"User's Guide for Evaluating Physical Security Capabilities of ...

_ - , , _ _ . - y, -,

.. . . . . . _ _ _ - .__

:-'

SAND 77-0082-j NUREG-0184

Unlimited Release NRC-13i

'

|g

'

,

, .USER'S GUIDE FOR EVALUATING PHYSICAL SECURITY ;

CAPABILITIES OF NUCLEAR FACILITIES BY THE '

EASI METH3D'

.i

k

00R BRIG &n' ii

Harold A. Bennett4

. . , y, ~. . . . r? < .y . 7. . ,- . .

, ,|,p,y - ~ =' r$[ ',T '-

* d;}. [,'; A...

n. : ;<< + %; 'g. - s .up a m,.):

.' ='

27. ,

?q% ( ; r , ~ ' ,-< 3% -;.

.

-

- ',. ,

.

! | si;'

m,

n re. . )i

1 ..

m

S EEI;M ['

, -e n ,

__ . - ---- . t: s

. .ma ;- n- --

r w$ 4 e -I;em a g

-- =e-- '- < gg g g

.

;_ 9%@ . - - -).

_ _ _;; 7 . m _ _ _ m m-w,m7_3

]790821 N2 90 539

_

'

'

. m.sm---misii minims-miime i usi

III

.

IIII

Issued by Sandia Laboratories, operated for the UnitedStates Energy Research and Development Administrationby Sandia Corporation.

NOTICE

This report was prepared as an account of work sponsored bythe finited States Government. Neither the United States northe United States Energy Research and Development Administration,nor the United States Nuclear Regulatory Commission, nor any oftheir employees, nor any of their contractors, subcontractors,or their employees, makes any warranty, expressed or implied,or assumes any legal liability or responsibility for theaccuracy, completeness or usefulness of any information, apparatus,product or process disclosed, or represents that its use would notinfringe privately owned rights.

I

'2090 340

32

,

_ _

_

SAND 77-00E2NUREG-0184 Distribution

Unlimited Release Category NRC-13Printed June 1977

_

USER'S GUIDE FOR EVALUATING PHYSICAL SECURITY

CAPABILITIES OF NUCLEAR /ACILITIES BY THEEASI METHOD

_

Harold A. Bennett-

Systems Analysis Division I, 5741Sandia Laboratories

Albuquerque, NM 87115

..

E

Available frcmNational Technical Information Services

Springfield, VA 22161

2090 34I3

-

_ . _ . . .

II

ACKNOWLEDGEMENT

This document was edited by Robert Holmes, Lee Cunningham, and PerryGore, Tech. Reps. , Inc. , under Sandia Laboratories P.O. 05-6554.

IIIIIIII

.

IIIIE

g@ 'c |,

I4

_ . _ . .

TABLE OF CONTENTS

Section Page

1 OBJECTIVE 7

2 BACXGROUND 7_-

3 DISCUSSION 7

3.1 The EASI Method 7

3.2 Selection of Adversary Action Sequence 9

3.3 Selection of Physical Path 10

3.4 Location of' Protective Barriers 12

3.5 Location of Sensors and Probability of Detection 12

3.6 Determination of Adversary Time Requirements AlongSelected Path 13

3.7 Communications 16

3.8 Response Times 164 EXAMPLES 17

4.1 SR-52 Examples 19

Example 1 Case A - Saboteur, Outsider 23

Example 1.A 27

Example 1.8 28

Example 2 Case B - Thief, Insider 29

Example 2.A 33

Exanple 3 Case C - Thief, Outsider 34Example 3.A 38

_ Example 4 Case 0 - Saboteur, Insider 40Example 4.A 42Example 4.B 43

4.2 HP-67 Examples 44

Example 5 Case A - Saboteur, Outsider 45

Example 6 Case C - Thief, Outsider 50

REFERENCES 55

APPENDIX A METHODOLOGY 57

_ APPENDIX B GLOSSARY OF SELECTED SAFEGUARDS TERMS 62

APPENDIX C BARRIER PENETRATION TEST DATA S3

APPENDIX D INTRUSION CETECTION SYSTEMS INFORMATION 67

APPENDIX E EASI PROGRAM LISTING FOR SR-52 73-

APPENDIX F EASI PROGRAM LISTING FOR HP-67 75_

2090 343_

s

__

--

I

ILIST OF ILLUSTRATI0 tis

IFigure Page

1 Example of Facility to be Protected 11

2 Adversary Time-Sequence Path (Example Only) 15

3 Solution Based on Finite flumbers of Response Times 18

4 Texas Instruments, SR-52 Programmable Calculator 20

1-1 Adversary Sequence, Example 1, SR-52 24




5-1 Adversary Sequence, Example 5, HP-67 46

6-1 Adversary Sequence, Example 6, HP-67 51

I~

I.

I

II

III

I

2090 344~

Ie

. ._._ _ _. - --

1. C3JECTIVE

The objective of this handbook is to provide a guide for evaluating physicalsecurity of nuclear facilities using the " Estimate of Adversary Sequence Inter-ruption (EASI)" method and a hand-held programmable calculator. The handbook is

intended for use by personnel at facilities where special nuclear materials (SNM)are used, processed, or stored. It may also be used as a design aid for suchfacilities by potential licensees.

2. BACKGROUND

The Nuclear Regulatory Commission (NRC) has the responsibility for formulatingand implementing regulations for safeguarding the nuclear fuel cycle with regardto both theft of StN and sabotage of vital equipment within the facilities. TheNRC is currently considering a new approach to safeguard regulation directedtoward establishing performar.ce requirements rather than prescribing systemelements. This new approach should provide sufficient latitude and economicincentive for improved safeguards system design; however, a workable system ofdesign, license review, and inspection must be demonstrated to the satisfaction

__ of NRC, industry, and the public before new procedures can be adopted. The EASImethod is a simple technique which can serve as either a physical protectionsystem design aid or as a decision aid in the licensing an'd inspection prccess.

3. DISCUSSION

3.1 The'EASI Method

The basis for the EASI method is that, for resolute theft or sabotage attemptsto be averted at nuclear facilities, the response force * must be notified of theattempt while there is still suff?cient time remaining in the adversary's actionsequence for the force to respcnd and interrupt the sequence. The response forceis assumed to be adequate at least to delay adversary progress until additionalforces arriec to neutralize the adversary. The actual force composition requiredis a function of the threat and must be determined by other means.

.

Although the term response force is used throughout this methodology development,other suitable alternatives to the use of force may be substituted providedthey are adequate to delay adversary progress until the adversary can beneutralized.

2090 34h7

__

_ _ _ . _

II

The EASI evaluation method is a probabilistic approach which evaluates theinteraction of basic functions of the physical protection system (detection,assessment, comunications, and delay) with guard response time and providesan estimate of adversary sequence interruption. These functions will be dis-cussed as they are encountered in the development of the evaluation procedure.The mathematical methodology for the EASI method is contained in Appeadix A,

and a glossary of selected safeguards terms is contained in Appendix 8.

The steps for applying the EASI method are: ga. Obtain, or develop, a site and plant layout, including design and 3

operational characteristics, in sufficient detail to identify adversary

targets as a function of hypothesized adversary goals, motivationsand attributes.

b. Generate adversary action sequences relevant to the targets identified.,

c. Define the physical paths corresponding to the selected action sequenceand choose a specific path, or set of paths, for analysis,

d. D*rmine locations of dete. ors and delay mechanisms along the selectedpath.

e. Obtain data for the probabilities of detection for all detectors and the

probability of communication success.

f. Obtain the means and standard deviations of the time for each of theadversary tasks.

g. Obtain the mean and Oi.andard deviation of the security force responsetime.

h. Perform the necessary calculations, using a hand-held programmable cal-culator and the input data determined to be applicable for the selectedadversary path, to determine the probability of interruption.

i. Analyze other possible paths using the same technique in order todetermine if any paths produce an unacceptably low probability ofinterruption. If so, then such information should be considered in

Eformulating the safeguards adequacy statement for the existing facility su

or proposed design.

j. During the design of a physical protection system, if unacceptably lowprobabilities of interruption are encountered, change input parameters;

I2090 346

Ie

.

,.

-4 .

e.g., security force response time, communications probability and' detector probability, one at a time to determine the impact ofsuch changes on the overall probability of interrupting theadversary sequence.

3.2 Selection of Adversary Action Sequence

In the context of nuclear facility safeguards, the adversary action sequenceswhich should be considered will both begin and end at some point at or interior

. to the outermost facility boundary. The two primary functional objectives ofthe facility safeguards system are:

Protect against the _i_n, situ release of radiotoxic material into an- n

inhabited environment and

Protect against the successful removal (theft) of StN from the facility-

boundary.

Action sequences should be defined which cover all possible generic adversaryactions that may lead to the failure of the above objectives and for which measuresof safeguards effectiveness can be defined. An exhaustive set of terminations forthese sequences which, if protected against, would insure the accomplishment of

,

the two primary objectives are:

Unauthorized removal of StN from the facility boundary.-

Acquisition of (autonomous control over) radiotoxic or special nuclear-

materi al .

Intentional compromise of subsystems or components which control the-

release of radiotoxic material.

In addition to these requence terminations others which should be consideredindependently in orcer to pmvide protection in depth and balanced protectionagainst multistaged adversary actions are:

Unauthorized access to both SNM locations and subsystems or components-

which control the release of radiotoxic material. '

Authorized adversary access to both SNM locations and subsystems or ccm--

ponents which control the release of radiotoxic material.

Protection against authorized adversary access is considered to be a respon-sibility of plant management and national clearance procedures, both of which try to

%

2090 3479

_

II

prevent granting authorization to a potential adversary through the use ofbackground checks, clearances, reliability checks, etc.

Action sequences generally are initiated at any transition from an autho-rized to an unauthorized act. Individuals having no authorized access generallyinitiate action sequences external to facility boundaries.

Employees with some type of access authorization may initiate a sequence atany boundary interior to the facility boundary. An exhaustive set of adversaryaction sequence evaluations should consider sequences which initiate at eachlevel or category of authorization and which terminate at those conditionswhich have been outlined.

The set of adversary attributes which must be considered for any selectedaction sequences is generally limited by the capability of the safeguards systemwhich exists exterior to the boundary at which the unauthorized action initiates.-

For example, adversary numbers and resources (tools, high explosives, training.etc.) for any unauthorized act beginning at the facility boundary would be limitedby the ability of a national, regional, or local safeguards structure to detect,assess, and neutralize any adversary preparation, training, collection of resources,etc. On the other i.:nd, the numbers of adversaries with some acas authorizatin

would be limited by the capability of the personnel clearance, and their resourceswould be limited by portal contraband detection systems.

The attributes which describe the adversary should include such items asnumber, training, weapons, information, transportation, hardware resources, etc.The description of these adversary attributes along with the facility description

and other environmental constraints determines the performance of the variouscomponents of the safeguards system. These measures of component performance

are then the inputs to the EASI model to analyze any physical path which hasbeen selected from a given generic adversary action sequence.

3.3 Selection of Physical Path

Following the selection of an adversary action sequence, the next considera-tion is devoted to the selection of a physical path. Figure 1 is presented both asan example of a facility to be protected and as the facility used for the

numerical examples which fellow. The location of the special nuclear materials

and/or vital components are indicated. The starting point for a path is defined

I2090 348 I"

. . . . _

x x x x X : x ; 1

1 1Security Fence

x. x

x x

x x..

x x

x n._

1. A

1 Building Entrance'

(Locked rear door)Building Entrance x

(Front) N J

- f

x Gate Guard--

x

porgog -Vltal Component/ v

__

Entrance Gate x^

-- Access Rcod N Locked x'Special Nuclear

Materials Location M \ toeg,qy< Ocorb

'a

*Response Force *8---8 '

Locarlon -

__

x Electric Fence x

-Armored Door__

x x--

- x ;

_a - x x x x -x x x : x x

..

_

Figure 1. Example of Facility to be Protected_

--

2090 349 u

--

_ _ _ . . . . .

II

as the point where an unauthorized act comences; e.g. , penetrating the boundaryfence. The terminal point for a path is defined as the point by which adversaryprogress is to be stopped. It could be the location of the SNM or vital component,or the plant boundary. With a starting point and a terminal point designated bythe adversary action sequence classificction, the remainder of the path must beselected for analysis.

3.4 Location of Protective Barriers

The protective barriers for the facility should be identified and located on

the facility layout. In Figure 1, the barriers could be: (1) the security fence,(2) the locked exterior doors to the building, (3) an electric fence around theSNM access area, (4) the armored door to the SNM room, (5) the locked door t'athe vital component room, and/or (6) the locked door to the SNM room.

Some determination must be made of the time required to penetrate protective.

barriers. The purpose of Appendix C is to provide some general guidance basedupon a limited amount of actual test data.

3.5 Location of Sensors and Prob 6bility of Detection

Detection systems are compos.d of sensors, signal comunications, assessmentmethods, information display and control units, and power supplies. The purposeof detection systems is to w cover adversary actions such as unauthorized entryattempts into the facility or into particular areas within the facility, smuggling ofcontraband into the facility, and theft of SNM.

The performance of any detection system depends strongly on the followingfactors:

The applicability of the sensor type to the required task-

The compatibility of the equipment with the physical and environmental-

conditions within which the system must function

The installation design and maintenance procedures.-

An " Intrusion Detection Systems Handbook"1 has been published to provide

guidance and procedures covering the above factors for intrusion detectors.

I2090 350 g

Iu

-

. __

While these same factors should apply to portal control detecticn systems for_ contraband material and SNM, the state of the art has not yet progressed to the

point of producing a similar handbook. Information extracted from the " IntrusionDetection Systems Handbook" is contained in Appendix D. This Appendix shouldprovide the reader with a general knowledge of intrusion detection systems.

In the EASI method the location of each sensor should be icentified 1tndlocated on the facility layout. In Figure 1, the sensors could be: (1) closedcircuit TV coverage of the area between the fence and the building, (2) a mag-netic switch on the locked external building doors, (3) a strain sensing deviceon the electric fence, (4) an employee or guard within the building, (5) alaruson the internal doors leading to the vital component or SNM rooms, and (6) neutronand gamma ray detectors at one or more locations. The probability of detec: ion

-- for each sensor should be determined based upon test data describing the operationof the sensor within the particular environment.

Contained in the probability of detection cre: (1) the probability that thedetector will sense abnormal activities, (2) the probability that this indicationwill be transmitted to an evaluation point; e.g., some control station, and(3) the probability that a valid signal is so declared. If these probabilitias

of each activity are independent, the overall probability of detection, P(d),can be calculated as

P(d) = P xP xPs t y

where

P is the probability the sensor detects the abnormal activity, P is thest

_ probability that a signal is transmitted, and P is the probability that thesignal is declared to be valid. If P = 0.8, Pt = 0.9, and P = 0.95 thes y

solution for P(d) is 0.684.

3.6 Determination of Adversary Time Requirements Along Selected Path

After determining the path and locating the barriers and detectors on thispath, the time required for the adversary to perform each task along the pathfrom the starting pr int to the terminal point must be identified. All adversary

2090 351,

-- Lu/u 33u_

13

_

. . . . _

II

task times are defined in terms of their means and standard deviations. A time-sequenced path could be developed as shown in Figure 2. Not? that adversary task

time divisions occur at each sensor. The estimate of mean times {E(t ), i variesjfrom 1 to 7 in Figure 2, will normally be based upon analyses and/or tests con-ducted by the ev 'uator/ investigator. For example, if results from six tests

indicated that it took 7, 5, 3, 6, 4 and 5 minutes for the assumed adversary toopen the external door, the mean time would be -

.

E(t)=h t (1)4 j

w'.ere E(t ) is the estimate of mean time for t on Figure 2, n is the number of4 4tests, and t is the time for each test, for n equals 1 through 6.j

' With the six test times given above, the solution is E(t ) = (7+5+3+6+4+5)/6 =45 minutes.

The standard deviation, is determined by

~

n

a(t ) = [tj-E(t)|2 t/2 (2)4 4J=1

_

where c(t ) is the standard deviation for t on Figure 2. With the six test times~

4 4given above, the solution is c(t ) = {{(7-5)2+(5-5)2+(3-5)2+(6-5)2+(4-5)2+(5-5):}/6] /2

41.29 minutes.=

For a normal distribution (based upon a large number of tests), the standarddeviation would include approximately 234 percent of all of the test times,about 68 percent of the test times would be within 2 one standard deviation asshown below.

I' ' I

lo_ _ lo _

_--

| ~34% ~ 34*, Iw ,

0 l Mean t oo

2090 352 m14 g

um suus m umm usur m ung mum umm aums uum suum muur immu w ' umus - - -

.

STARTING TERMINALPolNT SENSORI SENSOR 2 SENSOR 3 POINT

i i il 2 3 4 5 6 7, , , ,, . i i i -

i .Penetrate Troval Across Continue Troval Open Tro9el to Open Achieve

Fence Open Area to External Door internal Door Internal Door ObjectiveExternal Door

E(t,) E(t,) E(t ) E(t) E(t) E(f.) E(t,)3 o

g(t,) o(t,) g(t) o(t ) o(t ) o(t) g(t,)3 o o

Figure 2. Adversary Time-Sequence Path (Example only)

NOWO

wL7U

$

3.7 Communications

The analysis of the probability of communication, P(C), to the response force,starts with an analysis of each comunication system employed. For independent

systems; e.g., where a warning signal is sent by two or more independent pathssuch as hard-wire transmission and radio, the overall probability of receivingan alarm (from at least one of two independent transmission methods) is

P(C) = [1 - (Pfa * Pfb)] (3)

Iwhere P(C) is the probability of communication system success (at least one signalis received), P is the probability that the signal from comunication system Afawill not be received (hard-wire transmission for example), and P is the probabil-fbity that the signal from communication system B will not be received (radio trans-mission for example).

The probability of failure is equal to one minus the probability of successE

for each system; i .e. , Pf=1-P. If the probability of successfully trans- 5smitting a signal by hard-wire is P = 0.9 and the probability of successfullysa

transmitting a signal by radio is Psb = 0.8, the probabilities of failure arePfa = 0.1 and Pf3 = 0.2, respectively, and P(C) = 0.98.

For three systems in parallel, the probability of comunication P(C), receivinga signal from at least one system, is an expansion of (3), or

P(C) = [1 - (P xPfb x Pfc)l (4)fa

(Note that this calculation is different from P(d) where all actions had tosucceed, not just one.)

3.8 Response Times

The time required for the response force to travel to the terminal pointmust be evaluated. Again, depending upon the specific adversary action sequencebeing considered, the terminal point may be the location of the SM4 or the vitalcomponents, the facility boundary, or another specified position. An estimate ofthe expected response time (E(t )} and the standard deviation of the respoase timec

II

2090 354

(c(t }} must be determined. These times are calculated in a manner similar tor

adversary times (3.6); however, for each path selected, only one pair of timesfor E(t ) snd a(t ) is used in the EASI method. The response time should include

r r

(1) the time delays in receiving a system alarm, (2) the time required to assessthe warning, and (3) che time required to travel to the terminal point. The

evaluator / inspector must analyze the locations of the response force and theterminal point, the method of operation for such forces, and other time delaysin arriving at times for E(t ) and c(t ). Tests may be conducted under several

r pdifferent conditions and the response times evaluated in a manner similar toadversary times.

4. EXAMPLES

The EASI program is utilized to obtain the probability of interrupting theadversary sequence for: (1) a particular adversary path, (2) a specifiedex;:ected time and standard deviation for the response time, (3) one probabilityof communications, (4) specified probabilities of detection for each sensor,and (5) specified expected times and standard deviations associated with each

adversary task. The estimate of adversary sequence interruption probabilityobtained as a solution with the specified inputs is primarily useful as a numberwith which .to compare other solutions based upon different input data. As anexample, if several solutions are obtained by using different response times(and holding other parameters constant), the results could be plotted as shownin Figure 3. The EASI program, coupled with a computer with a graphic output,is designed to provide the evaluator with this plotting capability; however,evaluations with a hand-held calculator are limited to a reasonable number ofsolutions.

After collecting the input data discussed in Section 3, an estimate ofadversary sequence interruption can be obtained by the use of the EASI programand a hand-held programmable calculator. Programs and examples of their usehave been developed for the Texas Instruments, SR-52 and the Hewlett-Packard,

HP-67 programable calculators. Basic examples of the use of the EASI programon these two calculators are provided in the following paragraphs. Theseexamples are illustrative and the data used should not be construed as typicalvalues.

2090 355

17

IIII

- I.

1.0

0.9 -

,5 0.8 -

0.7 -

0.6 -

+ 0.5 - *

0.4 -

-

2 0.3 - x

0.2 -

- x

x*Nx0.1 -

I , I i l i I ' '! ,; ,' i ,

02 4 6 8 10 12 14 16

Response Time (minutes)

Figure 3. Solution Based on Finite Numbers of Response Times

III

I2090 356

. _ _ _

_

_

4.1 SR-52 Examples

The following basic examples, along with several modifications to thesebasic examples, were run on the Texas Instruments SR-52:

_

Example Situation

1 Case A - Saboteur, Outsider2 Case B - Thief, Insider3 Case C - Thief, Outsider4 Case D - Saboteur, Insider

.

The SR-52 programmable calculator is shown in Figure 4. Most of thekeys on the SR-52 are double labeled -- a label on the key itself and onejust above it. These keys have two functions; the first function is denotedby the label on the key and is activated simply by depressing the key, the

'

second function is the label above the key and is activated by depressingthe 2nd button and then the function key. For example, to activate the

'

A' function, depress the 2nd button followed by the flIl button.

To store the contents of a program written on magnetic cards into thecalculator the following procedures apply:

a. Turn power on (located at the top, right side).

b. Read side A of the selected magnetic card as follows:press CLR then 2nd then read keys and insert the card

in the lower slot located on the right hand side of the calculatorwith the $rAim pointed to the left as shown on Page 21. Do notrestrict or hold the card after it is caught by the drive motor.The display will remain blank until the calculator has completed-

reading side A.

.

2090 357_

19_

. . _ _ . . . .

III

fg hT,'[i;,(''' M' Ikk /) ' "f''hh N

P

ld}{b t'P , | p' | .i

t it ii ' ' j f'il it! '' .q'i

/ tb h.h 4. /'M,'i I I l 'm'n

. . ..

h TaxAs lusTRUMENTS SR-52

MA' 5' L'

. .O' . F'

. ,'l

,

g,

:.. : e ,,,.

.

IND D MS D/4 P' R vi-~

A 3'

i S L .. . C.dAi Eu . P 6eO D f-

' S}h ( f$h' h h h n-s,r, '' : ,r . . m . .l |

=,

, , . . . , , ,. I o,,. ; - a.,'.

.e. .. o . . .. . . . . . . . . .

'..

.

..,. .

.

. - , ,,

. . , ._ ,

,s. ... :._: 4e E

. I i 2 4'.e

~% ivi : rii E nr M- g+/- -Q Rh@ ~. 0 .

rreras s mssm uts w w m$ g

P00R ORIBINAL iFigure 4. Texas Instruments, SR-52 Programmable Calculator

I20

2090 358 |

. . _ . _ . .

v y mpp n m y-tsp 23 m :>~-mqwe sm ;._ .~ nmm _ . , ..

_

,' if".. , . . |*' ~ * ~'''

,

..;.y ~ - -

,

-- ,

'.|Y',

'':'y

t,1 ,,

e.. . gg

^h

s

-

c. After the drive motor stops, remove the card from the left side ofthe calculator and insert it into the upper slot on the calculatorso that side A of the card shows in the window above keys Tthrough T , as shown below.

, - . _ . . , . . , ,,,.r.... ,,_,._y,_,_ - , .._, y's : , ^;. <

[ ce ."

#'

:..fit g,

,

^

k(q?N ?':' ,

'd,

nxk; -

U;;m ! . y: .

| -* '

.

yJ 1

_ .' li@.

<7.. ;s;7 , ':J'+

,

.l

~. >:' a -s

h.Ti ., e,

-* .4, -.,s;-

.h .

<

21

. _ .. .. . . . . _ _ .. . . . .. .

.. _

Id. If the display flashes immediately following step b repeat the

procedure. If difficulty persists, refer to " Maintenance and ServiceInformation" in the owner's manual.

The program is now loaded into program memory and will remain thereEuntil the calculator is either turned off, another card is read, or a

new instructions are keyed in by passage to the learn mode (LRN button).

The magne cards have the ability to retain information placed onthem ivr- an indefinite amount of time. The recorded information doesnot tend to fade or weaken with age and will remain unchanged untilactually altered by an external magnetic field. While the magneticsignal will not deteriorate, the physical characteristics of the cardand the card drive unit in the calculator are susceptible to damage.

CAUTION: Prerecorded magnetic cards may be damaged or altered ifexposed to dust or foreign materials, permanent magnets, or electro-magnetic fields such as near electric motors or power transformers.

(Note: The EASI Program for the SR-52 is_ listed in Appendix E.)

w-

IIIIII

w a

I22

- - - - -

'h' # #f/ N $p f4%'#e* 4#s te. e. ev <e 1,.

TEST TARGET (MT-3),

.

'

1.0 'd Ba DMS B3 Enmm

|,| * |||b -

|| l.8 <

I.25 I.s I.c ,

< 6~ =

4;#4)/ #Ss+a%s,e4#

f,,,//xA

_. _

d++k>gETAs<s'*es

, e .. <e _TEST TARGET (MT-3),

.

'

l.0 EEE E4|# zu lli=n=m

|,| I# U{!Nl.8 1

1.25 1.4 1.6 ,

c 6"

4% <* *b'

*S$#h#. </>M3A

b/s_

#g> !Q -

b Y?///~$kg/g< #++4> 'e_e .. <e 1,.

TEST TARGET (MT-3),

.

E m g m$A'

e su :,

|,| * |!!b '

.8 1

1.25 1.4 1.6 .

_ r

c 6"

#4 4$ 4Af:/,3,f/ '4kA////A

s , , 77 .pv +

6%p WQ ~

<>+,,kk k< #'

's. .E E - ,, -

TEST TARGET (MT-3),

.

'

l.0 d' En E45m nam na -

* ||!!N|,| p

M '

l.25 1.4 1.6 ,

,

.

< 6"

4% ++4%

# '* 3 $h 4+W, ,Azzz),# 44,_

, , ,

. _ _ .

.-

- EXAMPLE 1

CASE A - SAB0TEUR, OUTSIDER

_ The path chosen for analysis is shown in Figure 1-1 and has the followingsequence:

1. The adversary penetrates the boundary fence, t , crosses the area between,

i

the fence and the facility's main building, t and t , and reaches locked2 3

exterior door.- 2. While outside, the adversary is subject to surveillance by CCTV, (Sensor 1).

3. After penetrating the exterior door, t , (Sensor 2), the adversary continues4along a corridor to a second locked door, t '-

54. The adversary penetrates this locked door, t ' (3' :or 3) and enters a room

6containing the vital component,t .

7

The adversary time-sequence path (in minutes) is shown below:

__

Penetrates TravelPenetrates Cross Open Area Locked Door to Door

Fence 1 2S1 S2

t 7 t t 7 tt t, ,.

1 2 e 3 4 5--

i . .s. i

E(t ) = 2.0 E(t ) = 1.0 Elt ) = 1.0 E(t ) = 3.0 E(t )= 0.5 \l 2 3 4 5,

c(t ) = 0.5 c(t ) = 0.2 c(t ) = 0.2 c(t ) = 0.3 c(t )= 0.1 /t 2 3 4 5.- ,

,-------.. _n ----. _ ---.sw /

| .

!I

--

1 Penetrates Travel to Terminal Point__

1 Locked Door (Vital Component)\ 2 S3 + Time to Achieve Final Objective

7 t- s ~; 6 7 it

E(t ) = 3.0 E(t ) = 0.16 7

c(t ) = 0.3 c(t ) = 0.026 7_

.

._

.-

; 2091 001 u

. _ _ . . _ . _

IX X X X X X X X X X ; X

X'

i nSecurity Fence g

X X

X X

IX X

SENSORI

X Xg

l\STARTINGg POINT 3.

's'' /

* / X

-

>/X Building Entrance Building Entrance X-

(Front) N J (Locked rear door)-

# I

xOooteG.o,d 1 SENSOR 2x

' - Vitof ComponentPortal

Entrance Gote g t g

SENSCR 3 - I

b Access Road NX j Locked gOcorSpecial Nuclear

Materlois Locotton

{' DoorgResponse Force Jr x-s .

I

Locollon -

X Electric Fence x

-Armored Door

X X

X ;

i X X X X X X X X X X..

Figure 1-1. Adversary Sequence, Example 1, SR-52

|2091 002

.. __

NOTES:

1. Adversary times must be divided at sensor locations; e.g. , the time to crossthe open area, t +t , is arbitrarily divided in half in this example under2 3the assumption that the TV coverage, Sensor i, will detect movement closeto the middle of the open area.

2. The detection probabilities P(d) for the three sensors are: S1 = 0.3,S2 = 0.97, S3 = 0.97.

'

3. The communication probability P(C) is 0.9.4. The response time of the security force is E(t ) = 4.0 minutes with a

r

c(t ) = 0.16 minutes.r

With the given input information, the estimate of adversary interruptionis calculated as shown below:

Press DisplayStep Procedure (In Order) Indicates

1 Enter Program (A)* 03_

2 Initialize Program E O

3 Enter Expected Response Time, E(t ) 4, 2nd, A' 4p4 Enter Standard Deviation of 0.16, 2nd, B' O.0256

Response Time, a(t )p

5 Enter Probability of Communication, 0.9, 2nd, C' O.9P(C)

6 Enter Expected Time for Task 7, 0.1, A 0.1- E(t )-Closest to Terminal Point7

7 Enter Standard Deviation for 0.02, B 0.0004.

Task 7, o(t )7

^

8 Enter Sensor Probability of 0.97, C 1.213122282-18**_ Detection P(d) for S3

9 Enter Expected Time for Task 6, 3, A 3

E(t )6-- 10 Enter Standard Deviation for 0.3, B 0.09

_

Task 6, c(t )6

11 Enter Expected Time for Task 5, 0.5, A C..- E(t )S

12 Enter Standard Deviation for 0.1, B 0.01Task 5, c(t )

5~

13 Enter Sensor Probability of Detection 0.97, C 0.1120440888**= P(d) for S2

(Continued on Next Page)

; 2091 003- 25

--

. _ . . . . . . . .

Press DisplaySteo Procedure (In Order) Indicates

14 Enter Expected Time for Task 4, 3, A 3

E(t )4 E15 Enter Standard Deviation for 0.3, B 0.09 3Task 4, c(t )4

16 Enter Expected Time for Task 3, 1.0, A 1

E(t )317 Enter Standard Deviation for 0.2, B 0.04

Task 3, c(t )3

18 Enter Sensor Probability of Detection 0.3, C 0.352***P(d) for S1

*If the SR-52 has been turned off, the EASI program must be reentered. If

the SR-52 has not been turned off, press the E button and proceed withStep 3.

** Blank for a few seconds before number displayed, do not press another keyuntil number appears on display.

***This number is the probability of interruption (rounded from 0.3517906773).

NOTES: (1) Adversary times and sensors are entered in order from the terminalpoint, not the starting point. g

(2) The times for E(tg) and E(t ) assumed that the sensor point of 33detection was halfway (in time) between the fence and the door.(3) Adversary times which are closer to the starting point than the

first sensor are not part of the solution.

I

IIIII

200 0" IIx

- . . - - - . . -_ . _ _ __

EXAMPLE 1.A.

For comparison purposes, suppose the first sensor was replaced by animproved TV system with automatic alarm features and with a probability ofdetection of 0.8. The new solution is as follows:


1 Enter Program (A)* 0


3 Enter E(t ) 4, 2nd, A' 4r

4 Enter o(t ) 0.16, 2nd, B' O.0256p

5 Enter P(C) 0.9, 2nd, C' O.96 Enter E(t ) 0.1, A 0.177 Enter c(t ) 0.02, B 0.000478 Enter P(d) for S3 0.97, C 1.213122282-18**9 Enter E(t ) 3, A 36

10 Enter a(t ) 0.3, B 0.09611 Enter E(t ) 0.5, A 0.5S

12 Enter c(t ) 0.1, B 0.01513 Enter P(d) for S2 0.97, C 0.1120440888**14 Enter E(t ) 3, A 3415 Enter a(t ) 0.3, B 0.09g

16 Enter E(t ) 1.0, A 1317 Enter o(t ) 0.2, B - 0.04318 Enter P(d) for Sl 0.8, C 0. 751 ***

*If the Sh-52 has been turned off, the EASI program must be reentered. If the_ SR-52 has not been turned off, press the E button and proceed with Step 3.

** Blank for a few seconds before number displayed, do not press another keyuntil ne%er appears on display.


_

_

__

2091 005 n

_ _ _ _ _ _ _ _ _ _ ____ ____ _ _ - .

EXAMPLE 1.B

For comparison purposes, change Sensor 1 back to the original P(d) = 0.3but reduce the security response time to E(t ) = 2 min with c(t ) = 0.16 min;

r r

e.g. , by moving response force closer to vital component. The new solution

is as follows:


1 Enter Program (A)* O

2 Initialize Program E 0,

3 Enter E(t ) 2, 2nd, A' 2c4 Enter c(t ) 0.16, 2nd, B' O.0256r

5 Enter P(C) 0.9, 2nd, C' O.9

6 Enter E(t ) 0.1, A 0.17

7 Enter c(t ) 0.02, B 0.00047

8 Enter P(d) for S3 0.97, C 0.0000000017**

9 Enter E(t ) 3, A 3610 Enter c(t ) 0.3, B 0.096

11 Enter E(t ) 0.5, A 0.5S

12 Enter c(t ) 0.1, B 0.01S

13 Enter P(d) for S2 0.97, C 0.8725898641**

14 Enter E(t ) 3, A 3415 Enter c(t ) 0.3, B 0.09416 Enter E(t ) 1.0, A 1

317 Enter c(t ) 0.2, B 0.04

3

18 Enter P(d) for $1 0.3, C 0.907***

*If the SR-52 has been turned off, the EASI program must be reentered. If theSR-52 has not been turned off, press the E button and proceed with Step 3.

** Blank for a few seconds before numoer displayed, do not press another keyuntil number appears on display.


Therefore, changing the security force response time from 4 minutes to2 minutes increases the probability of adversary interruption from 0.352 to 0.907.

I

2091 006u

. . . - - - --

EXAMPLE 2..

CASE B - THIEF, INSIDER

The path selected for this analysis is shown in Figure 2-1 and containsthe following sequence:1. An employee has authorized access to the material access area (MAA) where

- special nuclear materials are stored (he may be observed by other employee (s)and a report may be made, Sensor 1).

2. He attempts to steal some SNM, t .i

3. He exits the door to the MAA, t , (where he may again be observed by other'

2employee (s) who may report thr: incident, Sensor 2).

4. He travels through the buildi19 to the guarded portal, t , and enters the3

portal, t , (where he may be detected by neutron and gamma ray sensor,4

Sensor 3). He exits the dcorway, t ; crosses the facility grounds, t iS 6

and passes the guard station, t , (where a less sensitive radiation detector7

may sound an alarm, Sensor 4).

; 5. He then exits the facility through the entrance gate, t , (which is con-8

sidered to be the terminal point).

The adversary time-sequence path (in minutes) is shown belcw:

Obtains SNM Exits MAA Travel in Enters ExitsBuilding Portal Doon<ay

S1 S2 S3

7 t t 7 t i t 7 t.1 2 3 4 5

.i . . . ig

E(t ) = 0.2 E(t ) =0.1 E(t ) =0.6 E(t ) =0.5 E(t ) =0.5l 2 3 4 5

c(t ) = 0.02 c(t ) =0.01 c(t ) =0.06 c(t ) =0.05 c(t ) =0.05 It 2 3 4 S!

/'p_.-----._____,_._._-

_. ,,/ Passes Travel to

Crosses Guard Tenninal-- Open Area Station Point

(Entrance\ S1 Gate)

t t t6 7 8 |

E(t ) = 1.5 E(t ) =0.5 E(t ) =0.5S 7 8-- c(t ) = 0.2 c(t ) =0.05 c(t ) =0.056 7 8

2091 007 29

_ _ . _ . . .

e

x x x x x x x x x x -x x

x ISecurity Fence

x x.

x x

x x

x x

x 1,

x x

SENSCR3

[(Building Entrancex Building Entrance x

% J Locked rear door)(Front)'g&Qg4~~~m__w* g

x vote Guard | ,

|t TERMINAL PolNT lPortal f -Vital Component/ v

,

iEntrance Gate j x

% % NAccese Road Locked gDoorSpecial Nuclear

_ % SORIMaterlois Location * N, Locked

JDoora

Response Force Jr x-u

Location - STARTING POINT

Electric Fencex x

- Arm ore d Door

x x

x ;,

: x x x x x x x- : x x.,


2091 008

...-. -__

NOTES:

1. The P(d) for Sensors 1 and 2 is 0.1, P(d) for Sensor 3 is 0.65, andP(d) for Sensor 4 is 0.25.

2. The probability of communication P(C) is 0.9.3. The estimate (mean) of the response time E(t ) is one minute and the

r

standard deviation o(t ) is 0.2 minutes.r

With the above input information, the estimate of adversary interruptionis calculated as shown belew:

Press DisplaySten Procedure (In Order) Indicates



3 Enter Expected Response Time, E(t ) 1, 2nd, A' 1c4 Enter Standard Deviation of 0.2, 2nd, B' O.04

Response Time, o(t )r

5 Enter Probability of Comunication, 0.9, 2nd, C' O.9P(C)

6 Enter Expected Time for Task 8, 0.5, A 0.5E(t )8 ~

7 Enter standard Deviation for Task 8, 0.05, B 0.0025-- c(t )8

8 Enter Prcbability of Detection, 0.25, C 0.0035856163**P(d) for S4

9 Enter Expected Time for Task 7, 0.5, A 0.5E(t )7 ' "'~~~''' ~

10 Enter Standard Deviation for Task 7, 0.05, B 0.0025c(t )7

11 Enter Expected Time for Task 6, 1.5, A 1.5E(t )6

12 Enter Standard Deviation for Task 6, 0.2, B 0.04o(t )6

13 Enter Expected Time for Task 5, 0.5, A 0.5E(t )S

14 Enter Standard Deviation for Task 5, 0.05, B 0.0025c(t )S

15 Enter Probability of Detection, 0.65, C 0.5864320696**P(d) for 5 3

16 Enter Expected Tira for Task 4, 0.5, A 0.5_

E(t )4


2091 009q 31

-_

_ _ - . . . . .

Press Display_Steo Procedure (In Order) Indicates

17 Enter Standard Deviation for Task 4, 0.05, B 0.0025o(t )4

18 Encer Expected Time for Task 3, 0.6, A 0.6E(t )3


20 Enter Probability of Detection, 0.1, C 0.6".36986804**P(d) fcr S2

21 Enter Expected T'me for Task 2, 0.1, A 0.1E(t )2 g

22 Enter Standard Deviation for Task 2, 0.01, B 0.0001 ga(t )2

23 Enter Expected Time for Task 1, 0.2, A 0.2E(t))

24 Enter Standard Deviation for Task 1, 0.02, B 0.0004a(t))

25 Enter Probability of Detection, 0.1, C 0.658***P(d) for S)

*If The SR-52 has been turned off, the EASI program must be reentered. If

the SR-52 has not been turned off, press the E button and proceed withStep 3.

** Blank for a few econds before number displayed, do not press another keyuntil number appears on display.


II

n

.

200 010u

. . . . - . . . _ _ -_

EXAMPLE 2.A

For comparison purposes, delete Sensor 3 at the portal exit and renumberthe three sensors to see how this would affect the probability of interruption.The solution be:omes:

Press DisplaySteo Procedu g (In Order) Indicates


2 Initialize Program - E O

3 Enter E(t ) 1, 2rd, A' 1p4 Enter o(t ) 0.2, 7.nd, B' O.04r

5 Enter P(C) 0.9, 2nd, C' O.96 Enter E(t ) 0.5, A 0.5g7 Enter a(t ) 0.05, B 0.002588 Enter P(d) for S 0.25, C 0.0035856163**39 Enter E(t ) 0.5, A 0.57

10 Enter c(t ) 0.05, B 0.0025711 Enter E(t ) 1.5, A 1.E612 Enter a(t ) 0.2, B 0.04613 Enter E(t ) 0.5, A 0.5S

14 Enter c(t ) 0.05, B 0.0025S-

15 Enter E(t ) 0.5, A 0.54- 16 Enter c(t ) 0.05, B 0.00254

17 Enter E(t ) 0.6, A 0.6318 Enter c(t ) 0.06, E 0.0036319 Enter P(d) for 5 0.1, C 0.0932629073**220 Enter E(t ) 0.1, A 0.1221 Enter c(t ) 0.01, B 0.0001222 Enter E(t)) 0.2, A 0.223 Entera(t)) 0.02, B 0.000424 Enter P(d) for Sj 0.1, C 0.175***

~

*If the SR-52 has been turned off, the EASI program must be reentered. If theSR-52 has not been turned off, press tne E button and proceed with Step 3.



_ 2093 Hh33

_ _ . . . _ _ . _

EXAMPLE 3

CASE C - THIEF, OUTSIDER

The path chosen for this analysis is shown in Figure 3-1 and contains thefollowing sequence:1. The adversary penetrates the boundary fence, t , crosses the open area

l

t2 and t , to the tuilding door (where he may be detected by Sensor 1,3

assumed to be one-half way bev fence and the door).2. He penetrates the buildi .g door, t , which is protected by Sensor 2.43. He travels through the building and reaches the door to the materi-

access area (MAA), t *S

4. He opens the door to the MAA, t , which is protected by Sensor 3.6

5. He obtains the special nuclear material and exits the MAA, t ; travels7

down the hall and exits the external door, t , (where a radioactivity8

detector may detect the SNM, Sensor 4).6. He crosses the open area, t and t10, where he may be detected by the TV,g

Sensor 5 (same as Sensor 1).7. He exits through the security fence and escapes, t

it.

The adversary time-sequence path is shown tielow:

.II

Outer Door | Travel inPenetrates PenetratesPenetrates -

Crosses pen Area Building Inner Doors 3Fence g

7- st U t2 6 3 i. t te i.

tt 4 6--

1 ' , .-

E(t ) = 2.0 E(t ) = 0.5 E(t ) = 0.5 E(t ) = 3.0 E(t ) = 0.7 E(t ) = 5.0 \l 2 3 4 S 6 \

c(t ) = 0.3 c(t ) = 0.0 c(t ) = 0.05 c(t ) = 0.3 c(t ) = 0.2 c(t ) = 1.0 Il 2 3 4 5 6

//

___ ___-,----------w__/

( Obtain SNM Travel, Bldg. Crosses Open Area Exits Through|&ExitsMAA ence

& Exit SA 55i S3

7 i 8 tg 7 t7\ t t 10 : 11 |

E(t ) = 1.0 E(t ) = 1.0 E(t ) = 0.5 E(t10) = 0.5 E(tit) = 0.57 8 g

c(t ) = 0.2 c(t ) = 0.2 a(t ) = 0.05 c(t10) = 0.05 c(tll)=0.05|7 8 g

I2091 012

._..__ _ _ _

x x x x x x x x x X : x

x 1Security Fence

x x

x x

x X

a

SENSORI&5g TV 1

!\x u. '\

t STARTINGSENSOR 2 i PO!N T x

f#

-:- == =;-.-

x Building Entrance Building Entrance aa

p )j (Locked rear door)f

# fl TERMINALT POINT

xOootsoo<d,l, h

'SENSOR 4p Vital Component,

Entrance Gate

!!._ b Access Road LN ocked/4 x

Special Nuclear N NSOR 3:

.Materlois Location M N Lockedm *a Door

* ,

Response Force 1M "~"

Location g-x Electric Fence x

- Armored Door

x x

X ,;

:- x x x x x -x x : x x.,

._


2091 01335

_ _ _ _ _ _ . . . . .

INOTES:.

1. There are five alarms with the following probabil .ies of detection:S1 = 0.3, S2 = 0.95, S3 = 0.9, S4 = 0.65, and S5 = 0.3. (It is assumedthat both door sensors were disabled upon entry and they were not operativefor the exit path.)

2. The probability of communication is 0.9.3. The response force mean time E(t ) is 4 minutes with a standard deviationp

c(t ) of 0.5 minutes. -p

With the above input information, the estimate of adversary interruptionis calculated as shown below:

Press DisplayStep Proceduri (In Ordt.-) indicates



3 Enter Expected Response Time, E(t ) 4, 2nd, A' 4 5r4 Enter Standard Deviation for Response 0.5, 2nd, B' O.25 5

Force, c(t )p5 Enter Probability of Comunications, 0.9, 2nd, C' O.9 E

P (C) 5'.5, A 0.56 Enter Expected Time for Task 11, 0

E(t)))-Closest to Terminal Point7 Enter Standard Deviation for Task 11, 0.05, B 0.0025

-

c(t)) )8 Enter Expected Time for Task 10, 0.5, A 0.5

E(t10)9 Enter Standard Deviation for Task 10, 0.05, B 0.0025

c(t10) E3

10 inter Probability of Detection, 0.3, C 0.0000110965**P(d) for SS E

11 Enter Expected Time for Task 9, 0.5, A 0.5 5E(t )g


13 Enter Probability of Detection, 0.65, C 0.0001394112**P(d) for 54

14 Enter Expected Time for Task S, 1.0, A 1

E(t )8

|15 Enter Standard ceviation for Task 8. B 0.04c(t )8


2091 0143,

. _ . _ _ _

Press DisplaySteo Procedure (In Order) Indicates1

16 Enter Expected Time for Task 7, 1.0, A iE(t )7


-- 18 Enter Probability of Detection, 0.9, C 0.1522979978**P(d) for S3

~19 Enter Expected Time for Task 6, 5, A 5

E(t )620 Enter Standard Deviation for Task 6, 1, B 1

c(t )621 Enter Expected Time for Task 5, 0.7, A 0.7

E(t )S

22 Enter Standard Deviation for Task 5, 0.2, B 0.04a(t )S

23 Enter Probability of Detection, 0.95, C 0.87662543**P(d) for S2

24 Enter Expected Time for Task 4, 3.0, A 3E(t )4

25 Enter Standard Deviation for Task 4, 0.3, B 0.09a(t )4

26 Enter Expected Time for Task 3, 0.5, A 0.5E(t )3

27 Enter Standard Deviation for . Task 3, 0.05, B 0.0025c(t )3

28 Enter Probability of Detection, 0.3, C 0.9?9***P(d) for Sl

*If the SR-52 has been turned off, the EASI program must be reentered. If theSR-52 has not been turned off, press the E button and proceed with, Step 3.


-- * *This number is the probability of ircerruption (rounded from 0.9099352038).._

--.

2091 015_- 37

--

. _ . . . . -

IEXAMPLE 3.A

CASE C - THIEF, OUT5IDER (WITH ASSISTANCE FROM INSIDER)

Suppose the thief was aided by an internal accomplice who attempted todisable S2, S3 and 54, and that the probability of detection Ly all of thesesensors was reduced to 0.1. The solution is modified as follows:

Press DisplayStep Procedure (In Order) Indicates -

*1 Enter Program (A)* 0

2 Init'111ze Program E 0

3 En'.c E (t ) 4, 2nd. A' 4c .

4 Enter o(t ) 0.5, 2nd, B' O.25r

5 Enter P(C) 0.9, 2nd, C' O.9 g6 Enter E(t))) 0.5, A 0.5 a7 Enter c(t )) 0.05, B 0.0025j8 Enter E(tjg) 0.5, A 0.59 Enter c(t10) 0.05, B 0.0025

10 Enter P(d) for SS 1.3, C 0.0000110965**11 Enter E(t ) 0.5, A 0.5 -g

12 Enter c(t ) 0.05, B 0.0025g E13 Enter P(d) for S4 0.1, C 0.0000308372** 514 Enter E(t ) 1.0, A 1815 Enter c(t ) 0.2, B 0.04816 Enter E(t ) 1.0, A 1717 Enter c(t ) 0.2, B 0.047

18 Enter P(d) for 53 0.1, C 0.0169471185**

19 Enter E(t ) 5, A 5620 Enter c(t ) 1, B 16

21 Enter E(t ) 0.7, A 0.7S

22 Enter c(t ) 0.2, B 0.04S

23 Enter P(d) for S2 0.1, C 0.1053736905**

24 Enter E(t ) 3.0, A 34

25 Enter a(t ) '.3, B 0.094


200 m Igse

-

. . . _ . _ _ _ _ . . . _ _ _

Press DisplaySten Procedure (In Order) Indicates

26 Enter E(t ) 0.5, A 0.53

27 Enter a(t ) 0.05, B 0.0025328 Enter P(d) for S1 0. 3, C 0.347***

*If the SR-62 has been turned off, the EASI program must be reentered. Ifthe SR-52 has not beer turned off, press the E button and proceed with

-- Step 3.



Therefore, under the assumptions listed above, the accomplice had reducedthe probabf cy of interruption from 0.910 to 0.347. '

2091 017

--

39

-

- - - . - - . . . .

EXAMPLE 4

CASE D - SAB0TEUR, INSIDER

IUnder the assumption that the vital components were in a locked room,

Ean adversary path could be as follows (Figure 4-1): 51. An employee penetrates the locked door, t , (which may activate an alam).

i

2. He proceeds to the vital component and damages / destroys the equipment, t '2

The adversary time-sequence path is:

|Travel toPenetrates Vital eDoor 51 Component Terminal Point

: t _t1 2 .

E(t ) = 3 E(t ) = 0.5y 2

a(t ) = 0.3 c(t ) = 0.1i 2

If the expected response time is 4 minutes with a standard deviation of0.5 minutes, the probability of comunication is equal to 0.9, and the proba-

Ebility of detection by Sencor 1 is 0.95, the solution is: 5

Press Display aSteo Procedure (In Order) Indicates E

i EnterProgram(A)* - 0


3 Enter Expected Responsa Time, E(t ) 4, 2nd, A' 4r

4 Enter Standard Deviation of 0.5, 2nd, B' O.25 EResponse Time, c(t ) 5p

:s Enter Probability of Comunication, 0.9, 2nd, C' O.9P(C)

6 Enter Expected Time for Task 2, E(t )- 0.5, A 0.52Closest to Terminal Point

7 Enter Standard Deviation for Task 2, 0.1, B 0 .01c(t )2

8 Enter Probability of Detection 0.95, C 0.000**P(d), for S j

*If the SR-52 has been turned off, the EASI program must be reentered. If theSR-52 nas not been turned off, press the E tutton and proceed with Step 3.

**This number is the probability of interruption (rounded from 0.0000073151).

I2091 018

40 . I

___

_

I

--

Building EntranceBuilding Entrance . (Locked rear door)-

.

(Front) .,

..

p ..

Portal

y Vital Component/

TERMINAL PolNTp

SENSORI

/' /Nh - Loened Door

-STARTING POINT

Special Nuclear N Locked DooreMaterlois Location

a - a

4 Electric Fence"", x

Armored Door

a Response Force Location__

Figure 4-1. Adversary Sequence, Example 4, SR-52__

2091 01941

-

_ _ _ . . . _ . _ _ .

,

I

EXAMPLE 4.A

Since the previous solution yields an unacceptable probability, considerreducing the expected response time to 0.3 minute with a standard deviationof 0.1 minute (by having guards or a buddy system, inside the vital component

area at all times). The new solution becomes:

Press DisplayStep Procedu re (In Order) Indicates



3 Enter E(t ) 0.3, 2nd, A' O.3r

4 Enter c(t ) 0.1, 2nd, B' O.01p

5 Enter P(C) 0.9, 2nd, C' O.9

6 Enter E(t ) 0.5, A 0.52

7 Enter c(t ) 0.1, B 0.012

8 Enter P(d) for S) 0.95, C 0.784**

*If the SR-52 has been turned off, the EASI program must be reentered. If theSR-52 has not been turned off, press the E button and proceed with Step 3.

**This number is the probability of interruption (rounded from 0.784158297).

I.

IIIIII

200 0 I42

. . - . _ - - -_

EXAMPLE 4.B

An alternate solution could be to add a second door having a sensor with thesame probability of detection as the existing door, for a new adversary time-sequence as follows:

Penetrates Penetrates Travel toDoor 1 Door 2 Vital

S1 S2 Component Terminal Pointt 7 t 9 t !| j 2 3

E(t)) = 3 E(t ) = 3 E(t ) = 0.52 3

o(t)) = 0.3 o(t ) = 0.3 a(t ) = 0.12 3

- If E(t ) remains 4 minutes and c(t ) remains 0.5 minutes, P(C) remainsr r

0.9, and P(d) for both Sensors 1 and 2 is 0.95, the solution becomes:

Press Display.

Sten Procedure (In order) Indicates-


. -2 Initialize Program E O

__3 Enter E(t ) 4, 2nd, A' ic4 Enter c(t ) 0.5, 2nd, B' O.25p

'

5 Enter P(C) 0.9, 2nd, C' O.96 Enter E(t ) 0.5, A 0.53

- 7 Enter c(t ) 0.1, B 0.013-- 8 Enter P(d) for S 0.95, C 0.0000073151**2

__

9 Enter E(t ) 3, A 32

._

10 Enter c(t ) 0.3, B 0.092

_Enter P(d) for S) 0.95, C 0.164***11

_*If the SR-52 has been turned off, the EASI program must be reentered. If theSR-52 has not been turned off, press the E button and proceed with Step 3.

** Blank for a few seconds before number displayed, do not press another key_

until number appears on display.

***This number is the probability of interruption (rounded from 0.1642014476)._

__

,-

2091 02143

_

_

II

4.2 HP-67 Examples

The HP-67 programable calculator is similar to the Texas Instruments,SR-52 in size, external appearance and in the position of the magneticcard reading slot. Although most of the keys on the HP-67 perform threeseparate functions, the EASI proon aes not require switching from oneset of functions to another. Only the basic keyboard functions are neededfor EASI (the @ and g functions keys are never used). To store thecontents of a program written on magnetic cards the following procedures apply:

a. Turn power on (located at the top, left side).

b. Read side 1 of the selected magnetic card as follows: place gthe W/PRGM-RUN switch (located at the top, right side) in the IU

RUN position. Insert the card in the slot located on the right

hand side of the calculator with the 41 pointed to the left

(in the same manner as employed with the SR-52). Do not restrictor hold the card after it is caught by the drive motor.

c. After the drive motor stops, remove the card from the left sideof the calculator and file it away.

d. If the display shows ERROR following step b, press the CLX buttonand repeat the procedure beginning with step b. If difficulty

persists, refer to " Service and Maintenance" in the owner's manual.

After the program has been read into the calculator, the probability ofinterruption calculations are performed following the procedures outlinedin Examples 5 and 6 on the following pages. If a mistake is made whileentering data, press the CLX button and reenter the data beginning with thefirst entry.

The HP-67 program requires the following data for each Task 1: E(t ),jc(t ), P(d). If no detection device is associated with Task i, enter zero (0)jfor P(d).

(NOTE: The EASI Program for the HP-67 is listed in Appendix F.)

II

20 0 022 I|u

. . . . . . ____

;

EXAMPLE 5 -

CASE A - SAB0TEUR, OUTSIDER,

~

The path chosen for analysis is shown in Figure 5-1 and has the following ,

sequence: -

1. The adversary penetrates the boundary fence, t , crosses the area betweenj- the fence and the facility's main buiiding, t2 and t , and reaches locked3

exterior door.2. While outside, the adversary is subject to surveillance by CCTV, (Sensor 1).3. After penetrating the exterior door, t , (Sensor 2), the adversary continues4

along a corridor to a second locked voor, t *S

- 4. The adversary penetrates this locked _ door, t , (Sensor 3), and enters a room6containing the vital component,t *

7

The adversary time-sequence path (in minutes) is shown below:

Penetrates TravelPenetrates Cross Open Area Locked Door to Door.

Fence 1 2S1 S2

' yt| t) t t : t2 3 4 5- s

N_ E(t)) = 2.0 E(t ) = 1.0 E(t ) = 1.0 E(t ) = 3.0 E(t ) = 0.5 \2 3 4 S

l

a(t)) = 0.5 a(t ) = 0.2 o(t ) = 0.2 o(t)=0.3 a(t ) = 0.1 i; 2 3 4 S p,-------- - + - - - - - - - - - - - '

/- /

/ |\

$ Penetrates Travel to Terminal Points Locked Door (Vital Component)N 2 S3 + Time to Achieve Final Objective' 7s.- t t

6 i 7 .-i

E(t ) = 3.0 E(t ) = 0.16 7

o(t ) = 0.3 o(t ) = 0.02s 7--

2091 023

45

_ _ . . . . -

IX X X X X X X X X X X X

X XSecurity Fence

X X

X X

IX X

SENSOR 1TV

Q XX

' STARTIN GX

|POINTX

,-I

Ls'

x*#

-

X Building Entrance Building Entrance X

(Front) N" 1 (Locked rect door) W-/s -

SENSCR 2X Gate Guard X

- -Vital Component 45Portal

h,1

Entrance Gate i T X

\ b Access Road N toeg,q

Special Nuclear A 00''

Materlois Locotton _ M K LockedDoor{ " '^i XResponse Force W 4-

Location

Electric FenceX X

- Ar rror e d Door

x x

): ):

X X X X X X X X X X X X

IFigure 1-5. Adversary Sequence, Example 5, HP-67

,,,. y g46

- . _ _ - . _

_

m

. NOTES:

. 1. Adversary times must be divided at sensor locations; e.g., the time to crossthe open area, t +t , is arbitrarily divided in half in this example under2 3

--

the assumption that the TV coverage, Sensor 1, will detect movement closeto the middle of the open area.

2. The detection probabilities P(d) for the three sensors are: Sl = 0.3,' S2 = 0.97, S3 = 0.97.

3. The communication probability P(C) is 0.9.4. The response time of the security force is E(t ) = 4.0 minutes with a

r

c(t ) = 0.16 minutes.r

- With the given input information, the estimate of adversary interruptionis calculated as shown on the following page.

i

_

h

i

-

..

_

w

_

V

-

2091 025-

_

- .

47

__ _ _ _.

IEXAMPLE 5

CASE A - SAB0TEUR, OUTSIDER


1 Enter Program (Sid- 1)* O

2 Enter Expected Response Time, E(t ) 4, Enter 4p

3 Enter Standard Deviation of 0.16, Enter 0.16Response Time, c(t )r

4 Enter Probability of Comunication, 0.9, A -4.0**P(C)

5 Enter Expected Time for Task 7, 0.1, Enter 0.1E(t )-Closest to Terminal Point7

6 Enter Standard Deviation for Task 7, 0.02, Enter 0.02c(t )7

7 Enter Sensor Probability of Detaction, 0.97, B 1.213122289-18**P(d) for S3

8 Enter Expected Time for Task 6, E(t ) 3, Enter 36

9 Enter Standard Deviation for Task 6, 0.3, Enter 0.3.

c(t ) '

6.

10 Enter Zero; No Sensor Probability of 0, B 1.213122289-18**Detection Associated with Task 6

11 Enter Expected Time for Task 5, E(t ) 0.5, Enter 0.5S

12 Enter Standard Deviation for Task 5, 0.1, Enter 0.1c(t )S

13 Enter Sensor Probability of Detection, 0.97, B 0.112044089**tP(d) for S2

14 Enter Expected Time for Task 4, E(t ) 3, Enter 34 E15 Enter Standard Deviation for Task 4, 0.3, Enter 0.3 su

c(t )416 Enter Zero; No Sensor Probability of 0, B 0.ll2044089**t

Detection Associated with Task 417 Enter Expected Time for Task 3, E(t ) 1.0, Enter 1

318 Enter Standard Deviation for Task 3, 0.2, Enter 0.2

c(t )3

19 Enter Sensor Probability of Detection 0.3, B 0.351790677***tP(d) for 51

*If the HP-67 has been turned off, the EASI program must be reentered.If the HP-67 has not been turned off, press CLX button and proceed withStep 2.


20p 026I4e

. . _ . _ . _ _ . __

** Blank for a few seconds before number displayed, do not press anotherkey until number appears on display.

- ***This number is the probability of interruption .

tFor the HP-67 only two significant figur : will normally be displayedfollowing computations (the exception being nue.ers with a rounded valueless than 0.01, which will automatically be displayed in exponential form).In order to display additional significant figurer. (maximum of 9), press theDSP key followed b the number of significant figures desired; e.g., de-

pressing OSP and will provide the accuracy cited in the example.

__

A

-

_

v

_

-

a

w

A

,

._

-

2091 027 o

- _ _ _ ____

IEXAMPLE 6


The path chosen for this analysis is shown in Figure 6-1 and-contains thefollowing sequence:1. The adversary penetrates the boundary fence, t), crosses the open area, E

t and t , to the building door (where he may be detected by Sensor 1, B2 3

assumed to be one-half way between the fence and the door).

2. He penetrates the building door, t , which is protected by Sensor 2.4

3. He travels through the building and reaches the door to the materialaccess area (MAA), t *

S

4. He opens the door to the MAA, t , which is protected by Sensor 3.6

5. He obtains the special nuclear material and exits the MAA, t ; travels g7

down the hall and exits the external door, t , (where a radioactivity W8

detector may detect the SNM, Sensor 4).6. He crosses the open area, tg and tl0, where he may be detected by th'e TV,

Sensor 5 (same as Sensor 1).7. He exits through the shcurity fence and escapes, t)) .

The adversary time-sequence path is shown below:

IPenetrates Penetrates Travel in Penetrates

Fence Crosses Open Area Outer Door Building Inner Doors 3U Rt'2 tt t * '' '.

6 m g'3 4 '51

'' - i .

E(t)) = 2.0 E(t ) = 0.5 E(t ) = 0.5 E(t ) = 3.0 E(t ) = 0.7 E(t ) = 5.0 h2 3 4 S 6

c(t)) = 0.3 c(t ) = 0.0 c(t ) = 0.05 c(t ) = 0.3 c(t ) = 0.2 c(t ) = 1.02 3 4 S 6

/,_____._____------__-._____/ g.

/ 5l |aExitsMA;

Travel, Bldg. Crosses Open Area Exits ThroughObtain SNM& Exit Fence

S3 u S5 -

k t 7 ts _U t t t'11, -

9 10i 7 8 - --

E(t ) = 1.0 E(t ) = 1.0 E(t ) = 0.5 E(t10) = 0.5 E(t))) = 0.57 8 g

c(t ) = 0.2 c(t ) = 0.2 c(t ) = 0.05 c(t10) = 0.05 c(t))) = 0.057 8 g

2091 OM g50

. . _ _ . . -

1

X X X X X X X X X X^

/a'

I

_ Security Fence=n

X X

X - X

X y

SEN50 R ' 8 5X TV X

X X

STARTING*

POINTSENSCR 2 :3'

# / :\1_=N>X..,

X Building Entrance 1/ / Sullding Entrance X(Locked rear doAnt(Frent) N 4

f[gf

TERMINAL1 POINT

X Gate GuardXSENSOR 4[ Portal /-

#

Q'I_- Vital Component

Entrance Gate th X

l._

#Access Road ,j g,

|Speclot Nuclear Door X

=Materials Location SENSOR 3

| NLockedDoor, '

y XResponse Force : a,

Locotton 1

-

X Electric Fence y-- -Armored Door

X X

_

x x

_

' '' x x X -x x x x x X x

__Figure 6-1. Adversary Sequence, Example 6, HP-67

2091 029-

4

-- 51

- - . _ . . .

E

NOTES:

1. There are five alarms with the following probabilities of detection:S1 = 0.3, S2 = 0.95, S3 = 0.9, S4 = 0.65, and S5 = 0.3. (It is assumedthat both door sensors were disabled upon entry and they were not operativefor the exit path.)

2. The probability of communication is 0.9.3. The response force mean time E(t ) is 4 minutes with a standard deviationp

o(t ) of 0.5 minttes.r

With the above input information, the estimate of adversary interruptionis calculated as shown on the following page. '

IIII

III

IIII

2091 03052

. . . _ _ _ __ _ _

EXAMPLE 6

_



1 Enter Program (Side 1)* 0

2 Enter Expected Response Time, E(t ) 4, Enter 4p

3 Enter Standard Deviation of Response 0.5, Enter 0.5Time, c(t )

r'

4 Enter Probability of Communication, 0.9, A -4.0**- P(C)

5 Enter Expected Time for Task 11, 0.5, Entcr 0.5

E(t ))-Closest to Terminal Pointj_

6 Enter Standard Deviation for Task 11, 0.05, Enter 0.05c(tjj)

7 Enter Zero; No Sensor Probability of 0, B 0**Detection Associated with Task 11.

8 Enter Expected Time for Task 10, 0.5, Enter 0.5E(t10)-_

9 Enter Standard Deviation for Task 10, 0.05, Enter 0.05- c(t10)

10 Enter Probability of Detection. 0.3, B 0.000011097**tP(d) for SS

-

11 Enter Expected Time for Task 9, 0.5, Enter 0.5- E(t )g

12 Enter Standard Deviation for Task 9, 0.05, Enter 0.05o(t )g

'

13 Enter Probability of Cetection, 0.65, B 0.000139411 **t_

P(d) for S414 Enter Expected Time for Task 8, 1.0, Enter 1

-

E(t )815 Enter Standard Deviation for Task 8, 0.2, Enter 0.2

a(t )8__

16 Enter Zero; No Sensor Probability of 0, B 0.000139411**+-- Detection Associated with Task 8

__ 17 Enter Expected Time for Task 7, 1.0, Enter 1

E(t )7

18 Enter Standard Deviation for Task 7, 0.2, Enter 0.2_~ a(t )7

19 Enter Probability of Detection, 0.9, B 0.152297998**"P(d) for '3

_


1 2091 03133

_ _ _ _________

I

IPress Display

Steo Procedure (In Order) Indicates

20 Enter Expected Time for Task 6, 5, Enter 5 gE(t ) 56

21 Enter Standard Deviation for Task 6, 1, Enter 1

c(t )6 E22 Enter Zero; No Sensor Probability of 0, B 0.152297998**t 5

Detection Associated with Task 6 ,

23 Enter Expected Time for Task 5, 0.7, Enter 0.7E(t )S

24 Enter Standard Deviation for Task 5, 0.2, Erter 0.2c(t )S

25 Enter Probability of Detection, 0.95, B 0.876625430**tP(d) for 52

26 Enter Expected Time for Task 4, 3.0, Enter 3

E(t )427 Enter Standard Deviation for Task 4, 0.3, Enter 0.3

a(t )428 Enter Zero; No Sensor Probability of 0, B 0.876625430**t

Detection Associated with Task 4 .

29 Enter Expected Time for Task 3, 0.5, Enter 0.5E(t )3

30 Enter Standard Deviation for Task 3, 0.05, Enter 0.05c(t )3

31 Enter Probability of Detection, 0.3, B 0.909935204***tP(d) for 51

*If the HP-67 has been turned off, the EASI program must be reentered. If

the HP-67 has not been turned off, press CLX button and proceed with Step 2.** Blank for a few seconds before number displayed, do not press another key

until number appears on display.***This number is the probability of interruption.

tFor the HP-67 only two significant figures will normally be displayed followingcomputations (the exception being numbers.with a rounded value less than 0.01,which will automatically be displayed in exponential form). In order to dis- Eplay additional significant figures (maximum of 9), press the DSP key gfollowed bv the number of significant figures desired; e.g., depressing

OSP and @ will provide the accuracy cited in the example.

II

2091 032 |_.-

. . . . - . - -__

REFERENCES

1. " Intrusion Detection Systems Handbook," SAND 76-0554, Sandia Laboratories,000, November 1976.

2. Johnson, N.L. , and S. Kotz, Distributions in Statistics -- ContinuousUnivariate Distributions - 2, Hougnton M1fflin Co.,1970, p. 6.

3. Sasser, D.W., "EASI on the HP-25, HP-65, and HP-67," SAND 76-0597,Sandia Laboratories, May 1977.

,

,

_

m

..

-

m

2091 03355 - 56

_ _ . . . .

. . - - - . - - -

APPENDIX A

METHODOLOGY

The basis for tnt EASI method is that, for resolute theft or sabotageattempts to be averted at nuclear facilities, the response force * must benotified of the attempt while there is still sufficient time remaining inthe adversary's action sequence for the force to respond and interrupt the

- sequence. At this point the response force is assumed to be adequate atleast to delay adversary progress until additional forces arrive to neutralizethe adversary. The actual force composition required is a function of thethreat and must be determined by other means.

In this esaluation method, response force notification of a theft orsabotage attempt is called an alarm, and the probability of alarm is definsd as:

s

P(A) = P(D)P(C) (1)

where

P(D) = probability of attempt detection,P(C) = probability of connunication to the response force.

For a single detection sensor, the probability of adversary actionsequence interruption is

P(I)=P(R|A)P(A) (2)

where

P(R| A) = conditional probability of response force arrival prior to the- end of adversary's action sequence, given an alarm.

As noted earlier, the adversary action sequence takes place along a pathwith a starting point, followed by a sequence of sensors (or other possiblemeans of detection) and barriers, and a terminal point. If a sensor activsteswith time t remaining for the adversary to reach the designated terminsi point,athen for an interruption to occur the following relation must hold:

c

_ 'Altnough the term response force is used throughout this methodology develop-' me'nt, other suitable alternatives to the use of force may be substituted pro-

vided they are adequate to delay adversary progress until the adversary canbe neutralized.

2091 034sv

_

II6

t -t >0 (3)a r

Iwhere

time remaining for adversary to reach a terminal point when thet =a

sensor activatest = time for the security force to respond starting with sensor activation.p

Assuming t and t are independent, normally distributed *, random variablesa r

then

Ix = (t - t) (4)a r

Ihas a normal distribution with a mean,

u = E(t - t ) = E(t ) - E(t ) (5)x a r a r

and a variance,

2c = var (t - t ) = var (t ) + var (t ) (6)x a r a r

and

* ~

(x - u )2-)P(x > 0) = exp -x dx. (7)

g2nc-

22 2aa

. .

Referring back to Equation (2), it is evidsnt that P(R| A) is equivalent toP(x > 0). Furthermore, P(R| A) can be evaluated in terms of the expected values

_

and variances of t and t using Equations (5) and (6). For example, ifa r

E(t ) > E(t ) + 2 x (8)a r

then P(R| A) > 0.98 and Equation (2) can be approximated by

P(I) = P(A). (9)

*The normal distribution requirement may be at.froximar.ed by letting t and t bea rsums of random variables which satisfy the conditions of the E

Central Limit Theorem. E

h58

_

;

If

-

E(t ) < E(t ) - 2a , (10)3 r x

then P(R| A) < 0.02 and Equation (2) can be approximated by,

P(I) = 0. (11)

- For

__ E(t ) - 23 < E(t ) < E(t ) + 2c (12)r x a r x

P(R| A) should be evaluated by Expression 7 or approximated by2

exp 1.7[u*/c ]xP(R|A)=

1 + exp 1.7[u /e ] . (13)x x

Since the method is concerned with the time remaining in the sequence,evaluation of E(t ) and var (t ) at point p along a path of interest must bea a

# th respect to the terminal point. The penetration time through each barrierand the transit time between barriers are considered to be random variables withvalues corresponding to the level of adversary resources. Then, the expected

_ time. from any point p to the terminal point n is:

n

E(t ) at point p = i =E Elt ) (14)a $p+1

where

E(t ) = the expected time to perform Task i.j

2091 036 59

-

_ __ _

h

Assuming each task to be independent, the variance of the patn time re-maining between point p and the terminal point n is: ,

n

Var (t ) at point p = { var (ti) (15)a i=p+1

'For two or more sensors the conditional probability of response force

,

arrival, P(R| A), for each sensor must be calculated as previously described-Then the cumulative probability of sequence interruption calculated along theadversary's path from the starting point is:

n 1-1

P(I) = P(R|A )P(A ) + [ P(R|A )P(A ) H Q(A ) (16)1 3 $ $ j

i=2 j=1

where

Q(A ) = i - P(A ).3 j

On a cultiple sensor path, the contribution of any sensor to the systemperformance is reduced by the probability that no alarm has occurred prior todetection by that sensor. To illustrate, with two sensors Equation (16) becomes:

P(I) = P(R|A )P(A ) + P(R|A )P(A )(1 - P(A )) (17)3 1 2 2 1

If the term (1 - P(A )) is small, then the second sensor is not a principal1

source of alarms and errors made'in evaluating 0(R|A ) may be ignored. Taking2

advantage of such conditions, the EASI method could be simplified as follows.For each sensor in the system,

where

IE(ta'.) " E(t ), let P(RjA ) = 1 (18)r $

II

200 UN

60

--__

_

and where

E(ta ) < E(t ), let P(R'A ) 2 u. (19)p 4g__

This modification (which could be called * Yery EASI method) thenconsists of simply calculating :he , umulative

~ '

probability of alarm alongthe adversary's path from che starting point (usually the plant boundary) up

' to a point which is the security force's expected response time from the__ tenninal point. Actually, this method would yield correct results if no

sensors satisfied condition (12) along the path being analyzed. However,_ . _ this simplification may satisfy most preliminary evaluations of security

system designs provided the limitations of the method were well understood.

_

--

-

--

__

__

2 2091 038-

61

_ _ _ . . . . . . . . .

IAPPENDIX B

GLOSSARY OF SELECTED SAFEGUARDS (ERMS

ADVERSARY: An individual or an organized group intending to cause adversesocietal consequences through acts involving nuclear material.

ADVERSARY ACTION SEQUENCE: An ordered set of specific acts, which if

completed could product an event of serious consequences to society.

ADVERSARY PATH: Any physical route which could be taken by the adversary '

in order to perform the adversary action sequence.

ADVERSARY TASK: A specific function which must be performed by theadversary in order to proceed along a pata; i.e., penetrate a barrier,travel through a given distance, etc.

ADVERSARY SEQUENCE INTERRUPTION: The act of breaking in upon the adversary

action sequence by the response.

RESPONSE _1 A counteraction taken by the physical protection system againstthe adversary.

PHYSICAL PROTECTION: A safeguards subsystem directed against adversary

actions at or within protected boundaries through the functions of detection,assessment, coccunications, delay and neutralization.

DETECTION: The discovery of any adversary action.

ASSESSMENT: The verification that an adversary action nas been sensedand the determination of the proper response required.

CCMMUNICATIONS: The act of informing either the local physical protectionresponse forces, or the local law enforcement agency or both of an adversaryaction.

DELAY: A means to impede adversary progress - usually to buy time toeffect a response.

NEUTRALIZE: To render an adversary ineffective - no longer able to completethe action sequence. Usually the result of a successful response.

2091 039

62

- -- - - .- - - -_

-

APPENDIX C

BARRIER PENETRATION TEST DATA

The purpose of this Appendix is to provide data over a range of barrierswhich would enable the user to make reasonable estimates of penetration timesfor specific barriers and penetration methods. The data were obtained fromthe Ba'rrier Penetration Data Bank being compiled at Sandia Laboratoriesfor the purpose of producing a barrier penetration handbook in the near future.These data are currently not endorsed by NRC. Actual test times are given along

- with an estimate of the range of penetration times. Where data referencesare not specifically given, the data were obtained from tests conducted atSandia Laboratories.

The penetration times given pertain to the set of tools used for that test.This does not mean that those tools necessarily provide the minimum penetrationtime for the barrier tested. It is generally agreed, however, that hand and

__

power tools are capable of providing minimum penetration times for concretewalls less than 8 inches thick while high explosives are required for minimum

_ penetration times for concrete walls 8 inches thick or greater. Penetration'

times for industrial sheet metal doors are considered to be in the range of-- 1 to 3 minutes with a mean of 2 minutes, with either tools or Jet-Ax explosives.

- Locked doors may be penetrated by picking the lock. The time required topick a standard straight-pin-tumbler design lock or good quality is in the range

_

of 1 to 5 minutes w th a mean of 3 minutes. Specially designed locks areavailable which can increase tnt: .n:ove times by an order of magnitude.

_

_

Table C.1 provides test' data on three types of barriers (fences, doors andwalls) and specifies the type of barrier material, the number of people(adversaries) involved, equipment used (both manual and power), weight of eouip-ment, penetration time, range of times, coments, and references.

An extensive source of data references can be found in "An Assessment of3Some Safeguards Evaluation Techniques," NUREG-0141, R&D Associates, February 1977,Appendix C.

__

._

- 2091 04063

.__

___ ___

cnt-

Table C.1 Barrier lest Data

THNEATHanual Power 1stimated

Htmeer Equipment [quipacnt faplosive Total Penetration Harpjeof Weight Weight Weight Weight ilac of liac

Dariter HateriaI People Egij=nen t (pounJsl_ (poundi { pounds) (puunds}{ minutes) {minuM) Cosaments Feference

fence Lhain link sicsh, 2 Plank, 2 to 4 20 - - 23 0.10 0.09 to Lift fabric M851N-837*9 gauge, 2 inch mesh, incies thick 0.11 and crawl7 feet high, with underoutriggers

i Bolt cutter, 24 7 - - 1 0.32 0.20 tu Cut triangular hBSIN-837

inches long 0.40 flap. 26 by18 inches

i Gloves 0.5 - - 0.5 0.10 0.05 to Cita6 over h851N-8370.15 at gate

LSA Class 6 0. 375-inch-thick hard 3 Hasacr; punch; chisel; 10 225 - 235 18.27 14.27 to Espose telt NB51k- 73-223"Vault Duur drill-ses6 stance steel, cutting torch, omygen 22.27 wonks with

U.5-inch-thick stain- feJ electric arc; turch, force

less steel cover over generatur 3kW, t, ult, openbu t t un ks gas operated door

2 Hocket torch - 200 - 200 9.5 8.5 to Cut 11-inch NB51R-73-22310.5 diameter I. ole

thebugh door

N t*,u r 0.15- in-thick steel I 0xygen-lance, small - 100 - 100 10.0 7.2 to Cut 2 by 2- --- ------

a plate, 3-in- thick f iber- tank , gau9e , 2 bar) 12.3 foot holeglas, 0 125-in-thicksteel plate

*nat tunal bus eou of Standard > lechnical Noteo " National bureau of Standards Internal Heport

C:=-

* .

_ _ . _.. . - - -

Table C.I Barrier Test Data (Continued)

THRfAINnual Power Estimated

Nundser Igulimient Equipment fxplosive Total Penetration Rangeof Weight Weight Weight Welfht T imie of ilme

!!d! L!!f. Md!"f.!g [ People !.rp!!inuent jgeu,nd_sl jimunds)_ (gg_unds ) jpounds){ minutes) (minutes) Cousaents gerenceN

Wall llollnw cinder block; I Sledge. 24-in 19 - - 19 1.52 1.3 to liasmier out NPsIR-13-223

no. 5 rebar. 14 liolt cutter 1.7 hole, cut re-inforcementlaches on center;

cores tilled with material. 12by 8-inch holesurtar

Sled e, cutting to 55 - 65 4.3 3.5 to Beat hole in llB51R-73-101Wall Concrete 4 inches thlLL l 9with no. 5 rebar. 5 turth with tanks. 5.1 wall with 90inches on (enter Npp blows, cut

ret,ar. Il by

14-inch hole

I Sledge; cutting 26.75 55 0.25 82 4.2 3.4 to. Fire Jet-Ax. NB51R-73-101

torch with 5.0 twaneer outoxyacetylene; opening, cutexplusive, linear rebar. 24 by

N shaped (harge. 31-inch holeC Jet-Ax JA-3.W 5.6 oun(es. 250

grains per foot-

Wall fontrete H inches thick 2 Sledge; punch; 24-in 56.1 90 0.4 146.5 5.1 4.3 to Sfall with NB51R-74-528

o with no. 5 actar. 5 bolt cutter; roto- 5.9 Jet-Ax. drillinthes un center hausser; drill; gen- 2 holes, punch

4 eratur. 3LW. gas out. 102 blowsN operated; explosive, with sledge

linear shaped charge.Jet-Ax JA-4. 5.6 oz.550 9:altis por f oot

mLJ1

.. _--

orOT

Table C.1 Barrier Iest Data (Continued)

I 14 R E A iNnual Power [stimated

f4unter Equipnent Equijment Explosive lotal Penetration Rangeof Weight Weight Weight Weight ilme of fisie

Li i rhr N_terh L Pygple E tuijgnt {puunds) jpounds) 1 pounds]_ (puinids)(minutes) (minuted Comments Referented _

Wall Contiete 8 inches thick 2 Sledge; punch; 13.0 130 - 143 14.1 13.1 to Drill 20 NBSIR-73-101with no. 5 ocbar, 5 chisel; s utohanseer; 14.5 0.75-ininches un (enter drill; cutting diameter holes,

tosch with tanks, spall, chisel,

oxyacetylene; gen- humainer out,erator, 3LW, gas cut rebar , e

operated by 12-inchhole

Wall Concrete 12 inches 1 Sledue; explosive, 6 - 20 26 5 3 to ' Air coupled SL A, Div 1752

(VertKal thick with nu. I saithel cha:Ne charge layedSteelu e te) gauge Wheeling on wall, blast

expanded steel mesh out IL |ach-laced with reber diameter hole,

entry possible.exit not pus-sible, beat

rebar back.20-inch-dine-ter Isle

NCDw--

-w'A

E E E E E E E E E

. . . . . . _ _ _ _ __ .

APPENDIX D

INTRUSION DETECTION SYSTEMS INFORMATION2,

..

The performance of any detection system is highly dependent upon the systemdesign (inherent performance), environmental effects (both natural and man made),

,

i and adversary attributes (skills and resources). Therefore, only within specific*

Sets of conditions can detection system performance be quantitatively evaluated.; For the near term, confident extripolation of performance from one condition

set to another appears limited due to only a rudimentary understanding of howsite-specific installation variables, along with physical and environmentalconditions can affect component performance. Recognizing the state of the art

._

and the fact that some sita-related conditions may be unknown to system designers,it is recommended that new installations be extensively tested to uncover andcorrect any problems.

The following information is given to acquaint the reader with potentialproblem areas in detection systems and to offer recommendations for improved

~

performance.

1. SENSORS

A sensing device in combination with a proc 2ssor forms the basic detectionelement. It is this combination that is commonly called a " sensor."

._

Sensors form the backbone of all detection systems, but current performancerequirement: challenge the state of the art. Two performance characteristicsascociated with sensors are:

Probacility of Detection, which provides an indication of sensor performancein detecting an adversary within the zone covered by the sensor, and

False Alarm Rate,* which provides a measure of the expected rate at which-- alarns not attributable to adversary activity will occur._

-

*For the purpose of sensor evaluation oer se, nonadversary-related alarms must_.

be categorized as false alarms (reason unknowr.) and nuisance alarms (reasonknown). For the purposes of this handbook, both categories are inclu6ad inthe tem " false alarm.",

2091 044-

67

_

_ _ _ . . . _

There is presently no single sensor thr.t will reliably detect all intruders, yet

have acceptably low false alarm rates in all expected natural and man-made environ-

ments associated with nuclear facilities. Although various types of sensingelements and processors have been devised in an attempt to cope with the widerange of anticipated environmental conditions, these attempts have been oflimited success. Generally, improverrents in detection have been accompanied byincreased false alarm rates, while reductions in false alarm rates have resulted

in a lowered detection capability. Table D.1 indicates characteristics of ggeneral types of exterior sensors. W

The probability of detecting and correctly assessing adversary activity is gbased on the equipment capability, and is conditional on maintenance as well as 4

security afforded the equipment. A safeguards system should be designed so thatthe probability of detection will be as near unity as possible consistent withpractical equipment limitations. Using two or more systems, high detectionprobabilities appear achievable for most environments. Lower orobabilities wouldhave to be accepted during aeriods when only one system is ooerative.

False alams are considered to be alarms not caused by valid adversaryactivity. The false alarm rate (FAR, given in units of alams per hour)affects the expected assessment activity since, each time an alarm occurs, the gassessment system must be employed. If there were no false alarms, the assess- 5ment system would be used only to determine adversary characteristics and directresponse force actions. The acceptable FAR would depend heavily on the abilityto identify the source of each alarm. If all alarm causes could be easilyidentified by the assessment system, then a fairly high rate might be acceptable.However, a high FAR will tend to undermine confidence in the system; for thisreason, a system design goal should be to eliminate as many causes of falsealarms as possible.

When using exterior sensors on the perimeter of an area or building, a well-defined clear zone or isolation zone is highly desirable. Such a zone resultsin a reduction of false alarm rates inadvertently caused by innocent people,large animals, blowing debris, etc. Also, the perimeter should be divided intosegments, inoependently alarmed, in order to localize the area of an alarm.This provides the capaoility to rapidly assess an alarm; it likewise assiststhe response force operations.

I2091 04; |"

es

--__.

_

_.

| | || i == ==us =

| ii. m ,===ai | == ==

, suon .. . u.I | 1 = | | i = === ==

| | | ||Ananaymwst.g| = ==<

f ||| | M |j .tvustify 42JM | ==M 3M m n

|~~ S 8tewwY troung | | | | |j M== =

i|''''8 | | | 1 | | === =;

j === ! l I I I I I 1=

|1 8u u-ai i l I | | 1 =

I-+ s " a l | I I I I Im = =- s

-va-a l i I i | 1 I I3 =

| |5 -um t = 1a I = = | =.

w+1

5 3|li 1 I I I I I its- c 2 13 1 t. s. s. s. s. 1

'

. .

- 3 :54: 3 : 2 2 2 2 2 2 5x 23:s: . . e e e e e e i

- w 2:Cu 3 2 : : : : : : 1w

- O eg

b | tj , -] .'| s0

, _ !,=

1. i )1, 3, , . : s.v: +- -

f.. ! E!! 5: j: I |a 2- -

.5:.]_. . .

m Ads21: |l- 't asi a cil al '

:2 --ow

~

& A

$ d 1 1 :Iris !

?. f :e 'i?. f e'12ui : s.c

13" 8 i ::: ::v:3 : a =ss. ass._ -

d *~4 =31 I I ! | | 1| | ==

_ ,$ ~~4 =o l ! I I = 1 = 1 I II=1o

- + -t=w l 1 = 1 = | | | | | |m 1 =

5 1**J3 . ' 2 4 T %| = I | 1 | ! || |= == = = =

|| | j| 1;- . . . = = = = = = = =

_ ~~ ,

I I i-

i: 1 I I- -

1- 1 e

?l l l i! il- 3: t

| 1 I i-

_

= se a , e :: : a

!

- 72 i e 3vs2 3 a- = e.

!!! 1 ! mi) ! l $- E's! sa 2.

at a . It- 22 o{ w.* d - _n ae3 : ; ;

ee e a . . .

3N d | 5$$ 0 5 $$,: 5 I E

l .., ~ g. u im..1m . n n... ,., m. ..v ..m .

_

_.

- 2091 046

-

69

--'

-.--s ---

.,..

I2. ASSESSMENT SYSTEMS

Direct visual assessment or closed-circuit-television (CCTV)-aided assessmentof alams is essential to prevent comitment of response forces as a result offalse alarms or diversionary actions by intruders. Alarm sectors or zones shouldbe limited to some length (exterior sensors are nornally designed to cover arange of approximately 100 meters) that would facilitate rapid assessment. In

addition, the alarm zones should be adequately ifghted and free from clutter toaid in accurate assessment.

CCTV assessment systems can be manually employed or automatically employed

following an alarm. The particular form of employment would depend on the amountof barrier delay time following an alarm. Automatic employment, triggered bythe occurrence of an alarm, is generally preferred. Also, recording featurescan be associated with assessment systems, providing an " instant replay" capability gfor use by the assessing personnel. E

3. INFORMATION DISPLAY SYSTEMS

Information display systems normally have the capability to indicate an alarmstate, provide a chronological log of alam occurrences, and display the assess- Ement information. The exact capabilities associated with an information display 5system are dependent on the complexity of the overall sensor and assessmentsystem. The information display system should be located in a secure and hardenedroom to protect it and tne monitor personnel from attack. If the primary responseforce is not located in close proximity to the protected area, consideration shouldbe given to providing a duplicate information display system in the responseforce operation center. Two information disolay systems should be orovided in gseparate orotected locations to arotect acainst a sinale insider, acting 5malevolently or under duress, from ignoring an alarc or disabling the ecuicment.

4. SIGNAL C0muNICATION NETWORKS

Signals must be transmitted from remote sensors to some central location gwhere the information can be displayed to security personnel. Both hardware 5transmission lines and radio frequency (rf) transmission have been used forthis purpose. To preclude defeat by remote rf jamming, hardware transmissionlines generally are preferred for fixed sites. In some situations, transmission

lines are located entirely within a protected area, while in others they mustbe located partly outside the protected area. In either case, the lines are

I2091 047 g

_ ._ _

.

_

m

-

vulnerable to adversary actions. Even lines inside a protected area could bel attacked by persons with authorized access who, for example, are acting under-

duress. Consequently, some continuous-line supervisory technique should bei used not only to detect tampering that could compromise the detection systems$ but also to verify line integrity.

Line supervisory techniques vary from relatively simple systems that monitor, line current, through more complex tone superposition systems, to pseudorandom *

or random digital coding systems. Sensors and assessment systems must be com- -

j patible with whichever supervision method is used for a particular securityinstallation. The most comon supervisory technique in use today is the simplesystem that monitors line current through the use of a known voltage located at

' the control console, coupled with a passive termination located at the sensor.Systems of this type can be compromised since even a complex, passive termina- -

- '"'-

J tion can be measured and a duplic'de produced to bridge the line; however, suchsystems do provide a certain level of orotection against adversary activity, as

$ well as an indication of inadvertent severance of the comunication link.

_ Regardless of the comolexity of the line supervision system used, such a.

y system can be defeated with a rmbability of near unity if the adversary isallowed access to the line for sufficient time and if the adversary has g;

j adeouate resources and technical excertise. Consequently, the line must be" protected by either security patrols or tamper sensors in order to detect, attempts to gain access to the line. Line access delay times must be compatible t

j=

either with the patrol interval or with response times following a tamper alam.

q 5. TAMPER PROTECTION

N Detection systems must be protected from tampering so that their effective-

} ness cannot be compromised. Some sensors are self-protecting in that anyd attempt to approach the sensor would cause an alarm. Obviously, this is a -

( most desirable condition. However, mary sensors are not self-protecting,

fw and even self-protecting sensors can be defeated by knowledgeable adversariesI if access to the equipment is allowed. For this reason, all equioment should

] be in tamoer-resistant enclosures which are orotected by switches or self-.-

;'

- protective devices that will detect tamoerino and generate an alarm signal. $,

Tnese antitamper circuits must be in operation even when the protected equipmenta4 is in an access mode; bypass should be allowed only for authorized, supervised ;

maintenance or operational procedures.A'

2091 048 .=$ 71

-

, - - - . - .

II

6. POWER

Each detection system, including the assessment element, should be capable ofoperating from comercial AC power. Provisions should be made for automaticswitchover to emergency power (and back to comercial oower) without causing an

alarm in the event of commercial power failure. A signal should alert securityforces to the fact that the system is operating on emergency power. Emergencypower supplies should be protected from tampering in a manner similar to othersystem elements. Emergency power may be supplied by uninterruptible power

sources, by batteries combined with automatic-starting generators, ur bybatteries alone.

7. PERIODIC PERFORMANCE VERIFICATION

Periodic testing of sensors and assessment devices is essenti?1 to assure

continuous, oroper functioning and to detect equioment failures before theycomoromise the security system. Few available systems have complete self-testfeatures. Typically, processor performance is tested, but the sensing deviceis not. For example, the seismic buried-line sensor self-test feature directlyexcites the pressure transducers which are the sensing elements. If the ground

Bis frozen, detection will be unreliable, but the self-test will still indicate 5

_

that the processor is working and that the transducers are intact. In general,passive systems are limited to this sort of self-test, and a complete test canonly be accomplished by controlled penetration of the isolat!cn zone at selectedplaces.

Active systems can be completely tested by varying or modulating the trans- -

mitter signal . Such a feature should be incorporated in active systems ifpossible.

Obviously, a complete, continuous, automatic self-test feature is desirable50 that the long periods of uncertainty between controlled penetrations (as wellas the manpower requirements for such tests) could be avoided. With this feature, gfailure or malfunction of the system would be recognized immediately and remedial 3action initiated or alternative procedures implemented in a timely manner.

II

2091 049 I.

E

....___.--s .

__

APPENDIX E

EASI PROGRAM LISTING FOR SR-52

.-

.

-

_-

_

..

b

_

_

2091 050

.73

-

_ _ _ _ .

IDisplay Key Display Key Display Key

00 46 *LBL 37 46 *LBL 73 23 Inx

01 15 E 38 13 C 74 53 (

02 47 * CMS 39 65 X 75 42 ST0

03 25 CLR 40 43 RCL 76 00 0E

04 81 HLT 41 00 0 77 06 6 5

05 46 *LBL 42 03 3 78 55 +

79 53 (06 11 A 43 95 =

07 44 SUM 44 42 STO 80 01 1

08 00 0 45 00 0 81 85 +

09 01 1 46 04 4 82 43 RCL

10 81 HLT 47 43 RCL 83 00 0E

11 46 *LBL 48 00 0 84 06 6 3

12 12 B 49 07 7 85 54 )213 40 *X 50 SS + 86 54 )

14 44 SUM 51 43 RCL 87 65 X

15 00 0 52 00 0 88 43 RCL

16 02 2 53 02 2 89 00 0

17 81 HLT 54 95 90 04 4=

E18 46 *LBL 55 30' *[ 91 95 5=

'19 18 *C' 56 20 *i/X 92 85 +

20 42 STO 57 65- X 93 43 RCL

21 00 0 58 53 ( 94 00 0

22 03 3 59 43 RCL 95 08 8

23 81 HLT 60 00 0 96 65 X

24 46 *LBL 61 01 1 97 53 (

25 16 *A' $2 75 98 01 1-

26 42 STO 63 43 RCL 99 75 -

27 00 0 64 00 0 100 43 RCL

28 05 5 65 05 5 101 00 0

29 81 HLT 66 54 ) 102 04 4

30 46 *LBL 67 65 X 103 54 )

31 17 *B' 68 01 1 104 95 =

32 40 *X 69 932 105 42 STO-

,

33 42 STO 70 07 7 106 00 0

34 00 0 71 95 107 08 8=

35 07 7 72 22 INV 108 Sl HLT

36 81 HLT

* Denotes 2nd function key.

2091 05174

.. .._... __

.

APPENDIX F

EASI PROGRAM LISTING FOR HP-673

_

M

S

__

-

._

_

2091 052

23,

---

_ . I.

III

~ IDisplay Key Disolay Key

001 31 25 11 fLBL A 026 35 52 hx-y

002 31 43 fCLREG 027 81 +

003 33 01 ST01 028 01 1

004 35 53 hR+ 029 83 -

2005 32 54 gx 030 07 7

006 33 03 ST03 0 31 71 x

007 35 53 hR+ 032 32 52 ge*008 42 CHS 033 33 05 STOS009 33 04 ST04 034 01 1

010 35 22 hRTN 035 61 +

011 31 25 12 fLBLB 036 34 05 RCL5012 35 54 hRt 037 35 52 hx-y

013 35 54 hRt 038 81 +

014 33 61 04 ST0+4 039 35 52 hx-y

015 35 54 hRt 040 71 x2016 32 54 gx 041 35 82 hLSTx

017 33 61 03 ST0+3 042 01 1

018 35 54 hRt 043 51 -

01 9 31 51 f x=o 044 34 02 RCL2E

020 22 13 GE C 045 71 x 5021 34 01 RCL 1 046 51 -

022 71 x 047 33 02 ST02023 34 03 RCL3 048 31 25 13 fLBLC

f[024 31 54 049 34 02 RCL2025 34 04 RCL4 050 35 22 hRTN

II

2091 053576 S

.

. . - _ _ _

DISTRIBUTION:

USNRC Distribution SectionAttn: Robert WadeWashington, DC 20555NRC-13 (208 copies)

2 W.J. Howard1000 G. A. Fowler1230 W.L. Stevens1233 R.E. Smith1310 A.A. Lieber, Attn: W.F. Roberty,13111700 0.E. Jones1710 V.E. Blake1730 W. C. My re1738 J. Jacobs1739 J.D. Willians1739 D.L. Mangan1750 J.t. Stiegler1751 T.A. Sellers1752 M.R. Madsen1754 J . F. Ney1758 T.J. Hoban175S D.D. Boozeri

1758 G. A. Kinemond4010 C. Winter5000 A. Narath5120 G.J. Simmons, Attn : B.L. Hulme, 51225400 A.W. Snyder -

5410 D.J. McCloskey5412 J.W. Hickman5412 G.B. Varnado5700 James H. Scott -

5740 V.L. Dugan (2)5741 L.D. Chapman (10)5741 H.A. Bennett (25)5741 K.G. Adams5741 D. Engi,

5741 L.M. Grady5741 R.D. Jones5741 R.G. Roosen5741 D.W. Sasser5741 A.A. Trujillo5742 S.G. Varnado8000 T.B. Cook, Attn: B.F, Murphey, 83008329 T.S. Gold8321 R.L. Rinne (2)8266 E.A. Aas (2)31 41 C. A. Pepmueller (Actg. ) (5)31 51 W.L. Garner (3)

For ERDA/ TIC (Unlimited Release)

._

2091 05477

.

. - - .

"User's Guide for Evaluating Physical Security Capabilities of ...

Documents

Transcript of "User's Guide for Evaluating Physical Security Capabilities of ...