DOE G 421.1-1, Criticality Safety Good Practices Program Guide for DOE Nonreactor Nuclear Facilities

NOT MEASUREMENT SENSITIVE DOE G 421 .1-1 DOE GOOD PRACTICES GUIDE CRITICALITY SAFETY GOOD PRACTICES PROGRAM GUIDE FOR DOE NONREACTOR NUCLEAR FACILITIES u.s. Department of Energy Washington, D.C. 20585 DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. This document has been reproduced directly from the best available copy. Available to DOE and DOE contractors from the Office of Scientific and Technical Information, P.O. Box 62, Oak Ridge, TN 37831; (615) 576-8401. Available to the public from the U.S. Department of Commerce, Technology Administration, National Technical Information Service, Springfield, VA 22161; (703) 487-4650. Order No. xxxxxxxxxx DOE G 421.1-1 8-25-99 FOREWORD iii This DOE Good Practices Program Guide is approved for use by all Departments and Contractors of the U.S. Department of Energy responsible for the criticality safety of fissionable materials. It is DOE policy to use National and International Consensus Standards (e.g., ANSI/ANS Standards, ISO Standards, ECS Standards) when such standards are available to meet DOE needs. This DOE Good Practices Program Guide is a comprehensive guidance document to assist in developing a criticality safety program to implement the DOE Order (or Rule) on nuclear criticality safety, and the invoked ANSI/ANS standards, through use of good practices. Its comprehensiveness precludes its full applicability to all sets of conditions, since a good practice for one set of conditions may be an unnecessary, or a poor, practice for a similar, but not identical, set of conditions. DOE Good Practices Guides generally should not be used to develop audit check-lists. This DOE Good Practices Guide is not a requirements document and shall not be used as an auditing standard. It is intended only to provide guidance. Requirements for DOE nuclear criticality safety programs are found in higher level documents, e.g., Policy, Rule, Order, and Manual. These documents, e.g., the Order or the Manual, may invoke National and International Consensus Standards. Use of the word "shall" in this DOE Good Practices Guide is only to try to maintain consistency with higher level documents. This DOE Good Practices Guide was developed, over a nine-year period, by Calvin Hopper of the Oak Ridge National Laboratory under contract to the U.S. DOE, with the consensus of a representative work group of DOE Headquarters personnel and DOE site, i.e., laboratory and contractor, personnel. This development included 15 revisions, partly based on a general review and on 6 meetings with the work group. Additional major editorial revision was provided by James Mincey of the Oak Ridge National Laboratory. Because the work performed at the different DOE sites is diverse (viz., hands-on unshielded fissionable material operations at some sites and remote shielded operations at other sites), this DOE Good Practices Guide is diverse. Hence, it is comprehensive and covers most of the areas of responsibility pertaining to conducting a nuclear criticality safety program. To this end, information in this document has been gathered eclectically, therefore it is inappropriate to use this document in its entirety for anyone site or for any single application. Its intent, therefore, is to present a comprehensive text of good practices for nuclear criticality safety, and to depend on good judgment in both engineering and management to be the principal determinant for applicability of these good practices. While even a comprehensive text of good practices cannot address every need, it can serve as a source of ideas to address differing needs as they arise.

Beneficial comments (recommendations, additions, deletions) and any pertinent data that may be of use in improving this document should be addressed to Burton M. Rothleder (project manager for this document). Mr. Rothleder can be reached at 301-903-3726, fax 301-903-6172, or email burton .rothleder@hq.doe.gov. iv ACKNOWLEDGMENTS DOE G 421.1-1 8-25-99 The U.S. Department of Energy wishes to acknowledge the following persons as significant contributors to major parts of the technical content of this document: Calvin Hopper (Oak Ridge National Laboratory) James Mincey (Oak Ridge National Laboratory) Kenneth Yates (Westinghouse Safety Management Solutions) *** Charles Barnett (Lawrence Livermore National Laboratory, retired) Leslie Davenport (Battelle Pacific Northwest Laboratories, retired) Howard Dyer (Oak Ridge National Laboratory) Ivon Fergus (U.S. Department of Energy) Ronald Knief (Ogden Environmental and Energy Services) William R. Waltz (Savannah River Site, retired) The U.S. Department of Energy also wishes to acknowledge the supportive contributions to this document and to the review process from the many experienced members of the nuclear criticality safety community. DOE G 421.1-1 8-25-99 CONTENTS v 1. SCOPE ............................................................ 1 1.1 SCOPE ....................................................... 1 1.2 APPLICATION .................................................. 1 1.3 STRATEGY AND INTENT ........................................... 1 1.4 DOCUMENT REFERENCES. ......................................... 2 1.5 ANSI/ANS Series-8 Standards. ..... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 2 1.6 MAINTENANCE. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 2 2. APPLICABLE DOCUMENTS .............................................. 3 2.1 DOE DOCUMENTS ............................................... 3 2.1.1 DOE 1300.2A ............................................. 3 2.1.2 DOE 1324.2A ............................................. 3 2.1.3 DOE 5000.3B ............................................. 3 2.1.4 DOE 5480.3 .............................................. 3 2.1.5 DOE 5480.4 .............................................. 3 2.1.6 DOE 5480.11 ............................................. 3 2.1.7 DOE 5480.18B ............................................ 3 2.1.8 DOE 5480.19 ............................................. 3 2.1.9 DOE 5480.20A ............................................ 3 2.1.10 DOE 5480.21 ............................................ 3 2.1.11 DOE 5480.22 ............................................. 4 2.1.12 DOE 5480.23 ............................................ 4 2.1.13 DOE 420.1. ..... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 4 2.1.14 DOE 5484.1 ............................................. 4 2.1.15 DOE 5500.2B ............................................ 4 2.1.16 DOE 5500.3A ............................................ 4 2.1.17 DOE 5700.6C ............................................ 4 2.1 .18 DOE 6430.1 A ............................................ 4 2.1.19 DOE-STD-3007-93 ......................................... 4 2.1.20 DOE-STD-3013-94 ......................................... 4 2.1.21 DOE/TIC-11603-REV. 1 ...................................... 4 2.2 OTHER FEDERAL DOCUMENTS ...................................... 5 2.2.1 Code of Federal Regulations (CFR) ............................... 5

2.2.1.1 Title 10, Part 70 of the CFR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 5 2.2.1.2 Title 10, Part 71 of the CFR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 5 2.2.1.3 Title 10, Part 830 of the CFR .............................. 5 2.2.2 Nuclear Regulatory Commission (NRC) Documents . . . . . . . . . . . . . . . . . . . .. 5 2.2.2.1 NRC Regulatory Guide 3.1 ................................ 5 2.2.2.2 NRC Regulatory Guide 3.4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 5 2.2.2.3 NRC Regulatory Guide 3.34 ... . . . . . . . . . . . . . . . . . . . . . . . . . . .. 5 2.2.2.4 NRC Regulatory Guide 3.35 ............................... 5 2.2.2.5 NRC Regulatory Guide 3.68 ... . . . . . . . . . . . . . . . . . . . . . . . . . . .. 5 2.2.2.6 NRC Regulatory Guide 8.12 ... . . . . . . . . . . . . . . . . . . . . . . . . . . .. 5 2.2.2.7 NUREG/BR-0167 ...................................... 6 2.2.2.8 NUREG/CR-1278, SAND80-0200,RX,AN ...................... 6 vi DOE G 421.1-1 8-25-99 2.2.2.9 NUREG/CR-4639, EEG-2458 .............................. 6 2.3 NON-GOVERNMENT DOCUMENTS .................................... 6 2.3.1 American National Standards Institute (ANSI) . . . . . . . . . . . . . . . . . . . . . . .. 6 2.3.1.1 ANSI/ANS-8.1-1998 ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 6 2.3.1.2 ANSI/ANS-8.3-1997 ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 6 2.3.1.3 ANSI/ANS-8.5-1996 ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 6 2.3.1.4 ANSI/ANS-8.6-1983,R95 ................................ 6 2.3.1.5 ANSI/ANS-8.7-1998 .................................... 6 2.3.1.6 ANSI/ANS-8.9-1987,R95 ................................ 6 2.3.1.7 ANSI/ANS-8.10-1983,R88 ............................... 6 2.3.1.8 ANSI/ANS-8.12-1987,R93 ............................... 7 2.3.1.9 ANSI/ANS-8.15-1981,R95 ............................... 7 2.3.1.10 ANSI/ANS-8.17-1984,R97 .............................. 7 2.3.1.11 ANSI/ANS-8.19-1996 .................................. 7 2.3.1.12 ANSI/ANS-8.20-1991 .................................. 7 2.3.1.13 ANSI/ANS-8.21-1995 .................................. 7 2.3.1.14 ANSI/ANS-8.22-1997 .................................. 7 2.3.1.15 ANSI/ANS-8.23-1997 .................................. 7 2.3.1.16 ANSI/ANS-10.3-1986 .................................. 7 2.3.1.17 ANSI/ANS-10.4-1987 .................................. 7 2.3.1.18 ANSI/IEEE-Std-500-1984 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 7 2.3.2 Industry Related Reference Documents ............................ 7 2.3.2.1 ANS-9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 8 2.3.2.2 LA-11627-MS ........................................ 8 2.3.3 Journal Articles, and Meetings and Conference Proceedings . . . . . . . . . . . . .. 9 3. TERMS AND DEFINITIONS ............................................. 10 4. GENERAL GUIDANCE. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 25 4.1 APPLICABILITY ................................................ 25 4.2 INTERPRETATION OF THE GOOD PRACTICES PROGRAM GUIDE .............. 25 4.3 MAINTENANCE OF THE GOOD PRACTICES PROGRAM GUIDE ... . . . . . . . . . . . .. 25 4.4 DOCUMENT ARCHITECTURE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 25

4.4.1 Topical Structure .......................................... 25 4.4.2 Content Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 25 4.4.3 Section and Paragraph Numbering .............................. 27 5. DETAILED GUIDANCE ................................................ 28 5.1 ADMINISTRATION .............................................. 28 5.1.1 Contractor President/Chief Executive Officer ....................... 28 5.1.1.1 Responsibility........................................ 28 5.1.1.2 Policy ............................................. 28 5.1.1.3 Organization ........................................ 28 5.1.1.4 Program Oversight .................................... 28 5.1.1.5 Corrective actions. .................................... 29 5.1.1.6 Resources .......................................... 29 5.1.1.7 Stop Work Policy ..................................... 29 5.1.2 Facility Operations Managers .................................. 29 5.1.2.1 CAS Management .................................... 29 5.1.2.2 Procedures development and maintenance . . . . . . . . . . . . . . . . . . .. 29 DOE G 421.1-1 8-25-99 vii 5.1.2.3 Staff training ........................................ 30 5.1.2.4 Design and procedure reviews ............................ 30 5.1.2.5 Configuration control program ............................ 30 5.1.2.6 Self-assessments ..................................... 30 5.1.2.7 Compliance ......................................... 30 5.1.2.8 Audit response approval ................................ 30 5.1.2.9 Safety documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 30 5.1.2.10 Contingency analysis documentation . . . . . . . . . . . . . . . . . . . . . .. 30 5.1.2.11 Facility shutdowns ................................... 30 5.1.2.12 Maintenance of NCS controls ....................... ; . . .. 30 5.1.2.13 Fire safety plans . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 30 5.1.2.14 Operational postings .................................. 31 5.1.2.15 Delegation of responsibilities ............................ 31 5.1.2.16 Development of criticality accident evacuation routes ........... 31 5.1.2.17 Monitoring for process accumulations ...................... 31 5.1.2.18 Facility access and other NCS controls ..................... 31 5.1.3 Line/Production Management .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 31 5.1.3.1 Acceptance of authority and responsibility . . . . . . . . . . . . . . . . . . .. 31 5.1.3.2 Standards compliance .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 31 5.1.3.3 Operational approvals .................................. 32 5.1.3.4 Staffing and training ................................... 32 5.1.3.5 Configuration control. .................................. 32 5.1.3.6 Procedures ......................................... 32 5.1.3.7 Maintenance ........................................ 32 5.1.3.8 Self-audit.... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 32 5.1.3.9 Emergency planning ................................... 32 5.1.3.10 Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 32 5.1.3.11 Notifications ....................................... 32 5.1.3.12 Review requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 32 5.1.3.13 Delegation of authority and assignment of responsibilities ........ 33

5.1.4 First Line Supervision ....................................... 33 5.1.4.1 Responsibility........................................ 33 5.1.4.2 Training. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 33 5.1.4.3 Provision of training ................................... 33 5.1.4.4 Procedural development ................................ 33 5.1.4.5 Safety practices .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 33 5.1.4.6 Operational reviews ................................... 33 5.1.4.7 Operational approvals .................................. 34 5.1.4.8 Process monitoring .................................... 34 5.1.4.9 Recovery and deviation evaluations. . . . . . . . . . . . . . . . . . . . . . . .. 34 5.1.4.10 Labeling and posting .................................. 34 5.1.4.11 Access control .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 34 5.1.5 Fissionable Material Operations Personnel ......................... 34 5.1.5.1 Responsibility........................................ 34 5.1.5.2 Operational procedures ................................. 34 5.1.5.3 Terminate operations .................................. 34 5.1.5.4 Inquiries ........................................... 34 5.1.5.5 Training requirements .................................. 35 5.1.5.6 Notification ......................................... 35 5.1.5.7 Emergency response .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 35 viii DOEG421.1-1 8-25-99 5.1.6 Facilities Maintenance Organization. . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 35 5.1.7 Engineering and Projects Organization (E&PO) ...................... 35 5.1 .7.1 Responsibilities....................................... 35 5.1.7.2 Design requirement compliance ........................... 35 5.1.8 Criticality Safety Organization ................................. 35 5.1.8.1 Technical Direction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 35 5.1.8.2 Quality assurance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 36 5.1.8.3 Criticality Safety Organization personnel qualification ............ 36 5.1.8.4 Maintenance of familiarity ............................... 37 5.1.8.5 Consultation ........................................ 37 5.1.8.6 Obtaining consultation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 38 5.1.8.7 Performing self-assessments and audits . . . . . . . . . . . . . . . . . . . . .. 38 5.1.8.8 Operational reviews ................................... 38 5.1.8.9 Procedural reviews .................................... 38 5.1.8.10 Incident reviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 38 5.1.8.11 Process event/fault tree analyses ......................... 38 5.1.8.12 Quality and configuration control of software and data sets ....... 38 5.1.8.13 NCS evaluations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 38 5.1.8.14 NCS analyses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 38 5.1.8.15 NCS recovery actions ................................. 39 5.1.8.16 CAS and CDS sensors, Nuclear Accident Dosimeter (NAD), and

evacuation zone boundary shielding and deployment evaluation ........ 39 5.1.8.17 Peer review ........................................ 39 5.1.8.18 Records retention .................................... 39 5.1.8.19 NCS procedures ..................................... 40 5.1.8.20 Design reviews. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 40 5.1.8.21 Selection and approval of effective controls. . . . . . . . . . . . . . . .. 40 5.1.8.22 Assistance in shutdowns ... . . . . . . . . . . . . . . . . . . . . . . . . . . .. 40 5.1.8.23 Accident yield estimation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 40 5.1.8.24 Participate in CAS evacuation drills . . . . . . . . . . . . . . . . . . . . . . .. 40 5.1.8.25 Technical training support .............................. 40 5.1.8.26 Reviews of fire safety plans . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 40 5.1.8.27 Operational experience feedback. . . . . . . . . . . . . . . . . . . . . . . . .. 40 5.1.8.28 INCSRC support ..................................... 40 5.1.9 Installation Nuclear Criticality Safety Review Committee (INCSRC) ........ 40 5.1.9.1 Composition ........................................ 41 5.1.9.2 Guidance to management ............................... 41 5.1.9.3 Investigation of incidents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 41 5.1.9.4 INCSRC Annual reviews ................................ 41 5.1.9.5 Response to requests .................................. 42 5.2 PERSONNEL SELECTION, QUALIFICATION, TRAINING, AND STAFFING PROGRAM 43 5.2.1 Program for Operations and Support Personnel . . . . . . . . . . . . . . . . . . . . .. 43 5.2.2 Installation Nuclear Criticality Safety Staff . . . . . . . . . . . . . . . . . . . . . . . .. 43 5.2.3 Visitors and Clerical Employees ................................ 44· 5.2.4.1 Compliance ......................................... 45 5.2.4.2 Quality Audit ........................................ 45 5.3 OPERATING, STORING, AND TRANSFERRING - PLANS, PROCEDURES, REQUIREMENTS, AND CONTROLS ............................................... 46 5.3.1 General Requirements for Operating Plans and Procedures .............. 46 5.3.1.1 Start-up, operations, and modifications ...................... 46 DOE G 421.1-1 8-25-99 ix 5.3.1.2 NCS parameter identification ............................. 46 5.3.1.3 Single failure safety assurance ............................ 46 5.3.1.4 Procedural convenience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 46 5.3.1.5 Procedural reviews .................................... 46 5.3.1.6 Supplementation ..................................... 47 5.3.1.7 Operational deviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 47 5.3.2 Processing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 47 5.3.2.1 Plans, flowsheets, and layouts . . . . . . . . . . . . . . . . . . . . . . . . . . .. 47 5.3.2.2 Procedural description of material composition ................. 47 5.3.2.3 Procedural description of allowed material quantities . . . . . . . . . . . .. 47 5.3.2.4 Procedural description of spacing requirements . . . . . . . . . . . . . . . .. 48 5.3.2.5 Procedural specifications for material collection and transport. . . . . .. 48 5.3.2.6 Procedural specifications for administrative controls ............. 48

5.3.3 Receiving and Inspecting Fissionable Material . . . . . . . . . . . . . . . . . . . . . .. 48 5.3.3.1 Verification ......................................... 48 5.3.3.2 Material placement .................................... 48 5.3.4 Storing Fissionable Material ................................... 48 5.3.4.1 Container design ..................................... 48 5.3.4.2 Container criteria ..................................... 48 5.3.4.3 Container descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 49 5.3.4.4 Container identification and closure. . . . . . . . . . . . . . . . . . . . . . . .. 49 5.3.4.5 Container venting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 49 5.3.4.6 Containerization of plutonium or 233U • • • • • • • • • • • • • • • • • • • • • • •• 49 5.3.4.7 Plutonium storage monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 49 5.3.4.8 Facility design criteria .................................. 49 5.3.4.10 Storage facility plans and layouts ......................... 50 5.3.4.11 Admonitions about moderating and reflecting materials .......... 50 5.3.4.12 Removal and return of materials .......................... 50 5.3.4.13 Exclusion of superfluous materials ........................ 50 5.3.4.14 Readiness inspections ................................. 50 5.3.4.15 Postings .......................................... 50 5.3.4.16 Instructions ........................................ 50 5.3.4.17 Emergency planning .................................. 51 5.3.4.18 Exclusion from storage requirements .. . . . . . . . . . . . . . . . . . . . .. 51 5.3.4.19 Use of shipping containers .............................. 51 5.3.4.20 Material constraints .................................. 51 5.3.4.21 Pyrophoric materials .................................. 51 5.3.4.22 Heat removal ....................................... 51 5.3.5 Fissionable Material Transportation .............................. 51 5.3.5.1 Onsite transfers ...................................... 51 5.3.5.1.1 Onsite transport safety analysis ...................... 51 5.3.5.1.2 Operating procedures ............................. 51 5.3.5.2 Offsite transfers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 52 5.3.6 Posting and Labeling ........................................ 52 5.3.6.1 Posting of Fissionable Material Handling, Storage, and Work Areas .,. 52 5.3.6.1.1 Postings for presence of fissionable materials . . . . . . . . . . . .. 52 5.3.6.1.2 Symbol ....................................... 52 5.3.6.1.3 Storage postings ................................ 52 5.3.6.1.4 Process limits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 53 5.3.6.1.5 Uniformity of postings . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 53 x DOE G 421.1-1 8-25-99 5.3.6.1.6 Administrative control postings ...................... 53 5.3.6.1.7 Precautions or prohibitions . . . . . . . . . . . . . . . . . . . . . . . . .. 53 5.3.6.1.8 Visibility of postings, operator aids .................... 53 5.3.6.2 Labeling Requirements for Fissionable Material ................. 53 5.3.6.2.1 Label......................................... 53 5.3.6.2.2 Attachment .................................... 53 5.3.6.2.3 Contained information . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 53 5.3.6.2.4 Specialized needs .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 53 5.3.6.2.5 Unirradiated reactor fuel/targets ...................... 54 5.3.6.2.6 Irradiated reactor fuel/targets .,. . . . . . . . . . . . . . . . . . . . .. 54

5.3.6.3 Empty containers ..................................... 54 5.4 CRITICALITY ACCIDENT ALARM AND DETECTION SYSTEMS ................ 55 5.4.1 Conditions for CAS Coverage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 55 5.4.2 Conditions for CDS Coverage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 56 5.4.3 Conditions Not Requiring CASs and CDSs ......................... 56 5.4.3.1 Shielded Operations ................................... 56 5.4.3.2 Licensed/certificated packages ..... . . . . . . . . . . . . . . . . . . . . . .. 56 5.4.3.3 Incredibility ......................................... 57 5.4.4 Design Requirements ....................................... 57 5.4.4.1 Characteristic radiation detection .......................... 57 5.4.4.2 Alarm logic ......................................... 57 5.4.4.3 Trouble warning ...... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 57 5.4.4.4 Alarm purpose ....................................... 57 5.4.4.5 Resistance to detector saturation .......................... 57 5.4.4.6 Alarm resets ........................................ 58 5.4.4.7 Automated alarming ................................... 58 5.4.4.8 Response testing ..................................... 58 5.4.4.9 Minimization of false alarms and system vulnerability ............ 58 5.4.4.10 Backup power supply ................................. 58 5.4.4.11 Seismic resistance ................................... 58 5.4.4.12 Response time ...................................... 58 5.4.4.13 Detection criteria .................................... 58 5.4.4.14 Sensitivity ......................................... 59 5.4.4.15 Spacing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 59 5.4.4.16 Signal ............................................ 59 5.4.4.17 Reliability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 59 5.4.5 Testing ................................................. 60 5.4.5.1 Initial ............................................. 60 5.4.5.2 Post repair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 60 5.4.5.3 Radiation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 60 5.4.5.4 Periodic. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 60 5.4.5.5 Corrective Action ..................................... 60 5.4.5.6 Procedures ......................................... 60 5.4.5.7 Records... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 60 5.4.6 Location Analysis .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 61 5.4.6.1 Shielding and location analysis ... . . . . . . . . . . . . . . . . . . . . . . . .. 61 5.4.6.2 Yield estimation ...................................... 61 5.4.7 Familiarization with Operation ................................. 61 5.4.7.1 CAS alarm response ................................... 61 5.4.7.2 Emergency procedures ................................. 61 DOE G 421.1-1 8-25-99 xi 5.4.7.3 Signal familiarization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 61 5.4.7.4 Signal demonstration .................................. 61 5.4.7.5 Periodic alarm signaling .... . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 61 5.4.7.6 Annual evacuation drills ................................. 62 5.4.7.7 Visitor training ....................................... 62

5.5 EMERGENCY PREPAREDNESS ...................................... 63 5.6 NUCLEAR CRITICALITY SAFETY CONTROL PRINCIPLES AND METHODS ........ 64 5.6.1 Double-Contingency Principle (Application) . . . . . . . . . . . . . . . . . . . . . . . .. 65 5.6.1.1 Requirements of contingencies . . . . . . . . . . . . . . . . . . . . . . . . . . .. 66 5.6.1.2 Scope of contingencies .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 69 5.6.1.3 Double-contingency analysis ............................. 69 5.6.1.4 Contingency controls reliability . . . . . . . . . . . . . . . . . . . . . . . . . . .. 70 5.6.1.5 Contingency control margin of subcriticality . . . . . . . . . . . . . . . . . .. 70 5.6.1.6 Treatment of dependent contingencies ...................... 70 5.6.1.7 Identification of engineered or administrative controls ............ 70 5.6.1.8 Exception from Double-Contingency Principle .. . . . . . . . . . . . . . . .. 70 5.6.1.9 Preferred hierarchy of controls ............................ 70 5.6.1.10 Avoidance of administrative controls . . . . . . . . . . . . . . . . . . . . . .. 70 5.6.1.11 Exemption from double-contingency principle ................. 71 5.6.2 General Nuclear Criticality Safety Control Principles and Practices . . . . . . . .. 71 5.6.2.1 Safety assurance ..................................... 71 5.6.2.2 Potential criticality assessment. . . . . . . . . . . . . . . . . . . . . . . . . . .. 71 5.6.2.3 Burn-up credit ....................................... 71 5.6.2.4 Storage... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 71 5.6.2.5 Special actinide element evaluations ........................ 71 5.6.2.6 Subcritical neutron multiplication measurements . . . . . . . . . . . . . . .. 71 5.6.2.7 Criticality accident alarm systems . . . . . . . . . . . . . . . . . . . . . . . . .. 71 5.6.2.8 Process and equipment design ............................ 71 5.6.2.9 Process analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 71 5.6.2.1 0 Bases for su bcritical ity ................................ 71 5.6.2.11 Operating procedures ................................. 72 5.6.2.12 Exempt quantities of fissionable materials ................... 72 5.6.3 Nuclear Parameters Important to Nuclear Criticality Safety and Their Control . 72 5.6.3.1 Geometry control ..................................... 72 5.6.3.1.1 Equipment design reliance .......................... 72 5.6.3.1.2 Fissile solution transfers ........................... 72 5.6.3.1.3 Allowances with geometry control .................... 72 5.6.3.1.4 Control monitoring ............................... 72 5.6.3.1.5 Thermal insulation concerns . . . . . . . . . . . . . . . . . . . . . . . .. 72 5.6.3.1.6 Sump designs .................................. 73 5.6.3.1.7 Floor drains .................................... 73 5.6.3.1.8 Inadvertent transfers . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 73 5.6.3.1.9 Backflow prevention .............................. 73 5.6.3.2 Spacing (interaction) control ............................. 73 5.6.3.2.1 Storage and transfer .... . . . . . . . . . . . . . . . . . . . . . . . . .. 73 5.6.3.2.2 Storage rack integrity ............................. 73 5.6.3.3 Neutron absorber (poison) control . . . . . . . . . . . . . . . . . . . . . . . . .. 73 5.6.3.3.1 Suitability ..................................... 73 5.6.3.3.2 Raschig rings ........................ . . . . . . . . . .. 73 5.6.3.3.3 Representative samples . . . . . . . . . . . . . . . . . . . . . . . . . . .. 74

xii DOE G 421.1-1 8-25-99 5.6.3.3.4 Minimum soluble poison concentration ................. 74 5.6.3.3.5 Soluble poison monitoring .......................... 74 5.6.3.4 Concentration (density) control ........................ 74 5.6.3.4.1 Process changes in density ......................... 74 5.6.3.5 Moderation control .................................... 74 5.6.3.5.1 Monitoring neutron moderation . . . . . . . . . . . . . . . . . . . . . .. 74 5.6.3.5.2 Consideration of interstitial moderation ................. 75 5.6.3.5.3 Consideration of non-aqueous moderation ............... 75 5.6.3.5.4 Installed fire protection systems ...................... 75 5.6.3.5.5 Exclusion of moderating materials . . . . . . . . . . . . . . . . . . . .. 75 5.6.3.5.6 Use of water in fire fighting ......................... 75 5.6.3.6 Reflection control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 75 5.6.3.6.1 Assumptions about neutron reflection .................. 75 5.6.3.6.2 Avoidance of reflection control . . . . . . . . . . . . . . . . . . . . . .. 75 5.6.3.6.3 Use of water in fire fighting ......................... 75 5.6.3.7 Mass control ........................................ 75 5.6.3.7.1 Over-batching .................................. 75 5.6.3.7.2 Double batching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 76 5.6.3.7.3 Material form ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 76 5.6.3.8 Volume control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 76 5.6.3.8.1 Volumetric limits ................................ 76 5.6.3.9 Enrichment or isotopic control ............................ 76 5.7 NUCLEAR CRITICALITY SAFETY DESIGN AND ANALYSIS GUIDELINES . . . . . . . . .. 77 5.7.1 Scope .................................................. 77 5.7.2 Overview of the Nuclear Criticality Safety Control Design Process . . . . . . . .. 77 5.7.2.1 Majorprojects ....................................... 77 5.7.2.1.1 Preliminary process hazards review .. . . . . . . . . . . . . . . . . .. 77 5.7.2.1.2 Design process and design reviews .................... 77 5.7.2.1.3 Preoperational process hazards review. . . . . . . . . . . . . . . . .. 78 5.7.2.2 Projects involving modifications to existing equipment ............ 78 5.7.2.2.1 Screening process hazards review. . . . . . . . . . . . . . . . . . . .. 78 5.7.2.2.2 Preliminary process hazards review .................... 80 5.7.2.2.3 Preoperational process hazards review. . . . . . . . . . . . . . . . .. 80 5.7.3 Six Basic Nuclear Criticality Safety Control Design Objectives. . . . . . . . . . .. 80 5.7.3.1 Objective 1 - to control criticality probability using a preferred hierarchy of controls .............................................. 80 5.7.3.2 Objective 2 - to identify potential criticality scenarios ............ 80 5.7.3.3 Objective 3 - to eliminate potential criticality scenarios to the extent practical .............................................. 80 5.7.3.4 Objective 4 - to demonstrate that criticality risks are acceptably low .. 80 5.7.3.5 Objective 5 - to evaluate the operability of criticality safety controls .. 81 5.7.3.6 Objective 6 - to document the nuclear criticality safety control design . 81 5.7.4 Means of Controlling the Criticality Risks . . . . . . . . . . . . . . . . . . . . . . . . .. 81 5.7.4.1 Three basic means of criticality safety control ................. 82

5.7.4.1.1 Passive-engineered control . . . . . . . . . . . . . . . . . . . . . . . . .. 83 5.7.4.1.2 Active-engineered control .......................... 83 5.7.4.1.3 Administrative control . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 83 5.7.4.2 Criticality safety control methods .......................... 83 5.7.4.2.1 Geometry control ................................ 83 DOE G 421.1-1 8-25-99 xiii 5.7.4.2.2 Spacing control ................................. 87 5.7.4.2.3 Neutron poisons ................................. 88 5.7.4.2.4 Fissile concentration control . . . . . . . . . . . . . . . . . . . . . . . .. 90 5.7.4.2.5 Moderation control ............................... 90 5.7.4.2.6 Reflection control ................................ 91 5.7.4.2.7 Mass control ................................... 92 5.7.4.2.8 Enrichment or isotopic composition control .............. 92 5.7.4.2.9 Density control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 92 5.7.5 Identifying Potential Criticality Scenarios .......................... 93 5.7.5.1 Four measures contributing to successful identification ........... 93 5.7.5.2 Approaches for criticality scenario identification ................ 94 5.7.5.2.1 Using logic models to identify accident scenarios .......... 94 5.7.5.2.2 Postulating accident scenarios directly. ................. 95 5.7.5.2.3 Deductive logic tree example ........................ 96 5.7.6 Eliminating Potential Criticality Scenarios . . . . . . . . . . . . . . . . . . . . . . . . .. 98 5.7.7 Judging Acceptability of a Potential Criticality Scenario ............... 101 5.7.7.1 Double-contingency analysis meaning and application ........... 101 5.7.7.2 Basic steps in implementing double-contingency and performing a contingency analysis .................................... 102 5.7.7.3 Qualifications for a contingency barrier ..................... 103 5.7.7.3.1 Quantitative guidelines for acceptable contingency barrier failure probabilities ....................................... 103 5.7.7.3.2 Guidelines for independency . . . . . . . . . . . . . . . . . . . . . . .. 105 5.7.7.3.3 Quantification of the simultaneous collapse frequency of two controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 105 5.7.7.4 Conspicuous and prominent identification of double-contingency means of control .................................... . . . . . . . . .. 105 5.7.8 Operability of Criticality Safety Controls ......................... 105 5.7.8.1 Identifying controls important to nuclear criticality safety . . . . . . . .. 105 5.7.8.2 Examining the operability of the set of controls ............... 106 5.7.8.3 Incorporating good human factors practices . . . . . . . . . . . . . . . . .. 106 5.7.8.4 Incorporating uniformity into the design . . . . . . . . . . . . . . . . . . . .. 106 5.7.8.5 Facilitating sampling .................................. 106 5.7.8.6 Facilitating inspection and maintenance . . . . . . . . . . . . . . . . . . . .. 106 5.7.8.7 Facilitating flushing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 107 5.7.8.8 Anticipating process changes . . . . . . . . . . . . . . . . . . . . . . . . . . .. 107 5.7.8.9 Accommodating fire control systems. . . . . . . . . . . . . . . . . . . . . .. 107 5.7.9 Documenting the Nuclear Criticality Safety Control Design . . . . . . . . . . . .. 108 5.7.9.1 Documentation of the nuclear criticality safety control design proposal

5.7.9.2 Documentation of the nuclear criticality safety control design ..... . 5.7.10 Examples ............................................. . 5.8 SOFTWARE QUALITY ASSURANCE AND VALIDATION ................... . 5.8.1 Software Requirement ..................................... . 5.8.2 Verification of Calculational Method ........................... . 5.8.3 Software Configuration Control .............................. . 5.8.4 Validation of Calculational Method ............................ . 5.8.5 Code user corroboration ................................... . 5.9 NUCLEAR CRITICALITY SAFETY EVALUATION (NCSE) GUIDELINES .......... . 5.9.1 Personnel Requirements for Performing NCSEs .................... . 110 110 111 112 112 112 112 112 113 114 114 xiv DOE G 421.1-1 8-25-99 5.9.2 Performance and Documentation of the NCSE ..................... 114 5.9.2.1 Peer review ........................................ 116 5.9.2.2 NCSE documentation ................................. 117 APPENDIX A. PERSONNEL SELECTION, QUALIFICATION, TRAINING, AND STAFFING PROGRAM .............................................. 118 A.1 Program for Operations and Support Personnel . . . . . . . . . . . . . . . . . . . . . . . . .. 118 A.1.1 Continuing proficiency of personnel ............................ 118 A.1.2 Nuclear fission chain reactions and accident consequences. . . . . . . . . . . .. 118 A.1.3 Neutron behavior in fissioning systems. . . . . . . . . . . . . . . . . . . . . . . . . .. 119 A.1.4 Criticality accident history. .................................. 11 9 A.1.5 Response to criticality accident alarm signals. ..................... 119 A.1.6 Nuclear criticality safety parameters. ........................... 119 A.1 .7 Policy and procedures. ..................................... 119 A.1.8 Evaluations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 119 A.2 Installation Nuclear Criticality Safety Staff. ............................ 119 A.2.1 Qualification. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 120 A.2.2 Functional specialties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 121 A.2.2.1 Analysis. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 122 A.2.2.2 Evaluation. ........................................ 123 A.2.2.3 Implementation. .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 123 A.2.2.4 Confirmation ....................................... 123 A.2.2.5 Continuing competence. ............................... 123 A.2.3 Qualification process. ...................................... 123 A.2.3.1 Principles. ......................................... 124 A.2.3.2 Classification levels. .................................. 125 A.2.3.2.1 Entry. ....................................... 125 A.2.3.2.2 Apprentice. ................................... 126 A.2.3.2.3 Specialist. .................................... 126 A.2.3.2.4 Senior. ...................................... 127 A.2.3.2.5 Lead. ....................................... 127 A.2.3.3 Functional specialization. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 127 A.2.3.4 Continuing competence. ............................... 128 A.2.3.5 Requirements. ...................................... 129

A.2.3.5.1 Education. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 130 A.2.3.5.2 Experience. ................................... 131 A.2.3.5.3 Training. ..................................... 131 A.2.3.5.4 On-the-job training. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 132 A.2.3.5.5 Professional development. .... . . . . . . . . . . . . . . . . . . . .. 133 A.2.3.5.6 Personal characteristics. .......................... 134 A.2.3.6 Overall qualification. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 134 A.2.4 Classification-specific qualification programs. . . . . . . . . . . . . . . . . . . . . .. 135 A.2.5 Functional-specific qualification programs. . . . . . . . . . . . . . . . . . . . . . . .. 135 A.2.6 Continuing competence. .................................... 135 A.2.7 Documentation and records. ................................. 136 A.2.8 Evaluation and Documentation. ............................... 137 APPENDIX B. GRADED APPROACH ........................................ 138 B.1 Graded Approach to Criticality Safety Analyses and NCSEs. ................ 138 B.1 .1 Levels of analyses and evaluations. ............................ 138 DOE G 421.1-1 8-25-99 xv B.l .1.1 Level A. .......................................... 138 B.l .1.2 Level B. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 139 B.l .1.3 Level C. .......................................... 139 B.l.2 Complexities of facility fissionable material operations. ............... 139 B.l.2.1 Class I. ........................................... 139 B.l.2.2 Class II. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 139 B.l.2.3 Class III. .......................................... 140 B.l.2.4 Class IV ........................................... 140 B.l.3 Analysis Content. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 140 B.l.3.1 Operational description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 140 B.l.3.2 Fissionable material forms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 140 B.l.3.3 Credible operating condition changes. ...................... 140 B.l.3.4 Analysis of accident scenarios. . . . . . . . . . . . . . . . . . . . . . . . . . .. 140 B.l.3.5 Need for CAS or CDS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 141 B.l.3.6 Safety controls description. ............................. 141 B.l.3.7 NCSE summary. .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 141 B.l.4 Performance of nuclear criticality safety analyses and NCSEs. .......... 141 B.l .5 Results of the Graded Approach. .............................. 141 APPENDIX C. ESTIMATING THE WAITING TIME UNTIL THE SIMULTANEOUS COLLAPSE OF TWO CONTINGENCIES ................................................. 143 C.l Introduction.................................................. 143 C.l.1 DCP Review ............................................ 143 C.l.2 Markov Model ........................................... 143 C.l.3 Probabilistic Description .................................... 143 C.2 General Markov Model .......................................... 143 C.3 Symmetric Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 146 APPENDIX D. EXAMPLES OF DESIGN OF NUCLEAR CRITICALITY SAFETY CONTROLS .... 148 D.l Double-contingency analyses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 148

D.l.l Example # 1 ............................................ 148 D.l .1.1 Identifying potential criticality scenarios - logic diagram . . . . . . . . .. 148 D.l.l.2 Evaluation against the Double-Contingency Principle .. . . . . . . . . .. 149 D.l.l.2.1 Identifying the two barriers for double-contingency ........ 149 D.l.l.2.2 Qualification of the barriers for double-contingency . . . . . . .. 149 D.l.l.3 Identifying the means of control for each contingency barrier . . . . .. 154 D. 1. 1 .4 Review, relative to the other nuclear criticality safety objectives . . .. 154 D.2 Examples of eliminating unnecessary criticality scenarios ............ : . . . . .. 156 D.2.1 Example # 1 ............................................ 156 D.2.2 Example # 2 ............................................ 156 D.2.3 Example # 3 ............................................ 156 D.3 Examples of passive-engineered features and devices ..................... 157 D.3.1 Air break. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 157 D.3.2 Barometric seal leg . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 157 D.3.3 Criticality drain. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 157 D.3.4 Nuclear safety blank . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 159 D.3.5 Large line sizes .......................................... 159 D.3.6 Restricting orifices ........................................ 159 D.3.7 Relative elevation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 159 D.4 Examples of active protective devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 160 xvi DOE G 421.1-1 8-25-99 0.4.1 Rupture disk ............................................ 160 0.4.2 Backflow prevention devices ................................. 160 0.4.3 Radiation monitoring systems ................................ 160 APPENDIX E. SOFTWARE CONFIGURATION CONTROL PROCEDURE ................. 161 E.1 Specific responsibilities .......................................... 161 E.1 .1 Contractor safety organization manager . . . . . . . . . . . . . . . . . . . . . . . . .. 161 E.1.2 Software System Team . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 162 E.1.3 Functional System Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 162 E.1.4 System Administrator ...................................... 163 E.1.5 Installation nuclear criticality safety organization . . . . . . . . . . . . . . . . . . .. 163 E.1.6 Software developer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 164 E.2 Software identification .......................................... 164 E.3 Software control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 165 E.4 Software change procedure .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 165 E.5 Nonconformance Report procedure .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 166 E.6 Software testing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 166

APPENDIX F. EXAMPLE COMPUTATIONAL TECHNIQUE VALIDATIONS ............... 175 F.1 Selection and description of critical experiments . . . . . . . . . . . . . . . . . . . . . . . .. 175 F.2 Selection and description of the computational method .................... 175 F.3 Description of similarities and differences. . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 177 F.4 Input variables ................................................ 178 F.5 Acceptance criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 178 F.6 Areas of applicability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 179 F.7 Example validation ............................................. 180 APPENDIX G. BIBLIOGRAPHY OF JOURNAL ARTICLES AND MEETING AND CONFERENCE PROCEEDINGS ................................................... 195 INDEX ............................................................. 210 DOE G 421.1-1 8-25-99 AEG ANS ANSI CAS CDS CFR DBA DOE DOT E&PO FEM FMCA FMEA HEU INCSRC JTA LCO LEU LTB NAD NCS NCSE NCSS NCSSST NRC OJT PAG PRA PVC SME SNR USL V&V Acronyms Average Energy Group American Nuclear Society American National Standards Institute Criticality Accident Alarm System Criticality Accident Detection System Code of Federal Regulations Design Basis Accident US Department of Energy US Department of Transportation Engineering and Projects Organization Fissionable Equivalent Mass Fissionable Material Control Area Failure Modes and Effects Analysis High Enriched Uranium Installation Nuclear Criticality Safety Review Committee Job/Task Analysis Limiting Condition for Operation Low Enriched Uranium Lower Tolerance Band Nuclear Accident Dosimeters Nuclear Criticality Safety Nuclear Criticality Safety Evaluation Nuclear Criticality Safety Specialist Nuclear Criticality Safety Software System Team US Nuclear Regulatory Commission On-the-Job Training Protective Action Guide Probabilistic Risk Analysis PolyVinyl Chloride Su~ectMatterExpert Software Nonconformance Report Upper Subcritical Limit Verification and Validation xvii xviii List of Figures OOE G 421.1-1 8-25-99 Figure 5.3.6.1.2-1. Fissionable material symbol ................................. 52 Figure 5.7.2.1.2-1. Illustration of iterative process for development of nuclear criticality safety controls. ........................................................ 79 Figure 5.7.5.2.3-1. Illustration of deductive logic tree ............................. 97 Figure 0.1.1. Schematic of dry location and scrubber system ...................... 150 Figure 0.1.2. Logic diagram for potential criticality via liquid addition to dry location ...... 151 Figure 0.1.3. Logic diagram for potential criticality via liquid addition to dry location - two barriers added ......................................................... 152 Figure 0.1.4. Contingency analysis diagram .................................. 153 Figure 0.3.1. Schematic of air break. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 158 Figure 0.3.2. Illustration of barometric seal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 158 Figure 0.3.3. Criticality Orain. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 159 Figure F. 7.1. Typical results for the single-sided, uniform-width, closed-interval,

LTB technique. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 191 Figure F.7.2. Example results for the single-sided, uniform-width, closed-interval, L TB technique . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 194 DOE G 421.1-1 8-25-99 List of Tables xix Table 5.7.4-1. Criticality Safety Control Methods and Typically Associated Means of Control . 82 Table 5.7.5.2.3-1. Examples of Phenomena and Initiating Events Leading to the Mechanism for a Potential Criticality Event ..................................... . . . . . . .. 99 Table 5.7.7.3.1-1. Guidelines for Performing Quantitative Risk Analysis of Double-Contingency Control Failures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 104 Table 5.7.9-1. Summary of Nuclear Criticality Safety Control Design Documentation Objectives 109 Table A.2.3.3-1. Matrix of Qualification Levels for Each of Four Primary Functional Specialties 128 Table A.2.3.5-1. Education and Experience Requirements from DOE Order 5480.20 for Reactor and non-Reactor Facility Personnel Compared to Those for NCSS Personnel ......... 130 Table B.l .4-1. Resources required for performance of the NCSE .................... 142 Table D.l.l. Contingency Analysis - Summary Sheet . . . . . . . . . . . . . . . . . . . . . . . . . . .. 155 Table F.2. Partial Listing of Computer Codes, Models, and Hand Calculational Methods .... 176 Table F. 7.1. Calculated D Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 185 Table F. 7 .2. Input Data for Example Problem ................................. 192 Table F. 7 .3. Calculated Terms for Example Problem . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 193 xx List of Forms DOE G 421.1-1 8-25-99 Form E.1 Software Revision Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 167 Form E.2 Software Nonconformance Report .................................. 169 Form E.3 NCS Software System Version No.1 Catalog . . . . . . . . . . . . . . . . . . . . . . . . . .. 170 Form E.4 Request for User Access ......................................... 171 Form E.5 NCS Software Disaster Plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 172 Form E.6 Software Labeling Protocol ....................................... 173 Form E.7 NCS Software System Team (NCSSST) Sample Charter . . . . . . . . . . . . . . . . . . .. 174 DOE G 421.1-1 8-25-99 1. SCOPE. The SCOPE applies to the entire document. 1.1 SCOPE. This DOE Good Practices Program Guide illustrates and suggests practices and procedures for conducting a nuclear criticality safety (NCS) program at U.S. Department of Energy (DOE) nonreactor nuclear facilities having significant quantities of fissionable materials. These DOE practices and procedures are relevant to NCS program administration and oversight, NCS personnel selection and training, performance of NCS evaluations and analyses, emergency response, and programmatic control of processes, storage, procedures, hardware, and software. Throughout the text of this document, the term "fissionable material," used for concision, refers to the term that is specifically relevant to criticality safety concern, "significant quantity of fissionable material."

1.2 APPLICATION. This DOE Good Practices Program Guide applies to government contractors operating DOE nonreactor nuclear facilities having significant quantities of fissionable materials (unirradiated and irradiated) in process, storage, or transport outside a nuclear reactor core. This application extends to processing and burying of fissionable material wastes and handling or processing and storing of reactor fuel in storage pools. 1.3 STRATEGY AND INTENT. It is DOE policy to use National and International Consensus Standards (e.g., ANSI/ANS Standards, ISO Standards, ECS Standards) when such standards are available to meet DOE needs. This DOE Good Practices Program Guide is a comprehensive guidance document to assist in developing a criticality safety program to implement the DOE Order (or Rule) on nuclear criticality safety, and the invoked ANSI/ANS standards, through use of good practices. Its comprehensiveness precludes its full applicability to all sets of conditions, since a good practice for one set of conditions could be an unnecessary, or a poor, practice for a similar, but not identical, set of conditions. DOE Good Practices Guides generally should not be used to develop audit check-lists. This Good Practices Program Guide is not a requirements document and shall not be used as an auditing document. This Good Practices Program Guide shall not be incorporated in a Contract. It is intended only to provide guidance, but to meet this intention nuclear criticality safety professionals are expected to be familiar with its content. Requirements for DOE nuclear criticality safety programs are found in higher level documents, e.g., Policy, Rule, Order, and Manual. These documents, e.g., the Order or the Manual, may invoke National and International Consensus Standards. Use of the word "shall" (i.e., as the statement of a requirement) in this Good Practices Program Guide is only to try to maintain consistency with its direct and implicit use in higher level documents and shall not be used to impose requirements beyond those in higher level documents, except for use of the term "shall" in this paragraph. Therefore, no additional requirements, i.e., requirements that cannot be found in higher level documents, shall be imposed by users of this document. Because the work performed at the different DOE sites is diverse (viz., hands-on unshielded fissionable material operations at some sites and remote shielded operations at other sites), this Good Practices Program Guide, being relevant to such work, is also diverse. Hence, it is comprehensive and covers most of the areas of responsibility pertaining to conducting a nuclear criticality safety program. To this end, information in this document has been gathered eclectically; therefore it is inappropriate to use this document in its entirety either for anyone site or for any single application. Its intent, therefore, is to present a comprehensive text of good practices for nuclear criticality safety, and to depend on good judgment in both engineering and management to be the principal determinant for applicability of these good practices. While even a comprehensive 2 DOEG421.1-1 8-25-99 text of good practices cannot address every need, it can serve as a source of ideas to address differing needs as they arise.

Imbalance of detail is an expected characteristic of a comprehensive document that draws eclectically from diverse sources. In this Good Practices Program Guide, such imbalance, while present, is manifest by too much detail in some areas rather than too little detail in anyone area. As a fault, therefore, it is one of form rather than content, and a conservative fault, at that. 1.4 DOCUMENT REFERENCES. Some DOE documents (e.g., DOE Orders) referenced in this Good Practices Program Guide may have been revised or canceled by the time of issuance. Citation of references in this Good Practices Program Guide is intended to identify information that is relevant to this Good Practices Program Guide whether such information is found in the reference or in its revision or replacement. 1.5 ANSI/ANS Series-8 Standards. The basic elements and control parameters of programs for nuclear criticality safety at DOE must meet the requirements of specified ANSI/ANS Series-8 standards. Therefore, in the interest of clarity, familiar phraseology directly from these standards is sometimes used in this Good Practices Program Guide. Where such phraseology is used without attribution, failure to attribute is unintentional. 1.6 MAINTENANCE. The Good Practices Program Guide represents the desire of the DOE criticality safety community to have available a written account of the good practices of the various members of the criticality safety community so that all may be able to profit from the experiences of each, as applicable, hence from which practices may be culled that can be used in specific circumstances in the spirit of DNFSB Recommendation 95-2. Maintenance actions that are needed to keep the Guide current must be undertaken judiciously so that a contemporaneously valid version of the Guide is always available to the criticality safety community. Since criticality safety is a continuously evolving activity, the Guide cannot include recent events, especially since time­ consuming consensus reviews are necessary for each new draft, with revision reviews that would encompass several drafts estimated to take at least two years. The Guide is published here as Revision 0, with revisions to follow in subsequent years reflecting user experience and new initiatives. Among the new initiatives that affect criticality safety that will appear in Revision 1 are those included in Board Recommendations 95-2 and 97-2. The former affects criticality in general through its intention of achieving integrated treatment of safety management. The latter affects criticality in particular through the initiatives of bounding experiments and analyses; organization of experiment and calculation records; techniques for interpolation, extrapolation, and determination of area of applicability; use of simplified methods of analysis where applicable and defensible; and assignment of criticality safety as a staff function assisting line management. When Revision 1 is issued to include the effects of these, and perhaps other, initiatives, yet newer initiatives can be expected to have been only recently in place in readiness for Revision 2. Another aspect of document maintenance to be considered is the updating of references and the updating of terminology relevant to ancillary subject matter (e.g., relevant to packaging and to transportation). Updating that is deemed nonessential for Revision ° will be reserved for inclusion in Revision 1. DOE G 421.1-1 8-25-99 2. APPLICABLE DOCUMENTS

3 2.1 DOE DOCUMENTS. Information from the following DOE Orders, Standards, and Guides was used in the development of this Guide. Certain Orders have now been superseded by new Orders or have been canceled. These Orders are designated by phraseology using the terms superseded or canceled. 2.1.1 DOE 1300.2A. DEPARTMENT OF ENERGY TECHNICAL STANDARDS PROGRAM, of 5-19- 92, provides requirements for the development and application of technical standards in Department of Energy facilities, programs, and projects. 2.1.2 DOE 1324.2A. RECORDS DISPOSITION, of 9-13-88, contains procedures for the retention and disposition of records. Canceled by DOE 0 200.1, INFORMATION MANAGEMENT PROGRAM, of 9-30-96. 2.1.3 DOE 5000.3B. OCCURRENCE REPORTING AND PROCESSING OF OPERATIONS INFORMATION, of 1-19-93, establishes a system for reporting unusual occurrences having programmatic significance. Canceled by DOE 0 232.1, OCCURRENCE REPORTING AND PROCESSING OF OPERATIONS INFORMATION, of 9-25-95. 2.1.4 DOE 5480.3. SAFETY REQUIREMENTS FOR THE PACKAGING AND TRANSPORTATION OF HAZARDOUS MATERIALS, HAZARDOUS SUBSTANCES, AND HAZARDOUS WASTES, of 7-9-85, describes the requirements for packaging and transportation of hazardous materials, hazardous substances, and hazardous wastes. Canceled by DOE 0 460.1 A, PACKAGING AND TRANSPORTATION SAFETY, of 10-2-96. 2.1.5 DOE 5480.4. ENVIRONMENTAL PROTECTION, SAFETY, AND HEALTH PROTECTION STANDARDS, of 5-15-84, specifies the application of mandatory ES&H standards to DOE operations. Portions canceled by DOE 0 440.1, WORKER PROTECTION MANAGEMENT FOR DOE FEDERAL AND CONTRACTOR EMPLOYEES, of 9-30-95. 2.1.6 DOE 5480.11. RADIATION PROTECTION FOR OCCUPATIONAL WORKERS, of 12-21-88, provides radiation protection standards and program requirements for operations with respect to the protection of the worker from ionizing radiation. Canceled by 10 CFR 835. 2.1.7 DOE 5480.18B. NUCLEAR FACILITY ACCREDITATION TRAINING PROGRAM, of 8-31-94, institutionalizes a performance-based training process for DOE Category A reactors and high-hazard and selected moderate-hazard non-reactor nuclear facilities. Canceled 12-20-96. 2.1.8 DOE 5480.19. CONDUCT OF OPERATIONS REQUIREMENTS FOR DOE FACILITIES, of 7-9-90, which establishes requirements dealing with the conduct of operations for DOE operators. 2.1.9 DOE 5480.20A. PERSONNEL SELECTION, QUALIFICATION, TRAINING, AND STAFFING REQUIREMENTS AT DOE REACTOR AND NON-REACTOR NUCLEAR FACILITIES, of 2-20-91, describes the requirements for personnel involved in the operation, maintenance, and technical support of DOE-owned Category A and B reactors and non-reactor nuclear facilities. 2.1.10 DOE 5480.21. UNREVIEWED SAFETY QUESTIONS, of 12-24-91, establishes the means by which Unreviewed Safety Questions (USQs) are identified and the means of resolution of USQs. 4 DOE G 421.1-1 8-25-99 2.1.11 DOE 5480.22. TECHNICAL SAFETY REQUIREMENTS, of 2-25-92, establishes DOE's nuclear facility technical safety requirements. 2.1.12 DOE 5480.23. NUCLEAR SAFETY ANALYSIS REPORTS, of 4-10-92, which establishes uniform requirements for the preparation and review of safety analyses. 2.1.13 DOE 420.1. FACILITY SAFETY, Section 4.3, Nuclear Criticality Safety, of 10-13-95, establishes DOE's nonreactor nuclear facility nuclear criticality safety program.

2.1.14 DOE 5484.1. ENVIRONMENTAL PROTECTION, SAFETY, AND HEALTH PROTECTION INFORMATION REPORTING REQUIREMENTS, of 2-24-81, establishes the requirements and procedures for reporting and investigating matters of significance for the protection of environment, safety, and health at DOE operations. Canceled by DOE 0 231.1, ENVIRONMENT, SAFETY, AND HEALTH REPORTING, of 9-30-95, and by DOE 0 225.1, ACCIDENT INVESTIGATIONS, of 9-29- 95. 2.1.15 DOE 5500.28. EMERGENCY CATEGORIES, CLASSES, AND NOTIFICATION AND REPORTING REQUIREMENTS, of 4-30-91, establishes requirements for the coordination and direction of planning, preparedness, and response to operational emergencies. Canceled by DOE 0 151.1, COMPREHENSIVE EMERGENCY MANAGEMENT SYSTEM, of 9-25-95. 2.1.16 DOE 5500.3A. PLANNING AND PREPAREDNESS FOR OPERATIONAL EMERGENCIES, of 4-30-91, which establishes requirements for the development of site-specific emergency plans and procedures at nuclear facilities. Canceled by DOE 0 151.1, COMPREHENSIVE EMERGENCY MANAGEMENT SYSTEM, of 9-25-95. 2.1.17 DOE 5700.6C. QUALITY ASSURANCE, of 8-21-91, describes DOE's quality assurance program requirements for DOE and non-nuclear facility contractors. (See also 10 CFR 830.120, QUALITY ASSURANCE). Canceled by DOE 0 414.1, QUALITY ASSURANCE, of 11-24-98. 2.1.18 DOE 6430.1A. GENERAL DESIGN CRITERIA, of 04-6-89, contains the criteria for the design and construction of DOE facilities. (See also DOE 0 430.1, LIFE CYCLE ASSET MANAGEMENT, of 2-28-97.) 2.1.19 DOE-STD-3007-93. GUIDELINES FOR PREPARING CRITICALITY SAFETY EVALUATIONS AT DEPARTMENT OF ENERGY NON-REACTOR NUCLEAR FACILITIES, of December 1993, contains guidelines that should be followed when preparing Criticality Safety Evaluations that will be used to demonstrate the safety of operations performed at Department of Energy (DOE) Non-Reactor Nuclear Facilities. 2.1.20 DOE-STD-3013-94. CRITERIA FOR SAFE STORAGE OF PLUTONIUM METALS AND OXIDES, of December 1994 provides for safe storage (for at least 50 years or until final disposition) of plutonium metals, selected alloys, and stabilized oxides that contain a minimum of 50 weight-percent plutonium. 2.1.21 DOEITIC-11603-REV. 1. NONREACTOR NUCLEAR FACILITIES: STANDARDS AND CRITERIA GUIDE, of September 1986, is a source document that identifies standards, codes, and guides that address nuclear safety considerations at nuclear facilities. DOE G 421.1-1 8-25-99 5 2.2 OTHER FEDERAL DOCUMENTS. Information from the following other Federal documents was used in the development of this Guide. 2.2.1 Code of Federal Regulations (CFR). 2.2.1.1 Title 10, Part 70 of the CFR. Domestic Licensing of Special Nuclear Material establishes the procedures and criteria for the issuance of licenses to receive title to, own, acquire, deliver, receive, possess, use, and initially transfer special nuclear materials. 2.2.1.2 Title 10, Part 71 of the CFR. Packaging and Transportation of Radioactive Material establishes the requirements for obtaining Nuclear Regulatory Commission (NRC) approval of packaging and shipment of licensed material. 2.2.1.3 Title 10, Part 830 of the CFR. Nuclear Safety Management establishes requirements for preventing the uncontrolled release of radioactivity to the environment, inadvertent criticality, limiting and monitoring facility staff exposure to radiation and radioactivity, and protecting the public from exposure to radiation and radioactive contamination.

2.2.2 Nuclear Regulatory Commission (NRC) Documents. Information from the following NRC Regulatory Guides and NUREGs was used in the development of this Guide. 2.2.2.1 NRC Regulatory Guide 3.1. Use of Borosilicate-Glass Raschig Rings as a Neutron Absorber in Solutions of Fissile Material describes a method of using borosilicate-glass Raschig rings as a neutron absorber for criticality safety control in plants processing special nuclear materials. 2.2.2.2 NRC Regulatory Guide 3.4. Nuclear Criticality Safety in Operations with Fissionable Materials Outside Reactors describes acceptable procedures for the prevention of criticality accidents in the handling, storing, processing, and transporting of fissionable materials outside of nuclear reactors. 2.2.2.3 NRC Regulatory Guide 3.34. Assumptions Used for Evaluating the Potential Radiological Consequences of Accidental Nuclear Criticality in a Uranium Fuel Fabrication Plant describes methods used for performing analyses to assess the risk to public health and safety resulting from postulated nuclear criticality accidents in uranium fuel fabrication and processing plants. 2.2.2.4 NRC Regulatory Guide 3.35. Assumptions Used for Evaluating the Potential Radiological Consequences of Accidental Nuclear Criticality in a Plutonium Processing and Fuel Fabrication Plant describes methods used for performing analyses to assess the risk to public health and safety resulting from postulated nuclear criticality accidents in plutonium processing and fuel fabrication plants. 2.2.2.5 NRC Regulatory Guide 3.68. Nuclear Criticality Safety Training provides guidance on an appropriate nuclear criticality safety training program for the use of special nuclear material for license applicants and operations staff. It is not adequate for training for the nuclear criticality staff. 2.2.2.6 NRC Regulatory Guide 8.12. Criticality Accident Alarm Systems describes the specifications for use of criticality alarms where there is a potential hazard to workers from nuclear criticality accidents. 6 DOE G 421.1-1 S-25-99 2.2.2.7 NUREG/BR-0167. Software Quality Assurance Program and Guidelines, using industry standards, provides guidance in the development and maintenance of software. 2.2.2.S NUREG/CR-127S, SANDSO-0200,RX,AN. Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications provides some useful information for the performance of human reliability analyses. 2.2.2.9 NUREG/CR-4639, EEG-245S. Nuclear Computerized Library for Assessing Reactor Reliability (NUCLARR): Summary Description provides some useful human reliability data for the performance of human reliability analyses, primarily plant-specific reactor data from public domain sources. 2.3 NON-GOVERNMENT DOCUMENTS. 2.3.1 American National Standards Institute (ANSI). 2.3.1.1 ANSI/ANS-S.1-199S. Nuclear Criticality Safety in Operations with Fissionable Materials Outside Reactors provides basic criteria and limits for operations with fissionable materials outside reactors except for critical experiments. The standard also provides requirements for establishing the validity and areas of applicability of any calculational method used in assessing nuclear criticality safety. 2.3.1.2 ANSI/ANS-S.3-1997. Criticality Accident Alarm System provides the performance criteria for detecting nuclear criticality accidents.

2.3.1.3 ANSI/ANS-S.5-1996. Use of Borosilicate-Glass Raschig Rings as a Neutron Absorber in Solutions of Fissile Material describes the chemical and physical environment for usage, properties of the rings and packed vessels, maintenance inspection procedures, and criticality operating limits for solution systems containing 235U, 239pU, or 233U. 2.3.1.4 ANSI/ANS-S.6-19S3,R95. Safety in Conducting Sub critical Neutron-Multiplication Measurements in Situ provides safety guidance for conducting subcritical neutron-multiplication measurements where physical protection of personnel against the consequences of a criticality accident is not provided. 2.3.1.5 ANSI/ANS-S.7-199S. Guide for Nuclear Criticality Safety in the Storage of Fissile Materials provides mass and spacing limits for the storage of uranium containing greater than 30 wt % 235U, for 233U, and for plutonium as metals and oxides. 2.3.1.6 ANSI/ANS-S.9-19S7,R95. Nuclear Criticality Safety Criteria for Steel-Pipe Intersections Containing Aqueous Solutions of Fissile Materials provides criteria and data based on experiments and calculations applicable to homogeneous aqueous solutions. 2.3.1.7 ANSI/ANS-S.10-19S3,RSS. Criteria for Nuclear Criticality Safety Controls in Operations with Shielding and Confinement provides criteria for the prevention of nuclear accidents in facilities with shielding and confinement and a definition of the adequacy of the shielding and confinement required. DOE G 421.1-1 8-25-99 7 2.3.1.8 ANSI/ANS-8.12-1987,R93. Nuclear Criticality Control and Safety of Plutonium-Uranium Fuel Mixtures Outside Reactors provides single parameter limits for fissionable units of simple shape containing the three principal fissile nuclides. 2.3.1.9 ANSI/ANS-8.15-1981,R95. Nuclear Criticality Control of Special Actinide Elements provides single parameter limits for maintaining nuclear criticality safety of special actinide elements. 2.3.1.10 ANSI/ANS-8.17-1984,R97. Criticality Safety Criteria for the Handling, Storage, and Transportation of L WR Fuel Outside Reactors addresses LWR fuel rods and units outside reactor cores. 2.3.1.11 ANSI/ANS-8.19-1996. Administrative Practices for Nuclear Criticality Safety provides criteria for the administration of a nuclear criticality safety program for operations outside of reactors in which there exists a potential for criticality accidents. 2.3.1.12 ANSI/ANS-8.20-1991. Nuclear Criticality Safety Training provides criteria for the administration of a nuclear criticality safety training program for personnel who manage, work in, or work near facilities where the potential exists for a criticality accident outside of reactors, though it does not apply to the training of nuclear criticality safety staff. 2.3.1.13 ANSI/ANS-8.21-1995. Use of Fixed Neutron Absorbers in Nuclear Facilities Outside Reactors provides guidance for using fixed neutron absorbers integrally in nuclear facilities and fissionable material process equipment outside reactors to provide criticality safety control. 2.3.1.14 ANSI/ANS-8.22-1997. Nuclear Criticality Safety Based on Limiting and Controlling Moderators provides guidance for criticality safety by the limitation and control of moderators in the range from no moderation to optimum moderation for fissile materials. 2.3.1.15 ANSI/ANS-8.23-1997. Nuclear Criticality Accident Emergency Planning and Response provides guidance for minimizing risks to personnel during emergency response to a nuclear criticality accident outside reactors.

2.3.1.16 ANSI/ANS-10.3-1986. Guidelines for the Documentation of Digital Computer Programs presents guidelines for the documentation of digital computer programs prepared for scientific and engineering applications with the objective to facilitate effective selection, usage, transfer, conversion, and modification of computer programs. 2.3.1.17 ANSI/ANS-1 0.4-1987. Guidelines for the Verification and Validation of Scientific and Engineering Computer Programs for the Nuclear Industry provides guidelines for the verification and validation (V&V) of scientific and engineering computer programs developed for use by the nuclear industry with the objective to identify activities that will improve the reliability of scientific and engineering computer programs and reduce the risk of incorrect application. 2.3.1.18 ANSI/IEEE-Std-500-1984. IEEE Guide to the Collection and Presentation of Electrical, Electronic, Sensing Component, and Mechanical Equipment Reliability Data for Nuclear-Power Generating Stations provides data useful for performing equipment reliability analyses. 8 DOE G 421 .1-1 8-25-99 2.3.2 Industry Related Reference Documents. 2.3.2.1 ANS-9, GLOSSARY of Terms in Nuclear Science and Technology, American Nuclear Society Standards Subcommittee ANS-9 on Nuclear Terminology and Units, Harry Alter, Chairman, La Grange Park, Illinois, 1986. 2.3.2.2 LA-11627-MS, GLOSSARY of Nuclear Criticality Terms, Hugh C. Paxton, Los Alamos National Laboratory, Los Alamos, New Mexico, October 1989. 2.3.2.3 PNL-SA-4868, Rev. 5, Anomalies of Nuclear Criticality, E. D. Clayton, Pacific Northwest Laboratory, Richland, Washington, June 1979, provides discussions and explanations of deviations from commonly accepted rules of criticality behavior. 2.3.2.4 LA-3366 (Rev), Criticality Control in Operations with Fissile Material, H. C. Paxton, Los Alamos Scientific Laboratory, Los Alamos, New Mexico, November 1972, provides criticality data and makes them understandable in terms of simple reactor physics concepts to help develop intuition for conditions to be avoided during operations. 2.3.2.5 NUREG-0492, Fault Tree Handbook, U.S. Nuclear Regulatory Commission, January 1981, is a textbook on the fault tree technique for acquiring information about a system. 2.3.2.6 DOE/NCT--04, A Review of Criticality Accidents, William R. Stratton (revised by David R. Smith), Los Alamos National Laboratory, Los Alamos, New Mexico, March 1989, provides discussions of forty-one criticality accidents and the characteristics of their prompt power excursions. 2.3.2.7 Criticality and Fissionability Properties of Selected Actinide Nuclides, N. L. Pruvost, E. D. Clayton, and C. T. Rombough, Los Alamos National Laboratory, Los Alamos, New Mexico, to be issued, provides information concerning the nuclear properties of selected nuclides of the first ten of the fourteen actinide elements -- thorium through einsteinium. 2.3.2.8 LA-10860-MS, Criticality Dimensions of Systems Containing 235U, 239pU, and 233U, 1986 Revision, H. C. Paxton and N. L. Pruvost, Los Alamos National Laboratory, Los Alamos, New Mexico, July 1987, provides a compilation of critical data obtained from experiments performed during the period of 1945 through 1985, supplementing TID-7016 (paragraph 2.3.2.9 of this Guide). 2.3.2.9 TID-7016, Rev. 3, and LA-12808, Nuclear Criticality Safety Guide, Los Alamos National Laboratory, Los Alamos, New Mexico, September 1996, provides general guidance information related to nuclear criticality safety principles, experience, and practice.

LA-2063 (1956), and TID-7016 (1957), and TID-7016, Rev. 1 (1961), and TID-7016, Rev. 2 (1978), Nuclear Safety Guide, Los Alamos National Laboratory, Los Alamos, New Mexico, October 1996, have been reissued under a single cover as historical documents. 2.3.2.10 NUREG/CR-6504, Vols. 1 and 2 (and ORNL/TM-13322N1, V2),An Updated Nuclear Criticality Slide Rule, Oak Ridge National Laboratory, Oak Ridge, Tennessee, April 1997 (Vol. 1) and April 1998 (Vol. 2). DOE G 421.1-1 8-25-99 9 2.3.2.11 NEA/NSC/DOC(95)03/1-VII, International Handbook of Evaluated Criticality Safety Benchmark Experiments, Organization for Economic Cooperation and Development, Nuclear Energy Agency, Nuclear Science Committee, Paris, September 1998 (or most recent version). 2.3.3 Journal Articles, and Meetings and Conference Proceedings. A bibliography of technical journal articles and of technical meeting and conference proceedings relevant to nuclear criticality safety can be found in Appendix G. 10 DOE G 421.1-1 8-25-99 3. TERMS AND DEFINITIONS. The following provides terms and definitions used within this Guide. The word shall is used to denote a requirement, the word should to denote a recommendation, often of a higher level document, and the word may to denote permission, neither a requirement nor a recommendation, except when used in its other context, meaning contingency, i.e., possibility. A more general understanding of the roles of requirements and recommendations in this Guide can be obtained from paragraph 1.3, Section 5.2, and Appendix A. Phrases or words that are italicized are defined or listed elsewhere in the terms and definitions of this section. 3.1 ABSORBER, NEUTRON - A material with which neutrons significantly interact by reactions, resulting in their disappearance as free particles. 3.2 ABSORPTION, NEUTRON - A neutron-induced reaction, including fission, in which the neutron disappears as a free particle. The absorption cross section is designated as. See capture, neutron; cross section, neutron. 3.3 ACCIDENT, CREDIBLE - Those accidents with an estimated probability of occurrence > 10-6/year. 3.4 ACCIDENT, CRITICALITY (also NUCLEAR CRITICALITY ACCIDENT) - The release of energy as a result of accidentally producing a self-sustaining or divergent fission chain reaction. 3.5 ACCIDENT, DESIGN BASIS (DBA) - Accidents that are postulated for the purpose of establishing functional requirements for safety significant structures, systems, components, and equipment. 3.6 ALARM SYSTEM, CRITICALITY ACCIDENT (CAS) - A system capable of providing an immediate emergency evacuation alarm signal (usually audible but may be visible) after detecting (usually by the detection of gamma or neutron radiation, or both) a criticality accident. 3.7 ALBEDO, NEUTRON - The probability under specified conditions that a neutron entering into a region through a surface will return through that surface. 3.8 ALPHA PARTICLE - A 4He nucleus, usually emitted during a nuclear transformation. 3.9 ANALYSIS, NUCLEAR CRITICALITY SAFETY - The work products that contribute to the development of a nuclear criticality safety evaluation. In general, it is the technological term of art, "analysis," specifically applied to nuclear criticality safety. 3.10 AREA, ARCHIVE STORAGE - An area in a computer system's storage that contains copies of source and executable code for superseded versions of the software and the master copy of the source and the current executable version.

3.11 AREA, DEVELOPMENT STORAGE - An area in computer storage in which software is stored during development without the possibility of inadvertent production use. Upon completion of the software change, the software is transferred to the Migration Area. Access to this area is limited to that necessary for development. The Development Storage Area resides in the individual developer's computer space. DOE G 421.1-1 8-25-99 11 3.12 AREA, MIGRATION STORAGE - An area in computer storage in which software verification tests are performed in a simulated production environment. Upon completion of the verification testing and with the approval of the Software System team, the software is transferred to the Production Storage Area. Access to the Migration Storage Area is limited to that necessary for testing. 3.13 AREA, PRODUCTION STORAGE - An area in a computer storage from which the software is invoked by authorized software users. Only the current version of the software will be in the Production Storage Area, and only the system administrator and a designated back-up will have write access to this area if proper software quality assurance procedures are followed. 3.14 AREAL DENSITY - The total mass of fissionable material per unit area projected perpendicularly onto a plane. For an infinite, uniform slab, it is the product of the slab thickness and the concentration of fissionable material within the slab. 3.15 AREAS OF APPLICABILITY - The ranges of material compositions, geometric arrangements and other factors within which the bias and its corresponding uncertainty of a calculational method are established. 3.16 BARN - A unit of area used in expressing nuclear cross sections; 1 barn = 10-24 cm2. 3.17 Be/X - Conventionally, the atomic ratio of beryllium to 235U, 239pU, or 233U in a solution or mixture. Where there is more than one fissile species, the ratios are specified separately. 3.18 BETA PARTICLE - An electron, of either negative or positive charge, that has been emitted by an atomic nucleus or neutron in a nuclear transformation. 3.19 BIAS, CALCULATIONAL - A measure of the systematic disagreement between the results calculated by a method and experimental data. The uncertainty in the bias is a measure of both the precision of the calculations and the accuracy of the experimental data. See DOE Order 420.1, Section 4.3. 3.20 BIRDCAGE - A container and attached cage-like structure for maintaining a safe distance between a body of fissionable material and other objects (including other bodies of fissionable materia!), which, if brought too close, might give rise to criticality. 3.21 BUCKLING - The eigenvalue of the Helmholtz equation (either Bm2 or B/). Algebraic expressions can be used to relate material (Bm 2) or geometric (Bg 2) characteristics of critical, subcritical, or supercritical fissionable material systems. 3.22 BURST, PROMPT - Usually refers to the pulse or spike of energy from fissions produced by a prompt burst reactor. 3.23 C/X - Conventionally, the atomic ratio of carbon to 235U, 239pU, or 233U in a solution or mixture. Where there is more than one fissile species, the ratios are specified separately. 3.24 CALCULATIONAL METHOD - The mathematical equations, approximations, assumptions, associated numerical parameters, such as neutron cross sections, and calculational procedures that yield the calculated results. 12 DOE G 421.1-1 8-25r99

3.25 CAPTURE, NEUTRON - Neutron absorption not leading to fission or other neutron production. The capture cross section is designated Dc, See absorption, neutron; cross section, neutron. 3.26 CENT - A unit of reactivity equal to one-hundredth of the increment between delayed criticality and prompt criticality (a dol/ar). 3.27 CERTIFICATION - The process by which contractor nuclear facility management provides written endorsement of the satisfactory achievement of qualification of a person for a position. 3.28 CHAIN REACTION, NUCLEAR FISSION - A sequence of nuclear fission reactions in which the fissions are induced by neutrons emerging from preceding fissions. Depending on whether the number of fissions directly induced by neutrons from one fission is on the average less than, equal to, or greater than unity, the nuclear fission chain reaction is convergent (subcritica/), self­ sustaining (critica/), or divergent (supercritica/). 3.29 CODE, EXECUTABLE - The machine-language program that is the output after translation (compiling) and linking of the source code. 3.30 CODE, SOURCE - The original mnemonic or high-level statement versions of a program. The starting information or "source" from which the final "object" (machine language or executable code) is derived. 3.31 CONFIGURATION CONTROL TEST - Periodic testing of the production version of software to determine if unauthorized changes have occurred. 3.32 CONFIRMATION - The performance of audits, inspections, surveillance activities, and other assessments of compliance with regulatory or nuclear criticality safety program requirements, analysis/evaluation requirements, and other requirements. 3.33 CONSERVATISM - Simplifying approximations and assumptions in safety analyses and evaluations and their applications that increase the safety margin above the required minimum. 3.34 CONTAINER - See packaging. 3.35 CONTINGENCY - A credible but unlikely change in a conditionlcontrol important to the nuclear criticality safety of a fissionable material operation that would, if it occurred, reduce the number of barriers (either administrative or physical) that are intended to prevent a nuclear criticality accident. 3.36 CONTROL AREA, FISSIONABLE MATERIAL (FMCA) - Fissionable material operating or storage areas where physical and procedural controls are applied to maintain nuclear criticality safety. 3.37 CONTROL - The apparatus, processes, and mechanisms that, when manipulated, could affect the chemical, physical, metallurgical, or any other process of the nonreactor nuclear facility in such a manner as to affect nuclear criticality safety. 3.38 CONTROLLED DOCUMENT - A document whose content is maintained uniform by an administrative control system. DOE G 421.1-1 8-25-99 13 3.39 CONTROLS, ACTIVE-ENGINEERED - Those active means for ensuring nuclear criticality safety control methods. These means of control include active electrical, mechanical, and hydraulic hardware that sense a process variable important to nuclear criticality safety and provide automatic action to secure the system to a safe condition without requiring human intervention. 3.40 CONTROLS, ADMINISTRATIVE - Those administrative means for assuring nuclear criticality safety control methods. These means of control include organization and management, procedures, record keeping, assessment, and reporting necessary to ensure the nuclear criticality safety of a nonreactor nuclear facility.

3.41 CONTROLS, PASSIVE-ENGINEERED - Those means for ensuring nuclear criticality safety control methods that do not require human intervention or electrical or mechanical reaction to off­ specification conditions. These means of control take advantage of natural forces, such as gravity, physical chemistry limitations, and inherent physical characteristics, such as rigidity and structural integrity of cylindrical geometries, and limited compressibility of solids. These means of control include devices to prevent unsafe accumulations of fissionable material within a unit such as siphon breaks, filters, and pipe blanks between process vessels and spacing devices such as birdcages, racks, and stanchions between containers as well as fixed neutron poisons within vessels such as Raschig rings or between containers. 3.42 CORE - That part of a fissionable material system containing most or all of the fissionable material, as distinguished from a reflector. 3.43 CREDIBILITY - See credible. 3.44 CREDIBLE - Offering reasonable grounds for being believed on the basis of commonly accepted engineering judgment. 3.45 CRITICAL - Fulfilling the condition that a medium capable of sustaining a nuclear fission chain reaction has an effective multiplication factor, keff, equal to unity. (A nuclear reactor is critical when the rate of neutron production, excluding neutron sources whose strengths are not a function of fission rate, is equal to the rate of neutron loss.) 3.46 CRITICAL INFINITE CYLINDER - For a specified fissionable material and surrounding reflector, the infinitely long cylinder with a diameter that would be critical. 3.47 CRITICAL INFINITE SLAB - For a specified fissionable material and reflector on each surface, the slab of infinite lateral dimensions with a thickness that would be critical. 3.48 CRITICALITY ACCIDENT SCENARIO, POTENTIAL - A credible sequence of events that could lead to a criticality accident, which starts with an initiating event, such as a process upset, valving error, pluggage of a line, andlor operator error, followed by events involving failure or loss of criticality safety control (preventive) measures. Each potential criticality accident scenario represents a single path of events leading to a criticality accident, and all scenarios together encompass the total probability of criticality accident thereby permitting the evaluation of total risk in the facility. 3.49 CRITICALITY SAFETY, NUCLEAR (NCS) - Protection against the consequences of an inadvertent nuclear fission chain reaction, preferably by preventing the reaction. 14 3.50 CRITICALITY - The condition of being critical. DOE G 421.1-1 8-25-99 3.51 CROSS SECTION (0), NEUTRON MICROSCOPIC - A measure of the probability of a specified interaction between an incident neutron and a target particle or system of particles. It has the dimension of area and may be visualized as the area normal to the direction of an incident particle, which has to be attributed to the target particle to account geometrically for its interaction with the incident particle. It is commonly expressed in barns. Such cross sections include but are not limited to neutron capture (oc), fission (0,), neutron scatter (as), and neutron absorption (as). 3.52 CROSS SECTION (I), NEUTRON MACROSCOPIC - For a pure nuclide, it is the product of the neutron microscopic cross section for a particular reaction and the number of target nuclei per unit volume, giving it units of inverse length; for a mixture of nuclides, it is the sum of such products.

3.53 D/X - Conventionally, the atomic ratio of deuterium to 235U, 239pU, or 233U in a solution or mixture. Where there is more than one fissile species, the ratios are specified separately. 3.54 DECAY, RADIOACTIVE - A spontaneous nuclear transformation in which particles or gamma radiation is emitted, in which x-radiation is emitted following orbital electron capture, or in which the nucleus undergoes spontaneous fission. 3.55 DELAYED CRITICALITY - State of a fissionable material system such that the multiplication factor, k"ff' equals 1 as the steady-state condition. 3.56 DELAYED NEUTRONS - Neutrons emitted when the beta-decay of a fission product leads to a sufficiently highly excited state in the daughter nucleus that neutron emission is energetically possible. The time delay, relative to emission of prompt neutrons, is from somewhat less than 1 second to about 60 seconds. 3.57 DESIGN FEATURES - Active or passive features that are necessary to prevent, or reduce the probability of, a criticality accident. 3.58 DETECTION SYSTEM, CRITICALITY ACCIDENT (CDS) - A criticality accident detection system (usually gamma or neutron, radiation detection, or both) without an immediate emergency evacuation alarm, the purpose of which is to provide sufficient response time to allow for appropriate process-related mitigation, recovery actions, and possible delayed evacuation alarm if radiation exposures could be effectively limited by such actions. 3.59 DOABLE - A doable condition or instruction is one that is capable of being obeyed or performed, respectively. That is, a fissionable material operation, storage, or transport condition, limit, specification, instruction, etc. that can be measured or evaluated, and proper responses taken to obey the condition or properly perform the instruction. 3.60 DOLLAR - A unit of reactivity equal to the increment between delayed criticality and prompt criticality for a fixed chain reacting system. 3.61 DOSE, PROMPT - The total neutron and gamma dose imparted from the first burst resulting from a criticality accident. 3.62 DOUBLE-CONTINGENCY ANALYSIS - A double-contingency analysis is an analysis of potential criticality accident scenarios for the purpose of demonstrating compliance with the DOE G 421.1-1 8-25-99 15 double-contingency principle (application) by identifying appropriate barriers and means of control (see paragraph 5.6.1). This is typically an element of a Nuclear Criticality Safety Evaluation. 3.63 DOUBLE-CONTINGENCY PRINCIPLE (APPLICATION) - Process designs shall incorporate sufficient factors of safety to require at least two unlikely, independent, and concurrent changes in process conditions before a criticality accident is possible. Protection shall be provided by either (i) the control of at least two independent process parameters -- which is the approach that is completely consistent with the Double Contingency Principle as stated in ANSI/ANS-8.1-1998 and which, when practical, is the approach preferred by DOE to be taken to prevent common-mode failure, or (ii) a system of multiple controls on a single process [nuclear] parameter, which shall be the alternative approach to be taken only when the preferred approach is shown to be impractical. The number of controls required upon a single controlled process parameter shall be based upon control reliability and any features that mitigate the consequences of control failure. In all cases, no single credible event or failure shall result in the potential for a criticality accident, except where single contingency operations are permissible, as presented in paragraph 5.1 of ANSI/ANS-8.1 0- 1983,R88. This exception applies to operations with shielding and confinement (e.g., hot cells or other shielded facilities). Double contingency shall be demonstrated by documented evaluations.

3.64 EVALUATION, NUCLEAR CRITICALITY SAFETY (NCSE) - A documented process that demonstrates, by establishing and providing subcritical operating values, the nuclear criticality safety of any part of, or process in, a nonreactor nuclear facility that contains fissionable material. The evaluation provides sufficient descriptions of the facility equipment, fissionable material processes, and operational controls to identify the normal and contingent abnormal operating conditions of the facility. The evaluation contains the technical computational or comparative nuclear criticality safety analysis information that provides the bases of subcritical operating values for the normal and abnormal (contingent) conditions of facility operations or processes. Guidelines for preparing NCSEs are discussed in DOE-STD-3007-93 (paragraph 2.1.19 of this Guide). 3.65 EVENT. ANTICIPATED - Events with an estimated probability of occurrence between 1/year and 1 0-2/year . These events are of moderate frequency and may occur once or more during the lifetime of a facility. 3.66 EVENT. CREDIBLE - Events with an estimated probability of occurrence greater than 10-6 /year. 3.67 EVENT. EXTREMELY UNLIKELY - Events with an estimated probability of occurrence between 10-4/year and 10-6/year. These events are not expected to occur in the lifetime of a facility. 3.68 EVENT. INCREDIBLE - Events with an estimated probability of occurrence less than 10-6 /year. These events are considered to be of extremely low probability of occurrence or non-mechanistic hypothetical events. 3.69 EVENT. UNLIKELY - Events with an estimated probability of occurrence between 10-2/year and 1 0-4/year . These events are not expected but may occur during the lifetime of a facility. 3.70 EXCURSION. NUCLEAR - An episode during which the fission rate of a supercritical system increases. peaks. and then decreases to a low value. Also. see accident, criticality. 16 DOE G 421.1-1 8-25-99 3.71 EXCURSION PERIOD (T) - The reciprocal coefficient of time (t), where fission power in a nuclear excursion increases as eitlTl before a quenching mechanism becomes effective. 3.72 EXCURSION, PROMPT POWER - A nuclear excursion as the result of configuring fissionable material to achieve prompt criticality. In general, a sharp power spike followed by a plateau that may be interrupted by smaller spikes. 3.73 EXERCISE, TABLE-TOP - An event in which re-entry, rescue, etc. actions are simulated that test the emergency management's capability to cope with a nuclear criticality accident. 3.74 EXPONENTIAL COLUMN - A subcritical block or cylinder of fissionable material with an independent neutron source at one end. Under appropriate conditions, the response of a neutron detector decreases exponentially with distance from the source. From the logarithmic rate of this decrease and lateral dimensions of the column, critical dimensions of an unreflected assembly of the material may be deduced. 3.75 EXPOSURE - A measure of the ionization produced in air by x-rays or gamma radiation; the sum of electric charges on all ions of one sign in a small volume of air when all electrons liberated by photons are completely stopped, per unit mass of the air. Note that exposure refers to the environment, not absorbing material. The unit of exposure is the roentgen. Alternatively, exposure is the incidence of radiation on living or inanimate material.

3.76 FACILITY, NON REACTOR NUCLEAR - An operational area (e.g., building, holding, storage, or disposal area) dedicated to activities or operations (handling, storing, or transporting) that involve radioactive or fissionable materials, or both, in such form and quantity that a nuclear hazard potentially exists to the employees or the general public. Included are activities or operations that 1 . produce, process, or store radioactive liquid or solid waste, fissionable materials, or tritium; 2. conduct separations operations; 3. conduct irradiated andlor fissionable materials inspection, fuel fabrication, decontamination, or recovery operations; 4. conduct fuel enrichment operations; or 5. perform environmental remediation or waste management activities involving radioactive materials. Incidental use and generation of radioactive materials in a facility operation (e.g., check and calibration sources, use of radioactive sources in research and experimental and analytical laboratory activities, electron microscopes, and x-ray machines) would not ordinarily require the facility to be included in this definition. Accelerators and reactors and their operations are not included. 3.77 FAVORABLE GEOMETRY - Geometric constraint of fissionable material in which sub criticality is maintained under anticipated conditions. Examples are limited diameter of pipes intended to contain fissile solution, or limited volumes of solution containers. 3.78 FISSIBLE NUCLIDE - A nuclide that cannot sustain a nuclear fission chain reaction with slow neutrons but is only capable of sustaining a nuclear fission chain reaction by interaction with fast neutrons, provided the effective fast neutron production cross section (VO,) exceeds the effective fast neutron absorption cross section (0.). Such nuclides include 231Pa, 234U, 237Np, 238pU, 240pU, 242pU, 241Am, 243Am, 244Cm, 248Cm, 250Cf, and 252Cf. DOEG421.1-1 8-25-99 17 3.79 FISSILE NUCLIDE - A nuclide capable of sustaining a fission chain reaction by interaction with slow neutrons, provided the effective neutron production cross section (vat) exceeds the effective absorption cross section (a .. ). Such nuclides include 232U, 233U, 235U, 239pU, 241pU, 242mAm, 243Cm, 245Cm, 247Cm, 249Cf, 251Cf, and 254Es. 3.80 FISSION, NUCLEAR - The division of a heavy nucleus into two (or, rarely, more) parts with masses of equal order of magnitude, usually accompanied by the emission of neutrons, gamma radiation, and, rarely, small charged nuclear fragments. Although some fissions take place spontaneously, neutron-induced fissions are of major interest in criticality safety. The neutron fission cross section is designated at, and v is the number of neutrons emitted per fission. 3.81 FISSION PRODUCTS - Nuclides produced by nuclear fission or by the subsequent radioactive decay of nuclides formed in this manner. 3.82 FISSION, SPONTANEOUS - Nuclear fission that occurs without the addition of particles or energy to the nucleus. 3.83 FISSION YIELD. EXCURSION - The total number of fissions in a nuclear excursion. 3.84 FISSIONABLE EQUIVALENT MASS (FEM) - That gram mass of a fissionable material having the same mass ratio to its minimum critical mass as that mass ratio of a different fissionable material gram mass to its minimum critical mass. For example, given materials x and y having minimum critical masses of mex and mey, the FEM mass of x, mx' is directly proportional to the grams of y, my, times the minimum critical mass of material x divided by the minimum critical mass of material y (i.e., mx = [my • mexllmey). The FEM enables comparison of a quantity of one fissionable nuclide to a quantity of a second, or reference, fissionable nuclide based on their minimum subcritical mass limits. If more than one nuclide is present, their FEMs (in terms of the reference) can be summed.

3.85 FISSIONABLE MATERIAL - A material of any nuclides capable of sustaining a nuclear fission chain reaction. For nuclear criticality safety purposes, such materials are composed of fissionable nuclides but may include nonfissionable nuclides. Such material may be fissionable material only by virtue of its form, configuration, and environment. That is: natural uranium as mined, processed, and transported in bulk form is not fissionable material; however, natural uranium as fabricated into reactor fuel element pellets or rods may be considered as fissionable material if handled in a processing or operating environment where the pellets or rods could be adequately moderated to create a critical system. This definition is intended strictly for this Guide. 3.86 FISSIONABLE MATERIAL HANDLER - An individual officially designated by installation management to manipulate or handle significant quantities of fissionable materials, or manipulate the controls of equipment used to produce, process, transfer, store, or package significant quantities of such fissionable materials. 3.87 FISSIONABLE NUCLIDE - Any nuclide capable of undergoing neutron induced fission. For nuclear criticality safety purposes, such nuclides include the fissile or fissible nuclides but may also include nuclides such as 227 Ac, 228Th, 229Th, 230Th, 232Th. 233Pa, 236U, 238U, and 239Np. 3.88 GAMMA RADIATION - Short-wavelength electromagnetic radiation emitted in the process of nuclear transition or particle annihilation. 18 DOE G 421.1-1 8-25-99 3.89 GEOMETRY CONTROL - Physically controlling the shape, dimensions, and configuration of fissionable material or of equipment containing fissionable material to maintain such systems safely subcritical. 3.90 GRADED APPROACH - A process of performing a nuclear criticality safety evaluation that acknowledges different levels of effort and documentation are appropriate for different complexities of fissionable material operations and the associated methods and controls applied to maintain subcriticality and safety. 3.91 GRAY - A unit of absorbed dose; 1 Gy = I J/kg = 100 rad. 3.92 GUIDES, PROTECTIVE ACTION (PAGs) - The projected radiological doses or dose commitment values to individuals in the general population that warrant protective action following a release of radioactive material. Protective actions would be warranted provided the reduction in individual dose expected to be achieved by carrying out the protective action is not offset by excessive risks to individual safety in taking the protective action. The PAG does not include the dose that has unavoidably occurred prior to the assessment. 3.93 H/X - Conventionally, the atomic ratio of hydrogen to 235U, 239pU, or 233U in a solution or hydrogenous mixture. Where there is more than one fissile species, the ratios are specified separately. 3.94 HAZARD - A source of danger (i.e., material, energy source, or operation) with the potential to cause illness, injury, or death to personnel or damage to a facility or to the environment (without regard for the likelihood or credibility of accident scenarios or consequence mitigation). "Potentially hazardous" is redundant. Note that a hazardous facility is not necessarily a high-risk facility. 3.95 HIGH ENRICHED URANIUM (HEU) - Uranium having isotopic contents of 235U or 233U greater than or equal to 20 weight percent. HEU generally refers to 93 weight percent 235U.

3.96 INCIDENT, NUCLEAR CRITICALITY SAFETY - A change in process condition or a loss of control beyond the evaluated process variances of the nuclear criticality safety analysis. 3.97 IN HOUR - A unit of reactivity that, when added to a delayed-critical system, would produce a period of one hour; now seldom used. 3.98 INSTALLATION, NONREACTOR NUCLEAR - A contractor-operated DOE site comprising one or more nonreactor nuclear facilities. 3.99 IONIZING RADIATION - Any radiation consisting of directly or indirectly ionizing particles, photons, or a mixture or both. X-rays and the radiations emitted in radioactive decay are examples. 3.100 IRRADIATION - Exposure to ionizing radiation. 3.101 k.". - See MULTIPLICATION FACTOR, EFFECTIVE. 3.102 k. - See MULTIPLICATION FACTOR, INFINITE. DOE G 421.1-1 8-25-99 19 3.103 LIMIT, UPPER SUBCRITICAL (USL) - The limiting value of system reactivity beyond which subcriticality cannot be ensured (e.g., keff). The upper subcriticallimit only allows for uncertainties in the calculations and experimental data used in its derivation. 3.104 LINEAR ENERGY TRANSFER (LET) - The average energy lost by an ionizing radiation per unit distance of its travel in a medium. A high LET is generally associated with protons, alpha particles, and neutrons, whereas a low LET is associated with x-rays, electrons, and gamma rays. 3.105 LOW ENRICHED URANIUM (LEU) - Uranium having isotopic contents of 235U or 233U less than 20 weight percent. LEU generally refers to ~5 weight percent 235U. 3.106 MAINFRAME COMPUTER - For purposes of this procedure, a computer in which file control is achieved by access rules within the operating system rather than by physical control of storage media. 3.107 MANAGEMENT, LlNE/PRODUCTION - The organizational unit that accepts the direct responsibility for, and exercises authority over, the application of nuclear safety to their operations. 3.108 MANAGER, FACILITY OPERATIONS - The person whose facility warrants nuclear criticality safety consideration and controls, and who should, therefore, accept responsibility for the day-to­ day nuclear criticality safety of his/her facility. 3.109 MANAGER, FUNCTIONAL SYSTEM - The person appointed to represent specific Nuclear Criticality Safety Departments in the development and implementation of software configuration control plans for defined software system(s). 3.110 MODEL - A representation of the actual physical parameters used in a calculation. 3.111 MODERATOR - A material which will reduce neutron energy by scattering neutrons without appreciable neutron capture. 3.112 MULTIPLICATION FACTOR, EFFECTIVE (k.,,) - Physically, the ratio of the total number of neutrons produced during a time interval (excluding neutrons produced by sources whose strengths are not a function of fission rate) to the total number of neutrons lost by absorption and leakage during the same interval. Mathematically (computationally), that eigenvalue number (Lagrange multiplier if defined as production-to-Ioss ratio) which, when divided into the actual mean number of neutrons emitted per fission in an assembly of materials, would make the calculated result for the nuclear chain reaction of that assembly artificially critical. 3.113 MULTIPLICATION FACTOR, INFINITE (kJ - The keffof an infinite uniform medium. 3.114 NEUTRON - An elementary particle having no electric charge, a rest mass of 1.67495 x 10-27 kg, and an average lifetime of 1000 s.

3.115 NEUTRON, EPITHERMAL - Neutron of kinetic energy greater than that of thermal agitation, often restricted to energies comparable to those of chemical bonds. 3.116 NEUTRON, FAST - Neutron of kinetic energy greater than 0.1 MeV but not more than a typical Maxwellian distribution with an average energy of about 1.9 MeV. 20 DOE G 421.1-1 8-25-99 3.117 NEUTRON, INTERMEDIATE - Neutron of kinetic energy equal to or greater than 0.1 eV and equal to or less than 0.1 MeV. 3.118 NEUTRON, SLOW - Neutron of kinetic energy less than about 0.1 eV. 3.119 NEUTRON, THERMAL - Neutrons in thermal equilibrium with the medium in which they exist. At room temperature the mean energy of thermal neutrons is about 0.025 eV. 3.120 NONFAVORABLE GEOMETRY - See favorable geometry. 3.121 NON FISSILE FISSIONABLE MATERIAL (see FISSIBLE) - Any composition of nuclides capable. of maintaining a nuclear fission chain reaction with fast neutrons only, provided the effective neutron production cross section (va,) exceeds the effective absorption cross section (as) of the composition. 3.122 NONFISSIONABLE MATERIAL - Any composition of nuclides incapable of maintaining a nuclear fission chain reaction with neutrons of any energy whereby the effective neutron production cross section (va,) is less than the effective absorption cross section (as) of the composition. This definition is intended strictly for this Guide. 3.123 NUCLEAR CRITICALITY ACCIDENT, PERCEIVED - Any presumed nuclear criticality accident as inferred from the observance of physical phenomena (e.g., temperature rises, over-pressures, or others) or the activation of alarm systems indicative of a criticality accident (examples that might be included are CAS, continuous air monitors, and area radiation monitors). 3.124 NUCLIDE - A species of atom characterized by its mass number, atomic number, and nuclear energy state. 3.125 OPERATION, FISSIONABLE MATERIAL - An operation using a significant quantity of fissionable material. An operation includes handling, storage, processing, and transportation. 3.126 PACKAGE - The packaging together with its fissionable material contents as presented for movement or storage. 3.127 PACKAGING - The assembly of components necessary to ensure compliance with specifications for safe containment, storage, and handling of fissionable materials. It may consist of one or more receptacles, absorbent materials, spacing structures, thermal insulation, radiation shielding, vehicle, tie-down systems, auxiliary equipment, and devices for cooling or absorbing mechanical shocks. 3.128 PARAMETER, NUCLEAR - Any physical property whose value affects the nuclear reactivity of a system. Nuclear parameters include the mass, density, and isotopic enrichment of fissionable material; the geometry, reflection, and interaction conditions of the system; and the moderation, composition, and neutron absorption characteristics of the fissionable material mixture and other system materials. 3.129 PARAMETER, PROCESS - Operating or processing variables directly or indirectly affecting nuclear parameters of fissionable materials. Such process parameters may include temperatures, pressures, flow rates, viscosity, elapsed times, heights, rotational velocities, electrical resistivity, electrical potential, electrical currents, pH, color, opacity, etc. DOE G 421.1-1 8-25-99 21

3.130 PEER - An individual who performs peer reviews (e.g., a Criticality Safety Organization member), who has at least equivalent qualifications and standing compared to, and who is independent of, one or more other individuals who perform specific original work. Independent, in this case, means not involved in the performance of the specific original work to be reviewed, to the extent practical, not the immediate supervisor of individuals who performed specific original work to be reviewed, and to the extent practical, having sufficient freedom from funding considerations to ensure that the work is impartially reviewed. 3.131 PEER REVIEW - A review process for appraising and reporting the acceptability of independent and original specific work of others. 3.132 POISON, NEUTRON - A nonfissionable neutron absorber, generally used for criticality control. 3.133 PROMPT BURST REACTOR - A device for producing nondestructive super-prompt-critical nuclear excursions. 3.134 PROMPT CRITICALITY - State of a fissionable material system such that the prompt­ neutron contribution to keff equals unity. 3.135 PROMPT NEUTRONS - Neutrons emitted immediately during the fission process. 3.136 PROTON - A stable elementary particle having a positive charge of 1.60219 x 10-19 coulomb and a rest mass of 1.67265 x 10-27 kg. 3.137 QUALITY FACTOR (QF) - The ratio of dose equivalent to absorbed dose. 3.138 QUENCHING MECHANISM - A physical process that limits an excursion spike. Examples are thermal expansion and microbubble formation in a solution. 3.139 RAD - A unit of radiation absorbed dose; 1 rad = 10-2 J/kg = 10-2 Gy of the medium. 3.140 RADIATION - In context of criticality safety, alpha particles, beta particles, neutrons, gamma rays, and combinations thereof. 3.141 RADIATION MONITOR - A detector to measure the level of ionizing radiation. A purpose may be to give information about dose or dose rate. 3.142 REACTIVITY - A parameter of a fissionable system that is proportional to 1 - 1/keff • Thus, it is zero if the system is critical, positive if the system is supercritical, or negative if the system is subcritical (see effective multiplication factor, keff). 3.143 REACTOR. NUCLEAR - A device in which a self-sustaining nuclear fission chain reaction can be maintained and controlled (fission "reactor," "pile," or "core"). 3.144 RECOVERY - Proposed, evaluated, analyzed, and implemented ameliorative or corrective actions to restore an intended degree of criticality safety. 3.145 REFLECTOR - Material outside a fissionable material system capable of scattering back to the system some neutrons that would otherwise escape. 22 DOEG421.1-1 8-25-99 3.146 REFLECTOR SAVINGS - The absolute difference between a dimension of the reflected core of a critical system and the corresponding dimension of a similar core that would be critical if no reflector were present. 3.147 REFLECTOR, SUPERNORMAL - Any material or combination of materials that offers greater neutron reflector effectiveness than an essentially infinite thickness of water (e.g., about 20 cm of water). 3.148 RELATIVE BIOLOGICAL EFFECTIVENESS (RBE) - A factor used to compare the biological effectiveness of absorbed radiation doses (i.e., rads or grays) because of different types of ionizing radiation; more specifically, it is the experimentally determined ratio of an absorbed dose of a radiation in question to the absorbed dose of a reference radiation required to produce an identical biological effect in a particular experimental organism or tissue. This term is used only in radiobiology, not instead of quality factor in radiation protection.

3.149 REM - A unit of dose equivalent (Roentgen Equivalent Man), replaced by the sievert. The sievert, however, has not appeared in the criticality accident literature. The dose equivalent in rems is numerically equal to the absorbed dose in rads multiplied by the quality factor, and any other necessary modifying factor. 3.150 RISK - The quantitative or qualitative expression of possible loss, usually expressed in dollars or fatalities per year or facility lifetime, that considers both the probability that a hazard will cause harm and the consequences of that event. Not to be confused with hazard. 3.151 ROENTGEN (R) - A unit of exposure; 1 R = 2.58 x 10-4 C/kg in air, where C is coulombs. Strictly, the roentgen applies to x-rays or gamma radiation. 3.152 SAFETY BASIS - The combination of information relating to the control of hazards at a nuclear facility (including design, engineering analyses, and administrative controls), which demonstrates that the facility can be operated safely. 3.153 SHUTDOWN MECHANISM - See quenching mechanism. 3.154 SIEVERT (Sv) - A unit of dose equivalent; 1 Sv = 1 J/kg = 100 rem. 3.155 SIGNIFICANT QUANTITY - The minimum quantity of fissionable material for which control is required to maintain subcriticality under all normal and credible abnormal conditions. 3.156 SITE - See installation, nonreactor nuclear. 3.157 SOFTWARE CATALOG - A list of all software units in operation in a stated software system used for nuclear criticality safety evaluations. It identifies each software unit and states the version approved for use as of a stated date (ordinarily, the date of issue of the catalog). The access control and the scope of the software catalog are determined by the software system team. 3.158 SOFTWARE CONFIGURATION CONTROL - The systematic evaluation, coordination, modification, verification, implementation, and documentation of software. DOE G 421.1-1 8-25-99 23 3.159 SOFTWARE DEVELOPER(S) - The individual(s) responsible for the actual design or modification, or both, of the software. 3.160 SOFTWARE REQUESTOR - The organization for which software is developed and which is responsible for the software requirements definition. 3.161 SOFTWARE SYSTEM - A group of related programs and data which act in concert toward a particular purpose, has a common developing organization, and is suitable for a single set of control mechanisms. 3.162 SOFTWARE SYSTEM TEAM - The persons responsible for the software configuration control. 3.163 SOFTWARE - The instructions that determine and define the operation of an electronic computer or computer system. 3.164 SOFTWARE USER - An organization or person who uses the software. 3.165 SPECIALIST, COGNIZANT NUCLEAR CRITICALITY SAFETY - The qualified nuclear criticality safety specialist who is knowledgeable of specific facility operations, processes, and equipment, and who is assigned by installation management to manage, or to provide directly, nuclear criticality safety analyses, computations, evaluations, reviews, or audits of designs and operations for a specified nonreactor nuclear facility. 3.166 SPECIALIST, NUCLEAR CRITICALITY SAFETY (NCSS) - A professional person who is knowledgeable of nuclear criticality safety issues relevant to facility operations, processes, and equipment, and who is assigned by installation management to provide nuclear criticality safety analyses, computations, evaluations, reviews, or audits of designs and operations for nonreactor nuclear facilities.

3.167 SPIKE (IN A PROMPT-POWER EXCURSION) - The initial power pulse of a prompt-power excursion, limited by the shutdown mechanism. 3.168 STORAGE (Also "External storage") - A portion of a computer system where software and data are stored. Typically, storage is on magnetic disks, but other media may be used where appropriate. Storage may be on-line or off-line (external) to the computer operating system. 3.169 SUBCRITICAL - See nuclear fission chain reaction. 3.170 SUPERCRITICAL - See nuclear fission chain reaction. 3.171 SYSTEM ADMINISTRATOR - An individual responsible for the control of software for a defined software system, including issuance, revision, documentation, and archiving. 3.172 UNCERTAINTY - Lack of absolute precision, accuracy, or sureness of actions characteristic of measurements of data, approximations of results, or execution of procedures. 3.173 URANIUM ENRICHMENT (ENRICHMENT) - The weight percentage of 235U in uranium, provided that percentage exceeds its natural value; if the reference is to enhanced 233U content, n233U enrichment" should be specified. 24 DOEG421.1-1 8-25-99 3.174 VALIDATION. CALCULATIONAL METHOD - The establishment of the bias and calculational uncertainty in the results produced by the combination of the computer software, computer hardware, the data libraries, such as neutron cross sections, and the modeling method employed. The bias is established by correlating the results of criticality experiments with results obtained for these same systems by the method being validated. Commonly the correlation is expressed in terms of the values of kef( calculated for the experimental systems, in which case the bias is the deviation of the calculated values of kef( from the experimentally determined value. However, other parameters may be used. The bias serves to normalize a method over its areas of applicability so that it will predict critical conditions within the limits of the uncertainty in the bias. Generally, neither the bias nor its uncertainty is constant; both should be expected to be functions of composition and other variables. NOTE: Validation is not a required part of a verification test. 3.175 VERIFICATION. SOFTWARE CONFIGURATION CONTROL - The periodic execution of software to determine if unauthorized and undocumented changes thereto have been made. 3.176 VERIFICATION TEST - The testing of new or revised software stored in the migration storage area before the software is transferred into the production storage area. It is coordinated by the software system team assisted by the developer and others as required to test the unit integration, qualification, and acceptance of the software. The extent of the verification test is determined by the software system team based on the magnitude of the change and the consequences of a software failure in service. 3.177 X-RAY - Electromagnetic radiation of wavelength in the range 10-10 cm to 10-6 cm emitted from outside the nucleus. DOE G 421.1-1 8-25-99 25 4. GENERAL GUIDANCE. The DOE Good Practices Program Guide establishes DOE nuclear criticality safety interpretation and guidance to assist in implementation of nuclear criticality safety (NCS) across the DOE complex. This document is not intended to contain an exhaustive compilation of nuclear criticality safety guidance for every situation. However, the document is intended to provide examples for the development of nuclear criticality safety procedures and manuals for DOE contractors. The choice to implement any part of this document is the responsibility of DOE contractor design, operating, technical support, and oversight organizational units, as applicable. The user of this document is expected to follow the precepts and conform to the requirements stated in paragraph 1.3.

4.1 APPLICABILITY. Applicability of this Good Practices Program Guide spans design, construction, operation, maintenance, and decommissioning of covered facilities. It is recognized that the design and as-built configuration of some existing facilities do not meet all of the good practices contained in this document because they were built prior to the development of certain DOE Orders. Where practicable, currently existing operations, systems, and facilities should be upgraded considering the guidance provided by this document. The practicability of such upgrades should consider the cost versus the benefits. 4.2 INTERPRETATION OF THE GOOD PRACTICES PROGRAM GUIDE. The Office of Nuclear Safety Policy and Standards (USDOE Headquarters Environment, Safety and Health - EH-31) is the cognizant organization responsible for the preparation, maintenance, and interpretation of this document. 4.3 MAINTENANCE OF THE GOOD PRACTICES PROGRAM GUIDE. Maintenance and revision of this document shall be in accordance with DOE Order 1300.2A, "Department of Energy Standards Program." 4.4 DOCUMENT ARCHITECTURE. The remainder of the document consists of Detailed Guidance and related appendices. 4.4.1 Topical Structure. The order of presentation of topics proceeds from the general (e.g., administrative topics) to the particular (e.g., criticality safety, and other topic details). More specifically: Sections 5.1, 5.2, and 5.3 discuss administrative topics relating to management (5.1)' qualifications (5.2), and criticality safety procedural matters (5.3); Sections 5.4 and 5.5 discuss the mitigative topics of alarm systems (5.4) and emergency preparedness (5.5); Sections 5.6, 5.7, 5.8, and 5.9 discuss technical topics relevant to prevention of inadvertent criticality, including controls (5.6), design and analysis (5.7), computations (5.8), and evaluations (5.9). 4.4.2 Content Structure. The Detailed Guidance (Section 5) begins with Administration (Section 5.1). This is followed by Personnel Selection, Qualification, Training, and Staffing Program (Section 5.2), serving as a brief introduction to Appendix A 26 DOE G 421.1-1 8-25-99 which bears the same title as Section 5.2 but which contains a detailed discussion of the topic. Following this is Operating. Storing. and Transferring - Plans. Procedures. Requirements. and Controls (Section 5.3). The Detailed Guidance continues with Criticality Accident Alarm and Detection Systems (Section 5.4); and this is followed by a brief discussion of the closely related topic Emergency Preparedness (Section 5.5). The Detailed Guidance continues, more extensively, with Nuclear Criticality Safety Control Principles and Methods (Section 5.6), supplemented by Appendix B, Graded Approach to Nuclear Criticality Safety, and this is followed, in an even more extensive form, by Nuclear Criticality Safety Design and Analysis Guidelines (Section 5.7) where and Appendix C, Estimating the Waiting Time Until the Simultaneous Collapse of Two Contingencies, Appendix 0, Examples of Design of Nuclear Criticality Safety Controls, are referenced for additional details. The Detailed Guidance concludes briefly, initially with Software Quality Assurance and Validation (Section 5.8), which references Appendix E, Software Configuration Control Procedure, and Appendix F, Example Computational Technique Validations, DOE G 421 .1-1 8-25-99 for additional details, and finally with Nuclear Criticality Safety Evaluation {NCSEI Guidelines (Section 5.9).

The entire document concludes with 27 Appendix G, Bibliography of Journal Articles and Meeting and Conference Proceedings. 4.4.3 Section and Paragraph Numbering. In this document, those text units that are specifically numbered 1, 2, 3,4, 5, 5.1, 5.2, 5.3, 5.4, 5.5, 5.6, 5.7, 5.8, and 5.9 are called "Sections" (capitalized word). All other numbered text units (viz., 2.1.13, 3.1, 5.6.3) are called "paragraphs" (uncapitalized word). Either "section" or "paragraph" (uncapitalized words) is used to designate any text unit not expressly numbered. 28 DOE G 421.1-1 8-25-99 5. DETAILED GUIDANCE. 5.1 ADMINISTRATION. Nuclear criticality safety is administered at contractor installations by assigning responsibilities for key nuclear criticality safety requirements and activities. The following position titles and organizations are identified for the purpose of describing key position responsibilities in the administration of a nuclear criticality safety program at an installation. 5.1.1 Contractor President/Chief Executive Officer. The Contractor Installation(s) Corporation/Company President (CEO), through Installation Manager(s), shall' accept overall responsibility for the installation(s) nuclear criticality safety program in a way that demonstrates a continuing interest in safety. This objective should be met by documenting how the following elements of the nuclear criticality safety program are met: 5.1.1.1 Responsibility. Specific responsibilities for the nuclear criticality safety of operations and commensurate authority shall be clearly established. The performance of these responsibilities shall be reviewed on a periodic basis (noting nuclear criticality safety related occurrences, limit­ violations, commendable practices, and others), assigning importance to nuclear criticality safety commensurate with the other aspects of management.2 5.1.1.2 Policy. The corporate/company-level policy for implementing nuclear criticality safety requirements shall be made known to all contractor employees involved in operations with fissionable material through written company policies. 3 5.1.1.3 Organization. Corporate/company-level organizations shall be established as necessary to (1) ensure that supervision is made as responsible for nuclear criticality safety as for production, development, research, or other functions, and (2) to ensure that a Criticality Safety Organization, staffed with personnel skilled in the interpretation of data pertinent to nuclear criticality and familiar with operations, serves as advisors to supervision. The Criticality Safety Organization, to the extent practicable, should be administratively independent of process supervision and be assigned in a manner compatible with that for other safety disciplines.4 5.1.1.4 Program Oversight. A means to periodically evaluate the effectiveness of the nuclear safety program shall be established and corporate/company-level management shall participate in that evaluation.5 An Installation Nuclear Criticality Safety Review Committee (lNCSRC), reporting directly to 1 ANSI/ANS-8.19-1996, section 4.1. 2ANSI/ANS-8.1-1983,R88, section 4.1.1; and ANSI/ANS-8.19-1996, section 4.3. 3A NSI/ANS-8.1-1983,R88, section 4.1.1; and ANSI-8.19-1996, section 4.2. 4ANSI/ANS-8.1-1983,R88, section 4.1.1; and ANSI/ANS-8.19-1996, sections 4.3 and 4.4. 5ANSI/ANS-8.19-1996, sections 4.5 and 4.6. DOE G 421.1-1 8-25-99 29

corporate/company-level management, is one means that has been used to satisfy this requirement.6 The remainder of this document will assume INCSRCs are the means used to satisfy this requirement although there may be other means that are equally acceptable. An INCSRC should be responsible for fostering and monitoring nuclear criticality safety to include, in accordance with the reference in paragraph 2.1.17, an assessment of: (a) the nonreactor nuclear installation nuclear criticality safety program, (b) each nonreactor nuclear facility nuclear criticality safety program, (c) each installation nuclear criticality accident emergency preparedness program including the nuclear criticality accident alarm systems (CASs) and the nuclear criticality accident detection systems (CDSs) for compliance with detection criteria (paragraphs 5.4.1 and 5.4.2), and configuration control of the systems. 5.1.1.5 Corrective actions. Corrective actions resulting from the review process described in paragraph 5.1.1.4 should be promptly completed. 7 5.1.1.6 Resources. Installation(s) shall have adequate resources to maintain an effective NCS program including personnel skilled in the interpretation of data pertinent to NCS and familiar with operations to serve as advisors to supervision.s 5.1.1.7 Stop Work Policy. Provide corporation/company policy and assignment of "stop work" authority to relevant personnel within nonreactor nuclear facility installation staffs. 9 5.1.2 Facility Operations Managers. Facility Operations Managers, whose facilities warrant nuclear criticality safety consideration and controls, shall accept responsibility for the day-to-day nuclear criticality safety of their facility by addressing the following elements:'o 5.1.2.1 CAS Management. For facilities requiring CAS coverage, accept responsibility for, and ensure the administration of, a program for CAS management, including CAS availability and alarm circuit functioning within established limits; maintain a current copy of the CAS location analysis in facility files; and request additional CAS analysis as required by facility and process changes. 5.1.2.2 Procedures development and maintenance. Accept responsibility for preparation and maintenance of procedures (including special procedures as necessary) for facility operation that identify nuclear criticality safety steps/controls and drawings identifying equipment important to 6ANSI/ANS-8.19-1996, section 4.7. 7 ANSI/ANS-8.19-1996, section 4.1; and ANSI/ANS-8.1-1983,R88, section 4.1.5. 8ANSI /ANS-8.1-1983,R88, section 4.1.1; and ANSI/ANS-8.19-1996, sections 4.3 and 4.4. 9ANSI/ANS-8.1-1983,R88, section 4.1.5; and ANSI/ANS-8.19-1996, section 7.7. IOANSI/ANS-8.19-1996, section 5. 30 DOE G 421.1-1 8-25-99 criticality safety, and ensure the use of, and adherence to, such procedures in day-to-day operations. 5.1.2.3 Staff training. Maintain a program of staff training in both the general and facility-specific aspects of criticality safety. 5.1.2.4 Design and procedure reviews. Provide appropriately trained staff to determine when procedures (including special procedures), drawings, and design documents require nuclear criticality safety review, and ensure that such procedures, drawings, and design documents are forwarded to the Criticality Safety Organization for review. 5.1.2.5 Configuration control program. Provide that facility process and equipment configuration control programs that ensure proper nuclear criticality safety review, analyses, approval, and documentation occur prior to implementing or modifying any fissionable material operation within the facility.

5.1.2.6 Self-assessments. Ensure that facility self-audits are performed at least annually, and forward copies of such audit reports to their organization, the Criticality Safety Organization, and the Installation Nuclear Criticality Safety Review Committee (INCSRC). These audits shall ascertain that procedures exist for operations with fissionable materials, that procedures are being followed, and that procedures are consistent with the nuclear criticality safety basis for the operation." 5.1.2.7 Compliance. Accept responsibility for compliance with applicable DOE Orders, safety requirements, Technical Standards, and the nuclear criticality safety basis. Compliance should be documented by the self-audit process, Criticality Safety Organization operational reviews, INCSRC reviews, and other appraisal processes. 5.1.2.8 Audit response approval. Approve the response to NCS review, audit, and appraisal findings. 5.1.2.9 Safety documentation. Ensure that nuclear criticality safety aspects of facility design, construction, and operation are covered by a documented criticality safety analysis, and that operations are documented. 5.1.2.10 Contingency analysis documentation. Ensure that the facility is covered by documented double-contingency analyses. See paragraph 3.62. 5.1.2.11 Facility shutdowns. Accept responsibility for the safe shutdown of their facilities where warranted by actual or indicated criticality safety deficiencies. 5.1.2.12 Maintenance of NCS controls. Ensure that passive engineered, active engineered, and administrative nuclear criticality safety means of control are in place and functioning satisfactorily. 5.1.2.13 Fire safety plans. Accept responsibility for the development of a facility fire safety plan that recognizes, to the extent necessary, both fire safety and nuclear criticality safety considerations as specified in DOE Order 6430.1 A. These considerations should address the possible use of water or other moderator/reflector influences, the possibility of affecting the IIANSI/ANS-8.19-1996, section 7.8. DOE G 421.1-1 8-25-99 31 accumulation of fissionable material, and the required presence of fire fighters in the fissionable material operations area. 12 5.1.2.14 Operational postings. Establish and maintain nuclear criticality safety posting for the facility and labeling of fissionable materials.13 5.1.2.15 Delegation of responsibilities. Delegate nuclear criticality safety responsibilities to lower level facility supervision; however, overall responsibility for facility nuclear criticality safety remains with the facility manager. 5.1.2.16 Development of criticality accident evacuation routes. Ensure that criticality accident evacuation routes provide for timely facility evacuation, that facility changes do not unnecessarily impede or otherwise lengthen evacuation time, and that, to the extent practical, routes do not require personnel to approach potential sites of a criticality accident.14 5.1.2.17 Monitoring for process accumulations. Provide monitoring or surveillance, or both, to forewarn of unacceptable or unsafe accumulations of a significant quantity of fissionable materials in process equipment, storage areas, piping, and ventilation systems, thus permitting normal corrective actions. If unacceptable or unsafe accumulations of a significant quantity of fissionable materials are detected, corrective actions should be taken in conjunction with the area Criticality Safety Organization. 15

5.1.2.18 Facility access and other NCS controls. Provide other nuclear criticality safety features and administration as necessary to provide for the nuclear criticality safety of the facility, including personnel training, familiarization, and qualification for nonreactor nuclear facility access control of both assigned and incidental personnel. 5.1.3 Line/Production Management. Line/production management shall accept the direct responsibility for, and exercise authority over, the application of nuclear criticality safety to their operations by addressing the following program elements:16 5.1.3.1 Acceptance of authority and responsibility. Accept the authority and responsibility for nuclear criticality safety for facility operations under their control to include the implementation of nuclear criticality safety responsibilities as delegated by the contractor President. 5.1.3.2 Standards compliance. Ensure that applicable nuclear criticality safety standards and DOE requirements are applied in the design, modification, and operation of facilities under their control. Means to ensure that this requirement is met potentially include the use of configuration control 12ANSIIANS-8.1-1983,R88, section 4.1.7; and ANSI/ANS-8.19-1996, section 9.5. 13ANSI/ANS-8.1-1983,R88, section 4.1.4; and ANSI/ANS-8.19-1996, section 9.2. 14ANSI/ANS-8.19-1996, section 10.3. 15DOE 420.1, Section 4.3. 16ANSI/ANS-8.19-1996, section 5. 32 DOE G 421.1-1 8-25-99 boards, design reviews, technical reviews, operational readiness reviews, self-assessments/audits, and training, as applicable. Auditable means for demonstrating such compliance should be provided. 5.1.3.3 Operational approvals. Ensure that all operations within the facility are approved by Line/Production Management based upon current nuclear criticality safety analyses and approvals as provided by the Criticality Safety Organization. 5.1.3.4 Staffing and training. Ensure adequacy of staffing and that personnel assigned to work in the facility are adequately trained in specific job tasks and qualified in the procedures for working safely with fissionable materials in accordance with the reference document in paragraph 2.3.1.12. 5.1.3.5 Configuration control. Establish and conduct a configuration control program to ensure that facility modifications to the structure, utilities, operations, or equipment therein that may affect nuclear criticality safety are approved. 5.1.3.6 Procedures. Conduct the testing, start up, operation, emergency control, and corrective/preventive maintenance of the facility in accordance with approved procedures. 5.1.3.7 Maintenance. Ensure that sampling, measurement and control instrumentation, and safety monitoring capabilities are provided and maintained operational. 5.1.3.8 Self-audit. Report, investigate, and document unplanned events and unusual occurrences in accordance with DOE 0 232.1, formerly DOE Order 5000.3B. 5.1.3.9 Emergency planning. Participate in, and concur with, planning for emergency response to fires and criticality accidents. 5.1.3.10 Documentation. Ensure that applicable nuclear criticality safety files are maintained, for example: • operational and equipment approvals, • technical specifications, • auditable records of modifications, • operating reviews, • procedure reviews, • maintenance, • internal audit program, and • internal training.

5.1.3.11 Notifications. Notify the Criticality Safety Organization if any building or process modifications are planned that could interfere with the performance of a CAS, could require a change in the location of a detector, could require any additions to the CAS, or could otherwise affect the system. 5.1.3.12 Review requests. Bring matters requiring INCSRC review to the attention of the Committee, and solicit the Committee's guidance regarding cases where the need for Committee review is uncertain. DOE G 421.1-1 S-25-99 33 5.1.3.13 Delegation of authority and assignment of responsibilities. Delegate the authority and assign the responsibility for the day-to-day nuclear criticality safety of operations at an installation to First Line Supervision. In this regard, Line/Production Management should review the performance of First Line Supervision with respect to nuclear criticality safety on an annual basis (noting nuclear criticality safety related occurrences, limit violations, commendable practices, and others), assigning importance to nuclear criticality safety commensurate with the other aspects of process operations. 5.1.4 First Line Supervision. The First Line Supervision implements safety related responsibilities that are delegated by upper management and has further responsibilities to: 17 5.1.4.1 Responsibility. Accept responsibility for the nuclear criticality safety of operations under their control. 18 5.1.4.2 Training. Be knowledgeable in those aspects of nuclear criticality safety relevant to operations under their control as required by corporation/company training procedures for compliance with the applicable document. 19 5.1.4.3 Provision of training. Ensure that nuclear criticality safety training is provided to personnel under their control in accordance with corporation/company training procedures for compliance with the applicable document and require that these personnel have procedures and operating conditions necessary to perform their functions without undue risk. Records of training activities and verification of personnel understanding shall be maintained.20 5.1.4.4 Procedural development. Develop, or participate in the development of, written procedures applicable to the operations under their control. Maintenance of these procedures to reflect changes in operation should be a continuing supervisory responsibility.21 5.1.4.5 Safety practices. Require conformance with good safety practices including unambiguous identification of fissionable materials and good housekeeping.22 5.1.4.6 Operational reviews. Review all proposed new operations, facility modifications, and process and equipment changes involving significant quantities of fissionable material or nuclear criticality safety. Verify compliance with nuclear criticality safety specification for new and modified equipment prior to its use. 17 ANSI/ANS-S.19-1996, section 5. 18ANSI/ANS-S.19-1996, section 5.1. 19ANSI/ANS-S.19-1996, section 5.2. 20ANSI/ANS-S.19-1996, section 5.3. 21ANSI/ANS-S.19-1996, section 5.4. 22ANSI/ANS-S.19-1996, section 5.6. 34 DOE G 421.1-1 B-25-99 5.1.4.7 Operational approvals. Ensure that all operations within the facility are approved by Line/Production Management based upon current nuclear criticality safety analyses and approvals as concurred by the Criticality Safety Organization. 5.1.4.B Process monitoring. Monitor operations to verify compliance with nuclear criticality safety requirements.

5.1.4.9 Recovery and deviation evaluations. Evaluate all criticality safety specification or procedural limit violations and deviations, and concur with proposed recovery and corrective actions except for emergencies requiring immediate response. 23 5.1.4.10 Labeling and posting. Ensure that appropriate material labeling and area posting are maintained, specifying material identification and all operational/process limits on parameters that are subject to procedural control. Refer to paragraph 2.1.B for posting and labeling details. Posted operational and/or process limits are to be doable by fissionable material handlers.24 5.1.4.11 Access control. Access to areas where fissionable material is handled, processed, or stored shall be controlled. 25 5.1.5 Fissionable Material Operations Personnel. All personnel working with fissionable material shall: 5.1.5.1 Responsibility. Be responsible for nuclear criticality safety of their own actions and the operating systems under their control. 26 5.1.5.2 Operational procedures. Conduct fissionable material operations in strict accordance with approved written procedures and instructions. 27 5.1.5.3 Terminate operations. In the event an unforeseen condition develops and a procedure does not correspond to the operating system, return operations to a known safe stopping point or stop performing the procedure and notify supervision.28 5.1.5.4 Inquiries. Ask supervision for additional training, guidance, instructions, or procedures when uncertain of the nuclear criticality safety of job tasks involving fissionable materials. 23ANSI/ANS-B.1-19B3,RBB, section 4.1.7. 24ANSI/ANS-B.1-1983,RB8, section 4.1.4; and ANSI/ANS-8.19-1996, sections 9.2 and 7.6. 25ANSI/ANS-B.19-1996, section 9.4. 26ANSI/ANS-B.1-1983,RBB, section 4.1.1. 27ANSI/ANS-8.1-1983,R8B, section 4.1.3. 28ANSI/ANS-8.19-1996, section 7.7. DOE G 421.1-1 S-25-99 35 5.1.5.5 Training requirements. Complete and periodically update applicable nuclear criticality safety training in accordance with corporation/company procedures developed to comply with paragraphs 5.1.3.4 and 5.1.4.2 of this Guide. 5.1.5.6 Notification. Communicate information and concerns to co-workers and management as appropriate. 5.1.5.7 Emergency response. Know and follow emergency procedures. 5.1.6 Facilities Maintenance Organization. Through personnel NCS and facility access control training and use of a formal maintenance work permit program, the maintenance organization should ensure that any engineered criticality safety controls have been identified and will not be disturbed or inadvertently deactivated prior to performing work. The maintenance organizations should also verify with facility personnel that it is safe to perform work on an engineered criticality safety control prior to performing such work. 5.1.7 Engineering and Projects Organization (E&PO). The E&PO is responsible for the performance of oversight of design, procurement, and construction of facilities used for the processing, storage, or transport of fissionable material. 5.1.7.1 Responsibilities. E&PO should accept responsibilities in the area of nuclear criticality safety as delegated by the corporation/company President through corporation/company policies, procedures, and practices for nuclear criticality safety design control.

5.1.7.2 Design requirement compliance. In addition to those design responsibilities identified in paragraph 5.1.7.1, E&PO should comply with the nuclear criticality safety design requirements contained in DOE Order 6430.1 A and shall comply with the nuclear criticality safety requirements contained in DOE Order 420.1, Section 4.3 and the ANSI/ANS Standards referenced within DOE Order 420.1, Section 4.3. 5.1.8 Criticality Safety Organization. The Criticality Safety Organization accepts and implements responsibilities delegated by the corporation/company President and as described in corporation/company policies. These responsibilities shall, as a minimum and when applicable and appropriate, include: 5.1.S.1 Technical Direction. Technical direction consists of documenting the nuclear criticality safety program as policies and procedures to implement the elements of the ANSI/ANS standards specified in DOE Order 420.1, Section 4.3. a. ANSI/ANS-S.1-199S, "Nuclear Criticality Safety in Operations with Fissionable Materials Outside Reactors," except paragraphs 4.2.2 and 4.2.3, and paragraph 3.3; b. ANSI/ANS-S.3-1997, "Criticality Accident Alarm System," except paragraphs 4.1.2, 4.2.1, and 4.2; c. ANSIIANS-S.5-1996, "Use of Borosilicate-Glass Raschig Rings as a Neutron Absorber in Solutions of Fissile Materials"; d. ANSI/ANS-S.6-19S3,R95, "Safety in Conducting Subcritical Neutron-Multiplication Measurements in Situ," except paragraph 5.3; 36 e. f. g. h. i. j. k. I. m. DOE G 421.1-1 S-25-99 ANSI/ANS-S.7-199S, "Guide for Nuclear Criticality Safety in the Storage of Fissile Materials, n except paragraph 5.2; ANSI/ANS-S.9-19S7,R95, "Nuclear Criticality Safety Criteria for Steel-Pipe Intersections Containing Aqueous Solutions of Fissile Materials"; ANSI/ANS-S.1 0-19S3,RSS, "Criteria for Nuclear Criticality Safety Controls in Operations with Shielding and Confinement"; ANSI/ANS-S.12-19S7,R93, "Nuclear Criticality Control and Safety of Plutonium-Uranium Fuel Mixtures Outside Reactors"; ANSI/ANS-S.15-19S1,R95, "Nuclear Criticality Control of Special Actinide Elements"; ANSI/ANS-S.17-19S4,R97, "Criticality Safety Criteria for the Handling, Storage, and Transportation of LWR Fuel Outside Reactors," except paragraph 4.3; ANSI/ANS-S.19-1996, "Administrative Practices for Nuclear Criticality Safety"; ANSI/ANS-S.20-1991, "Nuclear Criticality Safety Training"; ANSI/ANS-S.21-1995, "Use of Fixed Neutron Absorbers in Nuclear Facilities Outside Reactors"; n. ANSI/ANS-S.22-1997, "Nuclear Criticality Safety Based on Limiting and Controlling Moderators"; o. ANSIIANS-S.23-1997, "Nuclear Criticality Accident Emergency Planning and Response." 5.1.S.2 Quality assurance. Maintain procedures to ensure that accurate nuclear criticality safety analyses for intended fissionable material operations are performed and documented and any identified required controls are implemented for those operations. Ensure that such documentation is consistent with the requirements of the reference in paragraph 2.1.17. 5.1.S.3 Criticality Safety Organization personnel qualifications. Establish criteria (see paragraphs 5.2.2, A.2 and 5.2.2, A.2) for qualifying Criticality Safety Organization staff and qualify and periodically ensure the qualifications of staff performing or reviewing topics such as (a) analyses of fissionable material process NCS event/fault-trees, (b) evaluations of NCS control effectiveness, (c) NCS evaluations, (d) NCS analyses,

(e) analyses of nuclear criticality accident alarm/detection system placement, (f) evaluations of nuclear criticality accident evacuation zones, DOE G 421.1-1 8-25-99 (g) audits of fissionable material processes and violation/procedural reviews, 37 (h) quality and configuration control of software and data sets used for NCS evaluations and for nuclear criticality accident alarm or detection system placement and evacuation zone evaluations, (i) accident or unusual occurrence investigations or root cause analyses, and (j) training for criticality safety. 5.1.8.4 Maintenance of familiarity. Maintain familiarity with (a) current and developing nuclear criticality safety standards and guides, (b) nuclear criticality safety computational codes to the extent that personnel need to use or interpret the codes or their results, and (c) all operations within the corporation/company installation that require nuclear criticality safety controls. Familiarity may be gained through a combination of reading, tours, training, inspections, calculations, and periodic assignments to a facility as appropriate. 5.1.8.5 Consultation. Provide consultation and technical guidance by a. advising corporation/company management of requirements relating to nuclear criticality safety and determining if the nuclear criticality safety program is consistent with this Guide, b. assisting in the development, review, and concurrence of operating procedures, and procedure changes affecting nuclear criticality safety, c. assisting and advising in equipment and process design, review, and concurrence in process and equipment changes affecting nuclear criticality safety, particularly passive engineered controls and active engineered controls, d. concurring in the approval of corporation/company-wide nuclear criticality safety related policies, procedures, manuals, and instructions written for conformance to regulations issued by organizations such as the U.S. Department of Energy (DOE), U.S. Department of Transportation (DOT), U.S. Nuclear Regulatory Commission (NRC) and the U.S. Code of Federal Regulations (CFR), e. assisting with formal nuclear criticality safety related communications between the corporation/company and external organizations such as in requests for exemptions or non-adherences to DOE Orders or other regulations, f. assisting in the development and execution of nuclear criticality safety training programs, and g. assisting in evaluation of unusual occurrences. 38 DOE G 421.1-1 8-25-99 5.1.8.6 Obtaining consultation. Obtain consultation with knowledgeable individuals to obtain technical assistance as needed. 5.1.8.7 Performing self-assessments and audits. Conduct or participate in installation self­ assessments or audits (at least annually) of nuclear criticality safety practices and compliance with procedures to ascertain that procedures are being followed and that process conditions have not been altered so as to affect the nuclear criticality safety of operations and the relevance of nuclear criticality safety evaluations to the operations. 29 5.1.8.8 Operational reviews. Perform walk-through inspections of facilities with nuclear criticality safety approvals. This walk-through may be done in conjunction with other facility audits, if implemented, and should include consideration of nuclear criticality safety practices and compliance with procedures. The frequency of such walk-throughs should be increased in relation to the potential for criticality accidents, degree of controls required, and level of activity ongoing, and should be specified by facility-, site-, or installation-specific procedure or policy documents. However, all such facilities should be inspected annually; facilities covered by a CAS should be inspected quarterly.

5.1.8.9 Procedural reviews. Review new or revised procedures affecting nuclear criticality safety. 5.1.8.10 Incident reviews. Review installation operating or procedural NCS incidents for root causes, possible improvement of safety practices, and procedural requirements; report findings to management. (See paragraph 2.1.14.) 5.1.8.11 Process event/fault tree analyses. Review and concur in, or, as trained, qualified, and requested by management, provide fissionable material process event/fault tree analyses in support of, nuclear criticality safety evaluations and analyses. 5.1.8.12 Quality and configuration control of software and data sets. Provide for software and data set verification, validation, and configuration control for criticality and radiation shielding computational methods used in nuclear criticality safety evaluations and, as applicable, for nuclear criticality accident alarm and detection system (CAS and CDS) placement evaluations. 5.1.8.13 NCS evaluations. Use quality controlled, configuration controlled, verified, and validated software and data sets; handbook techniques and data shown to be valid; or direct comparisons with critical and subcritical experiment data. Perform nuclear criticality safety evaluations to demonstrate technically the subcriticality of fissionable material processes, operations, and situations for transportation and storage under normal and credible abnormal conditions. 30 See Appendix B for discussion of a graded approach to NCS evaluations. 5.1.8.14 NCS analyses. Using results of a structured analysis process (e.g., process event/fault tree, HAZOP, what-if, human reliability, failure modes and effects, MORT) and NCS evaluations, perform and document nuclear criticality safety analyses for proposed new or modified fissionable material processes as requested by facility line/production management. The safety analyses shall contain information to demonstrate compliance with applicable requirements for the prevention of 29ANSI/ANS-8.19-1996, section 7.8. 30ANSI/ANS-8.1-1983,R88, section 4.3. DOEG421.1-1 8-25-99 39 inadvertent criticality and mitigation of consequences from a criticality accident. See Appendix B for discussion of a graded approach to NCS analyses. 5.1.8.15 NCS recovery actions. Respond to, and assist in, recovering from contingencies and any other discoveries that the basis for criticality safety is invalid by supplying advice and commenting on proposed actions in addition to performing and documenting NCS evaluations and analyses as described above. Initial advice should focus on whether it is necessary to declare an emergency, and if so, how to deal with the emergency. Generally, loss of all protection against criticality constitutes an emergency; exceptions include instances where shielding protects workers and equipment vital to safety against the dose consequences of a criticality accident. If the situation does not warrant declaring an emergency, advice should first focus on immediate or near term vulnerabilities that, if left uncorrected, could lead to declaring an emergency. 5.1.8.16 CAS and CDS sensors, Nuclear Accident Dosimeters (NADs), and evacuation zone boundary shielding and deployment evaluation. Participate in the performance of evaluations for placement of CASs and CDSs sensors, NADs, and evacuation zone boundaries for credible nuclear criticality accident source terms using appropriate criticality and shielding codes, NRC Regulatory Guides, or other techniques such as charts, nomographs, and hand calculations, as necessary, providing a peer review of results, documenting the results, and maintaining records of the evaluation.

5.1.8.17 Peer review. Provide peer reviews of (a) fissionable material process analyses affecting NCS, (b) NCS evaluations, (c) NCS analyses, (d) CAS, CDS, and NAD deployment evaluations, (e) nuclear criticality accident evacuation zone evaluations, and (f) quality and configuration control of software and data sets used for NCS evaluations and nuclear criticality accident alarm or detection system placement and evacuation zone evaluations. 5.1.8.18 Records retention. Ensure the maintenance of records during the period of their applicability and at least for periods specified in paragraph 2.1.2 for (a) NCS analyses, (b) CAS, CDS, and NAD placement evaluations, (c) nuclear criticality accident evacuation zone evaluations, (d) fissionable material process audits and violation/procedural reviews, and 40 DOE G 421 .1-1 8-25-99 (e) quality and configuration control of software and data sets used for NCS evaluations and nuclear criticality accident alarm or detection system placement and evacuation zone evaluations. 5.1.8.19 NCS procedures. Prepare, maintain, and interpret policy, standards, guidelines, and implementation procedures for installation nuclear criticality safety requirements. 5.1.8.20 Design reviews. Provide independent safety reviews of documents significant to criticality safety for all new facilities and significant modifications that affect nuclear criticality safety in existing facilities. Documents include training plans, design criteria, project design documentation, technical specifications, procedures, and drawings. 5.1.8.21 Selection and approval of effective controls. With support and approval from first line supervision, effectively select controls for nuclear criticality safety as identified by the nuclear criticality safety analysis. 5.1.8.22 Assistance in shutdowns. Technically assist line supervision in safely suspending fissionable material operations that, in the judgment of line supervision or the Criticality Safety Organization, do not have the required level of nuclear criticality safety. 5.1.8.23 Accident yield estimation. Provide for the evaluation of yield of credible nuclear criticality accidents bounding facility or installation fissionable material processes. 5.1.8.24 Participate in CAS evacuation drills. In cooperation with Operations, monitor and comment upon CAS evacuation drills, emergency procedures, re-entry procedures, and practices. 5.1.8.25 Technical training support. Review, approve, and provide technical information, as requested, for general and facility-specific nuclear criticality safety training curricula. 5.1.8.26 Reviews of fire safety plans. Review and concur in the fire safety plan for each facility having significant quantities of fissionable materials. 5.1.8.27 Operational experience feedback. Examine reports of procedural violations and other deficiencies for potential improvements of safety practices and procedural requirements, and report such potential improvements to management. Collect, analyze, and examine for trends of operational experiences relating to criticality safety to determine if the assumptions in NCS evaluations and analyses are valid, too conservative, or otherwise need revising. Report priority needs for revisions to management.31 5.1.8.28 INCSRC support. Provide nuclear criticality safety experienced personnel to serve on, and assist, the Installation Nuclear Criticality Safety Review Committee, as requested.

5.1.9 Installation Nuclear Criticality Safety Review Committee (lNCSRC). The INCSRC should provide the installation site manager with appraisals of the programmatic effectiveness of the installation operating and nuclear criticality safety organizations. 31ANSI/ANS-8.19-1996, section 6.7. DOE G 421.1-1 8-25-99 41 5.1.9.1 Composition. Should be chaired by an individual who reports to the Installation Manager or a sufficiently high level of management, and should be independent, to the extent practicable, of fissionable material Operations and the Nuclear Criticality Safety Organization. Committee membership may include individuals representing the installation for (a) fissionable material operations and waste management, (b) fissionable material operations development and engineering, (c) fissionable material accountability and security, (d) emergency preparedness, (e) installation maintenance and support, and (f) Criticality Safety Organization. 5.1.9.2 Guidance to management. Provide guidance to management for principles and policy of the installation nuclear criticality safety program including the resolution of any conflicting interpretations of NCS policies and procedures. 5.1.9.3 Investigation of incidents. Participate, as requested by line management, in the investigation of criticality safety incidents that are classed as "violations," in accordance with the reference in 2.1.3. (See also 2.1.14.) 5.1.9.4 INCSRC Annual reviews. INCSRC, or an alternative means of review shall conduct periodic reviews of the Installation NCS program.32 These reviews should be conducted at least annually and include applicable items from the following elements: a. Presentations by the installation NCS Organization regarding the status of (1) any proposed nuclear criticality safety program policy changes; (2) activities of the NCS Organization with respect to (i) pertinent aspects of continuing facility operations and of major new programs or modifications, (ii) applicable audit recommendations and suggestions resulting from audits of the nuclear criticality safety program, (iii) participation in installation personnel education and training efforts, and (iv) development, training, and qualification of NCS personnel; (3) compliance with DOE Orders and other federal, state, or municipal regulations regarding NCS as evidenced by documented periodic reviews and random surveillances; and (4) configuration control program for the conduct of Criticality Safety Organization operations. b. Presentations by operating line management responsible for, or affecting, the installation NCS program regarding 32ANSI/ANS-8.19-1996, sections 4.5 and 4.6. 42 DOE G 421 .1-1 8-25-99 (1) inspections, audits, and self-assessments including follow-up on corrective actions and recommendations from incident investigations, (2) personnel training, qualification, and certification, (3) administration of nuclear criticality safety controls including methods, accomplishments, and procedures, (4) installation and facility access control, (5) process and facility engineering design development, construction, and maintenance activities, (6) configuration control of processes, equipment, and facilities important to NCS, (7) ancillary support equipment and utilities affecting fissionable material operations, storage, or transportation, (8) operations, storage, and transportation of fissionable materials, (9) emergency preparedness and drills, and (10) compliance with statutory requirements regarding NCS as evidenced by documented

self appraisals. c. A physical inspection of the fissionable material control areas for the purpose of focusing on specific program review topics. d. Reviews of installation and facility operating experiences, including operating anomalies and NCS incidents along with incident investigation and prior review responses and follow-up by line management and the NCS organization. e. Review of criticality accident alarm and detection systems performance. f. The documentation of the annual review in a report provided to the Installation Manager that contains the items of review, findings, and recommendations. g. A summary presentation of the annual review report to the Installation Manager. 5.1.9.5 Response to requests. Review on an as-needed or requested basis (a) any proposed criticality safety program policy change, making recommendations to management, and (b) any issues or concerns that should properly come before the INCSRC. DOE G 421.1-1 8-25-99 43 5.2 PERSONNEL SELECTION, QUALIFICATION, TRAINING, AND STAFFING PROGRAM. The purpose of the program is to establish (develop and document) the selection, qualification, training, and staffing requirements for personnel such that persons are qualified to carry out their assigned responsibilities, that they have a broad understanding and acceptance of the inherent risks involved with the operations, and that they maintain a job performance proficiency consistent with effective control of the hazards and risks associated with the operations. Three broad categories of the program are considered in this Guide. The categories are (1) the operations and support personnel associated with fissionable material operations outside of reactors, (2) the installation nuclear criticality safety staff, and (3) visitors and clerical employees. The personnel selection criteria and depth and breadth of nuclear criticality safety training are necessarily variable, depending on the work assignments of personnel. A detailed discussion of this program is found in Appendix A, which is intended to provide guidance for organizations establishing new programs or improving current programs. This guidance is presented in an a posteriori form, expressly to emphasize that the specificity of structure and nomenclature for personnel selection, qualification, training, and staffing is illustrative and suggestive rather than recommendatory. 5.2.1 Program for Operations and Support Personnel. The category of operations and support personnel includes fissionable material handlers and their supervisors, operations support, design, maintenance, technical support (including the members of the Nuclear Criticality Safety Organizations) and emergency response personnel, managers and other administrative personnel, and persons who enter areas where fissionable material is processed, stored, or handled. As consistent with job assignments and personnel acknowledgement of job hazards and risks, the following items should be considered for inclusion in the training and qualification program. • Establish the training and qualification program to provide continuing proficiency of personnel. • Discuss the concept of a nuclear fission chain reaction. • Describe neutron induced fission, neutron capture, and neutron scattering and leakage. • Review and describe selected criticality accidents. • Train personnel in the recognition of, and the response to, criticality accident alarms.

• Explain and illustrate the influence of various nuclear criticality safety parameters on process safety. • Describe the facility management's nuclear criticality safety policy. • Periodically, perform and document evaluations of the training program and trained personnel. 5.2.2 Installation Nuclear Criticality Safety Staff. This category includes the manager and members of the installation Criticality Safety Organization who are responsible for performing computational or comparative evaluations and safety analyses for fissionable material operations; for developing procedural, process, and control requirements; and for providing procedural, process, and equipment/facility reviews and approvals, nuclear criticality safety training program development, and facility operational reviews, appraisals, audits, and investigations. The 44 DOE G 421 .1-1 8-25-99 professional personnel charged with implementing the programs identified in this Guide are designated nuclear criticality safety specialists (NCSS). There are currently only general qualification requirements33, but ongoing and future qualification of individuals should consider developing confirmable documentation that addresses, but is not limited to, the following (see Appendix A for more detail): • A demonstrated capability to perform installation-specific analyses of the NCSS job and its tasks for experienced NCSS personnel. • A qualification checklist, file, card, or other record that identifies each applicable task and the method(s) by which competence has been demonstrated, with performance evaluation based on actual or representative work products. • A baseline education of a baccalaureate degree in engineering or science and a minimum experience in nuclear criticality safety at the facility of one (1) year to independently perform NCSS tasks, and three (3) years to provide independent review and quality assurance of NCS tasks. Equivalencies may be established. • Certification of final qualification by criticality safety management. • Periodic competence confirmations based on practical exercises. First-hand knowledge of the situation of criticality should be the goal of all criticality safety practitioners that comprise the Installation Nuclear Criticality Safety Staff. Such knowledge should be meaningfully obtained through experience in performing criticality experiments, preferably on a routine basis, e.g., as a staff member at a critical mass laboratory for an extended period. When feasible, such knowledge should be obtained in this manner. Nuclear criticality safety specialists are collectively the professional staff with primary responsibility for implementing the activities and programs required to support this Guide. 5.2.3 Visitors and Clerical Employees. As a minimum, visitors and clerical employees entering fissionable material control areas without escort should have been instructed in the identification of the criticality accident alarm system (CAS) signals (audible and/or visible), instruction on the requirement for immediate evacuation if in an area in which a CAS alarms sounds, identification of evacuation routes, and an explanation as to why a CAS alarm is necessary. These persons should also have been instructed to refrain from all actions involving the movement, processing, or storage of fissionable material.34

5.2.4 Auditor Qualifications. Nuclear criticality safety program auditors shall have adequate education, knowledge, training, and experience to review and evaluate the elements of a nuclear criticality safety program in terms of content and adequacy for its intended application. 330 0 E Order 5480.20A, Chapter I, 7.g. 3400E Order 5480.20A, Chapter I, 7.e. DOE G 421.1-1 8-25-99 45 5.2.4.1 Compliance. A compliance auditor of a nuclear criticality safety program should have a demonstrated basic knowledge of DOE Orders, associated statutory requirements, and industry standards and practices in order to recognize the equivalency or adequacy of documented and observed program procedures and practices (i.e., compliance) with the DOE Orders. This knowledge should be demonstrated by either • three years in the administration and management of a non-reactor nuclear facility nuclear criticality safety program, or • education, training, and testing (developed from job/task analyses) in the above subject matter. 5.2.4.2 Quality Audit. An auditor of nuclear criticality safety program quality should have seven years experience in nuclear criticality safety leading to broad knowledge and applications. In addition, such auditors should have specific experience in the particular subject to be audited. Examples of this specific experience may include, but are not limited to, • physicochemical operations and administrative controls used in the processing, handling, transport, or storage of fissionable materials, and typical or experiential upset/contingent conditions of these operations, • computational physics as it relates to computational modeling, use and/or processing of neutron cross sections, and computer code verification and validation, • safety analysis techniques such as failure modes and effects analysis, what-if analysis, management oversight risk tree analysis, etc., • human factors influences on processes, • conduct of inspections, self-assessments, and audits, • emergency preparedness, and • criticality safety training subject matter for operators, supervisors, managers, visitors, etc. 46 DOE G 421.1-1 B-25-99 5.3 OPERATING, STORING, AND TRANSFERRING - PLANS, PROCEDURES, REQUIREMENTS, AND CONTROLS. Operations for which nuclear criticality safety is a consideration shall be addressed by a Nuclear Criticality Safety Evaluation and shall be governed by written plans, written procedures, and controls. 35 5.3.1 General Requirements for Operating Plans and Procedures. 5.3.1.1 Start-up, operations, and modifications. Written plans and procedures for facilities in which nuclear criticality safety is of concern shall cover start-up, operations, and any modifications that may affect nuclear criticality safety. All persons participating in the operation of such facilities shall be familiar with, and understand procedures applicable to, their assigned duties. In this Guide, operating plans and procedures include any set of instructions to do work that can affect criticality safety. They include process operating procedures, storage plans, and modification or maintenance work packages that involve significant quantities of fissionable material, associated materials, engineered safety features, and the CAS.36

5.3.1.2 NCS parameter identification. Procedures shall clearly -specify all nuclear and process parameter limits related to nuclear criticality safety that are intended to be controlled for safety. Nuclear criticality safety steps should be conspicuously identified in operating procedures and should immediately precede the step or group of steps to which they are applicable. New or revised procedures containing such nuclear safety steps, nuclear criticality safety limits, or nuclear criticality safety requirements shall undergo review by the Criticality Safety Organization prior to implementation.37 5.3.1.3 Single failure safety assurance. Procedures should be developed such that no single credible inadvertent departure from a procedure can cause a criticality accident. 5.3.1.4 Procedural convenience. Procedures should be convenient for use by operators and should be free of extraneous material. 5.3.1.5 Procedural reviews. Active procedures shall be reviewed periodically by supervision. The requirement to periodically review active procedures shall itself be a procedure to define the review frequency. Similarly, operations shall be reviewed at least annually to ascertain that procedures are being followed, and that process or facility conditions have not been altered so as to affect nuclear criticality safety adversely. 38 35ANSI/ANS-B.1-19B3,RBB, sections 4.1.2 and 4.1.3; and ANSI/ANS-B.19-1996, sections 7 and B. 36ANSI/ANS-B.1-19B3,RBB, section 4.1.3; and ANSI/ANS-B.19-1996, sections, 5.3, 5.4, and 7. 37 ANSI/ANS-B.1-19B3,RBB, section 4.1.3; and ANSI/ANS-B.19-1996, section 7.5. 38A NSI/ANS-B.1-19B3,RBB, section 4.1.6; and ANSI/ANS-B.19-1996, sections 5.4, 7.4, and 7.B. DOE G 421.1-1 8-25-99 47 5.3.1.6 Supplementation. Procedures should be supplemented as appropriate by posted nuclear criticality safety limits or other appropriate operator aids such as inventory lists, process checklists, flowsheets, and engineering drawings as part of an operator aid program in accordance with references cited in this document.39 40 Suitable allowances may be made for situations where the fissionable material content of products, wastes, or feed materials, or such content under other circumstances, is repetitive or is previously established from the work of others or from process limitations. Examples could include the acceptance of shipper's values for received materials or limitation of material density or concentration because of a specific chemical process. 5.3.1.7 Operational deviations. Deviations from operating procedures and unforeseen alterations in process conditions that affect nuclear criticality safety shall be documented, reported to management, and investigated promptly. Actions shall be taken to prevent a recurrence or to appropriately modify procedures. 41 5.3.1.8 Procedural revisions. Supplementing and revising procedures shall be facilitated as improvements become desirable.42 5.3.2 Processing. Fissionable material processing shall be conducted in an orderly fashion that includes, as appropriate, use of the following: 43 5.3.2.1 Plans, flowsheets, and layouts. Process plans, flow sheets, and layouts should be developed that describe the process, including equipment and facilities in which criticality hazards may exist, using appropriate drawings/sketches, and including dimensions in sufficient detail to permit the development of procedures specified in paragraphs 5.3.2.2 through 5.3.2.6 to evaluate the process.

5.3.2.2 Procedural description of material composition. Procedures shall be developed and used that contain information on the physical and chemical form of fissionable material in the processing operation, including isotopic content, concentrations, densities, and moderation levels of the fissionable material, as applicable and required to ensure criticality safety. This information may be bounded by conservative enveloping assumptions to simplify and eliminate superfluous details. 5.3.2.3 Procedural description of allowed material quantities. Procedures should be developed and used that contain statements of the maximum quantities or concentrations of fissionable material allowed in the process. 39DOE 5480.19. 40ANSI/ANS-8.1-1983,R88, section 4.1.4. 4IANSI/ANS-8.19-1996, section 7.7. 42ANSI/ANS-8.19-1996, section 7.3. 43ANSIIANS-8.19-1996, sections 5.6 and 9.5. 48 DOE G 421.1-1 8-25-99 5.3.2.4 Procedural description of spacing requirements. Procedures should be developed and used that specify required spacing of masses of fissionable material and separation from fissionable material in adjoining areas, as applicable. 5.3.2.5 Procedural specifications for material collection and transport. Procedures should be developed and used that specify safe methods of collecting, handling, and transporting fissionable material. 5.3.2.6 Procedural specifications for administrative controls. Procedures should be developed and used that specify administrative methods to prevent criticality. 5.3.3 Receiving and Inspecting Fissionable Material. The receipt and inspection of fissionable materials shall be controlled by procedures which address:44 5.3.3.1 Verification. Procedures that are consistent with materials controls and accountability requirements should be developed and used for determining, verifying, or noting the contents of each package, including the net weight of the fissionable material therein. 5.3.3.2 Material placement. Procedures should be developed and used for placing fissionable materials in receiving areas and storage facilities. 5.3.4 Storing Fissionable Material. The requirements of this section do not apply (a) when materials are in-process as part of production, analytical and developmental procedures, or transport operations, (b) when an assembly cell is used for assembly and/or storage of weapons components made with these materials, (c) when the number of packages of materials prepared for shipment is limited in accordance with the requirements of DOE 0 460.1 A, formerly DOE Order 5480.3, or (d) to radioactive waste storage or disposal facilities. 5.3.4.1 Container design. Fissionable material container design should be appropriate to the form of stored fissionable material. Criteria for container integrity should be developed in the course of the required safety analysis and the applications of such criteria evaluated by periodic inspection (by facility personnel). For containers involving any significant gas buildup, automatic pressure relief or other venting should be designed to ensure that no personnel exposure to any toxic material will occur under normal storage conditions, or, insofar as practical, under credible accident conditions. Such venting should not permit the spread of contamination.

5.3.4.2 Container criteria. Criteria, such as external and internal corrosion rate for determining the suitability of containers in storage, should be developed as necessary and set forth in writing. These criteria are particularly important in water pool storage of fuel elements or containerized fissionable materials and in the storage of plutonium or 233U. All storage containers should be periodically inspected against the criteria developed. The time between inspections may vary depending upon storage container quality and type. Procedures for conducting these inspections or surveillances should include acceptance criteria for corrosion and other phenomena that can adversely affect criticality safety. 44ANSI/ANS-8.19-1996, sections 7.2 and 9.2. DOE G 421 .1-1 B-25-99 49 5.3.4.3 Container descriptions. Containers of fissile material in areas with sprinkler systems shall be designed to prevent the accumulation of water. 45 Procedures developed and used for storing fissionable material should contain descriptions or identify types of containers in which fissionable materials are allowed to be stored. 5.3.4.4 Container identification and closure. All fissionable material storage containers should be marked and, if practical, coded to indicate the type or category of material, amount, degree of enrichment, moderation, and the radiation level at the outside surface of the container as appropriate to monitor criticality safety parameter limits and controls. Containers should be securely closed and positioned so as to prevent significant displacement and maintain criticality prevention requirements. 5.3.4.5 Container venting. Plutonium containers in which gas buildup can occur should be designed to prevent leakage of gas over the maximum storage period, or vented to prevent an accumulation of explosive gases; however, such venting should not permit the spread of contamination. 5.3.4.6 Containerization of plutonium or 233U. Plutonium- or 233U-bearing, or -contaminated, material should be packaged in a closed metal container. Combustibles within the container should be minimized. Hydrogenous materials ("plastics") should not be used for plutonium packaging. These considerations may also be applicable to 233U. (See also DOE-STD-3013-94, paragraph 2.1.20 of this Guide.) 5.3.4.7 Plutonium storage monitoring. Plutonium storage facilities and containers should be monitored and checked periodically to ensure continued integrity of containment. When required by the form or hazard potential of the stored material, procedures should be developed to detect contamination or loss of primary containment when personnel enter the plutonium storage facility. 5.3.4.B Facility design criteria. The storage of fissionable materials shall be such as to obviate concern with accidental nuclear criticality in the event of fire or flood, earthquake, or other natural calamities.46 In addition, the design of storage structures should tend to preclude unacceptable arrangements or configurations, thereby reducing reliance on administrative controls.47 Where the presence of significant quantities of combustibles cannot be avoided, as in the storage of combustible fissile scrap, a fire protection system shall be installed.48 Where sprinkler systems are installed in fissile storage areas, consideration shall be given to the possibility of criticality occurring in an accumulation of runoff water.49 45ANSIIANS-B.7-1975,RB7, section 4.2.7. 46ANSI/ANS-B.7-1975,RB7, section 4.2.3.

47 ANSI/ANS-B. 7-1975,RB7, section 4.2.4. 48ANSI/ANS-B. 7-1975,RB7, section 4.2.6. 49ANSI/ANS-B.7-1975,RB7, section 4.2.B. 50 DOE G 421.1-1 8-25-99 5.3.4.9 Storage specifications. Procedures should be developed and used for storing fissionable material. 50 These should set forth limits on the total quantity of fissionable material, allowable quantity of individual units, allowable container dimensions, and required spacing of containers in storage areas. 5.3.4.10 Storage facility plans and layouts. Storage facilities and structures shall be designed, fabricated, and maintained in accordance with good engineering practices. 51 Plans and layouts should be developed that contain a description of the storage facility, including dimensions and materials used in construction of the enclosure and shelving, cubicles, cages, and other equipment within the storage area. 5.3.4.11 Admonitions about moderating and reflecting materials. Procedures developed for storing fissile material should contain precautions to avoid entry of water or other moderating materials into a storage area where moderating and reflecting effects of such materials would be unsafe. Nonessential combustible materials should not be stored in a fissionable material storage area. 5.3.4.12 Removal and return of materials. Procedures shall be developed and used that control the removal, or transfer, of fissionable material from storage and the return of such material to storage. These procedures should incorporate means of verifying the weight, isotopic content, chemical composition, and degree of moderation, as appropriate. 5.3.4.13 Exclusion of superfluous materials. Process operations, storage of non-nuclear materials or equipment that is not directly required for fissionable materials storage operations, and all other functions not directly a part of normal fissionable materials storage operations should be excluded from the storage area. 5.3.4.14 Readiness inspections. Documented inspections, in situ tests, and preventive maintenance shall be performed periodically on fissionable material storage areas to ensure that the safety systems and components necessary for criticality safety control are maintained in a state of readiness. 52 5.3.4.15 Postings. Nuclear criticality safety limits shall be conspicuously posted.53 Postings at the entrance and inside fissionable material storage areas, as applicable, should be considered. 5.3.4.16 Instructions. Signs or other devices should be utilized as appropriate at strategic locations in or near fissionable material storage locations to provide instructions regarding interpretations of, and required responses to, alarms, evacuation routes, and fire fighting. 50ANSIIANS-8.7-1975,R87, section 4.1.2. 51ANSIIANS-8.7-1975,R87, section 4.2.2. 52ANSI/ANS-8.7-1975,R87, section 4.2.2. 53ANSIIANS-8.7-1975,R87, section 4.1.2. DOE G 421.1-1 8-25-99 51 5.3.4.17 Emergency planning. In conjunction with site emergency planning, a fire fighting plan should be developed for fissionable material storage areas and incorporated into the overall facility and site plans. Periodic training drills/exercises should be conducted appropriate to the level of fire hazard associated with the area. 5.3.4.18 Exclusion from storage requirements. Excess fissionable material should not be construed to be "in process" to circumvent the fissionable material storage requirements of this section.

5.3.4.19 Use of shipping containers. Fissionable material may be stored in shipping containers for the purpose of enhancing safety in storage, but not for the purpose of negating the requirements of this section. 5.3.4.20 Material constraints. Fissionable material should be stored in racks or equivalent fixtures capable of securely locating stored material in order to prevent displacement, to ensure spacing control, and to meet designs for criticality safety under normal operational and credible accident conditions. Floor storage within a fissionable material storage facility should only be permitted where control of location or other safety requirements (equivalent to the safety provided by storage racks) are inherently provided by the original containers and their restraints if required for nuclear criticality safety. 5.3.4.21 Pyrophoric materials. All fissionable materials that are determined to be pyrophoric should be put in a safe form (i.e., non-pyrophoric) prior to storage or be stored in approved containers or inert atmospheres that will not permit spontaneous ignition or dispersal. 5.3.4.22 Heat removal. Provisions should be made in a plutonium storage facility to ensure necessary and adequate heat removal for plutonium storage containers as established by facility safety assessments. 5.3.5 Fissionable Material Transportation. The transportation of fissionable materials onsite and offsite shall be governed by written procedures that comply with DOE Order 420.1, Section 4.3; DOE 0 460.1A, formerly DOE Order 5480.3; 49 CFR; 10 CFR 71; and other applicable federal requirements. 5.3.5.1 Onsite transfers. The design and use of onsite shipping containers shall provide criticality safety protection of fissionable material consistent with that protection provided by DOE, NRC, or DOT packages used in interstate transport. Considerations should be given to onsite resources and conditions of material transport that eliminate or mitigate interstate transport hazards (e.g., resources of prompt fire fighting, speed limits of transport, traffic control, method of transport, compensation for weather conditions, lifting height restraints, and others). 5.3.5.1.1 Onsite transport safety analysis. The packaging requirements for onsite transfer of fissionable material are contained in DOE 0 460.1A, formerly DOE Order 5480.3. Safety analysis for onsite transfers shall be in accordance with requirements in this DOE Order. The safety analysis, computational evaluations, and the documentation of the package safety analysis shall be performed in accordance with DOE Order 420.1, Section 4.3. 5.3.5.1.2 Operating procedures. Approved operating procedures applicable to an onsite transfer or shipment of fissionable materials shall be posted or readily available within the loading, unloading, or storage areas for such materials. 52 DOE G 421 .1-1 8-25-99 5.3.5.2 Off site transfers. All transfers of fissionable materials offsite shall be performed in DOE, NRC, or DOT approved fissionable material packages. All required administrative controls and procedures specified for the package use shall be performed. Such DOE, NRC, or DOT approved packages do not require additional criticality safety review for receipt or shipment. 5.3.6 Posting and Labeling. Positive identification of fissionable material is essential to criticality safety. Adequate labeling of fissionable material and clear posting of work and storage areas in which fissionable materials are present are important in avoiding the accumulation of unsafe quantities of such materials. Detailed guidance for posting and labeling follow.

5.3.6.1 Posting of Fissionable Material Handling, Storage, and Work Areas. Posting refers to the placement of signs to indicate the presence of fissionable material, to summarize key criticality safety requirements and limits, to designate work and storage areas, or to provide instruction or warning to personnel. 5.3.6.1.1 Postings for presence of fissionable materials. The presence of significant quantities of fissionable material should be posted at the entrance to work and storage areas such as benches, hoods, glove boxes, cabinets, rooms, zones, and modules where fissionable material is handled, processed, or stored. Posting to identify the presence of significant quantities of fissionable materials may be at the entrance to work areas or storage areas, at room entrances, or entrances to buildings, as appropriate. Such areas shall be periodically reviewed to eliminate extraneous postings. For example, criticality safety requirements should be posted only for those glove boxes or rooms currently containing, or that are intended to contain, significant quantities of fissionable material in the near future. Postings should be coordinated with the current list of required postings and ongoing implementation of nuclear criticality safety evaluations and analyses. Postings should be consistent with good human factors practices. 5.3.6.1.2 Symbol. The identification symbol used to identify the presence of all fissionable materials should be as specified in ANSI Standard No. 12.1 and is referred to as the "fissionable material symbol." See Figure 5.3.6.1.2-1. The fissionable material symbol consists of three curved bars around the standard radiation symbol with the word "fissionable" superimposed on the bars. The symbol shall be magenta, purple, or black on a yellow background. Figure 5.3.6.1.2-1. Fissionable material symbol 5.3.6.1.3 Storage postings. For fissionable material storage locations, criticality safety limits should be posted in conspicuous places near such storage locations. Postings should include, as appropriate, the following information: type of fissionable material, containers, and packages allowed; mass, number of units, surface density, and volume allowed; moderation limits; and DOE G 421.1-1 8-25-99 53 spacing limits. However, in the case of spent fuel storage pools, such postings need only contain criticality safety limit information, such as "only one assembly in motion at a time." 5.3.6.1.4 Process limits. For process areas, limits and controls that are controllable or observable by an operator should be posted at each work station as necessary to supplement operating procedures (e.g., Hood Limit - 15 one-liter bottles). However, care should be exercised to avoid posting so many limits that confusion develops. 5.3.6.1.5 Uniformity of postings. Each process facility should develop facility-specific criteria to be used as a basis for determining the limits and controls to be posted versus those controls that will only appear in operating procedures. 5.3.6.1.6 Administrative control postings. For laboratories or other areas using administrative mass control limits for individual labs, groups of labs, or isolated locations, such limits should be posted at the entry of each such area. 5.3.6.1.7 Precautions or prohibitions. Criticality safety precautions or prohibitions related to fire fighting such as prohibitions or precautions in the use of water, use of fog nozzles only, and limitations of direct high pressure water sprays should be posted at the entrance to areas containing fissionable material, as appropriate. These should be designed to be readable under poor lighting conditions and resistant to damage from fire and water.

5.3.6.1.8 Visibility of postings, operator aids. Text of postings for criticality safety should be easy to read; non-verbal items such as fuel assembly identification silhouettes and process mimic boards should be equally discernible. Each posting or operator aid should be located in such a manner that it may be easily seen while the operator is performing duties to which that operator aid applies. 5.3.6.2 Labeling Requirements for Fissionable Material. Labeling refers to the placement of clear and positive identifying markings on specific units or batches of fissionable material such as cans, packages, containers, birdcages, boxes, reactor fuel assemblies, and targets to prevent their being mistaken for other materials. If practical, labels should clearly show the type and amount of fissionable material present. 5.3.6.2.1 Label. For the purposes of this Guide, label may be interpreted to mean a label, an identification/serial number, or a tag affixed to the fissionable material assembly, container, or equipment. Wherever practical, labels should be machine readable or integral with a machine readable code, e.g., bar code. 5.3.6.2.2 Attachment. Containers of fissionable material received from offsite that meet the requirements of DOE 0 460.1 A, formerly DOE Order 5480.3, should have a label affixed unless an unusually high radiation dose will result. If an unusually high dose will result from labeling, the nuclear criticality safety organization should be advised and should determine an appropriate course of action consistent with the intent of this section. 5.3.6.2.3 Contained information. Labels should clearly show all information necessary to ensure adequate identification of fissionable materials. Generally, this information includes the type, form, moderation, enrichment, and quantity of fissionable material. 5.3.6.2.4 Specialized needs. Labels may be developed by each division or fissionable material control area to suit their own needs. However, when fissionable materials or containers of 54 DOEG421.1-1 8-25-99 fissionable material are to be transported between facilities onsite, the sending and receiving facilities should agree in advance on the type of labeling required. 5.3.6.2.5 Unirradiated reactor fuel/targets. Label requirements for unirradiated reactor fuel and targets should consist of a unique serial number etched/machined onto each reactor fuel element and target and accompanying paperwork/cards, matched to each serial number (which provides the type of information described in paragraph 5.3.6.2.3). 5.3.6.2.6 Irradiated reactor fuel/targets. Label requirements for irradiated reactor fuel elements and targets should be similar to those for unirradiated reactor fuel elements and targets. However, irradiated fuel/target labels should contain information such as fuel element/assembly serial numbers matched to paperwork containing information of the type described in paragraph 5.3.6.2.3. 5.3.6.3 Empty containers. Fissionable material containers that no longer contain fissionable material (other than that present as residual contamination) should be labeled as empty or as unloaded, as appropriate, or the old fissionable material labeling should be unmistakably crossed out, unless the absence of fissionable material is readily apparent. DOE G 421.1-1 8-25-99 55

5.4 CRITICALITY ACCIDENT ALARM AND DETECTION SYSTEMS. At a nonreactor nuclear installation, criticality accident alarm systems (CASs) shall be provided to minimize, by means of quick detection and immediate evacuation alarm, the total risk incurred, and the total dose received, by personnel from a criticality accident. Exceptions to this requirement are provided in paragraph 5.4.3. Another purpose of the CAS is to notify people to stay clear of the evacuated area and to notify appropriate response teams. In general, CASs shall be provided wherever it is deemed that they will result in a reduction in total risk. Consideration shall be given to hazards that may result from false alarms.54 Criticality accident detection systems (CDS), without immediate evacuation alarms, shall be provided for certain situations to permit delayed response or execution of mitigating actions to terminate the criticality, protect equipment, and reduce dose to personnel. 55 Unless management directs otherwise, the Criticality Safety Organization should have lead responsibility for performing CAS analyses and evaluations. However, instrumentation, controls, and alarms for criticality safety may be treated as a subset of other engineering disciplines. In any event, management should clearly designate responsibilities and authorities regarding the CAS, CDS, and interconnecting systems or devices. 56 5.4.1 Conditions for CAS Coverage. CASs shall57 be installed and maintained operational for all facilities in which • areas accessible to personnel where the maximum foreseeable absorbed dose in free air due to a credible criticality accident may equal or exceed 12 rad. For the purpose of this evaluation, the maximum integrated yield over the duration of the accident may be assumed to be no more than 2 x 1019 fissions, however, it is strongly recommended that facility-specific analyses be performed whenever practical to determine the appropriate criticality accident yield and time evolution, and • the probability of occurrence of criticality is greater than 10-6/yr, based on quantitative analysis or engineering judgment, and • the quantities of fissionable material to be handled, processed, or stored may exceed 700 g 235U, 500 g 233U, 450 g 239pU, 450 g of any combination of the three isotopes, or the subcritical limits specified in ANSI/ANS-8.15-1981,R87. Individual areas may be considered unrelated when the boundaries between the areas are such that there can be no interchange of material between the areas, the minimum separation between adjacent areas is at least 10 cm, and the areal density of fissionable material averaged over each individual area is less than the fissionable equivalent mass of 50 g235U/m2. 54ANSI/ANS-8.3-1986, section 4.1.1. 55DOE 0 420.1, Section 4.3. 56 ANSI/ANS-8. 1-1983,R88, section 4.1.1 . 57DOE 0 420.1, Section 4.3. 56 DOEG421.1-1 8-25-99 5.4.2 Conditions for ces Coverage. CDS coverage shall be provided58 • for areas accessible to personnel where the maximum foreseeable absorbed dose in free air due to a credible criticality accident will not exceed 12 rad. For the purpose of this evaluation, the maximum integrated yield over the duration of the accident may be assumed to be no more than 2 x 1019 fissions, however, it is strongly recommended that facility-specific analyses be performed whenever practical to determine the appropriate criticality accident yield and time evolution, and

• for criticality accidents having a probability of occurrence greater than 10-6 /yr, based on quantitative analysis or engineering jUdgment, and • when the quantities of fissionable material to be handled, processed, or stored may exceed 700 g 235U, 500 g 233U, 450 g 239pU, 450 g of any combination of the three isotopes, or the subcriticallimits specified in ANSI/ANS-8.15-1981,R87. Individual areas may be considered unrelated when the boundaries between the areas are such that there can be no interchange of material between the areas, the minimum separation between adjacent areas is at least 10 cm, and the areal density of fissionable material averaged over each individual area is less than the fissionable equivalent mass of 50 g235U/m2. 5.4.3 Conditions Not Requiring CASs and cess. CASs and CDSs are not required at nonreactor nuclear installations for the following circumstances: 5.4.3.1 Shielded Operations. Examples are spent fuel in underwater storage pools, hot cells, and buried waste. CASs and cess are not required underwater in spent fuel storage pools provided sufficient water shielding is maintained above the fuel to protect personnel. However, there should be a means to detect fission product gases or other volatile fission products in occupied areas immediately adjacent to the storage pool unless no fission products are likely to be released. CASs and CDSs are not required for hot cells in which either the potential for a criticality accident is incredible, or in which the potential for a criticality accident is credible but the resulting dose from the maximum criticality event is less than 12 rad at the outer surface of the hot cell. In any event, the cause of any anomalous personnel or area dosimetry results in the vicinity of the hot cell should be investigated, and there should be a means to detect fission product gases or other volatile fission products in occupied areas immediately adjacent to the hot cell unless no fission products are likely to be released. CASs and CDSs are not required for burial grounds where either the potential for a criticality accident is incredible, or the potential for a criticality accident is credible but the resulting dose from the maximum criticality event is less than 12 rad at the surface of the burial ground. In any event, the cause of anomalous personnel or area dosimetry results in the vicinity of burial grounds should be investigated. 5.4.3.2 Licensed/certificated packages. CASs and CDSs are not required for fissionable material during shipment or for material packaged in approved shipping containers awaiting transport or 580 0E 0 420.1, Section 4.3. DOE G 421.1-1 8-25-99 57 awaiting unpacking provided: (1) that there is no credible criticality accident that could occur while the containers are on a loading dock or in a staging area; (2) that there are no other operations with fissionable material not so packaged on the loading dock or in the staging area; and (3) that neutron interaction between the shipping containers and other fissionable materials in adjoining areas is essentially zero. 5.4.3.3 Incredibility. CASs and CDSs are not required where a documented analysis concludes that no credible set of circumstances can initiate a criticality accident. 5.4.4 Design Requirements. The following provides example design and performance criteria for the CAS.

5.4.4.1 Characteristic radiation detection. The CAS shall be capable of detecting excessive amounts or intensities of radiation due to a criticality event and to signal immediate personnel evacuation. The type of radiation to be detected and the mode of detection should be uniform throughout the system. 59 However, the type of radiation detected and the mode of detection shall be consistent with the environment, radiation background, shielding, and characteristic radiation that may be observed from the postulated criticality accidents. 5.4.4.2 Alarm logic. Trip logic for the CAS units should be based on a 1-out-of-2 detector voting logic, or· on a 2-out-of-N detector voting logic where N ~ 3. That is, either 1-out-of-2 or 2-out-of-N detectors shall trip (due to high radiation or detector/unit failure) in order to initiate an alarm. For N detectors when N > 2, (N-m) could be required to alarm, when (N-m) ~ 2. Consideration shall be given to the avoidance of false alarms by providing reliable single detector channels or by requiring detector voting logic described above.60 5.4.4.3 Trouble warning. A criticality alarm unit shall not produce an evacuation signal due to component failure. Instead, a visible or audible warning signal shall be provided at some normally occupied location to indicate system malfunction or loss of primary power. Failure of any single channel shall not prevent compliance with other CAS radiation detection criteria. 61 5.4.4.4 Alarm purpose. The alarm signal shall be for immediate and rapid evacuation purposes only and shall be of sufficient volume to be heard in all areas to be evacuated (see paragraph 5.4.4.16).62 However, areas with high noise levels may require alarm lights as well. 5.4.4.5 Resistance to detector saturation. Detectors shall not fail to initiate an alarm because of radiation saturation when exposed to a radiation field of at least 10 rad63 nor when subjected to the 59ANSI/ANS-8.3-1986, section 4.3. 60ANSI/ANS-8.3-1986, section 4.5.1. 6IANSI/ANS-8.3-1986, sections 5.4 and 4.5.1. 62ANSI/ANS-8.3-1986, section 4.4.1. 63ANSI/ANS-8.3-1986, section 4.5.4. 58 DOEG421.1-1 8-25-99 maximum criticality accident of concern. The CAS signal, once activated, shall remain activated until reset (see paragraph 5.4.4.6) as required by emergency procedures.54 5.4.4.6 Alarm resets. Manual resets, with limited access, should be provided outside the areas to be evacuated. 5.4.4.7 Automated alarming. The immediate evacuation alarm shall be automatically activated by a criticality accident without the need for human action. 65 5.4.4.8 Response testing. The CAS units should be designed such that testing of the alarm system response and performance may be accomplished without requiring evacuation. A CAS unit shall be returned to operating condition immediately following tests or maintenance.66 5.4.4.9 Minimization of false alarms and system vulnerability. CAS unit design shall incorporate features that reduce, to the extent reasonable, the frequency of false alarms and system vulnerability to external events, facility modifications, maintenance, or hazardous process conditions. All components of the system should be located to minimize damage in case of fire, explosion, corrosive atmosphere, or other extreme conditions. 57 5.4.4.10 Backup power supply. A backup power supply shall be provided for CAS units68 that is capable of supplying power to the units for a time period specified in the LCO.

5.4.4.11 Seismic resistance. In buildings designed to withstand the site-specific design basis earthquake or equivalent value specified by the Uniform Building Code, the design of new CASs should be resistant to earthquakes and should remain functional in the event of seismic shock equivalent to the site-specific design basis earthquake or the equivalent value specified by the Uniform Building Code.69 5.4.4.12 Response time. A CAS unit shall produce an immediate evacuation signal within 0.5 second of activation by the minimum accident of concern. 70 5.4.4.13 Detection criteria. In areas affording only nominal shielding of the detectors from a nuclear criticality accident, the minimum accident of concern may be assumed to deliver the equivalent of an absorbed dose in free air of 20 rad at a distance of 2 m from the reacting material 64ANSI/ANS-8.3-1986, section 4.4.9. 65ANSI/ANS-8.3-1986, section 4.4.6. 66ANSI/ANS-8.3-1986, section 6.6. 67 ANSI/ANS-8.3-1986, sections 5.1 and 5.2. 68ANSI/ANS-8.3-1986, section 4.5.3. 69ANSI/ANS-8.3-1986, section 5.5. 70ANSI/ANS-8.3-1986, section 5.5. DOE G 421.1-1 8-25-99 59 within 60 seconds. The alarm signal shall activate promptly when the dose rate at the detectors equals or exceeds a value equivalent to 20 rad/minute at 2 m from the reacting material.71 To minimize false alarms, the trip point may be set as high as practical as long as the above criterion is met. 5.4.4.14 Sensitivity. The CAS shall be designed such that instrument response and alarm latching occur as a result of transients of 1 ms (or more) duration.72 To minimize false alarms, the trip point should be more than 10 mrad/h above normal or operational background at the monitoring point and may be set as high as practical as long as the criteria of paragraph 5.4.4.13 is met. Neutron detection system trip points may be set differently based on independent analysis. 5.4.4.15 Spacing. The spacing of detectors shall be consistent with the selected alarm trip point and with the detection criterion of paragraph 5.4.4.13.73 5.4.4.16 Signal. A sufficient number of CAS alarm signal generators shall be installed so that the following obtain. a. They shall produce a mid-frequency complex sound wave that may be amplitude modulated at a subsonic frequency. The fundamental frequency should not exceed 1000 Hz. Modulation should be at a rate less than 5 Hz. b. They should produce an overall sound pressure level that is not less than 10 dB above the overall maximum typical ambient noise level, and in any case not less than 75 dB (referenced to 20pN/m2) at every location from which immediate evacuation is deemed essential. c. They should not produce an A-weighted sound level in excess of 115 dB (referenced to 20pN/m2) at the ear of an individual. Note: If hearing protection is required, the sound level may be measured inside hearing­ protection devices, or visible alarm systems may be substituted. 5.4.4.17 Reliability. The CAS shall be designed for high reliability and should utilize components that do not require frequent servicing,14 The system should be designed to minimize the effects of nonuse, deterioration, power surges, and other adverse conditions. The design of the system should be as simple as is consistent with the single objective of reliable activation of the alarm. 71ANSI/ANS-8.3-1986, section 5.6. 72ANSI/ANS-8.3-1986, section 5.7.1. 73ANSI/ANS-8.3-1986, section 5.8. 74ANSI/ANS-8.3-1986, section 5.1. 60 DOE G 421.1-1 8-25-99

5.4.5 Testing. Initial installation and subsequent tests shall be performed to provide confidence in system functionality.75 5.4.5.1 Initial. Initial testing and inspections of CASs shall verify that the fabrication and installation were made in accordance with design plans and specifications.7s 5.4.5.2 Post repair. Following significant modification or repair to a CAS, the system shall be tested and inspected in a manner equivalent to initial installation tests and inspections. 77 5.4.5.3 Radiation. CAS response to radiation shall be measured periodically to confirm continuing instrument performance. The test interval may be determined on the basis of experience; however, without a documented technical basis justifying lesser frequencies, tests should be performed at least monthly, and CASs should be recalibrated at least annually. Records of tests and recalibrations shall be maintained.78 5.4.5.4 Periodic. The entire CAS alarm system shall be tested periodically (at least annually). Field tests should verify (at least quarterly) that the signal is audible above background noise throughout all areas to be immediately evacuated. All personnel in affected areas shall be notified in advance of an audible test.79 5.4.5.5 Corrective Action. When tests reveal inadequate CAS performance, corrective action shall be taken without unnecessary delay.80 5.4.5.6 Procedures. CAS testing procedures shall be developed to minimize false alarms caused by testing and to return the system to normal operation following a test. 81 5.4.5.7 Records. All tests and corrective actions shall be recorded for each CAS and CAS unit. The records are to provide information on the system operability and help to identify sources of failures. 82 75ANSI/ANS-8.3-1986, section 6. 76ANSI/ANS-8.3-1986, section 6.1. 77 ANSI/ANS-8.3-1986, section 6.2. 78ANSI/ANS-8.3-1986, section 6.3. 79ANSI/ANS-8.3-1986, section 6.4. 80ANSI/ANS-8.3-1986, section 6.5. 81ANSI/ANS-8.3-1986, section 6.6. 82ANSI/ANS-8.3-1986, section 6.7. DOE G 421.1-1 S-25-99 5.4.6 Location Analysis. 61 5.4.6.1 Shielding and location analysis. Installation management shall ensure that CAS shielding and location analyses and configuration control programs exist for all installed CASs, and that the Criticality Safety Organization has participated in these analyses as mentioned in paragraph 5.1.S.16.83 The location and spacing of detectors should be chosen to avoid the effect of shielding by massive equipment or materials. 5.4.6.2 Yield estimation. As indicated in paragraph 5.1.S.23, the installation Criticality Safety Organization is responsible for estimating each facility maximum criticality accident yield to be used in safety analysis reports, alarm placements, and emergency preparedness. 5.4.7 Familiarization with Operation. 5.4.7.1 CAS alarm response. Instructions regarding the proper response to a CAS alarm signal (audible or visible) and the criticality accident evacuation routes shall be posted throughout the area covered by the CAS.84 5.4.7.2 Emergency procedures. Emergency procedures shall be prepared by each FMCA and shall clearly designate CAS evacuation routes. Evacuation should follow the quickest and most direct routes practicable. Evacuation routes should be clearly identified and should avoid recognized areas of higher risk.85 In addition, CAS evacuation routes should be established such that there is no confusion with other emergency postings such as radiological hazard or toxic gas alarms or postings. The Criticality Safety Organization should verify that evacuation routes are adequately posted.

5.4.7.3 Signal familiarization. All employees whose work may necessitate their presence in an area covered by a CAS alarm signal shall be made familiar with the sound of the signal (and location and appearance of the light, if applicable).86 5.4.7.4 Signal demonstration. Before placing a new CAS in operation, all employees normally working in the area shall be acquainted with the signal by actual demonstration at their work locations. 87 5.4.7.5 Periodic alarm signaling. To maintain familiarization and acquaint new employees and transferees into the area, the signal should be sounded during working hours after notifying all 83DOE 0 420.1, Section 4.3. 84ANSI/ANS-S.3-19S6, section 7.1. 85ANSI/ANS-S.19-1996, section 10.3. 86ANSIIANS-S.19-1996, section 7.2.1. 87ANSIIANS-S.19-1996, section 7.2.2. 62 DOEG421.1-1 8-25-99 concerned, including non-regular shift employees. This activity may be combined with the annual evacuation drills discussed in paragraph 5.4.7.6 but should be performed quarterly88 if no other means of familiarization are used. Use of recordings to familiarize new employees/transferees may be used in lieu of quarterly alarm activations. 5.4.7.6 Annual evacuation drills. Evacuation drills shall be conducted at least annually, and should be preceded by written notice, posted signs, or voice announcement. Surprise test evacuations shall not be conducted.89 5.4.7.7 Visitor training. Untrained visitors to an area covered by a CAS should be instructed in the proper response to a CAS alarm and escorted consistent with FMCA entry requirements or as necessary to maintain control. 88ANSI/ANS-8.19-1996, section 7.2.3. 89ANSI/ANS-8.19-1996, section 7.3. DOE G 421 .1-1 8-25-99 63 5.5 EMERGENCY PREPAREDNESS. Each installation where criticality accident alarm systems are installed shall have an emergency preparedness plan, program, and capabilities to respond to credible nuclear criticality accidents. In addition, organizations, local and offsite, that are expected to respond to emergencies shall be made aware of conditions that might be encountered, and they should be assisted in preparing suitable procedures governing their responses. 90 For a somewhat more detailed discussions, see Reference 2.3.1.11, section 10, and Reference 2.3.1.15. The reader is referred to "A Review of Criticality Accidents" by William R. Stratton (paragraph 2.3.2.6 of this Guide) for detailed discussions of some of the criticality accidents that have occurred in the past, and to "An Updated Nuclear Criticality Slide Rule" (paragraph 2.3.2.10 of this Guide) for a tool to provide capability for the continuing updating of accident information during the evolution of emergency response. 90 ANSI/ANS-8.1-1983,R88, section 4.1 .7. 64 DOE G 421.1-1 8-25-99 5.6 NUCLEAR CRITICALITY SAFETY CONTROL PRINCIPLES AND METHODS. This section provides nuclear criticality safety principles, practices, and control methods to be used for prevention of criticality accidents. An assessment of a design should be made as early as practical to determine if the potential for a criticality accident exists.

The decreasing order of preference for establishing subcritical limits (as specified in ANSI/ANS- 8.1 )91 should be experimental data, computational methods benchmarked against experimental data, and computational methods which extend the area of applicability of experimental data with an adequate additional margin of subcriticality. Except for instances relying upon broadly peer reviewed evaluations of "critical," "subcritical," and "safe" values determined from applicable data measurements such as in Nuclear Criticality Control of Special Actinide Elements92, the use of completely non-benchmarked, non-validated computational methods is inconsistent with ANSI/ANS-8.1 and is unacceptable. Without some form of validation or logical theoretical basis, there is no way to determine an adequate margin of subcriticality or margin of safety. Nuclear Criticality Safety Evaluations (NCSEs) should utilize cost-effective conservatism whenever practical. NCSEs should include logical explanations of how design features, controls, and planned responses to events are conservative, simple, and consistent, and how they encompass all credible scenarios. Where practical, NCSEs should also include numeric comparisons between measurable parameters affecting criticality safety. Conservative assumptions involving these parameters increase the calculated effective multiplication factor compared to actual conditions or non­ conservative assumptions. However, conservatism is different from setting a minimum safety margin such as requiring that the calculated effective multiplication factor not exceed a specified value, often 0.95, after the occurrence of any single contingency. (See paragraph 5.6.1.1, item 14, for further discussion of keff limits.) Specific items to be considered in making these comparisons include uncertainties in chemical and isotopic compositions, manufacturing tolerances, minor deviations, and other random variations in critical experiments as well as in all actual and postulated situations to be evaluated for criticality safety. For example, when performing criticality safety calculations for slurries of uranium oxide, it is customary to assume that the uranium is at the maximum enrichment permitted in the facility, the oxide is at the most reactive credible density, and water fills all voids resulting in maximum reactivity. It is also customary to perform a parametric search to find the solid/liquid ratio that yields highest k e" and use that ratio to derive controls. However, it is not necessary that each simplifying assumption be shown to increase calculated k e". It is only necessary that the overall result of interpretations of data, assumptions, approximations, and simplifications (as either inputs to, or outputs from, evaluations, analyses, and supporting documents) be conservative, and that this is clearly documented. That is, it is acceptable if some individual simplifying assumptions decrease reactivity, or if the effect on reactivity is indeterminate as long as the documentation makes it clear that, overall, the actual margin of safety meets or exceeds the minimum margin required. Also, it is acceptable if the actual safety margin is quite different for different cases as long as there is a clear rationale for the trend and unless the degree of conservatism is excessive. Excessive conservatism is any approximation or combination thereof that results in an excessive safety margin and thus needlessly hinders the mission of the facility or usurps resources. Details concerning Nuclear Criticality Safety Evaluations can be found in DOE-STD-3007-93, "Guidelines

91ANSI/ANS-8.1-1983,R88, section 4.2.5. 92ANSI/ANS-8.15-1981,R87. DOE G 421.1-1 8-25-99 65 for Preparing Criticality Safety Evaluations at Department of Energy non-Reactor Nuclear Facilities," paragraph 2.3.2.3 of this Guide. Geometry of single objects of fissionable material or shape and size of the fissionable material inside containers, and assumptions about or changes thereto, often playa dominant role in conservatism. Fortunately, in almost all cases of single fissionable units, circular geometries such as spheres and cylinders with height approximately equal to diameter are more reactive than other geometries for the same volume and contents. Also, an out-of-round or dented cylinder typically will be less reactive than a perfectly circular one. A typical conservative approximation is to model a fissionable material mixture whose shape is uncontrolled as a sphere because a sphere has the lowest neutron leakage ratio and is thus the most reactive shape in practically all cases. (Refer to E. D. Clayton's "Anomalies of Nuclear Criticality," (paragraph 2.3.2.3 of this Guide) for exceptions to this and other conservative simplifications.) This example achieves two desirable goals: first, it encompasses all possible shapes, and second, it greatly simplifies the calculations. However, not every case of increasing size or changing shape to increase reactivity qualifies as a conservatism. For example, increasing the inside diameter of a cylindrical dissolver in a calculational model to allow for corrosion over the dissolver's expected service life is not in itself a conservatism, because at some point the inside diameter may achieve the value used in the evaluation. To be conservative, the engineering calculation that yielded the corrosion allowance shall also include all associated uncertainties in projected usage of the dissolver. Conservatism is closely linked with other safety principles and practical considerations such as the need for consistency and simplicity in applying criticality safety. For example, rounding down mass limits on fissionable material quantities to a set of consistent, easy to remember values creates many conservative simplifications. However, adopting a uniform set of limits may cause the degree of conservatism to vary widely from place to place in the facility; exceptions to rote consistency may be warranted to avoid excessive conservatism. One should strive for a practical balance between excess conservatism arising from overly simplified, too-consistent limits and confusion that may arise from having too many exceptions. Worker knowledge should be continually tested, and operational mistakes should be reviewed to determine if the set of limits is too complex or whether conservatism can be safely relaxed. 5.6.1 Double-Contingency Principle (Application). Criticality prevention shall be based upon the Double-Contingency Principle (Application) of DOE Order 420.1, Section 4.3, which states (with explanatory text shown in square brackets):

Process designs [and storage areas] shall incorporate sufficient factors of safety to require at least two unlikely, independent, and concurrent changes in process conditions [contingencies] before a criticality accident is possible. Protection [or defenses against the two contingencies] shall be provided by either (i) the control of at least two independent process [nuclear] parameters -- which is the approach that is completely consistent with the Double Contingency Principle as stated in ANSI/ANS-8.1-1998 and which, when practical, is the approach preferred by DOE to be taken to prevent common-mode [and common-cause] failure, or (ii) a system of multiple controls on a single process [nuclear] parameter, which shall be the alternative approach to be taken only when the preferred approach is shown to be impractical. The number of controls required on a single controlled process parameter shall be based upon control reliability and any features that mitigate the consequences of control failure. In all cases, no single credible event or failure shall result in the potential for a criticality accident, except as referenced in the paragraph that follows. 66 DOE G 421.1-1 8-25-99 An exception to the application of double contingency, where single contingency operations are permissible, is presented in paragraph 5.1 of ANSI/ANS-8.1 0-1983,R88. This exception applies to operations with shielding and confinement (e.g., hot cells or other shielded facilities) . Double contingency shall be demonstrated by documented evaluations. If the alternative approach in (iil, above, is chosen, then the rationale for such choice shall be included in the documented evaluation. The documented evaluations could be in the Criticality Safety Evaluation. 5.6.1.1 Requirements of contingencies. Contingencies shall be independent and not be the result of common-cause failures. The collective judgment of operating and criticality safety staff is required in determining whether two events are related and consequently whether they actually represent two contingencies or a single contingency. For example, exceeding storage limits and then flooding an area would constitute two independent events; however, fire followed by flooding of fissile material from an automatic sprinkler system would be considered a single event. The following guidelines are for selecting contingencies and deriving appropriately conservative calculational models that bound the resultant assumed conditions. Appropriateness in conservatism means not only relevance, but also implies (1) realism in all aspects of evaluations, and (2) cost effectiveness that does not preclude consideration of reasonable alternatives. 1 . Develop and justify a set of contingencies to evaluate for criticality safety. a. Use other reference or other guidance documents describing contingencies, e.g., maximum credible flood depth in the facility. b. If existing guidance is not adequate, develop and justify the magnitude of each type of contingency and the resultant effects on nuclear criticality safety. E.g., if the maximum credible flood depth is two feet above floor level in a given facility, objects of or containing fissionable material located more than two feet off the floor may not be flooded. However, account for any incidental moderation and reflection of other objects that may occur because of the contingency. c. Be consistent, and explain apparent inconsistencies in the contingency selection and justification logic.

d. Document the nature of, and justification for, contingencies and supplemental explanations. 2. Demonstrate subcriticality for the contingencies selected for evaluation using the Double­ Contingency Principle. See paragraph 3.62 for documentation of double contingency. 3. Unless it would be a futile exercise or would result in economic infeasibility, perform the evaluation of the contingency or subset of contingencies to maximize kett by adopting an appropriately conservative calculational or handbook model. DOE G 421.1-1 8-25-99 67 a. For example, if flooding of a large container (e.g., a glovebox) is the contingency, assume that the water and fissionable material form a sphere that becomes optimally moderated and fully reflected by water. b. It may be necessary to refer to handbooks or perform a set of parametric calculations to determine optimum moderation. If necessary, parametric studies using simple models are relatively easy to set up, inexpensive, and easy to check. c. While this approach may yield restrictive limits, contingency selection, modelling, and interpretation errors are less likely than when using complex models. d. If the limits from the first cut effort by operating and criticality safety staff are not overly restrictive and are in harmony with other criticality safety limits, adopt them. 4. If an appropriately conservative evaluation produces (or it is reasonable to expect that one would produce) unacceptably high keffs for the desired fissionable mass or other parameters, next consider physical and chemical factors or passive barriers that realistically prevent the most reactive state from occurring. a. Justify the assumed revision of the effects of the contingency on the fissionable material and associated material as necessary. b. It is prudent to perform parametric studies to determine the relative importance of an assumption, e.g., determine keffs for a range of moderation including optimum moderation and the perceived natural limit due to chemistry or physics of the situation versus the benefit of taking advantage of the phenomenon or taking credit for barriers. 5. It is even more important to carefully consider the reliability of assumptions and barriers that are relied upon to reduce keff to a safe value in evaluating contingencies. This is illustrated by continuing the glovebox example. If the glovebox contains only finished fuel pellets of stable, high density oxide, the effect of the contingency of breaking a water line inside the glovebox may be interpreted quite differently than if the glovebox contains less stable materials. For typical gloveboxes, it is highly unlikely that such a line break will cause a flow rate sufficient to disturb fuel pellets. a. Therefore, the dimensions of the fuel in the calculational model may be changed to approximate the dimensions of a group of pellet trays, a much less reactive shape than a sphere. b. Also, the degree of moderation used in the calculations may be the relatively low moderation ratio that would result from water filling the small gaps between rows of pellets. c. It may reduce keff significantly further to include dimensions and orientation of the pellets or to approximate their shape in the model. However, modeling small items, besides making the model more complex, has other drawbacks; some codes and cross sections produce non-conservatively low keffs unless flux- and volume-weighted cross sections are generated and used correctly.

68 DOEG421.1-1 8-25-99 d. Additionally, because it is not credible to flood the entire building and because glove boxes are typically a few feet above the floor, it may be acceptable to assume that the underside of the array of pellet trays is only minimally reflected. e. This combination of assumptions exemplifies the concept of minimum conservatism, i.e., acceptable reduction in conservatism resulting from incorporation of realistic conditions inherent in the process being analyzed, and yields maximum limits for a given contingency scenario. HOWEVER, CAUTION IS INDICATED AS DISCUSSED BELOW! 6. Another contingency scenario involving minimum conservatism for the same glovebox could be stacking trays of pellets (against the rules) to create a more reactive geometry while assuming essentially no moderation in the calculational model. Here, the assumption is that two unlikely, independent events will not occur concurrently. 7. The caveat in using calculational models with minimum conservatism, especially when some assumptions depend upon complying with administrative controls, is that one or more assumptions used to create the model may become invalid concurrent with the process upset. This is illustrated by considering the glove box example further. a. Suppose the glovebox normally contains acid, and that, because of the flooding, the lid to the acid bottle comes off, the acid mixes with the water, and the mixture dissolves the pellets partially. b. Or suppose that personnel store items under gloveboxes (there being no rule preventing this); thus, in the flooding scenario, reflection may more closely approximate full water reflection on all sides. Even if criticality safety establishes a rule not to store items under gloveboxes, that is a convenient and inviting place to store items, and it is likely that the rule will be occasionally ignored. 8. Continuing the example, it is not likely that the rule mentioned above against stacking pellet trays will be broken. a. This is because only trained fissionable materials handlers have access to the insides of gloveboxes. b. Nevertheless, a combination of circumstances may occur to cause two seemingly independent contingencies to occur simultaneously. c. For example, a worker maneuvering a safe stack of trays of fuel pellets in a glovebox may break a water line and, being distracted by the spray of water, place these trays down on another stack of such trays, thus exceeding the safe stack height. While personnel are considering what to do, water fills the glovebox, moderating and reflecting this unsafe stack of pellet trays. Thus, a single initiating event may propagate and result in multiple contingencies, which are not truly independent in this example. 9. Less conservatism in selecting contingencies and their effects requires more in-depth study and calculations, and may result in necessitating other limits and requirements that in toto may be just as restrictive as the low limit resulting from applying more conservatism. DOE G 421.1-1 8-25-99 69 10. Less conservatism may result in training becoming more complicated, and it may be necessary to review for criticality safety more frequently and more closely to ensure that subtle misunderstandings and changes to equipment or the facility do not invalidate assumptions made in the evaluation. There may be no real benefit to the organization as a whole by producing a larger limit based on less conservative interpretations of contingency scenarios, a conclusion thus garnered by using the principle of integrated safety management.

11. Therefore, insofar as practical, use simple, appropriately conservative methods and models to address each contingency, and consider other alternatives before reducing conservatism. These include establishing physical barriers or administrative controls to mitigate the effects of contingencies. 12. Criticality safety personnel are expected to confer with cognizant personnel to determine the reasonableness of models and the effect that excess or even moderate conservatism may have. However, experienced personnel can attest to actual situations during contingencies in which criticality did not occur because of conservatism in the calculational model and resultant limits. 13. Conversely, contingencies should also be considered in the light of total safety. The consequences of accidental criticality for a given contingency or subset of contingencies may be overshadowed by other consequences associated with the events. a. In particular, there are some DOE facilities that cannot be expected to survive certain design basis accidents or design basis events. b. For example, if the non-criticality accident consequences of a contingency scenario would include fatality to all personnel in the area who might receive significant doses from a criticality, preventing criticality for that scenario is moot. c. Nevertheless, insofar as is practical, criticality safety controls should be established to protect rescue, fire-fighting, and other personnel from undue radiological exposure and contamination resulting from a criticality accident while they are involved in mitigating or recovering from contingencies. 14. In addition, contingencies should be considered in the light of total system behavior. Subcriticality, when determined by kelt for example, should be used to assess safety only in conjunction with its relation to parametric curves representing the system under consideration. For example, the often-referenced "safe" condition of kelt = 0.95 could be overly conservative at a point on the flat of a kelt vs. H/X parametric curve, but very non-conservative on the steep upward slope of such a curve. In addition to determining keff' analyses should discuss subcritical limits in terms of sensitivities to changes in relevant parameters (e.g., mass, concentration, density, enrichment, moderation, reflection). 5.6.1.2 Scope of contingencies. Single events that are beyond Design Basis Accidents (DBAs) are outside the scope of double-contingency principle requirements. 5.6.1.3 Double-contingency analysis. A double-contingency analysis shall be included as part of the criticality safety analysis for processes, pieces of equipment, storage, and transportation involving fissionable material. Additional guidance on preparation of a double-contingency analysis is provided in paragraph 5.7.7.1. 70 DOE G 421.1-1 8-25-99 5.6.1.4 Contingency controls reliability. Contingency barriers (controls) are engineered safety features, parameter limits, and other administrative controls that render a contingency unlikely or mitigate its effects. These barriers should be made highly reliable such that each contingency, including credit for mitigation, should have an estimated return period of less than 1 O-ltyr. Engineering judgment may be the basis of making a determination that a control is highly reliable. Guidance on failure probabilities of contingency barriers (controls) that are acceptable are provided in references 2.2.2.8 and 2.3.1.18. In addition, efforts should be directed toward maintaining the estimated recurrence interval for a criticality accident to a value less frequent than 10-4 /yr at any given nonreactor nuclear facility. See also paragraph 5.7.7.1.

5.6.1.5 Contingency control margin of subcriticality. No single contingency shall result in kef! exceeding the upper subcritical limit as discussed in paragraphs 5.8.4 and 5.8.5 or as developed from directly applicable critical or subcritical experimental measurements. Nuclear parameters that are not controlled to some limit shall be assumed to take the most reactive credible values when determining whether keff could exceed the upper safety limit. 5.6.1.6 Treatment of dependent contingencies. If contingency barriers are not independent, common causes should be identified, such as common power supplies, common methods of calibration, common components, and steps taken to remove common-cause failure dependencies to the extent practical. If common-cause failures of contingency barriers cannot be eliminated, the common-cause may be acceptable if the common features can be shown to fail in a manner that maintains the minimum margin of subcriticality for any given contingency. 5.6.1.7 Identification of engineered or administrative controls. Each passive engineered control, active engineered control, or administrative control (see paragraphs 5.7.4.1.1 - 5.7.4.1.3 below) associated with a contingency barrier shall be configuration controlled. 93 Engineering drawings should also identify such contingency barriers. 5.6.1.8 Exception from Double-Contingency Principle. Application of the Double-Contingency Principle shall not be required for contingencies that are highly unlikely. Highly unlikely is defined as an estimated annual frequency of occurrence of less than 10-4 /yr. That is, from an analysis standpoint, the potential for criticality as a result of a single contingency may be acceptable as long as the estimated annual occurrence of that contingency is less than 1 0-4/yr. Examples of such events are (1) earthquake in spent fuel storage basin, and (2) evaporation in a tank containing a solution of fissionable material under concentration control. If there is no substantive basis for estimating that a potential accident scenario is highly unlikely, whether by probabilistic assessment, engineering judgment, or data, then the double-contingency principle shall be applied. Sound engineering judgment should always be used. When an inadequate data base exists for estimating event probabilities, then sound, risk-informed engineering judgment dictates use of double contingency. However, see paragraph 5.6.1.11 below. See also paragraph 5.7.7.1. 5.6.1.9 Preferred hierarchy of controls. To the extent practicable, contingency barriers should employ passive engineered controls over active engineered controls over administrative controls. 5.6.1.10 Avoidance of administrative controls. All reasonable efforts should be directed toward avoiding the use of administrative controls only (see paragraph 5.7.4.1.3 below) as the sole barrier to a criticality accident. 93ANSI/ANS-8.1-1983,R88, sections 4.1.3, 4.2.3, and 4.2.4. DOEG421.1-1 8-25-99 71 5.6.1.11 Exemption from double-contingency principle. If "double-contingency" protection cannot be provided, an exemption from DOE Order 420.1, Section 4.3 shall be obtained. 5.6.2 General Nuclear Criticality Safety Control Principles and Practices. The following are principles and practices used in the control of nuclear parameters. 5.6.2.1 Safety assurance. Nuclear criticality safety should not be compromised for the sake of expediency, production, or economic pressure.

5.6.2.2 Potential criticality assessment. An assessment of a facility or equipment design should be made as early as practical to determine if the potential for a criticality accident exists. When such potential exists, facility and equipment designs shall meet applicable DOE Orders, ANSI/ANS standards, and other regulations related to nuclear criticality safety. 5.6.2.3 Burn-up credit. Criticality safety evaluations for undissolved reactor fuels and targets should be based on beginning-of-life (pre-irradiation) fissionable material concentrations and enrichments except when irradiation depletes lumped absorbers or increases fuel reactivity (burn-up debit) or when specific power histories and burn-up are technically demonstrated. 5.6.2.4 Storage. Storage of fissionable materials should be consistent with the guidance provided in paragraphs 2.3.1.5, 2.3.1.6, 2.3.1.8, 2.3.1.10, and 2.3.1.13, 2.3.1.14, 2.3.1.15, unless specific nuclear criticality safety evaluations have been performed. 5.6.2.5 Special actinide element evaluations. Criticality safety control of special actinide elements should be consistent with paragraph 2.3.1.9, unless specific validated and verified nuclear criticality safety evaluations have been performed. Additional information is presented in "Criticality and Fissionability Properties of Selected Actinide Nuclides" (paragraph 2.3.2.7 of this Guide). 5.6.2.6 Subcritical neutron multiplication measurements. Subcritical neutron multiplication measurements should be consistent with guidance in paragraph 2.3.1.4. 5.6.2.7 Criticality accident alarm systems. The implementation and functioning of, and employee familiarization with, criticality accident alarm systems should be consistent with paragraph 2.1.13 and Section 5.4. 5.6.2.8 Process and equipment design. Design of processes or equipment should make proper operation convenient and misoperation either inconvenient or impossible. 5.6.2.9 Process analysis. Before beginning an operation involving fissionable materials, or changing an existing operation, it shall be determined that the entire process will be subcritical under both normal and credible abnormal operating conditions. Care shall be exercised to determine those conditions that result in the maximum effective neutron multiplication factor. 94 5.6.2.10 Bases for subcriticality. The basis for establishing subcriticality should be identified for all significant conditions at each step in the process. In the case of established facilities or operations, this may consist of references to appropriate existing criticality safety analyses. 94ANSIIANS-8.1-1983,R88, section 4.1.2. 72 DOE G 421.1-1 8-25-99 5.6.2.11 Operating procedures. Routine operating limits should incorporate safety margins to protect against uncertainties in process variables and against a limit being accidentally exceeded. 5.6.2.12 Exempt quantities of fissionable materials. The Criticality Safety Organization for each installation, site, and/or facility shall justify and document the quantities of fissionable materials that do not require Nuclear Criticality Safety Evaluations and do not require criticality safety controls. 5.6.3 Nuclear Parameters Important to Nuclear Criticality Safety and Their Control. Control of one or more of the following nuclear parameters shall be incorporated into the design, operation, and administration of a fissionable material facility to the extent necessary to ensure conformance to the principles set forth in paragraphs B.l and 5.6.1. Care should be taken for such designs of potential safety systems with attendant inspection and surveillance, as appropriate. More detailed information about the control of these nuclear parameters may be found in Section 5.7.

5.6.3.1 Geometry control. Geometry control is the limitation of dimension and geometry to provide inherently "geometrically safe" or "geometrically favorable" containers, vessels, drains, and sumps for fissionable materials. 5.6.3.1.1 Equipment design reliance. Where practical, reliance should be placed on equipment design in which dimensions are limited (geometry control). Full advantage may be taken of any nuclear characteristics of the process materials providing that their presence has been verified and is monitored for continuing presence. All dimensions and nuclear properties upon which reliance is placed shall be verified prior to beginning operation, at appropriate intervals, and if significant .. changes are made or discovered.95 5.6.3.1.2 Fissile solution transfers. Where fissile solution transfer between geometrically favorable and geometrically unfavorable vessels is possible, at least one passive or two active means of control such as block valves or pipe blanks (in addition to administrative means of control) should be used to prevent inadvertent transfers. 5.6.3.1.3 Allowances with geometry control. When using geometry control, allowances shall be made for corrosion, distortion, erosion, and manufacturing tolerances. If distortion is a potential problem, steps should be taken to prevent it such as pressure relief valves, internal stay-bolts, rupture discs, heavier wall thickness, external bracing, and the use of more inherently stable geometries. In addition, subcriticality shall be based on the worst credible geometry conditions. 5.6.3.1.4 Control monitoring. Nuclear criticality safety controls should include provisions for periodic evaluation by an inspection program, use of corrosion specimens, or other techniques, if credible corrosion or erosion could change the geometry (or thickness) in a system that depends on geometry (or thickness) for nuclear criticality safety. 5.6.3.1.5 Thermal insulation concerns. The design of heating or cooling jackets should include consideration of leaks of fissionable material into such jackets. Appropriate measures shall be taken to preclude accumulations of fissionable material in jackets such that a criticality accident is possible. 95ANSI/ANS-8.1-1983,R88, section 4.2.3. DOE G 421.1-1 8-25-99 73 5.6.3.1.6 Sump designs. Sumps should be designed such that nuclear criticality safety is ensured if a credible mechanism exists for accumulating fissionable material in the sump. 5.6.3.1.7 Floor drains. Where applicable, floor drains should be designed to preclude the accumulation of fissionable material in traps and piping that could cause a criticality accident. 5.6.3.1.8 Inadvertent transfers. Process systems should be designed to prevent the carryover of fissionable material capable of causing a criticality accident from geometrically safe/favorable portions of a facility to other areas not having geometry control. 5.6.3.1.9 Backflow prevention. A system of positive control and backflow prevention, such as air gaps, should be used to prevent the inadvertent transfer of fissionable material capable of causing a criticality accident from geometrically safe/favorable vessels to unsafe vessels.

5.6.3.2 Spacing (interaction) control. Spacing control is used to restrict neutron interaction between and among various units, vessels, containers, and accumulations of fissionable materials to prevent nuclear criticality. It may include controls on spacing, arrangement, and shielding (neutronic isolation). Spacing provided by passive engineered controls is preferred over spacing provided by active engineered controls which, in turn, is preferred over spacing provided by administrative controls. Use of other than passive engineered features to provide spacing should be justified. 5.6.3.2.1 Storage and transfer. Individual items of equipment and containers holding fissionable materials, when arranged in a group, in storage, or when being transferred within a nuclear facility or between facilities onsite, should be spaced so that the entire array is subcritical for all conditions that affect or might affect the nuclear facility or site. Movement of material under credible in-facility and onsite accident conditions shall be considered. 5.6.3.2.2 Storage rack integrity. Storage racks shall be designed to maintain their integrity during and following a design basis earthquake and the design basis accidents they are required to withstand. 5.6.3.3 Neutron absorber (poison) control. For the purpose of this Guide, a neutron poison is any material for which credit is intentionally taken for an operation or a piece of equipment to maintain subcriticality. Control using solid neutron poisons incorporated into passive engineered controls such that the neutron poisons are protected from dissolution or dispersion is preferable to soluble neutron poisons controlled by active engineered controls. That form of control is preferable to concentration of soluble neutron poisons controlled by administrative controls. When poisons are specified, use of other than solid neutron poisons incorporated into protected passive engineered controls shall be justified, including a description of the need for a neutron poison (solid or liquid), its distribution, concentration, and permanence. 5.6.3.3.1 Suitability. Neutron poisons, such as cadmium, boron, and gadolinium, may be used to maintain equipment and processes subcritical, provided measured data or validated computational results confirm the effectiveness of the neutron poison and ensure its presence and reliability. 5.6.3.3.2 Raschig rings. The use of borosilicate-glass Raschig rings for packed vessels shall be consistent with the applicable document in paragraph 2.3.1.3. The use of borosilicate-glass Raschig rings for applications other than packed vessels shall be based on a documented criticality safety analysis. 74 DOE G 421 .1-1 8-25-99 5.6.3.3.3 Representative samples. Use of representative samples, such as corrosion coupons, to verify the continued presence of a fixed poison should require approved documentation that demonstrates that the samples actually represent the poison system. 5.6.3.3.4 Minimum soluble poison concentration. The minimum soluble poison concentration shall be at least 100% of the poison concentration required to ensure the validated and documented subcritical limit under any contingency. 5.6.3.3.5 Soluble poison monitoring. Two independent methods of determining the operating concentration of a soluble poison should be provided to confirm that the poison concentration limit is satisfied. The presence of soluble poison should be monitored at a frequency that provides for automatic or operator initiated protective action in the event of process upsets. Extraordinary care should be taken with solutions of poisons because of the difficulty of exercising intended distribution and concentration control of solutes. 96

5.6.3.4 Concentration (density) control. Concentration and density are different concepts -­ concentration connotes a fissionable material solution, molten salts, or a fine dispersion in another media; density connotes only one medium, the fissionable material. Concentration control is typically used to provide restrictions on the permitted concentrations of fissionable material dissolved or dispersed in another medium. For example, density control is meaningless for low enriched uranium metal and many compounds while concentration control may be vital. Sources of weaknesses of concentration controls are: evaporation, precipitation, phase change (organic to aqueous phase and vice versa), fire in an organic phase, flocculation, plate-out, centrifuging suspended solids, non-representative sampling, solids building up on filters, and not sampling for all fissile nuclides present. Density controls are generally applied to restrictions on fissionable material mass-to-volume values of powders, metal chips, machine turnings, etc. On occasion, density restrictions are applied to allowable chemical compounds or physical states for fissionable materials at particular process stages, work stations, and storage areas; and restrictions on the allowed fissionable mass per unit area (such as a floor or the bottom of a glovebox). 5.6.3.4.1 Process changes in density. If the determination of a concentration (density) limit assumes fissionable material in solution, it should be shown that the change to a more reactive state due to precipitation or transfer to a second phase is not credible before the change is eliminated from consideration as a contingency. 5.6.3.5 Moderation control. Moderation controls are used to provide restrictions on the allowed range of moderating material relative to fissionable material in moderator/fissionable mixtures or solutions (typically H/X, D/X, Be/X, C/X atom ratio) or on the total amount of moderating materials allowed. Such controls may be applied to ensure that the fissionable material remains dispersed and dilute. In other cases, the controls may be applied to ensure that the fissionable material remains dry. 5.6.3.5.1 Monitoring neutron moderation. For operations in which nuclear criticality safety depends upon control of neutron moderation, there should be assurance that the prescribed extent 96ANSIIANS-8.1-1983,R88, section 4.2.4. DOE G 421.1-1 8-25-99 75 of moderation remains unchanged or that, if a credible change occurs, the reactivity of the system remains below acceptable subcritical limits. Such assurance should include consideration of all credible accidents involving any moderator or combination of moderators. 5.6.3.5.2 Consideration of interstitial moderation. Interstitial moderation should be considered whenever such moderation is credible. 5.6.3.5.3 Consideration of non-aqueous moderation. If moderators more effective than water may be present, their effects should be considered and controlled. 5.6.3.5.4 Installed fire protection systems. In and of itself, the activation of installed fire protection systems should not be capable of causing an criticality accident. If nuclear criticality safety considerations preclude the use of water sprinkler systems, other fire control measures should be utilized. 5.6.3.5.5 Exclusion of moderating materials. When moderation control is employed, enclosures (e.g., gloveboxes), material transport (e.g., trucks), and material transfer systems (e.g., conveyor lines) should be designed such that moderating material in excess of established limits cannot be added accidentally to otherwise safe enclosures or systems.

5.6.3.5.6 Use of water in fire fighting. Efforts should be made, to the extent practical, not to restrict fire fighters' use of water. If the use of water is permissible for fire fighters, consideration should be given to loss of spacing control caused by the force of the water stream in addition to change in reflection and moderation. 5.6.3.6 Reflection control. Reflection control provides restrictions on the quantity, composition, and configuration of hydrogenous or other effective neutron reflecting materials in proximity to fissionable material. 5.6.3.6.1 Assumptions about neutron reflection. Nuclear criticality safety limits should be based on full water reflection unless actual reflection is more reactive than water, or unless reflection is controlled, or it is not credible to achieve full reflection. Both normal operating conditions and credible accident conditions shall be considered. 5.6.3.6.2 Avoidance of reflection control. In general, reflection controls based on limiting personnel access to a system to maintain nuclear criticality safety should be avoided. In those few cases where reflection controls are needed that are based on limiting personnel access to a system, the INCSRC should review and concur with such limits on a case-by-case basis. 5.6.3.6.3 Use of water in fire fighting. Efforts should be made, to the extent practical, not to restrict fire fighters' use of water. If the use of water is permissible for fire fighters, consideration should be given to loss of spacing control caused by the force of the water stream in addition to change in reflection and moderation. 5.6.3.7 Mass control. Mass controls provide restrictions on the quantity of fissionable material permitted in individual units, in work areas, in a total configuration, or in the total number of units. 5.6.3.7.1 Over-batching. For operations depending upon mass controls, where the contained volume does not automatically limit the contents to a subcritical mass or less, multiple batching, or over-batching, should be controlled to prevent unsafe accumulations. 76 DOE G 421.1-1 8-25-99 5.6.3.7.2 Double batching. In areas where double batching is credible, mass limits should include allowances for double batching. 5.6.3.7.3 Material form. If the determination of a mass limit assumes fissionable material in a physical or chemical form, it shall be shown that the change to a more reactive state, such as precipitation from a solution, freezing, or transfer to a second phase is unlikely before the change may be considered a contingency. 5.6.3.8 Volume control. Volume controls provide restrictions on the fissionable material volume, container volume, or vessel volume (may be specific to fissionable material composition). 5.6.3.8.1 Volumetric limits. Volumetric limits should be based on the minimum volume required to sustain a nuclear fission chain reaction for the given fissionable material and composition. The minimum critical volume should be that associated with the most reactive credible process conditions that may exist within the system, including consideration of system interactions with other process systems and the environment. 5.6.3.9 Enrichment or isotopic control. Enrichment controls provide restrictions on the maximum fraction of fissile or fissible nuclide (usually expressed as weight percent) for a fissionable element such as U or Pu. Operations depending upon such control shall have their nuclear criticality safety limits based upon the credible enrichment or isotopic composition that yields the maximum infinite medium multiplication factor, k~. The operational basis for the assumed isotopic composition or enrichment should be documented as part of the NCSE to provide the validated bases for maximum k~.

DOE G 421 .1-1 8-25-99 77 5.7 NUCLEAR CRITICALITY SAFETY DESIGN AND ANALYSIS GUIDELINES. This section provides general discussions and guidelines for designing, analyzing, and establishing controls for ensuring nuclear criticality safety (NCS) at DOE nonreactor nuclear facilities and fuel handling/storage areas within reactor facilities where the potential for a criticality accident exists. It is applicable to the performance of nuclear criticality safety analyses for new facilities and modifications to existing facilities that may influence the nuclear criticality safety of significant quantities of fissionable materials. A "Graded Approach" should be used as described in paragraph B.1. 5.7.1 Scope. The scope of this section is limited to design and analysis guidelines associated with nuclear criticality safety and does not include other elements of the nuclear criticality safety design and analysis process, such as the nuclear criticality safety evaluation, nor requirements for control of the engineering design process. For this Guide, nuclear criticality safety is the effort to prevent an unplanned and uncontrolled nuclear fission chain reaction. Unlike typical facility industrial safety, nuclear criticality safety is not based on a wealth of historical accident data. It is dependent on the best judgment of personnel assigned to design, analyze, operate, and monitor facilities and operations involving fissile and fissible (fissionable) material. 5.7.2 Overview of the Nuclear Criticality Safety Control Design Process. Nuclear criticality safety is achieved through design and administrative measures. A criticality accident is prevented by controlling various nuclear parameters that influence the potential for criticality. These nuclear parameters include: (1) mass of material, (2) concentration of material, (3) geometry of material and equipment containing material, (4) degree of moderation and reflection, (5) spacing of, and interaction among, units containing fissionable material, (6) enrichment of the fissionable isotopes, and (7) the degree of neutron absorbers (poisons). 5.7.2.1 Major projects. At the beginning of facility design or modification, facility, equipment, and process criteria (design criteria) are established, and major systems are identified. As the design evolves, processes and equipment are identified, flow rates and production rates are established, and the types, volumes, and masses of fissionable material and associated materials are identified. The number and locations of connections of process lines and needed auxiliary systems, equipment, and materials are also incorporated into the design. Throughout the design process, there are various types of reviews that should be conducted. The following important reviews ensure that nuclear criticality safety is properly incorporated into the design. 5.7.2.1.1 Preliminary process hazards review. Prior to the issuance of a Functional Design Criteria, a Preliminary Process Hazards Review should be performed to determine if the facility will be handling fissionable materials, regardless of amounts or concentrations, and whether the potential exists for a nuclear criticality accident. If it does, the Preliminary Process Hazards Review Report should state as an action item that the design should comply with the general principles and objectives presented in this document, including application of the double-contingency principle (see paragraph 5.7.7).

5.7.2.1.2 Design process and design reviews. It is imperative that design considerations affecting nuclear criticality safety begin very early in the design process. Information will be required from a nuclear criticality specialist that provides quantitative data on the limits for various parameters that influence criticality that, if exceeded, could result in a criticality accident. These data will depend on the types and forms of the fissionable materials involved. As is common to any design process, an iterative approach is required to arrive at a design concept that is both acceptable and optimized from a nuclear criticality safety standpoint. An illustration of the general iterative process for implementing nuclear criticality safety is shown in Figure 5.7.2.1.2-1. The goal for the final design 78 DOE G 421 .1-1 8-25-99 should be the attainment of the six basic design objectives presented in paragraph 5.7.3. The Design Process Hazards Review (conducted by the design organization, operations personnel, and a cognizant nuclear criticality safety specialist) should confirm design adequacy relative to the six basic objectives, including documentation of the application of the double-contingency principle. 5.7.2.1.3 Preoperational process hazards review. The design process (paragraph 5.7.2.1.2) should identify criticality hazards associated with the design concept and provide appropriate controls. However, the Preoperational Process Hazards Review (that is conducted by facility management with assistance from the cognizant nuclear criticality safety specialists) offers an excellent opportunity to independently review design adequacy relative to nuclear criticality safety and to implement improvements prior to start-up, as needed. Documentation of the design, as specified in paragraph 5.7.9, should provide a major information source for this review. The preoperational review should (a) confirm design adequacy as measured against, the six basic design objectives presented herein (paragraph 5.7.4), (b) confirm that facility, equipment, and process conditions conform to the intended design, (c) examine the nuclear criticality safety control methods and the means of control incorporated in the design, and confirm the judgments made during the design process as to the expected reliability of such controls, (d) review the results of Deductive Logic Tree Analyses, Inductive Logic Tree Analyses, Failure Modes and Effects Analyses, Direct Accident Postulation, or others performed on the design (if available) for any insights into potential areas of weakness, (e) identify, based on the above, any design improvements relative to nuclear criticality safety, as needed, and (f) ensure that all nuclear criticality safety controls, either implemented by initial design or by follow-up improvements, are properly documented, such as by analyses, procedures, and drawings. In this regard, it is important to maintain a documented trail of the application of the double-contingency principle. The preoperational review should cover the conduct of facility operations to include configuration control and maintenance policies that will govern the operation, care, and preservation of those engineered and administrative controls that are of importance to nuclear criticality safety. 5.7.2.2 Projects involving modifications to existing equipment.

5.7.2.2.1 Screening process hazards review. Cognizant nuclear criticality safety specialists should identify hardware for which proposed changes must receive nuclear criticality safety design and analysis prior to implementation. Care should be taken to ensure that the double-contingency principle is not compromised. Documentation of double-contingency considerations should be DOE G 421.1-1 8-25-99 DEFINE PROCESS CONDITIONS. SYSTEMS, PROCEDURES AND EQUIPMENT. EVAlUATE AND SElECT PARAMETERS TO BE CONTROLLED FOR NCS. SPECIFYNCS PARAMETER CONTROL. IDENTIFY POTENl1Al CRI11CAL1TY SCENARIOS. 79 MAKE DESIGN, PROCESS '>-";;;';;;""'-I~ AND CONTROL PROPOSAlS. Figure 5.7.2.1.2-1. Illustration of iterative process for development of nuclear criticality safety controls. 80 DOE G 421.1-1 8-25-99 maintained. Modifications that involve a loss or compromise of nuclear criticality safety controls, particularly loss of double-contingency, should be reviewed as potential unreviewed safety questions. 5.7.2.2.2 Preliminary process hazards review. If the screening process hazards review requires resolutions of issues among several technical disciplines, a preliminary process hazards review team may be formed for the purpose of resolving these issues. 5.7.2.2.3 Preoperational process hazards review. Action items are reviewed as described in paragraph 5.7.2.1.3 during the Preoperational Process Hazards Review. Issuance of the final Preoperational Process Hazards Review indicates closure of all action items, proper documentation of all action items (including double-contingency), and formal acceptance of the action items as described by responsible line management. 5.7.3 Six Basic Nuclear Criticality Safety Control Design Objectives. Risk control for nuclear criticality safety is primarily directed toward reduction of accident probability by means of process controls. In arriving at a final nuclear criticality safety analyzed and approved equipment/process concept, focus should be directed toward achieving six basic nuclear criticality safety control design objectives discussed in this section. 5.7.3.1 Objective 1 - to control criticality probability using a preferred hierarchy of controls. A variety of criticality safety control methods exist that may be considered for application in a given case, such as geometry control, spacing control, and mass control. Not all methods of control are equally preferred. Three basic means of control (passive-engineered, active-engineered, and administrative) are presented and ranked in order of preference, and are discussed later in paragraph 5.7.4, "Means of Controlling the Criticality Risks," where this objective is discussed in detail. 5.7.3.2 Objective 2 - to identify potential criticality scenarios. A necessary step in evaluating and controlling a risk is recognizing its existence. Even though many potential paths to a criticality event will be obvious, other potential paths will not be obvious. Paragraph 5.7.5, "Identifying Potential Criticality Scenarios," expands upon this objective. Four important approaches to successful identificatipn are discussed. A deductive logic tree approach is illustrated with an example.

5.7.3.3 Objective 3 - to eliminate potential criticality scenarios to the extent practical. Although a potential criticality scenario may be shown to meet the minimum standard for acceptability (Objective 4), it is preferred, whenever feasible, that the risk be eliminated entirely from the fissionable material process, even though the probability of occurrence of a given criticality accident scenario is less than some minimum acceptable level, It is better to modify the equipment or process, if practical, to eliminate the scenario entirely, A review of the equipment or process concept should be performed searching for feasible changes that will eliminate a potential criticality scenario. Elimination can be achieved by facility, equipment, or process changes that act to remove the initiating event from an accident sequence. For example, a change from water cooling to air cooling in a given process may eliminate a scenario involving the potential for undesirable moderation. This objective is discussed in paragraph 5.7.6, "Eliminating Potential Criticality Scenarios. " 5.7.3.4 Objective 4 - to demonstrate that criticality risks are acceptably low. Protection against a criticality accident should involve a defense-in-depth approach in which multiple, independent, DOE G 421 .1-1 8-25-99 81 unlikely events must occur before a criticality accident is possible. Paragraph 5.7.7, "Judging Acceptability of a Potential Criticality Scenario," where this objective is discussed further, provides a means to judge acceptability based on an application of the double-contingency principle. In the completely analyzed facility, the equipment and process concept should have credible criticality scenarios identified and should meet the minimum standard for acceptability presented in this section. 5.7.3.5 Objective 5 - to evaluate the operability of criticality safety controls. Selections made during the facility equipment and process design or modification will have a significant effect on the degree of difficulty presented to facility personnel in operating the facility. Paragraph 5.7.8, "Operability of Criticality Safety Controls," discusses this objective and presents nine specific considerations for facility operations. 5.7.3.6 Objective 6 - to document the nuclear criticality safety control design. Proper documentation of all facility, equipment, and process aspects important to nuclear criticality safety is essential for use by personnel in the areas of nuclear criticality safety control design, facility operation, engineering design, design review, and aUditing. The elements of proper documentation are presented in paragraph 5.7.9, where this objective is discussed further. 5.7.4 Means of Controlling the Criticality Risks.

Objective 1 - criticality risks are controlled using a preferred hierarchy of controls. Nuclear criticality safety is achieved by exercising control over various nuclear parameters. Paragraph 5.6.3 describes nuclear parameters that may be controlled for nuclear criticality safety, however, the means of control addresses how the control is achieved in design and operating terms. These nuclear parameters consist of the physical form, mass, and distribution of fissionable materials, and the physical form, mass, and distribution of all other materials with which the fissionable materials are associated. Eight such criticality control methods, each associated with the nuclear parameter controlled for nuclear criticality safety, are (1) geometry control, (2) spacing control, (3) neutron poisons control (fixed and soluble), (4) concentration control, (S) moderation and reflection control, (6) mass control, (7) enrichment control, and (8) density control. A subtle combination of these nuclear parameters is the inherent form of a material that may require "form control" to prevent conversion of the material form from, say, UFe to U02F2 , or from UFe and HF gas to a liquid. Additionally, spent nuclear fuel exhibits inherent combinations of controls 1 through 8, in their respective passive forms, in that it has specific physical constraints on geometry, or rod or pin spacing, resulting in limiting degree of moderation, neutron absorbing fission product inventory, and depleted fissionable material enrichment, mass, and concentration. A given situation may call for employing more than one of these control methods. The "control method" refers to the nuclear parameter being controlled. The "means of contro'" refers to the design/operating mechanism achieving the control. The three basic means of control are (1) passive-engineered control, (2) active-engineered control, and (3) administrative control. For example, concentration control may be achieved by means of an active engineered control such as an eductor (an automatic dilution device) and by means of an administrative control such as sampling. These means of control are not equally preferred for nuclear criticality safety. The passive-engineered means of control is most preferred, followed by active-engineered control, and then administrative control. Guidance in the preferred use of the basic means of control is provided in paragraph 5.7.4.1. 82 DOE G 421.1-1 8-25-99 A discussion on the use of each of the eight control methods is provided in paragraph 5.7.4.2, including the definition and use; the typically associated means of control; the reliability, range of coverage, and operational support required; and the common failure modes. Control methods that typically employ the more highly preferred means of control should be selected, whenever practicable. For example, geometry control is generally implemented using passive-engineered design features, which is a highly preferred means of control. In contrast, concentration control is generally implemented using active-engineered and administrative controls, which are less preferred. Table 5.7.4-1 shows the nine control methods ("eight" has become "nine," distinction being made here between moderation and reflection) and the typically associated means of control. Table 5.7.4-1. Criticality Safety Control Methods and Typically Associated Means of Control CONTROL METHOD GEOMETRY CONTROL SPACING CONTROL NEUTRON POISON CONTROL

FISSIONABLE MATERIAL CONCENTRATION CONTROL FISSIONABLE MATERIAL DENSITY CONTROL MODERATION CONTROL REFLECTION CONTROL ENRICHMENT CONTROL FISSIONABLE MATERIAL MASS CONTROL ASSOCIATED CONTROL MEANS (TYPICAL) PASSIVE ENGINEERED x X(FIXED) X(FIXED) X(FIXED) X(FIXED) ACTIVE ENGINEERED X(MACHINE AUTOMATED) X(SOLUBLE) x x x x x ADMINISTRATIVE X(PROCEDURAL) X(SOLUBLE) x x x x x x 5.7.4.1 Three basic means of criticality safety control. As discussed above, the three means of managing the nine criticality safety control methods are passive-engineered control, active­ engineered control, and administrative control. The ranking of the three means of criticality safety control is intended as a general guide of preference. In practice, a case-by-case evaluation is required to determine the best control method and means of control available for each circumstance, considering the unique requirements and conditions in existence at the time. All control methods generally have some degree of administrative dependence or other features that make it difficult to categorically assign a means of control to a particular control method. DOE G 421 .1-1 8-25-99 83 5.7.4.1.1 Passive-engineered control. Passive-engineered control is the highest ranked means of criticality safety control, involving fixed, passive design features or devices rather than moving parts. These means of control are highly preferred because they provide high reliability, a broad range covering many potential criticality accident scenarios, and require little operational support to maintain effectiveness. Human intervention is not required. Advantage is taken of natural forces, such as gravity, rather than electrical, mechanical, or hydraulic action. 5.7.4.1.2 Active-engineered control. Active-engineered control is a means of criticality safety control, of intermediate rank, involving add-on, active electrical, mechanical, or hydraulic hardware that protects against criticality. These devices act by sensing a process variable important to nuclear criticality safety and providing automatic action to secure the system in a safe condition without human intervention. Active-engineered controls are preferred when passive-engineered controls are not feasible. These devices are subject to random failure and to human error occurring during operations and maintenance activities. Therefore, high-quality, low-failure-rate equipment should be selected in all cases. Fail-safe designs should be employed, if possible, and failures should be easily and quickly detectable. The use of redundant systems should be considered as a means of dealing with unavailability. Active-engineered devices require surveillance, periodic functional checks, and preventive and corrective maintenance to maintain effectiveness. 5.7.4.1.3 Administrative control. Administrative Control is a means of criticality safety control that relies on the judgment, training, and responsibility of people for implementation. These controls may be action steps or caution steps in an operating procedure or steps in a surveillance program. Because they are human-based, and subject to error in application, administrative controls are generally regarded as the least desirable means of criticality safety control. In some instances, however, reliance must be placed on this means of control. Where practical, processes, equipment, and necessary instrumentation should be designed to initiate and facilitate human intervention or discourage misoperation. An example includes the design of handling or process equipment that limits the number of units or mass of fissionable material that a fissionable material handler can transfer. Where practical, administrative controls should be augmented by warning devices (visible or audible) that mandate operator action according to a specified procedure. Activation of warning devices should be minimized in order to be effective.

5.7.4.2 Criticality safety control methods. The following subsections list control methods used for nuclear criticality safety and discuss passive-engineered control, active-engineered control, and administrative control, and considerations associated with each. 5.7.4.2.1 Geometry control. Geometry control is the preferred method of criticality safety control based on limiting one or more characteristic dimensions. Where practicable, reliance should be placed on the use of geometry control rather than the control of any other nuclear parameter. The practicality of using geometry control depends on the type of equipment needed (it may be impossible to incorporate a geometrically safe design for a large-scale pit), the process flow rates and volumes, and inherent complexity. Because each system and facility may be different, decisions should be made and approved on a case-by-case basis. Geometry control is based on physical design limits, such as "geometrically safe" or "geometrically favorable" cylinder diameter, annulus inner and outer diameter, slab thickness, and spherical diameter (and the closely related concepts of "safe" or "favorable" volume) for a given fissionable material. Geometrically safe is defined as the characteristic dimension of importance for a single unit of a specific geometrical shape such that nuclear criticality safety is not dependent upon any other nuclear parameter. A geometrically safe dimension is determined assuming optimal 84 DOE G 421.1-1 8-25-99 moderation, thick reflection, and no control on concentration, enrichment, mass, or neutron poison. Geometrically favorable is defined as the characteristic dimension of importance for a single unit of a specific geometrical shape such that nuclear criticality safety is maintained in conjunction with one or more other nuclear parameters such as concentration and limited reflection. If geometrically favorable dimensions are used, care should be taken to guard against the possibility of losing control over the other nuclear parameters upon which favorable geometry depends. Geometrically favorable control may require active protective devices or administrative controls, or both, such as concentration- or moderation-control monitoring equipment, on-line enrichment- or mass-control monitors, and sampling. If there is no possibility that the geometrically favorable conditions will be violated (for example, the facility only handles uranium having 10% enrichment or less, or there is no credible way for the material to become reflected or moderated)' then it may be reasonable to consider the geometrically favorable dimensional parameters as passive­ engineered control rather than as active-engineered or administrative control. Geometry control limits (if maintained) preclude the possibility of criticality by virtue of neutron leakage from the system. This control method provides inherent criticality protection that (1) is not subject to random failures (as may occur with an "active" control device), (2) is not susceptible to the common types of human errors occurring during operating and maintenance activities that may act to defeat the control, and (3) provides inherent protection against unforeseen criticality scenarios. This control method requires a minimum of facility operational support to maintain effectiveness. Note that spacing between geometrically safe units shall be considered because of the potential for interaction.

Geometry control has many applications. Arrays of geometrically controlled cylindrical columns or slab tanks may be used to store or process fissionable material solutions. Geometrically controlled slab geometry may also be used for drip pans and for tables used for cleaning small pieces of contaminated equipment with various solutions. Process piping and drain lines often need to be designed to be geometrically controlled. Other equipment or portions thereof that normally do not process or contain fissionable material may also need to be controlled by volume or geometry. For example, if significant quantities of fissionable material can enter lubricating oil in a pump, the pump and its oil reservoir, if any, may need to be limited to a safe volume. Alternatively, it may be necessary to conservatively approximate the geometry of the interior of the pump and any oil reservoir and perform calculations to show that the geometry is safe for all credible cases. 5.7.4.2.1.1 Geometry control applied to process and storage vessels, equipment, and containers. As discussed above, geometrically controlled cylinders, slabs, annuli, and spheres may be used for process and storage vessels. Loss of safety could result from various phenomena, such as abnormally high pressure, causing dimensional distortions to the point that the critical dimension is reached. Even though a spherical geometry is the shape of choice from the standpoint of dimensional stability, a spherical tank often has limited practical use because of restrictions on useful volume. Elongated cylindrical geometries have favorable characteristics under pressure and have been used successfully for a wide range of applications. Annular and slab geometries are subject to distortions under pressure; however, in many applications these shapes can be adequately stabilized using external bracing and internal stay-bolts or tie-rods. Even though a vessel may be designed to be geometrically safe or favorable, solution absorbing insulation or liquid heat exchanger jackets that surround the vessel may invalidate geometry control. If absorbing insulation or liquid heat exchanger jackets are required to be placed around a geometrically controlled vessel, precautions should be employed to ensure that vessel leaks will not DOE G 421.1-1 8-25-99 85 accumulate unsafely in the insulation or heat exchanger jacket. A common practice in the use of liquid heat exchanger jackets is to maintain the pressure of the fluid in the heat exchanger jacket higher than the pressure inside the vessel. A differential pressure monitor and corresponding alarm may be necessary. Corrosion of the vessel walls should also be considered. Over time, corrosive attack causing a uniform thinning of the vessel wall will increase the inside dimension to a value greater than the as­ built value at the beginning of service life thereby reducing original margins of subcriticality. In addition, corrosion of the vessel walls and structural members may cause structural weakness, and thus increase the potential for bulging or rupture under pressure. If necessary, a "weep hole" concept should be considered as a means of detecting excessive corrosion. This can be accomplished by drilling several holes from the outside of the tank to about 0.5 wall thickness. For vessels using geometry control, corrosion leading to the loss of contents by leaks is not a criticality problem in itself, if suitable provisions are made in the design for dealing with the leaking solution. Therefore, an allowance for corrosion shall be included in the design of a vessel in which corrosion may occur.

Because dimensions are of great importance for the maintenance of geometry control, designers and criticality specialists must understand each other when it comes to designing and implementing dimensions calculated for nuclear criticality safety. For example, to a criticality specialist, it is easy to perform a calculation using exact dimensions for a 5.000-in. pipe 1.0. However, when translated to actual design, it may be difficult, or impossible, for a designer to order material of the exact dimension used by the criticality specialist in his/her calculation. It is important, then, that the criticality specialist understand that a designer may be limited to a certain material. It is equally important that a designer understand that an exact dimension may be crucial to nuclear criticality safety. If commonly available materials differ dimensionally from those used in nuclear criticality safety calculations, then the material selected should be less than the geometrically controlled dimension of importance, or additional calculations should be performed using dimensions of the various materials that are available (in which case, additional controls may be needed if the geometrically controlled dimension cannot be maintained). When multiple units or arrays of geometrically controlled equipment are needed, proper spacing and the buildup of fissionable material between units shall be considered. Even though an individual unit may be geometrically controlled, safe spacing of the equipment units should be calculated to limit neutron interaction, or the equipment units should be neutronically isolated (decoupled) from each other by the use of thick reflection or neutron poisons, or both, around/between each piece of equipment. The buildup of fissionable material from overflows or leaks between adjacent units should be minimized because it defeats the geometrically controlled condition. Buildup can be a significant problem in slab tank arrays where it is crucial to maintain space between tanks free of accumulations and where it is difficult to inspect and clean such locations. Care should also be taken to consider the neutron interaction due to intersections of connecting piping and drains with geometrically controlled equipment. Frequently, processes cause a transformation of fissionable material characteristics, such as in the high-temperature melting of low-density feed materials to high-density metals or alloys, or the chemical conversion of compounds to metals or metals to compounds. In any instance, consideration shall be given to intermediate conditions of the material throughout the transformation. 86 DOE G 421.1-1 8-25-99 In the instance of casting reduced-density, yet compacted, metal machine turnings into solid metal ingots, consideration should be given to the following: (a) providing a safely subcritical environment for a large volume of compacted machine turnings within a casting crucible, (b) providing a smaller limited volume/shape molten casting charge, (c) providing a safely subcritical environment for a casting mold of solid frozen metal, (d) providing catch basins, rings, or other devices for casting mishaps such as broken crucibles, leaking pour diverters, and broken or leaking molds, and (e) replacing worn and potentially oversized molds. Overflow holes in crucibles and molds play an important role in limiting the molten mass of metal within crucibles. Likewise, overflow holes in molds prevent incomplete crucible discharges to a mold or undesirable casting configurations.

The wearing of extrusion press dies and wire drawing dies generally affects product or process quality prior to affecting nuclear criticality safety. However, such equipment wearing or aging should be considered because it may affect the nuclear criticality safety of the product material by permitting the pressing or drawing of oversized materials. 5.7.4.2.1.2 Geometry control applied to facility features (e.g., placement and depth of curbs, sumps, stairwells, elevator shafts, door sills). Provisions should be made in facility design to consider leaks of significant quantities of fissionable material from process and storage vessels, equipment, containers, interconnecting piping, and instrumentation ports and tubing. Solutions containing fissionable material should not be allowed to accumulate in an unsafe geometry. Thus, geometry control is often used in connection with sump design. Typically, a sump is designed with a flat bottom so that liquid initially accumulating in the sump takes on the shape of a geometrically safe or favorably thin slab. When applying this concept, protection should be provided so that the maximum credible liquid level (considering the fissionable material of interest at optimum moderation) in the sump at any time will be less than the minimum critical slab thickness obtained from calculations or appropriate tables. One means of providing this protection on maximum liquid level is to incorporate an overflow capability so that excess liquid present in the sump will overflow to a safe region. Protection should be provided against loss of overflow capability. The design should be such that no single object present in the sump can block the overflow, such as a rag or other object, nor should accumulations easily plug it. The maximum credible volumetric liquid flow rate to the sump should not exceed the design pump-out rate. Protection should be provided against unwanted seepage into the sump and corrosion of the sump material. With prolonged exposure to reactive chemicals, like evaporating acids, it is possible for solutions of fissionable material to seep into and under sumps unless they are adequately lined. The possible "sloshing" of a sump's contents during filling should be considered because of induced wave motion that may exceed safe or subcritical liquid thicknesses. If conditions do not permit overflow capability, it is important to ensure that the liquid level in the sump corresponding to the maximum credible addition of solution (from a worst-case leak or vessel rupture of fissionable material) will be less than the minimum critical slab thickness. If the liquid level cannot be controlled because of potential large additions of liquids containing fissionable DOE G 421.1-1 8-25-99 87 material, then the use of solid neutron poisons such as Raschig rings should be considered (see paragraph 5.7.4.2.3.1). 5.7.4.2.1.3 Minimizing holdup volume and geometry in auxiliary process equipment. Geometry control is a very effective means of providing inherent criticality protection for equipment items not intended for fissionable material processing or storage (such as pumps, valves, and filters). This control may be achieved by limiting the maximum holdup volume in an equipment item to less than the minimum critical volume for the fissionable material being processed, as determined by calculations or applicable tables.

Additionally, in areas having overhead liquid fissionable material process lines or storage vessels, policies and procedures should be established to deter incidental or unintentional containers such as unrestricted volume tool boxes, mop buckets, sponges, mops, open-topped plastic-lined containers, or other containers that could collect liquids. 5.7.4.2.1.4 Passive devices preventing geometrical distortion, improper orientation, or solution transport. This group ranks high in the preference sequence. Because of simplicity and the absence of moving parts, the reliability of items in this group is high, while operational support requirements are generally low. Often, items in this group compete with, but are preferred to, the use of active protective devices to provide similar safety functions. Potential criticality problems may be caused by the distortion of a geometrically safe shape or the unwanted and unexpected transport of liquids from safe to unsafe locations. Fixed, passive design features and devices are available to prevent such occurrences. Examples of these devices and design features include rupture disks, vents (with overflow to a geometrically safe or favorable location), air breaks, barometric seal legs, nuclear safety blanks, large (but safe) line sizes, restricting orifices, and relative elevations. Section 0.3 contains additional information on each of these devices and techniques. Of particular interest are air breaks and barometric seal legs. These two items provide effective protection and should be incorporated as standard practice, as applicable. 5.7.4.2.2 Spacing control. Spacing is a highly preferred method of control consisting of the use of passive devices or systems, or administrative controls, to ensure the maintenance of favorable spacing. Safe spacing maintains neutron leakage and reduces neutron interaction among units containing fissionable material. Fixed (passive) spacing controls are used for the separation of fissionable material in operating activities and storage of many types of fissionable materials including weapons components, wet or dry storage of reactor fuel, storage of oxides or nitrates, storage of fissionable material in shipping containers, and storage of fissile-containing solutions. Examples of such devices and systems include pool storage racks, floor storage racks of various types, dollies having a base of sufficient dimensions to provide favorable spacing, fissionable material birdcages, and safely spaced shelving. To be considered a strictly passive control, spacing should not be dependent on other nuclear parameters, or the other nuclear parameters should be fixed. For example, spacing that also incorporates fixed neutron poisons is considered passively favorable spacing; spacing that passively limits container size to those containers that may be safely spaced is considered favorable spacing; spacing that is designed for materials having a limited enrichment is considered passively favorable spacing as long as other materials having higher enrichments are either not available or cannot fit into the safely spaced positions; and spacing that is designed for containers having limited moderation is considered passively favorable as long as containers without such 88 DOE G 421.1-1 8-25-99

moderation control limits are not available or cannot fit into the safely spaced positions. In situations where spacing is established for a specific container and its contents based upon specific mass, dimension, chemical composition, or fissile nuclide, features should be incorporated into the design to preclude the placement of other containers into the storage spaces. In addition, design features should eliminate the possibility of placing more than one container into a given storage space or placing additional containers into the regions between storage positions. When the containers of fissionable material are relatively light and have low radiation levels such that they can be handled hands-on, the potential exists for human error, particularly in moving containers into and out of storage. It is better to design spaced arrays such that they cannot be easily defeated by human error rather than to rely strictly upon procedures. When several types of containers of fissionable material are to be stored in the same spacing structure, the spacing should be established for the most reactive feasible combination of packages. This is normally the entire array filled with the most reactive package (although sometimes combinations of containers could be more reactive), and one position near the center double-batched if this is a possible loss of one control. Passive control of spacing is highly reliable, not subject to random failures, and provides coverage against potential unforeseen accident scenarios. However, several problems with spacing are possible. Fixed (passive) spacing structures and devices may be susceptible to structural failures due to such conditions as exceeding the load limits, corrosion, ramming by forklifts, items falling from overhead cranes, and earthquakes. Spacing control may require the use of nondestructive gamma or neutron counting equipment or physical sampling and analysis to determine fissionable material package content before assigning a given spacing to a given package. In such situations, passive-engineered spacing control takes on aspects of active-engineered or administrative control. If a favorable spacing arrangement can potentially be defeated by human error or equipment failure, then it may be necessary to consider the spacing control as active-engineered or administrative in nature. In fact, it is sometimes difficult to strictly distinguish between passive spacing control and active-engineered or administrative spacing control. If spacing control is dependent upon such things as signs, marks on the floor, procedures such as the spacing of packages 1 meter apart, or temporarily erected structures such as chained-off areas rather than fixed engineered storage structures, then it becomes administrative in nature and is less preferred than truly passive-engineered spacing design. 5.7.4.2.3 Neutron poisons. Neutron poisons preclude criticality by virtue of eliminating neutrons from a system through absorption. Absorbers may be fixed (solid) or soluble (in solution). Generally, fixed absorbers are considered passive-engineered controls, and soluble absorbers are considered active-engineered or administrative controls. Where practicable, vessel design should incorporate favorable geometry as a means of control before placing reliance upon neutron poisons. The practicality of using favorable geometry versus neutron poisons for solution processing is dependent upon the flow rate and volume of the solutions to be processed, the number of geometrically favorable units and parallel processing lines that may be required, the reliability associated with each unit, and the potential benefit of using neutron poisons to maintain safety while simplifying operations and improving reliability. For some items, it may not be possible to use a geometrically favorable design, thus, neutron poisons may be the only available means of nuclear criticality safety control.

Neutron poison control is generally not used for control of fissible nuclides because (1) fissible nuclides only fission with intermediate or fast neutrons, (2) few materials are good absorbers of DOE G 421.1-1 8-25-99 89 intermediate and fast neutrons, and (3) simpler and easier methods of control are generally available. 5.7.4.2.3.1 Fixed neutron poisons. The use of permanently fixed, neutron-absorbing materials (poisons), such as boron-containing materials (borosilicate-glass Raschig rings, boral, borated stainless steel, borated concrete, borated polyethylene), cadmium, chlorine (PVC rings), or other solid neutron absorbing materials is considered to be a passively engineered method of criticality safety control. In specific applications this method can provide inherent, reliable protection and shares many of the same advantages as passive-engineered geometry control and passive­ engineered spacing control. However, the successful application of this criticality safety control method can vary widely, depending on the potential for various phenomena that can cause loss or redistribution of the absorber material and on the ease with which periodic verification can be made to confirm the continued presence of the absorber. Applications involving contact (or potential contact) of the absorber material with process solutions can cause loss of the absorber by leaching, general dissolution, or other chemical reactions. In such cases, cladding the absorber material may provide effective protection against chemical attack. Loss of absorber material can also occur by fire and physical damage. In all cases periodic verification tests should be conducted to confirm the proper amounts and distribution of absorber material and integrity of cladding. In some cases, such as remote applications of absorbers, verification testing may be quite difficult. Thus, it is important that provisions are made in the design to ensure that there is sufficient access to allow for periodic testing. Raschig rings may be used to render otherwise geometrically unsafe vessels favorable depending on fissionable material concentration and packing density of the rings. Typical applications of Raschig rings include sumps, evaporator de-entrainment separator heads, large tanks, and scale pits. Packing density of the rings should not be overestimated when calculating the nuclear criticality safety of a vessel. Ring settling and boron leaching may also present problems. The detailed requirements for the use of borosilicate-glass Raschig rings are found in ANSI/ANS-8.5- 1986. Reactor fuel storage racks may be designed to incorporate various types of neutron poisons. Boral and borated stainless steel are typical neutron poisons that have been used in such storage racks. Borated concrete has been used for fresh fuel storage racks. Borated concrete is an example of a flux trap where the hydrogen content can vary as the concrete ages, therefore, the hydrogen content of borated concrete shall be verified or conservatively approximated. Almost all materials absorb neutrons to some degree. Therefore, the "typical" materials of construction for a given facility may be important in maintaining the nuclear criticality safety of a given piece of equipment. If a nuclear criticality safety evaluation is made using a certain material, and another material is substituted in the design, nuclear criticality safety may be jeopardized. Whenever material substitutions are to be made, additional evaluations should be performed to demonstrate that subcriticality and nuclear criticality safety are not compromised.

5.7.4.2.3.2 Soluble neutron poisons. Soluble absorbers are neutron-absorbing materials, such as boron in boric acid, gadolinium as gadolinium nitrate, or cadmium as cadmium nitrate, added to a solution for criticality safety control in vessels or piping that may otherwise be geometrically unsafe. Control shall be exercised to maintain soluble neutron absorber continued presence with the intended distributions and concentrations. Extraordinary care should be taken with solutions of 90 DOE G 421.1-1 8-25-99 absorbers because of the difficulty of exercising such control. 97 This method of criticality safety control is not preferred but has definite applications where the control methods discussed above are not applicable. The use of fixed neutron poisons should be investigated before placing reliance upon soluble absorbers. Neutron poisons, such as boric acid, are sometimes added to a dedicated water supply tank for fire fighting purposes in areas where unwanted moderation may be a concern. Soluble neutron poisons are implemented using active-engineered and administrative controls. Administrative confirmation of the types and quantities of chemicals used for soluble absorber makeup solutions is necessary, as well as a sampling of the prepared solutions themselves, to verify absorber concentration. Once prepared, solutions of soluble absorbers are sometimes subject to inadvertent precipitation of the absorber material from solution, the formation of distinct phases of the solution that have little or no absorber, or the dilution of the absorber by other makeup or process solutions. In many situations, soluble absorbers must be added for each use or batch requiring frequent operational support to ensure continued effectiveness. 5.7.4.2.4 Fissile concentration control. Fissile concentration control is used in situations in which the concentration of fissile nuclides in solution must be controlled to maintain subcriticality in large (unfavorable geometry) tanks. At least two circumstances exist for which different emphases of concentration control are required. In the first circumstance, a physicochemical process of an operation may ensure that the fissile nuclide concentration of a solution will be within safely subcritical values. In such cases, the monitoring and control of concentration becomes a secondary control in the event the physicochemical process is corrupted or bypassed. In the second circumstance, processes involving potentially concentrated solutions of fissile nuclides can also use concentration control as one of the process variables to include as part of implementing double-contingency. Examples include large volumes of dilute waste solutions, such as raffinates from chemical extraction processes, evaporator condensates, or laboratory sample solutions that must be processed or stored in large and unfavorable geometry tanks or process equipment. However, as stated above, geometry control should be used, if practical. Active-engineered or administrative means of control are normally used to implement concentration control. Procedures such as sampling, automatic concentration or density measurements with or without automatic shutoff valves, or prescribed dilution are always necessary since passive­ engineered control of concentration generally is not feasible.

5.7.4.2.5 Moderation control. Moderating and reflecting materials (such as water, heavy water, acids, oil, plastic, beryllium, concrete, heavy metals, and carbon) tend to substantially reduce the quantity of fissile nuclides that may be safely handled. For this reason, processes involving fissile nuclide compounds or metals are often designed to specifically exclude or control the use of moderators. Moderation control is the purposeful control of the quantity of moderating material mixed with or intermingled with fissile nuclides. Fissile nuclides may be safely handled using moderation control in combination with other control methods, such as mass control and geometry control. In this way, larger masses of fissile nuclides in larger geometries may be handled than by using mass or geometry control alone. Measurement of the ratio of moderating atoms to fissile atoms may be necessary to verify moderation control (for example, in the case of aqueous moderation this ratio is expressed as the hydrogen-to-uranium or hydrogen-to-plutonium atom ratio). Because of the need to verify moderation level, moderation control is generally implemented 97ANSI/ANS-8.1-1983,R88, section 4.2.4. DOE G 421.1-1 8-25-99 91 using active-engineered and administrative controls such as sampling, drying, or moisture detectors. When implementing moderation control, designers should take necessary steps to preclude potential sources of moderation (such as steam lines, water piping, tanks of aqueous solutions, beryllium powder, hydrocarbons, and carbon materials) from areas handling fissile nuclide powders and solids. Doubly containing water pipes and employing a leak detection system between the inner and outer pipes is an acceptable compromise in many situations where water piping must pass through or over moderation controlled areas. Processes involving fissile nuclide powders and metals may also make use of suitable enclosures to reduce or eliminate the potential for unwanted moderation. Otherwise, a design should take suitable precautions for potential moderation and reflection and rely on other control methods. Moderation control is an important consideration in selecting a fire control system. Available options include water, borated water, carbon dioxide, inert gases, and foam. See paragraph 5.7.8.9 for more information. When analyzing a fissionable material system conSisting of fissible nuclides, it is important to understand the effect of added moderation to dry fissible nuclides. Since fissionable materials of fissible nuclides can only fission with intermediate or fast neutrons, the addition of moderators (that slow down neutrons to low energies) will make such materials less reactive to the extent that criticality may be precluded. On the other hand, when handling solutions of fissionable material constituted with fissible nuclides, consideration should be given to potential loss of moderation (due to evaporation or heating), which would make such systems more reactive. Mixtures of fissible and fissile materials require special attention as they have conflicting contributions to the system reactivity depending upon the neutron energy spectra of the system. 5.7.4.2.5.1 Moderators more effective than water. Because of the abundance and prevalence of water, in addition to its good moderating properties, aqueous solutions are typically used to determine minimum conditions to achieve criticality, which are then used to assign exempt quantities or always-safe conditions to activities involving fissile material. In other circumstances, complete or partial flooding by water is typically used to determine worst criticality conditions.

Fissile material in the presence of moderators more effective than water (i.e., H20) -- that is, moderators with values of Us/Ie greater than that of water, e.g., heavy water (020), beryllium or beryllium compounds (e.g., 8eO), carbon (viz., graphite), and hydrogenous materials with hydrogen densities greater than that of water -- can be expected to have minimum criticality masses, safe geometries, exempt quantities, etc. that are more restrictive than those determined for aqueous solutions or for flooding by water. Fissile material in the presence of moderators other than water that are made more effective than water by the neutron energy spectrum of the fissile-moderator system can also be expected to have a minimum critical mass, safe geometry, exempt quantity, etc., each of which is more restrictive than that determined for aqueous solutions or for flooding by water. 5.7.4.2.6 Reflection control. Neutron reflecting materials (such as water, heavy water, concrete, steel, lead, plastic, beryllium, carbon, etc.) reduce the quantity of fissionable material that may be safely processed, stored, or transported. Generally, the degree of reflection evaluated for a given situation is taken to be the maximum credible available unless mitigating factors are, or reflection control is, ensured. 92 DOE G 421.1-1 8-25-99 Reflection may be controlled to prevent unacceptable thicknesses of reflectors in contact with, or surrounding, process equipment or fissionable material units. One should be aware that controlling other parameters may increase reflection. For example, when controlling neutron interaction between units by adding material between them, the undesired and unintended effect could occur by which a single unit is made critical because of reflection. See also 5.7.4.2.5, "Moderation control," for related effects. The effectiveness of standard and credible composite reflectors incidental to normal or abnormal conditions of processing, storing, or transporting fissionable material should be considered and evaluated, as appropriate. Examples could include combinations of water and steel, lead and depleted uranium, or concrete and Si02• 5.7.4.2.7 Mass control. Mass control may be used on its own or in combination with other nuclear parameter controls. In either case, administrative means of control are required. Mass control often takes on aspects of nuclear materials accountability, particularly when used in laboratory situations. Mass control limits are frequently established for individual laboratory rooms, or groups of rooms, and detailed records are kept of mass transfers into and out of the room. Extensive administrative controls are generally implemented involving the transfer of fissionable material, documentation of fissionable masses currently in the facility, posting of limits, and surveillance of the laboratories, records, and posted limits. Mass limits for adjoining rooms should also account for significant interaction. Alternatively, room walls could be designed to preclude potential interaction. Mass control may be used to limit the quantity of fissionable material in processes such as casting of metal, disposal, storage, collection, or withdrawal, or in transportation containers. Sampling or nondestructive measurements are often required to ~erify masses. Establishment of mass limits for containers of fissionable material should involve consideration of potential moderation and reflection, geometry, enrichment, spacing, concentration, and neutron poisons. Safe mass varies considerably, depending on the other nuclear parameters involved. Controls should be implemented to ensure that unexpected changes in these other nuclear parameters will not cause a criticality accident.

5.7.4.2.8 Enrichment or isotopic composition control. When a facility handles fissionable material with a range of enrichments or isotopic compositions, it is useful to consider the potential benefit of employing enrichment or isotopic composition control in conjunction with other nuclear parameters. For example, safe mass for a given enrichment or isotopic composition, favorable geometry for a given enrichment or isotopic composition, and favorable spacing for a given enrichment or isotopic composition may all be useful concepts. In all cases, active-engineered or administrative controls, or both, are necessary to verify enrichment or isotopic composition and prevent the inadvertent use of fissionable material having a higher, more reactive enrichment or isotopic composition than specified for a particular operation. In cases where enrichment or isotopic composition cannot be easily controlled, the available fissionable material providing the maximum reactivity should be assumed. 5.7.4.2.9 Density control. Density control of solids is similar to concentration control for liquids, and areal density control may be applied to either solids or liquids. High density of solid fissionable material tends to reduce the volume or geometric dimensions (and sometimes the mass) that may be safely handled compared to lower densities of the same or similar material whether alone or in a DOE G 421.1-1 8-25-99 93 mixture. Higher density of fissionable nuclides means that it is less likely for a neutron to escape without causing fission. Moderation and mass control are normally required as well when using density control for solids. Also, maximum density of the fissile nuclide as a solid or in a mixture of solids is normally an assumption in many evaluations, hence not a contro/. The difference is that assumptions are those factors thought to be immutable and not readily subject to measurement or contro/. When density is used as a control, it is often represented indirectly, that is, in terms of what can be directly observed and controlled. For example, storage containers in a moderation control area may have a lower mass limit for the fissile nuclide as metal than for the same nuclide in a compound. However, some processes such as super-compacting solid wastes are becoming more prevalent to minimize storage or repository space, and the effects of greatly increasing density of the fissionable material within a container should not be overlooked, especially if many such containers are to be stored in an array with minimum spacing between them. It may be necessary to establish control on the overall fissionable nuclide density of the array as well as on the fissionable nuclide density within units. Areal density control, a related concept to overall array density, is defined by making a projection perpendicular to a planar surface, such as a floor or tank bottom, and limiting the mass of fissionable nuclides per unit area on this projection. Areal density control may be very beneficial when the area of the planar surface is large. In such cases, the mass of fissionable nuclides in an area or within a vessel may be safely increased by a large factor over the minimum critical mass, and it does not matter whether the fissionable material is in the solid or liquid form. Areal density control may also be applied to discrete items, equipment, or containers of either solids or liquids, and if so, is akin to spacing control. In all cases, care should be taken to ensure that no localized region containing more than a minimum critical mass can credibly exceed the overall limit of mass per unit area.

5.7.5 Identifying Potential Criticality Scenarios. Objective 2 - criticality scenarios are identified. The first step in evaluating an element of risk is the recognition of it. Based on past experience, it can be expected that while many control failures resulting in contingent conditions leading to a criticality accident will be obvious, other contingent conditions will not be apparent. 5.7.5.1 Four measures contributing to successful identification. For highly complex systems the objective of identifying all potential criticality scenarios is idealized, and in practice will likely not be met. However, four measures can be taken to reduce the chance that potential criticality risks will go unrecognized, as follows: (a) appropriate commitment of time and resources commensurate with the size of the project and complexity of the processes/systems; (b) use of design and review personnel that have operating and nuclear criticality safety experience with similar processes/systems working with a cognizant nuclear criticality safety specialist; (c) use of a systematic approach in the identification process to minimize the chance that potential criticality scenarios will go unrecognized (Several approaches to criticality scenario identification are briefly discussed in paragraph 5.7.5.2, and an example is provided.); and (d) selection of preferred criticality safety control methods to provide protection against a broad range of initiating events, some of which may go unrecognized (this fourth 94 DOE G 421 .1-1 8-25-99 measure has been discussed in detail in paragraph 5.7.4, "Means of Controlling the Criticality Risks"). It is important to note that the identification process should cover a full range of planned and unplanned conditions in a facility, including normal and abnormal operations, start-up, maintenance, shutdown, and decommissioning. 5.7.5.2 Approaches for criticality scenario identification. Scenario identification and analysis involve the identification and analysis of sequences of events that can lead to a criticality accident. Two basic approaches may be used, separately or together, to perform a scenario analysis for criticality safety. These approaches are (1) using systematic logic models to identify and analyze accident sequences, and (2) postulating the accident sequences directly using previous operating experience, incident data, and engineering judgment. The first approach works well when addressing complex designs that have interacting systems and when addressing new and untried designs. The second approach is satisfactory for simple systems and systems built similar to existing systems. 5.7.5.2.1 Using logic models to identify accident scenarios. Several different logic models have been developed and applied to perform scenario analysis of nonreactor nuclear facilities. These models are useful for identifying accident scenarios in general, and are often useful in identifying criticality scenarios that may otherwise go undetected. Some representative methods are outlined in the following paragraphs.

5.7.5.2.1.1 Deductive Logic Tree Analysis. Deductive logic tree analysis (fault tree analysis using a priori reasoning as exemplified in PRAs) is a deductive logic technique that diagrammatically models the various combinations of basic failure events that contribute to some overall failure event. A deductive logic tree begins with the definition of this ultimate failure event or consequence, such as a critical excursion in a specific piece of equipment, and is expanded downward through subsequent levels of contributing failures until an appropriate level of basic failure events has been reached. The contributing failures may be combined as necessary by logical AND and OR gates at the appropriate levels, if necessary. Deductive logic trees are normally used to model events having binary operational states (total failure vs. total success), as opposed to those having partial failures. The deductive nature of the tree is an advantage in that no assumption of accident initiating events is necessary. However, a detailed understanding of the system being examined is necessary so that important system failure modes are not missed. Even so, this technique can be successfully employed throughout the various design and review stages. As mentioned above, deductive logic trees can be used to model accident sequences, where the top event becomes some consequence of failure sequences. This may result in combining several system logic trees that contribute to the overall consequence thereby providing several independent paths that can lead to the final consequence of a critical excursion. An example of a deductive logic tree applied to a facility being analyzed for nuclear criticality safety is provided in paragraph 5.7.5.2.3. Detailed discussion of fault tree analysis can be found in NUREG-0492 (paragraph 2.3.2.5 of this Guide). 5.7.5.2.1.2 Inductive Logic Tree Analysis. Inductive logic tree analysis (event tree analysis using a posteriori reasoning) is an inductive logic technique that sequentially models the progression of events, both successes and failures, leading from some initiator to a series of logical outcomes. An inductive logic tree begins with some initiating failure, usually on a component or misoperation level, and maps out a sequence of events to form a set of branches, each of which represents a DOE G 421.1-1 8-25-99 95 specific accident sequence leading to a particular final consequence such as a nuclear criticality accident. Like deductive logic trees, inductive logic trees are normally used to model events having total success or failure. Each accident sequence identified by the inductive logic tree is somewhat analogous to a branch of a deductive logic tree. However, while a deductive logic tree branch represents a combination of failures leading to the undesired consequence, an inductive logic tree branch represents a combination of sequential events (both failures and successes) leading to the undesired consequence. While complete inductive logic tree analysis requires identification of all possible and distinct initiating events and development of an inductive logic tree for each, inductive logic trees are often useful in examining the consequences of failure of a particular piece of equipment. A detailed understanding of the overall system may be necessary in order to understand how the failure of a particular component affects the success or failure of other components.

5.7.5.2.1.3 Failure Modes and Effects Analysis. A failure modes and effects analysis (FMEA), used with PRAs, is an inductive analysis that systematically analyzes component failure modes and identifies the resulting effects on the system. An FMEA can be relatively detailed, if needed, and quantitative if data exist. Emphasis is placed upon identifying the problems that result from hardware failure. Typically, a columnar format is employed in an FMEA. Specific entries include (a) component identification, (b) failure rate, (c) failure mode, (d) effect on the system, (e) severity class, and (f) compensating provisions. A FMEA provides a systematic examination of failures of a system and is relatively simple to apply, but it has the disadvantage of considering only one failure at a time rather than multiple failures. 5.7.5.2.2 Postulating accident scenarios directly. A set of accidents may be postulated based on the designer/analyst knowledge of previous operating experience, incident data, previously conducted safety assessments, and engineering judgment. This technique often involves the generation of a series of "what if" questions. These postulated accidents may also be quantified if accident frequency data are available. In many cases, accident frequencies are estimated using engineering judgment. This approach offers the advantage of simplicity, but its success is highly dependent on the experience of the designer/analyst. The results of such analyses are difficult to reproduce and defend. The maximum credible accident approach and the design basis accident approach are two related techniques that may be useful in identifying scenarios and in distinguishing between those that are credible and those that are incredible. The maximum credible accident approach uses engineering judgment to identify accidents. Based on an intuitive estimate of their probabilities, the accident scenarios are divided into credible and incredible accident scenarios. The incredible accidents are not analyzed in detail. Accidents having a probability of occurrence greater than the maximum credible accident can then be analyzed in detail. This approach is typically used only to estimate the upper bound of the accident consequence potential of the particular operation and to design specific protective systems only for the maximum credible accident. As noted previously, however, it is important to identify as many accident scenarios as possible that potentially could lead to a criticality accident. Designer/analysts should not subjectively dismiss potential criticality 96 DOE G 421.1-1 8-25-99 scenarios as incredible when it may be possible through a design change to eliminate the scenario completely. The advantage of the maximum credible accident approach is its simplicity, while its weakness is the subjective nature of the division between credible and incredible accident scenarios and the typical treatment of only the maximum credible accident. The design-basis accident approach is an extension of the maximum credible accident approach. A series of accidents, including low-probability accidents with major consequences, are postulated based on various accident initiators and used as the explicit basis for design or analysis. Accidents having a lower probability of occurrence than the design-basis accident in each accident initiator area are generally not analyzed. The design-basis accident approach is more comprehensive than the maximum credible accident approach but the weakness remains -- the subjective nature of the selection of accidents.

As applied to nuclear criticality safety, the terms "maximum credible accident" and "design-basis accident" are not particularly useful except as a means to aid in distinguishing between credible and incredible accidents. Any potential criticality event, regardless of the magnitude of the initial fission burst, should be carefully analyzed and appropriate design changes made if necessary. 5.7.5.2.3 Deductive logic tree example. An illustration of a simplified version of a deductive logic tree analysis applied to the design of a facility is shown in Figure 5.7.5.2.3-1. The first step is to logically divide the process into discrete locations, starting by dividing the process area into general locations or systems such as rooms, cabinets, glove boxes, process lines, or other appropriate groupings within the facility, and proceeding to the specific locations where criticality (the undesired consequence) could occur. This facility breakdown process is nothing more than a systematic way to ensure that all locations are considered with respect to nuclear criticality safety. The specific locations to be included should encompass all locations having sufficient volume to support a criticality event such as in-process vessels, storage tanks, feed tanks, sumps, process piping, ventilation piping and duct work, pumps, filters, and waste drums, or the potential for loss of spacing that could lead to a criticality event for circumstances such as wet or dry reactor fuel storage, waste drum storage, and oxide or nitrate storage. The second step involves chaining backward to develop the bottom three rows of Figure 5.7.5.2.3- 1 which complete the deductive logic tree and illustrate a means to assist in logically thinking through all of the possible paths potentially leading to a criticality event in a specific location. These rows are labeled mechanisms, phenomena, and initiating events, and are defined as follows: Mechanisms - As used here, the word mechanism refers to the direct means by which criticality is possible in a specific location. Mechanisms include loss of mass control, loss of concentration control, loss of geometry control, loss of moderation and reflection control, loss of spacing control (interaction), loss of enrichment control, loss of fixed or soluble neutron poison control, and the potential for unplanned transport of fissionable material into an unfavorable geometry such as by DOE G 421.1-1 8-25-99 I . I ROOMA I I I I CRmcALITY I IN TANK 1 I I LOSS OF CONCENTRATION CONTROL - HIGH CONCENTRATION I I I PRECIPITATION J I I VALVING ERROR: ADDITION OF PRECIPITANT FROM COlD FEED TANK P I PROCESS AREA 1 J L I ROOMB I I PROCESS I LINE 1 I CRmCAUTY II CRITICALITY IN SUMP A IN PIPI~G RUN I LOSS OF ENRICHMENT CONTROl- HIGH ENRICHMENT I I CABINETC }.- I CR~I} INn~~E .- }.- - -- 97 GENERAl - LOCATION SPECIFIC LOCATION! - CONSEQUENCE - - - MECHANISM I I EVAPORATION I I INCORRECT FEED }.- - - -- - - - PHENOMENA I VALVING ERROR: LEAKAGE OF BLOCK VALVE ADDITION OF PRECIPITANT BElWEEN STORAGE FROM PROCESS TANK F COlUMN K AND TANK I I }.- INCORRECT VALVE OR VALVE MATERIAL SB.ECTED }.- - Figure 5.7.5.2.3-1. Illustration of deductive logic tree. INITIATING EVENTIFAUlT PRECURSOR EVENTIFAUL T

siphoning or leakage. See Table 5.7.5.2.3-1. A potential for criticality exists whenever the safe limit is exceeded for a nuclear parameter chosen for criticality safety control. In Figure 5.7.5.2.3- 1, nuclear criticality safety in Tank 1 is maintained by controlling the fissionable material concentration. Thus, the mechanism for criticality in Tank 1 is identified as "high fissionable material concentration." The purposeful listing of mechanisms is most useful for analyzing potential causes of a criticality. Phenomena - Refers to the possible alternative means for attaining the mechanism for a potential criticality. For example, in Figure 5.7.5.2.3-1 three possible phenomena are identified for attaining high fissionable nuclide concentration: a precipitation phenomenon, an incorrect feed phenomenon, and an evaporation phenomenon. For information, Table 5.7.5.2.3-1 contains some of the more common phenomena associated with mechanisms. The purposeful listing of phenomena is useful for analyzing potential causes of a criticality. Initiating Events - Initiating events refer to the basic failures that can cause the phenomena identified. The credibility or incredibility of such things as natural events and effects as potential criticality accident initiating events may depend on initial design criteria such as earthquake- 98 DOE G 421.1-1 8-25-99 resistant criteria, tornado-resistant criteria, siting above the flood plain, and elimination of vehicles from a certain area. If appropriate design criteria are in place, the probability of natural events or effects initiating events causing a phenomenon leading to a criticality accident is likely to be incredible. The facility should document the design criteria used and the resultant probability of associated initiating events. For example, in Figure 5.7.5.2.3-1, the phenomenon of precipitation may be caused by either of two failures: valving error leading to the transfer of precipitant from cold feed Tank P to Tank 1; or a valving error leading to the transfer of precipitant from process Tank F to Tank 1. Sometimes the initiating event (failure) may have potential precursor failures, requiring that the tree be extended. Examples of various types of failures are included in Table 5.7.5.2.3-1. When developing a deductive logic tree, several points should be kept in mind. There is no fixed format or nomenclature. Rather, the emphasis here is on the use of the systematic and deductive thinking process involved in deductive logic tree development. The aim is to identify all of the locations where criticality is a possibility and all of the conceivable ways that an unsafe condition could occur. The focus of the deductive logic tree should be on identifying potential criticality scenarios for later examination. As developed herein, deductive logic trees may be entirely qualitative. It is not necessary (nor even desired) that the criticality preventive measures be represented. The selection and adequacy of controls can be considered separately for each criticality scenario (see paragraphs 5.7.4 and 5.7.7). As a final note, attempts at making distinctions between the initiating event as an equipment failure or as a breakdown of administrative controls can sometimes become a source of confusion and may be pointless or artificial. For further illustration of this process for identifying potential criticality scenarios, the example in Appendix 0 may be helpful.

5.7.6 Eliminating Potential Criticality Scenarios. Objective 3 - criticality scenarios are eliminated to the extent practical. Rather than accepting an element of risk, it is preferred, in principle, that the risk be removed entirely (if feasible). Although a potential criticality scenario associated with a design concept may be shown to meet the minimum standard for acceptability (paragraph 5.7.7), an effort should be made to explore the feasibility of design changes that would act to eliminate the scenario altogether. On occasion, elimination can be achieved by design changes that remove the initiating event to the accident sequence. DOE G 421.1-1 8-25-99 99 Table 5.7.5.2.3-1. Examples of Phenomena and Initiating Events Leading to the Mechanism for a Potential Criticality Event Mechanism 1. Loss of mass control; fissionable material mass limits exceeded. 2. Loss of concentration control; fissile material concentration limits exceeded. 3. Loss of geometry control; geometry limits exceeded. 4. Loss of moderation or reflection control, or both; moderation or reflection limits, or both, exceeded. Examples of Phenomena: and Initiating Events a. Double (multiple) batching: human error or failure of automatic solution addition equipment. b. Fissionable material content higher than expected: incorrect sample result, incorrect feed, sample mixup, or enrichment higher than expected. c. Slow accumulation: unrecognized slow leak. a. Precipitation: precipitant added inadvertently as a result of valving errors. b. Evaporation: tank abandoned (natural evaporation), loss of coolant, exothermic reaction. c. Solvent extraction: gradual accumulation of solvent, solvent added inadvertently, degraded solvent accumulates in equipment. a. High internal pressure causing geometry distortions: eructation, gas generation, exothermic reactions. b. Corrosion (thinning) of vessel walls causing increase in internal vessel dimensions: loss of chemistry control. c. Slumping: inadequate choice of material for high temperature environment. a. Flooding of location or equipment designated to remain dry: backflow, leak, or spill of process liquids; sprinkler activation when equipment exposed for maintenance activities. b. Moisture pickup from surrounding atmosphere: loss of control of cabinet atmosphere. c. Excessive reflection from nearby maintenance or operating personnel or the introduction of new material adjacent to the item of concern: procedural violations, maintenance activities, or design changes. d. Loss of reflection used for neutronic isolation: maintenance operations or facility design changes. 100 5. Loss of spacing (interaction); spacing exceeded. control limits 6. Loss of fixed or soluble neutron poison control; absorber concentration, absorber dimension, or absorber leaching limits exceeded. 7. Loss of enrichment control; enrichment limits exceeded. 8. Unplanned transport of fissionable material into an unfavorable geometry. DOE G 421.1-1 8-25-99 a. Additional units added to an array: procedural violations or design change without investigating present limits. b. New equipment containing fissionable material introduced into an area already having fissionable material: design change without investigating present limits. a. Leaching of absorber material: loss of chemistry control or inadvertent addition of leaching materials. b. Corrosion (thinning) of absorber plates, rods, or Raschig rings: loss of chemistry control, failure to make periodic inspections, poor inspection measurements.

c. Physical loss: fire or mechanical impact. d. Improper chemical makeup: human errors in calculations or procedures; incorrect sampling results. e. Precipitation of absorber materials from solution: valving error or other inadvertent addition of precipitant. f. Formation of scale containing absorber material: inadequate temperature or chemistry control, or poor material selection. g. Dilution of soluble absorber materials: valving errors introducing water or other diluents, or leaking across a heat exchanger. a. Inadvertent addition of high enriched material: valving error, procedural error, or leakage. a. Leakage: from a vessel or a line, through a closed valve, across the tubes of a heat exchanger, or between lines in very close proximity due to vibration. b. Improper transport of process liquids: valving errors. c. Backflow: pressure upset - multiple initiating events. d. Back siphonage: pressure upset - multiple causes. e. Liquid entrainment in an off-gas line: upset in operating conditions. f. Air lift phenomena: upset in operating conditions. g. Overflowing a vessel with the solution flowing through common venting or piping to other units: loss of level control. It is not possible to identify all such possibilities; however, three examples are provided in section 0.2 to illustrate the intent and lines of inquiry. These examples involve (1) eliminating a source of DOE G 421.1-1 8-25-99 101 water from the design concept that could potentially reach a location that must remain "dry" for nuclear criticality safety, (2) eliminating a potential motive force (high pressure) that could cause the backflow of liquid containing fissionable material to an unsafe location, and (3) eliminating a potential for over-concentration of solution containing fissionable material. 5.7.7 Judging Acceptability of a Potential Criticality Scenario. Objective 4 - criticality risks are acceptably unlikely. The key concepts and terminology presented in this section are the Double­ Contingency Principle, double-contingency analysis, and barriers for contingencies. Protecting against a credible criticality accident involves a defense-in-depth approach in which multiple, unlikely events must occur before a criticality accident is possible. This section provides a minimum acceptance standard for a potential criticality scenario based on a defense-in-depth approach called the Double-Contingency Principle. It is important that the Double-Contingency Principle be considered, implemented, and documented at each step of the analysis process (see paragraph 5.7.3). This does not mean that the complete implementation of the Double-Contingency Principle must occur during the earliest design stage of a new process or process modification. Rather, it means that there should be a consistent, documented application of dOUble-contingency as the design evolves to finalization and as operating procedures are prepared. The final result, that may include several reports/letters/reviews, should be a clear, documented trail of how dOUble-contingency has been achieved in a given facility.

5.7.7.1 Double-contingency analysis meaning and application. A dOUble-contingency analysis is an analysis of potential criticality accident scenarios for the purpose of demonstrating compliance with the Double-Contingency Principle by identifying appropriate barriers and means of control. A dOUble-contingency analysis should be performed by the cognizant nuclear criticality safety specialist in concert with the design organization and facility/process operators, as needed. It should be an ongoing process, beginning as early as possible in the design activity and continuing through the preparation of operating procedures prior to start-up. The complete documentation of the dOUble-contingency analysis may be composed of various design documents, reports, design reviews, safety analyses, letters, or other documents, but should be traceable. The Criticality Safety Organization should review the double-contingency analysis for sufficiency. The Double-Contingency Principle's defense-in-depth approach calls for the presence of (at least) two controlled barriers (a loss of a barrier is referred to as a contingency) against the potential for a criticality accident. Each barrier shall be capable of terminating a potential criticality accident scenario. The basic notion is that in the event one of the barriers should fail when needed, the second barrier will be available to prevent the accident. For this approach to be effective, each of the two barriers shall be unlikely to fail, and shall be independent in terms of their failure modes. While failure mode independence can be established, likelihood of failure cannot be well quantified under conditions of sparse data, such in situ conditions being desirable from a safety standpoint. This has led Paxton to observe, in LA-3366 (paragraph 2.3.2.4 of this Guide), that Double­ Contingency, as a formal rule, cannot substitute for expert judgment. Paxton further states that experience and common sense usually provide the only basis for "likely" or "unlikely" determinations. See also, paragraphs 5.6.1.4 and 5.6.1.8. The objective of the independency of the barriers has important effects on the selection of the control method(s) and means of control. It is generally regarded that the highest degree of independency can be achieved through the control of two independent nuclear parameters such 102 DOE G 421.1-1 8-25-99

that loss of control of EITHER nuclear parameter alone will not cause a criticality accident. This is sometimes referred to as a two-parameter barrier. For example, assume that a large, geometrically unsafe tank has been designed to store solution whose fissile concentration is normally well below the minimum critical concentration, but that could become higher than the minimum critical concentration due to various potential system failures. To achieve double-contingency, it is decided to base one barrier on concentration control and the second barrier on soluble absorber control. For concentration control, the barrier may be to terminate flow in a feed stream whenever a high concentration of fissionable material is detected. For soluble absorber control, the barrier may be to add soluble absorber solution if the absorber concentration is less than a specified value. A criticality accident cannot occur if concentration control alone is lost because of the presence of soluble absorber. Similarly, a criticality accident cannot occur if soluble absorber control alone is lost because of the normally low fissile concentration of the process solution. As discussed in paragraph 5.7.4, these two barriers may be implemented using engineered or administrative means of control. To ensure double-contingency, it is also preferred that the means of control for implementing the two barriers be independent of each other. Continuing the present example, to terminate the flow of a concentrated feed stream, the active-engineered means of control might include a sensor to detect high fissile concentration, the associated electrical interlock, and an automatic valve in the feed stream line to close upon demand. To add soluble absorber solution if the absorber concentration is low, the administrative means of control may be to sample the tank solution for boron content on a periodic basis (such as once per shift) and to manually add boric acid solution until the desired concentration is achieved. Thus, the means of control for implementing each barrier are independent of each other. This approach ensures protection against a wide array of accidents. It may also be possible to encounter a situation in which two independent barriers can be provided that have potential common-cause control failures. In this case, one or more separate means of control, in addition to that which has potential common-cause failure, should be used to ensure the action of each barrier. Occasions do exist, however, in which a two-parameter barrier is not feasible, and reliance is placed on a single nuclear parameter, that is the loss of control of a single nuclear parameter can lead to a criticality accident. This is often the case, for example, when using concentration control. In this case, multiple (at least two controls) are needed on this nuclear parameter. Here, the objective would be to apply the preferred control means (such as engineered controls over administrative controls) and to select specific controls that are as independent as possible in terms of common-cause failure modes. Paragraph 5.7.10 provides an example in which criticality safety is dependent solely on moderation control (that is, the prevention of water introduction to a "dry area"). Here, each of the two barriers is an active-engineered device, and they appear to be absent of common-cause failure modes.

5.7.7.2 Basic steps in implementing double-contingency and performing a contingency analysis. The approaches used to identify potential criticality accident scenarios are discussed in paragraph 5.7.5. The basic steps for implementing double-contingency and performing a double-contingency analysis of a potential criticality scenario are the following: a. identify the two (or more) barriers for application of the Double-Contingency Principle, b. show that each barrier is independent and unlikely to fail as described in paragraph 5.7.7.3, c. identify all means of control associated with each barrier as described in paragraph 5.7.7.4, and DOE G 421.1-1 8-25-99 103 d. perform a final review of the potential criticality scenario relative to all six basic nuclear criticality safety design objectives (paragraph 5.7.3), particularly the following two objectives: Objective 3 - to eliminate as many as possible of the identified potential criticality scenarios through the use of careful design, use of alternative materials, and alternative equipment; and Objective 1 - to minimize the probability of occurrence of potential criticality scenarios by using a preferred hierarchy of criticality safety controls. 5.7.7.3 Qualifications for a contingency barrier. In accordance with the statement of the Double­ Contingency Principle, it is important that each of the two barriers meet two basic requirements: (1) be unlikely to fail when called upon, and (2) function in an independent manner. The determination of whether a barrier is unlikely to fail may be made on the basis of engineering judgment or quantitative failure rate information, if available. Either approach should be capable of being defended. 5.7.7.3.1 Quantitative guidelines for acceptable contingency barrier failure probabilities. The following quantitative guidelines may be used, subject to data availability, to judge whether the failure of a barrier is sufficiently unlikely such that it may qualify for application to the Double­ Contingency Principle. Guideline 1: The estimated probability that the barrier will fail (when called upon for protection) is no greater than 1 in 100 demands, or stated otherwise, the unavailability is less than 0.01/demand), and Guideline 2: The product of the estimated frequency of the initiating event (expressed in occurrences per year) times the estimated failure probability (applied in Guideline 1) is no greater than 1 in 10 years. Thus, the calculated maximum frequency for potential criticality is 1 in 1000 years, that is, the frequency of the initiating event times the failure probability of the first barrier times the failure probability of the second barrier. The frequency of the contingent, off-normal condition is 1-in-1 0 years. The relative failure ratio of control (barrier that prevents criticality following the off-normal, non-critical) condition is 1-in-1 00 demands (Le., barrier exercise). Therefore, (1 off-normal event) ( 1 criticality barrier failure) 10 years ) (100 off-normal event barriers) = 1 possible criticality 1000 years It is not expected that detailed quantitative risk analyses will be available at the time initial design selections are made for criticality safety control. However, a reasonable expectation of the performance of a proposed means of control may be available from the results of past risk analyses or experiences with similar means of control in similar applications. Such information is useful to screen out means of control that may later prove to be unsatisfactory. Table 5.7.7.3.1-1 provides guidance as to when a quantitative analysis of double-contingency control failures should be performed.

104 DOE G 421.1-1 8-25-99 Table 5.7.7.3.1-1. Guidelines for Performing Quantitative Risk Analysis of Double-Contingency Control Failures Type of ControlA Two independent control methods, each having independent passive-engineered means of control One control method having two or more independent passive­ engineered means of control One control method having two or more redundant passive­ engineered means of control Two independent control methods, each having independent active-engineered means of control One control method having two or more independent active­ engineered means of control One control method having two or more redundant active­ engineered means of control Two independent control methods, each having independent administrative means of control One control method having two or more independent administrative means of control One control method having two or more redundant administrative means of control Necessity of Quantitative Analysis of Control Failures Optional Optional Should be considered Should be considered Should be considered Usually required Usually required Usually required Usually required AFor combinations of passive- and active-engineered means of control, quantitative analysis of control failures should be considered. For combinations of passive-engineered and administrative means of control, quantitative analysis of control failures should be considered. For combinations of active-engineered and administrative means of control, quantitative analysis of control failures is usually required. DOE G 421.1-1 8-25-99 105 Formal quantitative risk analysis can be a valuable tool when properly used. The development and analysis of logic trees can effectively identify flaws in control schemes. The logic analysis process can also assist in identifying alternative criticality control methods that may be more cost effective. However, caution should be applied in the use of these methods. Although quantitative, the estimates made using these methods still rely on engineering judgment. The criticality professional should be aware of the potential error bands in the basic failure rate data and estimates and their effect on the final quantities. 5.7.7.3.2 Guidelines for independency. The basic notion is that dual protection could be lost if a single (common-cause) failure exists that could act to compromise both barriers. Obviously, a process would be unacceptable where a single component, or subsystem, is shared by both barriers and whose failure would simultaneously defeat both barriers. Even with two completely redundant systems with complete component and physical separation, it is possible that an error in calibration (performed identically on both protective systems during maintenance) could compromise both systems. Whenever possible, diversity is preferred to redundancy. Diverse controls involving the measurement of two, or more, different nuclear parameters and causing two, or more, types of safety action are less subject to common-cause failures. 5.7.7.3.3 Quantification of the simultaneous collapse frequency of two controls. The effectiveness and estimated frequency for the simultaneous collapse of two controls used for Double-Contingency Principle applications can be assessed for certain circumstances. That is, controls used for nuclear criticality safety that are periodically monitored for their continued effectiveness or failure and are repaired or brought into specification for continued use as part of the Double-Contingency Principle can be evaluated statistically to determine the expected simultaneous failure frequency of both controls. An example of such an approach is provided in Appendix C.

5.7.7.4 Conspicuous and prominent identification of double-contingency means of control. Each means of control associated with the operating process that contributes to a barrier for double­ contingency should be conspicuously and prominently identified in operating procedures. Consideration should also be given to conspicuously and prominently identifying the means of control associated with double-contingency that appear in design drawings and design reports. These means of control may be in a variety of forms, including various engineered and administrative controls. The intent of conspicuously identifying the means of control associated with dOUble-contingency is that it serves to highlight to operating personnel those features, controls, and administrative actions that are of importance to nuclear criticality safety and that require special care and preservation. 5.7.8 Operability of Criticality Safety Controls. Objective 5 - criticality safety controls are operable. Selections made during the design and safety analysis process will play an important role in the ability of facility personnel to successfully operate the facility and deal with the associated criticality safety controls. Several important considerations affecting operability of the criticality safety controls are discussed in this section. 5.7.8.1 Identifying controls important to nuclear criticality safety. Successful operation of the nuclear criticality safety controls for a facility cannot be achieved without a clear understanding of the control features that are of importance to nuclear criticality safety. This information should be documented as clearly as possible and transmitted from the design and analysis process to the facility operators. As discussed in paragraph 5.7.9, "Documenting the Criticality Risks," the important elements of documentation include (1) identification of the barriers for double- 106 DOEG421.1-1 8-25-99 contingency, derived from the double-contingency analysis, (2) identification of the associated means of control, and (3) information pertinent to the preservation and maintenance of each means of control, such as its required functional capabilities, design specifications, configuration control, and the testing and surveillance requirements. 5.7.8.2 Examining the operability of the set of controls. Each means of control associated with double-contingency for the design concept will require facility operational support to maintain a necessary high level of reliability. As discussed in paragraph 5.7.4.2, some control methods require considerably more operational support than others. A review should be made from the perspective of the total program required in the facility to support the set of controls required for nuclear criticality safety. The objective is to ensure that the total program required is reasonably achievable and manageable. 5.7.8.3 Incorporating good human factors practices. The use of good human factors practices in the design and operations will greatly contribute to successful operation of the criticality safety controls by reducing the potential for human error in operating and maintenance activities. Examples of useful references are found in paragraphs 2.2.2.8 and 2.2.2.9. Considerations include, for example, the layout and labeling of controls, valves, and displays (such as the identification of lines, use of colors, and labels to demarcate panel systems and functions) and the strategic placement of operational assistance (such as succinct instructions for use of equipment, storage arrays, packaging, and handling). Another important area deals with physical space and arrangement, based on importance and frequency of use. It is essential that these considerations begin early in the design and analysis process. Experience has shown that retrofitting a system to improve human factors following construction can be impractical or, at a minimum, very costly.

5.7.8.4 Incorporating uniformity into the design. Incorporating uniformity (consistency) into the design will reduce complexity, training time, and the chances for human error. An integrated approach should be taken to the (total) facility design to ensure uniformity relative to nuclear criticality safety. For example, the selection of a criticality safety control method for each of two different areas in a facility that have similar processes and criticality considerations should be consistent, unless there is a compelling reason to do otherwise. However, this is not intended to exclude diversity to prevent common-mode failures. 5.7.8.5 Facilitating sampling. For selected process and storage vessels, the ability to sample the solution in the vessel (such as for fissionable material concentration, presence of solids, organics, and other materials) will be important to nuclear criticality safety. In these cases, consideration should be provided in the design concept to ensure that operating personnel can obtain samples that are representative of the vessel contents. Ensuring sampling capability may involve proper location of sampling points and the incorporation of mixing and recirculation features. The timely results of sample analyses assist in smooth and safe operations. 5.7.8.6 Facilitating inspection and maintenance. For selected process areas and equipment, the ability of operating personnel to perform periodic inspections and maintenance activities will be important to nuclear criticality safety. This may include, for example, the need for periodic inspections of equipment, piping, duct-work, and the annular space between double-walled tanks for possible accumulations of solid fissionable material; inspections of liquid levels in tanks; inspections of equipment dimensions; inspections for leaks; inspections of fixed absorbers; and inspections for maintenance of engineered criticality safety controls. Both visual inspections and the use of portable monitoring devices may be necessary. During the design process it is important to identify those portions of the facility requiring such inspections and to provide appropriate design DOE G 421.1-1 8-25-99 107 features to facilitate inspection activities such as viewing-ports, absence of hidden areas, and physical accessi bility. The possibility of fissionable material buildup in exhaust or other duct-work systems requires particular attention. Where it is determined to be necessary for nuclear criticality safety, the design of exhaust duct-work should provide for (1) access points for visual inspection using video cameras, fiber-optic devices, or the unaided eye, and for equipment used for removal of fissionable material (such equipment should be geometrically safe); (2) adequate work space to accommodate periodic monitoring of the duct-work using portable equipment such as gamma-monitoring equipment, and, if gamma monitoring is intended, sufficient distance from nearby gamma sources to minimize or lessen background radiation; (3) consideration of making the duct-work itself geometrically safe, where it is not possible or practical to prevent the potential accumulation of fissionable material; (4) the capability to clean the duct-work without tearing it down (this can often be done by avoiding sharp angles and (5) the use of internal pull brushes to move material to access points); and the minimization of sudden expansions, sharp bends, dampers, long horizontal runs, and internal obstructions that contribute to making particles fall out of the air or inert gas stream.

5.7.8.7 Facilitating flushing. In some cases, the ability to flush a line or a tank will be important to nuclear criticality safety. Necessary provisions should be included in the design concept to permit a high-quality flushing operation, such as compatibility of flushing chemicals with the materials of construction, proper line sizes and slopes, adequate line supports to limit sagging, incorporation of special valves needed for the flushing operation, proper location of the flush addition and exit points, and isolation of the chemical flush feed tanks to prevent backflow of fissionable material into the tanks. 5.7.8.8 Anticipating process changes. When designing facilities and equipment intended to process low concentrations, low enrichments, or low masses of fissionable material, such that nuclear criticality safety is not a problem, it is important to anticipate that process changes may be requested in the future, that is, a new feed stream may be added or a higher enrichment may require processing. In such cases, it is prudent to incorporate some form of criticality safety control into the design or to make suitable provision for adding criticality safety controls in the future. 5.7.8.9 Accommodating fire control systems. One of the important nuclear parameters related to nuclear criticality safety is neutron moderation. In the absence of moderating materials such as water, relatively large masses of fissile nuclides in the form of powders or metals may be safely handled. If the presence of water is possible, however, some operations with dry fissile nuclides may have to be severely constrained, modified, or eliminated. A potential conflict exists between nuclear criticality safety and fire safety over the use of moderating agents such as water for fire suppression systems. An analysis is necessary to determine if a credible inadvertent criticality accident could be caused by an automatic sprinkler system or the use of fire hoses. This analysis should involve nuclear criticality safety, fire safety, and safety analysis personnel. If a credible inadvertent criticality accident is not possible, then a water sprinkler system and fire hoses should be used. However, if a credible inadvertent criticality accident is possible, then alternative fire suppression systems should be employed. There are also situations in which a water sprinkler system is acceptable, but the use of high-pressure fire hoses is unacceptable because of the potential to rearrange items in an array. ---------------------------------------~~~--~-= ....... --" .... _.,.,"-- 108 DOE G 421.1-1 8-25-99 In some situations, it is reasonably simple to make changes to equipment and operations such that the use of water is permissible. For example, revising the unit spacing of a storage array and taking steps to ensure that fissile units cannot be rearranged can make the use of water acceptable in the form of automatic sprinklers or fire hoses. In other cases, taking provisions to prohibit the accumulation of water in equipment by the use of appropriately placed and sized drainage holes, the use of an enclosure, or increasing the slope of piping may make the use of water acceptable. In certain situations in which nuclear criticality safety is a concern, it may be possible to use borated water as a fire suppression agent. If borated water is to be used, a dedicated source of borated water should be available, and the concentration of boron should be periodically confirmed.

If the use of water is not permissible in operations with fissile nuclides, then the operating and design personnel should work with nuclear criticality safety and fire safety specialists to find a suitable alternative. From a nuclear criticality safety perspective, there are usually no restrictions on the use of dry chemicals, carbon dioxide, most foams, or inert gases as fire suppression agents in facilities that handle fissile nuclides. However, fire safety specialists will have to agree on the adequacy of these other fire suppression agents for a given facility and operation. Industrial safety specialists will also be concerned with the use of some of these alternative fire suppression agents because they will displace air and could potentially asphyxiate workers. Signs should be conspicuously displayed to alert fire fighters and workers if the use of water is not permitted and to identify what fire suppression agents are acceptable. 5.7.9 Documenting the Nuclear Criticality Safety Control Design. Objective 6 - criticality analysis and controls are documented. Documentation of the nuclear criticality safety control design for fissionable material in process, storage, or transportation is essential for use by engineering design personnel, persons engaged in the design review process, facility operating personnel, cognizant nuclear criticality safety staff, and process reviewers and auditors. The five basic control design objectives discussed previously in this Guide serve as a focal point for the documentation effort. Guidelines for documentation are presented in Table 5.7.9-1, and specific guidance on the content of the nuclear criticality safety control design is provided in paragraphs 5.7.9.1 through 5.7.9.2. The following provides an acceptable method for documenting those elements of a nuclear criticality safety control design described in the previous sections of this chapter and in Table 5.7.9-1. The level of detail for the process should be commensurate with the complexity of the fissionable material operation. Documentation of the analysis should consist of the following three parts: 1. Nuclear Criticality Safety Control Design Proposal - The description of the proposed fissionable material facilities; equipment; processes; potential criticality scenarios; process-, operational-, and equipment-controls related to the potential criticality scenarios; and contingent conditions (provided by engineering process/equipment design and operations supervision and assisted by the cognizant NCS specialist, as needed). DOE G 421.1-1 8-25-99 109 Table 5.7.9-1. Summary of Nuclear Criticality Safety Control Design Documentation Objectives Section of Design Category Documentation Objective Guidelines Documentation relative to Risks are identified: Present all Paragraph 5.7.5 each specific location potential criticality scenarios that were where criticality is identified using devices such as logic credible. diagrams, tabulations. Documentation relative to Risks are minimized: Show that the Paragraph 5.7.4 each potential scenario most preferred criticality safety control identified above. method{s) has (have) been employed and that it is (they are) practical for the set of conditions. Risks are eliminated: Describe Paragraph 5.7.6 considerations given to feasible design alternatives to eliminate the potential scenario. Risks and controls are acceptable: Paragraph 5.7.7 Show compliance with the Double- Contingency Principle, including:

Identification of the two barriers and the basis for qualification. Identification of the means of control, including functional requirements such as specifications, time responses, set points, and information pertinent to care, maintenance, and testing. Information relative to the Operability of controls: Describe the Paragraph 5.7.8 facility as a whole. general approach taken to the nine design considerations listed in paragraph 5.7.8 aimed at facilitating successful operations of the set of criticality safety controls by facility operating personnel. Objective Obi. 2 Obi. 1 Obi. 3 Obi. 4 Obi. 5 ----------------------------------------------~ , ...... , ... ",._ .... ,"- 110 DOEG421.1-1 8-25-99 2. Nuclear Criticality Safety Evaluation (NCSE) - The descriptions and results of the nuclear criticality safety evaluations (calculations, comparative analyses, standard references, and other resources) for all normal and contingent conditions identified in the proposal or subsequently considered and reviewed by the design and operations personnel. The content of NCSEs is discussed in Section 5.9. 3. Nuclear Criticality Safety Control Design - The consolidation and referencing of the proposed fissionable material operations and the nuclear criticality safety evaluation to ensure that the objectives of Table 5.7.9-1 are addressed. 5.7.9.1 Documentation of the nuclear criticality safety control design proposal. Fissionable material operations management and appropriate process/equipment engineering design personnel should provide the necessary written information so that the cognizant NCS specialist organization can adequately evaluate the subcriticality and analyze the safety of proposed fissionable material operations. This information should include the following, as appropriate: a. Sufficient information provided for an adequate understanding of the process by the NCS analysts. This information may include as-built (Title III) engineering drawings, flow diagrams, facility layout drawings, sketches, and operating procedures. b. Description of normal and all credible abnormal changes (contingencies, potential criticality scenarios) in process conditions that could alter a nuclear parameter. c. Identification of passive and active safety controls that are part of the process. Safety systems and safety class items should be identified along with the applicable nuclear parameters. Safety limits, limiting safety system settings, and limiting conditions of operations should be specified as appropriate. d. Identification and description of process including: flows; intermediate storage; transport; and usage, identification, and spacing of portable containers. e. Identification of materials (fissionable and nonfissionable) potentially affecting the process, along with their physical and chemical forms and properties. The accuracy and precision of measurements used to characterize materials should also be provided. Information provided for the nuclear criticality safety control design should be "signed-off" by two individuals knowledgeable of, and responsible for, the development of the proposed fissionable material operation and by two individuals knowledgeable of, and responsible for, the fissionable material operation after completion of the safety analysis. 5.7.9.2 Documentation of the nuclear criticality safety control design. The control design should be provided by the NCS organization (with assistance, as needed, from the process/equipment engineering design and operating personnel) as a controlled document that includes

a. the nuclear criticality safety control design proposal in its entirety; b. the NCSE in its entirety; c. a discussion providing the basis for not using preferred criticality safety control method(s); DOE G 421.1-1 8-25-99 111 d. a description of considerations given to feasible design alternatives that could eliminate potential criticality scenarios; e. a demonstration of compliance with the Double-Contingency Principle, including the identification of multiple barriers and their bases for qualification, and the identification of the means of control, including functional requirements and information pertinent to care, maintenance, and testing such as specifications, time responses, set points, and inspection and maintenance intervals; f. the reiteration of the nuclear criticality safety control design proposal limits and controls and any additional NCS limits and controls developed during the iterative evaluation and analysis process; g. a discussion about the operability of criticality safety controls by facility operating personnel; and h. the signing of the nuclear criticality safety control design proposal by • the cognizant NCS specialist and peer reviewer to indicate completeness of the nuclear criticality safety control design (If the evaluation or peer review is accomplished through the use of personnel outside of the installation NCS organization, the installation and NCS organization management should provide the qualifications and bases for any alternative use of non-installation NCS specialists.), and • the fissionable material operations supervision and equipment/process engineering design personnel, indicating the understanding and acceptance of the nuclear criticality safety analysis results. 5.7.10 Examples. Appendix D provides some examples of a double-contingency analysis, the elimination of unnecessary scenarios, and passive and active controls. 112 5.8 SOFTWARE QUALITY ASSURANCE AND VALIDATION. DOE G 421.1-1 8-25-99 5.8.1 Software Requirement. Only verified, validated, documented, and configuration controlled software shall be used for performing calculations supporting criticality safety analyses. The software used for calculations shall be the same version used in validating the software for determining areas of applicability and subcritical acceptance criteria or upper subcritical limits. The dated, unambiguous, and unique identification of the software should be stated. As temporary as the use may be, programmable calculator use and personal computer programs also should be thoroughly tested, verified, validated, and documented for application to the problem being calculated when the results of such applications are incorporated in NCSEs. 5.8.2 Verification of Calculational Method. For software program development, the verification process shall be applied throughout the activities involving problem and software definition, software design, coding, integration and testing, installation and continued operation, and maintenance. For independently developed, tested, verified, and packaged software that is migrated or ported to an intended user computer/calculator platform, verification of integration and testing and continued operation and maintenance shall be performed. The verification process shall conform to the guidance provided in the applicable document paragraphs 2.1.17, 2.2.2.7, 2.3.1.16, and 2.3.1.17.

5.8.3 Software Configuration Control. Appendix E provides an acceptable approach for software configuration control that addresses the requirements of government and industrial standards described in the reference of paragraph 2.2.2.7. 5.8.4 Validation of Calculational Method. The justification for the validity of the selected computational method should be documented and should include (a) the selection and description of the critical experiments used in the validation, or an appropriate reference that describes the experiments in adequate detail to permit reconstruction of computational input, (b) the selection and description of the computational method that is to be validated along with any necessary data for performing calculations or comparisons (e.g., neutron cross sections, material bucklings, limiting surface densities, or other similar data), (c) the selection and description of the computer/calculator platform and associated operating system used in the validation, (d) the nuclear properties, such as cross sections, which should be consistent with experimental measurements of these properties, (e) a description of similarities and differences between the critical experiments and the calculational models used for the validation, (f) all geometric, material, and nuclear physics related input variables used for the validation of the calculational or comparative method, with sketches provided, (g) the basis for the calculational or comparative bias and the determination of an acceptance criterion for calculated subcritical results, and DOE G 421.1-1 8-25-99 113 (h) the areas of applicability of the calculational or comparative bias and the acceptance criterion, and upper subcritical limit, developed from the validation effort. Example approaches for performing a computational technique validation are provided in Appendix F. 5.8.5 Code user corroboration. Code users shall perform at least some 'Of the validation and cross­ check calculations to demonstrate their ability to use the codes properly. Also code users should compare results between codes, experimental data, and hand calculational methods insofar as practical to provide sanity checks on results. Lastly, as a separate effort, code users should participate in blind round robins periodically to demonstrate continued competence with the methods and data used in evaluations. 114 DOEG421.1-1 8-25-99 5.9 NUCLEAR CRITICALITY SAFETY EVALUATION (NCSE) GUIDELINES. This section provides discussions and guidelines for the performance and documented content of nuclear criticality safety evaluations used for defining the technical bases of subcritical limits and derivative operating values. These subcritical limits and derivative operating values may be developed from criticality safety analyses and may be specified in criticality safety approvals for fissionable material operations. Additional information can be found in the reference cited in paragraph 2.1.19. 5.9.1 Personnel Requirements for Performing NCSEs. Only trained, technically competent, authorized, personnel shall perform nuclear criticality safety evaluations/calculations and peer reviews. Qualification of these individuals should include formal and informal instruction, on-the­ job training, and training by peer resources and by external sources (as necessary), as discussed in paragraph 5.2.2, A.2.

5.9.2 Performance and Documentation of the NCSE. Before starting a new operation with fissionable materials or before an existing fissionable material operation is changed, an evaluation shall be performed to determine that the entire process will be subcritical under both normal and credible abnormal conditions.98 The evaluation shall a. be documented with sufficient detail, clarity, and lack of ambiguity to allow independent evaluation and judgment of results,99 and b. explicitly identify the controlled nuclear and process parameters and their associated limits upon which nuclear criticality safety depends. In an emergency or otherwise in the interest of safety, the evaluation and its documentation may be performed in whole or in part after the fact. The documentation shall also include a justification for performing recovery actions prior to completing the normal evaluation process described above. The nuclear criticality safety calculations used to demonstrate subcriticality for actual process criticality safety analyses should be reported in a traceable document. The calculations should be documented in a stand-alone report or be included in a criticality safety analysis that includes the following: (a) a verification of the accuracy of the information provided in paragraph 5.7.9.1 ; (b) a list of the nuclear parameters, associated controls, and contingencies along with • a justification for excluding consideration of any nuclear parameters perceived not to be affected by the operation or identified contingencies; • identification of the method(s) of control (physical and administrative) for each nuclear parameter; 98ANSI/ANS-8.1-1983,R88, section 4.1.2. 99ANSIIANS-8.1-1983,R88, section 4.3.6 (1). DOEG421.1-1 115 8-25-99 • identification of contingencies including normal and credible abnormal process conditions and external events such as natural phenomena, floods, and fires; and • changes that may require a new or modified criticality safety analysis, which would include, but not be limited to, changes or modifications in the location of a piece of equipment or glovebox in which fissionable material will be handled, processed, or stored, the geometry of a piece of equipment that will contain fissionable material or a change in the geometry of fissionable material itself, fissionable material nuclide or enrichment, physical or chemical form of the fissionable material, the density or concentration of the fissionable material, the quantity of fissionable material or batch size, the moderation or reflection of fissionable material, a processing sequence involving fissionable material, the method of containment of fissionable material, the method or location of storing fissionable material, including changes in the spacing of containers or type of containers, the quantity or type of neutron poisons, including changes in the decision to use or discontinue use of neutron poisons, the method of moving fissionable material within a facility or around the site, credible errors or accidents, or change in the probability of accidents, in handling, processing, or storing fissionable material, and passive or active engineered controls or administrative controls whose purpose is to satisfy the double-contingency principle, including changes in the type of equipment, its independency, or its reliability; and (c) an evaluation for each of the controls and contingencies identified that justifies the subcriticality of the fissionable material operation given the failure of a single control or the occurrence of any credible event.

The subcriticality of contingent conditions may be based upon American National Standard Institute (ANSI) consensus standards. Values from other documented sources should be verified with validated computational techniques, enveloping experimental data, or ANSI/ANS standards values. 116 DOEG421.1-1 8-25-99 Experimentally determined critical data may be used directly to determine NCS specifications provided an adequate margin of subcriticality and safety is justified. Specific requirements and content for NCSEs are provided in the reference cited in paragraph 2.1.19. 5.9.2.1 Peer review. Before the nuclear criticality safety evaluation may be applied to authorize a fissionable material operation, a peer review shall independently evaluate the calculations and verify that the above requirements for conducting the NCSE have been satisfied and that the calculations are correct. Results of all NCSEs shall be peer reviewed and concurred by a second NCS specialist (a) to confirm the proper translation from potential criticality scenarios and contingent conditions to appropriate evaluation models for use in a comparative analysis with experimental data, ANSI/ANS values, or computational technique, (b) to verify that sufficient detail and results of calculational information is available to permit independent review, computations, or comparative analyses of the evaluation models, and (c) to verify that the evaluation models were actually computed or compared with reference data/values. Peer acceptability is based on two requirements: technical qualifications and independence, both of which shall be satisfied. The technical qualifications of the peer reviewer should be at least equivalent to that needed for the original work under review and should be the primary consideration in the selection of a peer reviewer. The peer reviewer should have recognized and verifiable technical credentials in the technical area being reviewed. In so far as practicable, the peer reviewer should be independent of the original work to be reviewed. Independence means that the peer reviewer was not involved as a participant, immediate supervisor, or advisor in the work being reviewed, and to the extent practicable, has sufficient freedom from funding considerations to ensure that the work is impartially reviewed. The independence criterion is not meant to exclude eminent scientists, engineers, or onsite nuclear criticality safety specialists qualified as peers upon whose earlier work certain portions of the work under review is based, so long as a general scientific consensus has been reached regarding the validity of his/her earlier work. Included in the peer review process are the verification of actions and responsibilities for maintaining the quality and integrity of the nuclear criticality safety software system used in support of the contractor installation nuclear criticality safety organization(s). Except when specifically included in a Software Catalog, vendor-supplied systems software such as operating systems, linkers, compilers, and data-base management systems used by the contractor installation are excluded here and covered by separate configuration control for which the contractor is responsible. (See Section 5.8 and Appendix E.) DOE G 421.1-1 8-25-99 117 An assessment should be made to ensure the fissionable material operation under consideration has proper radiation detection coverage by the installation or facility CAS or CDS (Section 5.4). 5.9.2.2 NCSE documentation. Examples of NCSEs that have been adapted to follow the above guidelines are provided in the reference in paragraph 2.1.19. They were prepared at various DOE facilities and are presented for illustration purposes only. DOE G 421.1-1 (Cover) Foreword Acknowledgments Contents Acronyms 1. Scope 2. Applicable Documents 3. Terms and Definitions 4. General Guidance 5. Detailed Guidance Help: To request a hard copy of this Guide please call Directives Distribution Center at (202) 586-9642