| Main |
|
|
| Main |
1.1. |
Criticality can be achieved under certain conditions by most fissionable nuclides belonging to the actinide elements. Some of these nuclides are also fissile, meaning that they are able to support a self‑sustaining nuclear chain reaction with neutrons of all energies, but predominantly with slow neutrons [1]. This Safety Guide addresses criticality safety for fissile material and covers mixtures of fissile and other fissionable nuclides. |
| Main |
1.2. |
Nuclear facilities containing fissile material, and activities in which fissile material is handled, are required to be managed in such a way as to ensure an adequate margin of subcriticality under operational states and under conditions referred to as ‘credible abnormal conditions’ or ‘conditions included in the design basis’ (see Requirements 38 and 66 of IAEA Safety Standards Series No. SSR‑4, Safety of Nuclear Fuel Cycle Facilities [2]). This applies to facilities where fissile material is handled in the production of fresh nuclear fuel (including enrichment and fuel fabrication), facilities where irradiated nuclear fuel is handled, and research and development facilities where fissile material is handled. These requirements in SSR‑4 [2] also apply to radioactive waste from nuclear fuel cycle facilities that contains fissile material. |
| Main |
1.3. |
Requirements for the transport of packages containing fissile material are established in IAEA Safety Standards Series No. SSR‑6 (Rev. 1), Regulations for the Safe Transport of Radioactive Material, 2018 Edition [3]. |
| Main |
1.4. |
The subcriticality of a system depends on many parameters relating to the fissile material, including its mass, concentration, moderation, geometry, nuclide composition, chemical form, temperature and density. Subcriticality is also affected by the presence of other materials such as neutron moderators, neutron absorbers and neutron reflectors, and by dynamic effects (in particular, for fluids). Subcriticality can be ensured through the control of an individual parameter or a combination of parameters, for example by limiting mass alone or by limiting both mass and moderation. Such parameters can be controlled by engineered and/or administrative measures. |
| Main |
1.5. |
In this Safety Guide, the term ‘nuclide composition’ encompasses the parameters ‘enrichment’, ‘effective enrichment’, ‘plutonium vector’ and ‘isotopic composition’. Other terms used in this publication are as defined in the IAEA Safety Glossary [1]. |
| Main |
1.6. |
This Safety Guide supersedes IAEA Safety Standards Series No. SSG‑27, Criticality Safety in the Handling of Fissile Material. |
| Main |
1.7. |
The objective of this Safety Guide is to provide recommendations on meeting the relevant requirements established in SSR‑4 [2], as well as in SSR‑6 (Rev. 1) [3] (see para. 1.13), in respect of the following:Ensuring and demonstrating subcriticality under operational states and under conditions referred to as ‘credible abnormal conditions’ or ‘conditions included in the design basis’;
Estimating the credible consequences of a potential criticality accident;
Minimizing the consequences if a criticality accident were to occur.
|
| Main |
1.8. |
The recommendations on criticality safety provided in this Safety Guide are also relevant to meeting other requirements established in the safety standards, including IAEA Safety Standards Series Nos GSR Part 4 (Rev. 1), Safety Assessment for Facilities and Activities [4]; GSR Part 2, Leadership and Management for Safety [5]; GSR Part 5, Predisposal Management of Radioactive Waste [6]; GSR Part 6, Decommissioning of Facilities [7]; SSR‑5, Disposal of Radioactive Waste [8]; and GSR Part 7, Preparedness and Response for a Nuclear or Radiological Emergency [9]. |
| Main |
1.9. |
The Safety Guide is intended for use by operating organizations, regulatory bodies and other organizations involved in ensuring criticality safety of nuclear facilities and activities. |
| Main |
1.10. |
This Safety Guide applies to all facilities and activities in which fissile material is handled, except those facilities that are intentionally designed to be critical, for example a reactor core in a nuclear reactor, or a critical assembly. In this publication, ‘handling of fissile material’ refers to all activities involving fissile material, including its processing, use, storage, movement (i.e. within the site) and transport (i.e. off the site), as well as the management of radioactive waste containing fissile material. |
| Main |
1.11. |
The recommendations provided in this Safety Guide cover criticality safety during operational states and during conditions referred to as ‘credible abnormal conditions’, from initial design, through commissioning and operation, to decommissioning. It also applies to the design, operation and post‑closure stages of waste disposal facilities. This Safety Guide also provides recommendations on planning the emergency response to a criticality accident. |
| Main |
1.12. |
The recommendations provided in this Safety Guide address approaches to and criteria for ensuring subcriticality; identification of credible abnormal conditions; performance of criticality safety assessments; verification, benchmarking and validation of calculation methods; safety measures to ensure subcriticality; and management of criticality safety. |
| Main |
1.13. |
In cases where criticality safety is specifically addressed by regulations — for example, the transport of fissile material in accordance with SSR‑6 (Rev. 1) [3] — this Safety Guide supplements but does not replace the recommendations and guidance provided in corresponding Safety Guides, for example IAEA Safety Standards Series No. SSG‑26 (Rev. 1), Advisory Material for the IAEA Regulations for the Safe Transport of Radioactive Material (2018 Edition) [10]. |
| Main |
1.14. |
The recommendations provided in this Safety Guide may be applied to operations that are intended to remain subcritical in nuclear power plants and research reactors, for example the handling of fresh fuel and irradiated fuel. |
| Main |
1.15. |
This Safety Guide consists of six sections and an Annex. Section 2 provides recommendations on the factors that affect criticality safety and provides guidance for criticality safety specialists. It also provides recommendations on the management system that should be in place, subcritical limits and safety margins, and criteria for determining exemptions to certain criticality safety measures. Section 3 provides recommendations on the safety measures necessary for ensuring criticality safety, especially the importance of implementing adequate safety measures, the factors affecting these safety measures, and the roles and responsibilities of those involved in implementing the safety measures. Section 4 provides recommendations on conducting criticality safety assessments, the role of deterministic and probabilistic approaches, and the methodology by which the criticality safety assessment should be performed. Section 5 provides recommendations on criticality safety for specific practices in the various areas of conversion and enrichment, fuel fabrication, irradiated fuel operations prior to reprocessing or disposal, reprocessing, radioactive waste management (i.e. processing, storage and disposal), decommissioning, transport and on‑site movement of fissile material, and research and development laboratories. Section 6 provides recommendations on planning the response to a criticality accident and the basic responsibilities of those involved. In addition, it provides guidance on criticality detection and alarm systems. |
| Main |
1.16. |
The Annex provides a bibliography of useful background information on criticality safety, covering the methodology for criticality safety assessment, standards, handbooks, computational methods, training and education, and operating experience. |
| Main |
2.1. |
Ensuring subcriticality in accordance with Requirements 38 and 66 of SSR‑4 [2] is an essential component of criticality safety. Safety measures, both engineered measures and administrative measures (see para. 6.139 of SSR‑4 [2]), ensure that facilities are operated, and that activities are conducted, within specified operational limits and conditions that ensure subcriticality. These safety measures should be identified, implemented, maintained and periodically reviewed to ensure that operations and activities stay within defined safety limits (see para. 2.9) during operational states and during credible abnormal conditions (see para. 2.3). |
| Main |
2.2. |
Subcriticality is generally ensured through the control of a set of macroscopic parameters such as mass, concentration, moderation, geometry, nuclide composition, chemical form, temperature, density, and neutron reflection, interaction or absorption. The determination of limits for these parameters is generally performed on the basis of the effective neutron multiplication factor (keff) of a system, for which nuclear data are needed. Because keff depends on a large number of variables, there are many examples of apparently ‘anomalous’ behaviour in which changes are counterintuitive. |
| Main |
2.3. |
The operational states and credible abnormal conditions that could lead to criticality conditions include the postulated initiating events listed in the appendix to SSR‑4 [2]. The credible abnormal conditions should be determined on the basis of deterministic analysis complemented, where practicable, by probabilistic safety assessment. In the identification of the credible abnormal conditions, the facility design and the characteristics of the activity, as well as operating experience feedback, should be considered (see also Refs [11, 12]). |
| Main |
2.4. |
In accordance with Requirement 13 of SSR‑4 [2], items that are important to criticality safety are required to be identified and classified on the basis of their safety function and safety significance. This includes items providing engineered or administrative criticality safety measures, such as items for the prevention of criticality accidents and for the mitigation of consequences of such accidents. |
| Main |
2.5. |
A graded approach may be used in developing and implementing the approach to ensuring criticality safety of facilities or activities that involve handling of fissile material (see Requirement 11 of SSR‑4 [2]). The application of a graded approach should be determined on the basis of the type of facility or activity and its potential risk. The application of a graded approach should not compromise safety. The graded approach should be applied to the following: The scope and level of detail of the criticality safety assessment;
The methods and enveloping criticality events used in the criticality safety assessment;
The design of criticality detection and alarm systems;
The level of training and qualification of personnel involved in criticality safety;
Emergency preparedness and response for criticality accidents;
Administrative measures for criticality control.
|
| Main |
2.6. |
Safety measures and nuclear security measures should be planned and implemented in an integrated manner, and as far as possible in a complementary manner, so that security measures do not compromise safety and safety measures do not compromise security. The implications of security measures, in particular access control, should be assessed with respect to their effect on criticality safety. The training programme on criticality safety should include the relevant aspects of nuclear security and of accounting for and control of nuclear material. Similarly, security personnel and those personnel responsible for accounting for and control of nuclear material should receive at least basic training in criticality safety. |
| Main |
2.7. |
Feedback of operating experience, including awareness of previous anomalies and accidents, should be used to contribute to ensuring criticality safety. Information on the causes and consequences of important events that have been observed in criticality safety is provided in Refs [12–14] and in the IAEA’s Fuel Incident Notification and Analysis System. Events relating to criticality safety should be analysed and included in the operating experience programme. Requirements for feedback from operating experience for all facilities and activities are established in para. 6.7 of GSR Part 2 [5] and, for nuclear fuel cycle facilities, in Requirement 73 of SSR‑4 [2]. Further recommendations are provided in IAEA Safety Standards Series No. SSG‑50, Operating Experience Feedback for Nuclear Installations [15]. |
| Main |
2.8. |
Subcritical limits should be derived on the basis of one or both of the following: The subcritical value of keff for the system under analysis.
A set of one or more macroscopic control parameters whose values, individually or in combination, for the system under analysis correspond to a keff of less than 1. Examples of such control parameters are mass, concentration, moderation, geometry, nuclide composition, chemical form, temperature, density, and neutron reflection, interaction or absorption.
|
| Main |
2.9. |
Safety margins should be applied to determine the criticality safety limits. Acceptance criteria should be defined, and it should be demonstrated that these criteria will not be exceeded. Furthermore, the upper bound of the uncertainty and sensitivity analysis of keff calculations (see para. 2.10) should not exceed the acceptance criteria. Subcriticality implies a keff value of less than 1 and/or a control parameter whose value corresponds to a keff of less than 1. Paragraph 6.21 and Requirement 17 of SSR‑4 [2] require the use of conservative margins for design. |
| Main |
2.10. |
Consideration should be given to the uncertainties associated with the calculation of keff when applying safety margins to keff. Alternatively, consideration should be given to uncertainty in the calculation of other control parameters when applying safety margins to their corresponding critical values. This should include, for example, the possibility of bias or bias uncertainty in the calculation method and the sensitivity of parameter values to changes in the control parameter or keff. The relationship between keff and other parameters might be significantly non‑linear. |
| Main |
2.11. |
In accordance with Requirement 38 of SSR‑4 [2], the subcriticality of the design is required to be demonstrated in a full criticality safety assessment. The criticality safety assessment should define criticality safety limits and, in turn, operational limits and conditions for criticality safety, which should be expressed in terms of the process parameters affecting the reactivity characteristics of a system. These parameters include mass, concentration, moderation, geometry, nuclide composition, chemical form, temperature, density, and neutron reflection, interaction or absorption. The parameters quoted in limits and conditions should be expressed in terms that can readily be understood, such as enrichment, packaging rules, or a moisture or moderator material limit or restriction. |
| Main |
2.12. |
The operational limits and conditions specified for the facility or activity should be lower than or equal to the criticality safety limits and should be suitable for being monitored and controlled. Sufficient and appropriate safety measures should be applied to detect and react to deviations from normal operation before any criticality safety limit is exceeded. Uncertainties in measurement, administrative errors and sensor delay should also be considered when assessing the appropriateness of safety measures. |
| Main |
2.13. |
In some cases, the amount of fissile material is so low, or the nuclide composition is such, that a full criticality safety assessment is not justified. Exemption criteria, if not specified by the regulatory body, should be developed by the operating organization, reviewed by the management of the operating organization and then agreed by the regulatory body, as appropriate. A useful starting point is the exception criteria applied to the classification of transport packages containing fissile material in para. 417, in conjunction with para. 570, of SSR‑6 (Rev. 1) [3]. |
| Main |
2.14. |
The primary approach in seeking exemption should be to demonstrate that the inherent features of the fissile material are sufficient to ensure subcriticality. The secondary approach should be to demonstrate that the maximum amounts of fissile nuclides involved are so far below minimum critical values that no specific safety measures are necessary to ensure subcriticality. |
| Main |
2.15. |
Modifications to facilities or activities are required to be evaluated before being implemented, to determine whether the bases for the exemption remain valid (see paras 6.141 and 9.83 of SSR‑4 [2]). |
| Main |
2.16. |
The basis for meeting exemption criteria should be documented and justified. |
| Main |
2.17. |
A documented management system that integrates the safety, health, environmental, security, quality, and human and organizational factors of the operating organization is required to be established and implemented with adequate resources, in accordance with Requirement 4 of SSR‑4 [2]. As part of the management system, early in the design stage a criticality safety programme should be established and put into effect by the operating organization to ensure that safety measures for ensuring subcriticality are specified, implemented, monitored, audited, documented and periodically reviewed throughout the lifetime of the facility or the duration of the activity. |
| Main |
2.18. |
Requirements for the management system are established in GSR Part 2 [5], and associated recommendations are provided in IAEA Safety Standards Series Nos GS‑G‑3.1, Application of the Management System for Facilities and Activities [16]; GSG‑16, Leadership, Management and Culture for Safety in Radioactive Waste Management [17]; GS‑G‑3.5, The Management System for Nuclear Installations [18]; and TS‑G‑1.4, The Management System for the Safe Transport of Radioactive Material [19]. |
| Main |
2.19. |
The management system (which is required to cover all items, services and processes important to safety (see para. 4.8 of SSR‑4 [2])) should include activities in relation to criticality safety, thereby providing confidence that they are performed correctly. In determining how the management system for criticality safety is to be applied, a graded approach on the basis of the relative importance to safety of each item or process is required to be used (see Requirement 7 of GSR Part 2 [5]). The management system is required to support the development and maintenance of a strong safety culture, including in all aspects of criticality safety (see Requirement 12 of GSR Part 2 [5]). |
| Main |
2.20. |
The management system should ensure that the facility or activity achieves the necessary level of criticality safety, as derived from regulatory requirements; the design requirements and assumptions; the safety analysis report; and operational limits and conditions, including administrative requirements. |
| Main |
2.21. |
In accordance with paras 4.15–4.23 of SSR‑4 [2], the management system should address the following functional areas: Management responsibility, which includes the support and commitment of management necessary to achieve the objectives of the operating organization.
Resource management, which includes the measures necessary to ensure that the resources essential to the implementation of strategy and the achievement of the objectives of the operating organization are identified and made available.
Process implementation, which includes the activities and tasks necessary to achieve the goals of the organization.
Measurement, assessment, evaluation and improvement, which provide an indication of the effectiveness of management processes and work performance compared with objectives or benchmarks. It is through measurement and assessment that opportunities for improvement are identified.
|
| Management responsibility |
2.22. |
The prime responsibility for safety, including criticality safety, rests with the operating organization. In accordance with para. 4.11 of GSR Part 2 [5], the documentation of the management system for criticality safety is required to include the following: |
| Management responsibility |
2.23. |
There should be a designated person (or persons) who is responsible and accountable for criticality safety, including, as appropriate, the following: Developing and documenting all aspects of criticality safety assessment.
Monitoring the performance of activities and processes.
Ensuring that personnel are adequately trained.
Operating a system for keeping records that ensures control of performance and verification of activities important to criticality safety. The record keeping system should provide for the identification, approval, review, filing, retrieval and disposal of records.
|
| Management responsibility |
2.24. |
Paragraph 4.15 of SSR‑4 [2] states: |
| Management responsibility |
2.25. |
The operating organization is required to ensure that criticality safety assessments and analyses are conducted, documented and updated (see Requirement 24 and para. 4.65 of GSR Part 4 (Rev. 1) [4] and Requirement 5 of SSR‑4 [2]). |
| Management responsibility |
2.26. |
In accordance with para. 4.2(d) of SSR‑4 [2], the operating organization is required to arrange audits of criticality safety measures. This should include the examination of arrangements for emergency response, for example emergency communications, evacuation routes and signage. Checks should be performed by the criticality safety staff who performed the safety assessments to confirm that the data used, and the implementation of criticality safety measures, are correct. Audits should be performed by personnel who are independent of those who performed the safety assessments or conducted the criticality safety activities. The data from audits should be documented and submitted for management review and for action, if necessary. |
| Resource management |
2.27. |
The operating organization is required to provide adequate resources (both human and financial) for the safe operation of the facility or activity (see Requirement 9 of GSR Part 2 [5]), including resources for mitigating the consequences of criticality accidents. The management of the operating organization, in particular the person responsible for criticality safety, should participate in the following: Determining the necessary competence of criticality safety staff and providing training, as necessary;
Preparing and issuing specifications and procedures on criticality safety;
Supporting and performing criticality safety assessments;
Having frequent personal contact with personnel, including observing work in progress.
|
| Resource management |
2.28. |
The responsibilities, knowledge and training for ensuring criticality safety should be clearly specified by the operating organization. The individuals having these responsibilities should be formally appointed by the operating organization. Criticality safety staff should be knowledgeable about the physics (both static and kinetic) of nuclear criticality and the associated national and international safety standards, codes and best practices, and should be familiar with the design and operation of relevant facilities and the conduct of relevant activities. The criticality safety staff should be independent of the operations management, to the extent necessary. |
| Resource management |
2.29. |
All activities that might affect criticality safety are required to be performed by suitably qualified and competent personnel (see para. 9.83 of SSR‑4 [2]). The operating organization should ensure that these personnel receive training and refresher training at suitable intervals, appropriate to their level of responsibility. In particular, personnel involved in activities with fissile material should understand the nature of the hazard posed by fissile material and how the risks are controlled by the established safety measures, operational limits and conditions, and operating procedures. The criticality safety staff should provide assistance in the training of operating personnel, provide technical guidance and expertise for the development of operating procedures, and check and validate all operations that might need criticality control. |
| Resource management |
2.30. |
The management system for criticality safety is required to include procurement activities and should be extended to include suppliers (see para. 4.35 and Requirement 11 of GSR Part 2 [5]). The operating organization should ensure, through audits, that suppliers (e.g. designers, safety analysts) have management systems that adequately address criticality safety. |
| Resource management |
2.31. |
Any hardware and software based process items and equipment necessary for work to be performed in a safe manner should be identified, provided and maintained. Calculation tools (e.g. computer codes) used for criticality safety assessment should be identified and are required to be verified and validated in accordance with para. 6.145 of SSR‑4 [2]. Equipment and items used for criticality safety monitoring, data collection, verifications and tests should be qualified for the operating environmental conditions and should be calibrated, as necessary. |
| Process implementation |
2.32. |
All operations to which criticality safety is pertinent are required to be performed in accordance with approved procedures and instructions that specify all the parameters they are intended to control and the criteria to be fulfilled (see para. 9.83 of SSR‑4 [2]). The operating procedures should cover operational states and credible abnormal conditions. |
| Process implementation |
2.33. |
To facilitate the implementation of operating procedures used to ensure subcriticality, managers should ensure that operating personnel involved in the handling of fissile material are also involved in the development of the operating procedures. |
| Process implementation |
2.34. |
Assessments of modifications to facilities or activities, or proposals for the introduction of new activities, are required to consider the implications for criticality safety (see paras 6.141 and 9.83 of SSR‑4 [2]). Safety assessments of modifications affecting fissile material that have a safety significance should be provided to the regulatory body to allow for review before the modifications are implemented. Modifications having major safety significance are required to be subjected to procedures for design, construction and commissioning equivalent to those applied to the whole facility or activity (see para. 9.59 of SSR‑4 [2]). The facility or activity documentation is required to be updated to reflect modifications, and the operating personnel, including supervisors, should receive adequate training on the modifications (see Requirement 61 of SSR‑4 [2]). |
| Process implementation |
2.35. |
The nature of the criticality hazard is such that deviations towards insufficient subcritical margins might not be immediately obvious; that is, there might be no obvious indication that keff is increasing. If operational deviations occur that are not foreseen in the criticality safety assessment, operating personnel should immediately consult the criticality safety staff for advice on how to place the system into a known safe condition. Operating personnel handling fissile material should therefore inform their supervisor in the event of any unforeseen operational deviations. |
| Process implementation |
2.36. |
Throughout the lifetime of the facility or the duration of an activity, operations to which criticality safety is pertinent involve different groups and interfaces with other areas, such as those related to nuclear security and to the system of accounting for and control of nuclear material (see Requirement 75 of SSR‑4 [2]). Operations with such interfaces should be identified, coordinated, planned and conducted to ensure effective communication and clear assignment of responsibilities. Communications regarding safety and security should ensure that confidentiality of information is maintained. This includes the system of accounting for and control of nuclear material, for which information security should be coordinated in a manner ensuring that subcriticality is not compromised. |
| Measurement, assessment, evaluation and improvement |
2.37. |
Audits performed by the operating organization of facilities and activities (see para. 2.26), as well as proper control of modifications to facilities and activities (see para. 2.34), are particularly important for ensuring subcriticality. The results are required to be evaluated by the operating organization and corrective actions taken where necessary (see para. 4.2(d) of SSR‑4 [2]). |
| Measurement, assessment, evaluation and improvement |
2.38. |
Most criticality accidents and near‑miss events have had multiple causes. In many cases, initiating events could have been identified by operating personnel and supervisors, and unsafe conditions corrected before the criticality accident occurred. This highlights the importance of sharing operating experience (i.e. without breaching any arrangements for information security), of training operating personnel, of promoting a strong culture for safety and of independent audits. |
| Measurement, assessment, evaluation and improvement |
2.39. |
Any deviation from operating procedures and unforeseen changes in operations or in operating conditions is required to be reported and promptly investigated by the operating organization (see paras 9.34, 9.35 and 9.84 of SSR‑4 [2]). The investigation should analyse the causes of the deviation to identify lessons and to determine and implement corrective actions to prevent a recurrence. In accordance with the graded approach, the depth and extent of the investigation should be proportionate to the safety significance of the event. The investigation should include an analysis of the operation of the facility, or the conduct of the activity, including human factors. It should also include a review of the criticality safety assessment and analyses previously performed, including the safety measures originally established. |
| Measurement, assessment, evaluation and improvement |
2.40. |
Requirement 73 of SSR‑4 [2] states that “The operating organization shall establish a programme to learn from events at the facility and events at other nuclear fuel cycle facilities and in the nuclear industry worldwide.” Recommendations on operating experience programmes are provided in SSG‑50 [15] (see also para. 2.7). |
| Measurement, assessment, evaluation and improvement |
3.1. |
Consideration of criticality safety should be used to determine the following: The design and arrangement of engineered safety measures;
The need for instrumentation to ensure that the operational limits and conditions are adequately monitored and controlled;
The need for additional administrative measures to ensure that the operational limits and conditions are adequately controlled.
|
| Measurement, assessment, evaluation and improvement |
3.2. |
When determining the measures for ensuring the criticality safety of systems in which fissile material is handled, the concept of defence in depth is required to be considered (see para. 6.141 of SSR‑4 [2]). Two vital parts of this concept are passive safety features and fault tolerance (i.e. the design should be such that a failure occurring anywhere within the systems provided to fulfil each safety function will not cause the system to achieve criticality). |
| Measurement, assessment, evaluation and improvement |
3.3. |
With regard to fault tolerance, para. 6.142 of SSR‑4 [2] states: |
| Defence in depth |
3.4. |
The facility or activity is required to be designed and operated or conducted such that it provides defence in depth against credible abnormal conditions and accidents (see Requirement 10 of SSR‑4 [2]). This is achieved by the provision of different levels of protection, with the objective of preventing failures or, if prevention fails, of ensuring that the failure is detected and compensated for or corrected. The primary objective is to adopt safety measures that prevent a criticality accident. However, in line with the concept of defence in depth, safety measures are also required to mitigate the consequences of such an accident (see para. 6.19 of SSR‑4 [2]). |
| Defence in depth |
3.5. |
An overview of the levels of defence in depth (see para. 2.12 of SSR‑4 [2]) in relation to criticality safety is provided in Table 1. In applying the concept of defence in depth, application of the fourth level of defence, which deals with ensuring the confinement function to limit radioactive releases, might not be fully applicable in the context of criticality safety. However, for mitigation of the radiological consequences of a criticality accident, the fifth level of defence in depth has to be applied, with consideration given to the requirements for emergency preparedness and response established in GSR Part 7 [9] (see also Section 6 of this Safety Guide). |
| Passive safety |
3.6. |
The passive safety of the facility or activity should be such that the system will remain subcritical without the need for active engineered safety measures or administrative safety measures (i.e. other than verification that the properties of the fissile material and changes in reflection, absorption and moderation are covered by the design). For example, the facility or activity could be designed using the assumption that fissile material is always restricted to equipment with a favourable geometry. Special care is then necessary to avoid unintentional transfer to an unfavourable geometry. |
| Fault tolerance |
3.7. |
The design should take into account fault tolerance in order to replace or complement passive safety measures (if any). The double contingency principle (see para. 3.3) is the preferred means of ensuring fault tolerance by design. By applying this principle, a criticality accident cannot occur unless at least two unlikely, independent and concurrent changes in process conditions have occurred (see also Requirement 23 of SSR‑4 [2]). |
| Fault tolerance |
3.8. |
In accordance with the double contingency principle, if a criticality accident could occur because of the concurrent occurrence of two changes in process conditions, it should be shown that (a) the two changes are independent (i.e. not caused by a common cause failure) and (b) the probability of occurrence of each change is sufficiently low. |
| Fault tolerance |
3.9. |
The characteristics of a system should meet the recommendations in para. 2.11, in order that each change in process conditions can be detected (e.g. monitored) by suitable and reliable means within a time frame that allows the necessary corrective actions to be taken. |
| Fault tolerance |
3.10. |
The system design should follow the fail‑safe principle, such that a component failure will not result in a criticality accident. In meeting Requirement 23 of SSR‑4 [2], the safety measures should be designed to ensure that no single failure or event, such as a component failure, a function control failure or a human error (e.g. an instruction not followed), can result in a criticality accident (the single failure criterion). |
| Fault tolerance |
3.11. |
Where failures or incorrect operation of the system or perturbations or malfunctions in the system could lead to an unsafe condition, the characteristics of the system should be such that key parameters only deviate from their normal operating values at a rate such that detection, intervention and recovery can be performed sufficiently well to prevent a criticality accident. Where this is not possible, it should be ensured that sufficient and appropriate additional safety measures are provided to prevent (with a high degree of confidence) the initiating event from developing into a criticality accident. |
| Fault tolerance |
3.12. |
The safety functions needed for ensuring subcriticality should be determined, and the safety measures for fulfilling these functions should be defined (see also para. 6.139 of SSR‑4 [2]). The safety functions should be determined on the basis of an analysis of all initiating events and their combinations relevant to criticality safety arising from credible abnormal conditions, including human error, internal and external hazards, and loss or failure of structures, systems and components important to safety. |
| Fault tolerance |
3.13. |
In accordance with para. 6.68 of SSR‑4 [2], and applying the lessons from criticality accidents, the selection of preventive safety measures should observe the following hierarchy: Inherent safety of the process, which is independent of any safety measures.
Passive engineered safety measures that do not rely on control systems, active engineered safety measures or human intervention.
Automatically initiated active engineered safety measures (e.g. an automatically initiated shutdown or process control system).
Administrative safety measures:
(i) Active engineered safety measures initiated manually by operating personnel (e.g. operating personnel initiating a shutdown system in response to an indicator or alarm);
(ii) Safety measures provided by operating personnel (e.g. a mass limit that is implemented by an operator weighing a container and verifying that the mass limit will not be exceeded prior to introducing the container into a glovebox).
|
| Fault tolerance |
3.14. |
The hierarchy of safety measures in para. 3.13 gives preference to inherently safe design and passive safety. If subcriticality cannot be ensured through these means, further safety measures should be employed to minimize the probability of a criticality accident and to mitigate the consequences of such an accident on workers, the public and the environment. This does not mean that the application of any safety measure towards the top of the hierarchy precludes the provision of other safety measures where they can contribute to defence in depth. |
| Fault tolerance |
3.15. |
In addition to the hierarchy of preventive safety measures in para. 3.13, and consistent with the concept of defence in depth, mitigatory safety measures (e.g. shielding, criticality accident detection systems, emergency response) are required to be employed to the extent practicable, in accordance with paras 6.149–6.151 of SSR‑4 [2]. |
| Fault tolerance |
3.16. |
The safety measures applied should be related to the control of one or more parameters or their combinations. Examples of control parameters are given in para. 3.17. |
| Control parameters for criticality safety |
3.17. |
Paragraph 6.143 of SSR‑4 [2] states: Mass and enrichment of fissile material present in a process;
Geometry (limitation of the dimensions or shape) of processing equipment;
Concentration of fissile material in solutions;
Degree of moderation;
Control of reflectors;
Presence of appropriate neutron absorbers.”
|
| Control parameters for criticality safety |
3.18. |
The control parameters that should be considered for ensuring subcriticality include the following: Restrictions on the dimensions or shape of the system to ensure a favourable geometry.
A limit on the mass of fissile material within a system to a subcritical mass. For example, the subcritical mass limit may be specified to be less than the minimum critical mass (incorporating a suitable safety factor) so that inadvertent ‘over‑batching’ of fissile material does not lead to criticality. Consideration may also need to be given to the potential for multiple over‑batching of fissile material as a credible abnormal condition (see para. 9.85(a) of SSR‑4 [2]).
A limit on the concentration of fissile nuclides, for example within a homogeneous hydrogenated mixture or within a solid.
Limits on the type and quantity of neutron moderating material.
Limits on the isotopic composition of the elements in the fissile material present in the system.
A limit on the density of the fissile material.
Limits on the amount, geometrical distribution and form of neutron reflecting material surrounding the fissile material.
The presence, geometrical distribution and integrity of neutron absorbers in the system or between separate systems that are individually subcritical.
Limits on the minimum separation distance between separate systems that are individually subcritical.
|
| Control parameters for criticality safety |
3.19. |
The control parameter limits in para. 3.18 can be evaluated either by multiplying the critical parameter value determined for the particular system conditions by a safety factor, or by calculating the value of the parameter that allows the system to be subcritical with a sufficient margin. In deriving safety margins, consideration should be given to the degree of uncertainty in a system’s conditions; the probability and rate of change in those conditions; the uncertainties in calculations, if used; and the consequences of a criticality accident. As stated in para. 6.140 of SSR‑4 [2], “Criticality evaluations and calculations shall be performed on the basis of conservative assumptions.” |
| Factors affecting subcriticality |
3.20. |
In many cases, limits on the nuclide composition of the fissile material or restrictions to a certain type and chemical compound of the fissile material, or a combination of both, are essential for ensuring criticality safety. Effective safety measures should be applied to ensure the following: The limits on the nuclide composition of the elements in the fissile material are complied with.
The chemical and physical form of the compound to be used cannot change to make the compound more reactive.
A mixture of different compounds resulting in a higher keff cannot occur. The events described in (b) and (c) could occur in specific situations (e.g. the precipitation of a uranium or plutonium nitrate solution, modification of the diameter of pellets); both such events should be taken into account in the criticality safety assessment, and it should be proved that subcriticality would be maintained.
|
| Factors affecting subcriticality |
3.21. |
The presence of neutron moderating materials should be considered, as these can significantly reduce the critical mass of the fissile material. Hydrogen and carbon contained in materials such as water, oil, graphite and polyethylene are common moderators. Low atomic mass, low neutron absorption materials (e.g. deuterium, beryllium, beryllium oxide) are less common but can be very effective moderators. Consideration should be given to the replacement of a moderator and/or reflector with an alternative substance that has more favourable properties with regard to criticality; for example, there is the possibility that hydrocarbon based oils could be replaced with oils containing fluorine or chlorine. |
| Factors affecting subcriticality |
3.22. |
The presence of neutron reflecting material should be considered. Material present outside the system of fissile material will act as a neutron reflector and can increase the keff of the system. Criticality safety assessments usually consider a light water reflector (full density water) with a thickness sufficient to achieve the maximum keff, known as ‘total reflection’ or ‘full light water reflection’. However, the possible presence of other reflector materials (e.g. polyethylene, concrete, steel, lead, beryllium, aluminium), or several reflector materials used in combination, should be considered if this could result in a greater increase in keff. |
| Factors affecting subcriticality |
3.23. |
Neutron absorbers are mainly effective for thermal neutron systems. Therefore, any neutron spectrum hardening (i.e. an increase in the distribution of higher energy neutrons) caused by operating conditions or credible abnormal conditions should be considered, as this hardening might decrease the effectiveness of the neutron absorption. Therefore, when a neutron absorbing feature is being considered, appropriate safety measures should be applied to ensure that the effectiveness of the neutron absorber remains sufficient. Consideration should also be given to monitoring the long term degradation of neutron absorbers (and their associated moderators) and situations that could cause such degradation. |
| Factors affecting subcriticality |
3.24. |
The geometrical distribution of neutron absorbers and credible changes in their distribution should be considered. Changes in the geometrical distribution of neutron absorbers could include slumping, evaporation and compression. |
| Factors affecting subcriticality |
3.25. |
Neutron absorbers that are homogeneously distributed in a thermal neutron system are usually more effective than those that are heterogeneously distributed. However, heterogeneously distributed absorbers might be easier to control by administrative means. In a thermal neutron system consisting of a heterogeneous arrangement of fissile material and a fixed neutron absorber (e.g. the storage of fuel assemblies), the neutron absorber might be more effective the closer it is located to the fissile material. Any material (e.g. water, steel) located between the absorber and the fissile material can change the effectiveness of the absorber. Solid, fixed neutron absorbers should be tested and/or validated prior to first use in order to demonstrate the presence and uniformity of the distribution of the absorber nuclide (e.g. 10B). Demonstration of the continued presence and effectiveness of neutron absorbers throughout their operational lifetime should be considered. |
| Factors affecting subcriticality |
3.26. |
Material (e.g. steam, water mist, polyethylene, concrete) located between or around fissile material can act as a reflector and as a moderator and/or a neutron absorber and can therefore increase or decrease the keff of the system. Any change in keff will be dependent on the type and density of the material positioned between or around the fissile material. Materials containing hydrogen and materials with low density (such as steam or foam) can cause a significant change in keff. The inclusion or omission of any materials from the criticality safety assessment should be justified by evaluating the effect of their treatment on keff. |
| Factors affecting subcriticality |
3.27. |
Neutron interaction between units or equipment containing fissile material should be considered, as this interaction can affect the keff of the system. This control parameter can be used to ensure criticality safety, for example by specifying minimum separation distances (or in some cases maximum distances, for example to limit interstitial moderation between units of fissile material) or by introducing screens of neutron absorbers. Wherever practicable, separation should be ensured by engineered means, for example fixed storage racks for storage of arrays of drums containing fissile material. |
| Factors affecting subcriticality |
3.28. |
The heterogeneity of materials such as swarf (i.e. turnings, chips or metal filings) or fuel pellets can result in a keff greater than the factor for a homogeneous mixture, particularly for low enriched uranium systems or for mixed uranium and plutonium. Therefore, the degree of heterogeneity or homogeneity assumed in the criticality safety assessment should be justified. Safety measures should be applied that ensure that the heterogeneity of the fissile material could not result in a higher keff than that considered. |
| Factors affecting subcriticality |
3.29. |
The temperature of materials might cause changes in density and in the neutron cross‑section, which might affect keff. This should be considered in the criticality safety assessment. |
| Passive engineered safety measures for criticality safety |
3.30. |
Passive engineered safety measures are highly preferred to active engineered safety measures owing to their higher reliability. Like active components, passive components are subject to degradation and to human error during installation and maintenance activities. Passive components should be subject to surveillance or periodic verification and, as necessary, maintenance. Care should be taken that boundary conditions, necessary for the effectiveness of the passive measure, will be maintained. Examples of passive components are geometrically favourable pipes, vessels and structures, solid neutron absorbing materials, and the form of fissile material. When considering the reliability of these types of component, administrative failure modes should be taken into account. |
| Passive engineered safety measures for criticality safety |
3.31. |
Certain components that function with very high reliability on the basis of irreversible action or change may be designated as passive components. |
| Passive engineered safety measures for criticality safety |
3.32. |
Certain components, such as rupture discs, check valves, safety valves and injectors, have characteristics that need special consideration before designation as an active or passive component. Any engineered component that is not a passive component is designated as an active component, although it may be part of either an active engineered safety measure or an administrative safety measure. |
| Active engineered safety measures for criticality safety |
3.33. |
Active engineered safety measures should be used in addition to passive safety measures and where passive engineered safety measures are not feasible. Active components are subject to failure and degradation and to human error during operation and maintenance activities. Therefore, components of high quality and with low failure rates should be selected in all cases. Fail‑safe designs should be employed, if possible, and failures should be easily and quickly detectable. |
| Active engineered safety measures for criticality safety |
3.34. |
Paragraph 6.92 of SSR‑4 [2] states: |
| Active engineered safety measures for criticality safety |
3.35. |
Examples of active components are neutron or gamma monitors (see paras 6.33–6.57), computer controlled systems for the movement of fissile material, devices monitoring essential process parameters that enable automatic trips (e.g. conductivity, flow rate, pressure, temperature), as well as pumps, valves, fans, relays and transistors. Active components with actions that necessitate a human response (e.g. the response to an alarm or to a value on a weighing scale) should be considered as administrative safety measures (see paras 3.36–3.47). When considering the reliability of these types of component, administrative failure modes should be taken into account. |
| General considerations for administrative safety measures for criticality safety |
3.36. |
When administrative safety measures are employed, particularly procedural controls, it should be demonstrated in the criticality safety assessment that credible deviations from such measures have been exhaustively studied and that combinations of deviations that could lead to a criticality accident are understood. Specialists in human performance and human factors should be consulted to develop the procedural controls, to assess the robustness of the procedural controls and to identify improvements, where appropriate. |
| General considerations for administrative safety measures for criticality safety |
3.37. |
The use of administrative safety measures should be incorporated into the management system of the operating organization (see para. 2.17), and the use of such measures should include consideration of the following: Specification and control of the nuclide composition of the fissile material; the fissile nuclide content; the mass, density, concentration, chemical composition and degree of moderation of the fissile material; and the spacing between systems of fissile material.
Determination and demarcation of criticality controlled areas (i.e. areas authorized to contain significant quantities of fissile material) and specification of the control parameters associated with such areas. Specification (and, where applicable, labelling) of materials (e.g. fissile material; neutron moderating, absorbing or reflecting materials). Specification (and, where applicable, labelling) of control parameters and their associated limits on which subcriticality depends. A criticality controlled area should be defined by both the characteristics of the fissile material within it and the control parameters used.
Control of access to criticality controlled areas.
Separation between criticality controlled areas, and separation of materials within criticality controlled areas.
Movement and control of materials within and between criticality controlled areas (including those areas containing different fissile materials and/or with different control parameters), and spacing between moved and stored materials (see also para. 6.147 of SSR‑4 [2]).
Procedural controls for record keeping systems (e.g. accounting for fissile material).
Movement and control of materials from areas without criticality safety control (e.g. wastewater processing areas) to criticality controlled areas or vice versa (e.g. flow of effluent waste streams from controlled to uncontrolled processes) (see also Requirement 28 of SSR‑4 [2]).
Use of neutron absorbers, and control of their continued presence, distribution and effectiveness.
Procedures for use and control of ancillary systems and equipment (e.g. vacuum cleaners in criticality controlled areas; control of filter systems in waste air and off‑gas systems).
Quality management, periodic inspection (e.g. control of continued favourable geometries), maintenance, and the collection and analysis of operating experience.
Procedures for use in the event of credible abnormal conditions (e.g. deviations from operating procedures, credible alterations in process or system conditions).
Procedures for preventing, detecting, stopping and containing leaks and for removing leaked materials.
Procedures for firefighting (e.g. the use of hydrogen‑free or very low hydrogen content fire extinguishing materials).
Procedures for the control and analysis of design modifications and of changes in operating procedures.
Procedures for criticality safety assessment and analysis.
Procedures for the appointment of suitably qualified and experienced criticality safety staff.
Procedures for training operating personnel and criticality safety staff.
Means of ensuring that the procedures are understood by operating personnel and contractors working at the facility.
Control of the facility configuration.
The safety functions and safety classification of structures, systems and components important to safety (e.g. in relation to the design, procurement and administrative oversight of operations, and to maintenance, inspection, testing and examination).
|
| Operating procedures |
3.38. |
Operating procedures are required by Requirement 63 of SSR‑4 [2], and approved procedures in relation to criticality safety are required by para. 9.83 of SSR‑4 [2]. These procedures should be written with sufficient detail for a qualified individual to be able to perform the activities without the need for direct supervision. The aims of operating procedures should be as follows: To facilitate the safe and efficient conduct of operations;
To include those controls, limits and measures that are important for ensuring subcriticality;
To include mandatory operations, advice and guidance for credible abnormal conditions and accident conditions;
To include appropriate links between procedures in order to avoid omissions and duplications and, where necessary, to clearly specify the conditions of entry to and exit from other procedures;
To be simple and readily understandable to operating personnel.
|
| Operating procedures |
3.39. |
Procedures should be reviewed in accordance with the management system. Such reviews should incorporate any changes and lessons from feedback of operating experience and should be supported by periodic training. As appropriate, this should include review by supervisors and the relevant criticality safety staff. Any changes to operating procedures should be subject to approval by managers responsible for ensuring subcriticality. |
| Responsibilities and authorities for criticality safety |
3.40. |
The operating organization has responsibility for overseeing the implementation of the criticality safety measures and for implementing an appropriate quality management programme. The relevant authorities and responsibilities are required to be documented in the management system (see paras 2.22 and 2.23). |
| Responsibilities and authorities for criticality safety |
3.41. |
The operating organization may delegate authority for the implementation of specific criticality safety measures to supervisors. The authority that is permitted to be delegated to a supervisor should be specified and documented in the management system. The prime responsibility for safety remains with the operating organization (see Requirement 2 of SSR‑4 [2]). |
| Responsibilities and authorities for criticality safety |
3.42. |
Authority for the implementation of the quality management programme should be assigned to persons who are independent of the operating personnel. |
| Responsibilities and authorities for criticality safety |
3.43. |
Requirement 12 of GSR Part 2 [5] states that “Individuals in the organization, from senior managers downwards, shall foster a strong safety culture.” This should ensure that all personnel understand the importance of ensuring subcriticality and the necessity of adequately implementing the criticality safety measures. For this purpose, the operating organization should provide the following: Criticality safety staff who are independent of operating personnel and who report (along with other safety experts) to a manager with responsibility for safety at the highest level of the organization;
The organizational means for ensuring that the criticality safety staff provide managers, supervisors and operating personnel with periodic training on criticality safety to improve their safety awareness and behaviour (see para. 9.83 of SSR‑4 [2]);
The organizational means for ensuring that criticality safety staff are provided with periodic training on criticality safety that is suited to their roles, responsibilities and operations;
The organizational means for ensuring that periodic reviews of criticality safety assessments (see Section 4) are undertaken;
The organizational means for ensuring that the criticality safety programme and its effectiveness are continually reviewed and improved.
|
| Responsibilities and authorities for criticality safety |
3.44. |
Records of participation in criticality safety training should be maintained and used to ensure that routine refresher training is provided. |
| Responsibilities and authorities for criticality safety |
3.45. |
The criticality safety staff should be responsible for the following:Performing and documenting criticality safety assessments for systems of, or areas with, fissile material;
Ensuring the accuracy of the criticality safety assessment by, whenever possible, directly observing the activity, processes or equipment, as appropriate, and encouraging operating personnel to provide feedback on operating experience;
Providing documented guidance on criticality safety for the design of systems of fissile material, for processes and for the development of operating procedures;
Specifying the operational limits and conditions for ensuring criticality safety;
Specifying the necessary criticality safety measures and supporting their implementation;
Determining the location and extent of criticality controlled areas;
Assisting in determining the location of criticality detection and alarm systems, developing the associated emergency arrangements and conducting periodic reviews of these arrangements;
Assisting and consulting operating personnel, supervisors and management, and maintaining contact with them to ensure familiarity with all activities involving fissile material;
Conducting regular walkdowns of the facility and inspections of the activities;
Assisting in the establishment, modification and review of operating procedures;
Verifying and documenting criticality safety in relation to modifications or changes in the design of systems or in processes;
Ensuring that training in criticality safety is provided periodically for operating personnel, supervisors and management.
|
| Responsibilities and authorities for criticality safety |
3.46. |
Supervisors should be responsible for the following: Maintaining an awareness of the control parameters and associated limits for criticality safety relevant to systems for which they are responsible;
Monitoring and documenting compliance with the limits of the control parameters;
Ensuring that inspection, testing and maintenance programmes for engineered safety systems are implemented;
If there is the potential for unsafe conditions to occur owing to a deviation from normal operations, stopping the work in a safe way and reporting the event, as necessary;
Promoting a questioning attitude from personnel and demonstrating a strong safety culture, including giving priority to safety over the needs of production.
|
| Responsibilities and authorities for criticality safety |
3.47. |
In relation to criticality safety, the responsibilities of operating personnel and other personnel should include the following: To cooperate and comply with management instructions and procedures;
To adopt and contribute to a questioning attitude and strong safety culture;
If there is the potential for unsafe conditions to occur owing to a deviation from normal operations, to stop work and report the event, as necessary.
|
| Responsibilities and authorities for criticality safety |
3.48. |
Implementation of a combination of different engineered and administrative safety measures is essential for the assurance of subcriticality (see para. 6.139 of SSR‑4 [2]). In accordance with the principles of redundancy, diversity and independence (see Requirement 23 and para. 6.141 of SSR‑4 [2]), reliance can be placed on safety measures that have been already implemented in the facility or activity. Any such existing measures should be considered within the hierarchy of criticality safety measures described in paras 3.12–3.14. |
| Responsibilities and authorities for criticality safety |
3.49. |
Safety measures include quality management measures, inspection, testing and maintenance to ensure that the necessary safety functions are fulfilled and that criteria for reliability are met. Where administrative controls are necessary as part of a safety measure, these should be verified regularly. |
| Responsibilities and authorities for criticality safety |
3.50. |
Before the implementation of criticality safety measures, consideration should be given to a range of factors, including the following: The complexity of implementing the safety measure;
The potential for common cause failure of safety measures;
The reliability claimed in the criticality safety assessment for the set of safety measures;
The ability of operating personnel to recognize the abnormality or failure of the safety measure;
The ability of operating personnel to manage abnormal situations;
The ageing management aspects;
Feedback from operating experience.
|
| Responsibilities and authorities for criticality safety |
3.51. |
Changes affecting criticality safety due to ageing of the facility should be considered. The ageing management programme is required to be coordinated with the criticality safety programme (see paras 9.53 and 9.83 of SSR‑4 [2]). |
| Responsibilities and authorities for criticality safety |
3.52. |
Ageing effects should be monitored, and their potential impacts on criticality safety should be assessed. Where ageing has reduced criticality safety below acceptable levels, corrective measures are required to be implemented (see para. 4.2(d) of SSR‑4 [2]). Changes that have been approved should be implemented in a timely manner. Periodic testing of items relied on to ensure subcriticality should be performed to ensure that the criticality safety analysis remains valid for any actual or potential degradation in the condition of such items. |
| Responsibilities and authorities for criticality safety |
3.53. |
Before a new activity with fissile material is initiated, the level of criticality safety is required to be assessed (see para. 6.141 of SSR‑4 [2]) and the necessary engineered and administrative safety measures should be determined, prepared and independently reviewed by criticality safety staff. Likewise, before an existing facility or activity is changed, the engineered and administrative safety measures should be independently reviewed and, as appropriate, revised. The introduction of a new activity may be subject to authorization by the regulatory body before it can be initiated. |
| Responsibilities and authorities for criticality safety |
4.1. |
Criticality safety assessments should use a deterministic approach, in which a set of conservative rules concerning facilities or activities involving fissile material is applied. In such an approach, the adequacy of safety measures for successfully minimizing, detecting and intercepting deviations in control parameters to prevent a criticality accident should be judged against criteria such as the redundancy, diversity and independence of the safety measures and whether the safety measures are engineered or administrative, passive or active, or a combination of these four types of safety measure. The likelihood of failure of these safety measures should be considered. |
| Responsibilities and authorities for criticality safety |
4.2. |
The scope and level of detail of the criticality safety assessment are required to reflect the specific type of facility or activity and be consistent with the magnitude of the possible radiation risks arising from the facility or activity, in accordance with a graded approach (see Requirement 1 of GSR Part 4 (Rev. 1) [4]). |
| Responsibilities and authorities for criticality safety |
4.3. |
It is also common to complement the deterministic approach to criticality safety assessment with a probabilistic approach. The probabilistic approach involves realistic assumptions regarding operating conditions and operating experience, rather than the conservative representation typically used in the deterministic approach. The probabilistic approach necessitates an estimate of (a) the frequency of each initiating event that would trigger a deviation from normal operating conditions and (b) the probabilities of failure of any safety measures applied to minimize, detect or intercept the deviation. The frequency of the initiating event and the probabilities of failure of the safety measures can be combined to derive a value for the frequency of occurrence of criticality. By using this value and a measure of the consequences, an estimate of the criticality risk can be made and compared with risk targets or criteria for the facility or activity. |
| Responsibilities and authorities for criticality safety |
4.4. |
The probabilistic approach is used to evaluate the extent to which the safety of operations at the facility is well balanced and to provide additional insights into possible weaknesses in the design or operation, which can be helpful in identifying ways of further reducing the criticality risk. If the probabilistic assessment reveals an unusually high reliance of subcriticality protection on a single safety measure, strengthening or supplementing that measure should be considered. Difficulties in applying the probabilistic approach are sometimes encountered in criticality safety assessment if one or more of the safety measures includes the action of operating personnel as a significant component. The reliability of safety measures of this type can be very difficult to quantify. Also, in some cases, there might be a lack of data on the reliability of equipment, hardware or software. Consideration should be given to the uncertainties in the calculated values of criticality risk, especially if such values are to be used as a basis for significant modifications to a facility or activity. |
| Responsibilities and authorities for criticality safety |
4.5. |
In accordance with para. 6.138 of SSR‑4 [2], a criticality safety assessment is required to be performed prior to the commencement of any new or modified activity involving fissile material. A criticality safety assessment should be performed during the design stage, as well as before and during construction, commissioning and operation of a facility or activity. A criticality safety assessment should also be performed before the on‑site movement of fissile material, as well as before and during storage of fissile material and post‑operational cleaning and decommissioning of the facility. |
| Responsibilities and authorities for criticality safety |
4.6. |
The objectives of the criticality safety assessment should be to determine whether an adequate level of safety can be reasonably achieved and to document the appropriate limits, conditions and safety measures necessary to prevent a criticality accident. The criticality safety assessment should demonstrate and document the compliance of the design and procedures with appropriate safety criteria and safety requirements. |
| Responsibilities and authorities for criticality safety |
4.7. |
The criticality safety assessment should include a criticality safety analysis, which evaluates subcriticality for operational states and for credible abnormal conditions. The criticality safety analysis should be used to identify hazards, both internal and external, and to determine the radiological consequences of a criticality accident. |
| Responsibilities and authorities for criticality safety |
4.8. |
All margins adopted in setting subcritical limits, criticality safety limits and operational limits (see paras 2.8–2.12) should be justified and documented, and there should be sufficient detail and clarity to allow an independent review of the judgements made and the margins chosen. When appropriate, this justification should be supported by reference to national regulations, to national and international standards or codes of practice, or to guidance notes that are compliant with these regulations and standards. |
| Responsibilities and authorities for criticality safety |
4.9. |
In the criticality safety assessment, consideration should be given to the possibility of inappropriate actions by operating personnel in response to abnormal conditions. For example, the potential for operating personnel to respond to leaks of fissile solutions by catching the material in geometrically unfavourable equipment should be considered. |
| Responsibilities and authorities for criticality safety |
4.10. |
A systematic approach to criticality safety assessment should be adopted, for example as outlined by the following steps: Defining the reference fissile medium and its constituents, chemical and physical forms, and nuclear and chemical properties.
Defining the processes and operations involving the fissile material.
Defining the methodology for conducting the criticality safety assessment.
Demonstrating the subcriticality of the design and procedures for operational states and credible abnormal conditions, including applying the double contingency principle and defence in depth, as appropriate. Identifying which criticality parameters are being controlled and their associated limits.
Verifying and validating the calculation methods (including the computer codes) and nuclear data, as well as the procedures for using these methods, codes and data.
Performing the criticality safety analyses, and documenting a description of the calculation method and the nuclear data used.
|
| Responsibilities and authorities for criticality safety |
4.11. |
Where practicable, during the development of the criticality safety assessment, the personnel performing the assessment should directly observe all relevant aspects of the process or activity being assessed, including (if possible) any relevant equipment, activities and processes. |
| Responsibilities and authorities for criticality safety |
4.12. |
Before the commissioning of a new facility or the start of a new activity, or before an existing facility or activity is modified or changed in a way that might have an impact on criticality safety, the following actions should be taken: An independent review should be performed to confirm the adequacy of the criticality safety assessment. The reviewer should be competent in criticality safety assessment and knowledgeable about the facility or activity concerned. The review should include, at a minimum, the validation of the calculation method, the methodology for performing the criticality safety assessment, and a demonstration of the subcriticality of the design and procedures during operational states and during credible abnormal conditions. The reviewer should also confirm that all credible abnormal conditions have been identified.
The supervisor should verify that the scenarios described in the criticality safety assessment are appropriate and that the criticality safety assessment adequately identifies all associated operational states and credible abnormal conditions.
|
| Defining the reference fissile medium |
4.13. |
The characteristics of the reference fissile medium required for criticality safety assessment (see para. 6.144(a) of SSR‑4 [2]) should be determined, justified and documented. These characteristics include moderator nuclide composition (including physical form and chemical form (e.g. oxide, nitrate), absorber depletion, degree of nuclide decay or in‑growth, and irradiation (i.e. transmutation of fissile or fertile material and fission products). Estimates of the normal range of these characteristics, including conservative or bounding estimates of any anticipated variations in the characteristics, should be determined, justified and documented. |
| Defining the processes and operations involving the fissile material |
4.14. |
A description of the operations being assessed should be provided, which should include all relevant systems, processes and interfaces. This should include administrative systems, for example non‑destructive testing and systems for accounting for and control of materials. The description should be accompanied by relevant drawings, illustrations and/or graphics, as well as operating procedures. |
| Defining the processes and operations involving the fissile material |
4.15. |
The limits and conditions of each operation involving the fissile material should be determined. Any assumptions made about the operations — and about any associated systems, processes and interfaces — that could impact the criticality safety assessment should be identified and justified. |
| Defining the processes and operations involving the fissile material |
4.16. |
If the criticality safety assessment is limited to a particular aspect of a facility or activity, the potential for interactions with other facilities, systems, processes or activities should be described and considered. |
| Defining the methodology for conducting the criticality safety assessment |
4.17. |
The criticality safety assessment is expected to identify all credible initiating events (i.e. all incidents that could lead to credible abnormal conditions). These initiating events should then be analysed and documented, with account taken of possible aggravating events. Additionally, a justification is required for excluding any identified initiating events from the assessment (see para. 6.64 of SSR‑4 [2]). The following should be considered when performing the analysis: A structured and auditable approach should be used to identify credible initiating events. This approach should also include a review of lessons from previous incidents and take into account the results of any physical testing. Techniques that can be used to help identify credible scenarios include the following:
— ‘What‑if’ or cause–consequence methods;
— Qualitative event trees or fault trees;
— Hazard and operability analysis;
— Bayesian networks;
— Failure modes and effects analysis.
Input into the criticality safety assessment should also be obtained from the safety analysis report for the facility or activity, and from operating personnel and process specialists who are thoroughly familiar with the operations and initiating events that could credibly arise.
|
| Defining the methodology for conducting the criticality safety assessment |
4.18. |
The criticality safety assessment provides a documented technical basis that demonstrates that subcriticality can be maintained in operational states and in credible abnormal conditions, in accordance with the double contingency principle or the single failure criterion (see paras 3.7–3.11). The aim of the criticality safety assessment is to identify the safety measures necessary to ensure subcriticality. The assessment should specify the functions of these safety measures, as well as criteria for the reliability, redundancy, diversity and independence of these measures. The equipment qualification criteria for these safety measures should also be specified. |
| Defining the methodology for conducting the criticality safety assessment |
4.19. |
The criticality safety assessment should describe the methods used to establish the operational limits and conditions for the activity being evaluated. Methods that may be used for the establishment of these limits and conditions include the following:Reference to national and international standards;
Reference to accepted handbooks on criticality safety;
Reference to experiments, with appropriate adjustments of limits to ensure subcriticality when the uncertainties associated with the parameters reported in the experiment documentation are considered;
Use of validated calculation models and techniques.
|
| Defining the methodology for conducting the criticality safety assessment |
4.20. |
The applicability of the reference data used in the criticality safety assessment to the system of fissile material being evaluated should be justified. The calculation methods, computer codes and nuclear data used should be specified (including their release versions), together with any cross‑section pre‑processing codes that were used by assessors. |
| Defining the methodology for conducting the criticality safety assessment |
4.21. |
The overall safety assessment for the facility or activity should also be reviewed and used to identify and provide information on initiating events that should be considered as credible initiators of criticality accidents, for example activation of sprinklers, rupture of a glovebox, buildup of material in ventilation filters, collapse of a rack, movement of fissile material, and natural phenomena. |
| Verifying and validating the calculation methods |
4.22. |
Calculation methods involving the use of computer codes and an associated nuclear data library used in the criticality safety analysis to calculate keff are required to be verified and validated to ensure the reliability of their derived values (see Requirement 18 of GSR Part 4 (Rev. 1) [4] and para. 6.145 of SSR‑4 [2]). This includes establishing limits of applicability and acceptable levels of code bias and uncertainty. |
| Verifying and validating the calculation methods |
4.23. |
Verification of the calculation methods should be performed prior to validation and periodically thereafter. Verification is the process of determining whether a calculation method correctly implements the intended conceptual model or mathematical model. Verification should test the methods used in the model and computer codes, while ensuring that changes in the operating environment (i.e. operating system, software and hardware) do not adversely affect the execution of the codes. |
| Verifying and validating the calculation methods |
4.24. |
After verification of the calculation method is complete, and before its use in performing a criticality safety analysis, the method should be validated. Validation relates to the process of determining whether the overall calculation method adequately reflects the real system being modelled and enables the quantification of bias and uncertainty by comparing the predictions of the model with observations of the real system of fissile material or with evaluated experimental data. |
| Verifying and validating the calculation methods |
4.25. |
The relevance of benchmarks derived from experimental data in validating the criticality safety analysis should be determined from a comparison of the characteristics of the benchmarks with the characteristics of the system of fissile material being evaluated. A useful source of benchmark data can be found in Ref. [20]. |
| Verifying and validating the calculation methods |
4.26. |
In selecting benchmarks, consideration should be given to the following: Benchmarks should be reviewed to ensure that information is complete and fully addresses stated biases and uncertainties before their use as benchmarks. Benchmarks should have known and relatively small uncertainties compared with any arbitrary or administratively imposed safety margin.
Benchmarks should be selected from multiple independent sets to reduce the effect of shared benchmark uncertainties (e.g. correlations leading to systematic effect uncertainties).
Benchmarks should be reviewed to ensure that their neutronic, geometric, physical and chemical characteristics encompass the characteristics of the system of fissile material to be evaluated. Neutronic, geometric, physical and chemical characteristics are determined on the basis of system specifications that include the following:
Chemical compounds, mixtures, alloys and their compositions or formulas.
Isotopic compositions.
Material densities.
Relative proportions or concentrations of materials, such as the moderator to fissile nuclide ratio. Effective moderators are typically materials of low atomic mass. Common materials that can be effective moderators include water (i.e. hydrogen, deuterium and oxygen), beryllium, beryllium oxide and graphite (i.e. carbon). In the absence of well absorbing nuclides, another element (e.g. oxygen in magnesium) can be an effective moderator.
The degree of homogeneity or heterogeneity, including gradients, of fissile and non‑fissile materials (e.g. the settling of waste fissile materials in irradiated fuel rods).
Geometric arrangements and compositions of fissile material relative to non‑fissile material such as neutron reflectors and materials contributing to the absorption of neutrons (cadmium, boron, hafnium and gadolinium are commonly used, but other materials such as iron also act as slow neutron absorbers).
Temperature of the system.
Relevant neutron reflectors.
Neutron energy spectrum.
Correlations between effective neutron multiplication factors due to nuclear data uncertainties.
Calculation methods should be reviewed periodically to determine whether relevant new benchmark data have become available for further validation.
Calculation methods should be reverified following changes to the computer code system, and periodically thereafter.
Chemical compounds, mixtures, alloys and their compositions or formulas.
Isotopic compositions.
Material densities.
Relative proportions or concentrations of materials, such as the moderator to fissile nuclide ratio. Effective moderators are typically materials of low atomic mass. Common materials that can be effective moderators include water (i.e. hydrogen, deuterium and oxygen), beryllium, beryllium oxide and graphite (i.e. carbon). In the absence of well absorbing nuclides, another element (e.g. oxygen in magnesium) can be an effective moderator.
The degree of homogeneity or heterogeneity, including gradients, of fissile and non‑fissile materials (e.g. the settling of waste fissile materials in irradiated fuel rods).
Geometric arrangements and compositions of fissile material relative to non‑fissile material such as neutron reflectors and materials contributing to the absorption of neutrons (cadmium, boron, hafnium and gadolinium are commonly used, but other materials such as iron also act as slow neutron absorbers).
Temperature of the system.
Relevant neutron reflectors.
Neutron energy spectrum.
Correlations between effective neutron multiplication factors due to nuclear data uncertainties.
|
| Verifying and validating the calculation methods |
4.27. |
If no benchmarks exist that are representative of the system being evaluated (e.g. for low moderated powders and waste), it may be possible to interpolate or extrapolate from other existing benchmark data by making use of trends in the bias. In cases that involve an extended extrapolation of the benchmark data to the system being evaluated, an additional margin might be necessary to take into account validation uncertainties. Sensitivity analysis and uncertainty analysis may be used to assess the applicability of benchmark data to the system being analysed and to ensure an acceptable safety margin. An important aspect of this process is the quality of the nuclear data and of the benchmarks. Comparison of the results from one computer code with the results from another computer code might be used to supplement the validation of a calculational method; however, this does not by itself constitute adequate validation. |
| Verifying and validating the calculation methods |
4.28. |
The calculation methods, analysis techniques and nuclear data used in the evaluation of the applicability of benchmarks should be the same as those used to analyse the system or process to which the validation is applied; otherwise, justification should be provided for the use of different techniques. |
| Verifying and validating the calculation methods |
4.29. |
Appropriate statistical methods should be used to establish bias and bias uncertainty during the validation process. For cases involving data that are not normally distributed, a non‑parametric approach may be appropriate. |
| Performing and documenting the criticality safety analyses |
4.30. |
In the performance of criticality safety analyses, the calculation method should only be used within its validated areas of applicability; alternatively, any use of the calculation method outside its areas of applicability should be documented and justified. |
| Performing and documenting the criticality safety analyses |
4.31. |
An additional subcritical margin (i.e. administrative margin) should be used to bound any unknown (or difficult to quantify) uncertainty beyond that identified in the validation, and the additional margin should be justified. |
| Performing and documenting the criticality safety analyses |
4.32. |
The keff subcritical limit (sometimes referred to as the ‘upper subcritical limit’) should be established on the basis of the bias and bias uncertainty of the calculation method, the administrative margin, the features of the system, and any related issues (e.g. use of the calculation method outside its areas of applicability, the degree of experimental uncertainty) and considering the conservatism of the assumptions of the calculation models. When comparing the calculated keff values with this subcritical limit, the remaining uncertainties of the calculated keff values (e.g. statistical uncertainties in Monte Carlo calculations) are required to be considered (see para. 6.144(j) of SSR‑4 [2]). |
| Performing and documenting the criticality safety analyses |
4.33. |
When computer codes are used in the analyses, the type of computing platform (i.e. hardware and software), together with relevant information on the control of code configuration, especially calculation schemes, should be documented. |
| Performing and documenting the criticality safety analyses |
4.34. |
Quality management in relation to the input data and the calculation results is an important part of criticality safety analysis. This includes, for example, verification that Monte Carlo calculations have properly converged. All input data and nuclear data used in calculations; the assumptions, approximations and simplifications used to prepare the input data; the associated uncertainties; and the derived results and their uncertainties (see para. 4.31) should be documented as part of the management system (see paras 2.17–2.21). |
| Performing and documenting the criticality safety analyses |
4.35. |
Once the calculation method has been verified and validated, it should be controlled and documented as part of the management system to ensure that a systematic approach is adopted. |
| Performing and documenting the criticality safety analyses |
4.36. |
The results of the calculations should be cross‑checked by using independent nuclear data or different computer codes when available. |
| Performing and documenting the criticality safety analyses |
4.37. |
Benchmark modelling performed by organizations other than the organization performing the validation should be compared to confirm that the results are consistent. |
| Performing and documenting the criticality safety analyses |
5.1. |
Criticality safety concerns many parts of the nuclear fuel cycle, for example enrichment, fuel fabrication, fuel handling, transport and storage, reprocessing of spent fuel, and processing of radioactive waste and its disposal. |
| Performing and documenting the criticality safety analyses |
5.2. |
The facilities and activities of the nuclear fuel cycle can be split into two groups: those for which there is no potential for criticality and those for which there is potential for criticality, for example as follows: There is no potential for criticality in facilities for mining of natural uranium and thorium ores and their processing, transport and conversion.
The potential for criticality exists in enrichment facilities, uranium and mixed oxide fuel fabrication facilities, fresh fuel storage facilities, irradiated fuel storage facilities, reprocessing facilities, waste processing facilities and disposal facilities, and in the transport of fissile material.
|
| Performing and documenting the criticality safety analyses |
5.3. |
This section provides recommendations on specific issues that should be taken into account to ensure criticality safety in different practices in the nuclear fuel cycle. In all these practices, rigorous control of the physical inventory of fissile material is expected. Consequently, the potential for criticality resulting from errors such as over‑batching or the addition of water to vessels thought to be empty should be eliminated (see para. 9.85(a) of SSR‑4 [2]). |
| Performing and documenting the criticality safety analyses |
5.4. |
Specific requirements for criticality safety in the operation of uranium conversion and enrichment facilities are established in para. 9.88 of SSR‑4 [2]. |
| Performing and documenting the criticality safety analyses |
5.5. |
In conversion facilities, uranium concentrates are purified and converted to the chemical forms suitable for further steps in the manufacture of nuclear fuel — usually uranium tetrafluoride or uranium hexafluoride — if enrichment is needed. Because of the isotopic composition of natural uranium (i.e. approximately 0.7 % 235U by weight), in the homogeneous processes of conversion, and in the absence of enriched uranium or moderators more effective than water, no criticality safety hazards are encountered in the conversion of natural or depleted uranium. |
| Performing and documenting the criticality safety analyses |
5.6. |
Uranium enrichment facilities have the potential for criticality accidents; consequently, criticality safety measures, as described in Sections 2 and 3, should be applied. |
| Performing and documenting the criticality safety analyses |
5.7. |
Before any wet cleaning of equipment or cylinders, an operational limit for uranium holdup should be defined, and it should be verified that the uranium holdup is below this limit. |
| Performing and documenting the criticality safety analyses |
5.8. |
Particular consideration should be given to criticality safety in conversion facilities used for the conversion of enriched or reprocessed uranium, which has a higher enrichment than natural uranium and, under certain conditions, can achieve criticality. |
| Performing and documenting the criticality safety analyses |
5.9. |
A particular issue associated with uranium enrichment facilities is the potential for over‑enrichment and the hazards associated with varying levels of enrichment. |
| Performing and documenting the criticality safety analyses |
5.10. |
In meeting the requirement established in para. 6.146(c) of SSR‑4 [2], when considering measures to mitigate the consequences of a fire or a uranium hexafluoride release, the use of borated water and/or favourable geometry to collect the water should be taken into account. |
| Performing and documenting the criticality safety analyses |
5.11. |
Further recommendations on criticality safety for conversion facilities and uranium enrichment facilities are provided in IAEA Safety Standards Series No. SSG‑5, Safety of Conversion Facilities and Uranium Enrichment Facilities [21]. |
| Performing and documenting the criticality safety analyses |
5.12. |
Specific requirements for criticality safety in the design of a mixed oxide fuel fabrication facility are established in para. 6.152 of SSR‑4 [2]. Specific requirements for criticality safety in the operation of a fuel fabrication facility are established in paras 9.86 (enriched uranium) and 9.87 (mixed oxide) of SSR‑4 [2]. |
| Performing and documenting the criticality safety analyses |
5.13. |
Fuel fabrication facilities process powders, solutions, gases and solids of uranium and/or plutonium that might have different content in terms of either fissile material (e.g. in 233U or 235U enrichment) or absorber material (e.g. gadolinium). Such facilities can be characterized by their fissile uranium content (for uranium fuel fabrication) or — for mixed oxide fuel fabrication facilities — by the isotopic composition of the plutonium in the mixture (principally 239Pu, 240Pu and 241Pu), by the fissile fraction of plutonium (i.e. ( 239Pu + 241Pu) / (total Pu) as a measure of plutonium quality), and by the fissile content in the uranium and the mass fraction of PuO2 in the total amount of oxides. |
| Performing and documenting the criticality safety analyses |
5.14. |
A typical control parameter used in fuel fabrication is moderation. Where moderator control is employed, the following should be considered in the criticality safety assessment: Buildings containing fissile material should be protected from inundations of water from internal sources (e.g. from firefighting systems, leaks or failure of pipework) or ingress of water from external sources (e.g. rainfall, flooding).
To prevent water leakage into fissile material, or fissile material leakage into water, and unexpected changes in conditions of criticality safety control, water should be avoided as the heating and cooling medium in facilities for fissile material storage or processing. If this is not practicable, measures to limit the amount of water that can leak should be considered.
For firefighting, procedures should be provided to ensure the safe use of fire extinguishing media (e.g. control of materials and densities of materials to be used, such as water, foam, dry powders and sand). Combustible materials should be minimized in moderator controlled areas to reduce the likelihood of introducing moderating materials as a result of firefighting. Moderator control requirements should be specified in firefighting procedures. See also para. 6.146(c) of SSR‑4 [2].
The storage of fissile material should be designed to prevent its inadvertent rearrangement in events such as firefighting with high pressure water jets.
Powders might absorb moisture. The maximum powder moisture content that could be reached from contact with humid air should be taken into account in the criticality safety analysis. If necessary, inert and dry glovebox atmospheres should be maintained to ensure the criticality safety of packaged powders. Furthermore, hydrogenated materials (e.g. additives in the manufacture of pellets) should be applied, with safety factors consistent with the double contingency principle. Criticality safety analyses for these types of material can be difficult to perform because of the limited number of experimental benchmarks that can be used in validating computer codes. Consequently, care should be taken in the extrapolation of available benchmark data for these types of material (see also para. 4.27).
The introduction and removal of moderating material under operational states and credible abnormal conditions (e.g. equipment or cleaning material within moderator controlled areas, such as in gloveboxes, packaging areas or criticality controlled areas) should be monitored (e.g. by weighing moderating material) and controlled to avoid unsafe accumulations of moderated fissile material.
The properties of all existing materials that could impact moderator content (e.g. hydric, hygroscopic, adsorptive, absorptive and radiolytic properties) should be assessed.
The spatial distribution of moderators within fissile material units should be considered, along with the potential for non‑uniform distribution due to chemical, thermal or mechanical (e.g. mixing) processes.
The tolerance to changes in the physical and chemical properties of moderators should be assessed.
The integrity of containers used to store and transfer moderating materials in moderator controlled areas should be assessed.
Moderating material that might be encountered during maintenance, decontamination, construction and other activities should be taken into consideration.
|
| Performing and documenting the criticality safety analyses |
5.15. |
Buildings and equipment (e.g. gloveboxes) should be designed to ensure the safe retention of fissile material in the event of a credible earthquake or other external event. Similarly, multiple separated systems relying on distance or neutron absorbers should be suitably fixed in place to ensure that an appropriate separation is maintained and to ensure the integrity of the neutron shielding. |
| Performing and documenting the criticality safety analyses |
5.16. |
The generation and collection of waste throughout the fuel fabrication process should be identified and evaluated to ensure that the quantities of fissile nuclides in any waste remain within specified limits. |
| Performing and documenting the criticality safety analyses |
5.17. |
Moderator controlled areas should be clearly identified to personnel. |
| Performing and documenting the criticality safety analyses |
5.18. |
Penetrations into moderator controlled areas should be minimized. Systems that normally contain moderating material, as well as systems that do not normally contain moderating material but which penetrate a moderator controlled area, should be carefully considered. |
| Fissile material cross‑over |
5.19. |
Fuel production operations may be intermittent. To ensure adequate control during and between fuel production campaigns, the parameters that should be monitored include the mass of fissile material in each container, including the identification of the container (e.g. for manipulated powders or pellets) and/or the identification of fuel rods and fuel rod assemblies. These identifications should ensure that the movement and storage of these items is traceable, that unnoticed carryover between batches is prevented, and that the containers and workstations remain subcritical. |
| Machining, grinding and cutting of fissile material |
5.20. |
The different steps in the fuel fabrication process might create accumulations of fissile material that might not be readily visible. In accordance with para. 9.84 of SSR‑4 [2], a surveillance programme is required to be developed and implemented to ensure that uncontrolled accumulations of fissile material are detected and further accumulation is prevented. A method for periodic cleaning and for accounting for and control of fissile material at the facility and at workstations should be defined that allows the identification and recovery of the fissile material. For credible accumulations of fissile material that are not readily visible, a method for estimating and tracking these residues should be developed to ensure that the workstations and ancillary systems remain subcritical. Such methods could involve quantification using spectral measurements, such as gamma spectrometry, or using a structured evaluation that estimates the volume of accumulated fissile material, with account taken of the contents and the densities of the material. These methods should take into account operating experience, both internal and external. Consideration should be given to the possibility of entrainment of fissile material in process equipment or ancillary systems, including ventilation systems, due to the velocity of the transport medium. The need for periodic inspection of equipment in which fissile material could accumulate should be considered. |
| Machining, grinding and cutting of fissile material |
5.21. |
Machining, grinding and cutting of fissile material should ideally be undertaken without the use of coolants. However, it might not be possible to eliminate coolants from the process entirely or to replace them with non‑moderating coolants. The collection of accumulated residues and/or coolant is likely to necessitate control of other parameters, in particular control of favourable geometry. |
| Machining, grinding and cutting of fissile material |
5.22. |
Further recommendations on criticality safety for fuel fabrication facilities are provided in IAEA Safety Standards Series Nos SSG‑6, Safety of Uranium Fuel Fabrication Facilities [22], and SSG‑7, Safety of Uranium and Plutonium Mixed Oxide Fuel Fabrication Facilities [23]. |
| Handling and storage of fresh fuel |
5.23. |
The storage area for fresh fuel should comply with the conditions specified in the criticality safety assessment and should be such that the stored fresh fuel will remain subcritical during operational states and credible abnormal conditions. Engineered and/or administrative measures should be taken to ensure that fuel is handled and stored only in authorized locations to prevent a critical configuration from occurring. It should be verified that the fissile material nuclide composition complies with the criticality limitations of the storage area. |
| Handling and storage of fresh fuel |
5.24. |
For dry storage systems that use fixed solid neutron absorbers, a surveillance programme should be established to ensure that the absorbers have been installed, to monitor their effectiveness and to ensure that they have not become displaced. |
| Handling and storage of fresh fuel |
5.25. |
Drains in dry storage areas for fresh fuel should be kept clear to ensure the efficient removal of any water that might enter, so that such drains cannot constitute a possible cause of flooding. |
| Handling and storage of fresh fuel |
5.26. |
Fire risks in the fuel storage area should be minimized by preventing the accumulation of combustible material in the storage area. Instructions for firefighting and firefighting equipment suitable for use in the event of a fire involving fuel should be readily available and training should be provided. |
| Handling and storage of fresh fuel |
5.27. |
Further recommendations for ensuring criticality safety in the handling of fresh fuel at nuclear power plants and at research reactors are provided in IAEA Safety Standards Series Nos SSG‑73, Core Management and Fuel Handling for Nuclear Power Plants [24], and NS‑G‑4.3, Core Management and Fuel Handling for Research Reactors [25], respectively. |
| Handling and storage of fresh fuel |
5.28. |
Spent fuel operations are generally characterized by a need to handle large throughputs and to retain large inventories of fissile material in the facility. Some of the recommendations provided for spent fuel (i.e. after final removal from the reactor core) may also be applied to any irradiated fuel handled and stored at the reactor site (i.e. before final irradiation in the reactor core). In determining the criticality safety measures, the following should be considered: The overall nuclide composition (including the isotopic composition of specific elements) and the physical and chemical forms of the fissile material will have changed during irradiation in the reactor and subsequent radioactive decay. The effects of these changes on criticality safety (e.g. in terms of potential consequences, subcriticality margins, and emergency preparedness and response) should be considered.
The preferred method of ensuring subcriticality during spent fuel operations should be by means of geometrically favourable configuration of the fuel. Additional means, such as neutron absorbers and/or the use of a burnup credit, could be applied where subcriticality cannot be sufficiently or reliably maintained by means of favourable geometrical configurations alone. The effects of irradiation do not alter the preference for geometrically safe fuel storage.
Spent fuel is highly radioactive and will need to be handled remotely in shielded facilities or shielded packages. This affects the potential consequences of a criticality accident by reducing the direct radiation exposure, although the energy release might increase the amount of contamination.
Spent fuel will need cooling (e.g. in spent fuel pools) for several years following its removal from the reactor. The rate of change in fuel composition can be significant during this cooling period, and the subcriticality margin is affected by such composition change.
The fuel assemblies will have undergone physical changes during irradiation.
The most reactive composition and geometry of irradiated fuel inside the reactor core is often not the most reactive composition and geometry of fuel in operations outside the reactor core. The radioactive decay after irradiation could lead to a significant increase of keff compared with the keff derived from the nuclide composition at the end of the irradiation.
|
| Events during the handling of spent fuel |
5.29. |
The need for remote handling and the presence of heavy shielding for radiation protection necessitates consideration of a set of credible abnormal conditions in which there is a potential for damage to fuel assemblies (e.g. leading to a loss of geometry control) or damage to other structures (e.g. leading to a loss of fixed absorbers). The safety measures associated with such conditions include the robust design of supporting structures, engineered and/or administrative limits on the range of movement of fuel assemblies and objects in the vicinity of fuel assemblies, and regular testing and maintenance of handling equipment. Further recommendations on handling equipment are provided in IAEA Safety Standards Series No. SSG‑15 (Rev. 1), Storage of Spent Nuclear Fuel [26]. |
| Events during the handling of spent fuel |
5.30. |
Events during the handling of spent fuel might not lead directly to criticality; however, the potential for criticality in subsequent operations (e.g. transfer from a dry environment to a well moderated environment) should be considered. Arrangements should be made to check for and document any potential damage (e.g. to fissile material or absorber materials), for example before transfer from dry to wet handling of the spent fuel. |
| Maintaining spent fuel geometry |
5.31. |
Wherever it is necessary to maintain the geometry of irradiated fuel during storage and handling operations, criticality safety should be assessed for operational states and for credible abnormal conditions. This includes the handling and storage of any degraded fuel (e.g. fuel with failed cladding) that has been stored in canisters. Water retention (even temporary) within these canisters after their removal from water should be considered. The potential for dispersion of fuel due to degradation of fuel cladding, or due to failures of fuel cladding or fuel assembly structures, should be included in the criticality safety assessment. Control over fuel geometry might also be affected by corrosion of structural materials or by embrittlement and creep of the fuel as a result of irradiation, and the potential for these effects should also be assessed. In some operations — for example, in a dry environment — the geometry is not essential for ensuring subcriticality. |
| Maintaining spent fuel geometry |
5.32. |
For stored fuel there is sometimes a need to remove or repair fuel rods, which can change the moderation ratio of the fuel assembly and thus potentially increase its keff neutron multiplication factor value. Criticality safety assessments should be performed to consider the impact of such operations. |
| Loss of soluble or fixed absorbers |
5.33. |
In some storage pools for spent fuel, one possible criticality safety measure is the inclusion of a soluble neutron absorber (e.g. boron) in the storage pool water. In this case, the potential for accidental dilution of the soluble neutron absorber by unplanned additions of water not containing absorbers (or with a lower concentration of absorbers) should be considered in the criticality safety assessment. |
| Loss of soluble or fixed absorbers |
5.34. |
Fixed absorber materials used in spent fuel pools should be designed so that high radiation levels do not lead to detrimental changes in their physical and chemical forms. In existing facilities where ageing of neutron absorbers has already occurred, the provision of solid neutron absorbers for certain credible abnormal conditions, such as a drop of a fuel assembly, should be given only limited credit. In accordance with Requirement 32 of SSR‑4 [2], the ageing degradation of neutron absorbers throughout the lifetime of the facility should be considered, to ensure that their physical integrity remains consistent with the assumptions used in the safety analysis. |
| Loss of soluble or fixed absorbers |
5.35. |
The potential for degradation of criticality safety measures involving soluble or fixed absorbers should be considered in the criticality safety assessment. Safety measures associated with events of this type include restrictions on the volume of available water that could cause accidental dilution, periodic sampling and measurement of levels of soluble neutron absorbers, and periodic inspection and/or surveillance of fixed absorber materials. Sampling of soluble boron in the pool water should be performed in such a manner as to verify that the level of boron is homogeneous across the pool. Where soluble boron is used as a criticality safety measure, operational controls should be implemented to maintain water conditions in accordance with specified values of temperature, pH, redox, activity and other applicable chemical and physical characteristics, so as to prevent boron dilution. Additionally, appropriate measures to ensure boron mixing by, for example, thermal convection caused by decay heat in the storage pool should be taken into account. Where boron solutions are stored outdoors in a cold climate, the potential for boron separation due to freezing and thawing should be considered. |
| Changes in storage arrangements within a spent fuel facility |
5.36. |
Spent fuel is often stored in pool facilities for several years following its removal from the reactor core. During that time, changes may need to be made to the storage configuration. For example, in some nuclear power plants it has been found necessary to reposition the spent fuel in the storage pool (i.e. to ‘re‑rack’ the spent fuel pool) to increase the storage capacity. Increasing the density of fuel storage might have significant effects on the level of neutron absorption necessary to ensure subcriticality. A reduction in the amount of interstitial water between spent fuel assemblies in a storage rack might also cause a reduction in the effectiveness of fixed absorbers (see Ref. [13]). These effects should be taken into account in the criticality safety assessment for such changes. |
| Changes in storage arrangements within a spent fuel facility |
5.37. |
Consideration should also be given to the potential for changes in the storage arrangement due to credible abnormal conditions involving fuel movements or heavy equipment movements (e.g. a container being dropped onto the storage configuration). |
| Misloading events involving spent fuel |
5.38. |
Some storage facilities accept spent fuel from a range of reactor sites. To accommodate the different types of fuel, the facility is usually divided into areas with distinct design features and different degrees of criticality safety measures. In these situations, the potential for misloading of spent fuel into the wrong storage location should be considered in the criticality safety assessment. |
| Misloading events involving spent fuel |
5.39. |
The safety measures to prevent misloading events should include engineered features to preclude misloading (e.g. misloading that might occur because of the physical differences in fuel assembly design), and administrative controls and verification of the fuel assembly markings. |
| Taking account of changes in spent fuel composition as a result of irradiation |
5.40. |
In some criticality safety assessments for operations involving fuel that is (or will be) irradiated, the spent fuel has been conservatively assumed to have the composition with the maximum keff (sometimes called the ‘peak reactivity’). For many types of fuel, the peak reactivity is achieved by fresh fuel. For other types of fuel, there is a peak in reactivity at a higher irradiation level (burnup) for at least two reasons, as follows: The buildup of new fissile nuclides from fertile nuclides is more significant than the depletion of the initial fissile nuclides.
The effect of the depletion of integral burnable absorber nuclides (usually gadolinium isotopes) within the fuel composition is stronger than the effect of the depletion of fissile nuclides, leading to a net increase in keff. Taking account of the burnable absorber is referred to as ‘burnable absorber credit’ (or ‘gadolinium credit’ when that absorber is involved).
|
| Taking account of changes in spent fuel composition as a result of irradiation |
5.41. |
The maximum keff due to irradiation should be taken into account, except in either of the following cases: The fuel can be demonstrated as not being irradiated.
It can be sufficiently demonstrated that the fuel has reached a minimum irradiation level (burnup) and that the effects of this burnup can be safely accounted for, taking credit for reductions in keff as a result of changes in the spent fuel composition due to irradiation. This more realistic approach is commonly known as ‘burnup credit’ (see paras 5.45–5.48).
|
| Taking account of changes in spent fuel composition as a result of irradiation |
5.42. |
Taking credit for burnable absorbers in fuel that may be irradiated does not involve verification of the burnup but does involve verification of fuel designs and initial enrichment. |
| Burnup credit |
5.43. |
The changes in the composition of fuel during irradiation will eventually result in a reduction in keff. The application of burnup credit in the criticality safety assessment may present several advantages, as follows: Increased flexibility of operations (e.g. acceptance of a wider range of spent fuel types);
Verified properties of the sufficiently irradiated fuel, possibly resulting in an inherently subcritical material;
Increased loading densities in spent fuel storage areas;
Larger capacity transport packages.
|
| Burnup credit |
5.44. |
Paragraph 6.148 of SSR‑4 [2] states that “If the design of the facility takes into account burnup credit, its use shall be appropriately justified in the criticality safety analysis.” |
| Burnup credit |
5.45. |
The application of burnup credit might significantly increase the complexity, uncertainty and difficulty in demonstrating an adequate margin of subcriticality. The criticality safety assessment and supporting analysis should reliably determine a maximum value of keff for the system by taking into account the changes to the fuel composition during irradiation and changes due to radioactive decay after irradiation. Spatial variations in the spent fuel composition should be taken into account in calculating keff for the relevant configuration of the spent fuel. The increase in complexity presents several challenges for the criticality safety assessment. In a criticality safety assessment performed on the basis of burnup credit, the following should be addressed: Validation of the calculation methods used to predict the spent fuel composition (see paras 4.22–4.29).
Validation of the calculation methods used to predict keff for the spent fuel configurations (see paras 4.22–4.29). Calculations for burnup credit in spent fuel include many more nuclides than are present for fresh fuel calculations; consequently, additional uncertainties in nuclear data and the conservatism applied should be justified.
Specification and demonstration of a suitably conservative representation of the irradiation conditions, for example the amount of burnup, the presence of soluble absorbers, the presence of burnable absorbers, coolant temperature and density, fuel temperature, power history, and cooling time.
Justification for any modelling assumptions, for example the representation of smoothly varying changes in composition (i.e. as a result of radial and axial variations in burnup) as discrete zones of materials in the calculation model.
Justification for the inclusion or exclusion of specific nuclides such as fission products, of the in‑growth of fissile nuclides and of the loss of neutron absorbers.
|
| Burnup credit |
5.46. |
In general, the operational limits and conditions for ensuring subcriticality in spent fuel storage on the basis of an assessment of burnup credit involve a conservative combination of the initial enrichment of the fuel and the accumulated burnup (in which credible fuel history variations are taken into account) for each fuel type. This approach is commonly known as the ‘safe loading curve’ approach (see SSG‑15 (Rev. 1) [26]). In such circumstances, the criticality safety assessment should determine the operational measures necessary to ensure compliance with this curve during operation, for example the measurements that are necessary to verify the initial enrichment and burnup. |
| Burnup credit |
5.47. |
If burnup credit is not applied, there might be a large number of different fuel designs that necessitate individual administrative controls. For cases in which credit is taken for the burnup of individual fuel assemblies, sequences involving fuel misloading should be specifically considered at reactor sites where fuel at different burnup levels, including fresh fuel, is handled. Screening of received fuel assemblies can reduce the potential for misloading events where burnup credit is applied (a very small fraction of fuel assemblies are typically outside the allowable range and can be accounted for individually by special measures). Protection against misloading events, as described in paras 5.38 and 5.39, should form one of the key considerations in the criticality safety assessment for spent fuel operations. |
| Burnup credit |
5.48. |
Further information and guidance on the application of burnup credit are available in Ref. [27]. |
| Burnup credit |
5.49. |
Reprocessing facilities recover the uranium and plutonium from spent fuel by removing waste products (e.g. cladding, fission products, minor actinides) from the fuel after it has been irradiated. Reprocessing operations can also include the treatment of fresh fuel, fertile material or low burnup fuel. Specific consideration should be given to the dissolution phase, since fresh fuel or low burnup fuel can be more difficult to dissolve than spent fuel. In addition, uranium and plutonium mixed oxide fuels tend to be more difficult to dissolve than uranium dioxide fuels, and thorium bearing fuels exhibit complicated dissolution behaviour. |
| Burnup credit |
5.50. |
Specific requirements for criticality safety in the design of facilities handling mixed uranium and plutonium liquids are established in para. 6.153 of SSR‑4 [2], and specific requirements for the operation of fuel reprocessing facilities are established in para. 9.89 of SSR‑4 [2]. |
| Burnup credit |
5.51. |
The following issues are of particular importance and should be considered for criticality safety in reprocessing facilities: The wide range of forms of fissile material involved in reprocessing, potentially making the use of multiple control parameters necessary.
Variations in neutron fluxes and spectra caused by actinides other than uranium and plutonium.
The mobility of solutions containing fissile nuclides and the potential for their misdirection.
The need for chemistry control to prevent the following:
Precipitation, colloid formation and increases of concentration in solution;
Unplanned separation and extraction of fissile nuclides.
The possibility of holdup and accumulations of fissile material owing to incomplete dissolution of materials, accumulation of fissile material in process equipment (e.g. conditioning and vacuum vessels) or ventilation systems, or chronic leaks (including leaks of highly active liquors onto hot surfaces).
The need for moderator control during furnace operations causing condensation in powders.
Difficulties in monitoring the continuous processes in operations with high radiation levels.
Precipitation, colloid formation and increases of concentration in solution;
Unplanned separation and extraction of fissile nuclides.
|
| The wide range of forms of fissile material in fuel reprocessing facilities |
5.52. |
Criticality safety considerations for reprocessing facilities should include the following forms of fissile material, as applicable: Fuel assemblies;
Fuel rods;
Sheared fuel;
Fines or swarf;
Solutions of uranium and/or plutonium;
Oxides of uranium or plutonium, or mixed oxides of uranium and plutonium;
Plutonium oxalate or mixed uranium oxalate and plutonium oxalate;
Uranium or plutonium metals;
Other compositions (e.g. materials containing minor actinides).
|
| Mobility of solutions and the potential for their misdirection in fuel reprocessing facilities |
5.53. |
Many fissile materials are in a liquid form and, because there are many connections between items of equipment, the possibility of misdirection of the fissile material should be considered in the criticality safety assessment. Misdirection of fissile material can lead to uncontrolled chemical phenomena (e.g. concentration or precipitation of plutonium, dilution of neutron absorbers in solution) or to presence of fissile material in systems with unfavourable geometry. The potential for misdirection is required to be taken into account in the criticality safety assessment (see para. 6.146(a) of SSR‑4 [2]). The criticality safety assessment should identify the safety measures necessary to avoid misdirection, for example the use of overflow lines and siphon breaks. |
| Mobility of solutions and the potential for their misdirection in fuel reprocessing facilities |
5.54. |
The criticality safety assessment should give particular consideration to the impact of interruptions to normal operations (e.g. owing to corrective maintenance work) that have the potential to create unplanned changes to the flow of fissile material. The possibility that external connections could be added in an unsystematic manner to approved pipework and vessels should also be considered. |
| Mobility of solutions and the potential for their misdirection in fuel reprocessing facilities |
5.55. |
Operational experience has shown that misdirection of fissile material can occur owing to unexpected pressure differentials in the system (e.g. due to sparging operations during cleanup). The criticality safety assessment should include consideration of these effects. |
| Mobility of solutions and the potential for their misdirection in fuel reprocessing facilities |
5.56. |
In any facility employing chemical processes, leaks are a constant hazard. Leaks might occur as a result of faulty welds, joints or seals. Ageing of the facility might also contribute to leaks through corrosion, vibration and erosion effects. Leaks and the effects of corrosion, erosion and vibration are required to be taken into account in the criticality safety assessment (see para. 6.146(b) and (d) of SSR‑4 [2]). In general, drains, drip trays, recovery pans and vessels of favourable geometry should be provided to ensure that any fissile material that could leak will be safely contained. Consideration should also be given to the provision of monitored sumps of favourable geometry for the detection of leaks. It should not be assumed that leaks will be detected in sumps, as such leaks might evaporate and form solid accumulations over time. Consideration should be given to performing inspections to prevent any long term buildup of fissile material, especially in areas where personnel are not present (see Ref. [28]). |
| Maintaining chemistry control in fuel reprocessing facilities |
5.57. |
Particular consideration should be given to chemistry control during reprocessing. Some of the most important process parameters that could affect the criticality safety measures include acidity, concentration, density, purity of additives, temperature, contact area (i.e. during mixing of materials), flow rates and quantities of reagents. Loss of control of any of these process parameters could lead to a range of unfavourable changes, such as the following: Increased concentration of fissile nuclides (e.g. by precipitation, colloid formation or extraction);
Unplanned separation of plutonium and uranium;
Carryover of uranium and plutonium into the raffinate stream;
Incomplete dissolution of fissile material.
|
| Maintaining chemistry control in fuel reprocessing facilities |
5.58. |
The potential for the changes described in para. 5.57 to affect criticality safety should be considered in the criticality safety assessment. The selection of suitable safety measures will vary depending on the details of the process and include the following: Monitoring of the concentration of fissile nuclides (e.g. in‑line neutron monitoring, chemical sampling);
Monitoring of flow rates and temperatures;
Testing of acidity and quality control of additives.
|
| Maintaining chemistry control in fuel reprocessing facilities |
5.59. |
The effectiveness and reliability of the safety measures that are applied should be considered as part of the criticality safety assessment. The reference flowsheet required by para. 6.153 of SSR‑4 [2] helps in determining the response and sensitivity of the facility to changes in the process parameters, control parameters and safety parameters. This information should be used to ensure that the safety measures applied are able to respond quickly enough to detect, correct or terminate unsafe conditions and prevent a criticality accident. Time lags in process control should be considered in maintaining chemistry control. |
| Maintaining chemistry control in fuel reprocessing facilities |
5.60. |
Particular consideration should be given to the control of restart operations following interruptions to normal operation. Some changes in chemical characteristics might occur during any period of shutdown (e.g. changes in the valence state of plutonium leading to a reduction in acidity, which could result in formation of colloids), and these effects should be accounted for in safely re‑establishing normal operation. |
| Holdup and accumulation of fissile material in fuel reprocessing facilities |
5.61. |
Paragraph 9.84 of SSR‑4 [2] states: |
| Holdup and accumulation of fissile material in fuel reprocessing facilities |
5.62. |
The start of the reprocessing operation usually involves mechanical operations, such as shearing and/or sawing of the fuel to facilitate its dissolution. Such operations are usually conducted in a dry environment. Particular consideration should be given to the possibility of accumulations of fissile nuclides in swarf, fines and other debris becoming moderated through entrainment during subsequent parts of the process that have wet chemistry conditions. For this reason, regular inspections and housekeeping should be performed as part of the surveillance programme. (See also paras 3.21 and 3.22.) |
| Holdup and accumulation of fissile material in fuel reprocessing facilities |
5.63. |
The next process by which accumulation could occur is dissolution. Incomplete dissolution might occur as a result of a range of credible abnormal conditions, for example low acidity, low temperature, short dissolution time, overloading of fuel, and low acid volume. The following criticality safety measures should be considered: Pre‑dissolution control of the conditioning of acids;
Monitoring of temperature and dissolution time;
Post‑dissolution monitoring for gamma radiation (e.g. to detect residual undissolved fuel in hulls);
Controls on material balance;
Density measurements.
|
| Holdup and accumulation of fissile material in fuel reprocessing facilities |
5.64. |
The effectiveness, reliability and accuracy of the safety measures described in para. 5.63 should be considered as part of the criticality safety assessment. In particular, the possibility that sampling might not be representative should be considered. Similarly, the potential for settling of fine particles of fissile material in the bottom of vessels throughout subsequent processes should also be considered. In these cases, neutron monitoring of the lower parts of vessels and periodic emptying and flushing of vessels should be considered. |
| Holdup and accumulation of fissile material in fuel reprocessing facilities |
5.65. |
The potential for fissile nuclides to remain attached to cladding following dissolution should be considered. For example, in some cases residual plutonium can bond to the inside surface of cladding as a result of polymerization. |
| Holdup and accumulation of fissile material in fuel reprocessing facilities |
5.66. |
Recommendations on trapping and monitoring leaks in equipment are provided in para. 5.56. However, it is possible that very slow leaks or leaks onto hot surfaces (i.e. where the material crystallizes before reaching the measuring point) might occur. Such losses of material can be very difficult to detect. Safety measures for such leaks should include periodic inspections of the areas below vessels and pipework and the review of operational records to identify any chronic loss of fissile material. The criticality safety assessment should consider the timescales over which unsafe accumulations of fissile material could occur so that suitable inspection frequencies can be determined. |
| Moderator control in furnace operations in fuel reprocessing facilities |
5.67. |
For most furnace operations that are part of the conversion process (e.g. precipitation, drying, oxidation), the use of vessels with favourable geometry should be considered. It may also be practicable to ensure that the internal volume of the furnace has a favourable geometry. However, the oxide powders produced in subsequent operations may need moderation control to enable feasible storage arrangements. The conversion process should be designed such that it does not lead to the production of material with excessive moderator content. The criticality safety assessment should therefore consider mechanisms by which the moderator might be carried over (e.g. incomplete drying) or introduced (e.g. condensation during cooling). |
| Moderator control in furnace operations in fuel reprocessing facilities |
5.68. |
Further recommendations on criticality safety in reprocessing facilities are provided in IAEA Safety Standards Series No. SSG‑42, Safety of Nuclear Fuel Reprocessing Facilities [29]. |
| Moderator control in furnace operations in fuel reprocessing facilities |
5.69. |
Waste management operations cover a wide range of facilities, processes and materials. The recommendations in paras 5.70–5.77 apply to packaging, storage and disposal operations involving fissile material. The recommendations are also intended to apply to legacy waste. Waste management operations, particularly in a disposal facility, may involve large inventories of fissile material from a wide range of sources. In the case of legacy waste, there might also be considerable variation in and uncertainty about the waste properties (e.g. the physical form and chemical composition of the non‑fissile and fissile components of the waste). In contrast, decommissioning operations typically involve small inventories of fissile material. |
| Moderator control in furnace operations in fuel reprocessing facilities |
5.70. |
In the criticality safety assessment, the collection and storage of radioactive waste before it is processed should be subject to the same considerations as the processes from which the waste was generated (see also paras 9.84 and 9.85 of SSR‑4 [2]). Additionally, special considerations may be necessary if such waste streams are mixed with other radioactive waste streams of different origin or if the waste is compacted. Even if the individual inventories of fissile material before processing are generally small, significant accumulations of such material might occur in the subsequent waste collection and waste processing steps. |
| Moderator control in furnace operations in fuel reprocessing facilities |
5.71. |
Waste is commonly wrapped in materials that are more effective moderators than water (e.g. polyethylene), and this should be taken into account in the criticality safety assessment. |
| Moderator control in furnace operations in fuel reprocessing facilities |
5.72. |
Criticality safety for waste operations should be determined on the basis of the application of appropriate limits on the waste package contents. Criticality safety measures include the design of the packages (see para. 9.85(c) of SSR‑4 [2]) and the arrangements for handling, storage and disposal of packages within a facility. Where practicable, package limits should be applicable to all operations within the waste management chain, including operations at the subsequent disposal facility, so that subsequent repacking, with its associated hazards, is avoided. The transport of waste packages (see paras 5.81–5.86) should also be considered, so as to avoid the need to repackage the waste to ensure compliance with the criticality safety requirements established in SSR‑6 (Rev. 1) [3]. |
| Moderator control in furnace operations in fuel reprocessing facilities |
5.73. |
For the storage of waste containing fissile nuclides, consideration should be given to potential changes in the configuration of the waste, the introduction of a moderator or the removal of material (e.g. neutron absorbers) as a consequence of a credible internal or external event (e.g. movement of the waste, precipitation of solid phases from liquid waste, loss of confinement of the waste, a seismic event). Further recommendations are provided in IAEA Safety Standards Series No. WS‑G‑6.1, Storage of Radioactive Waste [30]. When it is necessary to prevent the settling of fissile material to maintain a subcritical configuration, the method used should be passive. Such situations can arise in long term storage or, for example, during the separation of fissile solids from aqueous mixtures. |
| Moderator control in furnace operations in fuel reprocessing facilities |
5.74. |
The assessment of criticality safety for the period after the closure of a disposal facility presents particular challenges. These challenges include the need to consider the effects of geochemical and geophysical processes on the disposal facility over very long timescales. Following the closure of a disposal facility, engineered barriers provided by the package design and the form of the waste will tend to degrade, allowing the possibility of separation, relocation and accumulation of fissile nuclides, as well as the possible removal of absorbers from fissile material. In addition, a previously dry environment might be replaced by a water saturated environment. Consideration of the consequences of criticality after closure of a disposal facility will differ from that for, for example, fuel stores or reprocessing plants, where a criticality accident might have immediate recognizable effects. In the case of a disposal facility, disruption of protective barriers and effects on the transport mechanisms of radionuclides are likely to be more significant than the effects of direct radiation from a criticality event, because the radiation produced by such an event would be shielded by the surrounding host rock formation and/or backfill materials. |
| Moderator control in furnace operations in fuel reprocessing facilities |
5.75. |
In the criticality safety assessment of waste management operations, consideration should be given to the following:The nuclear, radiological, physical and chemical properties of the waste;
Variation and uncertainty in the form and composition of the waste (see para. 5.76);
The need to address the degradation of engineered barriers and the evolution of waste packages after emplacement over long timescales (see para. 5.77);
Criticality safety requirements and other requirements to facilitate future transport of the waste (see paras 5.81–5.86).
|
| Variation and uncertainty in waste forms |
5.76. |
Variation and uncertainty in waste forms is a particular challenge for some types of legacy waste for which the accuracy and completeness of historical records might be limited. Therefore, criticality safety assessments for legacy waste to be disposed of should be performed in a comprehensive and detailed manner. If conservative deterministic methods are applied, in which bounding values are applied to each material parameter, the resulting limits on packages might prove to be very restrictive. This might then lead to an increase in the number of packages produced, resulting in more package handling, more packages being transported and greater storage volumes, each of which is associated with a degree of additional risk (e.g. due to occupational exposures, road or rail accidents, or construction accidents). Consequently, particular consideration should be given to optimization of the margins to be used in the criticality safety assessment. If an integrated risk approach is used, consideration should be given to the balance of risk between the criticality hazard and other hazards. |
| Degradation of engineered barriers over long timescales |
5.77. |
With regard to the disposal of spent fuel, the fissile inventory mainly consists of any remaining 233U and/or 235U and the plutonium isotopes 239Pu and 241Pu. Over the long timescales considered in post‑closure criticality safety assessments, some reduction of and change in the fissile inventory of the nuclear waste will occur owing to radioactive decay. The criticality safety assessments should also take into account credible degradation of the engineered barriers of waste packages, with consequential relocation and accumulation of fissile and non‑fissile components. |
| Degradation of engineered barriers over long timescales |
5.78. |
In the assessment of criticality safety for decommissioning, a graded approach should be applied that takes into account the type of facility and the fissile inventory present. Recommendations on the decommissioning of nuclear fuel cycle facilities are provided in IAEA Safety Standards Series No. SSG‑47, Decommissioning of Nuclear Power Plants, Research Reactors and Other Nuclear Fuel Cycle Facilities [31]. |
| Degradation of engineered barriers over long timescales |
5.79. |
Before beginning decommissioning, any accumulations of fissile material should be identified to assess the possibilities for recovery of this material. Consideration should be given to the potential for unaccounted accumulations of fissile material (e.g. active lathe sumps). A method for estimating and tracking accumulations of fissile material that are not readily visible should be developed to ensure that workstations remain subcritical during decommissioning operations (see also para. 9.84 of SSR‑4 [2]). This method should take into account operating experience, any earlier interventions to remove fissile material, and any records of physical inventory differences, process losses and/or measured holdup. The estimation of such accumulations of fissile material could be made on the basis of measurements (e.g. gamma spectrometry) or by a structured evaluation of the volume of material, with account taken of the contents and densities of the material. |
| Degradation of engineered barriers over long timescales |
5.80. |
The approach used to ensure subcriticality in decommissioning may be similar to that used for research laboratory facilities (see paras 5.87–5.95), where setting a low limit on allowable masses of fissile material provides the basis for allowing other parameters (e.g. geometry, concentration, moderation, absorbers) to take any value. In accordance with para. 7.4 of GSR Part 6 [7], an initial decommissioning plan for a facility is required to be developed and submitted to the regulatory body, together with the application for authorization to operate the facility. This initial decommissioning plan is required to be maintained and updated during facility operation, in accordance with Requirement 10 of GSR Part 6 [7]. When a facility approaches its permanent shutdown, a final decommissioning plan is required to be prepared (see Requirement 11 of GSR Part 6 [7]). In facilities handling significant amounts of fissile material, all decommissioning plans should be supported by criticality safety assessments to ensure that activities performed during the operation of the facility do not create avoidable problems later in decommissioning. |
| Degradation of engineered barriers over long timescales |
5.81. |
Requirements for the safe transport of radioactive material, including consideration of the criticality hazard, are established in SSR‑6 (Rev. 1) [3]. Recommendations to support these requirements are provided in SSG‑26 (Rev. 1) [10], TS‑G‑1.4 [19], and IAEA Safety Standards Series No. TS‑G‑1.5, Compliance Assurance for the Safe Transport of Radioactive Material [32]. |
| Degradation of engineered barriers over long timescales |
5.82. |
The requirements established in SSR‑6 (Rev. 1) [3] provide a prescriptive system for package subcriticality design assessment; however, engineering judgement is still needed, especially for estimating the potential behaviour of a package under accident conditions of transport, for which considerable engineering expertise is necessary. Consequently, this assessment should only be performed by persons with suitable knowledge and experience. |
| Degradation of engineered barriers over long timescales |
5.83. |
The assessment of subcriticality referred to in para. 5.82 provides a basis for the package design. A criticality safety assessment for the transport of such packagesisrequired in accordance with para.673 of SSR‑6 (Rev.1)[3], which states: Maintain subcriticality during routine, normal and accident conditions of transport; in particular, the following contingencies shall be considered:
Leakage of water into or out of packages;
Loss of efficiency of built‑in neutron absorbers or moderators;
Rearrangement of the contents either within the package or as a result of loss from the package;
Reduction of spaces within or between packages;
Packages becoming immersed in water or buried in snow;
Temperature changes.”
Leakage of water into or out of packages;
Loss of efficiency of built‑in neutron absorbers or moderators;
Rearrangement of the contents either within the package or as a result of loss from the package;
Reduction of spaces within or between packages;
Packages becoming immersed in water or buried in snow;
Temperature changes.”
|
| Degradation of engineered barriers over long timescales |
5.84. |
The state of a transport package before, during and after the tests specified in SSR‑6 (Rev. 1) [3] (e.g. water spray and immersion, drop and thermal tests), as determined by any of the methods listed in para. 701 of SSR‑6 (Rev. 1) [3], can provide confirmation of the assumptions made for the criticality assessment and analysis of the design. Since the tests should verify the assumptions used in the criticality safety analysis, many tests need to be considered to cover each scenario (e.g. an individual package and a package in an array configuration). |
| Degradation of engineered barriers over long timescales |
5.85. |
If the criticality safety assessment of a transport package identifies that the package complies with a package design approved for off‑site transport in accordance with the requirements of SSR‑6 (Rev. 1) [3], this approval may be relied on for use of the package within the facility. In such a case, it should be demonstrated that all operational states and credible abnormal conditions in a facility are bound by the existing transport package design safety assessment. In addition, the package should be in the same configuration as during off‑site transport (e.g. equipped with its shock absorbers). |
| Degradation of engineered barriers over long timescales |
5.86. |
The following should be considered with regard to the on‑site movement of fissile material: Measures to ensure that packages of fissile material remain reliably fixed to vehicles;
Vehicle speeds and road conditions;
The potential for on‑site movement accidents (e.g. collisions with other vehicles);
The potential for and consequences of a release of fissile material out of the package (e.g. into storm drains);
Interactions with other fissile material during on‑site movement.
|
| Degradation of engineered barriers over long timescales |
5.87. |
Some research and development laboratories handle fissile material in sufficient quantities that there is a potential for criticality. These facilities are generally characterized by the need for high flexibility in their operations and processes but typically have low inventories of fissile material and can include direct handling and/or remote handling operations. The general assumption that there is only a small inventory of fissile material might not be applicable for laboratories that are used for fuel examinations or experiments, or their respective waste treatment facilities. |
| Degradation of engineered barriers over long timescales |
5.88. |
Requirements for the design of facilities that handle mixtures of powders or liquids containing fissile material — as might be the case in research and development laboratories — are established in paras 6.154–6.156 of SSR‑4 [2]. |
| The range of fissile and non‑fissile materials in research and development laboratories |
5.89. |
Research and development laboratories can use a wide range of fissile and non‑fissile materials and separated elements and nuclides, typically including low, intermediate and high enriched uranium; plutonium that is high in 241Pu content (e.g. >15 wt%); plutonium that is low in 240Pu content (e.g. <5 wt%); graphite; boron; gadolinium; hafnium; heavy water; zirconium; pore former; aluminium; and various metal alloys. Examples of special fissionable (including fissile) and non‑fissionable nuclides sometimes encountered include 233U, 237Np, 242Pu, 241Am, 242mAm, enriched boron (e.g. 10B) and enriched lithium (e.g. 6 Li). These nuclides have diverse energy dependent nuclear reaction properties (e.g. neutron fission, neutron absorption, neutron scattering, gamma neutron reaction and gamma fission properties), which can result in non‑linear and seemingly incongruent variations of critical mass. |
| The range of fissile and non‑fissile materials in research and development laboratories |
5.90. |
Materials containing significant quantities and concentrations of the nuclides referred to in para. 5.89 should receive specific consideration in the criticality safety assessments and analyses. Useful references for determining the properties of some of these nuclides include Refs [33, 34]. Particular challenges are encountered in determining the critical mass of unusual materials that contain significant fractions of special nuclides (e.g. 243Cm, 245Cm), because often there are few criticality experiment benchmarks with which keff computations with these nuclides and materials can be validated. |
| Overlap of criticality controlled areas and interfaces between materials in research and development laboratories |
5.91. |
Owing to the significant flexibility in operations, criticality safety measures applied to the location and movement of fissile material within laboratories are important in ensuring subcriticality. The criticality safety assessment should define criticality controlled areas and should specify their boundaries and the maximum content of fissile material, and any other associated limits and conditions. |
| Overlap of criticality controlled areas and interfaces between materials in research and development laboratories |
5.92. |
Particular consideration should be given to the potential for any overlap of criticality controlled areas and any interfaces between materials in such overlaps. The management system (see paras 2.17–2.40) should ensure that the combining of material from different criticality controlled areas and the movement of moderators into a criticality controlled area are restricted and that any such combining or movement is subject to a criticality safety assessment before it is performed. |
| Inadvertent consolidation of fissile material in research and development laboratories |
5.93. |
Frequently, activities in a specific laboratory area might be interrupted to perform a different operation. In such cases, laboratory personnel should exercise particular care to avoid any inadvertent accumulation of fissile material as a result of housekeeping or consolidation of materials, prior to allowing more fissile and non‑fissile materials into the laboratory area. |
| Specialized education and training of personnel in research and development laboratories |
5.94. |
Because of the diverse characteristics of materials and laboratory operations, laboratory personnel and management should be appropriately educated and be provided with specific training on the characteristics of typical and special fissile material and non‑fissile material under different degrees of neutron moderation. |
| Subcritical assemblies |
5.95. |
Subcritical assemblies are generally used for research and educational purposes. Subcritical assemblies have the potential for criticality accidents; hence, criticality safety measures should be applied. Annex II to IAEA Safety Standards Series No. SSR‑3, Safety of Research Reactors [35], provides an overview of the application of the safety requirements to subcritical assemblies. |
| Subcritical assemblies |
6.1. |
Requirements for preparedness and response to a nuclear or radiological emergency are established in GSR Part 7 [9]. Associated recommendations and guidance are provided in IAEA Safety Standard Series Nos GSG‑2, Criteria for Use in Preparedness and Response for a Nuclear or Radiological Emergency [36]; GS‑G‑2.1, Arrangements for Preparedness for a Nuclear or Radiological Emergency [37]; GSG‑11, Arrangements for the Termination of a Nuclear or Radiological Emergency [38]; and SSG‑65, Preparedness and Response for a Nuclear or Radiological Emergency Involving the Transport of Radioactive Material [39]. |
| Subcritical assemblies |
6.2. |
Priority should always be given to the prevention of criticality accidents; however, there is always a possibility that events might give rise to a criticality accident. Such an accident might result in exposure of persons to direct radiation (neutron and gamma) and/or a release of radioactive material within the facility and/or to the environment, either of which might necessitate emergency response actions. The kinetic energy release from a criticality accident could also result in considerable non‑radiological hazards. |
| Subcritical assemblies |
6.3. |
Requirement 1 of GSR Part 7 [9] states that “The government shall ensure that an integrated and coordinated emergency management system for preparedness and response for a nuclear or radiological emergency is established and maintained.” This management system should also cover criticality accidents, as appropriate. The government is also required to make provisions to ensure that the roles and responsibilities for preparedness and response to such an emergency are clearly assigned (see Requirement 2 of GSR Part 7 [9]). |
| Subcritical assemblies |
6.4. |
In accordance with Requirement 4 of GSR Part 7 [9], the government is required to perform a hazard assessment. This hazard assessment is required to consider criticality accidents, including events of very low probability not considered in the design, and combinations of events and emergencies (see para. 4.20 of GSR Part 7 [9]). |
| Subcritical assemblies |
6.5. |
The development of the protection strategy on the basis of the hazard assessment and potential consequences of an accident, in accordance with Requirement 5 of GSR Part 7 [9], should consider the possible deterministic effects (evaluated on the basis of relative biological effectiveness weighted absorbed dose) as well as the possible stochastic effects (evaluated on the basis of equivalent dose). |
| Subcritical assemblies |
6.6. |
For each facility in which fissile material is handled and for which a criticality detection and alarm system is required (see para. 6.149(a) of SSR‑4 [2]), an emergency plan and emergency procedures and capabilities to respond to foreseeable criticality accidents are also required (see Requirement 72 of SSR‑4 [2]). In some circumstances where a criticality detection and alarm system is not installed (e.g. shielded facilities (see para. 6.36(b))), analyses should still be conducted to determine whether an emergency plan is necessary for the facility. |
| Subcritical assemblies |
6.7. |
In demonstrating the adequacy of the emergency arrangements, the potential occupational exposures and, if relevant, public exposures (see para. 6.150 of SSR‑4 [2]) should be estimated. The analysis of the potential consequences of a criticality accident should consider the criticality events that have occurred at similar facilities elsewhere (see table 1 of GSR Part 7 [9]). |
| Subcritical assemblies |
6.8. |
In accordance with para. 5.17 of GSR Part 7 [9], the government is required to ensure that appropriate arrangements are in place for the following: To promptly recognize and classify an emergency caused by a criticality accident. The operational criteria for classification are required to include emergency action levels and other observable conditions and indicators (see para. 5.16 of GSR Part 7 [9]).
To promptly declare the emergency class and to initiate a coordinated and preplanned on‑site response.
To notify the appropriate notification point and to provide sufficient information for the initiation of an effective, coordinated and preplanned off‑site response, if needed.
|
| Subcritical assemblies |
6.9. |
Arrangements are required to be in place to mitigate the consequences of a criticality accident (see Requirement 8 of GSR Part 7 [9]). Possible approaches include the installation of isolation valves, remote control systems (e.g. for ensuring the availability of neutron absorbers and the means of introducing them into the system where the criticality event has occurred), portable shielding or other means of safely altering the process conditions to achieve a safe state. |
| Subcritical assemblies |
6.10. |
Consideration should be given to limiting or terminating radioactive releases by shutting down facility ventilation systems in the event of a criticality accident. The possibility of an increase in hydrogen gas concentration due to radiolysis if such measures are implemented should also be considered. |
| Subcritical assemblies |
6.11. |
In some accidents, incorrect actions by operating personnel have inadvertently initiated a further criticality event after the initial event. It should be ensured that operating personnel are aware that following the initial fission spike or spikes, the system might return to a state that is very close to critical but with a continuing low fission rate. This typically occurs in systems containing solutions in which inherent negative reactivity feedback effects offset the excess reactivity inserted in the initial stages of the event. In such situations, very small additions of reactivity could be sufficient to initiate further fission spikes. |
| Subcritical assemblies |
6.12. |
The main risk in a criticality accident is to operating personnel in the immediate vicinity of the event. Radiation doses to operating personnel more than a few tens of metres away are not normally sufficient to cause severe deterministic effects; however, these radiation doses can still be significant, and appropriate escape routes and assembly points are required to be provided (see para. 6.149(b) of SSR‑4 [2]). Some types of system, particularly fissile nuclides in solution, can display oscillatory behaviour with multiple bursts of radiation continuing over hours or even days. For this reason, a key element in emergency planning should be to ensure prompt alerting and evacuation of persons to a safe distance. Following this, sufficient information should be gathered to enable a planned re‑entry into the facility (see paras 6.29–6.32). |
| Subcritical assemblies |
6.13. |
The provision of additional shielding should also be considered as a means of minimizing the radiological consequences of a criticality accident. The effects of any penetrations through the shielding should be evaluated. When planning additional shielding for criticality accidents, priority should be given to escape routes for operating personnel. |
| Subcritical assemblies |
6.14. |
Emergency procedures should designate escape routes for persons on the site. These routes should be clearly indicated. Evacuation should follow the quickest and most direct routes practicable, with consideration given to the need to minimize radiation exposure. Any changes to the facility should not impede evacuation or otherwise lengthen evacuation times. The emergency procedures should stress the importance of speedy evacuation. Recommendations for re‑entry to the facility are provided in paras 6.29–6.32. |
| Subcritical assemblies |
6.15. |
Personnel assembly points should be designated outside the areas to be evacuated, with appropriate consideration given to nuclear security (see para. 2.6) and the need to minimize radiation exposures. Means should be provided for confirming that all personnel have been evacuated from the area in which the criticality event has occurred. |
| Subcritical assemblies |
6.16. |
Paragraph 5.52 of GSR Part 7 [9] states: |
| Managing the medical response in the event of a criticality accident |
6.17. |
Arrangements for managing the medical response in the event of a criticality accident are required to be in place, in accordance with Requirement 12 of GSR Part 7 [9]. This includes the predesignation of medical facilities with a trained and multidisciplinary health care team to provide specialized treatment for individuals exposed to a criticality event. Recommendations on medical follow‑up are provided in GSG‑11 [38]. |
| Managing the medical response in the event of a criticality accident |
6.18. |
The data and information to be gathered for the medical management of affected individuals should include basic contact details, information on the circumstances under which the criticality accident occurred, and any relevant medical history (e.g. previous illnesses, comorbidities, habits). |
| Managing the medical response in the event of a criticality accident |
6.19. |
Reconstructing the dose distribution in the human body is critical to the medical response. Paragraph 5.102 of GSR Part 7 [9] states that “Arrangements shall be made to document, protect and preserve, in an emergency response, to the extent practicable, data and information important for an analysis of the nuclear or radiological emergency and the emergency response.” These arrangements should include comprehensive interviews with those involved about the circumstances of the criticality accident to help guide the emergency response. |
| Dose estimation for a criticality accident |
6.20. |
The process of estimating the radiation dose from a criticality accident is subject to various uncertainties. The acceptable level of uncertainty (or the level of confidence that the dose is not greater than predicted) will be a decisive factor in determining the method to be used and the assumptions that can be made to produce the estimate. |
| Dose estimation for a criticality accident |
6.21. |
The initial estimation of the dose from a criticality accident should consider, at a minimum, the following: The location of the criticality accident;
The power history of the criticality accident (i.e. the number of fissions that have occurred as a function of time);
The effect of any shielding (including the source of the criticality itself) between the location of the criticality system and those likely to be affected (i.e. operating personnel);
The individuals likely to be affected (i.e. operating personnel), and the orientation of their bodies in relation to the criticality accident;
The neutron energy spectrum to which affected personnel were exposed;
The equivalent doses to individual organs to determine appropriate medical interventions.
|
| Dose estimation for a criticality accident |
6.22. |
It is possible that a clear picture of the location and cause of the accident might not emerge for several hours. Additional information may come from several sources (e.g. radiation monitors, eyewitness accounts, facility records). The following information should be used to refine the dose reconstruction: Details of the items of equipment involved;
The radiological, physical and chemical properties of the fissile material, including quantities;
The reactivity insertion mechanism that caused the system to achieve criticality;
The feedback and quenching mechanisms present (such as venting);
An estimation of any radioactive release (see Ref. [41]).
|
| Dose estimation for a criticality accident |
6.23. |
Requirement 20 of GSR Part 7 [9] states that “The government shall ensure that authorities for preparedness and response for a nuclear or radiological emergency are clearly established.” In addition, Requirement 24 of GSR Part 7 [9] states that “The government shall ensure that adequate logistical support and facilities are provided to enable emergency response functions to be performed effectively in a nuclear or radiological emergency.” The authorities for preparedness and response to a criticality accident may be similar or identical to those established for other types of nuclear or radiological emergency. |
| Dose estimation for a criticality accident |
6.24. |
Each response organization is required to prepare a specific emergency plan or plans for coordinating and performing their assigned functions (see para. 6.17 of GSR Part 7 [9]). In addition, the appropriate responsible authorities are required to ensure that a ‘concept of operations’ for the response to a criticality accident is developed at the preparedness stage (see para. 6.18 of GSR Part 7 [9]). |
| Dose estimation for a criticality accident |
6.25. |
In accordance with Requirement 25 of GSR Part 7 [9], training, drills and exercises are required to be provided for personnel involved in the emergency response to a criticality accident to ensure that such personnel are able to perform their assigned response functions effectively. |
| Dose estimation for a criticality accident |
6.26. |
The response to criticality accidents might involve knowledge, skills and abilities beyond those needed for other nuclear and radiological emergencies, and this should be taken into account at the preparedness stage. References[14, 42, 43] provide detailed descriptions of the dynamic behaviour of criticality accidents that have occurred. The exercises for criticality accidents (see para. 6.25) could be developed on the basis of the descriptions of accidents in these references. |
| Dose estimation for a criticality accident |
6.27. |
Of the 22 criticality accidents in nuclear fuel cycle facilities reported in Ref. [14], 21 involved fissile material in solutions or slurries (i.e. mixtures of enriched uranium or plutonium compounds with water or organic chemicals). The majority of the accidents were caused by an increase in concentration of fissile nuclides, which resulted from movement of fissile material by gravity or by flow through pipework. In these accidents, the key physical parameters affecting the fission yield (i.e. the total number of fissions in a nuclear criticality excursion) were the following: The mass of the fissile region (particularly for systems with fissile nuclides in solution).
The reactivity insertion mechanism and reactivity insertion rate.
Parameters relating to reactivity feedback mechanisms, for example:
— Doppler feedback;
— Duration time and time constant of reaction;
— Degree of confinement of the fissile material;
— Neutron spectral shifts;
— Degree of voiding;
— Change of temperature;
— Density changes.
|
| Dose estimation for a criticality accident |
6.28. |
Typically, criticality accidents in solution systems have been characterized by one or several fission excursion spikes, particularly at the start of the transient, followed by a ‘quasi‑steady state’ or plateau phase in which fission rates fluctuate much more slowly. |
| Re‑entry, rescue and stabilization |
6.29. |
Only personnel trained in emergency response and re‑entry should be allowed back into the facility during an emergency due to a criticality accident. Persons re‑entering should be provided with personal dosimeters that monitor both gamma and neutron radiation. |
| Re‑entry, rescue and stabilization |
6.30. |
Re‑entry should be made only if radiological surveys indicate that the radiation levels are acceptable. Radiation monitoring should be performed during re‑entry using monitors that have an alarm capability. |
| Re‑entry, rescue and stabilization |
6.31. |
The emergency procedures should describe the procedures for re‑entry and the membership of re‑entry teams. The operating organization should take prime responsibility for meeting the conditions, criteria and objectives to enable the termination of an emergency due to a criticality accident (see Requirement 18 of GSR Part 7 [9] and the recommendations provided in GSG‑11 [38]). Lines of authority and communication for the termination of the emergency should be included in the emergency procedures. |
| Re‑entry, rescue and stabilization |
6.32. |
If the emergency plan specifies the use of special material, such as a neutron absorber, to shut down or stabilize the system, a sufficient quantity of the material should be available. The potential for corrective actions to make the situation worse (see para. 6.11) and the hazards to emergency workers should be assessed before attempting corrective actions. |
| Re‑entry, rescue and stabilization |
6.33. |
The need for a criticality detection and alarm system is required to be assessed for all facilities and activities involving, or potentially involving, the risk of criticality (see para. 6.149(a) of SSR‑4 [2]). |
| Re‑entry, rescue and stabilization |
6.34. |
In determining the need for a criticality detection and alarm system, individual areas of a facility may be considered to be unrelated if the boundaries are such that there could be no inadvertent interchange of material between areas and if neutron coupling is negligible. |
| Re‑entry, rescue and stabilization |
6.35. |
Where installed, the criticality detection and alarm system should provide effective information to minimize the dose received by personnel from a criticality accident and to initiate mitigating actions. |
| Re‑entry, rescue and stabilization |
6.36. |
Justification of any exceptions to the need to provide a criticality detection and alarm system should be provided and could be based on the following cases: Where a documented assessment concludes that no foreseeable set of circumstances could initiate a criticality accident (see para. 6.173 of SSR‑4 [2]), or where the provision of a criticality detection and alarm system would offer no reduction in the risk from a criticality accident or would result in an increase in the overall risk to operating personnel from all hazards, including industrial hazards.
Shielded facilities in which the potential for a criticality accident is foreseeable but the resulting radiation dose at the outer surface of the unit where the accident occurred would be acceptable (see para. 6.173 of SSR‑4 [2]). Examples of such facilities might include hot cells and closed underground repositories.
Packages for fissile material awaiting transport, during transport or awaiting unpacking.
|
| Re‑entry, rescue and stabilization |
6.37. |
Where the potential for criticality exists but no criticality alarm system is employed, another means to detect the occurrence of a criticality event should be provided. |
| Re‑entry, rescue and stabilization |
6.38. |
Facility personnel should be trained in the correct response to criticality detection and alarm system activation and deactivation. |
| Performance and testing of criticality detection and alarm systems |
6.39. |
The criticality detection and alarm system is required to detect neutron and/or gamma radiation (see para. 6.173 of SSR‑4 [2]). Consequently, consideration should be given to the deployment of detectors that are sensitive to both neutron radiation and gamma radiation. If applicable, other reliable and practical methods could be adopted. |
| Performance and testing of criticality detection and alarm systems |
6.40. |
Paragraph 6.172 of SSR‑4 [2] states that “Instrumentation and control systems used to ensure subcriticality shall be of high quality and shall be calibrated against known standards. Changes to computer codes and data shall be controlled to a high standard by means of the management system.” |
| Criticality detection |
6.41. |
In areas in which criticality alarm coverage is necessary, means should be provided to detect excessive radiation doses and/or dose rates and to trigger an alarm for the evacuation of personnel. |
| Criticality alarms |
6.42. |
The alarm signal should meet the following criteria: It should be unique (i.e. it should be immediately recognizable to personnel as a criticality alarm).
It should actuate as soon as the criticality accident is detected and continue until manually reset, even if the radiation level falls below the alarm point.
Systems (with restricted access) to manually reset the alarm signal should be provided outside areas that need to be evacuated.
The alarm signal should be audible in all areas to be evacuated, and the alarm should continue for a time sufficient to allow a complete evacuation.
The alarm should be supplemented with visual signals in areas with high background noise.
|
| Dependability of criticality detection and alarm systems |
6.43. |
Consideration should be given to the need to avoid false alarms, for example by using concurrent response of two or more detector channels to trigger the alarm. In the evaluation of the criticality detection and alarm system, consideration should be given to other hazards that might result from the triggering of a false alarm. |
| Dependability of criticality detection and alarm systems |
6.44. |
Criticality detection systems without immediate evacuation alarms should be considered for special situations where it is demonstrated that mitigating actions could be executed to automatically bring the system back to a safe state and to reduce the radiation dose to personnel. |
| Dependability of criticality detection and alarm systems |
6.45. |
Warning signals indicating a malfunction but not actuating the alarm should also be provided. |
| Design criteria for criticality detection and alarm systems |
6.46. |
The design of the criticality detection and alarm system should be single failure tolerant and should be as simple as is consistent with the objectives of ensuring reliable actuation of the alarm and avoiding false alarms. |
| Design criteria for criticality detection and alarm systems |
6.47. |
The performance of the detectors should be carefully considered in order to avoid issues such as omission of an alarm signal or saturation of signals. |
| Design criteria for criticality detection and alarm systems |
6.48. |
Uninterruptible power supplies should be provided for the criticality detection and alarm system. |
| Trip points of criticality detection and alarm systems |
6.49. |
The trip point for the criticality detection and alarm system should be set sufficiently low to detect the minimum event of concern but sufficiently high to minimize false alarms. Indications should be provided to show which detector channels have been tripped. |
| Positioning of the detectors in criticality detection and alarm systems |
6.50. |
The location and spacing of detectors should be chosen to minimize the effect of shielding by equipment or materials. The spacing of detectors should be consistent with the selected alarm trip point. |
| Positioning of the detectors in criticality detection and alarm systems |
6.51. |
In the decommissioning of facilities, it is common practice to establish interim storage areas for items such as waste drums or to position modular containment systems around items of equipment requiring size reduction or dismantling. When determining where to locate these interim storage areas, it should be ensured that the criticality detectors can continue to detect the minimum accident of concern. |
| Testing of criticality detection and alarm systems |
6.52. |
The entire criticality detection and alarm system should be tested periodically. Testing periods should be determined from operating experience and should be kept under review. Performance testing of the criticality detection and alarm systems should include the periodic calibration of the radiation detectors used in the criticality detection and alarm systems. |
| Testing of criticality detection and alarm systems |
6.53. |
Each audible signal generator should be tested periodically. Tests should be performed to verify that the signal is audible above background noise throughout all areas to be evacuated. All personnel in affected areas should be notified in advance of a test of the alarm. |
| Testing of criticality detection and alarm systems |
6.54. |
Where a test indicates inadequate performance of the criticality detection and alarm systems, the management should be notified immediately, and corrective actions should be agreed and taken without delay. Temporary measures (e.g. mobile detection systems) may need to be provided to compensate for defective criticality detection and alarm systems. |
| Testing of criticality detection and alarm systems |
6.55. |
Relevant personnel should be given advance notice of the testing of subsystems of the alarm system and of any periods of time during which the system will be taken out of service. Operating rules should define the compensatory measures to be taken when the system is out of service. |
| Testing of criticality detection and alarm systems |
6.56. |
Records of the tests (e.g. of the response of instruments and of the entire alarm system) should be maintained in accordance with approved quality assurance plans as part of the management system (see paras 2.17–2.40). |
| Testing of criticality detection and alarm systems |
6.57. |
Further guidance on criticality detection and alarm systems is provided in Ref. [48].INTERNATIONAL ATOMIC ENERGY AGENCY, IAEA Safety Glossary: Terminology Used in Nuclear Safety and Radiation Protection, 2018 Edition, IAEA, Vienna (2019). INTERNATIONAL ATOMIC ENERGY AGENCY, Safety of Nuclear Fuel Cycle Facilities, IAEA Safety Standards Series No. SSR‑4, IAEA, Vienna (2017). INTERNATIONAL ATOMIC ENERGY AGENCY, Regulations for the Safe Transport of Radioactive Material, 2018 Edition, IAEA Safety Standards Series No. SSR‑6 (Rev. 1), IAEA, Vienna (2018). INTERNATIONAL ATOMIC ENERGY AGENCY, Safety Assessment for Facilities and Activities, IAEA Safety Standards Series No. GSR Part 4 (Rev. 1), IAEA, Vienna (2016). INTERNATIONAL ATOMIC ENERGY AGENCY, Leadership and Management for Safety, IAEA Safety Standards Series No. GSR Part 2, IAEA, Vienna (2016). INTERNATIONAL ATOMIC ENERGY AGENCY, Predisposal Management of Radioactive Waste, IAEA Safety Standards Series No. GSR Part 5, IAEA, Vienna (2009). INTERNATIONAL ATOMIC ENERGY AGENCY, Decommissioning of Facilities, IAEA Safety Standards Series No. GSR Part 6, IAEA, Vienna (2014). INTERNATIONAL ATOMIC ENERGY AGENCY, Disposal of Radioactive Waste, IAEA Safety Standards Series No. SSR‑5, IAEA, Vienna (2011). FOOD AND AGRICULTURE ORGANIZATION OF THE UNITED NATIONS, INTERNATIONAL ATOMIC ENERGY AGENCY, INTERNATIONAL CIVIL AVIATION ORGANIZATION, INTERNATIONAL LABOUR ORGANIZATION, INTERNATIONAL MARITIME ORGANIZATION, INTERPOL, OECD NUCLEAR ENERGY AGENCY, PAN AMERICAN HEALTH ORGANIZATION, PREPARATORY COMMISSION FOR THE COMPREHENSIVE NUCLEAR‑TEST‑BAN TREATY ORGANIZATION, UNITED NATIONS ENVIRONMENT PROGRAMME, UNITED NATIONS OFFICE FOR THE COORDINATION OF HUMANITARIAN AFFAIRS, WORLD HEALTH ORGANIZATION, WORLD METEOROLOGICAL ORGANIZATION, Preparedness and Response for a Nuclear or Radiological Emergency, IAEA Safety Standards Series No. GSR Part 7, IAEA, Vienna (2015). INTERNATIONAL ATOMIC ENERGY AGENCY, Advisory Material for the IAEA Regulations for the Safe Transport of Radioactive Material (2018 Edition), IAEA Safety Standards Series No. SSG‑26 (Rev. 1), IAEA, Vienna (2022). INTERNATIONAL ORGANIZATION FOR STANDARDIZATION, Nuclear Energy — Fissile Materials — Principles of Criticality Safety in Storing, Handling and Processing, ISO 1709:2018, ISO, Geneva (2018). AMERICAN NUCLEAR SOCIETY, Nuclear Criticality Safety in Operations with Fissionable Materials Outside of Reactors, ANSI/ANS‑8.1‑2014 (R2018), ANS, La Grange Park, IL (2014). CLAYTON, E.D., Anomalies of Nuclear Criticality, Rep. PNNL‑19176 Rev. 6, Pacific Northwest National Laboratory, Richland, WA (2010). McLAUGHLIN, T.P., et al., A Review of Criticality Accidents, 2000 Revision, Rep. LA‑13638, Los Alamos National Laboratory, Los Alamos, NM (2000). INTERNATIONAL ATOMIC ENERGY AGENCY, Operating Experience Feedback for Nuclear Installations, IAEA Safety Standards Series No. SSG‑50, IAEA, Vienna (2018). INTERNATIONAL ATOMIC ENERGY AGENCY, Application of the Management System for Facilities and Activities, IAEA Safety Standards Series No. GS‑G‑3.1, IAEA, Vienna (2006). INTERNATIONAL ATOMIC ENERGY AGENCY, Leadership, Management and Culture for Safety in Radioactive Waste Management, IAEA Safety Standards Series No. GSG‑16, IAEA, Vienna (2022). INTERNATIONAL ATOMIC ENERGY AGENCY, The Management System for Nuclear Installations, IAEA Safety Standards Series No. GS‑G‑3.5, IAEA, Vienna (2009). INTERNATIONAL ATOMIC ENERGY AGENCY, The Management System for the Safe Transport of Radioactive Material, IAEA Safety Standards Series No. TS‑G‑1.4, IAEA, Vienna (2008). OECD NUCLEAR ENERGY AGENCY, International Criticality Safety Benchmark Evaluation Project (ICSBEP) Handbook, 2018 edn, OECD/NEA, Paris (2018). INTERNATIONAL ATOMIC ENERGY AGENCY, Safety of Conversion Facilities and Uranium Enrichment Facilities, IAEA Safety Standards Series No. SSG‑5, IAEA, Vienna (2010). INTERNATIONAL ATOMIC ENERGY AGENCY, Safety of Uranium Fuel Fabrication Facilities, IAEA Safety Standards Series No. SSG‑6, IAEA, Vienna (2010). INTERNATIONAL ATOMIC ENERGY AGENCY, Safety of Uranium and Plutonium Mixed Oxide Fuel Fabrication Facilities, IAEA Safety Standards Series No. SSG‑7, IAEA, Vienna (2010). INTERNATIONAL ATOMIC ENERGY AGENCY, Core Management and Fuel Handling for Nuclear Power Plants, IAEA Safety Standards Series No. SSG‑73, IAEA, Vienna (in preparation). INTERNATIONAL ATOMIC ENERGY AGENCY, Core Management and Fuel Handling for Research Reactors, IAEA Safety Standards Series No. NS‑G‑4.3, IAEA, Vienna (2008). (A revision of this publication is in preparation.) INTERNATIONAL ATOMIC ENERGY AGENCY, Storage of Spent Nuclear Fuel, IAEA Safety Standards Series No. SSG‑15 (Rev. 1), IAEA, Vienna (2020). INTERNATIONAL ORGANIZATION FOR STANDARDIZATION, Nuclear Criticality Safety — Evaluation of Systems Containing PWR UOX Fuels — Bounding Burnup Credit Approach, ISO 27468:2011, ISO, Geneva (2011). HEALTH AND SAFETY EXECUTIVE, Leakage into the B205 Plutonium Evaporator Cell at Sellafield: HSE Investigation into the Leakage of Plutonium Nitrate into the Plutonium Evaporator Cell of the B205 Chemical Separation Plant, Sellafield, on 8 September 1992, HSE Books, Sudbury, Suffolk (1994). INTERNATIONAL ATOMIC ENERGY AGENCY, Safety of Nuclear Fuel Reprocessing Facilities, IAEA Safety Standards Series No. SSG‑42, IAEA, Vienna (2017). INTERNATIONAL ATOMIC ENERGY AGENCY, Storage of Radioactive Waste, IAEA Safety Standards Series No. WS‑G‑6.1, IAEA, Vienna (2006). INTERNATIONAL ATOMIC ENERGY AGENCY, Decommissioning of Nuclear Power Plants, Research Reactors and Other Nuclear Fuel Cycle Facilities, IAEA Safety Standards Series No. SSG‑47, IAEA, Vienna (2018). INTERNATIONAL ATOMIC ENERGY AGENCY, Compliance Assurance for the Safe Transport of Radioactive Material, IAEA Safety Standards Series No. TS‑G‑1.5, IAEA, Vienna (2009). (A revision of this publication is in preparation.) LAVARENNE, C., MENNERDAHL, D., DEAN, C., Evaluation of Nuclear Criticality Safety Data and Limits for Actinides in Transport, Rep. C4/TMR2001/200‑1, Institut de Radioprotection et de Sûreté Nucléaire, Paris (2003). AMERICAN NUCLEAR SOCIETY, Nuclear Criticality Safety Control of Selected Actinide Nuclides, ANSI/ANS‑8.15‑2014 (R2019), ANS, La Grange Park, IL (2014). INTERNATIONAL ATOMIC ENERGY AGENCY, Safety of Research Reactors, IAEA Safety Standards Series No. SSR‑3, IAEA, Vienna (2016). FOOD AND AGRICULTURE ORGANIZATION OF THE UNITED NATIONS, INTERNATIONAL ATOMIC ENERGY AGENCY, INTERNATIONAL LABOUR OFFICE, PAN AMERICAN HEALTH ORGANIZATION, WORLD HEALTH ORGANIZATION, Criteria for Use in Preparedness and Response for a Nuclear or Radiological Emergency, IAEA Safety Standards Series No. GSG‑2, IAEA, Vienna (2011). FOOD AND AGRICULTURE ORGANIZATION OF THE UNITED NATIONS, INTERNATIONAL ATOMIC ENERGY AGENCY, INTERNATIONAL LABOUR OFFICE, PAN AMERICAN HEALTH ORGANIZATION, UNITED NATIONS OFFICE FOR THE COORDINATION OF HUMANITARIAN AFFAIRS, WORLD HEALTH ORGANIZATION, Arrangements for Preparedness for a Nuclear or Radiological Emergency, IAEA Safety Standards Series No. GS‑G‑2.1, IAEA, Vienna (2007). (A revision of this publication is in preparation.) FOOD AND AGRICULTURE ORGANIZATION OF THE UNITED NATIONS, INTERNATIONAL ATOMIC ENERGY AGENCY, INTERNATIONAL CIVIL AVIATION ORGANIZATION, INTERNATIONAL LABOUR OFFICE, INTERNATIONAL MARITIME ORGANIZATION, INTERPOL, OECD NUCLEAR ENERGY AGENCY, UNITED NATIONS OFFICE FOR THE COORDINATION OF HUMANITARIAN AFFAIRS, WORLD HEALTH ORGANIZATION, WORLD METEOROLOGICAL ORGANIZATION, Arrangements for the Termination of a Nuclear or Radiological Emergency, IAEA Safety Standards Series No. GSG‑11, IAEA, Vienna (2018). INTERNATIONAL ATOMIC ENERGY AGENCY, INTERNATIONAL CIVIL AVIATION ORGANIZATION, INTERNATIONAL MARITIME ORGANIZATION, Preparedness and Response for a Nuclear or Radiological Emergency Involving the Transport of Radioactive Material, IAEA Safety Standards Series No. SSG‑65, IAEA, Vienna (2022). INTERNATIONAL ATOMIC ENERGY AGENCY, INTERNATIONAL LABOUR OFFICE, Occupational Radiation Protection, IAEA Safety Standards Series No. GSG‑7, IAEA, Vienna (2018). SCIENCE APPLICATIONS INTERNATIONAL CORPORATION, Nuclear Fuel Cycle Facility Accident Analysis Handbook, Rep. NUREG/CR‑6410, Nuclear Regulatory Commission, Office of Nuclear Material Safety and Safeguards, Washington, DC (1998). HOPPER, C.M., BROADHEAD, B.L., An Updated Nuclear Criticality Slide Rule, Rep. NUREG/CR‑6504, Vol. 2 (ORNL/TM 13322/V2), Oak Ridge National Laboratory, Oak Ridge, TN (1998). McLAUGHLIN, T.P., “Process criticality accident likelihoods, magnitudes and emergency planning — A focus on solution accidents”, Challenges in the Pursuit of Global Nuclear Criticality Safety (Proc. Int. Conf. Tokai, Ibaraki, 2003), Japan Atomic Energy Research Institute, Tokai‑mura, Ibaraki (2003). YAMAMOTO, T., MIYOSHI, Y., Mechanisms of positive temperature reactivity coefficients of dilute plutonium solutions, Nucl. Sci. Eng. 142 (2002) 305–314. HAECK, W., LECLAIRE, N., LETANG, E., GIRAULT, E., FOUILLAUD, P., “The plutonium temperature effect experimental program”, Proc. Int. Conf. on the Physics of Reactors — Nuclear Power: A Sustainable Resource, Interlaken, 2008. INTERNATIONAL ORGANIZATION FOR STANDARDIZATION, Nuclear Criticality Safety — Analysis of a Postulated Criticality Accident, ISO 27467:2009, ISO, Geneva (2009). INTERNATIONAL ORGANIZATION FOR STANDARDIZATION, Nuclear Criticality Safety — Estimation of the Number of Fissions of a Postulated Criticality Accident, ISO 16117:2013, ISO, Geneva (2013). INTERNATIONAL ORGANIZATION FOR STANDARDIZATION, Nuclear Energy — Performance and Testing Requirements for Criticality Detection and Alarm Systems, ISO 7753:1987, ISO, Geneva (1987)
|
| Testing of criticality detection and alarm systems |
|
ASSESSMENT METHODOLOGY |
| Testing of criticality detection and alarm systems |
|
HANLON, D., et al., Use of Burn‑Up Credit in the Assessment of Criticality Risk, Independent Regulatory Support, Merseyside, UK (2017), http://www.onr.org.uk/documents/2017/onr‑rrr‑026.pdf |
| Testing of criticality detection and alarm systems |
|
STANDARDS |
| Testing of criticality detection and alarm systems |
|
International standards |
| Testing of criticality detection and alarm systems |
|
ANSI/ANS standards |
| Testing of criticality detection and alarm systems |
|
Canadian standards |
| Testing of criticality detection and alarm systems |
|
HANDBOOKS AND GUIDES Vol. 1 (1968), https://ncsp.llnl.gov/docs/ARH600_Vol_I.pdf
Vol. 2 (1969), https://ncsp.llnl.gov/docs/ARH600_Vol_II.pdf
Vol. 3 (1971), https://ncsp.llnl.gov/docs/ARH600_Vol_III.pdf
|
| Testing of criticality detection and alarm systems |
|
COMPUTATIONAL METHODS |
| Testing of criticality detection and alarm systems |
|
Hand calculation methods |
| Testing of criticality detection and alarm systems |
|
TRAINING AND EDUCATION |
| Testing of criticality detection and alarm systems |
|
UNITED STATES DEPARTMENT OF ENERGY NUCLEAR CRITICALITY SAFETY PROGRAM, Nuclear Criticality Safety Engineer Training, https://ncsp.llnl.gov/training‑education Module 1: Introductory Nuclear Criticality Physics
Module 2: Neutron Interactions
Module 3: The Fission Chain Reaction
Module 4: Neutron Scattering and Moderation
Module 5: Criticality Safety Limits
Module 6: Introduction to Diffusion Theory
Module 7: Introduction to the Monte Carlo Method
Module 8: Hand Calculation Methods — Part I
Module 9: Hand Calculation Methods — Part 2
Module 10: Criticality Safety in Material Processing Operations — Part 1
Module 11: Criticality Safety in Material Processing Operations — Part 2
Module 12: Preparation of Nuclear Criticality Safety Evaluations
Module 13: Measurement and Development of Cross Section Sets
Module 14: A Review of Criticality Accidents by Thomas McLaughlin
Module 15: Fundamentals of Criticality Safety for Non‑material Handlers
Module 16: Burnup Credit for Criticality Safety Analysis of Commercial Spent Nuclear Fuel
Chapter 1: Early History of Criticality Experiments
Chapter 2: Purposes of Early Critical Experiment Campaigns
Chapter 3: Early ORCEF Line Organizations and Facilities
Chapter 4: Facility Description
Chapter 5: Characteristic Experimental Programs
Chapter 6: Polonium‑Beryllium Neutron Source Experience
Chapter 7: Operational Safety Experiments and Analysis
Chapter 8: Additional ORCEF Experimentalists
Chapter 9: Solution Sphere Experiment
Chapter 10: Sponsor and Credit
|
| Testing of criticality detection and alarm systems |
|
OPERATIONAL EXPERIENCE AND ACCIDENTS AND INCIDENTS |
| Testing of criticality detection and alarm systems |
|
McLAUGHLIN, T.P., FROLOV, V.V., et al., A Review of Criticality Accidents, 2000 Revision, Rep. LA‑13638, Los Alamos National Laboratory, Los Alamos, NM (2000), https://permalink.lanl.gov/object/tr?what=info:lanl‑repo/lareport/LA‑13638 |