel ensure that the two people are authorized. The Two- Person Rule or equivalent surveillance procedure is in effect at any time the storage area is not locked and protected by an active alarm system and security cameras. A Daily Administrative Check (DAC) methodology is implemented in Category I MBAs and in lower category MBAs where rollup to a Category I quantity has been determined to be credible. The DAC detects abnormalities, tampering, and SNM that is not in authorized locations (See Section 6.2.4.3 – Daily Administrative Check). Nuclear material types, forms, and amounts authorized to be removed from the security area are identified in the MC&A Plan. Liquid, solid, and gaseous waste materials leaving an MAA are monitored. Instrumentation and methods used to monitor waste and equipment removed from an MAA is able to detect, in combination with other detection elements, the removal of a Category I quantity of SNM through a credible theft or diversion scenario, as determined by a VA. Items placed in storage and both SNM and non-SNM waste containers transferred across a security boundary are tamper-indicating. When a processing operation involves changes in material characteristics with a Category I throughput during an inventory period, a process monitoring program is used to detect anomalous conditions and indicate losses between physical inventories. DOE-STD-1194-2019 47 Table 6.2-5: Nuclear Material Control Measures for Category II SNM Category II MBA is located in a Protected Area or higher security area. Authorized activities and the authorized locations for nuclear materials in each MBA are identified. Controlled by two authorized and trained personnel with a minimum of an “L” security clearance. (See Section 6.2.4.2 - Two-Person Rule). A “Q” security clearance is required to access Category II material if rollup to a Category I quantity is credible or if a vulnerability assessment determines that an additional clearance is required. When not in use, SNM is stored in vaults or vault-type rooms meeting the requirements of DOE O 473.3A Chg 1 (MinChg), Protection Program Operations. Two authorized and trained individuals are present when opening and closing storage areas. Security devices or protective force personnel ensure that the two people are authorized. The Two-Person Rule or equivalent surveillance procedure is in effect at any time the storage area is not locked and protected by an active alarm system and security cameras. Nuclear material types, forms, and amounts authorized to be removed from the security area are identified in the MC&A Plan Items placed in storage and both SNM and non-SNM waste containers transferred across a security boundary are tamper indicating. When a processing operation involves changes in material characteristics with a Category I through put during an inventory period, a process monitoring program is used to detect anomalous conditions and indicate losses between and during physical inventories periods.

DOE-STD-1194-2019 48 Table 6.2-6: Nuclear Material Control Measures for Category III SNM Category III quantities must be located in a Limited Area or higher security area. Authorized activities and the authorized locations for nuclear materials in each MBA are identified. Controlled by authorized and trained personnel with a minimum of an “L” security clearance. A “Q” security clearance is required for materials when a VA determines that additional clearance is necessary to minimize risk. When not in use, SNM are stored in an approved locked repository. Security-locked doors will allow a room to serve as a repository. Acceptable locks are a three-position changeable combination lock meeting GSA standards for classified storage, or a DOE-approved automated access control device. Storage locations and areas where SNM is in-use but unattended, are protected by an intrusion detection system or patrolled at intervals not exceeding eight hours. SNM items that are not being processed or will be stored for more than 6 months are tamper-indicating. SNM containers leaving the MBA are tamper-indicating. Controls associated with a Protected Area or Material Access Area is sufficient by themselves for Category III SNM, unless they are identified as credible substitution materials for higher category SNM. Multiple Category III and IV locations outside a Protected Area do not total a Category II or greater quantity; or an assessment shows rollup is not credible. When a processing operation involves changes in material characteristics with a Category I throughput during an inventory period, a process monitoring program is used to detect anomalous conditions and indicate losses between physical inventories. Table 6.2-7: Nuclear Material Control Measures for Category IV SNM MBA located in a Property Protection Area or higher security area. Authorized activities and the authorized locations for nuclear materials in each MBA are identified. Controlled by authorized and trained personnel. Stored in an approved locked building, area, cabinet, or container that is not man portable. Locksets are pick-resistant with strict key control and accountability. An automated access control device approved by DOE may be used. SNM items that are not being processed or will be stored for more than 6 months are tamper-indicating. SNM containers leaving the MBA are tamper-indicating. Controls associated with a Protected Area or Material Access Area is sufficient by themselves for Category IV nuclear materials unless they are identified as credible substitution materials for higher category SNM. Multiple Category III and IV locations outside a Protected Area do not total a Category II or greater quantity; or an assessment shows rollup is not credible. When a processing operation involves changes in material characteristics with a Category I throughput during an inventory period, a process monitoring program is used to detect anomalous conditions and indicate losses between physical inventories. DOE-STD-1194-2019 49 Table 6.2-8: Nuclear Material Control Measures for Other Accountable Nuclear Materials MBA located in a Property Protection Area or higher security area. Authorized activities and the authorized locations for nuclear materials in each MBA are identified. Use and storage is controlled by authorized and trained personnel. Stored in an approved locked building, area, cabinet, or container that is not man portable. Locksets are pick-resistant with strict key control and accountability. An automated access control device approved by DOE security program may be used.

DOE-STD-1194-2019 50 6.3 MEASUREMENTS Measurements are the basis of accounting for inventories and transfers and provide assurance that no nuclear material is missing. They provide information on quantities, isotopic composition and weight percent determination of nuclear material in given locations which is essential to determining category levels and protection requirements. All nuclear material quantities in the material accounting records shall be based on measured values for element and isotope for nuclear material associated with: • Additions to inventory (e.g., receipts) • Removals from inventory (e.g., shipments and measured discards) • Material on hand at the time of inventory. Objectives of a measurements program are as follows: • The measurements program must provide measured values with uncertainties sufficient to detect theft or diversion of nuclear material. • The measurement control program must assure the quality of measurements made for MC&A purposes. When material not amenable to measurement is received at a facility and receipt measurements are not possible, the material can be entered into the accounting records based on shipper’s values and acceptable confirmation measurements of two attributes of the nuclear material. Material is considered “not amenable to measurement” when the size, configuration, or characteristics of the nuclear material are such that a quantitative measurement with acceptable precision and accuracy is not possible with measurement equipment and techniques that are commercially available. Limited processing to obtain an accountability measurement is permitted, provided it is approved by the DOE cognizant security authorities for both the shipper and receiver. 6.3.1. Types of Measurements Three types of measurements are used for accountability purposes: (1) Accountability measurements shall be used to establish initial values for nuclear materials and to replace existing values with more accurate measured values. These measurements shall be of the highest quality, consistent with the graded safeguards concept for the highest potential material attractiveness level, and the contribution of the uncertainty of the measurement to the overall measurement uncertainty of the inventory or transfer values. (2) Verification measurements shall be used to validate the accounting system values when necessary, e.g., at time of physical inventory for non-tamper-indicating items or in response to a security anomaly that could have resulted in a theft or diversion of nuclear material. Verification measurements do not need to use highly accurate or precise methods, however, when these measurements are used to adjust accounting DOE-STD-1194-2019 51 values, they shall have accuracy and precision comparable to, or better than the original measurement method. (3) Confirmation measurements shall be used to validate the presence of nuclear material for transfers, and to determine nuclear material presence under anomalous conditions. In order to validate nuclear material presence, a characteristic of the nuclear material, not just the item, shall be measured. However, when an item has been stored in a Category I or II area under TID protection, and an effective material surveillance program for that area, item gross weight may be used for as a confirmation measurement. 6.3.2. Measurement Methods and Procedures.

6.3.2.1 The quantity of all nuclear material present on inventory shall be determined using measurement methods or measurement services described in the MC&A Plan, unless shipper’s values are accepted with DOE approval. The site/facility operator shall develop and maintain methods for confirming the presence of nuclear materials and verifying material quantities. 6.3.2.2 Procedures for each measurement method shall provide clear direction to the analyst or operator and shall be validated initially and revalidated whenever changes are made. 6.3.2.3 Measurement procedures shall be approved by the MC&A manager or designee, the manager of the organizational unit responsible for performing the measurement, and the person overseeing the measurement control program. The site/facility operator shall have a change control program for measurement procedures and a mechanism for ensuring an MC&A review of all changes to measurement procedures. 6.3.2.4 When a weight or mass measurement method is used for accountability purposes, a daily check of both accuracy and linearity shall be performed. The check shall use standards that bracket the range typical of measurements performed for the material being measured. 6.3.2.5 When a volume measurement method is used for accountability purposes, the following shall be specified in measurement documentation: • Vessel identification (e.g., tank, column) • Capacity of the vessel to which the measurement applies • Material being measured • Volume measuring device and instrumentation • Sensitivity of each device and system • Range of operation and/or calibration, and DOE-STD-1194-2019 52 • Calibration frequency. 6.3.2.6 Calibration frequency shall be determined by documented studies of system stability or defined by alternative approaches documented by the site. Recalibration shall be performed whenever there is a change that could impact the calibration, e.g., replacement of an agitator or heating element in the tank. 6.3.2.7 When an analytical measurement method is used for accountability purposes, the following shall be specified in measurement documentation: • Type of material or chemical compound (e.g., UF6, uranium alloy, UO2, uranyl nitrate solution) being sampled and measured • Sampling technique • Sample handling (i.e., pre-analysis sample storage and treatment) • Analytical method used • Characteristics measured (e.g., grams of uranium per gram sample, U-235 isotopic concentration) • Measurement interferences • Expected measurement uncertainty (precision and accuracy goals). Measurement uncertainties in the sampling and analysis can be quantified either separately or in combination. • Whether the measurement method can be influenced by the person performing the measurement. If a method can be influenced by the person making the measurement, the measurement control program shall evaluate that person’s performance. • Calibration standard(s) and calibration frequency. 6.3.2.8 When an NDA measurement method is used for accountability purposes, the following shall be specified in measurement documentation: • The NDA equipment package (type and size of detector and type of associated electronics and computer interface, as appropriate) • Measurement method (e.g. passive neutron, gamma ray spectroscopy, etc.) • The type of container or location measured • Nuclear material type within the container or location • Attribute(s) measured • Characteristics measured DOE-STD-1194-2019

53 • Measurement configuration (including source-to-detector distance) • Calculation method • Modeling assumptions • Measurement interferences • Expected measurement uncertainties (precision and accuracy goals) • Calibration standard(s) and calibration frequency • Which material types/material form for which the standards are applicable • Whether the measurement method can be influenced by the person performing the measurement. If a method can be influenced by the person making the measurement, the measurement control program shall evaluate that person’s performance 6.3.2.9 When sampling of bulk material is required to obtain a measurement, the site/facility operator shall develop a sampling plan and a corresponding background document outlining studies and validation of the sampling plan for each sampling method. The sampling plan shall be written as a technical procedure and include: • Justification of sampling technique • Physical characteristics of the material being sampled • Description of equipment and supplies required • Discussion of sampling procedure • Number of samples required • Size of samples • Mixing procedures, including times • Instructions for storing and transporting a sample • Estimates of the variance. 6.3.2.10 The sampling plan shall be reviewed annually or when necessary to adapt to changes in sampling procedures or the material being sampled. 6.3.3. Selection and Qualification of Measurement Methods 6.3.3.1 The site/facility operator, through documented procedures, shall ensure that only qualified measurement methods are used for all MC&A measurements (accountability, confirmation, holdup, verification, etc). DOE-STD-1194-2019 54 6.3.3.2 Accountability measurement methods shall be selected to minimize the uncertainty of the inventory difference, maximize the loss detection sensitivity of the MC&A system, and assure the quality of the measurement results consistent with the consequences of the loss of the material. 6.3.3.3 Measurement methods, including the measurement instruments and operators, shall be qualified, periodically validated, and approved by the MC&A organization. Qualification shall demonstrate how well the method performs under workplace conditions. The frequency of method validation shall be based on qualification studies that demonstrate system stability. Target values for precision and accuracy, established and approved by DOE line management, shall be used as performance goals. Performance during qualification shall be documented to validate that the method can be performed with the material types for which the method is qualified. One useful reference for target values is: International Target Values 2010 for Measurement Uncertainties in Safeguarding Nuclear Materials, IAEA Report STR-368, published November 2010. However, it should be noted that uncertainties given in this reference may have been determined using measurement configurations that differ from those in use at a given site. In those instances, it may be more reasonable to consult method-specific ASTM standards for uncertainty guidance. 6.3.4. Measurement Control Program Controls on measurements are used to: • Maintain the limit of error of the inventory difference (LEID) within DOE – approved limits; • Minimize the error contribution resulting from nuclear material measurements; • Ensure that accountability values have known accuracy and precision; and.

• Confirm the functionality of the measurement instrument within expected ranges. 6.3.4.1 A measurement control program monitors the performance of measurement systems (systems include both instruments and personnel) to ensure performance remains within tolerances needed for the intended use (e.g., to detect diversion and/or to maintain product quality). All measurement systems used for accountability purposes shall be in the measurement control program. 6.3.4.2 A measurement control program shall quantify the random and systematic errors in all quantitative measurements used to assess the statistical significance of inventory differences and shipper/receiver differences. The long-term characteristics of measurement errors are typically quantified via an estimated range, an estimated standard deviation, or other expression of uncertainty in the error’s value. The measurement of a standard is required for estimating the bias in a measurement instrument, or the standard deviation of the systematic error. Replicate measurements of process materials can be used to quantify the standard deviation of random errors. DOE-STD-1194-2019 55 Examples 6.3.4.2-1 Systematic Error: Estimate the relative standard deviation of the systematic error (a unidirectional error that affects all measurements of a data set) using eight measurements taken during an inventory period of a standard having a known value of 87.000. 1 87.798 2 87.793 3 87.793 4 87.815 5 87.794 6 87.805 7 87.802 8 87.797 Sample average (Avg) 87.800 Known 87.000 Relative Std Dev% 0.919% The bias is estimated as Avg-Known, having the value 87.800 – 87.000 = 0.8. Assuming that the process measurements will not be corrected for the estimated bias, the relative standard deviation (in percent) for the systematic error can be expressed as: ((Avg-Known)/Known)*100% Numerically, the estimated relative standard deviation is ((87.800 – 87.000)/87.000)*100% = 0.919% DOE-STD-1194-2019 56 Random Error: Estimate the relative standard deviation of the random error using the analysis of seven batches of process material that were sampled in duplicate. Duplicate Measurement Results d d*d 1 4.156 4.158 -0.002 0.0000 2 4.236 4.325 -0.089 0.0079 3 4.345 4.354 -0.009 0.0001 4 4.175 4.275 -0.100 0.0100 5 4.386 4.410 -0.024 0.0006 6 4.189 4.091 0.098 0.0096 7 4.312 4.247 0.065 0.0042 Sum d*d 0.0324 Sum di*di/(2*7) 0.0023 Avg 4.2614 *Avg2 18.1592 Relative Std Dev% 1.129% The estimated relative standard deviation (in percent) for the random error is Sqrt (((Sum di*di)/2k)/Avg2)*100%, where di is the difference between the first and second duplicate analyses of the ith batch, k is the number of paired analyses, Avg is the overall average of all measurement, and Sum and Sqrt represent the respective summation and square root functions. Numerically, the estimated relative standard deviation is Sqrt ((0.0324/(2*7)))/18.1592)*100% = 1.129% Determining Systematic and Random Error for Holdup: Calculating the systematic and random error for holdup can be difficult. A conservative approach to the systematic error would be to assume a value of 0. An approach to determining systematic error would involve putting a known standard in various places in a glove box or location similar to where the actual holdup is to be measured. The NDA measurement is performed several times and the nuclear material value is determined. The systematic error is then determined in a manner similar to that shown above.

DOE-STD-1194-2019 57 The random error would be determined by making repeated measurements of the holdup and calculating the nuclear material values. The methodology shown above would then be used. An alternate approach would be to make a measurement of holdup and use a different assumption of the modeling of the nuclear material quantity, and then calculate the random error between the two models. Regardless of the method used, complete documentation should be maintained. 6.3.4.3 When accountability measurements are used to routinely evaluate inventory and shipper/receiver differences, the measurement control program shall be capable of ensuring the quality of measurements to a level acceptable to DOE line management. 6.3.4.4 The site/facility operator shall ensure accountability measurement systems have adequate calibration frequencies, control of biases, and adequate measurement precision to achieve predefined goals for detecting material loss. 6.3.4.5 The error estimates shall reflect the measurement process in existence at the time of the measurement of process materials. 6.3.4.6 Measurement control program procedures shall be established and maintained in a manual that is kept current and readily available. Responsibility for preparing, revising, and approving procedures shall be specified. The procedures shall address: • Calibration frequencies and methods. • Standards used for calibration (description and storage controls). • Standards used for control (method of obtaining or preparation, and tractability). • Control standard measurements. • Replicate sampling and replicate measurements. • Statistical analysis for evaluation of measurement control data to determine control limits and precision and accuracy estimates for each measurement system used for accountability. This data should be maintained on a current basis. • Verification of process control and inventory quantification instrumentation through comparison with other process instruments. • Control limits and control responses. • Generation, collection, and maintenance of control data to provide an audit trail from source data to accounting records. DOE-STD-1194-2019 58 • Software quality assurance. • Record keeping controls and requirements. 6.3.4.7 If measurement services, such as instrument calibration are provided by an outside contractor or offsite laboratory, the site/facility operator shall describe how this program is monitored to ensure that the contractor or laboratory has an acceptable measurement control program—that is, the measurements made with instruments under their program meet the site/facility operator’s measurement control program commitments. 6.3.4.8 Sample Exchange Programs. Each facility’s measurement control program should include participation in inter-laboratory control programs to provide independent verification of internal analytical quality control. 6.3.4.9 A person in charge of the measurement control program shall have the authority to enforce all applicable measurement control requirements, including the authority to terminate and restart measurement systems. 6.3.5. Calibration and Standards 6.3.5.1 Each method shall be calibrated using standards traceable to the National Institute of Standards and Technology (NIST) Standard Reference Materials or Certified Reference Materials provided by the New Brunswick Laboratory (NBL) Program Office. Standards shall have smaller uncertainties associated with their reference values than the uncertainties of the measurement method in which they are used. Standards shall be recertified at a frequency that ensures their uncertainties are valid.

6.3.5.2 The method, including the entire measurement system, shall be calibrated with a control standard, or set of standards that are representative of the process material being measured by the system, to the extent possible. To be representative, any constituent of the process material, or any factor associated with a process item, that produces a bias effect on the measurement shall be present to a similar degree in the control standards. Control standard measurements serve the dual purpose of monitoring the stability of a previously determined calibration factor, and estimating the average system bias over a period of time (e.g., an inventory period). A control standard can be any combination of primary, secondary, reference, or working standards used to calibrate or verify the calibration of a measurement system. The minimum total number of control standard measurements during the time period, as well as the typical frequency, shall be specified for each measurement system. 6.3.5.3 Measurement system performance shall be demonstrated at least once each day the system is used for accountability measurements. For calorimeters and other measurements requiring an extended measurement time, the performance shall be demonstrated at least one of every five measurements or weekly. Measurement control data, such as control standard measurement results and the differences DOE-STD-1194-2019 59 between measurement values of replicate pairs, shall be plotted manually on graphs or entered into a computer database for generating control charts. 6.3.5.4 A minimum of two control standard measurements should be made during each week that a key measurement system is used. Key measurement systems are those systems that account for >30 percent of the total measurement variance contribution to the LEID. When key measurement system are used less than eight weeks during a 2 month material balance period, more than two control standards per week of system use may be necessary. The site/facility operator should strive to achieve a minimum of twenty (20) control standard measurements during the inventory period for each measurement system. 6.3.5.5 Measurements shall be used for accountability purposes only when standards cover the range of measurements of interest. 6.3.5.6 Calibration determinations that use mathematical models shall include assumptions of the model in measurement documentation that are based on calibration methods and controls used to ensure that measurements fit the calibration model. 6.3.6. Control Limits 6.3.6.1 Warning and alarm (out-of-control) limits shall be established and used for control standard measurements for measurement systems that are used for nuclear material accountability. Warning limits shall be set at two standard deviations and alarm limits shall be set at three standard deviations from the mean. In statistics, the standard deviation (SD, also represented by the Greek letter sigma σ or s) is a measure that is used to quantify the amount of variation or dispersion of a set of data values. 6.3.6.2 Activity response required for a measurement system that is out-of-control is as follows: • Take the measurement system out of service with respect to accountability measurements. • Either the analyst or the operator performing a control measurement or their supervisor should have the responsibility for promptly reporting any control standard, or replicate measurement that exceeds an out-of-control limit. Such reporting shall be made to the person responsible for the measurement control program.

• Perform at least two additional control measurements and those should be within two standard deviations of the mean. • Perform additional control measurements, if results do not show the system to be back in control, using a different control standard or different replicate sample (as appropriate) or recalibrating the measurement system, or making any necessary system repairs. DOE-STD-1194-2019 60 • Remeasurement of any samples (or items) that were measured before the out- of-control condition but after the last within-control measurement. The validity of the previous measurements can be established without a complete re-measurement of all the samples (or items) involved if re-measurement on a “last in, first out” basis is used. That is, the last sample (or item) measured before the out-of-control measurement should be the first to be re-measured and continuing in reverse order until two consecutive re-measurements are found to be in agreement with their initial measurement at the 95 percent confidence level. 6.3.6.3. All control charts shall be reviewed by a person responsible for measurement control at least monthly, unless the measurement system was not used during that period. The review shall assess how often the control data exceeds either the warning or the out-of-control limits and evaluate any significant trends. Control charts should be periodically reviewed (at least monthly) or software developed to identify out-of-control situations. The review should consider some or all of the following situations: A measurement system is out-of-control when: • Two consecutive control standard or replicate measurements exceed two standard deviations; • One control standard measurement exceeding three standard deviations; • Two of three consecutive control standard or replicate measurements exceeding two standard deviations; • Eight consecutive control standard or replicate measurements are biased high or low. DOE-STD-1194-2019 61 Examples of out of control situations are shown in the charts below: • 1 point outside the 3s line-(Chart A) • 2 out of 3 points outside the 2s line-(Chart B) DOE-STD-1194-2019 62 • 8 consecutive points all above or below the centerline-(Chart C) • 6 consecutive points trending upward or downward-(Chart D) DOE-STD-1194-2019 63 • 15 consecutive points alternating above and below the centerline-(Chart E) DOE-STD-1194-2019 64 6.4 ACCOUNTING The functions and objectives of a nuclear materials accounting system are: (1) Accurate records of nuclear materials inventory are maintained, and transactions and adjustments are made. (2) The accounting system provides data and reports on nuclear material sufficient to support local, national, and international commitments. (3) The accounting system must accurately reflect the nuclear material inventory and have sufficient controls to ensure data integrity. (4) The accounting system provides data for reporting on accountable nuclear material to NMMSS and Nuclear Materials Inventory Assessments. (5) The accounting system must use material balance areas as the basis of the accounting structure with key measurement points established to localize and identify inventory differences. The accounting records provide a means for assessing performance of the MC&A system and determining compliance with regulatory requirements. 6.4.1 General Accounting Practices

Each DOE facility possessing reportable quantities of accountable nuclear materials listed in Appendix C and /or Appendix D shall establish and maintain procedures that describe the structure and operation of the system used to account for the nuclear materials. The procedures shall accurately reflect current accounting practices and follow generally accepted accounting principles promulgated by the Financial Accounting Standards Board. 6.4.1.1 Shipments, receipts, transfers, changes in physical form, chemical/isotopic composition, location, and adjustments, of the nuclear material inventory shall be approved and accurately recorded and entered into the accounting system within a timeframe approved in the MC&A Plan. 6.4.1.1.1 Nuclear Material Shipper/Receiver Agreements for external transfers The site/facility operator should develop and implement a program to control and account for external transfers of nuclear materials for each facility. This program should include documented procedures that specify requirements for authorization, documentation, tracking, verification, and response to abnormal situations should any occur during transfer of nuclear materials. The site/facility operator shall establish and implement a graded system of measurements and records to monitor external transfers of nuclear material and to deter/detect unauthorized removal of material during such transfers (see NMMSS User’s Guide for requirements for submitting DOE/NRC F 741 and DOE forms required for documenting transfers for materials accounting purposes). DOE-STD-1194-2019 65 6.4.1.2 The accounting system shall include checks and balances to deter any one person or organization from affecting changes in the status of nuclear material and making unapproved changes to the accounting system. • Separation of duties to reduce errors and deter improper transactions - Duties for recording accounting information should logically separate process operations, material change authorization, and accounting record updates. • Transactions are properly authorized - Controls shall be sufficient to assure that all transactions are recorded. • Recorded transactions are reasonable and valid - The transaction shall appear by all its characteristics to be reasonable to MC&A accounting management, and controls exist to identify potentially false transactions. Flagged transactions are reviewed prior to acceptance into the system. When accounting systems allow a single individual to make item adjustments, procedures should be in place to ensure a source document as backup for the transaction is generated and an independent technical review of all inventory adjustments is performed. An inventory adjustment that is not reviewed may be a potential source of a masked diversion. 6.4.2. Account Structure 6.4.2.1 At least one reporting identification symbol (RIS) shall be established for the facility with an assigned nuclear material representative who is responsible for reporting data to NMMSS. Additional RISs can be established for waste accounts, material under International Atomic Energy Agency (IAEA) agreement, or for another reason identified by the DOE. 6.4.2.2 For each RIS the facility shall establish one or more accounts called material balance areas (MBAs), and all nuclear material shall be assigned to an MBA unless safeguards have been terminated in accordance with safeguards termination requirements. An MBA shall have the following characteristics:

• An integral operation within a single geographical area that does not cross a material access area or a protected area boundary. • An identified nuclear material category, along with a description of the authorized operations. • An assigned MBA custodian who controls nuclear material movement, approves transfers, and conducts physical inventories. A custodian can be responsible for multiple MBAs but shall not be responsible for multiple MBAs when transfers of nuclear material occur between those MBAs (i.e., a single custodian shall not serve as both shipper and receiver for material transfers). DOE-STD-1194-2019 66 • Defined key measurement points for inputs, outputs, and inventory that facilitate localization of inventory difference. 6.4.3. Accounting Systems 6.4.3.1 The accounting system shall provide continuity of knowledge for all nuclear material from receipt through disposition by maintaining an audit trail that includes documentation of transfers, adjustments, measurement results with measurement method, and the identity of individuals making changes to the accounting system (date and time stamp). Entries are fully supported by source documentation. 6.4.3.2 The accounting system shall provide detection capability for data falsification and unauthorized access to the accounting system and source documents. The accounting system, whether a paper system or computer-based, should have checks and balances that ensure data entered is authorized, reasonable, appropriate, and matches source documents. If a computer system is used to generate accountability records, a brief overview of the hardware and software configuration should be provided, along with a description of how the system is controlled. Information technology systems used for MC&A will be certified in accordance with DOE requirements. System documentation should include a general description of the computer security measures in place and should refer to relevant computer security documents. For Example: • A description of the database(s) and operating system (including classification, where applicable). • Description of security measures in place to protect information from unauthorized access (e.g., secure local area networks, unclassified/sensitive networks, or encryption devices). • Responsibility for authorizing access to system. • Responsibility for maintaining the system and associated software. • System assurances (e.g., backup and/or reconstruction capabilities). • Change control; password control; data access control. The Local Area Nuclear Material Accountability Software (LANMAS) is a DOE standard, network-based accounting software used to satisfy essential records and reporting requirements established by DOE policy for the control and accountability of nuclear materials. While not required, LANMAS provides the necessary framework for establishing MBAs, reporting all required nuclear material, and transmitting data to NMMSS. DOE-STD-1194-2019 67 6.4.3.3 To meet emergency needs the accounting system shall be capable of being updated daily or on demand, and a book inventory listing of all SNM shall be generated within 3 hours of the request. This requirement is for updating records based on reports or information; it does not pertain to how quickly a facility shall be able to complete measurements. The listing shall differentiate between SNM and other nuclear material.

6.4.3.4 Data integrity shall be assured by backing up accountability data at a frequency approved in the MC&A Plan by DOE line management and periodically testing disaster recovery capability. 6.4.4. Accounting Data and Records 6.4.4.1 Accounting records and source documents shall include permanent/indelible item identification to the extent practicable, material type, form, quantity, location, gross weight, net weight, isotope, element concentration, enrichment for nuclear materials in all MBAs. (If available) Source documents are the forms or reports documenting a transaction. A source document is required for every activity; such as item creation, transfer, removal, process holdup adjustments, change in form or location, or measurement, which alters the accountability status of nuclear materials. Source documents may be hand-generated paper documents, computer-generated paper documents, or computer generated data files, and are used to update the database. The MC&A Plan should describe the types of source documents generated and the permissions or controls required to generate, prepare, approve and file the documents. 6.4.4.2 The site/facility operator shall establish a documented program to evaluate all inventory adjustments entered in the accounting records. Procedures shall be developed and implemented to ensure that all inventory adjustments are supported by measured values or other technically justifiable bases. Holdup adjustments shall be justified on the basis of measurements or other factors. The program shall include documented procedures for the statistical review of inventory adjustments using techniques such as tests of trends, biases, and correlation. The inventory adjustment program shall address: • Shipper/Receiver Differences, including a discrepancy in the number of items, a statistically significant measurement result, trending of difference data, and reporting requirements. • Inventory Differences, including reporting of missing items, inventory differences that exceed control limits, and reporting requirements. • Evaluation of Other Inventory Adjustments, including procedures for applying radioactive decay, fission transmutation, adjustments for re-measurement of items, and reporting of abnormal situations to DOE line management. DOE-STD-1194-2019 68 6.4.4.3 Accounting information shall be sufficient for calculating shipper/receiver and inventory differences, evaluating their significance, and investigating and resolving significant differences. For consistency, material in-transit at the end of a reporting period shall be included in the receiver’s reported inventory. 6.4.4.4 Nuclear material activities shall be reported in the same accounting period in which they occurred. In nuclear material accounting, this means that transactions and inventory adjustments are recognized during the accounting period in which they occur. For example, a shipment made on the last day of the month should be shown as a transaction by both the shipper and the receiver for that month, even though the receiver may not receive the material until the following month. As this example shows, care is needed in recording each event for the purpose of reporting its effects in the inventory statements. Inventory adjustments should be addressed in the MC&A Plan and additional details should be provided in accounting procedures. For those facilities using LANMAS the system requires that all data entries be “balanced” and an inventory difference may be generated as part of a transaction.

6.4.4.5 In addition to an itemized listing of all nuclear material on inventory, the accounting system shall maintain a separate record referred to as the Material Balance Report (MBR) or General Ledger. This ledger keeps track of total quantities on hand since the previous physical inventory (or beginning accounting period), additions to the site, removal from the site, adjustments to site accounting records, and the ending inventory (or ending accounting period). 6.4.4.6 Accounting system data shall be sufficiently accurate and timely to confirm that a planned material movement would not exceed the approved category level of the MBA or exceed site-wide rollup constraints. Rollup refers to the accumulation of quantities of nuclear material to a higher category. Facilities should require advance approval of MBA transfers, or the accounting system should determine a priori that a planned material movement will not exceed the approved category levels. 6.4.4.7 Source documents and records are considered quality records and shall be retained and protected in accordance with DOE O 200.1A Chg 1 (MinChg), Information Technology Management. Records retention should exist in order to facilitate reconstruction of events. The records should reflect the needs of the accounting office, management and review groups, both internal and external. The DOE Administrative Records Schedule 18: Security, Emergency Planning, and Safety Records, published by the Chief Information Officer, provides a list of documents that includes MC&A records and their associated retention schedule. DOE-STD-1194-2019 69 6.4.5 Accounting Reports 6.4.5.1 Data fields shall be defined and nuclear material information on shipments, receipts, internal changes, and inventory data sufficient to comply with national and international reporting objectives shall be reported to NMMSS within established timeframes. NMMSS is the U.S. Government's information system containing current and historic data on the possession, use and shipment of nuclear materials. This centralized database contains information collected from government and commercial nuclear facilities and provides output reports to those facilities and other interested parties, primarily U.S. Government offices charged with the management and safeguarding of nuclear materials. To accomplish their mission, NMMSS requires facilities to provide two types of information: • Transaction data • Inventory summary data. The transaction data is coded information for the MBR and the inventory summary data are the beginning and ending accounting period inventory information. Data collected and submitted to NMMSS is site summary level data, and not MBA or item specific data. Timely and accurate inventory and transaction data is required. For most facilities with Category I quantities, information is submitted monthly due to the volume of transactions. Other facilities that are less active may submit quarterly. NMMSS closes its records system monthly and has reports available for facilities. NMMSS is required to reconcile the national system to each facility’s data on an annual basis, based on transaction and inventory summary data as of September 30 of each year.

The NMMSS User Guide provides detailed instructions on completing forms and submitting data to NMMSS. Electronic submission of data is required, unless manual submission is coordinated with DOE line management. The guide includes reporting formats for transaction data, MBR data, inventory data, Foreign Obligations Reporting, IAEA reporting, how to create a Reporting Identification Symbol (RIS) and project numbers, and rounding for reportable quantities. The NMMSS program provides several means for submitting data electronically to NMMSS including SIPRNET, SECURENET, and encrypted unclassified e-mail. Contact the NMMSS Operator for additional information about submitting data to NMMSS. The contact information is provided at https://www.energy.gov/nnsa/nuclear-materials-management-and-safeguards- system-nmmss. NMMSS also provides its users with the Safeguards Management Software (SAMS), a software package that facilities can use to validate data. Sites should use SAMS to screen data before submitting it to NMMSS, thus reducing the time needed to reconcile facility and NMMSS data. Below is information from the NMMSS users Guide on Rounding, how to establish a RIS and information about Project numbers. 6.4.5.1.1 Rounding DOE-STD-1194-2019 70 Both element and isotope weights are reported if they round to a reportable quantity. In cases where the element is a reportable quantity, but the isotope is not a reportable quantity, the material is still to be reported, but for the isotope, enter 0 (zero). In cases where the isotope is a reportable quantity, but the element is not a reportable quantity, the material is still to be reported, but for the element enter 0 (zero). See Table 6.4.5-1, Rounding, below. Nuclear material transactions should be documented and reported as accurately as possible to reflect the actual quantity of material transferred. If a transaction of discrete items, each of which is less than a reportable quantity, sum to a reportable quantity, the transaction should be recorded to most accurately reflect the actual quantity involved. The shipper and receiver decide how to ensure appropriate accounting documentation in NMMSS. Both the shipper and receiver must agree on the method to use. If the shipper and receiver cannot agree, refer to ONMI to decide how best to document the transaction. Quantities reported as shown in Table 6.4.5-1, Rounding, below with fractions of one-half or greater are rounded upwards and fractions of less than one-half of a reporting unit are reported as the number zero (0). NOTE: When performing general calculations not related to discrete items in a transaction, do the calculation first before rounding. For software development purposes, sites or facilities may use more significant digits than provided in the tables. Table 6.4.5-1 Rounding 6.4.5.1.2 Establishing a Reporting Identification Symbol (RIS) RIS Request: A request from the MC&A field representative, who may be either a DOE/NNSA Federal or contractor employee, is routed to the DOE/NNSA line management for review and approval. DOE/NNSA line management approves activities for which the RIS is requested. DOE/NNSA line management sends the request to the DOE NMMSS Program Manager to establish the RIS required for DOE/NNSA approved activities. Quantity Action Equal to or greater than one-half of the reporting unit Report to the nearest whole reporting unit Less than one-half of the reporting unit Report as 0 (zero) -round down

DOE-STD-1194-2019 71 RIS Justification: Justification must exist before a new RIS can be established. The following is a list of common reasons for requesting a new RIS. The facility should: 1) anticipate Departmental authorization to contain an inventory of nuclear materials within the next 12 months; 2) be involved in international shipments or receipts of nuclear materials; or 3) be storing or processing material under IAEA safeguards. A facility that does not meet the above criteria, but believes a RIS is necessary for operations, can request a RIS by submitting proper justification and documentation to DOE/NNSA by following the procedure outlined in Section 13.1, Requests for New RISs or Revision of RIS Information, of the NMMSS User Guide. 6.4.5.1 Project Numbers Project numbers are structured on the DOE/NNSA budget and reporting (B&R) classification codes and identify the HQs and field elements or site offices having programmatic responsibility for each project. Indices of current project identifications are maintained and issued annually (NMMSS Report T–141) to organizations engaged in DOE/NNSA production and research programs. Project numbers are required for all G owner code transactions with the following specifications. 1) If the material is loan/lease material, the project number is QGD04LEASE (material that is not excess) or QGD05LEASE (excess material). 2) All export/import transactions involving DOE-owned material require the project number R50000000G on the foreign entity’s side of the data indicating that the material, though located outside the U.S., should remain DOE-owned. 6.4.5.2 Material Balance Reports (MBRs) are to be submitted annually to NMMSS for the September 30th accounting period and reconciled with the NMMSS data. More frequent data submission and reconciliation of MBRs may be required by DOE line management. DOE facilities selected under the U.S./IAEA Safeguards Agreement will also be required to meet any additional or more frequent reporting requirements for MBRs and other data reports as specified in the facility attachment. The MBR can be prepared by either the NMMSS operator or by the site/facility operator. The site/facility operator may place a standing request with NMMSS to have NMMSS generate an MBR (DOE/NRC Form 742) in lieu of submission of reports by the site/facility operator. The use of previously reported inventory data and transaction data enables the NMMSS system to generate the material balance report. Reconciling transactions shall be submitted if NMMSS balances are to be changed. 6.4.5.3 Radioactive decay shall be reported on MBRs annually when the decay has reached reportable quantities, or more frequently if required by DOE line management. DOE-STD-1194-2019 72 Normal operating losses (NOLs) and write-offs shall be reported individually, or with approval of DOE line management, entered monthly. DOE-STD-1194-2019 73 6.5 PHYSICAL INVENTORY 6.5.1 General Inventory Procedures The objectives of a physical inventory are: (1) The physical inventory in conjunction with other MC&A elements assures that accountable nuclear materials are not missing. (2) The physical inventory program ensures that discrepancies between the physical inventory and the accounting records system are detected and resolved. Performance of a physical inventory consists of the following steps: 1. Determination of what is on inventory at the required frequency (the materials on hand at the time of the inventory),

2. Ensure that process MBAs are prepared prior to the conduct of the actual physical inventory (i.e. equipment cleaned out), 3. Comparison of materials on hand to the records (book inventory), and 4. Investigation and resolution of any differences resulting from step 3. Determining what is on inventory involves observations and measurements of materials present at the time of the inventory. The list of materials on hand during physical inventory is then compared to the records. The records are the listings of all materials from the previous physical inventory, plus materials moved into and out of the MBA. Anomalies may develop in this comparison that requires investigation and resolution; for example, items may be missing, or the inventory difference (calculation from step 3) may be significantly different from zero. The book inventory records keep track of what materials went into and out of the MBA, and thus indicate what materials should be on hand at the physical inventory. Some of these materials may be present as discrete items that could easily be traced to individual entries in the records. Other materials may be present as bulk quantities that result from some portion or all of many entries in the records. Ideally, during a physical inventory, all materials (bulk or item) are located, have quantitative values, or quantitatively measured to assure their presence and quantity, and all areas are inspected to assure that there are no materials present that are not reflected in the records. The bulk materials are either moved to a location where they can be measured, as in the case of liquids being moved to an accountability tank, or they are converted to a stable form for measurement, such as conversion to an oxide or metal. 6.5.1.1 The site/facility operator shall implement a physical inventory program for accountable nuclear materials to demonstrate that materials are present in their stated quantities and to detect unauthorized removals or discrepancies. DOE-STD-1194-2019 74 The physical inventory provides data for two forms of anomaly detection: records checks and calculation of a material balance (and the resultant inventory difference). To provide these anomaly detection capabilities, a physical inventory shall be able to relate the materials on hand to the records, and to determine accurately how much material is present (as well as how much has moved through the MBA and if this represents a loss of material). 6.5.1.2 The physical inventory procedure may use either a pre-list of the book inventory generated by the accountability computer to locate items, or a hand list of items may be generated during the inventory, and the list compared to the accountability records. 6.5.1.3 In lieu of a 100 percent item inventory, a statistical sampling plan may be defined by the site/facility operator and approved by DOE line management. A plan shall meet the parameters of Table 6.5-1. Sampling plans should be developed for each MBA category, and MBAs may be combined. A formula similar to that shown in Example 6.2.4-3 may be used. 6.5.1.3.1 The inventory population shall be stratified according to item category, as shown in Table 6.5.1, Minimum Sampling Parameters for Physical Inventory. Separate samples shall be derived for each stratum. Table 6.5-1, Minimum Sampling Parameters for Physical Inventories Category Confidence Level Minimum Detectable I 95% 3% II 95% 5% III & IV 95% 10%

6.5.1.4 Inventories shall be based on measured values including measurements or technically justifiable estimates of holdup. It may not be practical to measure all items due to radiation exposure or time required. Therefore, items that are tamper-indicating or have been sealed with a TID and have been continually under an effective material surveillance program do not need inventory measurements. If there is no indication that an item has been altered, the previous measured value may be used in calculating the material balance. Items that are not tamper-indicating or sealed with an effective TID shall be measured to quantify the nuclear material. When a large number of these items exist, a statistical sampling plan with parameters stated in Table 6.5-1 may be used. Justification for using a sampling plan for these materials shall be provided to DOE line management who shall approve the plan. 6.5.1.5 The physical inventory is also used to show that TIDs are present in their assigned locations, applied to the item indicated in the accounting record, are intact, and that the intact TID has served its function (indicating tampering or altering). During physical inventory, applied TIDs shall be compared to the accounting records DOE-STD-1194-2019 75 system and to TID records. Each item should be inspected for penetration and for integrity of both the item packaging and the TIDs. Tag checks, also called location checks (each item is located), are used during a physical inventory to identify gross defects in the inventory. Missing items, missing tamper-indicating devices and broken, falsified, or violated tamper-indicating devices are all examples of gross defects. 6.5.1.6 Acceptance/rejection criteria shall be established and documented in the MC&A Plan for both item inventories and measurements. The statistical sampling plan shall state how inventories or measurements that fail the criteria are resolved. 6.5.2. Scheduling and Planning Inventories 6.5.2.1 Physical inventories of accountable nuclear materials shall be conducted at frequencies commensurate with the Category and operations conducted in each MBA in accordance with Table 6.5-2, unless an alternative inventory frequency is documented in the MC&A plan. Table 6.5-2 Physical Inventory Frequencies 6.5.2.2 Inventory frequencies may be extended using alternative measures specified in Table 6.5-3 after review and approval by DOE line management. Security analysis shall be performed, and if necessary, vulnerability/risk assessments, to provide assurance that the risk associated with the extended inventory period or automated inventories is acceptable. Safeguards and security systems should be integrated to achieve protection system effectiveness. Multidisciplinary teams shall perform independent assessments. 6.5.3. Automated Physical Inventories As technology advances, automation may be applied to physical inventory methods. Automated physical inventories should accomplish the same objectives as manual physical inventories listed above in Section 6.5.1. As with manual inventories, automated measurements are allowed on a statistical basis for storage locations where a 100% inventory is not feasible. However, in most cases where inventories are automated, it should be practical to do a 100% inventory within approved inventory timeframes. Category Processing MBA Storage MBA I 2 months 6 months II 2 months 6 months III 6 months 2 years IV 6 months 2 years DOE-STD-1194-2019

76 Table 6.5-3, Inventory Periods Based on Alternative Measures for Category I and II Storage Locations Alternative Inventory Control Measures 1 Inventory Period Formidable barriers 1 year Hazardous environment 1 year Bulk containment 1 year Vault enhancement above baseline requirements 9 months Continuous monitoring of physical or mechanical parameters 1 year General (area-wide) confirmatory measurements 1 year Continuous item observation2 (e.g., video/image, laser surveillance) 2 years Continuous item monitoring2 (e.g., monitoring of serial number, TIDs, movement) 2 years Mass2 (load cell) 2 years Confirmatory measurements2 on individual items (e.g., thermal, gamma, or neutron emission) 3 years Quantitative measurements on individual items May qualify as a continuous inventory 2 1 When multiple measures are used for storage MBAs, the inventory periods are additive as long as the alternative measures function independently. 2 If the measurements are both item- and material-specific and there is a level of confidence that the measurements are correct, the monitoring may qualify as a continuous physical inventory. To be considered a continuous physical inventory, automated measurements must be made on all items on a second-to-second basis. 6.5.4 Inventory of Unmeasured, Poorly-Measured, Irradiated, and Inaccessible Materials The term, “not amenable to measurement”, is not equivalent to “not convenient to measure” or “challenging to measure.” Where at all possible, material should always be measured. Applicability of “not amenable to measurement” is determined on a case-by-case basis and requires approval by DOE line management. Appropriate accountability measurement programs should be developed for material that is received on a continuing basis, even if it is unusual in chemical composition or physical form. 6.5.4.1 Nuclear materials not amenable to verification measurement shall be identified in the facility’s MC&A plan. Inventory values for these materials shall be based on measured values or technically justified estimates. Justification and supporting documentation for these inventory values shall be maintained and readily retrievable for review. When materials cannot be measured because of size or composition, this does NOT mean that no attempt should be made to characterize these items. Any available information should be used to confirm these materials prior to any limited DOE-STD-1194-2019 77 processing or packaging operations. As soon as possible, a good measurement should be obtained for use prior to any other operations or in preparation for storage. The last measurement prior to storage should be compared to initial data, and differences should be resolved where at all possible, taking into account the reliability and quality of the initial information. 6.5.4.2 For nuclear material that is not amenable to measurement at time of physical inventory, confirmation measurements of two attributes may be substituted. The two attributes chosen for confirmation shall be measured using independent methods that positively confirm the presence of the nuclear material. 6.5.5 Evaluating Inventory Programs

6.5.5.1 The site/facility operator shall develop, document and implement a program for evaluating all SNM inventory differences, including those involving missing items. Programs for evaluation of inventory differences for other nuclear materials may be established at the option of DOE line management. 6.5.5.2 The site/facility operator shall develop and implement procedures for establishing control limits and requiring an investigation when those limits are exceeded. Procedures for establishing control limits for inventory differences of SNM shall be based on variance propagation using current data. The data should reflect operating conditions for the material balance period of the inventory. Other methodologies may be used, but they shall be approved by DOE line management and shall be justified based on factors such as limited data, low transfer rates, and/or material category. For Category III and IV MBAs, control limits may be based on professional judgment with the approval of DOE line management. Significant differences between historical limits and limits based on variance propagation shall be investigated for the purpose of validating, revising, and refining the variance propagation model. 6.5.5.3 Assessments of inventory differences shall be conducted and include statistical tests (e.g., tests of trends and biases), which shall be applied, as appropriate, to both total inventory difference and actual inventory difference on both an individual and a cumulative basis for each processing MBA. Inventory records, process logs (where available), or other information may also be used to detect anomalies and trigger investigations. 6.5.5.4 Limits of error for IDs (LEID) of processes in new or existing facilities should be used to trigger the need to evaluate and improve measurement systems to determine if reduction in uncertainty can be achieved. 6.5.6 Inventory Reconciliation 6.5.6.1 Procedures shall be established and approved to reconcile physical inventory with the book inventory (and adjusted if necessary) within 30 calendar days following receipt of all inventory information (including sample and analysis data). The procedures shall address responding to and reporting missing items and inventory DOE-STD-1194-2019 78 differences in excess of control limits. (See Section 6.1.8) Inventory reconciliation shall be completed before starting the next physical inventory. 6.5.6.2 Reconciliation shall consist of the following activities: • Comparison of Accounting System values with physical inventory observed values. • Verification that all receipts and shipments were properly documented and reflected in the Accounting System. • Investigate all IDs that are greater than the associated LEID. • Where statistical sampling is used to validate the physical inventory items that are not tamper indicating, the reconciliation shall include extrapolation to the total physical inventory. • Resolution of any discrepancies identified in the two actions above prior to release of the MBA for resumption of operations. 6.5.7 Special (Emergency) Inventories 6.5.7.1 Special inventories may be conducted upon request of the personnel identified in the MC&A Plan. Examples include, but are not limited to, DOE line management, the contractor MC&A manager, etc. Special inventories are those conducted in addition to those conducted at the required intervals for a particular MBA. Situations in which special inventories are conducted include, but are not limited to:

• Turnover of the Primary MBA Custodian duties from one individual to another, • Transition of contractor responsibility, • Verification that all materials are present following an emergency involving an evacuation of an MBA, • When doubt exists associated with the holdings of a particular MBA, • For Performance Testing purposes during management assessments, Surveys, and Office of Enterprise Assessments. These inventories differ from periodic inventories in that they are performed to address objectives that may not include all elements of periodic inventories. A specific plan shall be developed for these inventories to address the scope of the inventory. For example, a post-emergency special inventory may only require the verification of the presence of the items outside secure storage. 6.5.7.2 Physical inventories performed during IAEA inspections may, with the concurrence of DOE line management, serve in place of a scheduled physical inventory. DOE-STD-1194-2019 A- 1 Appendix A: Suggested MC&A Plan Format 1. Introduction a. Purpose b. MC&A Goals c. Review, Revision, and Change Control d. Approvals 2. Program Management a. Program Management Objectives b. Site Name, Location, and Mission/Programs c. MC&A Threat Considerations d. Reporting Identification Symbol (RIS) e. Plant and MBA Descriptions f. Organizational Structure g. MC&A Responsibilities and Authorities h. MC&A Procedures i. Emergency Plans j. Incident Investigation and Reporting k. MC&A Training and Qualification l. MC&A Element Testing m. Program Review and Assessment n. System Performance Evaluation 3. Nuclear Material Control a. Material Control Objectives b. Nuclear Material Categorization c. Access Controls d. Material Containment e. Material Surveillance f. Material Transfer Controls g. Termination of Safeguards 4. Measurements and Measurement Control a. Measurement and Measurement Control Objectives b. Selection and Qualification of Measurement Methods c. Measurement Systems d. Measurement Controls e. Material not Amenable to Measurements 5. Nuclear Material Accounting a. Material Accounting Objectives b. Account Structure c. Accounting System Description d. Records and Reports e. System Assurance 6. Physical Inventory a. Physical Inventory Objectives b. Plans and Procedures A-2 c. Inventory Frequency d. Reconciliation and Anomaly Resolution e. Special Inventories DOE-STD-1194-2019 B-1 Appendix B: Graded Safeguards Tables Attractiveness Level Pu/U-233 Category (kg) Contained U-235/Separated Np-237/Separated Am-241 and Am-243 Category (kg) All E Materials Category IV I II III IV1 I II III IV1 WEAPONS Assembled weapons and test devices A All N/A N/A N/A All N/A N/A N/A N/A PURE PRODUCTS Pits, major components, button ingots, recastable metal, directly convertible materials B ≥2 ≥0.4<2 ≥0.2<0.4 <0.2 ≥5 ≥1<5 ≥0.4<1 <0.4 N/A HIGH-GRADE MATERIALS Carbides, oxides, nitrates, solutions (≥25 g/L) etc.; fuel elements and assemblies; alloys and mixtures; UF4 or UF6 (≥50% enriched) C ≥6 ≥2<6 ≥0.4<2 <0.4 ≥20 ≥6<20 ≥2<6 <2 N/A LOW-GRADE MATERIALS Solutions (1 to 25 g/L), process residues requiring extensive reprocessing; Pu-238 (except waste); UF4 or UF6 (≥ 20% < 50% enriched) D N/A ≥16 ≥3<16 <3 N/A ≥50 ≥8<50 <8 N/A ALL OTHER MATERIALS Highly irradiated3 forms, solutions (<1 g/L), compounds; uranium containing <20% U-235 or <10% U-2332(any form, any quantity) E N/A N/A N/A Reportable Quantities N/A N/A N/A Reportable Quantities Reportable Quantities

1The lower limit for Category IV is equal to reportable quantities in DOE O 474.2. 2The total quantity of U-233 = (Contained U-233 + Contained U-235). The category is determined by using the Pu/U-233 side of this table. 3In this Technical Standard “highly irradiated” is defined in the definitions. DOE-STD-1194-2019 C-1 Appendix C Special Nuclear Materials** Special nuclear materials in this table must be controlled and accounted for in a graded manner consistent with the Design Basis Threat policy and Graded Safeguards Table. Material Type Reportable Quantity* Weight Field Used for Element Weight Field Used for Isotope Material Type Code Enriched Uranium gram total U U-235 20 Uranium-233 gram total U U-233 70 Plutonium-2421 (Pu) gram total Pu Pu-242 40 Plutonium-239-241 gram total Pu Pu-239 + Pu-241 50 Plutonium-2382 tenth of a gram total Pu Pu-238 83 Uranium in Cascades gram total U U-235 89 *Reportable quantity is the minimum amount of material subject to the requirements of DOE O 474.2. Facilities with less than a reportable quantity of a material are exempt from the requirements of DOE O 474.2 for that material. Facilities with a reportable quantity or more of a material are to report transactions and inventories to NMMSS. A reporting unit is the mass unit that site/facility accounting systems must use for reporting inventories and transactions. 1Report as Pu-242 if the contained Pu-242 is 20 percent or greater of total plutonium by weight; otherwise, report as Pu-239-241. 2Report as Pu-238 if the contained Pu-238 is 10 percent or greater of total plutonium by weight; otherwise, report as Pu-239-241. ** Although classified as other accountable nuclear material, separated Am-241, separated Am-243, and separated Np-237 must be controlled and accounted for as SNM. DOE-STD-1194-2019 D-1 Appendix D Other Accountable Nuclear Materials Other Accountable Nuclear Materials in this list must be controlled and accounted for financial and materials management purposes and being protected in a graded manner consistent with their strategic and monetary importance or as required by international agreements. Material Type Reportable Quantity* Weight Field Used for Element Weight Field Used for Isotope Material Type Code Depleted Uranium (U) kilogram total U U-235 10 Normal Uranium kilogram total U - 81 Americium-2414(Am) gram total Am Am-241 44 Americium-2434 gram total Am Am-243 45 Berkelium3 (Bk) microgram - Bk-249 47 Californium-252 (Cf) microgram - Cf-252 48 Curium (Cm) gram total Cm Cm-246 46 Deuterium1 (D) tenth of a kilogram D2O D2 86 Enriched Lithium (Li) kilogram total Li Li-6 60 Neptunium-2374 (Np) gram total Np - 82 Thorium (Th) kilogram total Th - 88 Tritium2 (H-3) gram total H-3 - 87 * Reportable quantity is the minimum amount of material subject to the requirements of DOE O 474.2. Facilities with less than a reportable quantity of a material are exempt from the requirements of DOE O 474.2 for that material. Facilities with a reportable quantity or more of a material are to report transactions and inventories to NMMSS. A reporting unit is the mass unit that site/facility accounting systems must use for reporting inventories and transactions.

1For deuterium in the form of heavy water, both the element and isotope weight fields will be used; otherwise, report isotope weight only. 2Tritium contained in water (H2O or D2O) used as a moderator in a nuclear reactor is not an accountable material. 3Berkelium must be accounted for at the site level. It is not required that it be reported to NMMSS. 4Americium and Np-237 contained in plutonium as part of the natural in-growth process are not required to be accounted for or reported until separated from the plutonium. If separated, these materials must be controlled and accounted for as SNM. DOE-STD-1194-2019 84 CONCLUDING MATERIAL Review Activity: Preparing Activity: AU Office of Security Policy (AU-51) EA EM MA NE Project Number NNSA SANS-0006 SC Field and Operations Offices CH ID NNSA Service Center ORO RL SRO Site Offices: ANL INL LASO LLSO NPO NFO OR RLSO SRSO SSO External Agency Defense Nuclear Facilities Safety Board DOE-STD-1194-2019 Nuclear Materials Control and Accountability Table of Contents FOREWORD 1. SCOPE 2. PURPOSE 3. APPLICABILITY 4. REFERENCES 5. ACRONYMS AND DEFINITIONS 6. SPECIFICATIONS 6.1 Program Management 6.1.1 Program Management Objectives 6.1.2 MC&A Organization and Resources 6.1.2.2 The MC&A organization shall be independent of plant/facility operation organizations, such that MC&A objectives are met regardless of plant mission concerns. 6.1.2.3 The internal controls that ensure separation of duties shall be documented. An individual shall not have sole authority to oversee, evaluate performance, and audit information for which he/she is responsible. 6.1.2.4 MC&A organization, management structure, lines of authority and points of interface shall be documented. Functions and responsibilities of the personnel of the MC&A organization may be delineated on an organizational chart. 6.1.2.5 MC&A activities shall be coordinated and integrated with those of the analytical and nondestructive assay (NDA) laboratories, site protection programs, operations, safety, and emergency planning. 6.1.2.6 Responsibilities and authorities for all MC&A activities shall be defined and documented. At a minimum, the following organizational units and their functions shall be addressed: 6.1.2.7 Line Management shall ensure that the resources and personnel needed to implement and maintain an effective MC&A program are identified, documented, and available for work on that project. 6.1.3 MC&A Plan 6.1.3.1 The MC&A Plan shall accurately describe the overall MC&A program and its associated system of controls in sufficient detail to allow evaluation by DOE/NNSA oversight organizations (The MC&A Plan may be documented similar to the example outlin... 6.1.3.2 The site/facility operator shall identify key measurement points and types of measurements in a process map or description (e.g., plan of the day); transfer operations showing transfer documentation and checks to be performed; and physical in... 6.1.3.3 Procedures referenced in the body of the MC&A Plan or detailed in an appendix may be changed without DOE approval, provided plan commitments and capabilities are not degraded as a result of the change. 6.1.3.4 Procedures shall be established by the site/facility operator for emergency conditions and periods when MC&A systems are inoperative. These measures shall ensure that access to or removal of SNM would be detected during these periods. 6.1.3.5 The MC&A Plan shall describe how MC&A will be implemented following new construction projects and renovations to existing process areas. Changes to site operations shall be evaluated for impact to MC&A programs prior to implementation. 6.1.3.6 The MC&A Plan shall include a description of which MC&A records will be retained and the length of time they will be retained as required by DOE O 243.1B Chg 1 (Admin Chg), Records Management Program. 6.1.3.7 During surveys, DOE line management will further evaluate the Plan by inspecting and testing MC&A elements against the program element objectives, and evaluating overall MC&A system effectiveness.

6.1.4 Personnel Training and Qualification 6.1.4.1 The MC&A Training and Qualification Program should have an overview of the training management and tracking system used to ensure that only qualified personnel perform MC&A tasks. 6.1.4.1.1 The MC&A Training and Qualification Program shall have training that is evaluated at the site level for consistency with DOE policy and needs; this evaluation may be provided by an independent external resource. 6.1.4.1.2 The MC&A Training and Qualification Program shall be documented and: 6.1.4.1.3 Training plans shall be derived from a valid needs analysis and periodically reviewed, at least annually, to ensure that they are current with MC&A jobs requirements. The training plans shall identify: 6.1.4.1.4 Training that meets analysis requirements can be provided by external resources such as commercial vendors or other Government training agencies (e.g., National Training Center). 6.1.4.1.5. A system of managing MC&A training records shall be developed and maintained with: 6.1.4.2 Measurements Training 6.1.4.2.1 In addition to the MC&A Training and Qualification Program requirements stated above, the training needs for personnel who perform sampling and bulk measurements, NDA measurements, and destructive assay measurements shall be documented in a ... 6.1.4.2.2 The measurement or training plan shall include the qualification criteria for acceptable levels of proficiency prior to personnel performing measurements. When changes are made to measurement instruments or methods being used, the associate... 6.1.4.2.3 Measurement personnel who perform destructive analyses shall demonstrate proficiency for each method at least once a day (i.e. day on which measurements are made) or for each batch. It is acceptable to demonstrate re-qualification based on ... 6.1.4.2.4 Personnel shall be knowledgeable of the appropriate standards for each measurement system. Where sampling of bulk material is necessary, personnel shall be familiar with the sampling and sub-sampling programs that are implemented to ensure ... 6.1.5 Change Control 6.1.5.1 The MC&A Plan shall be under change control. Conflicts in upgrading or changing procedures, processes, systems, or software that are integral to MC&A reporting and accountability should be avoided. The procedure development, review, revision... 6.1.6 Incident Investigation and Reporting 6.1.6.1 An incident shall be reported to DOE line management in accordance with the reporting requirements, stated in DOE O 470.4B, Chg 2 (MinChg), Safeguards and Security Program. 6.1.6.2 The site/facility operator’s alarm resolution program shall identify the type of anomaly and its cause. 6.1.6.3 Actions shall be taken to ensure that investigation and resolution occurs in a timely manner.

6.1.7 Performance Testing 6.1.7.1 The site/facility operator shall establish an MC&A Performance Testing Program to evaluate MC&A system elements that can detect a threat in time to detect loss or diversion, as well as elements that assure SNM is properly protected and is in a... 6.1.7.2 Each MC&A system element or elements identified by the MC&A Performance Testing Program shall be tested for effectiveness, covering the range of performance parameters required in the MC&A Plan. These tests, and the number of tests needed, sh... 6.1.7.3 Safeguards and security performance tests involving MC&A system elements shall be performed at least every 365 days (annually not to exceed twelve months). The test shall be based on a comprehensive site or facility threat scenario that demon... 6.1.7.4 The following MC&A system elements shall, as applicable, be tested: 6.1.7.5 The program shall include a comprehensive set of tests and a frequency of testing that confirm the capability of implemented and operating MC&A elements. The scope and frequency of testing shall be based on the graded safeguards concept with ... 6.1.7.6 A description of the MC&A Performance Testing Program shall be provided that includes the development, implementation, revision, and recordkeeping of test plans and the preparation of reports. Recordkeeping of performance tests shall be capab... 6.1.7.7 MC&A program documentation shall address actions to be taken in the event of unsatisfactory test performance. Unsatisfactory performance is determined from criteria specified in test plans. At a minimum, site/facility operator shall develop c... 6.1.7.8 The MC&A program shall be considered in a degraded mode until such testing has confirmed the operability of all applicable performance parameters. Compensatory measures may be required during such degraded modes. System elements shall be eva... 6.1.8 MC&A Assessments 6.1.8.1 The site/facility operator shall establish a self-assessment program to assess the integrity and quality of its MC&A systems and procedures. The program shall determine the effectiveness of the MC&A system, under both normal operations and em... 6.1.8.2 The scope and content of self-assessments shall be graded based on MBA category and be documented with the following topics: 6.1.8.3 The self-assessment program shall have a documented schedule, which will be provided to DOE line management with updates whenever schedule changes are made. In addition to scheduled assessments, assessments shall be conducted prior to start-u... 6.1.8.4 The results of performance tests and the assessments of the above MC&A elements shall be incorporated into an annual evaluation of MC&A system capabilities. This MC&A system effectiveness evaluation shall be used to support the identification... 6.1.8.5 Self-assessments shall be performed by qualified personnel who are organizationally independent of process operations. 6.1.8.6 Findings from MC&A self-assessments, shall be maintained in a tracking system and include a corrective action plan. The corrective action plan shall include: 6.1.8.7 In addition to the assessments described above, knowledgeable personnel, independent of the MC&A organization, shall conduct internal audits to fairly evaluate the MC&A function for compliance with internal plans and procedures. The frequency...

6.2 MATERIAL CONTROL 6.2.2. Graded Nuclear Material Control 6.2.2.1. The nuclear material control measures for Category I locations shall, at a minimum, consist of those measures shown in Table 6.2-4, Nuclear Material Control Measures for Category I SNM. 6.2.2.2. The nuclear material control measures for Category II locations shall, at a minimum, consist of those measures shown in Table 6.2-5, Nuclear Material Control Measures for Category II SNM. 6.2.2.3. The nuclear material control measures for Category III locations shall, at a minimum, consist of those measures shown in Table 6.2-6, Nuclear Material Control Measures for Category III SNM. 6.2.2.4. The nuclear material control measures for Category IV locations shall, at a minimum, consist of those measures shown in Table 6.2-7, Nuclear Material Control Measures for Category IV SNM and Other Accountable Nuclear Materials. 6.2.2.5. The nuclear material control measures for Other Accountable Nuclear Materials locations shall, at a minimum, consist of those measures shown in Table 6.2-8, Nuclear Material Control Measures for Other Accountable Nuclear Materials. 6.2.1 Nuclear Material Categorization 6.2.1.1 The attractiveness level of SNM shall be determined and used to assign category designation to nuclear materials and their locations. The attractiveness level determination is performed before consideration of the irradiation levels. 6.2.1.1.1 Combined with the radiation dose rate, weight and weight percent SNM can enter into a site’s decision to assign a lower attractiveness to an item. If any of the following conditions exist, then the Attractiveness Level of accountable nuclea... 6.2.1.1.1.1 Radiation: Items can be considered highly irradiated and may be protected as attractiveness level E. For radiation to be a mitigating factor, the radiation environment may be taken into consideration after determining the attractiveness ... 6.2.1.1.1.2 Net Weight: Item net weight can be considered, if an item is sufficiently heavy that removal from its location requires the use of special tools or equipment, and those tools or equipment are controlled, locked and alarmed. For weight t... 6.2.1.1.3 Weight Percent: Item weight percent can be considered, if the item contains less than one weight percent plutonium or less than one weight percent U-235, when the uranium enrichment is greater than 20% U-235. However, weight percent shall ... 6.2.1.2. Determination of category involves grouping materials by type, attractiveness level, and quantity. Material quantities are element weights for plutonium and isotope weights for uranium-235 (U-235) and uranium-233 (U-233). For the purposes o... 6.2.1.3. Roll-up is the accumulation of smaller quantities of SNM to a higher category, based upon the categorizations steps listed above. In order to determine the credibility of roll-up, the attractiveness level, quantity and location shall be know... 6.2.1.4 Facility protection strategy changes resulting from changes in safeguards category based on materials holdings at the facility and the credibility of rollup shall be reviewed and approved by DOE line management.

6.2.3. Access Controls 6.2.3.1 The site/facility operator shall identify persons authorized access for each MBA that have a need for access to perform assigned duties, or have a need to access nuclear materials, and shall allow access to only those persons. 6.2.3.2 This list shall be prepared and maintained by the Facility or Building Manager with concurrence by the MC&A Manager. Personnel on an authorized access list shall: 6.2.3.3 The system for controlling access shall consist of procedures and/or equipment, consistent with the requirements in DOE O 473.3A Chg 1 (MinChg), Protection Program Operations, and is capable of detecting unauthorized access and communicating t... 6.2.3.4 The system shall function during normal, as well as unusual and emergency conditions. 6.2.3.5 In defining access controls for nuclear materials, the site/facility operator can designate certain materials, as inaccessible. The following cases are considered inaccessible when accompanied by a justification: 6.2.3.6 For SNM that is accessible, the site/facility operator shall implement procedures to minimize the quantity of material that is not in the storage configuration for the MBA category in which it resides. 6.2.3.7 For each system used for nuclear material accounting data, the site/facility operator shall control access to material control and accounting data and information. 6.2.4. Material Surveillance 6.2.4.1 Authorized locations. Nuclear material locations shall be identified and be consistent with Security Plans and vulnerability assessments. Authorized locations can be fixed, i.e., vault and shelf location; or in-transit between MBAs or offsit... 6.2.4.2 Two-Person Rule. When the Two-Person Rule is used as a material surveillance measure or administrative control, the two authorized persons assigned responsibility for maintaining direct control of the items shall be physically located where t... 6.2.4.3 Daily Administrative Check (DAC). A DAC is a methodology that is used in Category I MBAs to detect anomalous conditions and to determine that SNM is not in unauthorized locations. 6.2.4.4 Tamper-Indicating Device (TID). An item is tamper-indicating when it is constructed or protected with a TID such that a malevolent act cannot be accomplished without permanently altering the item or TID in a manner that would be obvious durin... 6.2.4.5 Process Monitoring. Process monitoring is a methodology to ensure that SNM is in its authorized location and when effectively implemented, it is a useful tool to detect anomalous process conditions and indicate losses of SNM well before the s... 6.2.4.6 Item Monitoring. Item monitoring is a methodology that can be used in Category I and II areas as part of the material surveillance program to ensure timely detection of the loss of items that total a significant quantity. SNM is considered t... 6.2.4.7 Transfers. When nuclear material is transferred from one MBA to another or shipped to or received from an offsite location, checks shall be made to ensure that there are no anomalous conditions. 6.2.4.8 Waste Monitoring. All liquid, solid, and gaseous waste streams leaving a material access area shall be monitored for SNM. 6.2.4.9. Portal Monitoring. Portal monitoring refers to monitoring personnel and vehicle egress from an MAA and PA. 6.2.5 Deactivation and Decommissioning (D&D) 6.2.5.1 D&D for Inactive Facilities 6.2.5.2 D&D for Active Facilities

6.2.6 Termination of Safeguards 6.2.6.1 Safeguards can be terminated on nuclear materials provided the following conditions are met: 6.2.6.2 Terminating safeguards on SNM holdup can occur only after the holdup has been measured and properly credited to the accountability books. Unless demonstrated to be otherwise, the attractiveness level and/or category of SNM in process holdup s... 6.2.6.3 Management of Terminated Materials - The MC&A organization shall coordinate with the Security organization to provide accountability information (Attractiveness and Category) for terminated materials. This includes materials exhumed from wast... 6.2.7 Returning Terminated Materials to the Active Inventory 6.2.7.1 Perform an accountability measurement on the material and use the value obtained as the accountability value. 6.2.7.2 Perform research to establish the history associated with the material: 6.2.8 Overview of Process to Terminate Safeguards on Nuclear Material 6.3 MEASUREMENTS 6.3.1. Types of Measurements 6.3.2. Measurement Methods and Procedures. 6.3.2.1 The quantity of all nuclear material present on inventory shall be determined using measurement methods or measurement services described in the MC&A Plan, unless shipper’s values are accepted with DOE approval. The site/facility operator sha... 6.3.2.2 Procedures for each measurement method shall provide clear direction to the analyst or operator and shall be validated initially and revalidated whenever changes are made. 6.3.2.3 Measurement procedures shall be approved by the MC&A manager or designee, the manager of the organizational unit responsible for performing the measurement, and the person overseeing the measurement control program. The site/facility operator... 6.3.2.4 When a weight or mass measurement method is used for accountability purposes, a daily check of both accuracy and linearity shall be performed. The check shall use standards that bracket the range typical of measurements performed for the mate... 6.3.2.5 When a volume measurement method is used for accountability purposes, the following shall be specified in measurement documentation: 6.3.2.6 Calibration frequency shall be determined by documented studies of system stability or defined by