The key issues noted here are some of those raised by individual workshop participants, and do not in any way indicate consensus of workshop participants overall.
• Security is a national responsibility but has international dimensions.
• Communication with the public is important because in an accident or disaster scenario, there is not time to really explain thoroughly.
• Decision making in an unexpected emergency scenario would involve multiple players: political leaders, operators, regulators, bureaucrats, politicians, representatives of the local community and others.
• The balance between research and security interests is at times difficult to define and maintain.
Promising Topics for Collaboration Arising from the Presentations and Discussions
These promising topics for collaboration arising from the presentations and discussions do not reflect a consensus of the participants, but are rather a selection of those topics offered by individual participants throughout the presentations and discussions.
• Improving the accuracy of measurements may be an area of possible cooperation.
• Jointly discussing risk-based versus risk-informed decisions would be of interest.
• Bringing in experts from other fields to discuss training in dangerous, high-consequence areas, such as aviation, could be of joint value and interest.
Jointly discussing how to incorporate culture into nuclear security issues would be of benefit to experts from India and the United States.
Baldev Raj began by observing that security has become a key word in people’s discussions. We talk about an idea of security: food security, water security, and nuclear security. What do we mean when we talk about this word security? We mean that we have concerns, and we know that the concerns are not short-lived, and we have to take systematic approaches: Science, technology, policies and implementation to ensure that various types of security are achieved sustainably.
The risks and the security efforts against those risks are national responsibilities, but they have international dimensions due to connectivity. Consequently, countries have responsibilities vis-à-vis international organizations, and we in the international community study the situation and countries’ responses during catastrophes.
Nuclear security includes safety, protection, and nonproliferation. These three pillars are few in number, but the interfaces among them are huge and multidisciplinary, particularly with respect to science and technology. The number of emergencies is increasing, but the maturity in handling these emergencies is increasing at varying rates. Most safety scenarios in today’s facilities develop slowly, whereas security scenarios often develop quickly in unpredictable ways, but safety and security are still interconnected. Nuclear safety can be discussed with complete transparency, but the moment the word ‘security’ is introduced, various levels of opaqueness appear. Because one can speak more transparently about nuclear safety, the maturity of science and technology is much greater, as is the ease of making decisions. This does not mean that one is easier than the other, but there are differences with regard to how much money has been invested, when the programs started, how many people work in which areas, and which analytical tools (e.g., simulation and modeling tools) are available.
The problems are complex. These complexities include a diversity of sources and scenarios. Sources vary from reactors to fabrication facilities to reprocessing to fissile materials during transportation. In the security domain, sometimes responsible parties cannot be transparent. Access in knowledge in databases is provided on an “as and when by whom basis.” In nuclear security, the organizations remain, but the repository of information is with the individual people; they are very different and that is important to decision making. Decision making roles are clear, as they are among people, regulators, bureaucrats, and politicians. Raj is not worried much about sources. He is more worried about gaps in decision making in nuclear security. Rogue countries and their operations, conservative and clear versus bold and realistic. This is always a thin line, but often one needs bold, but realistic decisions; being conservative in this case will not work.
The anticipation of human resources, with different expertise and abilities, and communication at different levels with effectiveness and credibility looks so benign that it has been ignored. All of us think that we are very good communicators, and we all know what poor communicators we are. Communication in the nuclear area, particularly in the case of catastrophes or severe accidents, has never been good. Paradigm changes are needed. Perhaps young people who know how to communicate better and very clearly in a short time can help. Younger people should be on committees, and we should be listening to them. Understanding the interface between people and technology is always difficult, but it must be managed. If we don’t manage it, we are not going to have a systems approach, we will have a domain approach, which is not going to be successful. Therefore, a paradigm shift is needed.
Raj then noted that lessons learned about nuclear security from one accident in a country cannot be directly translated to another country due to differences between cultures and the way decisions are made. If one were to try to simulate a Fukushima-type accident in China, the United States, or in Europe, there would be different responses in each country, although the science and technology are very similar. Translating International Atomic Energy Agency (IAEA) guidance into different cultures so that it affects how vital decisions are made is difficult.
This gets back to effective communication to educate and enhance the ability to discern between essentials and nonessentials; this is key to solving problems. Take the case of Fukushima. Radiation levels in residential areas may be reasonably low, after decontamination, radiation levels can be brought to completely acceptable levels. With more effective communication, citizens could be involved in the science and technology to conduct decontamination or rehabilitation in a much better way. We keep on talking about microsieverts, millisieverts. Who understands that? Communication with the public has to be very different. These issues need to be well understood by people because in a disaster or accident scenario there is no time to really teach people what to do, unless they were prepared well in advance.
Decision making in an unexpected emergency situation would involve multiple players, each with their own expertise and motivations: very powerful individuals (prime ministers and presidents), operators, regulators, bureaucrats, politicians, representatives of the local community, and others. How, Raj asked, do people who have different knowledge bases make decisions? This must be determined in advance; it could not be determined at the time of an incident because there would be so much confusion and clutter that it would be difficult to identify a small signal among a whole lot of noise in order to make a good decision.
This was one lesson of the Fukushima accident. Decision making regarding response requires an agreement on approach, and implementation, and this is part of a systems approach, stated Raj.
With nuclear security and nuclear safety, there are differences in potential damage assessments with different disaster scenarios. A sophisticated attack on
a nuclear facility could jeopardize both nuclear safety and security. One needs to consider differences in modeling and simulation, advanced sensors, robotics, and instrumentation. Responding to safety and security incidents may present conflicting challenges. One may wish to limit human response where the risks to responders may be deemed very high, yet there may be no other choice, such as in responding to a fire in areas of high radiation concentration. There may be a way to optimize response if good thinking goes into the development of response scenarios that incorporate advanced science and technology. The STAR Project of the European Commission is a good beginning.
Raj noted that the IAEA will also have a central role to play, along with other multinational organizations, and individual countries that offer assistance. Each player would bring very different kinds of cooperation and collaboration, and managing these interactions is very important.
Science and technology must play a central role, be it through modeling and simulation, or be it through decontamination and rehabilitation. Wonderful technologies have been developed in Japan to decontaminate and rehabilitate very large areas, and these would be useful to the world. Robotics are bringing advances in the form of miniaturization and the availability of technologies to all countries, although there are export control limitations. Perhaps where nuclear safety and security are concerned, key technologies could be made available.
A paradigm shift will require that every country do a lot of work to ensure fresh ideas and fresh thinking to move forward and to continue to question each other to make and sustain changes. In this regard, international collaborations have a significant role to play. Raj noted the fact that these issues have been discussed for years and decades indicates that they are important, relevant, and changing. There is now a demand for incorporating a judicious mix of qualitative and quantitative approaches into modeling and simulation approaches to safety and security. Likewise, there are now many means of data and information retrieval, analog and digital approaches for example, as well as hybrid approaches. Based on greater understanding, it is possible to move forward and to improve technologies.
Human resources are the most important aspect. Knowledge alone is not going to help. There are many knowledgeable people on this planet, we also need wise and ethical leaders who can work at these interfaces and make decisions. Raj expressed his view that these people seem to be disappearing. There is a great deal of optimism, however, because there are very capable people who take these matters seriously and who are committed to finding solutions, such as those at this workshop and at similar gatherings. Strategies have to be found, and Raj looks to Galileo, Faraday, Deming, and Taguchi for inspiration.
Specifically, in the area of measurements, there must be a way to improve because correct measurements are key. No matter how much consideration goes into discussions, measurements in each domain must be accurate. Too often we are satisfied with cataloging measurements taken. The right measurements might not have been taken to allow for cost-effectiveness and optimization. This is important especially at the interfaces and in the design phases. Safety and non-
proliferation aspects must be incorporated in the design phase, even beyond the design basis threat approach to appreciate linkages, to anticipate problems, and to not repeat mistakes. Learning from these mistakes might prevent other catastrophes and mitigate harmful effects in the event of an incident.
Raj concluded by referencing the teachings of Buddha from which he draws optimism: detach, clear, balance, experiment, maintain conviction, pursue, achieve.
Systems Approach from a U.S. Perspective
D.V. Rao opened his presentation with a quotation from Will Rogers that guides his thinking on nuclear security: “It is not what you don’t know that hurts you. It is what you think you know, but that ain’t so that gets you.” In other words, it is not what we don’t know that is the problem, because we have a way of solving gaps in knowledge. Rather, there are cases where we are certain we know but we are mistaken. These are the problem because we are not very prepared. Systems analysis and the mathematics that underlay it provide an objective way to analyze gaps and communicate gaps.
There are different types of communication as Raj noted, and this communication is done at different levels. On one level, people are very educated but may not be aware of the details of nuclear engineering necessary to address the gaps. How does one communicate with them and demonstrate that one has done the best one can? That is the key: to have done the best possible to determine the gaps, find a solution to those gaps, and communicate those solutions. There are risks, and they must be shared by all populations; this must also be communicated.
Throughout the presentations, one thing has become very clear, Rao said: nuclear facilities are socio-technical systems. Engineers try to make them an engineered system as much as possible because an engineered system is much easier to manage. The social aspects of these systems are not easy to manage. There are certain expectations about social behavior in democratic institutions or democratic countries. How are these accommodated?
To make it more complex, almost every nuclear facility, even reactors, are complex and unique. Therefore, the way they implement security and safety regimes is a one-of-a-kind system. One does not put it on autopilot. In fact, often automation gives false signals, and false signals give security guards reasons to turn off of the sensors: “Oh, that thing always beeps. I (the security guard) am just not going to do anything. It is probably a rabbit jumping over the Restricted Area.” Automation may not do the job that one expects it to do.
A second point is that many of the nuclear facilities have a research and development (R&D) function, be it civilian or in the defense industry. Without R&D it is difficult to recruit very smart people to work at your facilities. Rao then asked, how does one balance research interests against the other two competing interests of materials and information security and transparency?
To try to address nuclear security, Department of Energy national labs have been exploring a variety of modeling and simulation and analysis techniques, including visualization techniques. Together they then form the important tools in developing and designing and creating a system to draw the most from that system. Further, regardless of the techniques, there are no substitutes for policy or regularity regimes. There is guidance from IAEA and from Indian regularity agencies. Some of the regulation is prescriptive, not performance-based. Even with prescriptive guidance, we must understand that (1) regulations are based on certain assumptions, either regarding design basis threats (DBTs) or regarding existing technologies and the limitations of those technologies; and (2) the system should be designed to fail gracefully. In other words, if a system is designed based on a threat in which a person would come with a certain number of guns and a certain amount of explosives, and in reality, a person may have double that, the whole architecture may completely collapse. Graceful failure is the goal, allowing the system to be able to function in defeat.
There is a similar term in mathematics: “epistemic uncertainty,” or the “unknown, unknown.” Because one does not always know what is not known, sufficient margin is needed, but it is not always clear what a “sufficient” margin is. For example, the Fukushima Diiachi plant was not a badly engineered system, but Rao stated that every nuclear power plant operator has known for a long time, through the mathematics of the probabilistic risk assessment, that a station blackout is a possibility. The probability of a blackout and possible causes have been analyzed in depth. There are new regulations in the United States regarding station blackouts. Engineers also have to deal with how to address potential problems at older plants. When those decisions are made, some mathematical techniques can help identify and build consensus on decisions and risk-acceptance at a national lab or state level.
Physics-based models can also help determine answers to questions such as: “If that much of the process material is going through a line, what types of signatures would one expect?” Modeling and analysis tools are improving, and it should be possible to simulate facilities very accurately with high fidelity. As India demonstrates leadership with the fast breeder reactor program and fuel recycling facilities, some of these methods should be used to set guidance for the rest of the world, working with others, because that guidance does not exist.
With regard to DBT, law enforcement agencies, engineers, and subject matter experts come together and assess what is likely to happen from a threat perspective. In case of a smart insider, or an intelligent adversary, some of these methods break down. And the dynamic flow graph and the logical flow graph are methods designed for these threats. It is important to always look for new techniques and methods by which to fuse data and provide data with some degree of confidence, recognizing that all recommendations have associated uncertainties. Some methods are based on inference, some on forensics, and some on force-on-force modeling descriptions. Rao stated that he prefers the term “riskinformed,” rather than “risk-based,” because risk is one attribute that informs
decision-making. In this formulation, value is assigned to risk, but value is also given to other aspects as well.
One example of this is called a “multi-attribute utility.” In this case, one asks “for that fuel cycle and for that operation within the fuel cycle, are the various attributes that contribute toward security?” Working through issues by asking this question makes decision-making more transparent. One attribute, for example, is material attractiveness. DOE has undertaken a process to bring experts from the three weapons labs together and ask them to establish a more scientifically-defensible approach to defining material attractiveness. This process has been under way for two years and has made progress.
With relevance to the Indian nuclear sector, the material attractiveness of light water reactor material and material attractiveness for a fast-reactor are not the same. They are different because the breeding plutonium vector (isotopic composition) is different. There is also a difference between materials associated with light water reactors and heavy water reactors. Experts in India may undertake a similar process and distill the information for others so that they can evaluate options, for example, for treating spent fuel or separated plutonium. Questions remain for all countries that have plutonium. Experts need to find ways by which to communicate the attractiveness of various materials or the inherent security features of materials.
Communicating these issues beyond the scientific community to policy-makers raises different issues. For example, if one has pressurized water reactors with very low burn-up rates built in the 1960’s, with spent fuel close to the reactor site, the attractiveness of the materials increases. This may lead to the question: “Should the material be kept there, and, if it is moved, should the fuel cycle be closed?” One can also demonstrate that after 50 years, even the spent plutonium fuel becomes very attractive due to low doses of radiation emitted and low heat, warranting attention. These are the decisions that stem from the development of tools and the resulting analyses conducted in a comprehensive way.
In conclusion, Rao noted that the threat spectrum is a continuum. One has to analyze various threats and assess whether nuclear materials would be attractive targets in particular scenarios. Then, a judgment needs to be made as to the level to which one should protect material, a facility, and so forth. The owner of the facility, together with experts, assesses intrinsic vulnerabilities, intrinsic risks, and operational risk. These assessments are coordinated with intelligence information, local police and others, to reduce the intrinsic risk, or to reduce the operational risk as far as possible from the intrinsic risk.
Reflecting on Raj’s presentation, the discussion moderator noted that in future meetings, it may be helpful to invite a presenter from Boeing or Airbus because they deal with training across multiple cultures on the same, potentially dangerous technology. There are also some academic studies about how people
from different cultures and societies actually learn to fly jumbo airplanes. They have had a lot of practical experience and it might be useful to hear about the lessons they offer.
An Indian workshop participant emphasized Raj’s comments about sensors and robotics. This is one area which has grown in India and abroad. Measuring sensors and modeling are also important. Perhaps this could be a topic for future meetings because the participant said, India is not as strong in the area of sensors and their utilization in multiple areas, whether for protection or guarding consistency.
Micah Lowenthal asked Rao and others about systems analyses for identifying areas of leverage points, but also for establishing probabilities. There are multiple camps that have opinions about these tools. At one extreme, one says, “we don’t care about the results, it is really the process of going systematically through and analyzing that is most valuable.” The other says that, “we really want the results, and that is what is going to give us our prioritization of how we are going to remedy our systems or design our systems.” Where do you come out on that? What would you think is most valuable?
Rao replied that he views risk-informed rather than risk-based approaches to be more effective. The process is more important, bringing in subject-matter experts, including mathematics, brings quantification and rigor that adds another level of learning. Coming together makes a greater difference than the final answer.
The moderator then asked for suggestions of materials that might offer a helpful introduction to the science of risk in addition to the book entitled, Normal Accidents, by Charles Perrow.1 Another participant recommended Scott Sagan’s work on nuclear safety.2
A participant referred to Raj’s inclusion of incorporating culture into nuclear security issues as well as the importance of communicating effectively with the public about acceptable levels of radiation for decontamination. How could Indian and American experts actually start to work on these issues? How do we actually explain to each other that we have an equal amount of knowledge, but that knowledge may be in different fields?
Raj replied he had first-hand experience with this because he was in charge of the tsunami response at Indian nuclear facilities in 2004. After the initial emotional shock, they started putting together people who were knowledgeable about the culture of those engaged in fishing in the area, the culture of the bureaucracy, and the culture of how much information to provide. This is important because in a nuclear scenario if the right information isn’t given, one can be held responsible for suppressing information. Conservative information might have been provided in good faith, so Raj chose words very carefully, and
1 Perrow, Charles. 1999. Normal Accidents: Living with High-Risk Technologies. Princeton: Princeton University Press.
2 Sagan, Scott Douglas. 1995. The Limits of Safety. Princeton: Princeton University Press.
was bold but realistic. People would advise him to not to say certain things, but he responded, “Let us say that we are watching the facilities, and as of now, there is nothing of concern. We have instrumentation and sensors, and if anything develops, we would have information within a few hours.” It is extremely important to have complete, clear information and then distill it. There must be a strategy for being transparent and for effectively dealing with that transparency.
Raj’s experience demonstrates that if one can be transparent and convincing, one can cut across different levels of knowledge-based bureaucracy, but one has to be transparent, first of all, even at the cost of losing one’s job and having politicians unhappy because what is said is something they may not like. This is candor. And the second key aspect is to effectively involve them in the huge job. If they are not involved, just being nice at the time doesn’t help. One does not need nice people at that time; one needs people who become a part of the solution. It is possible to involve all stakeholders. In order to do so, one has to understand what the fishermen and fisherwomen, the small shop keepers, the people in general know of the facilities.
Culture comes after knowledge. If one has knowledge, a way of understanding the culture, and communicating, one can have success. This is a subject that needs much more discussion. Immediately after the tsunami, a wonderful meeting was held at the National Institute for Advanced Studies (NIAS), where all of the people who handled this response were called together to try to study how cultures had influence, how they communicated, and where they were successful. The proceedings of that meeting are available. It may be worthwhile to spend a day on this together.
A participant then provided a minor example from the American case that was only 12 hours old. A spokesman for the New York University Hospital stated that when the backup generators failed the hospital as a result of Superstorm Sandy, newborn babies were carried down the street to transport them to another facility. The interviewer kept on asking the hospital spokesman, “Did the generators fail?” And the spokesman said, “I can’t answer that question, can’t answer that question.” He was afraid of a lawsuit. Basically, in the American system, the spokespersons, especially of private organizations, are worried about the legal system. So in this recent case, he could not admit what everybody knew - the generators had failed.
Paul Nelson then commented that the weights assigned to the different security factors do reflect cultural differences. It is often more difficult than one might think to arrive at a consensus as to what those weights should be, even in the context of a given country or a given state. But one can test the sensitivity of the conclusions relative to those cultural factors; sometimes they may not be quite as sensitive.
Another workshop participant commented that it is not easy to convince people who are going to invest human and financial resources into nuclear safety and security based on validating models with mathematics and a vector.
In response, a participant expressed his strong support for modeling, simulations, and analysis as they are the best tools and technologies.
A workshop participant from the United States agreed that when one is asking someone to invest hundreds of millions of dollars based on a model alone, it is very unlikely that they would be persuaded. However, models are tools, and any good modeler knows that models are inaccurate. But, when that model is used within a small focused area together with analysis from subject matter experts who can propagate uncertainties in a rigorous way, trustworthy answers can be found. Any model informs understanding of what is likely and what is absolutely unlikely, and this is the decision point about risks.
Another participant with many years of experience concurred that transparency is very important and that it stood him in very good stead, although at times, he thought that particular statements may cost him his job. But over time, it builds confidence in what one says and people have supported him, for which he is thankful.
A workshop participant from the United States relayed some of his own professional experiences over the years working internationally. Regarding the importance of people, there is a certain amount of integrity of the models as well as of the individual analysts. Over the years in certain cultures, we have shared experiences and knowledge about how to do these types of analyses. There are examples when an analyst from another country has done the same analysis and come up with different numbers and cannot even explain the difference. Ultimately, the analyst would say, “My guy can’t take these numbers to my management, because the results are coming out bad.” There has to be integrity in the process of conducting these analyses. A lot of money rests on the results sometimes, and at times, bad news has to be delivered to management to force certain security upgrades to take place. There is a bit of a cultural aspect to understanding how to deliver the results of some of these analyses in an effective way and to maintain integrity in the process as well as integrity as professionals. The human element is a key part of the overall security posture and protection planning and everything.
The moderator suggested that for the next meeting or workshop, we might want to commission some case studies, some from America, some from India, successes and failures in dealing with the public during disasters. Clearly, there have been enough failures and maybe some successes and maybe scholars can produce case studies of these successes and failures and we can then try and analyze why they were such. The roles of science and technology in responses to Hurricane Katrina and the Fukushima accident could be case studies, for example.
A participant followed this suggestion by reflecting that when experts were at the IAEA looking at Fukushima modeling in the very early stages after the tsunami, some would say that they had much better models to be able to predict how the hydrogen would appear. However, when that information was given to IAEA, it never reached the Japanese people and it was not clear how it would have been used if it had been reached. The modeling and simulation done by different groups was widely different. As long as the results converge, it is easy, but results can be so widely different that one needs a benchmark exercise.
That takes a long time and a lot of money. Someone has to invest the resources and involve quality people. This is improving.
A participant from the United States noted that the Sandia MELCOR Model, used in real-time to predict the outcome of the Fukushima accident, actually proved to be fairly accurate because it is rigorous. That particular model was started right after the Three Mile Island accident and various agencies and labs have all contributed to that model at different levels and continuous updates have been made. It seems that India is doing something similar. One has to conduct 2D, 3D experiments, separate effects experiments, combine complex experiments and then start assimilating all of that information back into the model. These experiments need to be conducted over years and decades before one reaches a point where one can have more faith in the model. This is something that needs commitment. If all of these investments are made, the models can be very reliable. One has to avoid simply stating that one model is better than another.
A participant asked about the Indian response to the 2004 tsunami. The response seems to have been positive because the individual in charge at that time had the sensitivity and the experience, and perhaps had the wisdom, but did he have formal education and training? This has to be part of a senior leader’s background (deputy heads and heads) because the public does not trust just a routine spokesman. They want confidence to be instilled by someone who is in a position of authority and whom they can trust. Is there any formal input, formal education, formal awareness program for dealing with the public on such issues in the event of a mishap?
Another participant replied that he didn’t believe there is one, but strongly agreed that everyone finds themselves incomplete in these circumstances. It would be better placed to use all of our convictions and commitment, and in addition to have the background and experience and learning from others. This is very important. Would it be helpful to have an orientation of one or two days for leaders of various programs who would be called upon to communicate with the public?
Shri B. Bhattacharjee commented that the first responders will be the first on the scene in a nuclear event. There is a slight difference between nuclear event scenarios and natural event scenarios because in natural event scenarios, one can heavily rely on tradition and knowledge. Unless one relies on and captures their wisdom and knowledge base, responses in nuclear event scenarios will be a failure. With regard to a radiological emergency or disaster, there is another difference because that is where the advantage of Generation Program becomes all the more important. It may not be obvious to responders what to do in these events. The National Disaster Management Authority has no authority to make decisions on the ground (and other agencies do not have that role), therefore a specialist to the local administrator would be helpful. Elected officials may also have difficulties due to the need for reelection. People may have more confidence in elected officials whom they have elected. Information must be delivered in local languages by elected officials in the way they think is best
(e.g., hanging posters on boxes, or at railway stations, or via weekly or monthly gatherings).
In addition, India has a National Disaster Response Force with about 12,000 people, one of the largest in the world, with a dedicated force for disaster management including severe disasters. This force works with local forces and trains them as well. At a time of peace, prior to a disaster, these forces should prepare people at the grassroots level, accepting the help of the “home wards.” This should be the model for responses to nuclear events. It is the single most important thing that should be done because if one wants to grow using public money, and if that growth occurs without public confidence, it will not work. No matter how great a genius one may be in this area, he or she must be allowed to speak without any question.
With regard to training people or courses for communicating complex issues to the public, another participant remarked that the many communication courses available to him and his colleagues focused on good communication skills in general, including how to make a limited number of points clearly, and not be too complex. A class specifically on how to communicate scientific uncertainties without causing panic would be helpful to develop. Other issues to address in such a class would be how to communicate topics unique to science and the realities of what experts deal with to the people.