DOE G 421.1-1 Appendices, DOE Good Practices Guide

118 DOE G 421.1-1 8-25-99 APPENDIX A. PERSONNEL SELECTION, QUALIFICATION, TRAINING, AND STAFFING PROGRAM The purpose of the program is to establish (develop and document) the selection, qualification, training, and staffing requirements for personnel such that persons are qualified to carry out their assigned responsibilities, that they have a broad understanding and acceptance of the inherent risks involved with the operations, and that they maintain a job performance proficiency consistent with effective control of the hazards and risks associated with the operations. Three broad categories of the program are considered in this appendix. The categories are (1) the operations and support personnel associated with fissionable material operations outside of reactors, (2) the installation nuclear criticality safety staff, and (3) visitors and clerical employees. The personnel selection criteria and depth and breadth of nuclear criticality safety training are necessarily variable, depending on the work assignments of personnel. The ensuing discussion in this appendix is intended to provide guidance for organizations establishing new programs or improving current programs. This guidance is presented in an a posteriori form, expressly to emphasize that the specificity of structure and nomenclature for personnel selection, qualification, training, and staffing is illustrative and suggestive rather than recommendatory. General requirements of the program are provided in the applicable documents listed in paragraphs 2.1.9 and 2.3.1.12. A.1 Program for Operations and Support Personnel. The category of operations and support personnel includes fissionable material handlers and their supervisors, operations support, design, maintenance, technical support (including the members of the Nuclear Criticality Safety Organizations) and emergency response personnel, managers and other administrative personnel, and persons who enter areas where fissionable material is processed, stored, or handled. Guidance for the selection, qualification, training, and staffing requirements of these persons is provided in Chapter IV of DOE Order 5480.20 and ANSI/ANS-8.20-1991. As consistent with job assignments and personnel acknowledgement of job hazards and risks, the following elements should be considered for inclusion in the training and qualification program. A.1.1 Continuing proficiency of personnel. Establish the training and qualification program to provide continuing proficiency of personnel. Tailor the program to job responsibilities, conduct of the job, recognition of hazards, and acceptance of risk. Establish requirements of refresher training. Such training shall be provided at least every two years. 1OO A.1.2 Nuclear fission chain reactions and accident consequences. Discuss the concept of a nuclear fission chain reaction. Make a distinction among families of chain reactions in which fission rate decreases with time, those that are sustained with a constant fission rate, and those that have an exponential increase in the fission rate. 101 Describe the time history of super-critical excursions for both metal (fast neutron) systems and for moderated (slow neutron) systems. 102 Include information about the kinetic energy release during the fission burst and compare it to the 100DOE 5480.20A, Chapter I Section 10. IOIANSI/ANS-8.20-1991, section 7.1.1. I02ANSI/ANS-8.20-1991, section 7.1.2. DOE G 421 .1·1 8-25-99 119

equivalent energy measured in familiar events; for example, chemical explosions.103 Distinguish between the initial, the delayed, and possible radiation doses from criticality accidents in light of expected doses at various distances from the source of the criticality as influenced by the rapidity of evacuation. Discuss health effects of criticality accidents. A.1.3 Neutron behavior in fissioning systems. Describe neutron induced fission, neutron capture, and neutron scattering and leakage. 104 Discuss the influence of neutron energy on the fission probability.105 Explain neutron moderation as the mechanism that reduces the neutron energy.l06 Identify several good neutron moderators. Discuss the use of neutron absorbers (poisons) with emphasis on caveats when relying upon soluble neutron poisons. A.1.4 Criticality accident history. Review and describe selected criticality accidents. Include a discussion of the causes of the accidents and their terminations. A.1.5 Response to criticality accident alarm signals. Train personnel in the recognition of, and the response to, criticality accident alarms and the relationships of distance, time, and shielding to the reduction in a received radiation dose. A.1.6 Nuclear criticality safety parameters. Explain and illustrate the influence of various nuclear criticality safety parameters on process safety. These include mass, geometry, interaction/separation, moderation, reflection, concentration, volume, density, neutron poisons, heterogeneity, and enrichment. Illustrate the concept of contingencies (Le., the loss of a nuclear criticality safety parameter control) by examples pertinent to facility operations. Review and discuss facility single parameter limits. A.1.7 Policy and procedures. Describe the facility management's nuclear criticality safety policy and include discussions about the use of operational and facility configuration control procedures for the control of nuclear criticality safety parameters. Inform employees of their right to question any operations that they believe may not be safe. A.1.8 Evaluations. Periodically, perform and document evaluations of the training program and trained personnel. Retain documentation of the evaluations in accordance with DOE 0 200.1, formerly DOE Order 1324.2A and DOE Order 5480.20. A.2 Installation Nuclear Criticality Safety Staff. This category includes the manager and members of the installation Criticality Safety Organization who are responsible for performing computational or comparative evaluations and safety analyses for fissionable material operations; for developing procedural, process, and control requirements; and for providing procedural, process, and equipment/facility reviews and approvals, nuclear criticality safety training program development, and facility operational reviews, appraisals, audits, and investigations. Broad personnel selection, 103 ANSI! ANS-8. 20-1991, section 7.1 .2.1 . 104ANSI/ANS-8.20-1991, section 7.2.1. lOS ANSI/ANS-8.20-1991, section 7.2.2. 106ANSI/ANS-8.20-1991, section 7.2.3. 120 DOE G 421.1-1 8-25-99 qualification, training, and staffing requirements are provided in the applicable document listed in paragraph 2.1.9. The professional personnel charged with implementing the programs identified in this Guide are designated nuclear criticality safety specialists (NCSS). A.2.1 Qualification. There are currently only general qualification requirements,107 but ongoing and future qualification of individuals should consider developing confirmable documentation that addresses the following:

1. A demonstrated capability to perform installation-specific analyses (and, if appropriate, facility-specific analyses) of the NCSS job and its tasks for existing and experienced new­ hire NCSS personnel. 2. A qualification checklist, file, card, or other record that identifies each applicable task and the method(s) by which competence has been demonstrated through apprenticeship for inexperienced new-hire personnel with performance evaluation based on actual or representative work products. 3. A baseline education of a baccalaureate degree in engineering or science and a minimum experience in nuclear criticality safety at the facility of one (1) year to independently perform NCSS tasks (e.g., be classified as a Specialist), and three (3) years to provide independent review and quality assurance of NCS tasks (e.g., be classified as a Senior Specialist). Equivalencies may be established. 4. Certification of final qualification by line and safety management. 5. Periodic competence confirmations based on practical exercises in one or more of the four functional specialties (see paragraph A.2.2) consistent with their responsibility and level of activity in each area. Qualification documentation should address the following three points: 1. Modes: a. Formal training (onsite and offsite), b. Apprenticeship and structured on-the-job training, and c. Professional development activities. 2. Functional specialization (e.g., code validation, dOUble-contingency analysis, process support, procedure reviewer, peer reviewer): a. Analysis, b. Evaluation, c. Implementation, and d. Confirmation. 3. Technical proficiency for each functional specialization (e.g., novice, apprentice, expert). For the purposes of this section, nuclear criticality safety specialists (NCSS) are collectively the professional staff with primary responsibility for implementing the activities and programs required I07DOE Order 5480.20A, Chapter I, 7.g. DOE G 421.1-1 8-25-99 121 to support this Guide. As defined below, the job designation, "Specialist," is that of the baseline individual capable of performing independently (perhaps in a designated functional area). The more highly qualified Senior Specialist has additional responsibility for providing independent review and oversight. The titles are functional and, therefore, independent of site-specific human resource designations that may include engineer, senior engineer, etc., and may have intermediate classifications. This section provides guidelines for judging initial qualification and continuing competence of nuclear criticality safety specialist personnel. DOE Order 5480.20, "Personnel Selection, Qualification, Training, and Staffing Requirements at DOE Reactor and Non-Reactor Nuclear Facilities" (2-20-91), does not address qualification for the NCSS position specifically. However, this Order does address qualification requirements for positions that have similar and related responsibilities (as described in paragraph A.2.3.5). Engineers and other personnel assigned a limited number of tasks related to nuclear criticality safety, and technicians performing routine tasks under direct guidance from nuclear criticality safety specialists (e.g., audits using a checklist, computer testing, etc.) are excluded from this Guide. However, all shall be qualified for the tasks they perform and may participate in appropriate portions of the program describe.d herein.

The qualification processes described in this section require documentation and management approval for qualifying NCSS personnel. Qualification ultimately is the responsibility of management, which should also address personal characteristics of maturity, judgment, decision­ making ability, independence, and teamwork. This qualification process allows for specialization in one or more of four functional specialties in the nuclear criticality safety discipline and assumes the ability and availability for an anticipated mode-of-progression in job responsibilities from Entry-Level to Senior Specialist followed by ongoing demonstration of continuing competence. A.2.2 Functional specialties. As noted in the applicable documents above, all nuclear criticality safety specialists are considered to be personnel who are • familiar with the physics of nuclear criticality and with associated safety practices to furnish technical guidance to management appropriate to the scope of operations; • skilled in the interpretation of data pertinent to nuclear criticality safety and familiar with operations to serve as advisors to supervision; • involved in technical support functions of surveillance, of analyzing facility data, planning modifications, reviewing programs, and resolving technical problems within the area of nuclear criticality safety; and • having the responsibility and authority to comment on, or review and concur with, nonreactor nuclear facility fissionable material operating processes and equipment. Thus, collectively, each requires competence in physics of nuclear criticality, associated safety practices, and familiarity with facility operations. However, individual specialists may be qualified to meet all responsibilities or may have specialization consistent with the collective competence of the entire organization. This section allows for, but does not require, broad specialization 122 DOE G 421.1-1 8-25-99 consistent with traditional nuclear criticality safety practices. The following generic areas are addressed: 1. (Safety) Analysis -- performing design analysis for processes and equipment and for integrated safety assessment with attention to nuclear criticality safety. 2. Evaluation -- performing the unique subset of (safety) analysis that deals with computer and other evaluations for system subcriticality (subsequent use of the term analysis/evaluation reflects the interrelationship between the two functions). 3. Implementation (Administration) -- providing administrative interface for integrating analysis/evaluation with facility operations and practices (e.g., procedures, specifications, postings, and training) and for meeting regulatory and other requirements. 4. Confirmation -- performing audits and other assessments of compliance with analysis/evaluation requirements and conditions, regulatory requirements, and other requirements. The four basic functional categories (analysis, evaluation, implementation, confirmation) are described in more detail in the following sections, but they are quite arbitrary, both in name and content. They represent overlapping functions requiring each nuclear criticality safety specialist to have common baseline knowledge of all responsibilities. An analysis of the nuclear criticality safety specialist responsibilities and tasks will be necessary to define common baseline requirements, name and define each functional specialty (if used), and establish qualification requirements including education, experience, classroom, and on-the-job training.

Each of the four generic functional specialties and the continuing competence to perform NCSS tasks (whether divided among the analysis, evaluation, implementation, and confirmation functions) is described below. A.2.2.1 Analysis. Analysis, according to this Guide, is a thorough description -- developed by non­ reactor nuclear facility safety management, engineering design personnel, and facility operations supervision -- that includes sufficient facility, equipment, and fissionable material process descriptions and controls to permit the identification of normal and abnormal conditions and means of attaining those conditions. This will enable performance of a safety analysis specific to nuclear criticality that identifies contingent conditions (potential criticality scenarios) and the bases for subcriticality (nuclear criticality safety evaluation) and for nuclear criticality safety (NCS). Alternatively, (safety) analysis is the documented process to systematically identify the hazards inherent in an operation; describe and analyze the adequacy of the measures taken to eliminate, control, or mitigate identified hazards; and analyze and evaluate potential accidents and their associated risks. Criticality safety analysis is an important aspect of this in non-reactor nuclear facilities. The NCSS provides unique attention to this aspect. This analysis includes (a) modelling facility response to accident conditions and performing related studies or calculations, (b) documenting and reviewing calculations used in safety analyses, and DOE G 421 .1-1 8-25-99 123 (c) coordinating specialized assistance from safety specialty analysts; these latter safety specialty analyses are analytical determinations that include • performance and review of special safety analyses and computer code development and validation related to these calculations, including risk assessment, radiation dose consequence analysis, and criticality analysis; • preparation and review of safety analysis report chapters, or portions thereof, that relate to specialty skills; and • specialty project assignments that require specific skills and/or qualifications that an individual possesses. A.2.2.2 Evaluation. Evaluation, according to this Guide, is a documented demonstration of the technical computational basis or comparative evaluation with experimental data that provides the subcritical operating values in support of the nuclear criticality safety analysis. An evaluation is a subset of an analysis. It frequently is treated as a separate function based on precedent and due to the unique need for, and substantial attention directed toward, demonstrating subcriticality for normal, upset, and accident situations and configurations identified in safety analyses. Also of importance is maintaining and validating the computer codes and systems used for this purpose. Where evaluation may be a dominant facet of nuclear criticality safety analysis, it does not by itself constitute safety analysis.

A.2.2.3 Implementation. Implementation is the process of bringing into existence engineered safety features, parameter limits, and other controls for criticality safety. It includes most of the nuclear criticality safety activities other than those directly involved in performing safety analysis and evaluation (and the specific confirmation activities described next). An important ingredient is providing advice to, or otherwise assuring appropriate attention of, management and supervision on their numerous and diverse responsibilities regarding maintaining engineered safety features, keeping parameters within limits, and enforcing other controls for criticality safety. Another ingredient is providing needed administrative interface to the other functions, such as integrating the analysis/evaluation inputs and outputs with facility operations (e.g., work practices, procedures, specifications, postings, and training) and identifying audit needs and responding to identified deficiencies. A major responsibility is ensuring that regulatory and other requirements (e.g., demonstration and documentation of double-contingency) are met. A.2.2.4 Confirmation. Confirmation includes performing audits and other assessments of compliance with conditions used in, and specified as a result of, the analysis/evaluation processes, with regulatory requirements and with other requirements. As deviations and associated trends are identified, corrective actions may be developed jointly with facility management as part of the implementation function. A.2.2.5 Continuing competence. Continuing competence consists of maintaining the ability to perform the NCSS tasks whether they are divided functionally among analysis, evaluation, implementation, and confirmation. A.2.3 Qualification process. This section provides guidelines for judging competency and determining qualification of nuclear criticality safety specialist personnel. It describes the overall approach, mode-of-progression, functional breakdown, and requirements. 124 DOE G 421.1-1 8-25-99 The qualification process described herein requires documentation and management approval. Thus, it is a form of certification. However, the term is avoided here because DOE Order 5480.18 defines certification as being the product of an accredited, performance-based training program. Although not necessarily accredited, the underlying principles of performance-based training do apply to this training program. The requirements of this Guide also apply to temporary or consultant personnel who serve as NeSS or perform major NeSS tasks (e.g., evaluations of subcriticality). They should meet the qualification requirements consistent with the tasks assigned (Le., Apprentice if performing under supervision, Specialist if working independently, and Senior Specialist if providing review and oversight). A.2.3.1 Principles. The qualification process applies to both new personnel and those currently serving as NeSS. In the latter case, there is no "grandfathering" per se, but rather a qualification­ by-documentation process. At the time the Guide takes effect at a facility, incumbents may be assumed to be qualified to fulfill current job responsibilities. They verify the qualification by documenting how each major set of task items was met, addressing any deficient areas with training or practical exercises, and meeting the continuing competence requirements (as outlined in paragraph A.2.S) on an established schedule. The qualification process does not apply to consultants and temporary personnel under direct guidance, surveillance, and performance or task acceptance review from qualified nuclear criticality safety specialists for specifically directed tasks (e.g., audits, computer testing, etc.).

Qualification is judged based on a combination of education, experience, training, and professional development. The training consists of formal classroom activities and structured on-the-jOb training (OJT) that stresses actual work performance under close guidance from a Senior Specialist and detailed evaluation of, and feedback on, work products. This section describes processes for qualification of NeSS personnel that are necessary, but not, by themselves, sufficient. Qualification is the ultimate responsibility of management who should address other factors such as maturity, judgment, decision-making, independence, and teamwork. An anticipated mode-of-progression has all incoming personnel progressing from Entry-Level to Apprentice, to Specialist, and finally to Senior Specialist. This approach enhances overall organization capability. From a human resource perspective additional levels may be used to reflect factors such as experience, maturity, and overall unique value to the organization. An additional level, Lead Specialist, is supervisory in nature. Because assignment is based on a variety of factors including availability, it is not part of the mode-of-progression. The qualification program sets standards and minimum times for promotion to higher levels. Management also may establish maximum times consistent with reasonable progress in meeting applicable requirements. Failure to qualify within allotted times may result in reassignment or other action. Each facility should perform an analysis of the NCSS job requirements and identify associated tasks. This is similar to, but less detailed than, the job/task analysis (JT A) used in development of performance-based training programs (see paragraph 2.1.7). The facility-specific task list is generated based on job descriptions, tasks identified in this Guide, and other resources. The task list may be used to define either a single NCSS position or specialty functions (e.g., analysis, DOE G 421.1-1 8-25-99 125 evaluation, implementation, and confirmation). The list is also the basis for developing the behavioral objectives that define and measure performance for the qualification program. With functional specialization, minimum qualification levels are established in the specialty, related, and interface areas. Qualification requirements are a combination of education, experience, formal training, structured on-the-job training, professional development, and personal factors or characteristics. Minimum standards are established in each area. However, equivalencies are appropriate and should be predetermined and specified in general terms in the qualification procedure. One example is the type and extent of experience that would be considered in lieu of a technical degree. Another example is to consider certain advanced degrees or specialized research projects to be equivalent to an amount of criticality safety experience. A.2.3.2 Classification levels. The anticipated mode-of-progression begins at the Entry-Level for personnel newly hired to become nuclear criticality safety specialists. They are designated as Apprentices after having completed specified requirements and having been judged ready to perform work under supervision of a Senior Specialist. The designation "Specialist" applies when the individual is deemed capable of performing independently (perhaps in a designated functional specialty area). A Senior Specialist is more highly qualified and judged to be prepared for the additional responsibility of providing independent review and oversight and to be a Senior Specialist for apprentice-level personnel. A Lead Specialist designation applies to supervisory/management functions that are outside of the mode-of-progression, with availability depending on staffing levels, organization structure, vacancies, etc.

The titles are generic. Equivalent designations may be used at a given facility. The titles also may be separate or independent of site-specific human resources designations that may include engineer, senior engineer, etc. and may have intermediate (e.g., Specialist I, Specialist II, and Specialist III) or more advanced classifications (e.g., Principal Senior Specialist). These classifications are intended to apply to NCSS in general and to functional specialties (e.g., analysis), if used. Proposed classification-specific requirements are noted in general in a later part of this section and in more detail in paragraph A.2.4. A.2.3.2.1 Entry. The Entry-Level classification is for personnel who meet selection criteria with a combination of education, experience, and training deemed sufficient to begin in the NCSS anticipated mode-of-progression. Individuals requiring remedial work may stay in the classification for an extended period of time. Personnel with experience elsewhere in the same facility or at another facility may be classified Entry-Level while verifying previous completion of applicable requirements and satisfying others. It is most likely that any formal classroom training received by NCSS (including onsite classroom training, if warranted by candidate numbers and staff size) will be while in the Entry-Level classification. In addition, facility familiarization (e.g., in-facility assignments) and introductory projects such as for analysis/evaluation (e.g., a standard problem with a single computer code) and audit observation/participation are included. Depending on the results of the analysis of jobs and tasks and on other factors including limited facility access for security clearance reasons, Entry-Level qualification may be divided along functional or other lines. In such circumstances, advancement to Apprentice status may be allowed, contingent on completion of deferred requirements prior to qualification as Specialist. 126 DOE G 421.1-1 8-25-99 As the Entry-Level requirements are intended to provide qualification for beginning the Apprentice phase, this classification provides the basics of criticality safety, and of each of the functional specialties if such division is made. A.2.3.2.2 Apprentice. The Apprentice classification is for personnel who have a combination of education, experience, training, and personal characteristics deemed sufficient to perform NCSS tasks under close guidance and supervision from, and with additional formal review (i.e., over and above that required by standard practices) by, a Senior Specialist, and who are able to participate productively in work activities in the specialty and related areas (defined in paragraph A.2.3.3). The classification may be multiple level if Entry-Level requirements have been deferred, e.g., due to lack of facility access for security clearance reasons. New hires may meet experience requirements for Specialist while in this category; experienced new-hire personnel spend only as much time as necessary to complete specific requirements. An Apprentice may perform tasks in a" or designated functional specialty area(s) under the guidance of a Senior Specialist. Such tasks include performing part of an analysis, running a computer code to assess subcriticality, participating in an audit, or preparing a draft regulatory or administrative document. Completion of Apprenticeship in the specialty and related areas, Entry­ Level requirements in the remaining areas, and approval by management lead to Specialist status.

A.2.3.2.3 Specialist. The Specialist classification is for personnel with the education, experience, training, and personal characteristics deemed sufficient to perform NCSS tasks in all or specialty area(s) independently, subject to normal technical and management review. Time-in-grade, acceptable work products, specialized training, leadership roles, and management approval lead to Senior Specialist status. Personnel may meet experience requirements for Senior Specialist while in this category. Experienced personnel may spend a lesser amount of time consistent with meeting all other applicable requirements. This is the minimum level of qualification allowing independent work. Depending on the size and extent of the facility, it may apply to specific functional specialties, particular subject area(s) within the specialty, or specific physical portion(s) or area(s) of the facility. The Specialist also may specialize further (e.g., risk analysis, code validation, human factors, or auditing) as appropriate to the collective competence of the organization. The Specialist may act as a subject matter expert in areas of special competence for qualification of others (as directed by, and under the cognizance of, the designated Senior Specialist mentor). The work of the Specialist is subject to the usual reviews and quality assurance practices that are consistent with local procedures. The Specialist wi" continue to have a Senior Specialist mentor. The quality of work products, specialized training, demonstration of sound judgment, initiative, leadership, and time-in-grade are measures of suitability for qualification as Senior Specialist. Although the subject areas are basically the same as those addressed as an Apprentice, attention shifts to increasingly independent action and to leadership and review related to the work of others. DOE G 421.1-1 8-25-99 127 A Specialist performs tasks in all or designated functional specialty area(s) and learns under the guidance of a Senior Specialist to provide oversight and quality assurance review of the work of others. Tasks subject to evaluation include performing and reviewing analyses, calculating and quality assuring computer calculations that assess subcriticality, leading an audit, or preparing regulatory and other administrative documents. Completion of Specialist qualification in all areas, or in a functional specialty, leads to Senior Specialist status. A.2.3.2.4 Senior. The Senior Specialist classification is for personnel with education, experience, training, and personal traits deemed sufficient to perform NeSS tasks independently or in a leadership and oversight role. Personal traits (e.g., initiative, organization skills, integration ability, and maturity) are especially important to the specialist expected to work independently, train other specialists, provide review and approval of work products and documents, and, potentially, make "stop work" decisions (see paragraph 5.1.1.7\. Senior Specialists perform routine final reviews and quality assurance of work originated by Apprentice, Specialist, and Senior Specialist personnel consistent with local procedures. They also act in a leadership capacity and, thus, should be experienced enough to teach others how to do the job and take responsibility for the resulting work products.

The major qualification activities for Senior Specialists relate to demonstrating continuing competence. High-level technical training develops in-house expertise in specific subject areas. Management training supports increased leadership and eventual assignment as Lead Specialist, i.e., supervisor or manager. A.2.3.2.S Lead. The Lead Specialist classification is for personnel with education, experience, training, and personal traits deemed sufficient to supervise or manage the nuclear criticality safety function in general and NeSS tasks specifically. Significant personal traits include those desirable for Senior Specialists plus attention to such issues as demonstrated desire and ability prior to assignment and the ability and willingness to make decisions and be accountable for their results. It should be recognized that even outstanding technical specialists may not make good lead specialists and/or supervisors or managers. Lead Specialist is a classification outside of the mode-of-progression. Its availability depends on organization staffing and structure and on the availability of organizational positions at given times. If the supervisor or manager of a multi-disciplinary safety organization is not highly qualified in nuclear criticality safety, a subordinate Senior Specialist should be designated as Lead Specialist. The supervisor or manager should be qualified at least to the Apprentice level so as to be able to perform all basic NeSS tasks, albeit subject to a Senior Specialist mentor's guidance. A.2.3.3 Functional specialization. If functional specialization is formalized, it is necessary that each NeSS qualify to a baseline level in all four functional areas in recognition of the interfaces described previously (e.g., the interactions among analysis, evaluation, implementation, and confirmation). Preferably this occurs during the Entry-Level classification, or if necessary, during Apprenticeship. The Apprentice is intended to be qualified to begin on a function-specific path in any of the four areas (under direct guidance and supervision of a Senior Specialist). The qualification level for personnel specializing in each of the four generic functional areas is shown in Table A.2.3.3-1. Consistent with the anticipated mode-of-progression, Senior Specialists qualify in their primary functional area, at least as Specialists in the designated related area, and at 128 DOE G 421 .1-1 8-25-99 least as Apprentices in the two remaining interface areas. This approach recognizes the strong need for integration of the substance of the functional areas. Table A.2.3.3-1. Matrix of Qualification Levels for Each of Four Primary Functional Specialties. Primary Qualification Level in Functional Area: Functional Specialt'L Analysis Evaluation Implementation Confirmation Analysis SENIOR SPECIALIST Apprentice Apprentice SPECIALIST Evaluation SPECIALIST SENIOR Apprentice Apprentice SPECIALIST Implementation Apprentice Apprentice SENIOR SPECIALIST SPECIALIST Confirmation Apprentice Apprentice SPECIALIST SENIOR SPECIALIST

The analysis and evaluation functions are closely allied through the unique role of performing a criticality safety evaluation. Thus, practitioners of each need to be qualified at least as Specialist (i.e., capable of performing, though not necessarily overseeing, the work) in the related field. Being qualified as Apprentice in the implementation and confirmation functions (i.e., capable of performing the tasks under close supervision of a Senior Specialist) recognizes the need to maintain close contact with the facility and to understand how analysis and evaluation results are implemented and how it will be verified that resulting requirements are met. The implementation and confirmation functions also must be called upon in support of developing analysis assumptions up front and ensuring that limitations identified by an analysis are implemented in the working environment. Double-contingency analyses, for example, and their documentation have both technical and administrative aspects. Similarly, the areas of implementation and confirmation functions are closely allied and, thus, are related to each other. Implementation is a primary subject of the confirmation activities, with deviations and other identified weaknesses fed back for corrective action. Both require Apprentice­ level familiarity with analysis and evaluation to assist effectively in specification of input assumptions; translate output conditions to practical in-facility methods (e.g., procedures, postings, etc.); and verify compliance/consistency between the evaluation (input assumptions and results), materials and equipment, and practices. Appendix B presents further discussion in terms of a graded approach. A.2.3.4 Continuing competence. Continuing competence of the Senior Specialist is maintained by performing routine tasks in the functional specialty and ensuring periodic performance of important tasks in the related and interface areas. The resulting work products are subject to routine peer evaluation and supervisory/management oversight or, if appropriate, to special evaluation. DOE G 421.1-1 8-25-99 129 Continuing competence is the long-term qualification program for Senior and Lead Specialists. Entry-Level, Apprentice, and Specialist personnel maintain qualification through satisfactory progress in the anticipated mode-of-progression. A.2.3.5 Requirements. Requirements for NCSS are a combination of education, experience, formal training, structured on-the-job training, professional development, and personal characteristics. As with any professional position, each NCSS may be expected to achieve qualification through a personalized program that addresses specific strengths and weaknesses. General trade-off equivalencies among the qualification factors identified in this section should be specified in the qualification procedure. Management should document the bases for each specific application. Minimum entry-level standards or selection criteria are identified for new hires. A technical background is required, consistent with the nature of the NCSS tasks. Exceptions to requirements (e.g., experience in lieu of degree, credit for advanced degree, or degree-related criticality safety experience) should be documented.

DOE Order 5480.20, "Personnel Selection, Qualification, Training, and Staffing Requirements at DOE Reactor and Non-Reactor Nuclear Facilities" (2-20-91) does not address nuclear criticality safety specialist personnel specifically. However, the NCSS are considered non-reactor nuclear facility technical support personnel who, according to the Order, have duties that include involvement in surveillance, analyzing facility data, planning modifications, program review, and technical problem resolution in their area of expertise (e.g., nuclear criticality safety). The Order establishes baseline education and experience requirements for general technical support personnel. It also dictates that when a specific position is equivalent to one defined for category-A reactor personnel, the requirements for the latter apply. Although the NCSS position is not directly equivalent, it has similarities to that of the category-A reactor technical support personnel and, to a lesser extent, to that of the reactor engineer. Table A.2.3.5-1 compares the relevant education and experience requirements for class-A reactor and non-reactor nuclear facility personnel with those established for NCSS in this Guide. Each entry applies to what the Order refers to as "positions with authority to review and concur, and not to entry-level positions." Thus, the proper NCSS comparison is to the Senior Specialist. All positions have the same education requirement, while according to DOE Order 5480.20 the reactor and non-reactor nuclear facility technical support positions have the same experience requirement, and that for the reactor engineer is greater. The Senior Specialist experience requirement is greater than that for general technical support personnel both in being three years and facility-specific (or equivalent as developed in paragraph A.2.3.5.2). Thus, minimum nuclear and onsite experience requirements, which also may depend on functional speCialization and other qualification factors, are not specified separately. 130 DOE G 421 .1-1 8-25-99 Table A.2.3.5-1. Education and Experience Requirements from DOE Order 5480.20 for Reactor and non-Reactor Facility Personnel Compared to Those for NCSS Personnel. Position Category A Reactor Non-Reactor - - - Nuclear Nuclear Technical Support* Facility Criticality - - - Safety (Senior) General Reactor Technical Specialist Requirement Engineer Support* Education Baccalaureate Baccalaureate Baccalaureate Baccalaureate degree in degree in degree in degree in engineering or engineering or engineering or engineering or related science related science related science related science Experience Job-Related 2 years 4 years 2 years 3 years* * Nuclear 1 year 2 years 1 year 6 months* * * Onsite 6 months 6 months* * * * SOURCE: DOE Order 5480.20, "Personnel Selection, Qualification, Training, and Staffing Requirements at DOE Reactor and non-Reactor Nuclear Facilities" (2-20-91) * * Equivalent site-specific nuclear criticality safety experience * * * Minimum nuclear and onsite experience not specified, as explained in the text NOTE: General trade-ofts between education and experience are allowed by DOE Order 5480.20 and as delineated in the body of this Guide. A.2.3.5.1 Education. The minimum qualification or selection criterion for education is the baccalaureate degree in an appropriate technical field (e.g., engineering, physical science, human factors, etc.).

For each functional specialty, some degree disciplines may be more applicable than others, e.g., chemical engineering for analysis in a "wet chemistry" facility, nuclear engineering or physics for evaluation, and human factors engineering for implementation and confirmation. Other curricula should be evaluated case-by-case, with experience or training requirements increased if appropriate. For those lacking a degree in an appropriate technical field, holding an associate (2-yearl degree, or holding a baccalaureate degree in a non-technical field, equivalence may be established on-the-job through apprenticeship with a Senior Specialist as mentor. Experience and training requirements should be increased accordingly. Applicable experience should be accumulated at the level of tasks performed by degreed NCSS personnel and comparable to job requirements in designated functional specialty and physical areas. Equivalence to the technical baccalaureate degree may be judged in terms of experience at the Apprentice level and demonstrated ability to perform tasks required of the NCSS. An advanced degree or applicable graduate work as an indication of additional analytic ability or maturity may be judged to reduce the experience requirement. Specific studies or research related to criticality safety also may be applied to reduce training or professional development requirements as appropriate. DOE G 421.1-1 S-25-99 131 Specific educational background appropriate to specialization -- e.g., probabilistic risk assessment for analysis, reactor physics for evaluation, human factors for implementation and confirmation -­ may also be acquired through training and professional development. Overall, factors such as area of study, level, and other considerations may be applied to adjust experience, training, and apprenticeship requirements. A.2.3.5.2 Experience. Direct nuclear criticality safety experience at the given facility sets the baseline standards -- one year for Specialist and two additional years (total of three years) for Senior Specialist. The Lead Specialist classification generally requires experience beyond that of the Senior Specialist, although as described above it is not part of the mode-of-progression. The minimum experience requirements may be adjusted according to educational background factors. New-hire personnel accumulate experience while participating in the anticipated mode-of­ progression. Previous experience may reduce the requirements. Facility personnel who have performed jobs most directly associated with nuclear criticality safety receive the greatest credit. For those who have worked at one or more other facilities, direct nuclear criticality safety experience is most directly applicable. Experience that is nuclear related (e.g., reactor fuels, reactors, safety analysis, health physics, industrial safety, or similar disciplines at the same or other similar facilities) shall be evaluated with credit given in relationship to applicability to general and specific NCSS tasks. However, even if all experience requirements are judged to be met, the individual should still complete all facility familiarization requirements, demonstrate equivalence to specific training requirements, and complete and have evaluated a designated number of "projects" (e.g., work products of the type included in the apprenticeship program and used as the basis for judging continuing qualification).

A.2.3.5.3 Training. Formal training courses may be developed for Entry-Level qualification and for later activities as appropriate to the size of the facility organization. Such courses should be performance-based, consistent with the guidance of ANSI/ANS-S.20-1991 (even though training of NCSS personnel is not addressed explicitly). Subject matter recommended by ANSI/ANS-S.20- 1991 will be addressed, though at greater depth consistent with the needs of the NCSS audience. Course formats other than lecture, e.g., seminars, workshops, etc., are preferred. Consistent with ANSI/ANS-S.20-1991 and performance-based training, evaluations of candidate performance should be conducted. A comprehensive written examination is one alternative, although realistic problem solving activities that demonstrate both knowledge and ability to apply it appropriately may be the better choice. Open-book exercises such as applying ANSI/ANS standards, guides, and other reference materials are appropriate. Many offsite courses are appropriate for Entry-Level and more advanced qualification. Such courses should be evaluated for applicability based on characteristics including subject matter, faculty breadth and expertise, audience makeup (e.g., peers and other contacts at similar facilities), and instructional approach (lectures, workshop sessions, and practical exercises). Whether a formal evaluation of participants is provided, it should be verified independently (e.g., through the Senior Specialist) that the desired learning has taken place. Value beyond subject matter is recognized due to interactive activities with faculty and peers from other facilities. Applicable offsite courses include the general short courses offered by the University of New Mexico and Los Alamos National Laboratory's critical facilities. Broad or specialized courses on safety analysis, computer and other computational methods, audits and inspections, human factors, and other related subjects also deserve consideration. 132 DOE G 421.1-1 8-25-99 An appropriate mix of onsite and offsite training courses, refresher seminars, and workshops can provide the NeSS with knowledge that will support development and maintenance of requisite facility-specific skills. A.2.3.5.4 On-the-job training. As with other professionals, the NeSS performs basic recurring tasks that are similar, but not repetitive in the sense of those performed by production-oriented operators and technicians (e.g., analyses using the same methods, but each time for a different situation). Likewise, individual NeSS, even new hires, have differing needs for qualification. Thus, formal training courses generally are less appropriate than learning-by-doing. A structured on-the­ job training (OJT) approach is indicated for this purpose. The OJT mode of qualification can be applied from entry level through continuing qualification, with most direct use during the Apprentice and Specialist classifications. In all cases the training proceeds under the close supervision and guidance of a Senior Specialist. On-the-job training, whether standardized or individually orchestrated, is primarily one-to-one (or one-to-a-few) between the candidate(s) and a Senior Specialist. Work performed by the candidate (prior to qualification as Specialist) is subject to careful supervision by the Senior Specialist and to routine peer review, as applicable. Senior Specialists serve as mentors. Subject matter experts (SME) qualified and experienced in performing a particular task may, on a case-by-case basis, be assigned by the Senior Specialist to direct, observe, or evaluate performance of activities. Periodic evaluation of candidate performance is required.

On-the-job training depends heavily on individual initiative of the NeSS candidate and uses directed self-study -- a training setting without a full-time instructor in which objectives and conditions are provided by the Senior Specialist, using training materials, or in-facility reviews and instruction. A qualification checklist, "card" file, or other means (for simplicity, hereafter referred to as the checklist) may serve as the basis for directing and documenting progress and completion of designated milestones. Activities that are the means for judging completion of specific tasks include • Review -- deliberate critical examination of references and training materials, • Observe -- directed careful analytic attention to the performance of another, • Perform -- performance of actual or equivalent tasks using necessary references, materials, and tools in the normal job environment, and • Simulate -- mimicking task performance at the job site or through task performance on a mock-up device similar to the actual equipment and work environment. For activities such as review of documents and observation of facility evaluations, which do not automatically generate a work product that is subject to review by a Senior Specialist or subject matter expert, an appropriate performance evaluation technique is required. This may take the form of a documented discussion -- explanation or other techniques of evaluation that indicate proficiency -- with the Senior Specialist, a more formal evaluation, or a written examination. Workbooks or notebooks that can be reviewed by the Senior Specialist or others also are appropriate. In all cases it is necessary to document qualification details using the checklist. DOE G 421.1-1 8-25-99 133 The on-the-job training requires performance-based development, Le., systematic determination of specific tasks, task analysis for skills and knowledge, and learning objectives that define the expected content and level of performance. Exemption from, or reduction in, requirements (e.g., fewer analyses, evaluations, or audits) may be based on previous experience, but preferably on proficiency testing or work-product review. Evaluation modes may include • Board evaluations based on oral, walk-around, notebook review, or other demonstration; these may in turn be divided into Mini-boards with the Senior Specialist and a supervisor or subject matter expert, as appropriate, to judge intermediate milestones, and Final board with, at a minimum, the Senior Specialist, supervisor/manager (chair), a designated SME, and a "facility" representative; other senior specialists also may be included; • Projects that test technical ability, judgment, etc. reviewed by teams composed similar to the boards; the process may be accompanied by a final oral "defense" (or board) evaluation. Board members should receive training on conduct and participation in the process. The chair and/or Senior Specialist should receive more detailed training on board setup and conduct. Where seminars, workshops, and offsite courses (see also paragraph A.2.3.5.3 on Training) are used as a basis for meeting what is otherwise an OJT task, the content (Le., the learning by the candidate) should be evaluated for applicability using the standard OJT processes.

A.2.3.5.5 Professional development. Professional development activities apply to all classification levels and are a major element in Senior Specialist initial qualification and continuing competence. They are subject to review with the Senior Specialist, supervision, or others. Presentation of a seminar may be an appropriate way both to verify the extent of learning and to share the experience with peers. Professional development activities include, but are not limited to, • educational activities and technical meetings such as conferences, seminars, clinics, workshops, tours, forums, or symposia, • college courses (including home study), • professional development courses, • onsite workshops or seminars, • publication of papers, reports, or other peer-reviewed documents, • special onsite and offsite work assignments (e.g., task force membership or a temporary in-facility assignment), 1 34 DOE G 421 .1-1 8-25-99 • preparation of a position paper for critical review on a contentious issue of nuclear criticality safety, • intra-site committees (e.g., safety overview), • inter-site committees (e.g, multi-site corporate, DOE-regional, or DOE-wide), and • regional or national committees (e.g., American Nuclear Society Nuclear Criticality Safety Division, Institute of Nuclear Materials Management, ANSI/ANS-8 Standards). In each case, active participation (e.g., as instructor, chair, or officer) carries more credit than mere attendance. A.2.3.5.6 Personal characteristics. The qualification process should include ongoing evaluation and judgment of the readiness of the NCSS candidate to do the whole job and do it independently. The Senior Specialist should address such issues during the course of the process. Management has the prerogative on the final judgment based on factors that can include the candidate's judgment, technical ability, and initiative. As noted previously, each Senior Specialist may have review, approval, and/or "stop work" authority (e.g., in paragraph 5.1.1.7) and, thus, needs to be judged capable of implementing them. A.2.3.6 Overall qualification. The qualification process may be coordinated through the use of a qualification checklist. This may be a generic form that is readily customized to needs of individual NCSS candidates. Where functional or other specialization is employed, the checklists may be tailored appropriately. The checklist should provide guidance on the tasks to be performed and the means by which the NCSS will be evaluated (i.e., objectives). By implementing a formal qualification program for the first time, existing personnel use a qualification-by-documentation approach with the same checklist. They • indicate education, experience, etc., • indicate how training/task requirements were met and equivalence to Entry-Level and Specialist programs, • establish a schedule for meeting any serious deficiencies, and • focus primarily on the continuing competence requirements to verify their ability to perform major work-product tasks. For new or existing personnel, exceptions to formal qualification requirements may be made based on judgment and documented alternatives (e.g., experience in lieu of a degree or credit for an advanced degree, specialized course work, or relevant research activity).

The process should have provisions for final confirmation of competence made by safety supervision or management (and, if applicable to a specific facility, by cognizant line management). A comprehensive written examination, oral or facility walk-around examination, or a combination thereof, should be used to address all major NCSS tasks. Evaluation of realistic and representative work products should be an important part of the process. Remedial actions for failures need to be specified. DOE G 421.1-1 8-25-99 135 A.2.4 Classification-specific qualification programs. Subject-matter content for the NCSS qualification program should be developed from an installation-specific analysis of the job and its tasks. The analysis may be used to designate functional specialties. Each facility has the option to use the generic classification levels proposed in this document or use site-specific classifications consistent with its human resources system. A.2.5 Functional-specific qualification programs. If functional specialization is employed, the analysis of the job and its tasks should be used to make an installation-specific check list. As described in the previous section, these may apply to all of the Entry-Level, Apprentice, Specialist, and Senior Specialist classifications at progressively more detailed levels. Additional specialization may be employed with respect to the collective capability of the organization. A.2.G Continuing competence. Continuing competence demonstration is required of each Senior Specialist. It is addressed here rather than with the classifications due to the tie-in to the four functional specialty areas. Existing personnel or highly experienced new-hires who have been performing at the Senior Specialist level employ a qualification-by-documentation approach as described previously (paragraph A.2.3.G). A Senior Specialist who is a peer should be assigned to validate or verify basic and continuing competence requirements. Those designated as Apprentice or Specialist are not specifically subject to these requirements with normal progress in the qualification mode-of-progression. However, comparable activities and consistent frequencies should be included on the qualification checklists. The actual content of the program to ensure continuing competence should be derived from the analysis of the job and its tasks. General areas and issues are addressed below. Periodic training in technical and administrative subjects assists in maintaining and improving job performance and developing broader scope and depth in specific knowledge and skills. Retraining on subjects included in the Entry-Level, Apprentice, and Specialist portions of the qualification program is generally not necessary. However, if individual or group performance problems are identified, they should be addressed. Specific subjects that are appropriate for continuing training include, but are not limited to, • facility and industry operating experience, audit findings, and deficiency trends, • changes to systems, components, and applicable procedures, • changes to DOE Orders, National Standards, and other guidance, and • major changes to NCSS tasks. Classroom training, seminars, or "required reading" may be appropriate methods. Examinations, discussions, or evaluation of work products should be used for confirmation consistent with the approaches applied in mode-of-progression qualification.

Continuing competence requirements are based on performing activities in each of the four functional areas (including all required reviews and approvals for the designated level, with additional review if appropriate). The requirement may be annual or graded based on functional 136 DOE G 421 .1-1 8-25-99 specialization (e.g., annual for the specialty area, biennial for the related area, and triennial for general or interface areas). Work products should be provided and evaluated in each of the following areas: • facility familiarity (e.g., through periodic tours and meeting attendance); • analysis for criticality safety (e.g., double-contingency analyses); • evaluation of subcriticality; • facility audit activities; • implementation activities, e.g., task, job, and procedure audits, investigation of criticality safety limit violations, and evacuation procedure audits; • onsite professional development activity, e.g., regular task, but elsewhere in the facility or with a different organization, and appropriate activity from the list in paragraph A.2.3.5.5 or equivalent; and • offsite professional development activity (e.g., see paragraph A.2.3.5.5). For large facilities where qualification may be based on physical areas or processes, the requirements apply to each applicable area. Where functional specialization is used, each work product may be geared according to the specialization and classification shown in Table A.2.3.3 as follows: • specialty field at the Senior Specialist level -- lead an analysis, evaluation, or audit effort; review and quality assure analyses, evaluations, or audits; or complete major administrative responsibilities; • related field at the Specialist level -- perform a new and original analysis, evaluation, audit, or administrative task; and • general/interface fields at the Apprentice level -- perform (under supervision) representative analysis/evaluation exercises or participate in audits and administrative tasks. A.2.7 Documentation and records. Documentation shall be maintained on the qualification of each NeSS. The qualification checklist or equivalent documentation may be designed to serve this purpose. It should show each applicable task, how and when it was accomplished, examination results if applicable, and who verified completion (of single tasks or groups of tasks). Final approvals by the Senior Specialist and supervision/management should also appear. DOE G 421.1-1 8-25-99 137 Records shall be developed consistent with facility policies and procedures for training and qualification. Retention of documentation and records shall be consistent with DOE Orders and facility procedures. A.2.8 Evaluation and Documentation. Evaluations of the NeSS qualification program and personnel should be performed and documented periodically. Documentation of these evaluations should be retained in accordance with the applicable document listed in paragraph 2.1.2. Additional documentation requirements are provided in the applicable document listed in paragraph 2.1.9. 138 APPENDIX B. GRADED APPROACH DOE G 421.1-1 8-25-99 B.1 Graded Approach to Criticality Safety Analyses and NCSEs. A graded approach to the performance of criticality safety analyses and the supportive nuclear criticality safety evaluations (NCSE) should be exercised. A graded approach to the performance of criticality safety analyses acknowledges that different levels of effort and documentation are appropriate for different complexities of facility fissionable material operations (i.e., handling, processing, and storing) and the associated methods and controls applied to maintain subcriticality and safety.

The classification of facility complexity and levels of analyses and evaluations to be performed should be determined at an organizational level independent of facility operations or production (e.g., the safety organization reporting to the installation/facility manager). This determination should be based upon the technical judgment of a nuclear criticality safety specialist. B.1 .1 Levels of analyses and evaluations. Levels of analyses or evaluations range in effort from simple references -- to common engineering and safety judgment and to national consensus standard subcritical values (e.g., 450g 239pU) using a highly reliable control on allowed facility fissionable material mass -- to a complicated validated computation of neutron interacting arrays of dissimilar systems involving materials having variable nuclear parameters and numerous administrative/procedural and physical controls benefitting from probabilistic risk analyses. Three levels of analysis and evaluation are considered: Levels A, B, and C. Level A analyses and evaluations may be performed for facilities having fissionable material inventories and operational conditions that will remain within the envelope of conditions specified for subcritical values within national consensus standards. Level B analyses and evaluations are performed for facilities having fissionable material inventories or operational conditions that exceed the envelope of national consensus standard subcritical values but have fissionable material inventories and operational conditions that may be analyzed to be safely subcritical by reference to commonly accepted and used handbook or safety guide values. Where these values are not based directly on experimental data, such as tables or figures based solely on calculated values, they should be confirmed from two independent sources. Level C analyses and evaluations are typically performed for fissionable material inventories and operational conditions that cannot be addressed with national consensus standards or handbook values. Level C analyses and evaluations may involve the application of computational techniques requiring computer program documentation, verification, validation, and user qualification. In all cases, it shall be shown that all normal and credible abnormal operational conditions and contingencies remain within the envelope of the specified subcritical process and nuclear parameters. All physical and administrative controls used for ensuring the subcritical values shall be clearly identified. The reliabilities of the controls should be described to be acceptable. This is already covered in paragraph 5.6.1. By order of preference, referable facility historic data, industrially accepted guidance, and, lastly, experienced engineering judgment about human and equipment reliability should be used to defend the reliability of nuclear criticality safety controls. B.1 .1.1 Level A. Level A evaluations are performed by direct reference to national consensus standard subcritical values. Such references include ANSI/ANS-8.1-1983,R88, Nuclear Criticality Safety in Operations with Fissionable Materials Outside Reactors, and ANSI/ANS-8.15-1981,R87, Nuclear Criticality Control of Special Actinide Elements. Though no additional verification of the subcritical values are required, a clear comparative evaluation of the operation being evaluated should be given along with the basis of safety. DOE G 421 .1-1 8-25-99 139

B.1.1.2 Level B. Level B evaluations are performed with referenced values derived from published handbooks, safety guide subcritical values, or criticality data. Such well known references include, but are not limited to, LA-10860-MS, Critical Dimensions of Systems Containing 235U, 239pU, and 233U (paragraph 2.3.2.8, 2.3.2.11 of this Guide); NUREG/CR-0095 ORNL/NUREG/CSD-6, Nuclear Safely Guide TID-7016 Revision 2 (paragraph 2.3.2.9 of this Guide); and ARH-600, Criticality Handbook. The referenced values should be based directly on experimental data or should be verified to be consistent with independent handbooks or safety guide subcritical values or validated computational techniques. Where applicable data are directly available, subcritical values shall be established on bases derived from experiments, with adequate allowance for uncertainties in the data. In the absence of directly applicable experimental measurements, the subcritical values may be derived from calculations made by a method shown to be valid by comparison with experimental data. lOs Level B analyses should be based on critical data only after appropriate margins of subcriticality have been applied to the critical values. The use of unpublished experimental logbook data requires comparison with a Level C evaluation as described in paragraph B.1.1.3. The identification of and reliability of controls shall be as described in paragraph B.1.1 above. B.1 .1.3 Level C. Level C analyses are performed by the use of a validated computational technique. Examples include ORNL/NUREG/CSD-2NI/R2, KENO-Va, An Improved Monte Carlo Criticality Program with Supergrouping; LA-7396-M, Rev.2, MCNP, A General Monte Carlo Code for Neutron and Photon Transport; and BNFL SAG/80/P29, Criticality Assessment Using the Limiting Surface Density (NB/) Method and Examples of Application. Acceptable margins of subcriticality and range of applicability for the chosen evaluation technique should have been determined and documented for use in criticality safety evaluations. No single computational result should be used for determining the subcriticality and safety of an operation. Rather, multiple results showing trends and computational reliability will be used. The use of Level C analyses should be in conformance with ASME NQA-2 requirements. The identification of and reliability of controls shall be as described in paragraph B.1.1 above. B.1.2 Complexities of facility fissionable material operations. Complexities of facility fissionable material operations range from single operations having less than a significant quantity of fissionable material to multiple operations having large quantities of fissionable materials processed in mUltipurpose facilities with many types of interfacing operations and support activities. Four classes of complexities are defined as follows: B.1.2.1 Class I. Class I facility operations have less than significant quantities of fissionable materials presenting no significant risk of criticality within item control areas or material balance areas. Nuclear criticality safety is applied through facility nuclear material possession and accountability limits. B.1.2.2 Class II. Class" facility operations have significant quantities of fissionable materials and have operations limited to repetitive and routine activities. No significant quantities of fissionable material wastes are generated in Class II facility operations. Nuclear criticality safety is applied with physical barriers such as spent or fresh fuel storage racks and single item handling devices. The fissionable material operations are performed in control areas that effectively preclude neutron

l08ANSI/ANS-8.1-1983,R88, section 4.2.5. 140 DOE G 421 .1-1 8-25-99 interaction among items. Examples include, but are not limited to, fuel element examination operations, fissionable material item packaging, and storing. B.1.2.3 Class III. Class III facility operations have significant quantities of fissionable materials and perform operations that influence other fissionable material operations within the facility. Examples include, but are not limited to, analytical laboratories, foundries, machine shops, dimensional inspection shops, nondestructive testing shops, etc. that exchange materials among the various operations. Significant quantities of fissionable material wastes in solid and liquid forms are generated and collected but are not processed to finally recovered forms. The fissionable material operations are performed in effectively non-neutron interacting item control areas and material balance areas. B.1.2.4 Class IV. Class IV facility operations are multipurpose and include all of the characteristics of a Class III facility but with the addition of complex operations including solution, waste recovery, waste processing, and decontamination and decommissioning operations. Additionally, the fissionable material operations may be performed in neutron interacting item control areas and material balance areas. B.1.3 Analysis Content. Despite the level of effort and documentation of evaluations and analyses and the complexity of an operation, the same fundamental elements should be included and identified in the safety analyses for each discrete operation within the facility. The safety analyses should be retained in accordance with paragraph 2.1.2. These elements include the following: B.1.3.1 Operational description. Using verified as-built sketches, drawings, or flow diagrams of the equipment, portable containers, and of processes and facilities, the description of the intended fissionable material operation under analysis should be provided for which the hazard of criticality exists. Care should be exercised to identify, for additional analysis, ancillary support equipment or activities that may require independent safety analyses (e.g., vacuum producers, nonfissionable material feed chemical make-up and supply, compressed gas/air, waste collection, ventilation, transportation, neutron interaction among other fissionable material systems, etc.) and that may affect, or be affected by, the operation under consideration. The description should be of sufficient detail to permit independent evaluations and safety analyses of the operation. B.1.3.2 Fissionable material forms. Bounding descriptions of the chemical and physical form(s) of fissionable material in the operation should be provided, including isotopic content, resulting concentrations, densities, degrees of neutron moderation, degrees of neutron interaction and reflection considered, and the physicochemical stability of the fissionable material in the anticipated normal or abnormal operating environment. B.1.3.3 Credible operating condition changes. This includes the description of the normal and abnormal credible changes in operating conditions that could alter a nuclear parameter (i.e., geometry/volume, spacing/interaction, neutron absorption, concentration/density, mass, moderation, reflection, and enrichment) beyond intended operating conditions. The description should include a characterization of any resultant conditions, masses, forms, materials, etc. adversely affecting subcriticality and safety.

B.1.3.4 Analysis of accident scenarios. This includes the identification of event sequences leading to credible nuclear criticality accident scenarios (a single scenario probability exceeding a frequency of 1 x 10-6 per year) and associated consequences to workers, the public, and facilities. Bases should be specified if no credible accident scenarios can be determined. DOE G 421 .1-1 8-25-99 141 8.1.3.5 Need for CAS or CDS. A review for the need and placement of a nuclear criticality accident alarm or detection system should be provided. Alarm and detector coverage shall be provided as necessary, or a reference supplied that indicates fulfillment of the alarm or detector need and placement (see Section 5.4). 8.1.3.6 Safety controls description. The description of the passive and active safety controls that are part of the operation should be identified and should include the intended administratively or physically controlled value(s) for each of the nuclear parameters. If a specific nuclear parameter does not affect the operation, a short justification for excluding the nuclear parameter from the analysis should be provided. Technical practices and measurement control programs used for ensuring the reliability of safety controls should be provided. 8.1.3.7 NCSE summary. The summary description of the validated technical nuclear criticality safety evaluations (computational or comparative) showing the subcriticality of the operation under normal and abnormal conditions should be provided. The safety evaluation should identify and consider interactions with any other fissionable material operations within the facility. B.1.4 Performance of nuclear criticality safety analyses and NCSEs. As indicated above, a "Graded Approach" acknowledges that different levels of effort and documentation are appropriate for different complexities of facility fissionable material operations. The gradation of levels of effort and of documentation and the complexities of operations may be seen as a two-dimensional matrix, as shown in Table 8.1.4-1, which is used for grading the approach and resources required for performing the nuclear criticality safety analysis and NCSE. The table footnotes provide explanations about the resources that are numbered 1 through 4. A peer review is to be conducted for any NCS analysis and associated evaluation. B.1.5 Results of the Graded Approach. As indicated by the combination of complexities of operations with levels of effort required for analyses or evaluations, as described in paragraphs 8.1.1 and B.1 .2 and shown in Table 8.1.4 above, an NCS analysis or evaluation may result in a seemingly minor safety document for Class I - Level A type analyses or evaluations, whereas a Class IV - Level C analysis or evaluation may result in a rather prodigious report. Additionally, the required resources can be quite variable. In all cases, the safety analysis shall contain all of the elements described in paragraph B.1 .3 that are relevant to the operation, or appropriate NCS analyses or evaluations that supply these elements may be referenced. More in-depth descriptions and examples of such analyses and evaluations are provided in Sections 5.7, 5.8, and 5.9. 142 Table 8.1.4-1. Resources required for performance of the NCSE. Facility Complexity Analysis Effort Class I Class II Class III Level A 1 2 2 Level 8 2 2 or 3 3 Level C -- 3 or 4 4 Legend: Level of Effort and Personnel Qualifications 1. Operations Supervision.

DOE G 421.1-1 8-25-99 Class IV 2 3 4 2. Qualified Nuclear Criticality Safety Specialist having experience interpreting safety guides and critical data references, in conjunction with an experienced process/operations engineer who is familiar with operational process, equipment, and facility normal and abnormal conditions. 3. Qualified Nuclear Criticality Safety Specialist having operational and process knowledge and experience interpreting safety guides and critical data references, in conjunction with an experienced process/operations engineer who is familiar with operational process, equipment, and facility normal and abnormal conditions. 4. Qualified Nuclear Criticality Safety Specialist having operational and process knowledge, experience interpreting safety guides and critical data references, and computational validation and analysis experience, in conjunction with an experienced process/operations engineer who is familiar with operational process, equipment, and facility normal and abnormal conditions. DOEG421.1-1 8-25-99 143 APPENDIX C. ESTIMATING THE WAITING TIME UNTIL THE SIMULTANEOUS COLLAPSE OF TWO CONTINGENCIES' (Adapted from Author's Text) C.1 Introduction. This appendix provides an interface between criticality safety and safety analysis. Recent emphasis calls for probabilistic safety assessments in addition to the traditional qualitative and quantitative, but deterministic, assessments. That emphasis supplies the motive for this appendix, which is narrowly focused on the Double-Contingency Principle (DCP) as applied in criticality safety practice. C.1.1 DCP Review. The definition of the DCP is stated as, "Process designs shall, in general, incorporate sufficient factors of safety to require at least two unlikely, independent, and concurrent changes in process conditions before a criticality accident is possible." For example, given a fissile material workstation in a glovebox, the "two unlikely" events are inadvertent double-batching and inadvertent flooding with water. In this example, work begins at the workstation at time zero. The purpose of this probabilistic model is to make a probabilistic statement about the waiting time until the workstation is simultaneously flooded and double-batched. C.1.2 Markov Model. A Markov model is convenient and tractable. In such a model, (1) the time span from recovery from a flooded condition to onset of the next flooded condition is an exponentially distributed random variable, (2) the time span from the onset of a flooded condition to recovery from that flooded condition is an exponentially distributed random variable, and (3) those two random variables are independent. A similar set of statements applies to the double-batching situation. C.1.3 Probabilistic Description. Given estimates of mean failure and mean recovery times of the two independent contingencies, the model can be used to generate a probabilistic description of the waiting time to the first simultaneous collapse; or, if estimates of mean failure and mean recovery times of the two independent contingencies are unavailable, the model can be used to construct parameter surveys to bound estimates that could satisfy a criterion for mean time to simultaneous collapse.

C.2 General Markov Model. The construction of a Markov model for the general situation follows. For k = 1, 2, let Xk(t) = 1 if contingency k is in its desired state; let Xk(t) = 0 if contingency k is in its undesired state. Suppose that at time zero both contingencies are in the desired states: X, (0) = 1 and X2(0) = 1. For k = 1, 2, let 1/'Ak be the mean time between transitions from desirable to undesirable states for the kth contingency. Similarly, let 1/Pk be the mean time between transition from undesirable to desirable states. If the Markov model is invoked, then the sojourns between transitions are independent, exponentially distributed random variables. The process is assumed to begin in state (1,1) (i.e., X,(t) = 1 and X2(t) = 1). The waiting time until the first visit to state (0,0) (i.e., X,(t) = 0 and X2(t) = 0) is to be determined. That waiting time is also a random variable to be determined as follows. The (0,0) state is that in which both contingencies are in undesired states, and in practice, is a state from which exit is possible. However, it is convenient for modeling purposes to make (0,0) an absorbing state, one from which exit is not possible. If state (0,0) is an absorbing state and T, a 144 DOE G 421.1-1 8-25-99 random variable, is the waiting time until the first visit to (0,0), given that the process begins in state (1,1); then for any t > 0, the events [T ~ t] and [X, (t) = 0 and X2 (t) = 0] are equivalent. That equivalence simplifies the following mathematical demonstration. Figure 1 displays a state transition diagram for the two-state Markov process. For i = 0,1 and j = 0,1; let Pij(t) :; P[X,(t) = i and X2(t) = j]. The incantation that corresponds to the right hand side of the last definition is "probability that X, at time t equals i and X2 at time t equals j." Then from the figure, the system of first order differential equations that the Pij satisfy is dPll -(AI +A2)Pll + III POI +1l2P lO dt dP lO -(AI + 1l2)PlO + A2P ll = dt dPOI -(A2+ Il I)POI +AIPll = dt dPOO Al P lO +A2P OI = dt Since the process begins in state (1,1)' the initial conditions for system (1) are: P,,(O) = 1, P1O(0) = 0, POlIO) = 0, Poo(O) = O. Figure 1. The state transition diagram for the Markov model of the double-contingency stochastic process; "1" is a desirable state, and "0" is an undesirable state. (1 ) DOE G 421.1-1 8-25-99 145 The technique used for constructing a solution to system (1) is the Laplace transform. Let L represent the Laplace transform operator, and for i = 0, 1 and j = 0, 1 let f ij = L Pij' The application of L to system (1) yields S+Al +A2 -~2 -~l 0 f11 I -A2 S + Al + J.l2 0 0 flO 0 = -AI 0 S + A2 + J.l1 0 f01 0 0 -AI -A2 S foo 0 Solving system (2) for foo yields: fools) = N(s)/D(s) where and D(s) = S[S3 + (2A, + 2A2 + p, + P2)S2 + (A, A, + A2 A2 + 3 A, A2 + A, p, + A, P2 (2) (3) (4) + A2 p, + A2 P2 + P2 P2)S + (A, A1 A2 + A, A2 )..2 + A, A2 P1 + A1 A,2 P2)] (5) Equations (4) and (5) are unnecessarily expanded to highlight the symmetry of the subscripts. The Laplace transform of P[T ~ t] is foo' and P[T ~ t] is the cumulative distribution function (CDF) that describes T, the waiting time until the simultaneous occurrence of the two contingencies. Hence, a fundamental property of Laplace transforms and the fact that P[T ~ 0] = 0 imply that s fools) is the Laplace transform of dldt P[T ~ t]. But dldt P[T ~ t] is the probability density function (PDF) that describes T; let fT represent that PDF, and let gT ;: LfT. Then from (3):

= where the last equation in (6) defines D*. sN(s) D(s) N(s) D*(s) (6) To invert gT requires finding roots of the cubic D'; the coefficients of D' appear in (5). In application where the A; and the PI are assigned numerical values, computer-based root finding routines could be used; and fT could be found by inverting gT' Although inversion of gT is unproductive in the general case, useful information can be extracted from gT without inversion. That is; 146 DOE G 421.1-1 8-25-99 00 gT(S) == f tT(t) e -sf df = (e -sT) o where ( ) represents expectation. Hence gT is a moment generating function for T. In particular, if exp(-st) is expanded in a Taylor series about 0, it is found that (T) = -g' T (0) where the prime represents differentiation with respect to s. Differentiation and algebraic manipulation applied to (4),(5), and (6) yields: (T) = AlAI + A2A2 + AIA2 + AI~1 + AI~2 + A2~1 + A2~2 + ~1~2 AIAIA2 + AIA2A2 + AIA2~1 + AIA2~2 Equation (8) is presented in the expanded form to highlight the symmetry of the relationship. (7) (8) A special case of (8) is enlightening. In practical cases, if application of the double contingency principle is to yield significant safety advantage, the mean times of transition from desirable to undesirable states should be much longer than the mean times of transition from undesirable to desirable states. In the context of the model, this translates into the assertion that for every i = 1, 2 and j = 1, 2, ~ « PI' In this special case (8) becomes ;J (T) - I (9) I + The advantage to be gained by using two contingencies instead of one contingency is demonstrated in the following quantitative estimate of examining the mean time to the first simultaneous occurrence of two contingencies. Suppose 1/)", = 5 years, 1/)..2 = 10 years, 1/p, = 5 days, and 1/P2 = 2 days. Then equation (9) applies, and (T) ;::: 2600 years; the advantage is substantial in this case. Equation 8 is provided for the general case and equation 9 is provided for the special (and usually applicable) case. C.3 Symmetric Case. The "symmetric case" is for circumstances in which both contingencies are described by identical probabilistic models, i.e.,).., = )..2 " ).. and p, = P2 "p. The symmetric case can be treated as above by starting with a state transition diagram and writing down the corresponding first-order linear system of differential equations. The system is 3 x 3 matrix instead of 4 x 4 matrix because the states (0,1) and (1,0) are indistinguishable. The symmetric case is logically equivalent to what reliability theorists call the two-unit-active­ redundant case, and it has been completely solved2,3 and is provided as follows. As before, let T be the waiting time until the first visit to state (O,O). Then for time t ~ 0, DOE G 421.1-1 147 8-25-99 -olt -02t (10) °2e - ole P[T>t] = where (02 - (1) 01 = ~ [(3A + ).1 + V).12 + 6A).1 + A2 ] (11 ) and ~ [C3A + ).1 + V).12 + 6A).1 + A2 ] 02 = m = ~ 3 + ftl Ul (12) Equation (10) is a complete probabilistic description of T. To obtain a corresponding result for the asymmetric case requires finding the roots of the cubic D* defined in equation (6). Although there is no simple equivalent of (10) for the asymmetric case, equation (10) may be conservatively used in the asymmetric case by setting A = max(A" A2) and p = min(p" P2)' Such an application may be useful to gain quick insight and might even suffice without further analysis if the result satisfies the preset criterion.

REFERENCES 1. C. S. Barnett, "A Probabilistic Model for Estimating the Waiting Time Until the Simultaneous Collapse of Two Contingencies," Proc. International Conference on Nuclear Criticality Safety, Dorset, England, September 9-13, 1991. 2. B. Epstein and J. Hosford, "Reliability of Some Two-Unit Redundant Systems," Proc. Sixth National Symp. Reliability and Quality Control (January, 1960), 469-488. 3. N. J. McCormick, "Reliability and Risk Analysis," P 143, Academic Press, Inc., 1981. 148 DOE G 421.1-1 8-25-99 APPENDIX D. EXAMPLES OF DESIGN OF NUCLEAR CRITICALITY SAFETY CONTROLS 0.1 Double-contingency analyses. The purpose of this section is to provide an example of a double­ contingency analysis of a potential criticality scenario to evaluate compliance with the Double­ Contingency Principle (paragraph 5.7.7). The main points of the illustration are (a) identifying the potential criticality scenario (paragraph 5.7.5), (b) evaluating the scenario for compliance with the Double-Contingency Principle (paragraph 5.7.7), and (c) identifying the associated means of control (paragraph 5.7.4). Example # 1 below provides an involved scenario analysis with control reliability/failure evaluations for acceptability. 0.1.1 Example # 1. Assume that the quantity of fissile nuclide required for a particular operation is 2 kg of 239pU in oxide form that is greater than the minimum critical mass. On this basis, criticality protection is solely dependent upon excluding moderation from the area since geometry/volume is not controlled. Since nuclear criticality safety depends on the control of a single nuclear parameter, moderation, two separate and independent barriers need to be provided to prevent loss of moderation control. Thus, as shown in Figure 0.1.1 (upper left-hand corner), nuclear criticality safety considerations require that moderating liquids be excluded from the dry processing location containing fissile material. Reviews of the design identified two credible sources of liquid to the dry location under operating conditions: (1) liquid backflow from an associated off-gas scrubber system, and (2) the unauthorized manual addition of liquids by operating personnel. Before proceeding, a brief description of the scrubber system is given below. The off-gas scrubber system is provided to cool and scrub the off-gas coming from the dry location that contains fissile material in powder form (upper left-hand corner of Figure 0.1.1). A vacuum is pulled on the system using a vacuum air jet located above the separator tank that is supplied by the high-pressure facility air system (90 psig). The off-gas first passes through the scrubber tank, where it mixes with liquid in the scrubber and forms a two-phase flow in the line to the separator tank. From the separator tank the off-gas goes to the vessel vent system. The liquid in the separator tank is circulated back (pumped) to the scrubber tank. The design incorporates a jet bypass line leading to the vessel vent system (see Figure 0.1.1). This bypass line contains an automatic valve (normally closed during operation of the jet) that is electrically interlocked to a high pressure switch. Also shown is a rupture disk located just off the separator tank. Note that for simplicity, Figure 0.1.1 shows only those instrumentation and control features in the system that are referred to below.

0.1.1.1 Identifying potential criticality scenarios - logic diagram. In accordance with paragraph 5.7.5, "Identifying Potential Criticality Scenarios," a logic diagram is constructed (see Figure 0.1.2) as an aid to systematically identify the various scenarios that could lead to the accidental addition of liquid to the dry location, which is the mechanism for a potential criticality accident in this case. The DOE G 421.1-1 8-25-99 149 logic diagram shows two credible liquid sources: Source 1 is liquid coming from the scrubber system; and Source 2 is liquid from manual addition to the cabinet (operator error). Pursuing Source 1 (Figure 0.1.2), three basic phenomena are identified: (1) back siphonage, (2) backflow resulting from a pumping action, and (3) backflow resulting from high pressure in the scrubber system. For the high-pressure case, two initiating events are identified: (1) eructation, and (2) pluggage of the air jet at the exit resulting in high pressure facility air (90 psig) applied to the scrubber system (Figure 0.1.1). As shown in Figure 0.1.2, back siphonage and eructation are judged to be incredible for this particular design and associated operating conditions. The pumping action case is identified in Figure 0.1.2 as worthy of study, but it is not developed here (for simplicity). The potential criticality scenario designated for study below deals with pluggage of the air jet. This scenario is highlighted in Figure 0.1.2 and may be summarized as follows: Potential criticality scenario - Mechanism: liquid addition to the dry location - Source: scrubber system liquid - Phenomenon: backflow due to high pressure in the scrubber system - Initiating event: pluggage of air jet at the exit. 0.1.1.2 Evaluation against the Double-Contingency Principle. 0.1.1.2.1 Identifying the two barriers for double-contingency. Simply stated, the Double­ Contingency Principle says that two independent, controlled barriers should exist to prevent occurrence of a potential criticality accident scenario. The application of this principle is shown symbolically in Figure 0.1.3, which is a duplicate of Figure 0.1.2, with the two barriers added. For this example, it is assumed that the two barriers chosen are (1) pressure relief via the jet bypass pressure/interlock system, and (2) pressure relief via the rupture disk. As illustrated in Figure 0.1.4, with these barriers in place, this potential criticality scenario requires the occurrence of all of the following: (1) the initiating event - jet plugged at exit, (2) the failure of Barrier 1 - failure to relieve pressure via the jet bypass pressure/interlock system), and (3) the failure of Barrier 2 - failure to relieve pressure via the rupture disk. 0.1.1.2.2 Qualification of the barriers for double-contingency As discussed in paragraph 5.7.7, it is important that the failure of a barrier for dOUble-contingency be an unlikely event. The determination of whether a failure of a barrier for double-contingency is unlikely may be made on the basis of engineering judgment or failure rate data, if available. For this example, assume that failure rate data are available. In accordance with paragraph 5.7.7.3, the guidelines for acceptability when quantitative data are available are: (1) Guideline 1 - the estimated probability that the barrier will fail is no greater than once in 100 demands or 0.01/demand, and (2) Guideline 2 - the product of {the estimated frequency of the initiating event} times {the estimated probability of failure of the barrier - as applied in Rule 1} is not greater than once in 10 years or O.1/year.

150 "DRY LOCATION" POSSIBLE BACKFLOW (LIQUID) DIRECTION NORMAL (AIR) FLOW ~ SCRUBBER 1=="-==1==-==1 TAN K PUMP AIR JET POSTULATED PLUGGING ,SITE JET BYPASS LINE INTERLOCK I\.JET -----_ .. HIGH PRESSURE SWITCH BYPASS VALVE SEPARATOR TANK DOE G 421.1-1 8-25-99 TO VESSEL VENT SYSTEM ( TO LIQUID OVERFLOW (SEAL POT) MANUAL SHUTOFF VALVE (NORMALLY OPEN) Figure 0.1.1. Schematic of dry location and scrubber system. OOEG421.1-1 151 8-25-99 POTENTIAL CRITICALITY LIQUID ADDITION TO MECHANISM "DRY LOCATION" SOURCE 1 LIQUID FROM SCRUBBER SYSTEM SOURCE 2 MANUAL ADDITION LIQUID TO CABINET (OPERATOR ERROR) t NOT DEVELOPED HERE BACKFLOW PUMPING ACTION BACKFLOW HIGH INTERNAL PRESSURE PHENOMENA t NOT DEVELOPED HERE INITIATING EVENTS I AIRJET PLUGGED AT EXIT PLANT AIR (SOPSI) Figure 0.1.2. Logic diagram for potential criticality via liquid addition to dry location. 152 POTENTIAL CRITICALITY LIQUID ADDITION TO "DRY LOCATION" SOURCE 1 LIQUID FROM SCRUBBER SYSTEM SOURCE 2 MANUAL ADDITION LIQUID TO CABINET (OPERATOR ERROR) NOT DEVELOPED HERE DOE G 421.1-1 8-25-99 ---/ , /NOTE: '\ I FOR DOUBLE \ I CONTINGENCY I I PRINCIPLE- \ TWO , \ DEFENSES , ... __ .... __ .. ,REQUIRED I '__ I BACKFLOW PUMPING ACTION NOT DEVELOPED HERE INITIATING EVENTS BACKFLOW HIGH INTERNAL PRESSURE , I \ I , I " , AIRJET PLUGGED AT EXIT PLANT AIR (90PSI) Figure 0.1.3. Logic diagram for potential criticality via liquid addition to dry location - two barriers added. DOE G 421.1-1 8-25-99 POTENTIAL CRITICALITY LIQUID ADDITION TO "DRY LOCATION" - BACKFLOW FROM SCRUBBER SYSTEM - HIGH PRESSURE - AIR JET PLUGGED AT EXIT INITIATOR FAILURE OF CRITICALITY PROTECTIVE FUNCTION #2 153 FAILURE OF CRITICAliTY PROTECTIVE FUNCTION #1 JET PLUGGED AT EXIT FAILURE TO RELIEVE PRESSURE FAILURE TO RELIEVE PRESSURE (ESTIMATED FREQUENCY O.6IYR) FAILURE HIGH PRESSURE SWITCH FAILURE ELECTRICAL INTERLOCK -BYPASS VALVE - RUPTURE DISK (ESTIMATED FAILURE O.003/DEMAND) FAILURE BYPASS VALVE TO OPEN ON DEMAND (ESTIMATED FAILURE DATA IN PARENTHESIS) -JET BYPASS PRESSURE/INTERLOCK SYSTEM (ESTIMATED G~ FAILURE O.OOS/DEMAND) MANUAL VALVE IN BYPASS LINE CLOSED -OPERATOR ERROR VENT PATH CLOGGED TO VESSEL VENT SYSTEM (LIQUID OVERFLOW LINE SERVES AS BACKUP) Figure 0.1.4. Contingency analysis diagram. 154 ~OE G 421.1-1 8-25-99 Guideline 1 - As shown in Figure 0.1.4 and Table 0.1.1, the probability that Barrier 1 will fail upon demand is estimated at 0.005/demand, thus meeting the 0.01/demand guideline. Correspondingly, the failure probability of Barrier 2 is estimated at 0.003/demand, which is better than the 0.01/demand guideline. Both barriers are judged to meet Guideline 2. The frequency of the initiating event -- pluggage of the air jet at the exit during operation -- is estimated (conservatively) to be in the vicinity of once every twenty months (based on previous experience with similar equipment and operating conditions). Therefore, the frequency is shown as 0.6/year (Figure 0.1.4 and Table 0.1). For Barrier 1: (estimated frequency of the initiating event) times (estimated probability of failure of Barrier 1) = 0.6/year x 0.005/demand = 0.003/year, thus meeting the 0.1/year guideline. For Barrier 2: (estimated frequency of the initiating event) times (estimated probability of failure of Barrier 2) = 0.6/year x 0.003/demand = 0.0018/year, thus meeting the 0.1/year guideline.

Note: As a point of interest, in this example the estimated frequency for this potential criticality scenario (based solely on the three factors discussed above) is: 0.6/year x 0.005 x 0.003 = 9 x 10-6/year, that is a recurrence interval of approximately 111,000 years. Independency of barriers. The two barriers in this example are judged to be sufficiently independent. On the negative side, both barriers involve the sensing of a common process parameter, high pressure, and both have the same basic function, which is to relieve pressure. However, on the positive side the two barriers do not share components, and they operate quite differently -- not likely to be subject to common-cause errors during facility operations such that both systems would be inadvertently taken out of service, or in maintenance operations such that common calibration or set-point errors might occur. 0.1.1.3 Identifying the means of control for each contingency barrier. As discussed in paragraph 5.7.7.4, the prominent identification of the means of control associated with a barrier for double­ contingency is important. Special care should be exercised to maintain these controls during facility operation, maintenance activities, and subsequent design changes. As shown in Figure 0.1.4 and Table 0.1.1, five controls are associated with Barrier 1 (see bottom of Figure 0.1.4). The failure of anyone of these could defeat the barrier. Three of the five are hardware items. They are the sensor, the electrical interlock, and the automatic valve. All three will require administrative controls in the form of functional testing and preventive maintenance to maintain high reliability. The other two controls (of these five) will require special procedural controls (such as verification that the manual valve in the bypass line is OPEN prior to operating the air jet). Only one means of control is associated with Barrier 2, that is, the rupture disk itself). 0.1.1.4 Review, relative to the other nuclear criticality safety objectives. The last step in the double-contingency analysis is to reflect back on the design relative to all six of the basic design objectives discussed in paragraph 5.7.3, particularly the following two objectives. Objective 3: Is there a feasible design alternative that will completely eliminate this potential criticality scenario? In this example the possibilities may include design alternatives to (1) eliminate the use of liquids in the auxiliary systems to the dry location (probably not practical here), or (2) eliminate the 90-psig motive force (in favor of an alternative). DOE G 421.1-1 8-25-99 Table 0.1.1. Contingency Analysis - Summary Sheet STATEMENT OF CRITICALITY SCENARIO Specific Location: Dry Location Mechanism: Liquid addition to dry location Source: Scrubber system liquid Phenomenon: Backflow due to high pressure in scrubber system Initiating Event: Pluggage of air jet at exit. 155 INITIATING EVENT Pluggage of air jet at exit - estimated frequency, approx. 0.6/year BARRIER 1 DESCRIPTION: Relieve (high, abnormal) pressure via jet bypass pressure/interlock system. QUALIFICATION OF BARRIER 1: Guideline 1: Estimated Probability of barrier failure - 0.005/demand. Guideline 2: Product of (est. freq. of initiating event) times barrier failure prob. = 0.6/year x 0.005 = 0.003/year. LIST OF ASSOCIATED MEANS OF CONTROL: 1. High-pressure switch - separator tank (open jet bypass valve at > 4 psig). 2. Electrical interlock - interlocks pressure switch to automatic valve in jet bypass line to OPEN

on demand. 3. Jet bypass valve (automatic) in jet bypass line. 4. Manual valve in jet bypass line - requires administrative controls to ensure valve open. 5. Vent line to vessel vent system - requires administrative control to ensure/verify that line is free. (Note: liquid overflow line to serve as backup.) BARRIER 2 DESCRIPTION: Relieve (high, abnormal) pressure via the rupture disk on separator tank. QUALIFICATION OF BARRIER 2: Guideline 1: Guideline 2: Estimated Probability of barrier failure - 0.003/demand Product of (est. freq. of initiating event) times barrier failure prob. = 0.6/year x 0.003 = 0.0018/year. LIST OF ASSOCIATED MEANS OF CONTROL 1. Rupture disk on separator tank (rupture pressure > 6 psig) 156 DOE G 421.1-1 8-25-99 Objective 1: If feasible, have the preferred methods been incorporated? For example, the use of geometry control in the dry location (if feasible) could eliminate the necessity of precluding liquids from the dry location for reasons of nuclear criticality safety. 0.2 Examples of eliminating unnecessary criticality scenarios. Rather than accepting an element of risk, it is preferred that the risk be removed entirely, if feasible. As discussed in paragraph 5.7.7, an effort should be made to explore the feasibility of design changes aimed at eliminating potential criticality scenarios. The three examples below are intended to illustrate the intent and lines of inquiry. 0.2.1 Example # 1 - Removing a potential water source to a dry area. A design concept incorporates a water-cooled heat exchanger to cool the off-gas from a process. Evaluations reveal a potential criticality scenario that begins with cooling water leaking across the tubes of the heat exchanger (the initiating event), followed by the loss of detection and protective measures, and ending with water reaching a location that must remain dry for nuclear criticality safety. Before accepting this risk, consideration should be given to the feasibility of alternative cooling means that will completely eliminate this scenario. For example, it may be feasible to provide the off-gas cooling function using a design that does not involve water, such as with an air-cooled or freon-cooled design. Using an alternative cooling method, the potential source of water to the dry location is entirely eliminated. 0.2.2 Example # 2 - Eliminating the motive force. A design concept incorporates an air jet connected to a process vessel to be used for the vacuum transfer of liquids into a vessel. The air jet is supplied by a high-pressure facility air system. Evaluations show a potential criticality scenario starting with pluggage of the exit to the jet with trash or other material, which produces a high positive pressure in the process vessel. In turn, the high pressure provides a motive force causing liquid in the vessel (containing fissile nuclides) to accidentally backflow through interconnecting piping and reach locations that are unsafe for criticality, such as instrument air systems, cold feed tanks, and ventilation systems. In such a case, the feasibility of alternative design concepts, such as an electrically driven pump or alternative system, should be explored that, while retaining the solution transfer capability, have no potential for producing large positive pressures on the vessel contents.

0.2.3 Example # 3 - Eliminating the potential for over-concentration. A design concept incorporates an evaporator for concentrating aqueous solutions containing fissionable material product. Nuclear criticality safety of the evaporator is based on limiting the concentration of the fissionable material product to a safe value. An automatic control system is used to regulate the specific gravity of the concentrate. (The specific gravity can be directly correlated to product concentration levels.) Backup protection against product over-concentration is achieved using active protective devices (sensors and interlocks) that shut off the steam supply to the evaporator when the specific gravity of the concentrate approaches the limit for nuclear criticality safety. A potential criticality scenario is identified that begins with the loss of specific gravity control, followed by failure of the active protective devices to shut off the steam supply, and resulting in high product concentration levels exceeding the nuclear criticality safety limits. In this case, design considerations should be given to identifying a feasible means to eliminate the possibility of product over-concentration. For example, the circumstances may permit using a value for the steam supply pressure to the evaporator that is high enough to achieve the normal product OOE G 421.1-1 8-25-99 157 concentration level but low enough to thermodynamically preclude the evaporator system from being capable of attaining the higher product concentration levels associated with nuclear criticality safety concerns. With this approach, a criticality accident due to product over-concentration is not possible, regardless of the proper performance of the control and protective devices. 0.3 Examples of passive-engineered features and devices. The purpose of this section is to provide examples of the group of controls called passive-engineered features and devices, that are discussed in paragraph 5.7.4.1.1. This group consists of fixed, passive design features and devices with no moving parts. No electrical, mechanical, or hydraulic action is required. In many cases, these features and devices are employed to protect against the unwanted transport of liquids from favorable to unfavorable locations. 0.3.1 Air break. An air break is a simple, highly reliable means for backflow or back siphonage prevention with virtually no failure mechanisms. With this device, an air gap is created by interrupting a piping system. This device is illustrated in Figure 0.3.1 and is applicable to situations where line pressure may be broken. Note that such a device would rank very high as a preferred control for nuclear criticality safety considering reliability, range of coverage, and operational support requirements. Regarding range of coverage, this device provides direct, positive protection against backflow to the feed tank in Figure 0.3.1 -- independent of the reason for the backflow. For these reasons, the air break should be employed as standard practice, whenever applicable. 0.3.2 Barometric seal leg. Figure 0.3.2 illustrates the use of barometric seal leg connections, or gooseneck connections, when there are multiple-source line connections to a main header. Here, a gooseneck connection is used for each source connected to the header. The arrangement shown in Figure 0.3.2 includes overflow capability from the header and acts to prevent liquid that has arrived to the header (from one line source) from back-flowing through other line source connections. Of course, undetected pluggage of the overflow line could defeat the safety function. Because of its simplicity and effectiveness, this arrangement should be incorporated whenever backflow from a header through a source line could introduce nuclear criticality safety concerns.

0.3.3 Criticality drain. A criticality drain is a device that normally serves both radiological and criticality safety functions while preventing liquid buildup in moderation controlled enclosures such as gloveboxes. Figure 0.3.3 illustrates the use of a J-trap type criticality drain. The portion of the drain inside the glovebox is raised slightly above the bottom and has a baffle to prevent clogging (some types use screen mesh stand-offs). Thus, the maximum credible depth of liquid in the glovebox is a fraction of minimum critical thickness. The portion of the device below the glovebox is partially filled with an oil selected for its low evaporation rate and resistance to combustion. This oil forms a radiological seal, and this region of the device may be transparent or have a level indicator and fill port. The end of the J-trap may be open or connected to vented drain piping based upon radiological considerations. In the event of a spill or leak exceeding the inside lip height, liquids pass through the trap. The J-trap and any connecting piping are large enough in diameter to accommodate the maximum credible flow rate into the glovebox. If the drain(s) are piped to receiver vessel(s), they shall be criticality-safe and equipped with overflow lines to avoid backups. 158 ILLUSTRATION OF "AIR BREAK" FEED TANK AIR BREAK PROTECTS AGAINST BACKFLOW AND BACKSIPHONAGE FROM PROCESS TANK TO FEED TANK PROCESS TANK SOLUTION (HIGH FISSILE CONCENTRATION) Figure 0.3.1. Schematic of air break. DOE G 421.1-1 8-25-99 ILLUSTRATION OF BAROMETRIC SEAL LEGS ("GOOSENECK CONNECTIONS") ARRANGEMENT PROTECTS AGAINST LIQUID BACKFLOW FROM MAIN HEADER TO SOURCE LINES OVERFLOW LINE TO SEAL POT BAROMETRIC SEAL LEGS (ELEVATION ABOVE OVERFLOW /7'(POINT) ~SOURCE LINES Figure 0.3.2. Illustration of barometric seal. DOE G 421.1-1 8-25-99 Water or au level OverfioW' or connection point to downstream pipinc Valve (!.. ..y:;r Buildinl Floor 11 ))77 77 ~77/7/ /7/7//7. Figure 0.3.3. Criticality Drain. 159 0.3.4 Nuclear safety blank. A nuclear safety blank is a simple, positive means for preventing the accidental transfer of liquid through a line to an unsafe location. This blank typically consists of a flat, solid metal disk inserted in a pipe flange to block the flow of liquid in special circumstances, such as special processing campaigns, where the accidental transfer of liquid through the line to another location could lead to criticality concerns. The device should be designed to make unplanned removal mechanically difficult and labeled for easy identification in the field. A spectacle flange is a nuclear safety blank combined with a second disk with flow hole(s) and resembles a pair of eyeglasses. This design provides flexibility while having the advantage of providing positive proof that flow is blocked if the disk with the hole(s) is visible. However, all nuclear safety blanks should be leak tested and surveyed for wear and corrosion at start-up and at appropriate intervals. With suitable administrative controls to guard against unplanned removal, these devices would likely qualify as a double-contingency control, whereas administrative controls to keep a block valve in the closed position would not qualify. 0.3.5 Large line sizes. Under certain conditions, the pluggage of a line can cause the unplanned redirection of liquid to an unsafe location. By selecting a large, but safe, line-size larger than would otherwise be employed, it may be possible to make pluggage of the line considerably less likely to occur than would otherwise be the case.

0.3.6 Restricting orifices. Under certain conditions, the occurrence of an abnormally high flow rate in a line can lead to a criticality concern. In such a case, a restricting orifice in the line can provide a simple, reliable means of protection. 0.3.7 Relative elevation. The relative elevations of various equipment items and piping in a facility can be an important consideration in determining the potential for the unplanned transport of liquid from safe to unsafe locations. For example, simple leakage past a block valve can result in the unplanned flow of liquid (by gravity) from a source tank to a receiving tank located at a lower elevation. This mode of unplanned transport (by gravity) can be eliminated in the design concept by reversing the respective elevations of the two tanks. These examples serve to illustrate the importance of clear identification of those design features and controls important to nuclear criticality safety. Many of the design features and devices in this group, such as a restricting orifice or size of a line, are not normally associated with nuclear 160 DOE G 421 .1-1 8-25-99 criticality safety, and in the absence of clear identification, their importance to nuclear criticality safety may be overlooked. 0.4 Examples of active protective devices. The group of controls identified as active protective devices is discussed in paragraph 5.7.4.1.2. These devices are characterized as add-on devices involving moving parts, are designed to act upon demand, or are sensing devices. Many such devices are electrical/mechanical. The first two examples below illustrate devices in this group that are strictly mechanical (preferred to complex electro-mechanical systems unless there is a demonstrable benefit from additional complexity). 0.4.1 Rupture disk. Phenomena causing abnormally high pressure in a vessel can cause the unwanted flow of liquid in the vessel to unsafe locations, as illustrated in the example in section 0.1.1. The normal engineering function of a rupture disk is to protect the vessel itself from over­ pressurization. However, it may be feasible in a given situation to select a lower pressure rating for the rupture disk (than would otherwise be needed) to limit maximum pressures in a vessel below the values required to transfer the liquid to an unsafe location. Assuming that adequate reliability of this device can be established, the rupture disk would serve a valuable nuclear safety function in addition to its vessel protective function. 0.4.2 Backflow prevention devices. As discussed in section 0.3, an air break provides very effective protection against backflow and back siphonage. However, there are situations where an air break device is not suitable, since line pressure would be lost. When it is necessary to maintain line pressure, an in-line device may be considered. A review of the various backflow and back siphonage prevention designs could include: (1) single check-valve design, (2) double check-valve design, (3) double check-valve design with vent, (4) reduced-pressure device, and (5) reduced­ pressure device with internal air gap. This spectrum of design types serves to illustrate the general notion involved in selecting a double-contingency means of control. Due to questions of seal integrity, it is likely that most of these backflow prevention devices would be determined to have insufficient reliability to qualify as a double-contingency means of control. On the other hand, one or more of these designs may so qualify, depending on unique design features and the service conditions involved.

0.4.3 Radiation monitoring systems. A radiation detector, readout, alarm, and associated motor- or air-operated valve(s) that close(s) on a dose rate set point is a relatively simple active protection system for either radiological safety. criticality safety, or both. Such systems may be portable or fixed. They can be conservatively used for criticality safety of geometrically unfavorable tanks by assuming that all radioactivity is due to the presence of fissionable nuclides. More sophisticated applications use gamma spectrum analyzers to more accurately estimate fissionable material content. In-line detectors should be close to the lower side of piping at strategic points to maximize detecting solids-buildup that sampling may miss. and detectors on tanks should be located near places where solids-buildup is most likely. A variant of this system is a soluble neutron poison monitoring system where increasing neutron flux means poison concentration is decreasing. However, these detectors should not be located under pipes or tanks because poison can precipitate and skew results. Regardless of the specific application, it is important to design, operate, and maintain such systems to avoid frequent false alarms and thus create a distrust of instrument readings and alarms. DOE G 421 .1-1 8-25-99 161 APPENDIX E. SOFTWARE CONFIGURATION CONTROL PROCEDURE This appendix provides an acceptable approach to ensure that the nuclear criticality safety software system used in support of contractor installation nuclear criticality safety organization(s) will • provide accurate and reliable results, • provide rigorous structure to implement software changes, and • prevent unauthorized changes to the software. Included in this appendix are the actions and responsibilities for maintaining the quality and integrity of the nuclear criticality safety software system used in support of the contractor installation nuclear criticality safety organization(s). Except when specifically included in a Software Catalog, vendor­ supplied systems software, such as operating systems, linkers, compilers, and data base management systems used by the contractor installation, are excluded here and covered by separate configuration control for which the contractor is responsible. E.1 Specific responsibilities. E.1.1 Contractor safety organization manager. The contractor safety organization manager • acts as or appoints a Software System Team Chairperson; • assumes overall responsibility for the configuration control of the Contractor Nuclear Criticality Safety Software System; • maintains membership and charter on the Software System Team through coordination with the Contractor Nuclear Criticality Safety Committee (See Form E.7 for charter); • schedules and coordinates annual surveillance of the software configuration control program; • requests a surveillance/audit of configuration control for software utilized for nuclear criticality safety computations once every five years; • maintains a current listing of authorized users as notified by System Administrator; • distributes pertinent information on the software changes, Software Catalog, validations, and other sources to authorized users as appropriate; • participates, coordinates, and manages the handling and resolution of Software Revision Reports and Software Nonconformance Reports as prescribed in this plan; and • maintains hard copy documentation for a retention period consistent with paragraph 2.1.2 for

- Software Configuration Control Plans, - Software Catalogs (Form E.3), 162 - Software Revision Reports (Form E.1), - Software Nonconformance Reports (Form E.2), - Request for User Access (Form E.4), - Audit and Surveillance Reports, and - Software System Team Charter and Membership. DOE G 421.1-1 8-25-99 E.1.2 Software System Team. The Software System Team • by majority, determines those development, verification, testing, and record keeping operations to be covered by the Configuration Control Plan and the access controls to be required, • when a new software system is believed to be ready for use, reviews and approves the Software Catalog for completeness and correct access control, • develops the requirements for software Verification and Configuration Control Tests, coordinates the performance of the required tests, and approves all new or revised software before production use, • ensures that documentation has been updated (e.g., Configuration Control Plan, Software Catalog, Access Control, records of Verification and Configuration Control Tests, etc.), • upon request, assists the "quality organization" and other organizations in performing software appraisals, audits, and surveillances, • when a change to the software is requested, reviews the Software Change Request, Software Revision Report, Part A (Form E.1), to decide if and when the change should be made and completes Parts Band C, as appropriate, • reviews Software Nonconformance Reports (Form E.2) and determines and documents resolution by a majority in agreement, and • develops, implements, and maintains a Software Disaster Plan, as appropriate (Form E.5). E.l.3 Functional System Manager. The Functional System Manager • serves as the principal Nuclear Criticality Safety Organization contact to the software user with regard to the content of the software, • provides notification to installation software users of changes to the software systems, nonconformance reports, specialized machine dependent job control language (JCl) requirements, and current Software Catalog, and, if serving as the lead contact for more than one installation, maintains communication with each installation represented, • participates in the handling and resolution of Software Revision Reports and Software Nonconformance Reports as prescribed in this plan, • ensures that a Software Catalog is prepared for each mainframe computer software application, is kept current, and a copy provided to each user, DOE G 421.1-1 8-25-99 163 • verifies correct version of software is transferred into Migration Storage Area from the Development Storage Area and performs or coordinates the Software Verification Tests, and • upon approval of the change for production use, ensures that the version identification of any departmental procedure or plans that reference the software by version are updated. E.1.4 System Administrator. The System Administrator • ensures that master copies of the previous versions of machine executable modules and source code are maintained in the Archive Storage Area, and that a hard copy listing and documentation of the latest version are maintained, • retains a copy of all Software Revision Report (Form E.1) forms, • prepares the Software Catalog and sends a copy of each updated catalog to all members of the Software System Team, • notifies the Software System Team that programming of a requested revision is complete and has been transferred to the Migration Storage Area for Verification Testing,

• checks the Software Revision Reports and supporting documentation for completeness and forwards the report to the Software Developer, • performs the transfer of software to the Production Storage Area and Archive Storage Area when all proper tests and approvals authorize the transfer, • verifies and ensures the proper version of the executable code is in the Production Storage Area and the most recently superseded version of the source and executable code is stored in the Archive Storage Area, • develops, implements, and maintains the Configuration Control testing of the software production version and maintains appropriate documentation of testing, • develops, implements, and maintains a NCS Software Programmer's Manual to document the procedure used in transferring, compiling, and otherwise using the software, and • subject to the Software System Team Chairperson's approval, procures and maintains computer equipment to perform archiving and testing responsibilities. E.1.5 Installation nuclear criticality safety organization. The installation nuclear criticality safety organization • ensures all users of the NCS Software System utilize software that is covered by this Configuration Control Plan for mainframe computations, • ensures the computer software contained in the Software Catalog (Form E.3) is properly validated for the intended use, • assists in the performance of Verifications and Configuration Control tests, as necessary, 164 DOE G 421.1-1 8-25-99 • authorizes access to the software covered under this plan for users in the installation Criticality Safety Organization and other contractors per the User Access form (Form E.4), forwards completed User Access forms to the Software System Administrator, and provides notification to the Software System Administrator when user access needs to be removed, • develops and implements Disaster Plans where appropriate and forwards a copy of these plans to the Software System Team, Form E.5, • ensures that each user granted access to the software is provided with training in the proper use of the software, • develops and implements the appropriate Quality Assurance and Quality Control Programs to ensure the correctness of calculational results and use of the software, • assists the Software System Team in implementing software changes, testing new software, user access control, and any other areas where appropriate, • may request changes by initiating the Software Revision Report (Form E.1 l in order to define modification requirements, and • reports problems encountered to the proper Functional System Manager using the Software Nonconformance Report (Form E.2l. E.1.6 Software developer. The software developer • makes ONLY those software changes that have been approved by the Software System Team on a Software Revision Report (Form E.1), • may propose software changes on a Software Revision Report, • updates software version identification in a program when changes are made, • assists the Software System Team in conducting the Verification Test of the software modification, • supplies information to the System Administrator on software version identification and software changes, as appropriate, and • works with Software System Team to update the supporting documentation. E.2 Software identification. Initial system configuration consists of a catalog of application specific software. This Software Catalog defines the baseline system configuration. Access control is established by the Software System Team and is maintained by the System Administrator. Unambiguous labeling should provide traceability from source modules to executable modules (Form E.6l.

Versions should be uniquely identified in such a way that the update sequence may be readily determined. The version number and revision number shall be listed at least once on all output. DOE G 421.1-1 8-25-99 165 E.3 Software control. Users of software are responsible for ensuring that any software used is the currently approved version and that the use and application is validated. All modifications to the nuclear criticality safety software system require the approval of the Software System Team using the procedure in section E.4 of this plan. The software residing in the Production Storage Area will be audited by the Quality Division to ensure that the correct version is in use and that no changes have been made. Hard copy computer printouts should have, printed on a header, the version and date of revision of the principal software unit generating the printout. All modifications of software will be acceptance tested as specified on the Software Revision Report. E.4 Software change procedure. A software change is initiated by any user by completing Part A of the Software Revision Report. The request is sent to a member of the Software System Team. The Software System Team Chair/Functional System Manager/Software Administrator transmits the report to the other members of the Software System Team, as needed, to determine if and when the change should be made. Approval or rejection is documented by completing Part B of the Software Revision Report. If the modification is to be made, the Verification Test Plan should be developed and documented on the Software Revision Report, Part B. NOTE: The level of detail in the Verification Test is determined by the Software System Team based on the extent of the software change and the consequences of unintended or unanticipated changes. The Software Revision and associated Verification Test are approved by the Software System Team by signing the appropriate spaces on the form. If the Software Revision Report is rejected, the Software System Team Chairperson provides an explanation for rejection and provides a copy to the requestor. A copy of the approved Software Revision Report (Parts A and Bl is sent to the System Administrator. The System Administrator provides the Software Developer a copy of the current source code. The software modifications are made in the Development Storage Area. Once the software modifications have been made to the satisfaction of the Software Developer and the System Administrator, the software is transferred to the Migration Storage Area by the Functional System Manager. Part C of the Software Revision Report documents the completion of this step. The Verification Test is performed in the Migration Storage Area by the Functional System Manager with assistance, where appropriate, from the installation NCS Organizations. The performance of the software in the Verification Test is evaluated by the Software System Team. Part 0 of the Software Revision Report documents the Verification Test results and the acceptance/rejection of the results by the Software System Team. 166 DOE G 421 .1-1 8-25-99 Software System Team approval of the Software Revision Report, Part 0, provides notification to the System Administrator to transfer the new version of the software into the Production Storage Area and a copy of the current version (source and executable code) to the Archive Storage Area.

Completion of Part E of the Software Revision Report documents the software transfers, bit-by-bit comparison of the new Production version, and completion of the software revision procedure. E.5 Nonconformance Report procedure. A Nonconformance Report is initiated by completing Part A of the Nonconformance Report (Form E.2). The request is sent to a member of the Software System Team. The Software System Team Chair/Functional System Manager/Software Administrator transmit the report to the other members of the Software System Team, as needed, to determine the actions to be taken to prevent recurrence of the nonconformance. The Software System Team Chair provides nonconformance notification to the Quality Assurance Division and the Occurrence Reporting System, as appropriate. In extraordinary cases, the System Administrator or the Software System Team Chairman may authorize shutting down a program that presents immediate and major danger to safety or the environment. In such cases, the Software System Team should authorize the use of the corrected software, full details of the incident shall be provided in the documentation for the change, and a Nonconformance Report shall be initiated. The changed software shall have a new version identification. E.6 Software testing. Configuration Control Test: Testing procedure, requirements, and plan are determined by the Software System Team. At a minimum, the Configuration Control Test should include (a) a periodic (every quarter) bit-by-bit comparison of the production version against an archived production version stored at the time the production version was installed, and (b) quarterly testing by each installation using installation specific validation cases. Documented records of these tests shall be maintained by the System Administrator. Verification Test: Testing procedures, requirements, and plans are determined by the Software System Team pursuant to section E.4 of this plan. The level of detail found in the test plan will be commensurate with the complexity of the software change. As part of a Software Change Request implementation, transfer tests will be performed to verify the copying and transferring of software from one computing platform to another computing platform as listed in the software catalogs. DOE G 421.1-1 8-25-99 Form E.1 Software Revision Report. SAMPLE 167 Report No. SRR- Reason for the requested change and Software Nonconformance Report No.(SNR- ): Description of requested change: Modules affected: Describe anticipated or known effects the change will have on: A. Sample problem results B. Calculational time/efficiency C. Existing documentation Approval Rejection Functional System Managers System Administrator Software System Team Chairperson Reason for rejection: Software Verification Test Plan attached? Page 1 of 168 Form E.1 (cont.) Describe the change and components affected File names for new source or data: Describe the results of the Software Developer testing performed: Does the documentation? If and attach new documentation. Software change completed Software Developer Date ----------------- --------- Administrator Date DOE G 421.1-1 8-25-99 Verification tests results accepted and permission granted to transfer software from Migration Storage Area to Production Area Functional System Manager Functional System Manager Functional System Manager System Administrator Software Team SYSOI SYS02 SYS03 SYS04 load transfer date

Date ------------------ --------- Date ------------------ ---------__________________ Date _______ _ access date Software change implementation in Production Storage Area completed and updated software catalogs sent to Software System Team Chairperson. System Administrator Date __________ _ 2of2 DOE G 421.1-1 8-25-99 Form E.2 Software Nonconformance Report SAMPLE Report No. SNR- Software user name and address: Software title/version/date: Description of software nonconformance or error: Cause of nonconformance or error: Effect on previous calculations: Recommended corrective action: Cause of nonconformance and effect on previous software users: Immediate action is required to stop use of software? __ Reportable event per Occurrence Reporting System? Recommended corrective action: Software System Team approval of recommended corrective actions: Functional System Manager Date ____ _ Functional System Manager Date ____ _ Functional System Manager Date ____ _ System Administrator Date ----- Software System Team Chairperson Date Corrective actions completed Software System Team Chairperson . Date 169 170 DOE G 421.1-1 Form E.3 NCS Software System Version No.1 Catalog Computer node __ Updated: __ SAMPLE 8-25-99 DOE G 421.1-1 8-25-99 Form E.4 Request for User Access. 171 User access is requested for the following Contractor Nuclear Criticality Safety software: The proposed user and their supervisor have been informed and understand that validation, (establishment of correctness or bias in calculated results) is a user responsibility and that the contractor makes no claim of correctness for the computer software or for computer calculations performed by others. Type Proposed User's Name and UID: ________________ _ Proposed User (Signature): ________________ _ Date: -------- User's Address: User's Phone #: ------------------- ---- User's Supervisor (Signature): ________________ _ Date: -------- Organization: _______________________ _ Installation Nuclear Criticality Safety Organization Head (Signature): _______________ _ Date: ------- SEND COMPLETED FORM TO: (TO BE COMPLETED BY SOFTWARE SYSTEM ADMINISTRATOR) User access was activated on this date: --------------------- System Administrator Signature: Copy: Software System Team Chair 172 Form E.5 NCS Software Disaster Plan. DOE G 421.1-1 8-25-99 A disaster plan is not necessary for the NCS software because of the redundancy provided by multiple computing systems. The NCS software will be provided on the following systems, for example: 1. Computing System #1 1.0. 2. Computing System #2 1.0. 3. Computing System #3 1.0. Therefore, it is judged to be incredible that all NCS software versions could be simultaneously destroyed. DOE G 421.1-1 8-25-99 Source Form E.6 Software Labeling Protocol Examples NCSS.ZAZ39461.Module.V#R###.FORT (.ASM) Production Subroutine library NCSS.ZAZ39461.Sublib.V#R###.LOAD Archive Subroutine library NCSS.ZAZ39461.Sublib. V#R### .ARCHIVE Production Load Modules NCSS.ZAZ39461.module.V#R###.S###.LOAD Migration Load Modules NCSS. YCR39461 .module.V#R### .S### .LOAD Archive Load Modules NCSS.ZAZ39461 .module.V#R### .S### .ARCHIVE Data Libraries NCSS.ZAZ39461.identification.V#R###.DATA MODULE = program name (such as KENOVA, CSAS25, and SUBLlB) V# is the nuclear criticality safety software version number. R### is the module revision number. S### is the subroutine library revision number. 173 174 Objective: Mtng Freq:

Team Membership: Reporting: Form E.7 NCS Software System Team (NCSSST) Sample Charter. DOE G 421.1-1 8-25-99 The nuclear criticality safety software system team (NCSSST) acts as the change control board for the company's Nuclear Criticality Safety Software. The team should: • maintain the company's Nuclear Criticality Safety Software Configuration Control Plan, • determine and implement necessary changes to the NCS software pursuant to the configuration control plan, • address NCS software nonconformance reports as appropriate, and • provide assistance to other organizations in the area of software configuration control. At the discretion of the team (minimum - once per year) Chairperson Contractor Central Safety and Health organization or designee System Administrator Computer, hardware or software maintenance/operations organization Installation Functional System Manager(s) Installation representative(s) The NCSSST is directly accountable to the Contractor Central Safety and Health organization. DOE G 421 .1-1 8-25-99 175 APPENDIX F. EXAMPLE COMPUTATIONAL TECHNIQUE VALIDATIONS This appendix provides more detailed descriptions and example implementation of the required elements for computational technique validation as described in paragraphs 5.8.4 and 5.8.5, i.e., (a) the selection and description of the critical experiments used in the validation, or an appropriate reference that describes the experiments in adequate detail to permit reconstruction of computational input, (b) the selection and description of the computational method that is to be validated along with any necessary data for performing calculations or comparisons (e.g., neutron cross sections, material bucklings, limiting surface densities, or other similar data), (c) the selection and description of the computer/calculator platform and associated operating system used in the validation, (d) the nuclear properties, such as cross sections, that should be consistent with experimental measurements of these properties, (e) a description of similarities and differences between the critical experiments and the calculational models used for the validation, (f) all geometric, material, and nuclear physics related input variables used for the validation of the calculational or comparative method, with sketches provided, (g) the basis for the calculational or comparative bias and the determination of an acceptance criterion for calculated subcritical results, and (h) establishing the areas of applicability of the calculational or comparative bias and the acceptance criterion developed from the validation effort. F.1 Selection and description of critical experiments. The selection and description of critical experiments used as benchmarks for the calculational method validation should be similar to, and representative of, the problems that are to be evaluated. The benchmarks' physical compositions, geometric configurations, and other nuclear characteristics should be reviewed to ensure applicability (similarity) to the future problems for which the validation is intended. Unfortunately, critical experiments available for benchmarking tend to emulate single units. A particular problem evaluation may require calculations for a single unit, as well as arrays of units (such as in fissionable material package or storage array evaluations). Such a problem poses a difficulty in benchmark selection because there is a paucity of critical experiments of large arrays. Because of these concerns, it may be necessary to model a wide variety of benchmark experiments to adequately assess the validity of the calculational method used in the evaluation. Sufficient numbers and quality of experiments should be selected to provide a statistically justifiable basis for subcritical acceptance criteria.

F.2 Selection and description of the computational method. The selection of the computational method should be related to the particular expertise and experience of the criticality safety specialist performing the validation and should be related to the difficulty of the eventual problem evaluation and the relevance of the benchmark data to the computational technique. Examples of calculational methods are the three-dimensional mUlti-group or the pointwise cross section Monte Carlo codes, KENO-V.a, or MCNP and VIM, respectively; the one-dimensional mUlti-group Sn discrete-ordinates transport theory code, ANISN; the diffusion theory code, GAMTEC II - HFN; and hand calculation methods such as the limited surface density, density analog, one- or two-group restricted three­ dimensional diffusion theory, or solid angle methods. Associated computational data (e.g., cross section libraries, scattering quadrature sets, material bucklings, diffusion lengths, etc.) shall be identified. The computational method and associated computational data shall be described or referenced in the validation documentation. When computer neutronics calculations are used, the 176 DOE G 421 .1-1 8-25-99 type of computing platform should be stated along with relevant code configuration control information. This information may be provided by reference. An example partial listing of computer codes, models, and hand calculational methods that historically have been successfully used for nuclear criticality safety evaluations is provided in Table F.2. Table F.2. Partial Listing of Computer Codes, Models, and Hand Calculational Methods Computer Codes - R. N. Blomquist, "VIM Continuous Energy Monte Carlo Transport Code," Proceedings of the International Conference on Mathematics and Computations, Reactor Physics, and Environmental Analysis, Portland, OR, (April 30 - May 4, 1995), (On-line user's guide for VIM is shipped with the code, available at RSICC). - J. F. Briesmeister, Ed., "MCNP, A General Monte Carlo Code for Neutron and Photon Transport," LA-7396-M, Rev. 2, Los Alamos National Lab. (Sept. 1986). - L. L. Carter, C. R. Richey and C. E. Hughey, "GAMTEC-II: A Code for Generating Consistent Multigroup Constants Utilized in Diffusion and Transport Theory Calculations," BNWL-35, Pacific Northwest Laboratory, (March 1965). - N. M. Greene, L. M. Petrie, "XSDRNPM-S: A One-Dimensional Discrete-Ordinates Code for Transport Analysis," ORNLINUREG/CSD-2/V2/R1 (June 1983). - J. R. lilley, "Computer Code HFN; Multi-Group, Multi-Region Neutron Diffusion Theory in One Space Dimension," HW-71545, General Electric Company, Richland, Washington, (July 1962). - R. D. O'Dell, F. W. Brinkley, Jr., D. R. Marr, and R. E. Alcouffe, "Revised User's Manual for ONEDANT: A Code Package for One-Dimensional, Diffusion-Accelerated, Neutral-Particle Transport," LA-9184-M Rev. (December 1989). (On-line user's manuals for TWODANT are shipped with the program source.) - L. Petrie, N. Landers, "KENO-Va, An Improved Monte Carlo Criticality Program with Supergrouping," ORNL/NUREG/CSD-2/VI/R2 (Dec. 1984). - W. A. Rhoades and R. L. Childs, "An Updated Version of the DOT 4 One-and Two-Dimensional Neutron/Photon Transport Code," ORNL-5851 (July 1982). - W. A. Rhoades and R. L. Childs, "The DORT Two-Dimensional Discrete Ordinates Transport Code," Nucl. Sci. Eng. 99, 1, 88-89 (May 1988). - W. A. Rhoades and R. L. Childs, "The TORT Three-Dimensional Discrete Ordinates Neutron/Photon Transport Code," ORNL-6268 (November 1987).

- C. R. Richey, "EGGNIT: A Multigroup Cross Section Code," BNWL-1203, Battelle Memorial Institute Pacific Northwest Laboratories, Richland, Washington (November 1969). DOEG421.1-1 8-25-99 177 - V. S. W. Sherriffs, "MONK, A General Purpose Monte Carlo Neutronics Program," SRD-R-86, United Kingdom Atomic Energy Authority Safety and Reliability Directorate, Culcheth Warrington, January 1978. - T. P. Wilcox, E. M. Lent, "COG: A Particle Transport Code Designed to Solve the Boltzmann Equation for Deep-Penetrating (Shielding) Problems." Draft Report, Lawrence Livermore National Lab. (Oct. 1986). Models and Hand Calculational Methods - J.T. Thomas, "Solid Angle and Surface Density as Criticality Parameters," NUREG/CR-1615 and ORNL/NUREG/CSD/TM-15, U.S. Nuclear Regulatory Commission (1980). - J.T. Thomas, "Surface Density and Density Analog Models for Criticality in Arrays of Fissile Materials," Nucl. Sci. Eng., 62, 424 (1977). - M.C. Evans, "Criticality Assessment Using the Limiting Surface Density (NB2n) Method and Examples of Application," BNFL SAG/80/P29, British Nuclear Fuels pic (1980). - H.F. Henry, C.E. Newlon and J.R. Knight, "Extensions of Neutron Interaction Criteria," K-1478 (July 1961). - F.G. Welfare, "A Comparison of the Solid Angle Technique with KENO IV Calculations," Trans. Am. Nucl. Soc., 43, 410 (1982). - C.E. Newlon, "Solid Angle-Interaction Potential Method: Illustrative Problems," K-L-6328 (Sept. 1973). - D.R. Oden, J.K. Thompson, M.A. Lewallen, "Critique of the Solid Angle Method," NUREG/CR-005, U.S. Nuclear Regulatory Commission (1978). - D. C. Hunt, "Comparative Calculational Evaluation of Array Criticality Models," Nucl. Techno/., 30, 190 (1976). - S. J. Altschuler and C. L. Schuske, "A Model for the Safe Storage of Fissile Solutions," Nucl. Techno/., 17, 110 (1973). - C. L. Schuske and S. J. Altschuler, "Models for the Safe Storage of Dry and Wet Fissile Oxides," Nucl. Technol., 19,84 (1973). - S. J. Altschuler and C. L. Schuske, "Models for the Safe Storage of Fissile Metal," Nucl. Technol., 13,131 (1972). F.3 Description of similarities and differences. Nearly every computational model of a benchmark experiment requires some modeling approximations. The computational model approximations of the benchmarks should be described and include discussions on the similarities and bases of the differences. 178 DOEG421.1-1 8-25-99 F.4 Input variables. The geometric, material, and nuclear physics related input variables used for the validation of the calculational or comparative method should be provided along with sketches that relate the benchmark to the computational model. F.5 Acceptance criteria. The acceptance criteria are developed from the bias of calculated results and the uncertainties of the experimental data, the calculational technique, and the calculational models.

The basis for the calculational or comparative bias and the determination of acceptance criteria for calculated subcritical results shall be provided. For nuclear criticality safety calculational method validation purposes, the bias is defined as a measure of the systematic disagreement between the results calculated by a method and experimental data. The usual method of determining the calculational bias is to correlate the results of the benchmark critical experiments with the calculated results of the code being validated. With a value of unity, keff = 1.0, for each benchmark critical experiment, the bias is the deviation of the calculated values of keff from unity. The average bias is usually determined by one of two methods: (1) taking the difference between a simple average of the pooled calculated results and unity, that may be adequate for a specific validation, or (2) taking the difference between a linear regression of the calculated results (as a function of some independent variable, e.g., average energy group (AEG) of neutrons causing fission) and unity, that is usually necessary for a global validation. The first method produces a single value for the bias, while the second method produces a variable bias that is a function of the independent variable due to trends. Generally, neither the bias nor its uncertainty is constant; both are typically a function of one or more physical or nuclear variables. Physical variables include, for example, material composition, density, and enrichment. Nuclear variables include AEG causing fission, ratio of thermal absorption to total absorptions, ratio of total fissions to thermal fissions, fractional neutron leakage, and others. To appropriately validate cases where the calculated flux is relatively large in the intermediate energy range and small in the fast and thermal regions, the code user needs to use benchmark quality critical experiments with similar AEG values and flux-energy group distributions. Uncertainties in the validation calculations come from three general sources. The first source arises from limitations associated with the critical experiment and inadequacies of determinations and documentation. These can include uncertainties in the material and fabrication tolerance of the experimental hardware and fuel (compositions, assays, masses, densities, dimensions)' the experimenter's manipulation or adjustments, or both, to obtain the reported data, and an inadequate description of the experimental layout and surroundings. The second source is from the computational method, that may include uncertainties in the mathematical equations solved, the calculational approximations utilized in solving the mathematical equations, the convergence criteria, the cross-section data evaluation process and the manipulation of cross-section data, and limitations of the computer hardware. The third source is from the calculational models developed to emulate the experiment. These include uncertainties because of material and dimensional modeling approximations, the selection of various code options, individual modeling/coding techniques, and interpretation of the calculated results.

For computational method validation purposes, it is usually not practical or necessary to quantify and qualify all the individual uncertainties. The total uncertainty can be estimated through the application of any valid statistical treatment of the data. The total uncertainty determined usually appears as the bias and a variability in the bias, depending upon the statistical analysis applied. The combination of the bias and uncertainty in the bias is deduced from the mean value being calculated to establish a subcritical value, e.g., acceptance criteria. This subcritical value and any other values considered to be less subcritical are taken to be critical within the confidence limits applied to the DOE G 421.1-1 8-25-99 179 statistical technique to determine the uncertainty. A margin of subcriticality should be deduced from the previously described subcritical value to ensure subcriticality. Where calculational methods of evaluation are used to predict neutron multiplication factors, the calculated multiplication factor, ka, shall be equal to or less than an established allowable neutron multiplication factor, upper subcriticallimit; i.e., where ka the calculated allowable maximum multiplication factor, kelt' upper subcritical limit (USL), of the system being evaluated for normal or credible abnormal conditions or events. ke the mean k"", that results from the calculation of the benchmark criticality experiments using a particular calculational method. If the calculated values of k"" for the criticality experiments exhibit a trend with a physical or nuclear variable, then ke shall be determined by extrapolation on the basis of a best fit to the calculated values. The criticality experiments used as benchmarks in computing ke should have material compositions (neutron poisons and moderators), geometric configurations, neutron energy spectra, and nuclear characteristics (including reflectors) similar to those of the system being evaluated. Generally neither the bias nor its uncertainty is constant; both should be expected to be functions of composition and other variables . .6.k. = (a) (b) (c) .6.ke = (a) (b) (c) (d) .6.km = an allowance for statistical or convergence uncertainties, or both, in the computation of k., material and fabrication tolerances, and uncertainties due to limitations in the geometric or material representations used in the computational method . a margin for uncertainty in ke that includes allowance for uncertainties in the critical experiments, statistical or convergence uncertainties, or both, in the computation of ke, uncertainties due to extrapolation of kc outside the range of experimental data, and uncertainties due to limitations in the geometrical or material representations used in the computational method . an arbitrary margin to ensure the subcriticality of k.. The margin in the correlating variable, that may be a function of composition and other variables, shall include allowances for the uncertainty in the bias and for uncertainties due to any extensions of the areas of applicability. A value for .6.km should be described and documented.

F.6 Areas of applicability. An integral part of a code validation effort is to define the areas of applicability for the validation. There are three conditions that must be satisfied to ensure that calculations done to evaluate or support a real situation fall within the areas of applicability for the validation of the calculational method being used. These are materials (and associated nuclear properties), geometry, and neutron energy spectrum. Frequently, the correlating variable of AEG of a neutron causing fission is used to define an area of applicability for the validation and related computational bias. A discussion of the bases or judgments as to what constitutes the validation areas of applicability should be provided. 180 DOE G 421.1-1 8-25-99 The areas of applicability should identify the important variables and characteristics for which the code was (or was not) validated. For example, the areas of applicability may include specific types of fissionable materials (HEU, LEU, plutonium of low 240pU content, or others), material form (solution or metal, water-moderated or carbon-moderated, and others), geometric configurations (single units or arrays, heterogeneous or homogeneous, dissimilar units, or other conditions), and reflector materials (water, concrete, steel, lead, or others). The areas of applicability are intended to identify specific limits (upper and lower) of the variable or characteristic used to correlate the bias and uncertainties. For example, the areas of applicability may be defined in terms of the moderating ratio like H:X = 10 to 500, or in terms of the average energy group causing fission such as an AEG = 6.5 to 21.5, or in terms of the ratio of total fissions to thermal fissions like F:Fth = 1.0 to 5.0. For subsequent use of a validated code, the user should show that the variables and characteristics of the problem being calculated fall within the areas of applicability defined during the validation. The areas of applicability of a calculational method may be extended beyond the range of experimental conditions over which the bias is established by making use of correlated trends in the bias. Where the extension is large, the method should be (a) validated with a stepwise approach in developing a repertoire of benchmarks for the purpose of identifying individual potentially compensating biases associated with individual changes in materials, geometries, or neutron spectra, and (b) supplemented by other calculational methods to provide a better estimate of the bias(es) in the extended areas of applicability. F.7 Example validation. This example describes a statistical technique used to establish the maximum allowable calculated ke", acceptance criterion (also called the upper subcritical limit) resulting from a computational method validation effort. Various elements of the technique are derived from different references. This example provides more detail than what is provided in the footnoted references, and the equations may be in a different, but algebraically identical, form. The equations in this example are usually in a basic form, while other algebraically identical forms (not presented here) are more convenient for computational purposes. One method109 used to validate the KENO criticality code and associated cross sections for establishing an acceptance criterion is to determine the single sided, uniform width, closed interval, lower tolerance bandll0.l11 (LTB) for calculated ke" values of critical systems. For application, this L TB becomes the upper subcritical limit (USL) acceptance criterion. A system is considered acceptably subcritical if a calculated ke" plus two standard deviations lies below the USL, i.e., ke" + 20 < USL:

109 110 III H. R. Dyer et aI., "A Technique for Code Validation for Criticality Safety Calculations," Trans. Am. Nucl. Soc. 63, 238 (June 1991). D. C. Bowden and F. A. Graybill, "Confidence Bands of Uniform and Proportional Width for Linear Models," Am. Stat. Assoc. Jour. 61, 182 (March 1966). N. G. Johnson, Ed., "Tolerance Interval in Regression, Query 26," Technometrics 10,107 (February 1968). DOE G 421.1-1 8-25-99 181 For a set of n kef( calculations of critical experiments with a corresponding independent variable x, determine the linear least-squares fit, k(x), of the data as a function of x. k(x) = bo + b, x, where bI (the slope) = L(X i - X)(k j - k) Lk.-bILx. bO(the intercept) = I I n x = and n In these equations, and others to follow, a summation, I, means the sum of all values from i = 1 to i = n, where n is the sample size, that is the number of critical experiments upon which the validation is based. The independent variable, x, is used to specify the areas of applicability, as described in section F.6. 2 The next step is to determine the "pooled" variance, S p 2 2 2 sp = sk(x) + Sw ,where 2 sk(x) (the variance of the fit, or mean square error) 2 h ' h" d 1 ~ 2 Sw (t e Wit In variance of the ata) = -.t..J O. ,and n I Oi is the standard deviation associated with each calculated kef(' The pooled standard deviation is then the square root of the variance, S p = ~ S: . 182 2 DOE G 421.1-1 8-25-99 The within-variance, sw' represents the contribution of the variance from KENO or other Monte Carlo codes that have a standard deviation associated with the calculated kef( values. For deterministic codes that do not have a standard deviation associated with the kef( values, the within­ variance is zero. It should be noted that the within-variance is not a part of the statistical method presented in footnotes 110 and 111, but was included here because of the inherent uncertainty from a Monte Carlo type code. The next step is to determine a multiplier, C, of the pooled standard deviation such that there is at least a confidence that a proportion P of the population (of future calculations of critical systems) will lie above the line defined by k(x) minus C·sp • This is the L TB as determined by the technique, and LTB = k(x) - OSp . The a confidence, that is selected by the validator, is defined by '" ~ 1 - ( Y2 1 ) - Y2 ' where (1 - Vl) = the one-sided confidence band about the linear regression, and (1 - V2) = the confidence on the variance of the fit. Since the expression for a presents one equation and two unknowns, either Vl or V2 must be selected such that the other can be determined. In practice, the (1 - Vl) confidence is selected to be the same value as the a confidence, typically 0.95. With a = 0.95 and (1 - Vl) = 0.95, then (1 - V2) = 0.975. The proportion P is usually chosen to be 0.999. The multiplier C is determined from 1 C -- C * n-2 2 h + z ------ ,were p 2 xCn- 2)(l-Y2) Zp is the standard normal variable of the proportion P for a normal distribution, 2 xCn-2)(l-Y2) is from the Chi-square distribution for (n-2) degrees of freedom at the (1-V2) confidence, and n is number of calculated critical experiments used in the validation. NOTE: The author of footnote 111 is not consistent with the subscript notation used during the development of the technique. The technique is based upon the "upper tail" of the Chi-square distribution, such that 2 2 P[XCn-2) > XCn-2)CI-Y2)] = 1 - Y2 .

Most Chi-square tables typically denote the "lower tail," such that DOE G 421.1-1 8-25-99 2 2 P[X(n-2) :5: X(n-2)(P)] = P then, the upper tail of the distribution is 2 2 P[X(n-2) > X(n-2)(P)] = 1 - P . 2 183 Thus, to obtain the value of X(n-2)(1-Y2) (author's notation), enter the table to find 2 X(n-2)(Y2) (typical notation), as the author does in the example problem for footnote 111. C' is evaluated over the range of the independent variable, a < x < b, where a and bare, respectively, the lower and upper limits of the areas of applicability. C' is determined by calculating values for g, h, p, and A, where 1 1 -2 - (a-x) 2 g = + n ~ - 2 (xex ) 1 1 -2 h (b-x) 2 + n -2 ~(xex) p = _1 [.!. + (a~x)(b~x") j gh n ~(xex)2' and A = g/h. The values of p, A, and (n-2) are used to determine a value D from Table F.7.1, at the (1 - V,) confidence. Table F.7.1 covers the range of 0.5 ~ A ~ 1.5; then C' = D·g. If A is outside the range of 0.5 to 1.5, then use 1/A, p, and (n-2) to determine D; then C' = D·h. In Table F.7.1, the values for D have been derived by evaluating the double integral given in footnote 110 and are essentially identical to the D values given in Table 3 of footnote 110. Table F.7.1 covers the same range for (n-2), p, A as the footnote, and also includes a 0.99 confidence (not included in the footnoted table). Table F.7.1 is provided for users who may not have access to footnote 110 and who may wish to impose a more restrictive confidence criteria. 184 DOE G 421.1-1 8-25-99 Once these values have been determined, the linear regression, k(x), and the L TB should be graphically depicted for future reference. The LTB is the USL for the maximum allowable kef(' ks , as a function of the independent variable, as shown in Figure F. 7.1. For application, a calculated kef( plus two standard deviations shall lie below the USL line, keff, ks , + 20 < USL. This statistical method for code validation allows the USL to be established such that there is a high degree of confidence that a calculated result that satisfies the acceptance criteria is indeed subcritical. Although a margin of subcriticality is not determined by the technique, a margin can be defined as the difference between the (1-y,) confidence on the linear regression for a single future calculation and the USL. The (1-y,) confidence on a single future calculation is determined by w(x) _ 2 1 (xi -x) 2" , where t(1-Yl) is from the student-t distribution at the (1-y,) confidence and (n-2) degrees of freedom, and sp is the pooled standard deviation previously determined. Since w(x) is a curvilinear function, and it is desirable to have a constant width margin, the expression is evaluated at XI = a and XI = b (the lowest and highest values, respectively, of the independent variable). The larger of the two is the constant W, to be deducted from the linear regression, k(x), to provide a uniform width confidence band for a single future calculation. The margin of subcriticality is the difference between the uniform width confidence band for a single future calculation and the USL, or margin of subcriticality = [k(x) - WJ - [k(x) - CSpl = C.sp - W. Figure F. 7.1 graphically depicts typical results of the single-sided, uniform-width, closed-interval, L TB technique for code validation. Since the calculational bias has been accounted for in the linear regression, it is not uniquely determined. Numerically, the average calculational bias at any point within the areas of applicability is the difference between the linear regression k(x) and unity.

DOE G 421.1-1 8-25-99 Table F. 7 .1. Calculated D Values !n-2) 4 4 4 4 4 4 6 6 6 6 6 6 8 8 8 8 8 8 10 10 10 10 10 10 12 12 12 12 12 12 14 14 14 14 14 14 (1 - V,) = 0.99 A J.Ql. 0.5 0.6 0.7 0.8 0.9 1.0 .0 9.44 7.89 6.91 6.34 5.78 5.50 .1 9.44 7.89 6.91 6.20 5.78 5.50 .3 9.44 7.89 6.91 6.20 5.78 5.50 .5 9.16 7.75 6.91 6.20 5.64 5.36 .7 9.16 7.75 6.77 6.06 5.50 5.22 .9 9.16 7.75 6.63 5.92 5.36 5.08 .0 7.47 6.20 5.50 4.94 4.52 4.23 .1 7.47 6.20 5.50 4.94 4.52 4.23 .3 7.47 6.20 5.50 4.94 4.52 4.23 .5 7.47 6.20 5.43 4.87 4.52 4.23 .7 7.47 6.20 5.36 4.80 4.38 4.16 .9 7.47 6.20 5.36 4.66 4.23 3.95 .0 6.77 5.64 4.94 4.38 4.02 3.81 .1 6.77 5.64 4.94 4.38 4.02 3.81 .3 6.77 5.64 4.87 4.38 4.02 3.81 .5 6.77 5.64 4.87 4.38 4.02 3.74 .7 6.77 5.64 4.80 4.30 3.95 3.74 .9 6.77 5.64 4.80 4.23 3.81 3.60 .0 6.34 5.36 4.59 4.09 3.81 3.57 .1 6.34 5.36 4.59 4.09 3.81 3.57 .3 6.34 5.29 4.59 4.09 3.78 3.53 .5 6.34 5.29 4.59 4.09 3.74 3.53 .7 6.34 5.29 4.59 4.02 3.71 3.46 .9 6.34 5.29 4.52 4.02 3.60 3.39 .0 6.06 5.08 4.45 3.95 3.64 3.43 .1 6.06 5.08 4.45 3.95 3.64 3.43 .3 6.06 5.08 4.45 3.95 3.60 3.39 .5 6.06 5.08 4.38 3.95 3.60 3.39 .7 6.06 5.08 4.38 3.88 3.57 3.32 .9 6.06 5.08 4.38 3.81 3.46 3.25 .0 5.92 4.94 4.30 3.81 3.53 3.32 .1 5.92 4.94 4.30 3.81 3.53 3.32 .3 5.92 4.94 4.30 3.81 3.53 3.32 .5 5.92 4.94 4.30 3.81 3.50 3.29 .7 5.92 4.94 4.30 3.81 3.46 3.25 .9 5.92 4.94 4.23 3.74 3.39 3.18 .L.1 1.2 5.22 5.08 5.22 5.08 5.22 5.08 5.08 4.94 5.08 4.94 4.80 4.73 4.09 3.95 4.09 3.95 4.09 3.95 4.02 3.95 3.95 3.88 3.81 3.81 3.67 3.53 3.67 3.53 3.67 3.53 3.60 3.53 3.53 3.46 3.46 3.39 3.43 3.32 3.43 3.32 3.39 3.32 3.39 3.32 3.32 3.25 3.25 3.18 3.29 3.18 3.29 3.18 3.25 3.18 3.25 3.18 3.21 3.14 3.143.11 3.18 3.11 3.18 3.11 3.18 3.11 3.18 3.07 3.11 3.04 3.04 3.00 185 1.3 1.4 1.5 4.94 4.87 4.80 4.94 4.80 4.80 4.94 4.80 4.80 4.87 4.80 4.80 4.80 4.80 4.66 4.66 4.66 4.66 3.88 3.81 3.81 3.88 3.81 3.81 3.88 3.81 3.81 3.81 3.81 3.74 3.81 3.74 3.74 3.74 3.74 3.74 3.46 3.46 3.39 3.46 3.46 3.39 3.46 3.46 3.39 3.46 3.39 3.39 3.43 3.39 3.39 3.39 3.39 3.39 3.25 3.25 3.18 3.25 3.25 3.18 3.25 3.25 3.18 3.25 3.21 3.18 3.25 3.18 3.18 3.18 3.18 3.18 3.14 3.11 3.11 3.14 3.11 3.11 3.11 3.11 3.07 3.11 3.11 3.07 3.11 3.07 3.07 3.04 3.04 3.04 3.04 3.04 3.00 3.04 3.04 3.00 3.04 3.04 3.00 3.04 3.00 3.00 3.04 3.00 2.97 2.97 2.97 2.97 186 Table F. 7.1 (cant.) (1 - V,) = 0.99 (cant.) A DOE G 421.1-1 8-25-99 (n-21 l1ll 0.5 0.6 0.7 0.8 0.9 1.0 L.1 1.2 1.3 1.4 1.5 16 .0 5.85 4.87 4.23 3.74 3.46 3.25 3.11 3.04 2.97 2.97 2.93 16 .1 5.85 4.87 4.23 3.74 3.46 3.25 3.11 3.04 2.97 2.97 2.93 16 .3 5.85 4.87 4.23 3.74 3.46 3.25 3.11 3.04 2.97 2.97 2.93 16 .5 5.85 4.87 4.23 3.74 3.43 3.21 3.11 3.04 2.97 2.97 2.93 16 .7 5.85 4.87 4.16 3.74 3.39 3.18 3.04 3.00 2.97 2.93 2.93 16 .9 5.85 4.87 4.16 3.67 3.32 3.11 3.00 2.97 2.93 2.93 2.90 20 .0 5.71 4.73 4.09 3.67 3.36 3.14 3.04 2.93 2.90 2.86 2.86 20 .1 5.71 4.73 4.09 3.67 3.36 3.14 3.04 2.93 2.90 2.86 2.86 20 .3 5.71 4.73 4.09 3.64 3.32 3.14 3.00 2.93 2.90 2.86 2.86 20 .5 5.71 4.73 4.09 3.64 3.32 3.11 3.00 2.93 2.90 2.86 2.86 20 .7 5.71 4.73 4.09 3.60 3.29 3.11 2.97 2.90 2.86 2.86 2.86 20 24 24 24 24 24 24 30 30 30 30 30 30 40 40 40 40 40 40 50 50 50 50 50 50 .9 .0 .1 .3 .5 .7 .9 .0 .1 .3 .5 .7 .9 .0 .1 .3 .5 .7 .9 .0 .1 .3 .5 .7 .9

5.71 4.73 4.09 5.57 4.66 4.02 5.57 4.66 4.02 5.57 4.66 4.02 5.57 4.66 4.02 5.57 4.66 4.02 5.57 4.66 4.02 5.50 4.59 3.95 5.50 4.59 3.95 5.50 4.59 3.95 5.50 4.59 3.95 5.50 4.59 3.95 5.50 4.59 3.95 5.43 4.52 3.88 5.43 4.52 3.88 5.43 4.52 3.88 5.43 4.52 3.88 5.43 4.52 3.88 5.43 4.52 3.88 5.36 4.45 3.85 5.36 4.45 3.85 5.36 4.45 3.85 5.36 4.45 3.85 5.36 4.45 3.81 5.36 4.45 3.81 3.57 3.25 3.04 3.60 3.29 3.07 3.60 3.29 3.07 3.60 3.29 3.07 3.57 3.25 3.07 3.53 3.25 3.04 3.53 3.18 2.97 3.53 3.21 3.04 3.53 3.21 3.04 3.53 3.21 3.04 3.50 3.21 3.00 3.46 3.18 2.97 3.46 3.11 2.90 3.46 3.14 2.97 3.46 3.14 2.97 3.46 3.14 2.97 3.46 3.14 2.97 3.43 3.11 2.93 3.39 3.04 2.86 3.39 3.11 2.93 3.39 3.11 2.93 3.39 3.11 2.93 3.39 3.11 2.93 3.39 3.07 2.90 3.36 3.04 2.83 --------------_ .• '""" ..... " ... ,.,,, ... _---- 2.90 2.97 2.97 2.97 2.93 2.93 2.86 2.90 2.90 2.90 2.90 2.86 2.83 2.86 2.86 2.86 2.83 2.83 2.76 2.83 2.83 2.83 2.79 2.79 2.72 2.86 2.86 2.90 2.83 2.90 2.83 2.90 2.83 2.86 2.83 2.86 2.83 2.83 2.79 2.83 2.79 2.83 2.79 2.83 2.79 2.83 2.79 2.79 2.76 2.76 2.76 2.79 2.76 2.79 2.76 2.79 2.76 2.76 2.72 2.76 2.72 2.72 2.72 2.76 2.72 2.76 2.72 2.76 2.72 2.76 2.72 2.72 2.69 2.69 2.69 2.83 2.83 2.83 2.83 2.83 2.83 2.83 2.83 2.83 2.79 2.83 2.79 2.79 2.79 2.76 2.76 2.76 2.76 2.76 2.76 2.76 2.76 2.76 2.76 2.76 2.76 2.72 2.72 2.72 2.72 2.72 2.72 2.72 2.72 2.72 2.72 2.69 2.69 2.69 2.69 2.69 2.69 2.69 2.69 2.69 2.69 2.69 2.69 2.69 2.69 DOE G 421 .1-1 8-25-99 (n-2) 4 4 4 4 4 4 6 6 6 6 6 6 8 8 8 8 8 8 10 10 10 10 10 10 12 12 12 12 12 12 14 14 14 14 14 14 .Lru. .0 .1 .3 .5 .7 .9 .0 .1 .3 .5 .7 .9 .0 .1 .3 .5 .7 .9 .0 .1 .3 .5 .7 .9 .0 .1 .3 .5 .7 .9 .0 .1 .3 .5 .7 .9 0.5 0.6 0.7 5.68 4.81 4.25 5.68 4.80 4.23 5.64 4.80 4.23 5.64 4.76 4.18 5.61 4.71 4.11 5.57 4.66 4.01 4.94 4.18 3.67 4.94 4.18 3.67 4.94 4.16 3.67 4.94 4.15 3.64 4.90 4.13 3.58 4.90 4.09 3.51 4.64 3.92 3.44 4.64 3.92 3.44 4.64 3.92 3.43 4.62 3.90 3.41 4.62 3.87 3.36 4.62 3.85 3.30 4.48 3.78 3.30 4.48 3.78 3.30 4.48 3.76 3.29 4.46 3.76 3.27 4.46 3.74 3.23 4.45 3.71 3.20 4.38 3.69 3.21 4.38 3.68 3.21 4.38 3.67 3.21 4.38 3.67 3.20 4.36 3.65 3.16 4.36 3.64 3.13 4.30 3.62 3.16 4.30 3.62 3.16 4.30 3.62 3.15 4.30 3.60 3.14 4.29 3.58 3.11 4.29 3.58 3.07 Table F.7.1 (cont.) (1 - V,) = 0.95 A 0.8 0.9 1.0 3.85 3.58 3.39 3.85 3.58 3.37 3.83 3.57 3.36 3.78 3.51 3.32 3.71 3.43 3.23 3.57 3.25 3.07 3.34 3.09 2.92 3.34 3.09 2.92 3.32 3.07 2.90 3.29 3.04 2.86 3.21 2.97 2.79 3.13 2.85 2.67 3.11 2.88 2.72 3.11 2.88 2.72 3.09 2.86 2.71 3.07 2.83 2.67 3.02 2.78 2.62 2.93 2.67 2.51 2.99 2.77 2.61 2.99 2.76 2.61 2.97 2.75 2.60 2.95 2.72 2.56 2.90 2.67 2.52 2.83 2.58 2.42 2.91 2.69 2.54 2.91 2.69 2.54 2.90 2.68 2.53 2.87 2.65 2.50 2.83 2.61 2.46 2.76 2.51 2.36 2.85 2.64 2.49 2.85 2.64 2.49 2.85 2.63 2.48 2.82 2.61 2.46 2.78 2.56 2.42 2.71 2.48 2.32 .L.1 3.23 3.23 3.21 3.16 3.09 2.95 2.79 2.79 2.78 2.74 2.69 2.57 2.60 2.60 2.59 2.56 2.51 2.42 2.49 2.49 2.49 2.46 2.42 2.33 2.43 2.43 2.42 2.40 2.35 2.27 2.39 2.39 2.38 2.35 2.32 2.23 1.2 3.13 3.13 3.11 3.07 3.00 2.88 2.71 2.71 2.69 2.65 2.60 2.51 2.52 2.52 2.51 2.48 2.44 2.36 2.42 2.42 2.41 2.39 2.34 2.27 2.35 2.35 2.34 2.33 2.29 2.22 2.31 2.31 2.30 2.28 2.25 2.19 1.3 3.04 3.04 3.04 2.99 2.93 2.83 2.63 2.63 2.62 2.60 2.55 2.48 2.46 2.46 2.45 2.42 2.39 2.34 2.36 2.36 2.35 2.34 2.30 2.25 2.30 2.30 2.29 2.27 2.25 2.20 2.26 2.26 2.25 2.23 2.20 2.16 187 1.4 1.5 2.99 2.93 2.99 2.93

2.97 2.91 2.93 2.90 2.88 2.86 2.81 2.79 2.58 2.55 2.58 2.55 2.57 2.55 2.55 2.53 2.51 2.49 2.46 2.46 2.42 2.39 2.42 2.39 2.41 2.38 2.39 2.36 2.36 2.34 2.32 2.31 2.32 2.29 2.32 2.29 2.32 2.28 2.30 2.27 2.27 2.26 2.24 2.23 2.27 2.24 2.27 2.24 2.26 2.23 2.24 2.22 2.22 2.20 2.19 2.19 2.22 2.20 2.22 2.20 2.21 2.20 2.20 2.18 2.18 2.17 2.15 2.15 188 (n-2) 16 16 16 16 16 16 20 20 20 20 20 20 24 24 24 24 24 24 30 30 30 30 30 30 40 40 40 40 40 40 50 50 50 50 50 50 JQL .0 .1 .3 .5 .7 .9 .0 .1 .3 .5 .7 .9 .0 .1 .3 .5 .7 .9 .0 .1 .3 .5 .7 .9 .0 .1 .3 .5 .7 .9 .0 .1 .3 .5 .7 .9 0.5 0.6 0.7 4.25 3.57 3.13 4.25 3.57 3.12 4.25 3.57 3.11 4.25 3.56 3.09 4.23 3.55 3.07 4.23 3.53 3.04 4.18 3.51 3.07 4.18 3.51 3.06 4.18 3.50 3.06 4.18 3.50 3.04 4.16 3.49 3.02 4.16 3.48 2.99 4.13 3.47 3.02 4.13 3.47 3.02 4.13 3.46 3.02 4.13 3.46 3.00 4.13 3.44 2.99 4.13 3.44 2.95 4.09 3.43 2.99 4.09 3.43 2.99 4.09 3.43 2.99 4.09 3.43 2.97 4.09 3.41 2.95 4.08 3.41 2.92 4.04 3.39 2.95 4.04 3.39 2.95 4.04 3.39 2.95 4.04 3.38 2.93 4.04 3.37 2.92 4.04 3.37 2.89 4.02 3.37 2.93 4.02 3.37 2.93 4.02 3.36 2.92 4.02 3.36 2.92 4.02 3.36 2.90 4.02 3.35 2.87 Table F.7.1 (cant.) (1 - V,) = 0.95 (cant.) A 0.8 0.9 1.0 2.81 2.61 2.46 2.81 2.60 2.46 2.80 2.59 2.45 2.78 2.57 2.42 2.75 2.53 2.38 2.69 2.44 2.29 2.76 2.56 2.42 2.76 2.56 2.41 2.75 2.55 2.40 2.73 2.52 2.38 2.70 2.49 2.34 2.63 2.41 2.26 2.72 2.52 2.38 2.72 2.52 2.38 2.72 2.51 2.37 2.71 2.49 2.35 2.67 2.45 2.31 2.61 2.37 2.23 2.70 2.49 2.35 2.70 2.49 2.35 2.69 2.49 2.34 2.67 2.46 2.32 2.63 2.42 2.28 2.58 2.34 2.20 2.66 2.46 2.32 2.66 2.46 2.32 2.65 2.45 2.31 2.63 2.43 2.29 2.61 2.40 2.26 2.55 2.32 2.18 2.64 2.44 2.30 2.64 2.44 2.30 2.63 2.43 2.29 2.62 2.42 2.27 2.59 2.38 2.24 2.54 2.31 2.16 L1 1.2 1.3 2.35 2.28 2.23 2.35 2.28 2.23 2.34 2.27 2.22 2.32 2.26 2.20 2.28 2.22 2.18 2.20 2.16 2.13 2.31 2.24 2.19 2.31 2.24 2.19 2.30 2.23 2.18 2.28 2.21 2.17 2.24 2.18 2.14 2.17 2.13 2.10 2.28 2.21 2.16 2.28 2.20 2.16 2.27 2.20 2.15 2.25 2.19 2.14 2.21 2.15 2.12 2.14 2.10 2.08 2.25 2.18 2.13 2.25 2.18 2.13 2.24 2.18 2.13 2.22 2.16 2.12 2.19 2.13 2.09 2.12 2.07 2.05 2.22 2.15 2.11 2.22 2.15 2.11 2.21 2.15 2.10 2.20 2.13 2.09 2.16 2.11 2.07 2.10 2.05 2.04 2.20 2.14 2.09 2.20 2.14 2.09 2.20 2.13 2.09 2.18 2.12 2.07 2.15 2.09 2.05 2.08 2.04 2.02 DOE G 421.1-1 8-25-99 1.4 2.20 2.20 2.19 2.18 2.15 2.13 2.15 2.15 2.14 2.13 2.12 2.09 2.13 2.13 2.12 2.11 2.09 2.07 2.10 2.10 2.10 2.09 2.07 2.05 2.07 2.07 2.07 2.06 2.05 2.03 2.06 2.06 2.05 2.05 2.03 2.01 1.5 2.17 2.17 2.16 2.15 2.14 2.13 2.13 2.13 2.13 2.12 2.11 2.09 2.11 2.10 2.10 2.09 2.08 2.06 2.08 2.08 2.07 2.06 2.05 2.05 2.05 2.05 2.05 2.05 2.04 2.02 2.04 2.04 2.04 2.03 2.02 2.01 DOE G 421.1-1 8-25-99 {n-21 4 4 4 4 4 4 6 6 6 6 6 6 8 8 8 8 8 8 10 10 10 10 10 10 12 12 12 12 12 12 14 14 14 14 14 14 Table F. 7.1 (cont.) (1 - VI) = 0.90 A .Lru. 0.5 0.6 0.7 0.8 0.9 1.0 .0 4.38 3.74 3.32 3.03 2.82 2.66 .1 4.38 3.74 3.32 3.02 2.81 2.66 .3 4.38 3.72 3.30 3.00 2.79 2.64 .5 4.34 3.69 3.26 2.96 2.75 2.60 .7 4.30 3.64 3.20 2.89 2.67 2.52 .9 4.27 3.58 3.09 2.76 2.53 2.38 .0 3.95 3.37 2.99 2.71 2.52 2.38 .1 3.95 3.37 2.98 2.71 2.52 2.38 .3 3.94 3.36 2.97 2.70 2.50 2.37 .5 3.94 3.33 2.93 2.66 2.47 2.33 .7 3.91 3.29 2.88 2.60 2.41 2.27 .9 3.88 3.25 2.80 2.49 2.29 2.15 .0 3.77 3.21 2.83 2.57 2.40 2.26 .1 3.77 3.21 2.83 2.57 2.39 2.26 .3 3.76 3.19 2.82 2.56 2.38 2.25 .5 3.75 3.17 2.79 2.53 2.34 2.21 .7 3.73 3.14 2.74 2.48 2.29 2.16 .9 3.72 3.11 2.68 2.38 2.18 2.05

.0 3.66 3.11 2.75 2.50 2.32 2.20 .1 3.66 3.11 2.75 2.49 2.32 2.19 .3 3.65 3.10 2.73 2.49 2.31 2.18 .5 3.65 3.08 2.71 2.45 2.27 2.15 .7 3.64 3.06 2.67 2.41 2.22 2.10 .9 3.63 3.02 2.61 2.32 2.13 2.00 .0 3.60 3.05 2.69 2.45 2.27 2.15 .1 3.60 3.05 2.69 2.45 2.27 2.15 .3 3.59 3.04 2.68 2.43 2.26 2.13 .5 3.58 3.02 2.66 2.41 2.23 2.11 .7 3.58 3.00 2.62 2.36 2.18 2.06 .9 3.57 2.98 2.56 2.27 2.09 1.96 .0 3.55 3.01 2.65 2.42 2.24 2.12 .1 3.55 3.01 2.65 2.41 2.24 2.12 .3 3.55 3.00 2.64 2.40 2.23 2.10 .5 3.54 2.99 2.62 2.37 2.20 2.08 .7 3.53 2.96 2.58 2.33 2.15 2.03 .9 3.52 2.94 2.53 2.25 2.06 1.94 189 L.1 1.2 1.3 1.4 1.5 2.55 2.46 2.39 2.34 2.30 2.55 2.46 2.39 2.34 2.30 2.53 2.44 2.37 2.32 2.28 2.49 2.41 2.34 2.29 2.26 2.42 2.34 2.28 2.25 2.21 2.28 2.23 2.19 2.17 2.16 2.28 2.20 2.14 2.10 2.06 2.28 2.20 2.14 2.10 2.06 2.27 2.19 2.13 2.09 2.05 2.23 2.16 2.10 2.06 2.03 2.18 2.11 2.06 2.02 2.00 2.07 2.02 1.98 1.97 1.96 2.16 2.09 2.04 1.99 1.96 2.16 2.09 2.03 1.99 1.96 2.15 2.08 2.02 1.98 1.95 2.12 2.05 2.00 1.96 1.93 2.07 2.00 1.96 1.93 1.91 1.97 1.92 1.90 1.88 1.87 2.10 2.03 1.98 1.93 1.90 2.10 2.02 1.97 1.93 1.90 2.09 2.02 1.96 1.92 1.89 2.05 1.99 1.94 1.91 1.88 2.01 1.95 1.91 1.87 1.85 1.92 1.87 1.84 1.83 1.82 2.05 1.98 1.93 1.90 1.87 2.05 1.98 1.93 1.89 1.86 2.04 1.98 1.92 1.88 1.86 2.02 1.95 1.90 1.87 1.84 1.97 1.91 1.87 1.84 1.82 1.88 1.83 1.81 1.80 1.79 2.03 1.96 1.91 1.87 1.84 2.02 1.96 1.91 1.87 1.84 2.02 1.94 1.90 1.86 1.83 1.99 1.92 1.87 1.84 1.82 1.941.881.841.811.80 1.861.811.791.771.77 190 (n-21 16 16 16 16 16 16 20 20 20 20 20 20 24 24 24 24 24 24 30 30 30 30 30 30 40 40 40 40 40 40 50 50 50 50 50 50 .Lru. 0.5 0.6 .0 3.51 2.98 .1 3.51 2.98 .3 3.51 2.97 .5 3.50 2.96 .7 3.50 2.93 .9 3.50 2.92 .0 3.47 2.94 .1 3.47 2.93 .3 3.47 2.93 .5 3.46 2.92 .7 3.45 2.90 .9 3.45 2.88 .0 3.44 2.91 .1 3.44 2.91 .3 3.43 2.90 .5 3.43 2.89 .7 3.43 2.87 .9 3.43 2.85 .0 3.41 2.88 .1 3.41 2.88 .3 3.41 2.88 .5 3.40 2.86 .7 3.40 2.85 .9 3.39 2.83 .0 3.38 2.85 .1 3.38 2.85 .3 3.38 2.85 .5 3.37 2.84 .7 3.37 2.82 .9 3.36 2.81 .0 3.36 2.85 .1 3.36 2.84 .3 3.36 2.84 .5 3.36 2.83 .7 3.36 2.81 .9 3.36 2.79 Table F. 7.1 (cont.) (1 - VI) = 0.90 (cont.) A 0.7 0.8 0.9 2.63 2.39 2.22 2.63 2.39 2.22 2.62 2.38 2.20 2.59 2.35 2.18 2.56 2.31 2.13 2.51 2.23 2.04 2.59 2.35 2.19 2.59 2.35 2.19 2.58 2.34 2.17 2.56 2.31 2.15 2.52 2.27 2.10 2.48 2.20 2.01 2.56 2.33 2.16 2.56 2.33 2.16 2.56 2.32 2.15 2.53 2.29 2.13 2.50 2.25 2.08 2.46 2.18 1.99 2.54 2.31 2.14 2.54 2.31 2.14 2.53 2.30 2.13 2.51 2.27 2.11 2.48 2.23 2.06 2.43 2.16 1.98 2.52 2.28 2.13 2.52 2.28 2.12 2.51 2.27 2.11 2.49 2.25 2.09 2.46 2.21 2.05 2.42 2.14 1.96 2.50 2.27 2.11 2.50 2.27 2.11 2.49 2.26 2.10 2.48 2.24 2.08 2.45 2.20 2.03 2.41 2.13 1.95 1.0 2.09 2.09 2.08 2.05 2.01 1.92 2.06 2.06 2.05 2.03 1.98 1.89 2.05 2.05 2.03 2.01 1.96 1.87 2.02 2.02 2.01 1.99 1.94 1.86 2.01 2.01 1.99 1.97 1.93 1.84 1.99 1.99 1.98 1.96 1.92 1.83 .:u 2.01 2.00 1.99 1.97 1.92 1.84 1.98 1.98 1.96 1.94 1.90 1.82 1.96 1.95 1.94 1.92 1.88 1.80 1.94 1.94 1.93 1.91 1.87 1.79 1.92 1.92 1.91 1.89 1.85 1.77 1.91 1.91 1.90 1.87 1.84 1.76 1.2 1.94 1.94 1.93 1.91 1.87 1.80 1.91 1.91 1.90 1.88 1.84 1.77 1.89 1.89 1.88 1.86 1.82 1.76 1.87 1.87 1.86 1.84 1.81 1.74 1.85 1.85 1.84 1.83 1.79 1.73 1.84 1.84 1.83 1.81 1.78 1.72 1.3 1.89 1.88 1.87 1.86 1.83 1.77 1.86 1.86 1.85 1.83 1.80 1.75 1.84 1.84 1.83 1.81 1.78 1.73 1.82 1.82 1.81 1.80 1.77 1.72 1.80 1.80 1.80 1.78 1.75 1.70 1.80 1.80 1.79 1.77 1.74 1.69

DOE G 421.1-1 8-25-99 1.4 1.85 1.85 1.84 1.82 1.80 1.76 1.82 1.82 1.81 1.80 1.77 1.73 1.80 1.80 1.80 1.78 1.76 1.72 1.79 1.79 1.78 1.76 1.74 1.71 1.77 1.77 1.76 1.75 1.73 1.69 1.76 1.76 1.75 1.74 1.72 1.69 1.5 1.82 1.82 1.81 1.80 1.78 1.75 1.80 1.79 1.79 1.77 1.76 1.71 1.78 1.78 1.77 1.76 1.74 1.72 1.76 1.76 1.75 1.74 1.73 1.70 1.74 1.74 1.74 1.73 1.71 1.69 1.73 1.73 1.73 1.72 1.70 1.68 DOE G 421.1-1 8-25-99 191 w > t> w u.. u.. W I ~ I I I T r .1kt> CALCULATIONAL BIAS ______ ~~): ~2. ~bj: ___ - 1.00 1--1-----_------...-.o-"'!!!-!"'S"!---=-=,.;;;,,;;;;;..-.----------i -------r- FUTURE SINGLE CALCULATION CULATION CONFIDENCE BAND ENCE FOR A SING}-,§ f~T~~'§. 2~~ - - - - -_ + _____ J::.tlLC.9~~I~ -- - -- - - -- MARGIN OF SUBCRITICALITY - I I a i USL • k (x) - CSp RANGE OF APPLICABILITY - I I b Figure F. 7.1. Typical results for the single-sided, uniform-width, closed-interval, L TB technique. 192 DOE G 421 .1-1 8-25-99 As an example of this technique, assume that 29 critical experiments have been modeled and calculated. The calculated keff, standard deviation, and average energy group causing fission (the independent variable, x) are shown in Table F.7.2. Table F.7.2. Input Data for Example Problem keff 0 AEG 0.99647 0.00337 14.82 0.99776 0.00326 14.81 1.00764 0.00311 14.83 0.99587 0.00365 14.44 0.99744 0.00327 14.28 1.00337 0.00335 14.84 0.99609 0.00395 14.73 1.00108 0.00378 15.08 0.99737 0.00325 15.20 0.98408 0.00342 15.31 0.98871 0.00361 15.26 0.99527 0.00292 15.50 0.98804 0.00273 15.49 1.01363 0.00401 14.36 1.01660 0.00445 14.36 1.00874 0.00485 14.36 1.01190 0.00479 14.38 1.00980 0.00498 14.35 1.00565 0.00397 14.10 1.01929 0.00407 14.12 1.00860 0.00411 14.10 0.99487 0.00462 15.04 0.99257 0.00382 14.90 1.00132 0.00450 14.90 0.99154 0.00420 14.90 1.00028 0.00374 15.43 0.99565 0.00413 15.44 0.98574 0.00415 15.43 0.98733 0.00416 15.43 Table F. 7.3 summarizes the various terms calculated to establish the USL and margin of subcriticality, with p = 0.999 and a = 0.95. From these results, the USL is defined by the straight line USL = 1 .1900 - 0.0153 x, and is statistically valid only between the range of AEG from 14.10 to 15.50. Any calculated keff + 20 that is below the USL is adequately subcritical, with a margin of subcriticality of at least 0.02. DOEG421.1-1 8-25-99 193 Table F. 7 .3. Calculated Terms for Example Problem n linear regression, k(x) minimum value of x, a maximum value of x, b average x (AEG), X - average keff, k 2 variance of fit, sk.;x 2 within variance, Sw 2 pooled variance, S p pooled standard deviation, sp Zp @ p = 0.999 x2 @ (n-2), (1-Y2) g h P A D C· C OSp LTB = USL student-t @ (n- 2) (1-y,) W (max. at x=a and x=b) minimum margin of subcriticality, Co sp-w "Read as 3.8260 x 10-5 • = 29 1.2266 - 0.015295 x 14.10 15.50 14.8341 = 0.99975 = 3.8260-05" = 1.5304-05 = 5.3564-05 = 7.3187-03 = 3.090 = 14.57 = 0.3497 = 0.3266 = -0.3951 = 1.0705 = 2.274 (interpolated from Table C-1) = 0.79525 = 4.9973 = 0.0366 = 1.1900 - 0.015295 x = 1.703 = 0.0132 = 0.0234 Figure F. 7.2 provides a plot of the resultant single-sided, uniform-width, closed-interval, lower tolerance band technique developed from the example. There may be valid reasons to reduce the USL. There are many factors that may both change the AEG and affect other parameters as well in a multiplying manner. For example, suppose very low temperatures cannot be ruled out for the application in question. Low temperatures will increase the AEG and can also increase density. Therefore cold increases reactivity by increasing density, may change the AEG to be outside the range of applicability of critical experiments, and decreases the margin of safety.

194 1.01 1.0 0.99 a = 14.10 DOEG421.1-1 8-25-99 b= 15.50 keff 0.98 0.97 0.96 0.95 ~-4----~------~------~------~--------L-____ ~ 14.00 14.25 14.50 14.75 15.00 15.25 15.50 AVERAGE ENERGY GROUP CAUSING FISSION (AEG) Figure F. 7 .2. Example results for the single-sided, uniform-width, closed-interval, L TB technique. DOE G 421.1-1 8-25-99 195 APPENDIX G. BIBLIOGRAPHY OF JOURNAL ARTICLES AND MEETING AND CONFERENCE PROCEEDINGS In the bibliography that follows, "JA" designates a refereed journal article (except for G-JA002 and G-JA 170)' "PA" designates a proceedings article, "P" designates complete proceedings for which individual article listings have been omitted in this bibliography, and "EBE" designates the unique document set of evaluated benchmark experiments. The "JA," "PA," "P," and "EBE" groupings follow in succession. Items are listed chronologically within each "JA," "PA," and "P" grouping. Except for G-JA001, G-JA002, and G-JA 170, all refereed journal articles can be found in either Nuclear Science and Engineering or Nuclear Technology (formerly Nuclear Applications or Nuclear Applications Technology). G-JA001. Gerald Goertzel, "Minimum Critical Mass and Flat Flux," J. Nucl. Energy, 2,193 (1956). G-JA002. Dixon Callihan, "Homogeneous Critical Assemblies," Progress in Nuclear Energy, Series I, Physics and Mathematics (ed. R.A. Charpie, J. Horowitz, D.J. Hughes, and D.J. Littler), p. 227, McGraw-Hili, New York (1956). G-JA003. Roger H. White, "Topsy, A Remotely Controlled Critical Assembly Machine," Nucl. Sci. Eng., 1, 53 (Mar. 1956). G-JA004. R.E. Peterson and G.A. Newby, "An Unreflected U-235 Critical Assembly," Nucl. Sci. Eng., 1, 112 (May 1956). G-JA005. Richard N. Olcott, "Homogeneous Heavy Water Moderated Critical Assemblies. Part 1. Experimental," Nucl. Sci. Eng., 1, 327 (Aug. 1956). G-JA006. John D. Orndoff, "Prompt Neutron Periods of Metal Critical Assemblies," Nucl. Sci. Eng., 2, 450 (Jul. 1957). G-JA007. J.K. Fox, L.W. Gilley, and J.H. Marable, "Critical Parameters of a Proton-Moderated and Proton-Reflected Slab of U236," Nucl. Sci. Eng., 3, 694 (Jun. 1958). G-JA008. A. Sauer, "Optimum Control and Flat Flux," Nucl. Sci. Eng., 5, 71 (Jan. 1959). G-JA009. J. Devooght, "Restricted Minimum Critical Mass," Nucl. Sci. Eng., 5, 190 (Mar. 1959). G-JA010. W. Goad and R. Johnston, "A Monte Carlo Method for Criticality Problems," Nucl. Sci. Eng., 5, 371 (Jun. 1959). G-JA011. Norman Ketzlach, "Nuclear Safety of Iron-Encased Fuel Elements," Nucl. Sci. Eng., 6, 187 (Sep. 1959). G-JA012. J. Ernest Wilkins, Jr., "Minimum Total Mass," Nucl. Sci. Eng., 6, 229 (Sep. 1959). 196 DOE G 421.1-1 8-25-99 G-JA013. G.A. Linenberger, J.D. Orndoff, and H.C. Paxton, "Enriched-Uranium Hydride Critical Assemblies," Nucl. Sci. Eng., 7, 44 (Jan. 1960). G-JA014. G.A. Jarvis, G.A. Linenberger, J.D. Orndoff, and H.C. Paxton, "Two Plutonium-Metal Critical Assemblies," Nucl. Sci. Eng., 8, 525 (Dec. 1960). G-JA015. L.B. Engle, G.E. Hansen, and H.C. Paxton, "Reactivity Contributions of Various Materials in Topsy," Nucl. Sci. Eng., 8, 543 (Dec. 1960). G-JA016. G.E. Hansen, H.C. Paxton, and D.P. Wood, "Critical Plutonium and Enriched-Uranium­ Metal Cylinders of Extreme Shape," Nucl. Sci. Eng., 8, 570 (Dec. 1960). G-JA017. D.P. Wood, C.C. Byers, and L.C. Osborn, "Critical Masses of Cylinders of Plutonium Diluted with Other Metals," Nucl. Sci. Eng., 8, 578 (Dec. 1960).

G-JA018. G.E. Hansen, D.P. Wood, and W.U. Geer, "Critical Masses of Enriched- Uranium Cylinders with Multiple Reflectors of Medium-Z Elements," Nucl. Sci. Eng., 8, 588 (Dec. 1960). G-JA019. Leona Stewart, "Leakage Neutron Spectrum from a Bare PU239 Critical Assembly," Nucl. Sci. Eng., 8, 595 (Dec. 1960). G-JA020. E.A. Plassmann and D.P. Wood, "Critical Reflector Thicknesses of Spherical U233 and PU239 Systems," Nucl. Sci. Eng., 8, 615 (Dec. 1960). G-JA021. C.B. Mills, "Minimum Critical Dimensions for Water Solutions," Nucl. Sci. Eng., 9, 377 (Mar. 1961). G-JA022. Mathew M. Shapiro, "Minimum Critical Mass in Variable Density and Epithermal Reactors," Nucl. Sci. Eng., 10, 159 (Jun. 1961). G-JA023. John Mihalczo and C.B. Mills, "Criticality of Low Enrichment U235 in Hydrogen," Nucl. Sci. Eng., 11, 95 (Sep. 1961). G-JA024. J.R. Knight, "Calculation of the Neutron Leakage Spectra and Neutron Doses from Bare Critical Systems," Nucl. Sci. Eng., 11, 239 (Nov. 1961). G-JA025. C.B. Mills and G.I. Bell, "Criticality of Low Enrichment Uranium in Hydrogen," Nucl. Sci. Eng., 12,469 (Apr. 1962). G-JA026. Hugh K. Clark, "Interaction of Fissionable Units," Nucl. Sci. Eng., 15, 20 (Jan. 1963). G-JA027. W.B. Rogers, Jr. and F.E. Kinard, "Material Buckling and Critical Masses of Uranium Rods Containing 3 wt %U235 in H20," Nucl. Sci. Eng., 20, 266 (Nov. 1964). G-JA028. C.R. Richey, R.C. Lloyd, and E.D. Clayton, "Criticality of Slightly Enriched Uranium in Water-Moderated Lattices," Nucl. Sci. Eng., 21, 217 (Feb. 1965). G-JA029. C.R. Richey, J.D. White, E.D. Clayton, and R.C. Lloyd, "Criticality of Homogeneous Plutonium Oxide-Plastic Compacts at H:Pu=15," Nucl. Sci. Eng., 23,150 (Oct. 1965). DOE G 421.1-1 8-25-99 197 G-JA030. H.K. Clark, "Effect of Distribution of Fissile Material on Critical Mass," Nucl. Sci. Eng., 24, 133 (Feb. 1966). G-JA031. R.C. Lloyd, C.R. Richey, E.D. Clayton, and D.R. Skeen, "Criticality Studies with Plutonium Solutions," Nucl. Sci. Eng., 25, 165 (Jun. 1966). G-JA032. Dale E. Hankins, "Effect of Reactivity Addition Rate and of Weak Neutron Source on the Fission Yield of Uranium Solutions," Nucl. Sci. Eng., 26, 110 (Sep. 1966). G-JA033. L.E. Hansen and E.D. Clayton, "Criticality of Plutonium Compounds in the Undermoderated Range, H:Pu ~ 20," Nucl. Appl., 3, 481 (Aug. 1967). G-JA034. Carroll B. Mills, "Low Critical Mass," Nucl. Appl., 4,17 (Jan. 1968). G-JA035. C.R. Richey, "Theoretical Analyses of Homogeneous Plutonium Critical Experiments," Nucl. Sci. Eng., 31, 32 (Jan. 1968), G-JA036. C.R. Richey, "Criticality of Heterogeneous Arrays Undergoing Dissolution," Nucl. Sci. Eng., 31, 40 (Jan. 1968). G-JA037. Thomas Gutman, "A Surface Density Evaluation of Critical Array Data," Nucl. Appl., 4, 121 (Feb. 1968). G-JA038. R.C. Lloyd, E.D. Clayton, and J.H. Chalmers, "Criticality of Arrays of Z33U Solution," Nucl. Appl.,4, 136 (Mar. 1968). G-JA039. J. Wallace Webster, "Minimum Thickness of a Water-Reflected Infinite Slab of an Aqueous Solution of 235UOzFz at Optimum Concentration," Nucl. Sci. Eng., 32, 133 (Apr. 1968). G-JA040. S.R. Bierman and G.M. Hess, "Minimum Critical 235U Enrichment of Homogeneous, Hydrogenous Uranyl Nitrate Systems," Nucl. Sci. Eng., 32, 135 (Apr. 1968). G-JA041. C.G. Chezem and E.J. Lozito, "Investigation of the Criticality of Low-Enrichment Uranium Cylinders," Nucl. Sci. Eng., 33, 139 (JuJ. 1968). G-JA042. R.C. Kispert, et al., "Crystallization Characteristics of Acidic Uranyl Nitrate Solutions," Nucl. Appl., 5, 224 (Oct. 19681.

G-JA043. S.R. Bierman, L.E. Hansen, R.C. Lloyd, and E.D. Clayton, "Critical Experiments with Homogeneous PuOz-Polystyrene at 5H/Pu," Nuc/. Appl., 6, 23 (Jan. 1969). G-JA044. Robert E. Rothe, "Critical Measurements on an Enriched Uranium Solution System," Nucl. Sci. Eng., 35,267 (Feb. 1969). G-JA045. L.E. Hansen, E.D. Clayton, R.C. Lloyd, and S.R. Bierman, "Critical Parameters of Plutonium Systems. Part I: Analysis of Experiments," Nucl. Appl., 6, 371 (Apr. 1969). G-JA046. L.E. Hansen and E.D. Clayton, "Critical Parameters of Plutonium Systems. Part II: Interpretation," Nucl. Appl., 6,381 (Apr. 1969). 198 DOE G 421.1-1 8-25-99 G-JA047. David R. Smith and William U. Geer, "Critical Mass of a Water-Reflected Plutonium Sphere," Nucl. Appl. Technol., 7, 405 (Nov. 1969). G-JA048. Robert E. Rothe, C.L. Schuske, and E.E. Hicks, "The Criticality of a Uranium-Solution Slab Under Various Reflector Conditions," Nucl. Appl. Technol., 7, 505 (Dec. 1969). G-JA049. William Bradley Lewis, "A Practical Approach to Nuclear Critical Safety," Nucl. Appl. Technol., 7, 523 (Dec. 1969). G-JAOSO. Donald C. Coonfield, Grover Tuck, Harold E. Clark, and Bruce B. Ernst, "Critical Mass Irregularity of Steel-Moderated Enriched Uranium Metal Assemblies with Composite Steel-Oil Reflectors," Nucl. Sci. Eng., 39, 320 (Mar. 1970). G-JAOS1. Grover Tuck and Harold E. Clark, "Critical Parameters of a Uranium Solution Slab-Cylinder System," Nucl. Sci. Eng., 40, 407 (Jun. 1970). G-JAOS2. Richard A. Wolfe, "The Nuclear Criticality Safety Aspects of Plutonium-238," Nucl. Appl. Techno/., 9, 218 (Aug. 1970). G-JAOS3. Harold E. Clark and Grover Tuck, "An Empirical Formula which Predicts the Critical Parameters of a Planar Array of Uranium-Solution-Filled Cylinders," Nucl. Appl. Technol., 9, 814 (Dec. 1970). G-JAOS4. Deanne Dickinson and C.L. Schuske, "An Empirical Model for Safe Pipe Intersections for Containing Fissile Solution," Nuc/. Technol., 10, 179 (Feb. 1971). G-JAOSS. S.R. Bierman and E.D. Clayton, "Critical Experiments with Unmoderated Plutonium Oxide," Nucl. Technol., 11, 185 (Jun. 1971). G-JAOS6. D.C. Hunt and Robert E. Rothe, "Criticality Measurements on Uranium Metal Spheres Immersed in Uranium Solution," Nucl. Sci. Eng., 46, 76 (Oct. 1971). G-JAOS7. Thomas Gutman, "Anomalies in the Analysis of Air-Spaced Arrays," Nucl. Technol., 12, 162 (Oct. 1971). G-JAOS8. William Bradley Lewis, "A Practical Approach to Nuclear Critical Safety II -- Critique of a Model," Nucl. Technol., 12, 276 (Nov. 1971). G-JAOS9. R.L. Currie, P.B. Parks, and J.L. Jarriel, "Static and Pulsed Reactivity Measurements on Large Uranium-235 Fuel Forms in Water," Nucl. Technol., 12, 356 (Dec. 1971). G-JA060. S.J. Altschuler and C.L. Schuske, "Models for the Safe Storage of Fissile Metal," Nucl. Technol., 13,131 (Feb. 1972). G-JA061. Harold E. Clark and Grover Tuck, "An Empirical Formula that Predicts the Critical Parameters of a Uranium Solution Slab-Cylinder System," Nucl. Technol., 13, 257 (Mar. 1972). G-JA062. G.R. Handley, "Some Effects of Water Sprinklers on Array Criticality Safety Analyses," Nucl. Techno/., 13,71 (Apr. 1972). DOE G 421 .1-1 8-25-99 199 G-JA063. R.C. Lloyd, E.D. Clayton, and L.E. Hansen, "Criticality of Plutonium Nitrate Solution Containing Soluble Gadolinium," Nucl. Sci. Eng., 48,300 (Jul. 1972). G-JA064. S.R. Bierman and E.D. Clayton, "Critical Experiments with Homogeneous PuOz- Polystyrene at 50 H/Pu," Nucl. Technol., 15,5 (Jul. 1972).

G-JA065. S.J. Raffety, "Homogeneous Critical Assemblies of 2 and 3% Uranium-235-Enriched Uranium in Paraffin," Nucl. Sci. Eng., 48, 433 (Aug. 1972). G-JA066. J.T. Mihalczo, "Criticality of Graphite- and Polyethylene-Reflected Uranium (93.2%)-Metal Cylinders and Annuli," Nucl. Sci. Eng., 49, 489 (Dec. 1972). G-JA067. C.L. Schuske and D.C. Hunt, "A Storage Container for Fissile Materials," Nucl. Technol., 16, 562 (Dec. 1972). G-JA068. S.R. Bierman, E.D. Clayton, and L.E. Hansen, "Critical Experiments with Homogeneous Mixtures of Plutonium and Uranium Oxides Containing 8, 15, and 30 wt% Plutonium," Nucl. Sci. Eng., 50, 115 (Feb. 1973). G-JA069. R.C. Lloyd, S.R. Bierman and E.D. Clayton, "Criticality of Plutonium Nitrate Solutions Containing Borated Raschig Rings," Nucl. Sci. Eng., 50, 127 (Feb. 1973). G-JA070. S.J. Altschuler and C.L. Schuske, "A Model for the Safe Storage of Fissile Solutions," Nucl. Technol., 17, 110 (Feb. 1973). G-JA071. S.J. Altschuler and C.L. Schuske, "A Study of Criticality Parameters Affecting the Handling and Storage of Fissile Metal," Nucl. Technol., 18, 55 (Apr. 1973). G-JA072. C.L. Brown, L.C. Davenport, and D.P. Oden, "Plutonium Fuel Technology Part III: Nuclear Criticality Safety Considerations in LWR (Pu,U)Oz Fuel Fabrication," Nucl. Technol., 18, 109 (May 1973). G-JA073. Grover Tuck, Harold E. Clark, and Donald L. Alvarez, "Enriched Uranium Metal-Solution Systems Separated by Neutron Poisons," Nucl. Technol., 18, 216 (Jun. 1973). G-JA074. R.C. Lloyd, E.D. Clayton, L.E. Hansen, and S.R. Bierman, "Criticality of Plutonium Nitrate Solutions in Slab Geometry," Nucl. Technol., 18, 225 (Jun. 1973). G-JA075. C.L. Schuske and S.J. Altschuler, "A Storage Vessel for Fissile Solutions," Nucl. Techno/., 18,305 (Jun. 1973). G-JA076. Ricardo Artigas, "Criticality Safety Evaluation of a Shipping Container for Moderated Low­ Enriched Uranium Compounds," Nuc/. Technol., 19, 16 (Jul. 1973). G-JA077. C.L. Schuske and S.J. Altschuler, "Models for the Safe Storage of Dry and Wet Fissile Oxides," Nucl. Technol., 19,84 (Aug. 1973). G-JA078. R.C. Lloyd and E.D. Clayton, "The Criticality of High Burnup Plutonium," Nucl. Sci. Eng., 52,73 (Sep. 1973). 200 DOE G 421.1-1 8-25-99 G-JA079. J.T. Thomas, "Critical Three-Dimensional Arrays of U(93.2)-Metal Cylinders," Nucl. Sci. Eng., 52, 350 (Nov. 1973). G-JA080. E.D. Clayton, "Fissionability and Criticality: From Protactinium to Californium and Beyond," Nucl. Sci. Eng., 52, 417 (Nov. 1973). G-JA081. C.L. Schuske and S.J. Altschuler, "Storage Capacity for Fissile Material as a Function of Facility Size," Nucl. Technol., 20, 179 (Dec. 1973). G-JA082. D.C. Hunt and Robert E. Rothe, "A Criticality Study of Fissile-Metal and Fissile-Solution Combinations," Nuc/. Sci. Eng., 53, 79 (Jan. 1974). G-JA083. D.C. Hunt and C.L. Schuske, "Minimum Critical Masses of Arrays of Fissile Oxide and Metal Elements in Water," Nucl. Technol., 22,263 (May 1974). G-JA084. Robert E. Rothe and D.C. Hunt, "The Effect of Position on the Criticality of Uranium Spheres in Uranium Solution Cylinders," Nucl. Sci. Eng., 54, 360 (Jul. 1974). G-JA085. D. Dickinson, "Calculations on Raschig-Ring-Poisoned Plutonium Solution Systems Using Hansen-Roach Cross Sections," Nucl. Sci. Eng., 54, 367 (Jul. 1974). G-JA086. E.D. Clayton, "Anomalies of Criticality," Nucl. Technol., 23,14 (Jul. 1974). G-JA087. C.L. Schuske, D. Dickinson, and S.J. Altschuler, "Surface Density Method Employing Unit Shape Factor (s/v) for the Storage of Fissile Materials," Nucl. Technol., 23, 157 (Aug. 1974). G-JA088. Grover Tuck, "Simplified Methods of Estimating the Results of Accidental Solution Excursions," Nucl. Techno/., 23,177 (Aug. 1974). G-JA089. R.C. Lloyd, S.R. Bierman, and E.D. Clayton, "Criticality of Plutonium-Uranium Mixtures Containing 5 to 8 wt