Solution monitoring (SM) has been used in a nuclear reprocessing plant as an additional measure to provide assurance that the plant is operated as declared. The inline volume and density monitoring equipment with dip tubes is important for safety and safeguards purposes and is a typical example of safeguards by design (SBD). Recently safety, safeguards, and security by design (3SBD) are proposed to promote an efficient and effective generation of nuclear energy. In 3SBD, proliferation risk assessment has the potential to consider likelihood of the incidence and proliferation risk in safeguards. In this study, risk assessment methodologies for safeguards and security are discussed and several mathematical methods are presented to investigate risk notion applied to intentional acts of facility misuse in an uncertainty environment. Proliferation risk analysis with the Markov model, deterrence effect with the game model, and SBD with fuzzy optimization are shown in feasibility studies to investigate the potential application of the risk and uncertainty analyses in safeguards. It is demonstrated that the SM is an effective measurement system using riskinformed and costeffective SBD, even though there are inherent difficulties related to the possibility of operator’s falsification.
As a result of greenhouse warming and increased energy demand, a global trend to introduce nuclear power into emerging countries has been a growing and increasing concern from the international society about the consequent impact on safety, safeguards, and security (3S). Introducing 3S mechanisms in an efficient and effective manner will require not only a balance between economic utilization of energy resource and mandatory installment of 3S countermeasures, but also intercooperation between those practices and implementation. The 3S initiative was launched at the Hokkaido Toyako Summit of 2008 by G8 countries [
A systematic approach to enhance the timely, efficient and costeffective integration of safety objectives, material control and accountability, and physical protection into the overall initial planning phase for a nuclear fuel facility may be applied for the introduction of nuclear energy by the “3S by design (3SBD)” methodology in which 3S countermeasures are considered in the design stage of those nuclear facilities [
In order to promote the designing work in a quantitative manner, the effective and timeconsuming installment of countermeasures could be encouraged by risk assessment to enhance reliability, robustness, and transparency of nuclear facilities in an explicit and implicit manner. Probabilistic safety assessment (PSA) has been developed for several decades in safety and is noted again after the Fukushima accident to perform severe accident analysis. Although safeguards and security communities have different histories and encounter technical aspects due to the inherent nature of intentional and malicious acts, probabilistic risk approach (PRA) should be investigated to pursue costeffective implementation. In the existing regulations of safeguards and security, it would be not so straightforward that the risk notion is applied to inherent threat and hazard recognition. In addition, the risk notion sometime leads to political and sociological concerns and has not been well discussed so far in an international community. However, in order to enhance the 3SBD methodologies, an integrated riskinformed approach is explored with attention to the scarcity of intentional acts in safeguards and the secrecy of actual incident data in security.
In this paper, we will show the SM system as an example of SBD and will investigate the risk assessment methodologies that could be applied to the integrated risk approach for 3S assessment. In feasibility studies SM will be shown as advanced measurement technologies to ensure an operational transparency and a full obedience of safeguards implementation.
In international safeguards, quantitative and timely judgments regarding the location and movement of special nuclear material (SNM) are performed to ensure that there is no loss or unauthorized removal of SNM [
Due to concerns about proliferation risk that have been recognized as an important aspect of 3S and about requirement of the timeliness goal of the IAEA safeguards, modern reprocessing facilities should be provided with SM to increase safeguardability [
In the SMMS, the LDT tank data is produced by three dip tubes installed into tanks. Each of the three tubes measures pressure at different heights inside the tank, such as the level (
Schematics of SM composed of three dip tubes inserted into tank, each of which measures three pressures at different heights inside the tank. The calibration equation is decided as a function of the solution level and temperature beforehand.
The three pressure values are used to calculate the density
The SM application in the IAEA safeguards must rely on process data that are assured to be accurate and complete to draw safeguards conclusions and the data validity is checked using an authentication process. The authenticated equipment is owned and controlled by the IAEA, and when deployed for an unattended operation, it should be installed with tamperindicated enclosure and seal system. However, in a large reprocessing facility, the number of SM instruments becomes large and it becomes expensive to install and maintain by the IAEA. Therefore, the IAEA, national safeguards authority, and operator can establish joint use equipment (JUE) resulting in ease of data collection, reduction of maintenance burden, and reduced cost of multiple parties. In case of SM at the RRP, that is, a typical example of JUE, the electric signal from the operatorowned SM is not strictly guaranteed to be secured, so the IAEA randomly selects the instrument for independent authentication in which the inspector can carry an agencycontrolled instrument to check for proper operation of the operator equipment [
One of the most promising synergies resulting from the integrated 3S consideration is the adoption of 3SBD approach for new nuclear facilities. An incorporation of 3S synergism into the conceptual design and system development phase increases regulatory effectiveness as well as operational efficiency and also reduces expensive and timeconsuming retrofitting. Promoting 3SBD will require, among other technical and institutional issues, harmonization of the risk notion embedded in each of the “
Mathematical models and assessment methodologies applied to safety, safeguards, and security (3S). The governing law and incidence frequency are selected to classify the inherent nature among the 3S incidences. The mapping of individual 3S region is drawn heuristically.
In safety, PSA has been developed by the long historical trials and discussions. This approach is to estimate the frequencies of accidents and failures from the historical data and to analyze the accident sequence with event trees and fault trees based on these parameters. Because of the recent concern about nuclear security, similar probabilistic assessment was extended for use in developing guidelines for protection of nuclear power plants against sabotage [
Similarly, a major difficulty encountered in applying probabilistic methods to safeguards is to determine the incidence of diversion and misuse. Although the mathematical formalization for the international safeguards has been developed for several decades [
Twodimensional probability for safeguards. The probability distribution composed of two random variables, the incidence time, and the measurement error is a characteristic feature of the proliferation risk.
In (
Without showing an explicit description of proliferation risk, the risk notion has already been considered in the IAEA safeguards as the statelevel evaluation, and the safeguards inspection is carried out according to risk analysis with an expert elicitation. However, using a mathematical formalization of proliferation risk probability one could demonstrate its advantage in an objective manner, and the quantitative representation is valuable in the 3SBD approach. The assessment method of the proliferation resistance (PR) of generation IV reactors was addressed by the proliferation resistance and physical protection working group (PRPPWG) of generation IV international forum (GIF) [
In this study, an aqueous reprocessing model that is composed of the total 43 process steps from spent fuel pond to product storage is assumed as a typical PUREX process. As shown in the Figure
Markov model applied to estimation of the incidence probability. “
While the SM can generate realtime LDT data of the tank inventory, the SM capability depends on not only software performance of pattern recognition but also noisy background by sampling, homogenization, evaporation, and so on. The confidence level of diversion confirmation, shown by “
Proliferation risk analysis in the typical PUREX process composed of the total 43 process steps from the spent fuel pond to the product storage tank. The failure, success, and detection probabilities are expressed at the individual process step number.
The relation between the measurement error and the incidence probability is correlated with each other. Although the proliferation risk analysis in the preceding section does not consider the measurement error probability, both probabilities are investigated as a deterrence effect in this section. The incidence probability is determined by the diverter’s intention and the deterrence effect on the diverter should influence the initiation of the incidence and the possible deterrence effect is studied using a game theoretical model. Although a payoff matrix is not easily defined objectively to model the inspectoroperator relation, a noncooperative twoperson zerosum game is assumed to investigate an effectiveness of the operator’s restraint of falsification in the SM data that is an indication of the operator’s diversion. The game theoretical model in safeguards verification has been developed in series of the reference papers and the challenge is continued in recent work in which the time dependency in the payoff matrix was discussed [
The stochastic game model is an integration of a Markov decision process and a matrix game and is utilized to consider the inspectoroperator relation among multiple players and at multiple stages [
Payoff matrix of twoperson and zerosum game for the
Inspector  Operator  

Legal 

MUF  




MUFalarm 



nondetection  0 


0 <
Stochastic game calculation for the deterrence effect on the inspector and operator. In case (a), the increase of MUF variance due to the measurement error induces the increase of ARL, so that it is assumed as the increase of the payoff parameter of
Operator’s choices as increasing MUF uncertainty
Operator’s and inspector’s choices as increasing concern
On the other hand, in case that the solution transferring from the unauthenticated tank 1 to the authenticated tank 2, tank 1 is shipper and tank 2 receiver, the operator likely has a concern about detection of the falsification during the transfer. Because the transferred solution is conserved between the two tanks and the downstream tank 2 is independently monitored by the inspector, any falsifications in the upstream tank 1 are likely detected. The increase of concern can be modeled to the increase of the payoff parameter of
In this section the safeguards performance by the SM and minimization of initial and running costs is investigated as an uncertainty analysis for multipleobjective problem. The multipleobjective problem can be solved by several mathematical methods. However, in this study a fuzzy optimization technique is applied to obtain multiplegoals solution by a wellknown liner programming (LP) method. The fuzzy linear programming (FLP) has originally been proposed in the 1970’s and the application for nuclear fuel cycle optimization has been investigated thereafter [
First, two ordinary linear optimizations are performed incorporating the objective functions of
In order to investigate the cost effectiveness of the safeguards system in an advanced reprocessing plant, the performance of several safeguards measures governed by the measurement error is compared. The optimization using the FLP is applied to pursue the optimal design with considering the tradeoff relation between the safeguards performance and the cost. One of the controversial points in safeguards measures is a tradeoff relation between destructive analysis (DA) and nondestructive analysis (NDA). NDA instruments are generally remotely operated, do not need much labor, do not produce contamination, and provide results more quickly than DA. In addition to this, DA increases cost for labor due to the huge amount of samples in a plant operation and this leads to a high operational cost. On the other hand, at the dissolution process of spent nuclear fuel and at the input accountability tank, NDA instruments are not supposed to be used in a high radiation field environment. Therefore, DA is the only method that could be used for elemental identification and conducting NMA for plutonium under harsh circumstances.
After taking into account the constraints, an optimum selection of DA or NDA is investigated using the singleobjective functions. A fuzzy technique based on LP is applied to the optimization. The three schemes in the safeguards measures are examined for the typical three stages in an advanced reprocessing process. The three schemes are a combination of SM and isotope dilution mass spectroscopy (IDMS), that of SM and hybrid Kedge densitometry (HKED), and that of flow meter (FM) and other advanced NDA such as neutron coincidence counting (NCC). For the typical three stages in the reprocessing process, we select dissolution, solvent extraction, and concentration processes. In the dissolution process, there is the constrained condition for NDA due to harsh circumstances. As increasing of the throughput of nuclear material, both the measurement error and the cost estimation are modeled to change as a function of the throughput and as shown in Table
Three schemes of safeguards measures for the advanced reprocessing process.
Scheme A  Scheme B  Scheme C  

Safeguards measures  SM + DA (IDMS)  SM + NDA (HKED)  FM + NCC (NDA) 
Measurement error (random, systematic) %  (0.4. 0.3) % [ 
(0.7, 0.4) % [ 
5 % 
Error scaling ( 



Cost  300 k$  600 k$  500 k$ 
(lnitial (k$) + running (FTE))  +5FTEs + 10FTEs [ 
+3FTEs [ 
+3FTEs 
SM: solution monitoring, DA: destructive analysis, IDMS: isotope dilution mass spectroscopy, NDA: nondestructive analysis, HKED: hybrid Kedge densitometry, NCC: neutron coincidence counting,
The optimized selections of three schemes from stages 1 to 3 according to the increase of the throughput are shown in Figure
Fuzzy optimization for safeguards measures in the reprocessing process. The performance of safeguards measures and the initial and running cost for the safeguards measures are compared in the typical three stages; dissolution, solvent extraction, and concentration stages. As increasing the throughput in the horizontal axis, the optimal choice for the safeguards measures is changed according to the assumed dependency of the performance and cost on the throughput.
PRA in safeguards and security has been evolving and applied to the promotion of 3SBD activities. However, the theoretical basis is diverse and the effectiveness of PRA in these areas has not been clearly demonstrated yet. SM with the LDT tank data has been widely used to implement the IAEA safeguards in the large reprocessing plant and has become an important measure to assure the credibility of no diversion and no misuse of SNM. Not only for an advanced instrument but also for riskoriented installation, it is shown that SM is a good example of safeguards by design activities. The Markov model is applied to PRA with the PUREX model and it is clearly demonstrated that the vulnerable path in the PUREX process is safeguarded by the SMMS originally installed based on the expert elicitation. The game theoretical approach applied to the theoretical explanation of the IAEA safeguards is used to explain the effectiveness of the selfauthentication notion. The deterrence effect on the operator’s falsification is shown as a compromise with the profit and the penalty and this concern makes the deterrence effect one of explanations for the selfauthentication. The last study on SM is the uncertainty analysis to optimize the safeguards measures with the tradeoff relation between the safeguards performance due to measurement error and the economical consideration as increasing the throughput in the advanced reprocessing process. Both the harsh circumstances with the residual minor actinide (MA) and FPs and the increase of measurement uncertainty due to the large throughput support more NDA installment than DA with considering the initial and running cost of those measures.
On the other hand, for the purpose of quantitative application of SM to the IAEA safeguards, the validity of the SM data taken from the unauthenticated tank is investigated in terms of the detection probability (DP) at the authenticated tank. The selfauthentication based on the mass conservation of authenticated solution among those tanks is investigated by the detection capability for the
The probabilistic risk methodologies in safeguards and security have been developing and the inherent difficulties due to intentional acts are still challenges. However, the Markov model, the game method, and other mathematical methods could be applicable to the decision problems in safeguards as well as security. Integrating the PSA in safety with the risk assessment techniques in safeguards and security would have a potential to fascinate with the younger generation, and the comprehensive 3S regulation based on the quantitative risk discussion should be transparent and persuasive for a reasonable approach in the mandatory 3S implementation.