SSG-7 (Rev. 1) Safety of Uranium and Plutonium Mixed Oxide Fuel Fabrication Facilities

Hledej:

Sekce	Odstavec	Text
Main
Main	1.1.	Requirements for all the important areas of safety in all stages of the lifetime of a nuclear fuel cycle facility are established in IAEA Safety Standards Series No. SSR‑4, Safety of Nuclear Fuel Cycle Facilities [1].
Main	1.2.	This Safety Guide provides specific recommendations on the safety of uranium and plutonium mixed oxide (MOX) fuel fabrication facilities.
Main	1.3.	Plutonium is a valuable energy resource that arises from the civil and military industries in a number of States. When plutonium oxide (PuO2) is mixed with uranium oxide (UO2), the resulting mixed oxide can be fabricated into fuel suitable for loading into thermal reactors and fast reactors, thereby utilizing this energy resource.
Main	1.4.	The MOX fuel fabrication processes rely to a large extent on passive and active engineered safety measures in addition to administrative controls to ensure safety. The potential hazards of a MOX fuel fabrication facility are release of actinides (i.e. plutonium, americium and uranium, in order of significance), increased radiotoxicity due to transuranium actinides and nuclear criticality.
Main	1.5.	As the toxicity of plutonium is high, it is important that best practices be employed at all stages of the fabrication of MOX fuel and that plutonium be handled, processed, treated and stored safely. It is important that best practices also be considered as part of applying optimization to the generation and management of all radioactive waste and effluents generated in MOX fuel fabrication facilities.
Main	1.6.	This Safety Guide supersedes IAEA Safety Standards Series No. SSG‑7, Safety of Uranium and Plutonium Mixed Oxide Fuel Fabrication Facilities¹.
Main	1.7.	The objective of this Safety Guide is to provide recommendations on the siting, design, construction, commissioning, operation including management for safety, and preparation for decommissioning of MOX fuel fabrication facilities to meet the applicable requirements established in SSR‑4 [1].
Main	1.8.	The recommendations in this Safety Guide are aimed primarily at operating organizations of MOX fuel fabrication facilities, regulatory bodies, designers and other relevant organizations.
Main	1.9.	The safety requirements applicable to fuel cycle facilities (i.e. facilities for uranium refining; conversion; enrichment; reconversion²; storage of fissile material; fabrication of fuel including MOX fuel; storage and reprocessing of spent fuel; associated conditioning and storage of waste; and facilities for fuel cycle related research and development) are established in SSR‑4. [1]. This Safety Guide provides recommendations on meeting these requirements for MOX fuel fabrication facilities.
Main	1.10.	This Safety Guide deals with the handling, processing, material transfer, and storage of (i) plutonium oxide powder; (ii) depleted, natural or reprocessed uranium oxide powder as it relates to MOX fuel fabrication facilities; and (iii) MOX fuel pellets, rods and assemblies fabricated from plutonium oxide and uranium oxide powders for use in thermal reactors and fast reactors. This Safety Guide also deals with the generation and management of wastes and effluents arising from the handling and processing of these materials.
Main	1.11.	This Safety Guide is limited to the safety of MOX fuel fabrication facilities; it does not deal with any impact that the fabricated fuel assemblies might have on the safety of the reactors in which they are to be used.
Main	1.12.	The fuel fabrication processes covered by this Safety Guide are dry processes and processes related to the mixing and processing of uranium dioxide and plutonium dioxide powders. The wet MOX fabrication process and the production of oxide powders are not addressed in this Safety Guide. IAEA Safety Standards Series Nos SSG‑6 (Rev. 1), Safety of Uranium Fuel Fabrication Facilities [2], and SSG‑42, Safety of Nuclear Fuel Reprocessing Facilities [3], provide additional recommendations on the safety of producing uranium and plutonium oxide powders.
Main	1.13.	This Safety Guide covers the production of MOX fuel from mixtures of uranium and plutonium oxides, obtained either by blending separate uranium oxide powders and plutonium oxide powders or as a prepared blend. Many aspects, such as the facility design, the safety analysis and the operation of the facility, depend on the nuclide compositions of these oxides. This Safety Guide covers all possible combinations of oxide composition.
Main	1.14.	The recommendations on ensuring criticality safety in a MOX fuel fabrication facility in this publication supplement the recommendations provided in IAEA Safety Standards Series No. SSG‑27 (Rev. 1), Criticality Safety in the Handling of Fissile Material [4].
Main	1.15.	The implementation of safety requirements on the legal and governmental framework and regulatory supervision (e.g. requirements for the authorization process, regulatory inspection and regulatory enforcement) as established in IAEA Safety Standards Series No. GSR Part 1 (Rev. 1), Governmental, Legal and Regulatory Framework for Safety [5], is not addressed in this Safety Guide.
Main	1.16.	This Safety Guide does not include recommendations on nuclear security for a MOX fuel fabrication facility. Recommendations on nuclear security are provided in IAEA Nuclear Security Series No. 13, Nuclear Security Recommendations on Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/ Revision 5) [6], and guidance is provided in IAEA Nuclear Security Series No. 27‑G, Physical Protection of Nuclear Material and Nuclear Facilities (Implementation of INFCIRC/225/Revision 5) [7]. However, this Safety Guide includes recommendations on managing interfaces between safety, nuclear security and the State system for nuclear material accounting and control.
Main	1.17.	Section 2 provides an overview of the hazards in a MOX fuel fabrication facility. Section 3 provides recommendations on the development of a management system for a MOX fuel fabrication facility and the activities associated with it. Section 4 describes the safety aspects to be considered in the evaluation and selection of a site to avoid or minimize any environmental impact of operations. Section 5 addresses safety in the design stage; it provides recommendations on the safety analysis for operational states and accident conditions and covers the safety aspects of radioactive waste management in the MOX fuel fabrication facility, and other design considerations. Section 6 addresses safety aspects in the construction stage. Section 7 addresses safety considerations in commissioning. Section 8 deals with safety in the stage of operation of the facility; it provides recommendations on the management of operation, maintenance and periodic testing, control of modifications, criticality control, radiation protection, industrial safety, the management of waste and effluents, and emergency preparedness and response. Section 9 provides recommendations on meeting the safety requirements for the preparation for decommissioning of a MOX fuel fabrication facility. Annex I shows the typical process routes in a MOX fuel fabrication facility. Annex II provides examples of structures, systems and components important to safety in MOX fuel fabrication facilities, grouped in accordance with process areas. Annex III provides examples of parameters for defining the operational limits and conditions for a MOX fuel fabrication facility.
Main	2.1.	In MOX fuel fabrication facilities, large amounts of fissile material and radioactive material are present in a dispersible form. This is particularly the case in the early stages of the fuel fabrication process, when the material is in powder form. In addition, the radioactive material encountered exists in diverse physical forms. Thus, in MOX fuel fabrication facilities the main hazards are potential nuclear criticality, loss of confinement and radiation exposure (both internal and external).
Main	2.2.	In MOX fuel fabrication facilities, plutonium oxide and uranium oxide and/or mixed oxide are processed. The factors affecting the safety of a MOX fuel fabrication facility include the following: Plutonium having high radiological toxicity, the consequences to the personnel, the public and the environment following an accident might be expected to be high. The powder processes used for MOX fuel fabrication have a potential for the dispersion of radioactive material. The isotopic characteristics of plutonium have an effect on nuclear criticality safety, radiation exposure and heat generation.
Main	2.3.	External exposure assessment should include exposure due to neutron emission from ²³⁸Pu and ²⁴⁰Pu isotopes and gamma radiation from ²⁴¹Am, which is formed through the radioactive decay of ²⁴¹Pu during storage. Gamma radiation from ²²⁸Th decay products (including ²⁰⁸Tl) should also be considered.
Main	2.4.	The decay heat of ²³⁸Pu should be included in the calculation of heat generation.
Main	2.5.	A MOX fuel fabrication facility using only dry processes does not store or process significant quantities of hazardous chemicals. Thus, chemical hazards that could lead to radiological consequences are low. However, this would not be the case for MOX fuel fabrication facilities using wet processes. To meet the requirements established in SSR‑4 [1], the operating organization is required to perform a safety analysis in which potential accidents are analysed to ensure that they are adequately prevented and, if they do occur, detected and their consequences mitigated. This requires application of the concept of defence in depth (see Requirement 10 of SSR‑4 [1]). For the MOX fuel fabrication facility to also remain in a safe state when the fuel fabrication process is stopped (i.e. when there is no movement or transfer of material), the following systems should continue to operate: Heat removal systems in storage areas to remove decay heat from reactor grade plutonium; Systems supporting confinement functions to supplement the physical confinement barriers and to provide mitigation and monitoring of radioactive discharges; Inert gas feed systems of sintering furnaces and gloveboxes; Criticality accident detection and alarm systems.
Main	3.1.	A documented management system that integrates safety, health, environmental, security, quality, and human and organizational factors of the operating organization is required to be established and implemented with adequate resources, in accordance with Requirement 4 of SSR‑4 [1]. The integrated management system should be established and put into effect by the operating organization early in the design stage of a MOX fuel fabrication facility, to ensure that safety measures are specified, documented, implemented, monitored, audited and periodically reviewed throughout the lifetime of the facility or the duration of the activity.
Main	3.2.	Requirements for the management system are established in IAEA Safety Standards Series No. GSR Part 2, Leadership and Management for Safety [8]. Associated recommendations are provided in IAEA Safety Standards Series Nos GS‑G‑3.1, Application of the Management System for Facilities and Activities [9]; GS‑G‑3.5, The Management System for Nuclear Installations [10]; GSG‑16, Leadership, Management and Culture for Safety in Radioactive Waste Management [11]; and TS‑G‑1.4, The Management System for the Safe Transport of Radioactive Material [12].
Main	3.3.	Coordination of the nuclear safety and security interface in the establishment of the integrated management system should be ensured. The management system should consider the specific concerns of each discipline regarding the management of information. Potential conflicts between the need for transparency of information relating to safety matters and the need for protection of information for security reasons should be addressed.
Main	3.4.	In determining how the management system for the safety of MOX fuel fabrication facilities is to be developed and applied, a graded approach is required to be used (see Requirement 7 and para. 4.15 of GSR Part 2 [8]). This approach should be based on the relative importance to safety of each item or process.
Main	3.5.	The management system is required to support the development and maintenance of a strong safety culture, including in all aspects of criticality safety (see Requirement 12 of GSR Part 2 [8]).
Main	3.6.	In accordance with paras 4.15–4.23 of SSR‑4 [1], the management system is required to address the following functional areas: Management responsibility, which includes the necessary support and commitment of the management to achieve the objectives of the operating organization. Resource management, which includes the measures necessary to ensure that the resources essential to the implementation of safety policy and the enhancement of safety and the achievement of the objectives of the operating organization are identified and made available. Process implementation, which includes the actions and tasks necessary to achieve the goals of the operating organization. Measurement, assessment, evaluation and improvement, which provide an indication of the effectiveness of management processes and work performance compared with objectives or benchmarks. It is through measurement, assessment and evaluation that opportunities for improvement are identified.
Main	3.7.	The prime responsibility for safety, including criticality safety, rests with the operating organization. In accordance with para. 4.11 of GSR Part 2 [8], the management system for a MOX fuel fabrication facility is required to clearly specify the following: The organizational structure; Functional responsibilities; Levels of authority.
Main	3.8.	The documentation of the management system should describe the interactions between the individuals managing, performing and assessing the adequacy of the processes and activities important to safety. The documentation should also cover other management measures, including planning, scheduling and resource allocation (see para. 9.9 of SSR‑4 [1]).
Main	3.9.	Paragraph 4.15 of SSR‑4 [1] states:
Main	3.10.	The operating organization is required to ensure that safety assessments and analyses are conducted, documented and updated (see Requirement 24 and para. 4.65 of IAEA Safety Standards Series No. GSR Part 4 (Rev. 1), Safety Assessment for Facilities and Activities [13], and Requirement 5 of SSR‑4 [1]).
Main	3.11.	In accordance with para. 4.2(d) of SSR‑4 [1], the operating organization is required to audit all safety related matters on a regular basis. This should include the examination of arrangements for emergency preparedness and response, such as emergency communications, evacuation routes and signage. Checks should be performed by the nuclear criticality safety personnel who performed the safety assessments to confirm that the data used and the implementation of criticality safety measures are correct. Audits should be performed by personnel who are independent of those who performed the safety assessments or conducted the activities important for safety. The data from audits should be documented and submitted for management review and for action, if necessary.
Main	3.12.	The operating organization is required to provide adequate resources (both human and financial) for the safe operation of the MOX fuel fabrication facility (see Requirement 9 of GSR Part 2 [8]), including resources for mitigating the consequences of accidents.
Main	3.13.	The management of the operating organization should undertake the following: Determine the necessary competence of personnel and provide training, as necessary; Prepare and issue specifications and procedures on safety related activities and operations; Support the conduct of and perform safety assessments, including modifications; Have frequent personal contact with personnel, including observing work in progress; Make provisions for adequate staffing³, succession planning and retention of corporate knowledge.
Main	3.14.	Requirement 58 of SSR‑4 [1] states that “The operating organization shall ensure that all activities that may affect safety are performed by suitably qualified and competent persons.”
Main	3.15.	In accordance with Requirement 58 and paras 9.39–9.47 of SSR‑4 [1], the operating organization is required to ensure that these personnel receive training and refresher training at suitable intervals, appropriate to their level of responsibility. In particular, personnel involved in activities with fissile material (both uranium and plutonium), radioactive material (including waste) and chemicals should understand the nature of the hazard posed by these materials and how these risks are controlled by the established safety measures, operational limits and conditions, and operating procedures.
Main	3.16.	Requirement 11 of GSR Part 2 [8] states that “The organization shall put in place arrangements with vendors, contractors and suppliers for specifying, monitoring and managing the supply to it of items, products and services that may influence safety.” In accordance with paras 4.33–4.36 of GSR Part 2 [8], the management system for a MOX fuel fabrication facility is required to include arrangements for procurement.
Main	3.17.	In accordance with para. 4.16(b) of SSR‑4 [1], the operating organization is required to ensure that suppliers of items and resources important to safety have an effective management system in place. To meet these requirements, the operating organization should conduct audits of the management systems of the suppliers.
Main	3.18.	Requirement 63 of SSR‑4 [1] states:
Main	3.19.	The management system for a MOX fuel fabrication facility should include management for criticality safety. Further recommendations on the management system for criticality safety are provided in SSG‑27 (Rev. 1) [4].
Main	3.20.	Any proposed modifications to existing facilities or activities, or proposals for the introduction of new activities, are required to be assessed for their implications for existing safety measures and appropriately approved before implementation (see paras 9.57(b) and (c) of SSR‑4 [1]). Modifications of safety significance are required to be subjected to safety assessment and regulatory review and, where necessary, they are required to be authorized by the regulatory body before they are implemented (see paras 9.57(h) and 9.59 of SSR‑4 [1]). The facility or activity documentation is required to be updated to reflect modifications (see paras 9.57(f) and (g) of SSR‑4 [1]). The operating personnel, including supervisors, should receive adequate training on the modifications.
Main	3.21.	Requirement 75 of SSR‑4 [1] states:
Main	3.22.	The audits performed by the operating organization (see para. 3.11), as well as proper control of modifications to facilities and activities (see para. 3.20), are particularly important for ensuring subcriticality. The results of audits are required to be evaluated by the operating organization, and corrective actions are required to be taken where necessary (see para. 4.2(d) of SSR‑4 [1]).
Main	3.23.	Deviations from operational limits and conditions, deviations from operating procedures and unforeseen changes in process conditions that could affect nuclear criticality safety are required to be reported and promptly investigated by the operating organization, and the operating organization is required to inform the regulatory body (see paras 9.34, 9.35 and 9.84 of SSR‑4 [1]). The depth and extent of the investigation should be proportionate to the safety significance of the event, in accordance with a graded approach. The investigation should cover the following: An analysis of the causes of the deviation to identify lessons and to determine and implement corrective actions to prevent a recurrence; An analysis of the operation of the facility or conduct of the activity, including an analysis of human factors; A review of the safety assessment and analyses that were previously performed, including the safety measures that were originally established.
Main	3.24.	Requirement 73 of SSR‑4 [1] states that “The operating organization shall establish a programme to learn from events at the facility and events at other nuclear fuel cycle facilities and in the nuclear industry worldwide.” Recommendations on operating experience programmes are provided in IAEA Safety Standards Series No. SSG‑50, Operating Experience Feedback for Nuclear Installations [14].
Main	3.25.	In accordance with Requirement 5 of SSR‑4 [1], the safety of a MOX fuel fabrication facility is required to be assessed in the safety analysis and verified by periodic safety reviews. The operating organization should ensure that these periodic safety reviews of the facility form an integral part of the organization’s management system.
Main	3.26.	Requirement 6 of SSR‑4 [1] states that “An independent safety committee (or an advisory group) shall be established to advise the management of the operating organization on all safety aspects of the nuclear fuel cycle facility.”
Main	3.27.	The safety committee of a MOX fuel fabrication facility should have members or access to experts in areas of human factors, criticality safety and radiation protection. Such experts should be available to the facility at all times during operation.
Main	4.1.	The site evaluation process for a MOX fuel fabrication facility will depend on a large number of variables. At the earliest stage of planning a facility, a list of these variables should be prepared and considered in accordance with their safety significance. The risks posed by possible significant external hazards (e.g. earthquakes, accidental aircraft crashes, fires, nearby explosions, floods, extreme meteorological conditions) will probably dominate in the site evaluation process and should be taken into account in the design of the facility. Requirements for site evaluation for MOX fuel fabrication facilities are established in IAEA Safety Standards Series No. SSR‑1, Site Evaluation for Nuclear Installations [15], and further recommendations are provided in IAEA Safety Standards Series No. SSG‑35, Site Survey and Site Selection for Nuclear Installations [16].
Main	4.2.	The scope of the site evaluation for a MOX fuel fabrication facility is established in Requirement 3 of SSR‑1 [15] and Requirement 11 and paras 5.1–5.14 of SSR‑4 [1] and should reflect the specific hazards listed in Section 2 of this Safety Guide.
Main	4.3.	For a MOX fuel fabrication facility where a dry process is used to manufacture fuel, appropriate design and operation can ensure that gaseous releases are negligible under normal operating conditions. The main hazard in accident conditions is the potential release of plutonium (as plutonium oxide or MOX) as particles to the atmosphere or to the air of the working zone.
Main	4.4.	A MOX fuel fabrication facility should be considered to be a facility with a high hazard potential. This should be taken into consideration when applying a graded approach to the implementation of the requirements of SSR‑4 [1] to the facility. The following characteristics of the site should be considered, to ensure the safety of the facility: — Legal requirements: Using a site for which regulatory consent to process plutonium has already been granted. — Transport links: Minimizing the distance by which fissile material needs to be transported (e.g. by siting a MOX fuel fabrication facility on the same site as the plutonium production). Combined hazards and hazard interactions between the facilities on the same site should be understood and taken into consideration.
Main	4.5.	The population density and population distribution in the vicinity of a MOX fuel fabrication facility are required to be considered in the site evaluation process to minimize any possible health consequences for people in the event of a release of radioactive material and hazardous chemicals (see Requirements 4 and 12 of SSR‑1 [15]). Also, in accordance with Requirement 25 and paras 6.1 and 6.2 of SSR‑1 [15], the dispersion in air and water of radioactive material released from the MOX fuel fabrication facility is required to be assessed, taking into account the orography, land cover and meteorological features of the region. The environmental impact from the facility under all facility states is required to be evaluated (see para. 5.3 of SSR‑4 [1]) and should meet the applicable criteria.
Main	4.6.	Security advice is required to be taken into account in the selection of a site for a MOX fuel fabrication facility (see para. 11.4 of SSR‑4 [1]). Considering the presence of plutonium in the facility, special attention should be given to the management of the interface between nuclear safety and nuclear security during site evaluation (see Requirement 75 of SSR‑4 [1]). The selection of a site should take into account both safety and security aspects and should be facilitated by both safety experts and security experts.
Main	4.7.	Even if an existing nuclear site is used for a MOX fuel fabrication facility, the site evaluation should be performed using a process similar to that used for the siting of a new facility at a new site (see paras 3.24–3.27 of SSG‑35 [16]).
Main	4.8.	The operating organization should maintain a full record of the decisions taken on the selection of a site for a MOX fuel fabrication facility and the reasons behind those decisions.
Main	4.9.	The site characteristics should be reviewed periodically for their adequacy and persistent applicability during the lifetime of a MOX fuel fabrication facility. Any changes to these characteristics that might require safety reassessment should be identified and evaluated (see para. 5.14 of SSR‑4 [1]). This includes the case of an increase of the production capacity beyond the original envelope.
Main	5.1.	Requirement 7 of SSR‑4 [1] states: Confinement and cooling of radioactive material and associated harmful materials; Protection against radiation exposure; Maintaining subcriticality of fissile material.”
Main	5.2.	The requirements on the confinement and cooling of radioactive material are established in Requirements 35 and 39 and paras 6.123–6.128 and 6.157–6.159 of SSR‑4 [1].
Main	5.3.	The requirements on protection against internal radiation exposure are established in Requirement 34 and paras 6.120–6.122 of SSR‑4 [1]. The requirements on protection against external radiation exposure are established in Requirement 36 and paras 6.129–6.134 of SSR‑4 [1]. Concerning the radiation associated with plutonium (i.e. neutron emissions and gamma radiation), an appropriate combination of requirements on source limitation, distance, time and shielding is necessary for the protection of personnel as relates to whole body exposure, exposure of the hands and exposure of the lens of the eye. For neutron emissions, a general design principle is to place the shielding as close as possible to the source. In some cases, remote operation should be considered if necessary. Individual monitoring of neutron doses to the personnel should be conducted in addition to individual monitoring of gamma radiation.
Main	5.4.	The requirements on maintaining subcriticality are established in Requirement 38 and paras 6.138–6.156 of SSR‑4 [1]. Recommendations on the design of a MOX fuel fabrication facility to ensure subcriticality are provided in section 3 of SSG‑27 (Rev. 1) [4].
Design basis and safety analysis	5.5.	A design basis accident is a postulated accident leading to accident conditions for which a facility is designed in accordance with established design criteria and conservative methodology, and for which releases of radioactive material are kept within acceptable limits [1].
Design basis and safety analysis	5.6.	The safety requirements relating to the design basis for items important to safety and for the design basis analysis for a nuclear fuel cycle facility are established in Requirements 14 and 20 of SSR‑4 [1], respectively.
Design basis and safety analysis	5.7.	The specification of a design basis (or equivalent) will depend on the design of the facility, the siting of the facility and regulatory requirements. However, particular consideration should be given to the following hazards in the specification of the design basis safety analysis for MOX fuel fabrication facilities: Release of plutonium inside and/or outside the facility; Internal and external hazards, including internal and external explosions (in particular hydrogen explosions), internal and external fires, dropped loads and handling errors, extreme meteorological phenomena (in particular earthquakes, flooding and tornadoes) and accidental aircraft crashes.
Design basis and safety analysis	5.8.	These hazards are of major safety significance as they might result in radiological consequences for the facility personnel. In addition, these hazards could also result in some adverse off‑site consequences for the public or the environment.
Design basis and safety analysis	5.9.	The hazards listed in para. 5.7 might occur as a consequence of a postulated initiating event. Selected postulated initiating events for nuclear fuel cycle facilities are provided in the appendix to SSR‑4 [1].
Structures, systems and components important to safety	5.10.	Paragraph 6.21 of SSR‑4 [1] states:
Confinement of radioactive material	5.11.	To meet Requirement 35 of SSR‑4 [1] in a MOX fuel fabrication facility, three static barriers (or more, as dictated by the safety analysis) should be provided, in accordance with a graded approach. The first static barrier normally consists of gloveboxes, fuel cladding, material containers or other equipment containing radioactive material. The second static barrier normally consists of the rooms around the gloveboxes. The third static barrier is the building itself. The design of the static containment system should consider openings between the different confinement zones (e.g. doors, penetrations). Such openings should be designed to ensure that confinement is maintained in all operational states, especially during maintenance (e.g. by the provision of permanent or temporary additional barriers) and, as far as practicable, in accident conditions.
Confinement of radioactive material	5.12.	Each physical barrier of the containment system should be complemented by one or more associated systems, which should establish a cascade of pressure between the environment outside the building and the air that might contain contaminated material inside the building, and across all static barriers within the building. The associated systems should be designed to prevent the movement or diffusion of radioactive or toxic gases, vapours and airborne particulates through any openings in the barriers to areas of lower contamination or concentration of these materials. The design of the associated systems should address the following, as far as applicable: Operational states and accident conditions; Maintenance, which may cause localized changes to conditions (e.g. opening access doors, removing access panels); Where more than one ventilation system is used, protection in case of a failure of a lower pressure (higher contamination) system, causing pressure differentials and airflows to be reversed; The need to ensure that all static barriers, including any filters or other effluent control equipment, can withstand the maximum differential pressures and airflows generated by the system, including increasing the filter resistance during operation and considering conservative assumptions regarding the meteorological conditions.
Confinement of radioactive material	5.13.	Specific attention should be paid in the design to operations that lead to the transfer of contaminated materials outside the static containment system. Normal operations should not involve any transfer of radioactive powders outside the first barrier (with gloveboxes and tunnels linking them). Design features should be provided for the removal of materials and items (such as waste or scrap) from the gloveboxes when needed.
Confinement of radioactive material	5.14.	Devices for monitoring air contamination should be included in the design of confinement areas close to working locations, especially at gloveboxes. The location of such devices should be finalized during cold commissioning, when precise airflows are established.
Confinement of radioactive material	5.15.	In confinement areas, appropriate equipment should be provided for monitoring surfaces for contamination. Contamination can be detected by smear sampling of surfaces or by using portable devices.
Confinement of radioactive material	5.16.	The design of a MOX fuel fabrication facility should be such as to facilitate operation, maintenance and decontamination activities. Building compartmentalization should be considered in the design to prevent contamination of large areas of the MOX fuel fabrication facility.
Confinement of radioactive material	5.17.	The ventilation system normally includes filters in series to protect the public and the environment. The air drawn into the ventilation system from the environment as well as the air discharged from the facility should be filtered. The filters filter the air during normal operation and ensure the continuity of the static barriers in the event of loss of ventilation.
Confinement of radioactive material	5.18.	The ventilation system should be designed and operated to minimize the opportunity for buildup of particulates. Appropriate procedures should be established and instruments should be provided to control the potential buildup of plutonium powder or MOX powder particulates in the ventilation ducts and in the high efficiency particulate air (HEPA) filters.
Confinement of radioactive material	5.19.	Primary filters should be located as close to the source of contamination as practicable (e.g. near or in the gloveboxes) to minimize the potential buildup of plutonium powder or MOX particulates in the ventilation ducts. Multiple primary filters in series should preferably be used to prevent any transfer of contamination during maintenance of one of the filters.
Confinement of radioactive material	5.20.	Filtration should be provided at ventilation inlet points to prevent the loss of particulates due to reverse or static flow conditions in case of ventilation system failure.
Confinement of radioactive material	5.21.	In addition, operating fans and standby fans should be provided and should be powered such that, in the case of loss of normal power, the uninterrupted functioning of glovebox ventilation systems is ensured. Local monitoring systems and alarm systems should be installed to alert operators to system malfunctions that might result in differential pressures that are considered too high or too low.
Confinement of radioactive material	5.22.	Last stage filters (see also para. 5.35) should be used to protect the public and the environment and should normally be located close to the location at which discharges to the environment occur.
Confinement of radioactive material	5.23.	To prevent the propagation of a fire through the ventilation ducts and to maintain the integrity of firewalls, ventilation systems should be equipped with fire and smoke dampers (see also para. 5.61).
Confinement of radioactive material	5.24.	At the design stage, provision should be made for the installation of equipment for monitoring airborne radioactive material. Monitoring points should be chosen that would correspond most accurately to the exposure of personnel and would minimize the time for detection of any leakage from the first barrier.
Confinement of radioactive material	5.25.	The design of a MOX fuel fabrication facility should allow all planned activities associated with operation or maintenance to be performed without breaching the primary containment.
Protection of workers	5.26.	Requirements on the design of MOX fuel fabrication facilities to ensure radiation protection are established in Requirement 8 of SSR‑4 [1].
Protection of workers	5.27.	The first static barrier normally protects the workers. The specifications for the design of the first static barrier should be established to ensure and to control the integrity of this barrier. The design should include specifications for: welding; selection of materials; leaktightness (for gloveboxes, for the ratio of the leak rate to the flow rate); the ability to withstand seismic loads; the design of the equipment (internal equipment for gloveboxes); penetration seals for electrical and mechanical penetrations; and the ease of performing maintenance work.
Protection of workers	5.28.	Gloveboxes often consist of welded stainless steel enclosures with windows, arranged either singly or in interconnected groups. Access to equipment inside the glovebox is provided through access holes in the glovebox window that are fitted with gloves (made of various materials depending on the work being performed in the glovebox) which maintain the confinement barrier.
Protection of workers	5.29.	Gloveboxes, fume hoods and filtered ventilation systems should be used to minimize the radiation exposure of personnel and their exposure to hazardous material that could become airborne and be inhaled. In addition, personal protective equipment should be used to avoid contamination of workers with radioactive material and other hazardous material, if protection cannot be achieved by design solutions only.
Protection of workers	5.30.	For normal operation, the need for the use of respiratory protection should be minimized through careful design of the static and dynamic containment systems and of devices for the immediate detection of low thresholds of airborne radioactive material. Respiratory protection during normal operation should be used only as a complementary means of protection in addition to existing barriers (see also paras 9.100 and 9.101 of SSR‑4 [1]).
Protection of workers	5.31.	Audio alarm systems should be installed to alert operators to fan failures and to high or low differential pressures across filters. At the design stage, provision is also required to be made for the installation of equipment for monitoring airborne uranium concentration and/or gas concentration (see para. 6.120 of SSR‑4 [1]). Monitoring points should be chosen that would correspond most accurately to the exposure of personnel and would minimize the time for detection of any leakage (see para. 6.121 of SSR‑4 [1]).
Protection of workers	5.32.	To facilitate decontamination and decommissioning of the facility, the walls, floors and ceilings in areas of the uranium fuel fabrication facility where contamination is likely should be made non‑porous and easy to clean. This may be done by applying special coatings, such as epoxy, to surfaces. In addition, all surfaces that could become contaminated should be made readily accessible to allow for periodic decontamination as necessary.
Protection of the public and the environment	5.33.	Paragraph 3.9 of IAEA Safety Standards Series No. GSR Part 3, Radiation Protection and Safety of Radiation Sources: International Basic Safety Standards [17], states:
Protection of the public and the environment	5.34.	The uncontrolled dispersion of radioactive substances to the environment as a result of an accident can occur if multiple confinement barriers are impaired. Barriers that may provide environmental protection comprise the room and the building itself. The provision of multiple redundant filters in parallel should be considered for the final stage of filtration before the discharge of exhaust gases through a stack. Filtration, including final stage filtration, also provides a means of minimizing the release of radioactive particulates to the environment under normal operating conditions, usually reducing gaseous discharges to acceptably low levels.
Protection of the public and the environment	5.35.	The design of a MOX fuel fabrication facility should also provide measures for ensuring that the performance of filtration is the same as that claimed in the facility safety analysis, particularly for the last stage filters. Provisions to ensure the performance of filtration may include testing the particulate removal efficiency (e.g. by aerosol challenge testing), differential pressure measurements and monitoring of alpha particles in ductwork. The design should include provisions to monitor the environment around the facility and to identify breaches of the confinement barriers.
Protection against external exposure	5.36.	Relevant requirements on design provisions for protection against external radiation exposure are established in Requirement 36 and paras 6.129–6.134 of SSR‑4 [1].
Protection against external exposure	5.37.	External exposure of workers should be controlled by means of an appropriate combination of requirements on source reduction, distance, time and shielding. Owing to the specific activity of plutonium, the shielding provided by the vessels and/or gloveboxes of a MOX fuel fabrication facility might not be sufficient to control exposure adequately, and thus additional controls on time, distance and shielding should be considered, where necessary.
Protection against external exposure	5.38.	If necessary, consideration should be given to the remote operation of process equipment and the installation of equipment for powder collection to prevent any spreading of radioactive powder in gloveboxes.
Protection against external exposure	5.39.	Provision for shielding in material storage areas, at process gloveboxes (e.g. where powder processing or pellet processing is performed) and in the fuel assembly area should be considered.
Prevention of nuclear criticality	5.40.	Prevention of nuclear criticality is an important topic with various aspects to be considered during the design and operation of a MOX fuel fabrication facility (see Requirement 38 of SSR‑4 [1]). Paragraphs 5.41–5.49 provide recommendations on some of the main elements of criticality safety that are specific for MOX fuel fabrication facilities. Detailed recommendations on criticality safety are provided in SSG‑27 (Rev. 1) [4].
Prevention of nuclear criticality	5.41.	The criticality safety analysis should demonstrate that the design of equipment and the related safety measures are such that the facility is in a subcritical state at all times (i.e. the values of the controlled parameters are always maintained in the subcritical range). This should be achieved by determining the effective neutron multiplication factor (k_eff), which mainly depends on the mass, the geometry, the distribution and the nuclear properties of the fissionable material and all other materials with which it is associated. The calculated value of k_eff (including all uncertainties and biases) should then be compared with the value specified by the design limit (which should be set in accordance with paras 2.8–2.12 of SSG‑27 (Rev. 1) [4]), and actions should be taken to maintain the value of k_eff under this limit.
Prevention of nuclear criticality	5.42.	Paragraph 6.142 of SSR‑4 [1] states that “For the prevention of criticality by means of design, the double contingency principle shall be the preferred approach.” For ensuring criticality safety in a MOX fuel fabrication facility, one or more of the following parameters of the system should be kept within subcritical limits: PuO₂ (receipt): Mass and geometry (i.e. limitation of the dimensions or shape) should be selected in accordance with the safety specification of PuO₂ isotopic composition and moderation. The presence of appropriate neutron absorbers should be ensured. UO₂ (receipt): Mass and geometry should be selected in accordance with the safety specification of UO₂ isotopic composition and moderation. MOX powder (receipt or preparation): MOX powder is formed in the fuel fabrication process, and the associated criticality hazard should be assessed in accordance with the isotopic specifications and the PuO₂ content at each stage of the process: Mass, geometry and moderation should be considered. The presence of appropriate neutron absorbers should be ensured. MOX pellets: Mass, geometry and moderation should be selected in accordance with the isotopic specifications, the PuO₂ content and the size of the pellets. Fuel rods: Geometry and moderation should be selected in accordance with the isotopic specifications, the PuO₂ content and the design of the rods (e.g. size, cladding). Fuel assemblies: Geometry and moderation should be selected in accordance with the isotopic specifications, the PuO₂ content distribution in the different rods and the design of the assembly. Mass and geometry (i.e. limitation of the dimensions or shape) should be selected in accordance with the safety specification of PuO₂ isotopic composition and moderation. The presence of appropriate neutron absorbers should be ensured. Mass, geometry and moderation should be considered. The presence of appropriate neutron absorbers should be ensured.
Prevention of nuclear criticality	5.43.	Some examples of the parameters subject to control for the prevention of criticality are as follows: PuO₂(receipt): The isotopic composition of plutonium (the ratios of the amount of a particular isotope of plutonium to the total amount of plutonium: ²³⁹Pu/Pu, ²⁴⁰Pu/Pu, ²⁴¹Pu/Pu,²⁴²Pu/Pu). ²³⁸Pu should not be taken into account as its isotopic content and neutron properties are not as well qualified as for the other plutonium isotopes. The amount of moisture (degree of moderation) for control of criticality in the next stages of the MOX fuel fabrication process. The upper bounded PuO₂ density. UO₂ (receipt): The isotopic composition of uranium (the ratio of the amount of ²³⁵U to the total amount of uranium: ²³⁵U/U). When this ratio is less than 1%, and provided that there is no significant presence of deuterium, beryllium or graphite present in the facility, no criticality hazard is to be considered for uranium powders. The amount of moisture (degree of moderation) for control of criticality in the next stages of the MOX fuel fabrication process. The upper bounded UO₂ density. MOX powder (receipt or preparation): The ratio of PuO₂ to the total amount of oxides (PuO₂/(UO₂ + PuO₂)). The amount of moisture (degree of moderation) and the amount of additives (degree of moderation) for assessment of the criticality hazard at each stage of the process. The upper boundary of the UO₂–PuO₂ (MOX) density. The presence of non‑homogeneous distributions of moderators, if considered necessary. MOX pellets (in addition to previous controls): Diameter range of the pellets. Fuel rods (in addition to previous controls): Cladding thickness range of the rods. Fuel assemblies (in addition to previous controls): Distribution of the fuel rods within the assembly. The isotopic composition of plutonium (the ratios of the amount of a particular isotope of plutonium to the total amount of plutonium: ²³⁹Pu/Pu, ²⁴⁰Pu/Pu, ²⁴¹Pu/Pu,²⁴²Pu/Pu). ²³⁸Pu should not be taken into account as its isotopic content and neutron properties are not as well qualified as for the other plutonium isotopes. The amount of moisture (degree of moderation) for control of criticality in the next stages of the MOX fuel fabrication process. The upper bounded PuO₂ density. The isotopic composition of uranium (the ratio of the amount of ²³⁵U to the total amount of uranium: ²³⁵U/U). When this ratio is less than 1%, and provided that there is no significant presence of deuterium, beryllium or graphite present in the facility, no criticality hazard is to be considered for uranium powders. The amount of moisture (degree of moderation) for control of criticality in the next stages of the MOX fuel fabrication process. The upper bounded UO₂ density. The ratio of PuO₂ to the total amount of oxides (PuO₂/(UO₂ + PuO₂)). The amount of moisture (degree of moderation) and the amount of additives (degree of moderation) for assessment of the criticality hazard at each stage of the process. The upper boundary of the UO₂–PuO₂ (MOX) density. The presence of non‑homogeneous distributions of moderators, if considered necessary.
Prevention of nuclear criticality	5.44.	In order to perform criticality analysis of a MOX fuel fabrication facility, the following input data should be specified: The plutonium and uranium isotopic composition; The PuO₂ content of the final MOX powder mix (PuO₂/(UO₂+PuO₂)) value; The maximum density of the final MOX powder mix; The final moderator material content in the mix (i.e. powder moisture, hydrogen and carbon content (composition) of the additives).
Prevention of nuclear criticality	5.45.	Several methods that vary widely in basis and form can be used to perform the criticality safety analysis, such as the use of experimental data, reference books or consensus standards, hand calculations and calculations by means of deterministic or probabilistic computer codes. For more extensive recommendations on performing a criticality safety assessment, including recommendations on validation of computer codes, see section 4 of SSG‑27 (Rev. 1) [4].
Prevention of nuclear criticality	5.46.	The criticality safety analysis should include the following: The use of a conservative approach taking into account the following: Uncertainties in physical parameters, the physical possibility of optimal moderation conditions and the potential for non‑homogeneous distributions of moderators; The optimal geometry configuration of a system with fissile material; Plausible operational occurrences and their combinations if they cannot be shown to be independent; Operational states that might result from external hazards. The use of appropriate verified and validated computer codes that are validated together with the appropriate data libraries of nuclear reaction cross‑sections for the normal and credible abnormal conditions being analysed, while taking into account any bias and its uncertainties (see paras 4.22–4.29 of SSG‑27 (Rev. 1) [4]). Uncertainties in physical parameters, the physical possibility of optimal moderation conditions and the potential for non‑homogeneous distributions of moderators; The optimal geometry configuration of a system with fissile material; Plausible operational occurrences and their combinations if they cannot be shown to be independent; Operational states that might result from external hazards.
Prevention of nuclear criticality	5.47.	Consideration should be given to criticality safety during pelletizing of the final MOX powder mix as the powder undergoes compression and changes in geometry. The approach to criticality safety, including safety analysis after this stage in the production, is similar to the approach taken in a uranium fuel fabrication facility, with additional considerations applicable to plutonium in MOX as presented in SSG‑27 (Rev. 1) [4].
Prevention of nuclear criticality	5.48.	The following are recommendations for conducting a criticality analysis for a MOX fuel fabrication facility to meet the safety requirements established in para. 6.144 of SSR‑4 [1]: Enrichment: In criticality calculations, the use of an ‘effective enrichment’⁴ should be avoided unless the validity of the data used can be demonstrated with a high level of confidence. Mass: The mass margin should be sufficient to compensate for possible overbatching of PuO₂ or MOX, or underbatching of UO₂. Geometry: The potential for changes in dimensions (e.g. bulging of slab hoppers) during operational states and accident conditions is required to be considered in accordance with para. 6.144(d) of SSR‑4 [1]. Concentration, density and form of materials (in an analytical laboratory and in liquid effluent units): The analysis should cover a range of (i) plutonium and uranium concentrations for solutions and (ii) powder and pellet densities and moderators for different forms of MOX (e.g. powder, green and sintered pellets, rods) to determine the most reactive conditions that could occur. Moderation: Water, oil and other hydrogenous substances such as additives are common moderators that are present in MOX fuel fabrication facilities or that might be present in accident conditions (e.g. water from firefighting). Special consideration should be given to cases of non‑homogeneous moderation. Reflection: The most conservative margin should be retained of those resulting from different assumptions such as (i) a hypothetical thickness of water around the processing unit and (ii) consideration of the actual neutron reflection effect due, for example, to the presence of human beings, organic materials, shielding materials, or the concrete or steel of the container in or around the processing unit. Consideration should be given to situations where material might be present that could lead to a greater increase of the neutron multiplication factor than in a full water reflection system. Neutron interaction: Consideration should be given to neutron interaction between all facility parts. This includes the minimum distance of mobile units containing UO₂ or PuO₂ and the engineered means for ensuring the minimal distance between equipment containing UO₂ or PuO₂. Neutron absorbers: The neutron absorbers that may be used in MOX fuel fabrication facilities include cadmium and boron, and the safety analysis should incorporate their effect as neutron absorbers; however, ignoring their effects would yield conservative results. The use of mobile neutron absorbers should be avoided. Absorber parameters include thickness, density and nuclide composition of both the absorber material and the hydrogenated material used to increase its absorption efficiency (if applicable).
Prevention of nuclear criticality	5.49.	For processes in which fissile material is handled in a discontinuous manner (i.e. batch processing), the process and the related equipment should be designed to ensure that fissile material is transferred only when the limits defined for the next process are satisfied.
Prevention of nuclear criticality	5.50.	In accordance with para. 6.60 of SSR‑4 [1], postulated initiating events for detailed further analysis from the list of internal and external hazards are required to be identified for MOX fuel fabrication facilities.
Fire and explosion	5.51.	Fire in MOX fuel fabrication facilities might lead to the dispersion of radioactive material by breaching the confinement barriers or might cause a criticality accident by affecting the system or the parameters used for the control of criticality (e.g. the moderation control system or the dimensions of the processing equipment). Special consideration should be given to the fire extinguishing media deployed and their potential moderation effect.
Fire and explosion	5.52.	The fire hazards that are specifically encountered in a MOX fuel fabrication facility are associated with the presence of flammable and combustible materials such as electrical cabling and shielding, in particular when associated with gloveboxes and hydrogen in the sintering furnaces.
Fire and explosion	5.53.	As an important aspect of fire hazard analysis for a MOX fuel fabrication facility, areas of the facility that need special consideration should be identified (see Requirement 22 of SSR‑4 [1]). Fire hazard analyses of the facility should give particular consideration to the following: Areas where fissile material is processed and stored; Gloveboxes, especially those in which nuclear material is processed as powder or powder is produced; Workshops and laboratories in which flammable liquids and/or combustible liquids, solvents and resins and reactive chemicals are used, or zirconium metal is mechanically treated (e.g. producing cuttings or shavings); Areas with high fire loads, such as waste storage areas; Waste treatment areas; Rooms housing safety related equipment, for example items such as air filtering systems, and electrical switch rooms, whose ageing issues might lead to radiological consequences or consequences in terms of criticality that are considered to be unacceptable; Process control rooms and emergency control rooms; Evacuation routes.
Fire and explosion	5.54.	An analysis of fire and explosion is required to be conducted for MOX fuel fabrication facilities to meet Requirement 22 and the requirements established in paras 6.77–6.79 of SSR‑4 [1]. Fire hazard analysis should involve identification of the causes of fires, assessment of the potential consequences of a fire and, where appropriate, estimation of the frequency or probability of occurrence of fires. Fire hazard analysis should be used to assess the inventory of fuels and initiation sources, and to determine the appropriateness and adequacy of measures for fire protection. Computer modelling of fires may sometimes be used in support of the fire hazard analysis.
Fire and explosion	5.55.	The estimation of the likelihood of fires can be used as a basis for making decisions or for identifying weaknesses that might otherwise go undetected. Even if the estimated likelihood of fire may seem low, a fire might have significant consequences for safety, and thus certain protective measures should be undertaken, such as delineating small fire areas, to prevent fires or prevent a fire from spreading.
Fire and explosion	5.56.	The analysis of fire hazards should also involve a review of the provisions made at the design stage for preventing, detecting and mitigating fires.
Fire and explosion	5.57.	Prevention is the most important aspect of fire protection. Facilities should be designed to limit fire risks through the incorporation of measures to ensure that fires do not break out. Measures for mitigation should be put in place to minimize the consequences of a fire in the event that a fire breaks out despite preventive measures.
Fire and explosion	5.58.	To accomplish the twofold aim of fire prevention and mitigation of the consequences of a fire, a number of general and specific measures should be taken, including the following: Minimization of the amount of combustible material present in gloveboxes; nevertheless, it may be necessary to maintain an inert atmosphere and install alarm systems for monitoring oxygen levels to minimize the probability of a large fire. Separation of the areas where non‑radioactive hazardous material is stored from the process areas. Minimization of the fire load of individual rooms. Selection of materials, including building materials, process components and glovebox components and materials for penetrations, in accordance with functional criteria and fire resistance ratings. Compartmentalization of the building and ventilation ducts as far as possible to prevent the spreading of fires. The building should be divided into fire zones and the structural design should take into consideration the respective fire load. Measures should be put in place to prevent or severely curtail the potential for the fire and smoke to generate soot and spread beyond the fire zone in which the fire breaks out. The higher the fire risk, the greater the number of fire zones the building should have. Suppression or limitation of the number of possible ignition sources such as open flames or electrical sparks.
Fire and explosion	5.59.	Paragraph 6.79 of SSR‑4 [1] establishes requirements for the analysis with regard to fire extinguishing systems. Fire extinguishing devices, automatic or manually operated, with the use of an adequate extinguishing agent should be installed in zones where a fire is possible and where the consequences of a fire could lead to the dispersion of plutonium contamination outside the first static barrier. The installation of automatic firefighting devices with water sprays should be avoided for areas where uranium, plutonium and/or mixed oxide might be present, with account taken of the potential for criticality. Extinguishing gas other than carbon dioxide may be used in the event of a fire breaking out in a glovebox. The possible use of carbon dioxide should be considered in the criticality safety assessment.
Fire and explosion	5.60.	A detection and/or suppression system should be installed such that it is commensurate with the risks from internal fires and explosions. This system should be established in compliance with the national requirements.
Fire and explosion	5.61.	The design of ventilation systems should be given particular consideration with regard to fire prevention. Dynamic containment systems comprise ventilation ducts and filter units, which might constitute weak points in the fire protection system unless they are of suitable design. Fire dampers should be mounted in the ventilation system. Spark arrestors should be used to protect the filters if necessary. The required operational performance of the ventilation system should be specified so as to comply with fire protection requirements.
Fire and explosion	5.62.	Lines that cross the boundaries between fire zones (e.g. electricity lines, gas and process lines) should be designed to ensure that fire does not spread.
Fire and explosion	5.63.	In MOX fuel fabrication facilities, the use of hydrogen in the sintering furnaces is a potential cause of explosion. Hydrogen should be diluted with an inert gas (e.g. argon) before it enters the sintering furnace to reduce the likelihood of a hydrogen explosion. The supply of premixed gas should be automatically stopped when the concentration of hydrogen in the premixed gas exceeds a specified limit. The measurement of the concentration of hydrogen in the premixed gas should be subject to quality control. The composition of the premixed gas should be permanently monitored during operation.
Fire and explosion	5.64.	In addition, effective gas locks should be provided between rooms with a hydrogen atmosphere and other areas of the facility. Systems for detecting hydrogen leakages should be installed in rooms with a hydrogen atmosphere.
Fire and explosion	5.65.	The concentration of oxygen within gloveboxes filled with inert gas, presenting a risk of explosion, should be monitored.
Flooding	5.66.	Flooding in a MOX fuel fabrication facility might lead to the dispersion of radioactive material and to changes in the conditions for moderation.
Flooding	5.67.	Gloveboxes should not be connected to the water supply in normal operating conditions.
Flooding	5.68.	In facilities where vessels and/or pipes containing water are present, the criticality analysis should take into account the presence of the maximum credible amount of water that could be contained within the room under consideration, as well as the maximum credible amount of water in any connected rooms. Such rooms or premises should be clearly identified and the personnel should be informed.
Flooding	5.69.	Walls (and floors if necessary) of rooms where flooding could occur should be capable of withstanding the water load, and safety related equipment should not be affected by flooding.
Leaks and spills	5.70.	The amount of liquid present in a MOX fuel fabrication facility is limited. Water is used for cooling sintering furnaces. Possible steam explosions resulting from water entry due to a leak in the cooling system should be considered.
Leaks and spills	5.71.	Spillages might occur outside gloveboxes from cans, drums and waste packages during transit within the facility and/or in storage. Appropriate mechanical protection and appropriate confinement should be provided for movements of radioactive material.
Leaks and spills	5.72.	Where spillages in quantities that could be significant from the standpoint of criticality safety are possible, consideration should be given to installing design features to prevent water or moderator intrusion (e.g. as ingress of water from condensed humidity through ventilation systems). In these areas, installation of humidity detectors and drainage systems should also be considered.
Leaks and spills	5.73.	The surfaces of floors and walls should be chosen to facilitate their cleaning. This will also facilitate the minimization of waste from decommissioning.
Loss of services	5.74.	To meet the requirements established in Requirements 49 and 50 and para. 6.89 of SSR‑4 [1], electric power supplies and other support systems in a MOX fuel fabrication facility should be of high integrity. In the event of loss of normal power and depending on the status of the facility, an emergency power supply should be provided to certain structures, systems and components important to safety, including the following: Criticality accident detection and alarm systems; Ventilation fans and glovebox monitoring systems for the confinement of radioactive material; Detection and alarm systems for leaks of hazardous materials, including explosive gases; Heat removal systems; Emergency control systems; Fire detection and suppression systems; Monitoring systems for radiation protection; Lighting within the process facility.
Loss of services	5.75.	The loss of items such as gas for instrumentation and control, cooling water for process equipment and ventilation systems, heating water, breathing air and compressed air might also have consequences for safety. Examples of suitable measures to be addressed in the design of a MOX fuel fabrication facility to ensure safety include the following: Loss of gas supply to gas actuated safety valves and dampers. In accordance with the safety analysis, valves should be used that are designed to fail to a safe position. Loss of cooling water. Adequate backup capacity or a redundant supply should be provided for in the design. Loss of breathing air. Adequate backup capacity or a redundant supply should be provided to allow work to continue to be performed in areas with airborne radioactive material.
Loss of services	5.76.	MOX materials generate heat due to presence of ²³⁸Pu, and storage rooms, storage gloveboxes and larger production units in MOX fuel fabrication facilities have potentially large heat loads. Overheating might challenge the safety functions.
Loss of services	5.77.	Ventilation systems are designed to provide cooling and to maintain temperatures below specified values. In a MOX fuel fabrication facility, in the event of a failure of the ventilation system, the time interval before the means of confinement are breached should be adequate for repairing the failure or for taking alternative actions. All structures, systems and components important to safety should be designed such that they can withstand heat loads generated during this interval.
Loss or excess of process media	5.78.	The loss of process media such as process gas supplies (e.g. hydrogen, helium, nitrogen, argon) and additives, or any excess of these media, might have consequences for safety. Some examples are the following: Excess of additives in the powder preparation process should be considered in the criticality safety analysis. Increase of levels of airborne contamination and/or concentration of hazardous material in the work areas of the facility because of overpressure in the gloveboxes (containing, for example, nitrogen, argon or helium). Reduction of criticality safety due to loss of favourable geometry or loss of moderation control by excess of process gases. Releases of large amounts of nitrogen, argon or helium might result in a reduction in the oxygen concentration in breathing air in the work areas of the facility. For reasons of fire protection, inert gas may be used for the atmosphere in some gloveboxes. Failure of the gas supply, therefore, would remove one protective barrier. Consideration should be given to the integrity of the gas supply by providing a suitable backup supply or by ensuring diversity of supply.
Handling errors	5.79.	Handling systems (e.g. cranes) should be designed to reduce the frequency of occurrence of load drops. The consequences of possible load drops should be minimized, for example by qualification of the containers for drops, by the design of the floors and/or by the provision of safe travel paths.
Handling errors	5.80.	Mechanical failures or human errors during the handling of radioactive material might result in a degradation of criticality control, confinement or shielding. Mechanical failures or human errors during the handling of loads of non‑radioactive material might also result in a degradation of the safety functions of the MOX fuel fabrication facility.
Facility failures and equipment failures	5.81.	Measures for the industrial safety of commercial grade equipment installed in gloveboxes (e.g. mechanical guards) should be adapted to the nuclear environment.
Facility failures and equipment failures	5.82.	The design should minimize the potential for mechanical impacts on containers of hazardous and/or radioactive material caused by moving devices such as vehicles and cranes.
Facility failures and equipment failures	5.83.	Mechanical failures during the processing of nuclear material could result in damage to equipment (e.g. by crushing, bending or breakage) that might result in a degradation of criticality control, confinement or shielding. The design should ensure that the movement of heavy loads by cranes above vessels and piping containing large amounts of hazardous and/or radioactive material is minimized. For complex or important systems (e.g. rod handling systems designed to avoid the hazard of breaking a rod), a systematic method of failure analysis should be implemented.
Facility failures and equipment failures	5.84.	Failure due to fatigue or chemical corrosion or lack of mechanical strength should be considered in the design of containment systems for hazardous and/or radioactive material.
Facility failures and equipment failures	5.85.	To prevent failure of equipment containing hazardous materials (e.g. furnaces), effective programmes for maintenance, periodic testing and inspection should be established at the design stage (see also paras 5.164 and 5.165).
Radiolysis	5.86.	The irradiation of organic or hydrogenated substances by plutonium, or the resulting decomposition of molecules, might lead to the generation of gas (especially the release of hydrogen) or to the degradation of containment systems. The potential for radiolysis should be taken into account in the safety analysis for the following: Liquid effluents and organic solvents used in the laboratory; Contaminated oils and inflammable waste; Process scraps enclosing hydrogenated additives; Containers or plastic bags containing PuO₂ or MOX.
Radiolysis	5.87.	Pressurization caused by alpha decay generating helium in a sealed system and the potential for water evaporation due to radiolytic heat generation should be considered.
External hazards	5.88.	A MOX fuel fabrication facility should be designed in accordance with the nature and severity of the external hazards, either natural or human induced, identified and evaluated in accordance with the provisions of SSR‑1 [15]. Detailed recommendations on external hazards are provided in IAEA Safety Standards Series Nos SSG‑9 (Rev. 1), Seismic Hazards in Site Evaluation for Nuclear Installations [19]; SSG‑18, Meteorological and Hydrological Hazards in Site Evaluation for Nuclear Installations [20]; SSG‑21, Volcanic Hazards in Site Evaluation for Nuclear Installations [21]; and SSG‑68, Design of Nuclear Installations Against External Events Excluding Earthquakes [22]. Recommendations for specific external hazards for a MOX fuel fabrication facility are provided in paras 5.89–5.104.
Earthquakes	5.89.	To ensure that the design of a MOX fuel fabrication facility provides the required degree of robustness, a detailed seismic assessment (see SSR‑1 [15] and SSG‑9 (Rev. 1) [19]) should be made of the MOX fuel fabrication facility design, including the following seismically induced events: Loss of cooling. Loss of support services, including utilities. Loss of confinement functions (static and dynamic). Loss of safety functions for ensuring the return of the facility to a safe state and maintaining the facility in a safe state after an earthquake, including structural functions and functions for the prevention of other hazards (e.g. fire, explosion, load drop, flooding). Loss of criticality safety controls such as geometry, moderation, absorption and reflection as a result of the following: Deformation (geometry control); Displacement (geometry control, fixed neutron absorbers, neutron interaction); Loss of material (geometry control, soluble neutron absorbers); Ingress of moderating material (moderation control). Deformation (geometry control); Displacement (geometry control, fixed neutron absorbers, neutron interaction); Loss of material (geometry control, soluble neutron absorbers); Ingress of moderating material (moderation control).
Earthquakes	5.90.	A MOX fuel fabrication facility should be designed for the design basis earthquake to ensure that the earthquake will not impair the function of control rooms. Supplementary control rooms or emergency control panels should be accessible and operable by staff after an earthquake exceeding the design basis. Equipment necessary to maintain the MOX fuel fabrication facility in a safe and stable state and equipment necessary to monitor the facility and environment should be tested (as far as practicable) and qualified using appropriate conservative methodologies, including the use of an earthquake simulation platform.
Earthquakes	5.91.	Depending on the site characteristics and location of the MOX fuel fabrication facility, as evaluated in the site assessment (see Section 4), the effect of a tsunami induced by an earthquake and of other extreme flooding events should be addressed in the facility design.
External fires and explosions and external toxic hazards	5.92.	Hazards from external fires and explosions could arise from various sources in the vicinity of a MOX fuel fabrication facility, such as petrochemical installations; forests; pipelines and road, rail or sea routes used for the transport of flammable material such as gas or oil; and volcanic hazards.
External fires and explosions and external toxic hazards	5.93.	To demonstrate that the risks associated with such external hazards are below acceptable levels, the operating organization should first identify all potential sources of hazards and then estimate the associated event sequences affecting the facility. The radiological or associated chemical consequences of any damage should be evaluated, and it should be verified that they are within acceptance criteria. Toxic hazards should be assessed to verify that specific gas concentrations meet the acceptance criteria. It should be ensured that external toxic hazards would not adversely affect the control of the facility. The operating organization should conduct a survey of potentially hazardous installations and transport operations for hazardous material in the vicinity of the facility. In the case of explosions, risks should be assessed for compliance with overpressure criteria.
External fires and explosions and external toxic hazards	5.94.	To evaluate the possible effects of flammable liquids, toxic spills, volcanic ashes, falling objects (such as chimneys), air shock waves and missiles resulting from explosions, their possible distance from the facility and hence their potential for causing physical damage should be assessed.
Extreme meteorological phenomena	5.95.	A MOX fuel fabrication facility should be protected against extreme meteorological conditions as identified in the site evaluation (see Section 4) by means of appropriate design provisions. These should generally include the following: The ability of structures important to safety to withstand extreme weather loads, with particular assessment of parts of the facility structure designed to provide confinement; The ability to maintain the availability of cooling systems under extreme temperatures and other extreme conditions; The prevention of flooding of the facility including adequate means to evacuate water from the roof in cases of extreme rainfall; The safe shutdown of the facility in accordance with the operational limits and conditions, followed by maintaining the facility in a safe and stable shutdown state, where necessary; Events consequential to extreme meteorological conditions.
Extreme meteorological phenomena	5.96.	Measures for the protection of the facility against tornadoes will depend on the meteorological conditions for the area in which the facility is located. The design of buildings and ventilation systems should comply with specific national regulations relating to hazards from tornadoes. If specific national regulations do not exist, the design should adhere to international good practices.
Extreme meteorological phenomena	5.97.	High winds are capable of lifting and propelling objects as large as automobiles or utility poles. The possibility of impacts of tornado missiles such as these should be taken into consideration in the design stage for the facility, as regards both the initial impact and the effects of possible secondary fragments arising from collisions with and spallation from concrete walls or from other types of transfer of momentum.
Extreme meteorological phenomena	5.98.	The potential duration of extreme low or high temperatures should be taken into account in the design of support system equipment to prevent unacceptable effects such as the freezing of cooling circuits or to prevent adverse effects on venting and cooling systems.
Extreme meteorological phenomena	5.99.	If safety limits for humidity or temperature are specified in a building or a compartment, the air‑conditioning system should be designed to perform efficiently, including under extreme hot or wet weather conditions. The effect of condensation inside the facility should also be taken into consideration. Structural components of buildings (as static containment) should also be designed for extreme temperature and humidity and their associated thermal stress effects such as shrinkage in concrete.
Extreme meteorological phenomena	5.100.	The occurrence of snowfall and ice storms and their effects should be taken into account in the design of the facility and the safety analysis. Snow and ice are generally taken into account as an additional load on the roofs of buildings. In addition, snow and ice might impact ventilation systems and electrical equipment outside the buildings. The neutron reflecting effect and/or the interspersed moderation effect of the snow should be considered, if relevant.
Extreme meteorological phenomena	5.101.	For any flood events such as extreme rainfall (for an inland site) or storm surge (for a coastal site) attention should be focused on potential leak paths (breaks in the confinement barrier) into active cells and structures, systems and components important to safety when these are vulnerable to damage. Equipment containing fissile material should be designed to prevent any criticality accident in the event of flooding. Gloveboxes should be designed to be resistant (i.e. to remain undamaged and static) to the dynamic effects of flooding, and all glovebox penetrations should be above any potential flood levels. Electrical systems, instrumentation and control systems, emergency power systems (e.g. batteries, power generation systems) and control rooms should be protected by design.
Extreme meteorological phenomena	5.102.	For extreme rainfall, attention should be focused on the stability of buildings (e.g. hydrostatic and dynamic effects), the water level and, where relevant, the potential for mudslides. Consideration should be given to the highest flood level historically recorded and to siting the facility above this flood level, at sufficient elevation and with sufficient margin to account for uncertainties (e.g. in postulated effects of global warming), to avoid major damage from flooding.
Accidental aircraft crashes	5.103.	In accordance with the risks identified in the site evaluation (see Section 4), a MOX fuel fabrication facility should be designed to withstand the design basis impact.
Accidental aircraft crashes	5.104.	For evaluating the consequences of impacts or the adequacy of the design to resist aircraft impacts, only realistic crash scenarios should be considered, which may demand the knowledge of such factors as the possible angle of impact, velocity of the aircraft or the potential for fire and explosion due to the aviation fuel load. In general, fire cannot be ruled out following an aircraft crash. Therefore, specific requirements for fire protection and for emergency preparedness and response should be established.
Accidental aircraft crashes	5.105.	Instrumentation should be provided to monitor the relevant parameters (e.g. radiation doses due to external exposure, air quality of operational areas, building pressure), systems (e.g. ventilation systems) and general conditions of the facility (e.g. temperature, contamination) over their respective ranges for (a) normal operation, (b) anticipated operational occurrences and (c) accident conditions, to ensure that adequate information can be obtained on the status of the operations and the facility, and proper actions can be undertaken in accordance with operating procedures.
Accidental aircraft crashes	5.106.	Instrumentation should be provided for measuring all the main parameters whose variation might affect the safety of processes (e.g. pressure, temperature, flow rate). In addition, instrumentation should be provided for monitoring general conditions at the facility (e.g. criticality safety related parameters, radiation levels, individual dosimetry for external and internal exposure of personnel, releases of effluents, ventilation conditions), and for obtaining any other information about the facility necessary for its reliable and safe operation (e.g. presence of personnel, environmental conditions).
Accidental aircraft crashes	5.107.	Passive and active engineering controls are more reliable than administrative controls and should be preferred for control in operational states and in accident conditions. Automatic systems should be designed to maintain process parameters within the operational limits and conditions or to bring the process to a predetermined safe state, which for a MOX fuel fabrication facility is generally the shutdown state.
Accidental aircraft crashes	5.108.	Appropriate information should be made available to the operator for monitoring the effects of automatic actions. The layout of instrumentation and the manner of presentation of information should provide the operating personnel with an adequate picture of the status and performance of the facility. Devices should be installed that provide in an efficient manner visual and, as appropriate, audio indications of operational states that have deviated from normal conditions and that could affect safety. Provision should be made for the automatic measurement and recording of values of parameters that are important to safety and, where applicable, manual periodic testing should be used to complement automated continuous testing of conditions.
Control rooms and panels	5.109.	Control rooms and human–machine interface panels should be provided to centralize the availability of information and monitoring of actions. The need for and location of control rooms and panels in different areas should be evaluated taking into account occupational exposure, safety of personnel and emergency response. Where applicable, it may be useful to have dedicated control rooms to allow for the remote monitoring of operations, thereby reducing exposures and risks to personnel. Particular consideration should be given to identifying those events, both internal and external to the control rooms, that might pose a direct threat to the operators and to the operation of control rooms. Ergonomic factors should be taken into account in the design of control rooms and the design of control room displays and systems.
Safety related instrumentation and control systems	5.110.	The safety related instrumentation and control systems of a MOX fuel fabrication facility should include systems for the following: Criticality control, criticality detection and alarm: Depending on the method of criticality control, the control parameters usually include mass, density, moisture content, isotopic composition, fissile content, moderation and reflection of additives, and spacing between items. Radiation detectors (gamma and/or neutron detectors) with audio and, where necessary, visual alarms for initiating immediate evacuation from the affected area, should cover all the areas where a significant quantity of fissile material is present (see para. 6.173 of SSR‑4 [1]). Fire detection and suppression: All rooms with fire loads or significant amounts of fissile and/or toxic chemical material should be equipped with fire alarms. Gas detectors should be used in areas where a leakage of gases (e.g. hydrogen) could produce an explosive atmosphere. Process control: A safety related control system is the means of confirming the correct concentration of hydrogen in the gas supply to the sintering furnaces. Temperatures, pressures, flow rates, concentrations of chemicals and/or radioactive material, and tank levels should be indicated. Monitoring and control of ventilation: Monitoring and control of ventilation is needed to ensure that the airflows in all areas of the MOX fuel fabrication facility are flowing in the correct direction (i.e. toward areas that are more contaminated). In working areas, the temperature and humidity levels and the level of pollutants should be controlled to ensure the comfort of personnel and good levels of hygiene. In some cases, local ventilation should be used (e.g. in rooms housing backup batteries). Monitoring and control of ventilation should be applied in particular in areas where sintering furnaces and pellet grinding equipment are located. Control of occupational radiation exposure: External exposure. Direct reading dosimeters with real time displays and/or alarms should be used to monitor radiation doses to workers, in particular in areas in which inspection equipment such as X ray equipment and radioactive sources are located. Portable equipment and installed equipment should be used to monitor whole body exposures and exposures of the hands to gamma radiation and neutron emissions. Internal exposure. Owing to the specific hazards of airborne plutonium, the following provisions should be considered: Continuous air monitors to detect plutonium should be installed as close as possible to the working areas to ensure the early detection of any dispersion of plutonium. Continuous air‑sampling devices should be installed in the breathing zone of personnel for the retrospective assessment of doses due to internal exposure. Devices for detecting alpha surface contamination should be installed close to the working areas and also close to the exits of rooms in which working areas are located Devices for detecting and assessing doses to the lens of the eye should be installed where appropriate (assessment of doses to the lens of the eye can also be performed by calculation methods). Control of gaseous and liquid effluents: MOX fuel fabrication facilities using dry fabrication processes have low volumes of liquid discharges that can usually be monitored for control purposes by sampling and analysis and by measuring the volumes of discharges. Real time measurements should be provided for continuous discharges. Special arrangements should be made for effluents from laboratories, which can differ from site to site. Real time measurements should be made to confirm that filtration systems are working effectively. The detection and alarm system of abnormal releases should be ensured. Control of transfers of nuclear material. Detection of surface contamination and airborne radioactive material and alarm systems. Glovebox control: Gloveboxes should be equipped with instrumentation and control systems ensuring negative pressure. For gloveboxes containing inert gas, the in‑leakage gas concentration should be monitored for safety and, if necessary, to verify product quality. Temperature levels should also be monitored. Depending on the method of criticality control, the control parameters usually include mass, density, moisture content, isotopic composition, fissile content, moderation and reflection of additives, and spacing between items. Radiation detectors (gamma and/or neutron detectors) with audio and, where necessary, visual alarms for initiating immediate evacuation from the affected area, should cover all the areas where a significant quantity of fissile material is present (see para. 6.173 of SSR‑4 [1]). All rooms with fire loads or significant amounts of fissile and/or toxic chemical material should be equipped with fire alarms. Gas detectors should be used in areas where a leakage of gases (e.g. hydrogen) could produce an explosive atmosphere. A safety related control system is the means of confirming the correct concentration of hydrogen in the gas supply to the sintering furnaces. Temperatures, pressures, flow rates, concentrations of chemicals and/or radioactive material, and tank levels should be indicated. Monitoring and control of ventilation is needed to ensure that the airflows in all areas of the MOX fuel fabrication facility are flowing in the correct direction (i.e. toward areas that are more contaminated). In working areas, the temperature and humidity levels and the level of pollutants should be controlled to ensure the comfort of personnel and good levels of hygiene. In some cases, local ventilation should be used (e.g. in rooms housing backup batteries). Monitoring and control of ventilation should be applied in particular in areas where sintering furnaces and pellet grinding equipment are located. External exposure. Direct reading dosimeters with real time displays and/or alarms should be used to monitor radiation doses to workers, in particular in areas in which inspection equipment such as X ray equipment and radioactive sources are located. Portable equipment and installed equipment should be used to monitor whole body exposures and exposures of the hands to gamma radiation and neutron emissions. Internal exposure. Owing to the specific hazards of airborne plutonium, the following provisions should be considered: Continuous air monitors to detect plutonium should be installed as close as possible to the working areas to ensure the early detection of any dispersion of plutonium. Continuous air‑sampling devices should be installed in the breathing zone of personnel for the retrospective assessment of doses due to internal exposure. Devices for detecting alpha surface contamination should be installed close to the working areas and also close to the exits of rooms in which working areas are located Devices for detecting and assessing doses to the lens of the eye should be installed where appropriate (assessment of doses to the lens of the eye can also be performed by calculation methods). Continuous air monitors to detect plutonium should be installed as close as possible to the working areas to ensure the early detection of any dispersion of plutonium. Continuous air‑sampling devices should be installed in the breathing zone of personnel for the retrospective assessment of doses due to internal exposure. Devices for detecting alpha surface contamination should be installed close to the working areas and also close to the exits of rooms in which working areas are located Devices for detecting and assessing doses to the lens of the eye should be installed where appropriate (assessment of doses to the lens of the eye can also be performed by calculation methods). MOX fuel fabrication facilities using dry fabrication processes have low volumes of liquid discharges that can usually be monitored for control purposes by sampling and analysis and by measuring the volumes of discharges. Real time measurements should be provided for continuous discharges. Special arrangements should be made for effluents from laboratories, which can differ from site to site. Real time measurements should be made to confirm that filtration systems are working effectively. The detection and alarm system of abnormal releases should be ensured. Gloveboxes should be equipped with instrumentation and control systems ensuring negative pressure. For gloveboxes containing inert gas, the in‑leakage gas concentration should be monitored for safety and, if necessary, to verify product quality. Temperature levels should also be monitored.
Safety related instrumentation and control systems	5.111.	The requirements relating to human factors engineering are established in Requirement 27 of SSR‑4 [1].
Safety related instrumentation and control systems	5.112.	Human factors in operation, inspection, periodic testing and maintenance should be considered at the design stage. Human factors to be considered for MOX fuel fabrication facilities should include the following: The ease of intervention by the operator in all facility states; Possible effects on safety of inappropriate or unauthorized human actions (with account taken of tolerance of human error); The potential for occupational exposure.
Safety related instrumentation and control systems	5.113.	The design of the facility to take account of human factors is a specialist area. Experts and experienced operators should be involved from the earliest stages of design. Areas that should be considered include the following: Design of working conditions to ergonomic principles: The operator–process interface, for example electronic control panels displaying all the necessary information and no superfluous information; The working environment, for example ensuring good access to, and adequate space around, equipment and suitable finishes to surfaces for ease of cleaning. Choice of location and clear labelling of equipment to facilitate maintenance, testing, cleaning and replacement. Provision of fail‑safe equipment and automatic control systems for accident sequences for which reliable and rapid protection is required. Good task design and ease of implementing operating procedures, particularly during maintenance work, when automated control systems may be disabled. Minimization of the need to use additional means of personal radiation protection. The criticality mass limit, the actual mass of fissile material and the monitoring thresholds in a glovebox should be visible to the operator. The availability of this information should be considered in case of computer failure. Operating experience feedback relevant to human factors. The operator–process interface, for example electronic control panels displaying all the necessary information and no superfluous information; The working environment, for example ensuring good access to, and adequate space around, equipment and suitable finishes to surfaces for ease of cleaning.
Safety related instrumentation and control systems	5.114.	In the design and operation of gloveboxes, the following specific considerations should be taken into account: In the design of equipment inside gloveboxes, the potential for conventional industrial hazards that might result in injuries to personnel, including internal radiation exposure through cuts in the gloves and/or wounds on the operator’s skin, and/or the possible failure of confinement; Ease of physical access to gloveboxes and adequate space and good visibility in the areas in which gloveboxes are located; The potential for damage to gloves from sharp edges and corners on equipment and fittings and associated tools; Training of operators on procedures to be followed for normal and abnormal conditions.
Safety related instrumentation and control systems	5.115.	Requirement 14 of GSR Part 4 (Rev. 1) [13] states that “The performance of a facility or activity in all operational states and, as necessary, in the post‑operational phase shall be assessed in the safety analysis.” The safety analysis of MOX fuel fabrication facilities should include an analysis of various hazards for the whole facility and all activities.
Safety related instrumentation and control systems	5.116.	The list of postulated initiating events identified should take into account all the internal and external hazards and the resulting event scenarios. The safety analysis should be performed taking into consideration all the structures, systems and components important to safety that might be affected by the postulated initiating events identified.
Safety related instrumentation and control systems	5.117.	For MOX fuel fabrication facilities, the safety analysis should be performed iteratively with the development of the design, with the objectives of achieving the following: That doses to personnel and the public during operational states are within acceptable and operational limits for those states and consistent with the optimization of protection and safety (see Requirements 11 and 12 of GSR Part 3 [17]); That the radiological and chemical consequences of design basis accidents (or equivalent) to the public are within the limits specified for accident conditions and consistent with the optimization of protection and safety (see GSR Part 3 [17]); That appropriate operational limits and conditions are developed.
Safety analysis for operational states	5.118.	A facility specific, realistic, enveloping and robust (i.e. conservative) assessment of internal and external occupational exposure and public exposure during normal operation and anticipated operational occurrences should be performed on the basis of the following: Calculations of the estimated doses due to occupational exposure should be made on the basis of the conditions at the most exposed workplaces, should use maximum annual working times and should account for maintenance activities. Calculations of the envelope source term should be made on the basis of (i) reference isotopic compositions of plutonium and traces of associated transuranic elements and fission products and (ii) the highest specific activities of these radioactive materials. On the basis of data on dose rates collected during commissioning runs and as necessary, the operational limits and conditions may include maximum annual working times for particular workplaces. Calculations of estimated doses to the public should be made on the basis of the maximum estimated releases of radioactive material to the air and to water, the maximum depositions to the ground and direct exposure. Conservative models and parameters should be used to calculate the estimated doses to the public in the initial stages of design, with consideration given to further refinement as appropriate. Calculations of the source term should use the licensed inventories of radioactive material present in each piece of equipment and in each glovebox and storage area. Calculations of the efficiency of shielding during normal operation should be made on the basis of conservative assumptions regarding the performance of shielding. Calculations of the estimated doses due to occupational exposure should be made using the maximum cumulative annual working time at each workplace for operation and anticipated maintenance work.
Safety analysis for operational states	5.119.	A best estimate methodology with the use of adequate margins may also be used in the safety analysis.
Safety analysis for operational states	5.120.	The design of equipment; the layout of equipment in, for example, gloveboxes; and the placement of shielding should be determined on the basis of adequate interaction and feedback between process and mechanical designs, safety assessment and operational experience from similar facilities and/or facilities upstream in the process (e.g. spent fuel reprocessing or plutonium polishing facilities). Cleaning operations (e.g. elimination of heavy dust from gloveboxes) should be given special consideration in the design.
Safety analysis for operational states	5.121.	As soon as plutonium is introduced into the MOX fuel fabrication facility, the calculated doses should be compared with actual dose rates. If considered necessary, maximum permissible annual working times for specific workplaces may be included in the operational limits and conditions.
Methods and assumptions for safety analysis for accident conditions	5.122.	The acceptance criteria associated with the accident analysis should be defined in accordance with Requirement 16 of GSR Part 4 (Rev. 1) [13] and with respect to national regulations and relevant criteria.
Methods and assumptions for safety analysis for accident conditions	5.123.	For a MOX fuel fabrication facility, the consequences of design basis accidents could result in consequences for individuals on the site and close to the location of the accident. The consequences depend on various factors such as the amount and rate of release of radioactive material, the distance between the source of the release and the individuals exposed or affected, the pathways for the transport of material to individuals and the exposure times.
Methods and assumptions for safety analysis for accident conditions	5.124.	To estimate the on‑site and off‑site consequences of an accident, the entire range of physical processes that could lead to a release of radioactive material to the environment or to a loss of shielding should be modelled in the accident analysis and the worst credible consequences should be determined.
Methods and assumptions for safety analysis for accident conditions	5.125.	Accident consequences should be assessed in accordance with the requirements established in GSR Part 4 (Rev. 1) [13] and with relevant parts of its supporting Safety Guides.
Analysis of design extension conditions	5.126.	The safety analysis should identify design extension conditions, and their progression and consequences should be analysed in accordance with Requirement 21 of SSR‑4 [1]. The objective is to identify and analyse additional accident scenarios to be addressed in the design of a MOX fuel fabrication facility. Paragraph 6.74 of SSR‑4 [1] states:
Analysis of design extension conditions	5.127.	Design extension conditions include events more severe than design basis accidents that could originate from extreme events, or combinations of events, which could cause damage to structures, systems and components important to safety or which could challenge the fulfilment of the main safety functions. The postulated initiating events provided in the appendix to SSR‑4 [1] are required to be used, including combinations of initiating events as well as events with additional failures. Accidents that have more severe consequences as well as progressions of events that could potentially lead to radiological or chemical releases should also be analysed to support emergency preparedness and response and assist in the development of emergency plans to mitigate the consequences of an accident.
Analysis of design extension conditions	5.128.	Additional safety features or increased capability of safety systems, identified during the analysis of design extension conditions, should be implemented in the facility where practicable.
Analysis of design extension conditions	5.129.	For analysing design extension conditions, best estimate methods with realistic boundary conditions can be applied. Acceptance criteria for this analysis, in accordance with para. 6.74 of SSR‑4 [1], should be defined by the operating organization and should be reviewed by the national regulatory body.
Analysis of design extension conditions	5.130.	Examples of design extension conditions that are applicable to MOX fuel fabrication facilities can be found in Ref. [23].
Analysis of design extension conditions	5.131.	Analysis of design extension conditions should also demonstrate that the MOX fuel fabrication facility can be brought into a state where the confinement function and subcriticality can be maintained in the long term (see also SSG‑27 (Rev. 1) [4]).
Assessment of possible radiological or associated chemical consequences	5.132.	The main steps for the assessment of possible radiological or chemical consequences in the safety analysis should include the following: Analysis of the actual site conditions (e.g. meteorological, geological and hydrogeological site conditions) and conditions expected in the future, including internal and external initiating events with the potential for adverse effects. Specification of facility design information and facility configurations, with the corresponding operating procedures and administrative controls for operations. Identification of individuals and population groups (for facility personnel and members of the public) who could possibly be affected by radiation risks and/or associated chemical risks arising from the operation of the facility. Identification and analysis of conditions at the facility, including internal and external initiating events that could lead to a release of material or of energy with the potential for adverse effects, the time frame for emissions and the exposure time, in accordance with reasonable scenarios. Quantification of the consequences for the individuals and population groups identified in the safety assessment. Identification and specification of the structures, systems and components important to safety that may be credited to reduce the likelihood and/or to mitigate the consequences of accidents. These structures, systems and components that are credited in the safety assessment should be qualified to perform their functions in accident conditions. Characterization of the source term (e.g. material, mass, release rate, temperature). Identification and analysis of pathways by which material that is released could be dispersed in the environment. Considerations for the interface between safety and nuclear security.
Assessment of possible radiological or associated chemical consequences	5.133.	The analysis of the conditions at the site and the conditions expected in the future involves a review of the meteorological, geological and hydrological conditions at the site that might influence facility operations or might play a part in transporting material or transferring energy that might be released from the facility.
Assessment of possible radiological or associated chemical consequences	5.134.	Environmental transfer of material should be calculated with qualified computer codes or by using data derived from qualified codes, with account taken of the meteorological and hydrological conditions at the site that would result in the highest exposure of the public.
Assessment of possible radiological or associated chemical consequences	5.135.	The identification of personnel and members of the public (i.e. the representative person) who might potentially be affected by an accident involves a review of descriptions of the facility and of demographic information.
Assessment of possible radiological or associated chemical consequences	5.136.	In the assessment of the consequences of design extension conditions, less conservative assumptions compared with those made in the design basis analysis may be used (e.g. on prevailing wind directions on the site).
Assessment of possible radiological or associated chemical consequences	5.137.	The magnitude and severity of conditions considered in design extension conditions as well as the acceptance criteria used for acceptability of consequences of design extension conditions should be approved by the national regulatory body.
Assessment of possible radiological or associated chemical consequences	5.138.	Further recommendations on the assessment of potential radiological impact to the public can be found in GSG‑10 [18]. Useful guidelines for assessing the acute and chronic toxic effects of chemicals used in MOX fuel fabrication facilities are provided in Ref. [24].
Assessment of possible radiological or associated chemical consequences	5.139.	A comprehensive hazard assessment should be performed in accordance with Requirement 4 of IAEA Safety Standards Series No. GSR Part 7, Preparedness and Response for a Nuclear or Radiological Emergency [25], before the commissioning of the facility. The results of the hazard assessment should provide a basis for identifying the emergency preparedness category relevant to the facility and the on‑site areas and, as relevant, off‑site areas where protective actions and other response actions may be warranted in the case of a nuclear or radiological emergency. Further recommendations are provided in IAEA Safety Standards Series No. GS‑G‑2.1, Arrangements for Preparedness for a Nuclear or Radiological Emergency [26].
Assessment of possible radiological or associated chemical consequences	5.140.	The operating organization of a facility is required to establish emergency arrangements that take into account the potential hazards at the facility (see Requirement 72 of SSR‑4 [1]). The emergency plan and procedures and the necessary equipment and provisions should be determined on the basis of selected scenarios for design extension conditions and beyond design basis accidents (or the equivalent). The conditions under which an off‑site emergency response might be required to be initiated should include criticality accidents, widespread fires and earthquakes.
Assessment of possible radiological or associated chemical consequences	5.141.	The general requirements for optimization of protection and safety for waste and effluent management and the formulation of a waste strategy are established in IAEA Safety Standards Series No. GSR Part 5, Predisposal Management of Radioactive Waste [27], and recommendations are provided in IAEA Safety Standards Series Nos GSG‑3, The Safety Case and Safety Assessment for the Predisposal Management of Radioactive Waste [28]; GSG‑1, Classification of Radioactive Waste [29]; SSG‑41, Predisposal Management of Radioactive Waste from Nuclear Fuel Cycle Facilities [30]; and GSG‑16 [11]. Recommendations on aspects that are particularly relevant or specific to MOX fuel fabrication facilities are provided in paras 5.142–5.143.
Assessment of possible radiological or associated chemical consequences	5.142.	In accordance with Requirement 24 of SSR‑4 [1], the generation of radioactive waste is required to be kept to the minimum practicable in terms of both activity and volume, by means of appropriate design measures. Recovery of nuclear material and reuse of chemicals should be applied to the extent practicable in MOX fuel fabrication facilities to minimize the generation of waste in both solid and liquid forms. The main type of waste encountered in MOX fuel fabrication facilities is material contaminated with plutonium (from plutonium oxide or MOX). The following aspects should be considered in the design of MOX fuel fabrication facilities: Generation of waste: The design of the facility should be such as to minimize the amount of materials imported into gloveboxes in order to minimize radioactive waste generation. Appropriate management options (including, as appropriate, disposal routes) should be identified for all waste streams that will be generated, and the design of the facilities should be such as to facilitate waste management. It is possible that segregation of wastes with different properties (including different levels of radioactivity) may be possible at some stages of the process and should be considered in order to facilitate disposal by optimized routes (e.g. removal of uncontaminated outer packaging for disposal separate to plutonium contaminated inner packaging). Removal of waste: Waste should be first bagged in the glovebox and then removed from the glovebox using bagging ports in which a bag is attached to the glovebox and the waste is inserted and then removed after sealing to maintain confinement. The size of the port should be such as to accommodate the expected waste, which may include equipment that has been replaced. Filters from the gloveboxes and the ventilation system should be packed using appropriate radioactive waste containers. First stage aerosol filters should be recycled to return nuclear material to production. Collection of waste: For the assessment and management of waste contaminated with plutonium, provision should be made for a central waste management area. In this central area, waste should be monitored for its plutonium content and may be treated and placed in containers for interim storage. Design features for the collection and transport of waste should be such as to reduce the potential for dropping bags of waste. An indicative measurement or qualified estimate of fissile material mass in a waste package should be made before the package is moved to the central waste management area to ensure criticality safety. Design features should be provided for the collection and transport of waste in containers to provide an additional level of confinement. Consideration should be given to criticality control and radiation exposure of the personnel when a number of bags of waste are collected. Interim storage of waste: Subsequent treatment outside the MOX fuel fabrication facility may include conditioning, compaction and washing of the waste before its long term storage. The design of the facility should be such as to minimize the amount of materials imported into gloveboxes in order to minimize radioactive waste generation. Appropriate management options (including, as appropriate, disposal routes) should be identified for all waste streams that will be generated, and the design of the facilities should be such as to facilitate waste management. It is possible that segregation of wastes with different properties (including different levels of radioactivity) may be possible at some stages of the process and should be considered in order to facilitate disposal by optimized routes (e.g. removal of uncontaminated outer packaging for disposal separate to plutonium contaminated inner packaging). Waste should be first bagged in the glovebox and then removed from the glovebox using bagging ports in which a bag is attached to the glovebox and the waste is inserted and then removed after sealing to maintain confinement. The size of the port should be such as to accommodate the expected waste, which may include equipment that has been replaced. Filters from the gloveboxes and the ventilation system should be packed using appropriate radioactive waste containers. First stage aerosol filters should be recycled to return nuclear material to production. For the assessment and management of waste contaminated with plutonium, provision should be made for a central waste management area. In this central area, waste should be monitored for its plutonium content and may be treated and placed in containers for interim storage. Design features for the collection and transport of waste should be such as to reduce the potential for dropping bags of waste. An indicative measurement or qualified estimate of fissile material mass in a waste package should be made before the package is moved to the central waste management area to ensure criticality safety. Design features should be provided for the collection and transport of waste in containers to provide an additional level of confinement. Consideration should be given to criticality control and radiation exposure of the personnel when a number of bags of waste are collected.
Assessment of possible radiological or associated chemical consequences	5.143.	Appropriate quality controls should be applied throughout the management of waste from all waste streams. Recommendations on the management system for radioactive waste management are provided in GSG‑16 [11].
Assessment of possible radiological or associated chemical consequences	5.144.	MOX fuel fabrication facilities should be designed so that the need for discharges is avoided. If discharges cannot be avoided, the operating organization should ensure that discharge limits can be met in normal operation and that accidental releases to the environment are prevented.
Assessment of possible radiological or associated chemical consequences	5.145.	Liquid effluents to be discharged to the environment should be monitored, treated and managed as necessary to reduce the discharges of radioactive material and hazardous chemicals.
Assessment of possible radiological or associated chemical consequences	5.146.	Where necessary, equipment should be installed to reveal potential failure of treatment systems, such as differential pressure gauges to identify failed filters. If required by the safety analysis or the relevant authorization, discharge monitoring should be provided via continuous sampling of the activity in the liquid or gas, coupled with continuous measurement of the discharge flow rate.
Assessment of possible radiological or associated chemical consequences	5.147.	MOX fuel fabrication facilities which use dry processes generate dust. The gaseous effluent discharges from MOX fuel fabrication facilities should be reduced by filtration, which normally consists of a number of HEPA filters in series.
Customer specifications on fuel characteristics	5.148.	Customer specifications on fuel characteristics that have implications for safety in the design and operation of MOX fuel fabrication facilities (e.g. criticality, shielding, thermal effects) should be taken into account at an early stage in the design of the facility and equipment, especially in the specifications for the plutonium content and anticipated or conservatively bounding isotopic vector as input and the specifications for MOX fuel assemblies as output.
Gloveboxes	5.149.	Gloveboxes should be designed to facilitate the use of dry methods of cleaning (e.g. with vacuum cleaners).
Radiation protection and shielding	5.150.	Plutonium oxide and MOX can generate significant dose rates depending on the isotopic composition of the material processed. MOX from higher burnup plutonium oxide can give rise to significant neutron dose rates, while the presence of ²⁴¹Am (a decay product of²⁴¹Pu) can give rise to gamma radiation. Uranium oxide from reprocessing may also contain residual fission products and ²³²U with its decay products that give rise to beta and gamma radiation.
Radiation protection and shielding	5.151.	As unwanted accumulation of plutonium powder along the process might lead to high dose rates to personnel performing maintenance, the design of process lines should allow periodic inspection and cleaning of the systems in order to lower the ambient dose rate.
Radiation protection and shielding	5.152.	As there might be significant dose rates in areas of the MOX fuel fabrication facility occupied by personnel, consideration should be given at the design stage to the need for neutron and gamma shielding.
Radiation protection and shielding	5.153.	Effective shielding from 60 keV gamma radiation from ²⁴¹Am and from neutron emissions may be applied to the faces of gloveboxes, but this can restrict visibility and thus lead to increased occupancy periods at the glovebox by personnel. The type of shielding should therefore be selected on the basis of the estimated total doses due to occupational exposure during normal operation and maintenance.
Intermediate storage of MOX and plutonium oxide	5.154.	Plutonium oxide may be stored in MOX fuel fabrication facilities pending its processing. MOX may be stored at intermediate stages in the process as powder, pellets, rods or assemblies. The necessary storage capacity should be determined by process buffer quantities.
Modularization	5.155.	To facilitate the construction and commissioning of a MOX facility to meet Requirement 29 of SSR‑4 [1], the modularization of structures, systems and components should be considered. Modularization enables manufacturers of structures, systems and components to preassemble parts of the production line out of the facility site in better space conditions and using specific tools and equipment, and to perform initial tests of the structures, systems and components. This helps the installation on the site and reduces manufacturing deficiencies of the structures, systems and components before their transport to the facility site.
Modularization	5.156.	The design should consider using a limited number of types of modules, as well as combining modules for different purposes, so as to reduce the complexity of the structures, systems and components in order to achieve a lower frequency of maintenance activities and reduced doses to workers (see Requirement 36 of SSR‑4 [1]).
Maintenance policy	5.157.	The maintenance policy should cover the following aspects: Consideration of whether maintenance should be performed by remote operation or manually by using gloves. This may vary for different stages in the process. Criticality safety conditions such as limitations on the introduction of liquids, solvents, plastics and other moderators. Prevention of contamination when replacing equipment (e.g. motors and drives may be located outside gloveboxes). Limitation and removal of dust. Gloveboxes might become dusty unless cleaned regularly. A dusty environment might reduce visibility and might increase the whole body exposure and the occupational hand exposure (when hands are placed in dusty gloves). Loss of shielding material. Shielding on gloveboxes is often provided for normal process operations and may need to be removed for access for maintenance. Ideally, it should be possible to remove the source before removing the shielding. The design should avoid, where possible, sharp edges and the need for sharp equipment in gloveboxes to minimize the potential for causing wounds that could become contaminated.
Design provisions for on‑site transfer of radioactive material and hazardous materials	5.158.	Requirements for control over the transfer of radioactive material and other hazardous materials are established in Requirement 28 and paras 6.111 and 6.112 of SSR‑4 [1].
Design provisions for on‑site transfer of radioactive material and hazardous materials	5.159.	The design of the facility and the production processes should take into account the number of on‑site transfers of radioactive material across different safety related zones (e.g. contamination and criticality controlled areas).
Design provisions for on‑site transfer of radioactive material and hazardous materials	5.160.	For incoming containers containing radioactive material, sufficient technical provisions for checking the integrity should be considered during the design stage.
Design provisions for on‑site transfer of radioactive material and hazardous materials	5.161.	All containers used for transfer of radioactive material on the site should be considered in the safety analysis.
Design provisions for on‑site transfer of radioactive material and hazardous materials	5.162.	For cases where misidentification of containers could pose a hazard, provisions for easy identification of the content should be used (e.g. use of unique colours, shapes and/or valves).
Design provisions for on‑site transfer of radioactive material and hazardous materials	5.163.	Technical provisions for inspection and maintenance of containers that are classified as items important to safety should be available. All containers should be controlled by a computer based system (e.g. to monitor the actual status, position and technical conditions of the containers).
Design provisions for on‑site transfer of radioactive material and hazardous materials	5.164.	The analyses of handling arrangements should cover the following: Transport routes and intersections within the facility; Technical limits of the transport vehicles; Handling failures during transport.
Design provisions for decontamination and decommissioning	5.165.	To facilitate the decontamination and decommissioning of the facility, surface areas of the MOX fuel fabrication facility where there might be contamination should be non‑porous and easy to clean. This may be achieved by applying special coatings to surfaces and ensuring that no areas are difficult to access. In addition, all surfaces that could become contaminated should be made readily accessible to allow for periodic and incidental decontamination.
Design provisions for decontamination and decommissioning	5.166.	The design should allow dismantling of the equipment within gloveboxes rather than using destructive techniques during decommissioning.
Design provisions for decontamination and decommissioning	5.167.	In accordance with Requirement 32 of SSR‑4 [1], the design of the facility is required to take into account the ageing effects of systems, structures and components important to safety to ensure their reliability and availability during the lifetime of the facility.
Design provisions for decontamination and decommissioning	5.168.	The design should allow all systems, structures and components important to safety to be easily inspected in order to detect their ageing (static containment deterioration, corrosion) and to allow their maintenance or replacement if needed.
Design provisions for decontamination and decommissioning	5.169.	An ageing management programme should be implemented at the design stage to ensure that provisions are in place for anticipating equipment replacements.
Design provisions for decontamination and decommissioning	6.1.	Requirements for the construction of MOX fuel fabrication facilities are established in Requirement 53 and paras 7.1–7.7 of SSR‑4 [1]. General recommendations on the construction and construction management of nuclear installations are provided in IAEA Safety Standards Series No. SSG‑38, Construction for Nuclear Installations [31].
Design provisions for decontamination and decommissioning	6.2.	MOX fuel fabrication facilities are complex facilities, and regulatory body authorization should be sought in several stages. Each stage may have a hold point at which approval by the regulatory body may be necessary before the subsequent stage may be commenced (para. 7.2 of SSR‑4 [1]). In addition to the construction programme (see Requirement 53 of SSR‑4 [1]) and the management process by which the operating organization maintains control over construction, frequent visits by the regulatory body to the construction site should be used to provide feedback of information to the construction contractor to prevent future operational problems.
Design provisions for decontamination and decommissioning	6.3.	MOX fuel fabrication facilities are complex mechanically and, as such, modularized components should be considered in their construction. This enables equipment to be tested and proven at manufacturers’ premises before its installation at the MOX fuel fabrication facility (see para. 5.154). This will also aid in the commissioning, maintenance and decommissioning of the facility.
Design provisions for decontamination and decommissioning	6.4.	Components and cables in a MOX fuel fabrication facility should be clearly labelled, owing to the complexity of the control systems.
Design provisions for decontamination and decommissioning	6.5.	Preferably, construction work should be completed before commissioning of the facility or its parts. In cases where the construction and commissioning or operational stages overlap, the appropriate precautions should be considered in order to minimize potential adverse impact of construction activities on safety. Consideration should also be given to the protection of equipment that has already been installed.
Design provisions for decontamination and decommissioning	6.6.	All structures and components, after their installation, should be properly cleaned and painted with suitable primer followed by appropriate surface treatment.
Design provisions for decontamination and decommissioning	6.7.	The effects of nearby activities handling corrosive substances should also be considered.
Design provisions for decontamination and decommissioning	6.8.	Contractors engaged in the construction work should be properly assessed for their integrity and competency in adhering strictly to design requirements and quality requirements to ensure the future safety of the facility.
Design provisions for decontamination and decommissioning	7.1.	The requirements for commissioning are established in Requirement 54 and paras 8.1–8.23 and 8.27 of SSR‑4 [1].
Design provisions for decontamination and decommissioning	7.2.	The operating organization should make the best use of the commissioning stage to become completely familiar with the facility. This stage should also be an opportunity to promote and further enhance safety culture, including positive behaviours and attitudes, throughout the entire organization.
Design provisions for decontamination and decommissioning	7.3.	The commissioning should be divided into two main stages: cold (or ‘inactive’) commissioning and hot (or ‘active’) commissioning (see paras 8.14–8.18 of SSR‑4 [1]). For a MOX fuel fabrication facility the hot commissioning stage should be further divided into uranium commissioning and plutonium commissioning: Cold commissioning: In this stage, the facility’s systems are systematically tested, both individual items of equipment and the systems in their entirety. Initial testing of normal operation should be conducted. This might require regulatory authorization to use radiation sources. As much verification and testing as possible should be performed because of the relative ease of taking corrective actions in this stage. Any modifications to structures, systems and components important to safety should be reported to the regulatory body. Testing of the effectiveness of the static confinement and dynamic confinement should be undertaken and approved by the competent authority, and baseline performance data should be recorded. In this stage, the operating organization should prepare the set of operational documents and should train the personnel in the safety requirements, operating procedures (including those for maintenance) and emergency procedures. At the end of this stage, the operating organization should provide to the regulatory body evidence of conformity of the facility to design requirements and safety requirements and operational readiness for uranium commissioning. Hot commissioning: Uranium commissioning: Natural or depleted uranium should be used in this stage to avoid criticality risks, to minimize doses due to occupational exposure and to limit possible needs for decontamination. This stage also provides the opportunity to initiate the radiation protection control regimes that will be necessary when plutonium is introduced. Testing of neutron monitors and other radiation detectors should be conducted (with sources, if necessary) before or at the beginning of this stage. Safety tests performed during this commissioning period should cover confinement checking, control of movement of material and final balancing of dynamic confinement. This should include (i) checks for airborne radioactive material and checks of levels of exposure at the workplace; (ii) smear sampling of surfaces; (iii) checks for gaseous and liquid discharges; and (iv) checks for the unexpected accumulation of material. At the end of this stage, the operating organization should provide evidence to the regulatory body that the facility is ready to conduct safe commissioning with plutonium, ensuring the required level of radiation protection and criticality safety. Plutonium commissioning: This stage enables the process to be progressively, and cautiously, brought into full operation by addition of plutonium to the process in stages. Additional checks of radiation exposure and heat loading should be made. Uranium commissioning: Natural or depleted uranium should be used in this stage to avoid criticality risks, to minimize doses due to occupational exposure and to limit possible needs for decontamination. This stage also provides the opportunity to initiate the radiation protection control regimes that will be necessary when plutonium is introduced. Testing of neutron monitors and other radiation detectors should be conducted (with sources, if necessary) before or at the beginning of this stage. Safety tests performed during this commissioning period should cover confinement checking, control of movement of material and final balancing of dynamic confinement. This should include (i) checks for airborne radioactive material and checks of levels of exposure at the workplace; (ii) smear sampling of surfaces; (iii) checks for gaseous and liquid discharges; and (iv) checks for the unexpected accumulation of material. At the end of this stage, the operating organization should provide evidence to the regulatory body that the facility is ready to conduct safe commissioning with plutonium, ensuring the required level of radiation protection and criticality safety. Plutonium commissioning: This stage enables the process to be progressively, and cautiously, brought into full operation by addition of plutonium to the process in stages. Additional checks of radiation exposure and heat loading should be made.
Design provisions for decontamination and decommissioning	7.4.	During inactive commissioning, the operating organization should verify (by a ‘smoke test’ or other equivalent method) that the location of key radiological instruments is correctly designed (i.e. that the airflows within the facility are as estimated by the calculations during the design stage).
Design provisions for decontamination and decommissioning	7.5.	During commissioning and later during operation of the facility, the estimated doses to personnel that were calculated should be assessed against actual dose rates. If, in operation, the actual doses are higher than the calculated doses, corrective actions should be implemented, including making any necessary changes to the licensing documentation (i.e. the safety analysis report) or adding or changing safety features or work practices (see also Section 8).
Design provisions for decontamination and decommissioning	7.6.	To minimize the contamination of equipment during commissioning, process testing with uranium should be used where necessary to evaluate the performance of instruments for the detection of radiation or processes for the removal of uranium.
Design provisions for decontamination and decommissioning	7.7.	The licence to operate the MOX fuel fabrication facility is generally issued to the operating organization just before the stage of plutonium commissioning. In this case, plutonium commissioning will be performed under the responsibility, safety procedures and organization of the operating organization. It may be considered part of the operational stage of the MOX fuel fabrication facility.
Design provisions for decontamination and decommissioning	7.8.	Sufficient operating personnel, suitably qualified and with the necessary training, should be available at each stage of the commissioning.
Design provisions for decontamination and decommissioning	7.9.	All processes and equipment associated with the operation of a MOX fuel fabrication facility (e.g. waste management processes) should be commissioned using appropriate procedures during the facility commissioning. The purpose is to demonstrate that these processes operate as demonstrated in the safety analysis.
Design provisions for decontamination and decommissioning	7.10.	Where possible, lessons identified from the commissioning and operation of similar MOX fuel fabrication facilities should be sought out and applied.
Design provisions for decontamination and decommissioning	8.1.	The main hazards of a MOX fuel fabrication facility described in Section 2 should be taken into account in meeting the safety requirements for operation established in section 9 of SSR‑4 [1].
Design provisions for decontamination and decommissioning	8.2.
Design provisions for decontamination and decommissioning		In a MOX fuel fabrication facility many individual processes are performed with full automation, which helps to reduce human interaction with radioactive material. Because of this, more emphasis is placed on administrative measures, monitoring and preventive maintenance to ensure safe operation.
Design provisions for decontamination and decommissioning	8.3.	The internal safety committee in a MOX fuel fabrication facility should be created from the safety committee established for commissioning (see para. 4.29 of SSR‑4 [1]). Its function should be specified in the management system, and it should be adequately staffed. The committee should include diverse expertise and should have appropriate independence from the direct line management of the operating organization (see also para. 3.27).
Design provisions for decontamination and decommissioning	8.4.	Requirement 56 of SSR‑4 [1] states that “The operating organization shall ensure that the nuclear fuel cycle facility is staffed with competent managers and sufficient qualified personnel for the safe operation of the facility.”
Design provisions for decontamination and decommissioning	8.5.	Paragraph 9.16 of SSR‑4 [1] states that “A detailed programme for the operation and utilization of the nuclear fuel cycle facility shall be prepared in advance and shall be subject to the approval of senior management.” The programme for the operation and utilization of a MOX fuel fabrication facility should be periodically reviewed and updated to ensure that it is consistent with and supports long term objectives. The staffing should address the development of professional and managerial skills and experience, and should take into account losses of personnel and their knowledge due to retirement and other reasons. The long term staffing plan should allow sufficient time for the transfer of responsibilities to new personnel and thereby facilitate continuity in the conduct of duties.
Design provisions for decontamination and decommissioning	8.6.	The staffing of a MOX fuel fabrication facility should be based on the functions and responsibilities of the operating organization. A detailed analysis of tasks and activities to be performed should be made to determine the staffing and qualification needs at different levels in the organization. This analysis should also be used to determine the recruitment, training and retraining needs for the facility.
Design provisions for decontamination and decommissioning	8.7.	The operating organization should establish the necessary arrangements to ensure the safety of personnel and the safe operation of a MOX fuel fabrication facility during situations in which a large number of personnel might be unavailable, such as during an epidemic or a pandemic affecting areas in which personnel live. Such arrangements should include the following: Retaining a minimum number of qualified personnel on the site to ensure safe operation of the facility; Ensuring that a minimum number of qualified backup personnel remain available off the site; Establishing additional measures to prevent the spread of an infection on the site, in accordance with national and international guidance (e.g. enabling remote working for non‑essential personnel).
Design provisions for decontamination and decommissioning	8.8.	The safety requirements relating to the qualification and training of facility personnel are established in Requirements 56 and 58 of SSR‑4 [1]. Further recommendations are provided in paras 4.6–4.25 of GS‑G‑3.1 [9].
Design provisions for decontamination and decommissioning	8.9.	Personnel should periodically be provided with basic training in criticality safety and radiation safety, and emphasis should be placed on protection from radiation exposure, criticality control, and emergency preparedness and response.
Design provisions for decontamination and decommissioning	8.10.	The safety risks for operators, maintenance personnel and other personnel, such as the decontamination team, should be carefully considered when establishing the training programme. In particular, all personnel handling fissile material should have a sound understanding of radiation protection, criticality safety and the relevant physical phenomena.
Design provisions for decontamination and decommissioning	8.11.	The training of all levels of management should be considered. Personnel involved in the management and operation of the facility should understand the range of hazards present at the MOX fuel fabrication facility at a level of detail consistent with their level of responsibility.
Design provisions for decontamination and decommissioning	8.12.	Comprehensive training should cover both automatic operations and manual operations. Dedicated training facilities should be established as necessary, with the training emphasis on activities according to their potential safety consequences.
Design provisions for decontamination and decommissioning	8.13.	For manual activities, training should include the following: Maintenance, cleaning activities and project activities that may involve intervention in the active parts of the facility and/or changes to the facility configuration; Work within gloveboxes, glove changes and glovebox posting activities; Decontamination, preparation of work areas, erection and dismantling of temporary enclosures, and waste handling; Procedures for passing barriers, personnel self‑monitoring for contamination and the use of personal protective equipment; Response actions to be undertaken in situations that are outside normal operation (including emergency response actions).
Design provisions for decontamination and decommissioning	8.14.	For automatic modes of operation, training should include the following: Comprehensive training for the control room; The response to alarms; Alertness to the possibility of failures, malfunctions and errors in automatic and remote systems; Alertness to unexpected changes (or lack of changes) in key parameters; Response actions to be undertaken in situations that are outside normal operation (including emergency response actions).
Design provisions for decontamination and decommissioning	8.15.	Complementary training of safety personnel and security personnel and their mutual participation in exercises of both types should be part of the training programme to effectively manage the interface between safety and security. In particular, personnel with responsibilities and expertise in safety analysis and safety assessment should be provided with a working knowledge of the security requirements of the facility, and security experts should be provided with a working knowledge of the safety considerations of the facility, so that potential conflicts between safety and security can be resolved effectively.
Design provisions for decontamination and decommissioning	8.16.	Requirement 57 and paras 9.27–9.37 of SSR‑4 [1] require that operational limits and conditions be developed for a MOX fuel fabrication facility. The safety significance of the operational limits and conditions as well as of the action levels and conditions should be well understood by the personnel operating the facility. The set of action levels should be defined and maintained by the operating organization.
Design provisions for decontamination and decommissioning	8.17.	Since the number of operational limits and conditions may be large for a MOX fuel fabrication facility, these could be grouped by topic or activity. Examples of structures, systems and components that may be used when defining operational limits and conditions for each process area are presented in Annex II.
Design provisions for decontamination and decommissioning	8.18.	Close attention should be paid to the prevention of events during non‑routine operations and secondary operations such as decontamination, washing and preparation for maintenance or testing.
Design provisions for decontamination and decommissioning	8.19.	Operational documentation should be prepared that lists all the operational limits and conditions under which the facility is operated. Annex III gives examples of parameters that can be used for defining the operational limits and conditions in the various processing areas of the facility.
Design provisions for decontamination and decommissioning	8.20.	In accordance with para. 9.31 of SSR‑4 [1], limits on operating parameters are required to be established for safe operation of a MOX fuel fabrication facility. Examples of such limits are the following: The allowed ranges of the isotopic composition of plutonium oxide and the content of ²⁴¹Am especially at, but not limited to, the plutonium or MOX receipt stage; The maximum plutonium oxide content allowed for the different steps in the process; The maximum specific heat loads; The maximum allowed throughputs and inventories for the facility; The maximum quantities of additives allowed at different steps in the process; The maximum quantities of liquid moderator allowed at different steps in the process; The maximum concentration of hydrogen allowed in the atmosphere of sintering furnaces; The maximum concentrations of oxygen and moisture in gloveboxes; The maximum quantities of nuclear material deviating from the process balance (allowed loss rates).
Design provisions for decontamination and decommissioning	8.21.	The following are examples of administrative controls for safe operation (see para. 9.36 of SSR‑4 [1]) for a MOX fuel fabrication facility: Minimum staffing on shift; Availability of specific expertise (e.g. criticality expert, radiation protection expert) at all times when the facility is in operation; Minimum and maximum number of persons working at a glovebox.
Design provisions for decontamination and decommissioning	8.22.	Consideration should be given to ensuring that plutonium and uranium, especially in the form of powder or pellets, are present only in areas designed for the storage or handling of plutonium and uranium. To meet the requirements established in Requirement 64 and in para. 6.121 of SSR‑4 [1], programmes should be put in place for routine monitoring of surface contamination and airborne contamination, and for ensuring an adequate level of housekeeping. Areas with higher dose rates (e.g. those around gloveboxes) should be clearly delineated and, where practicable, additional barriers should be provided when operations in these areas are not in progress.
Design provisions for decontamination and decommissioning	8.23.	In a MOX fuel fabrication facility, the safe state of the process attained after any anticipated operational occurrence is often the shutdown state. However, some systems, such as the criticality detection and alarm system, the radiation detection and alarm system, and the ventilation system used for confinement, should continue to operate.
Design provisions for decontamination and decommissioning	8.24.	Operating procedures should be developed to control process operations directly. The procedures should include directions for attaining a safe state of the facility for all anticipated operational occurrences and accident conditions. Procedures of this type should include the actions needed to ensure criticality safety, fire protection, emergency preparedness and environmental protection.
Design provisions for decontamination and decommissioning	8.25.	The operating procedures for the ventilation system should be specified for fire conditions, and periodic testing of the ventilation system and fire drills should be performed.
Design provisions for decontamination and decommissioning	8.26.	Procedures should be developed for planned outages of production needed for activities such as inventory checking, maintenance, cleaning equipment of fissile materials and other operational needs. These procedures should specify systems for ensuring fissile materials are returned to their safe locations. The duration of scheduled activities and relevant compensatory measures should be specified in the procedures.
Design provisions for decontamination and decommissioning	8.27.	To meet Requirement 64 of SSR‑4 [1], the following practices should be followed to establish and maintain a high standard of housekeeping in a MOX fuel fabrication facility: Prevent the accumulation of materials and tools in gloveboxes; Prevent the accumulation of nuclear material in gloveboxes; Control the amount of radioactive material in gloveboxes in accordance with the principle of optimization of protection; Prevent the accumulation of flammable materials anywhere in the building (tissues, gloves, cloths, oils, general waste); Prevent the accumulation of waste inside and outside gloveboxes; Maintain notices and warning signs in good condition; Maintain high standards of cleanliness; Develop a baseline condition for each workplace by photographs (or equivalent means) ensuring that its condition can be maintained.
Design provisions for decontamination and decommissioning	8.28.	The safety requirements relating to maintenance, calibration, periodic testing and inspection of MOX fuel fabrication facilities are established in Requirement 65 and paras 9.74–9.82 of SSR‑4 [1].
Design provisions for decontamination and decommissioning	8.29.	All maintenance activities in a MOX fuel fabrication facility should be pre‑authorized on the basis of a safety report or safety assessment in line with the established management system.
Design provisions for decontamination and decommissioning	8.30.	Before any maintenance activities are undertaken, consideration should be given to radiological checks of the work areas, the need for decontamination and the need for periodic surveys during the period of maintenance and before return to service.
Design provisions for decontamination and decommissioning	8.31.	Before maintenance is performed in areas where fissile material is located, criticality safety personnel should be consulted (see also para. 5.54 of SSG‑27 (Rev. 1) [4]).
Design provisions for decontamination and decommissioning	8.32.	Maintenance should follow good practices, with particular consideration given to the following: Work control (e.g. handover and handing back of documents, visits to job sites, changes to the planned scope of work, suspension of work, ensuring safe access). Equipment isolation (e.g. disconnection of electrical cabling and heat and pressure piping, venting and purging of equipment). Testing and monitoring (e.g. checks before commencing work, monitoring during maintenance, checks for recommissioning). Safety precautions for work (e.g. specification of safety precautions, ensuring the availability of fully functional personal protective equipment and ensuring its use, emergency response procedures). Reinstallation of equipment (e.g. reassembly, reconnection of pipes and cables, testing, cleaning of job site, monitoring after recommissioning). Verification that, after maintenance is performed, the work area and equipment have been restored to normal safe conditions. Pressure drops across banks of air filters should be checked and recorded on a routine basis. Particular attention should be paid to gloves to ensure the detection of any degradation of glove material.
Design provisions for decontamination and decommissioning	8.33.	Periodic testing of fire detection and suppression systems for gloveboxes should be performed.
Design provisions for decontamination and decommissioning	8.34.	All temporary changes to the facility configuration during maintenance activities should be coordinated between safety specialists and security specialists to avoid potential conflicts (e.g. loss of electrical power supply on some safety systems, opening of barriers and doors). Compensatory measures should be implemented as necessary.
Design provisions for decontamination and decommissioning	8.35.	Compliance of the operational performance of the ventilation system with the fire protection requirements (see para. 5.61) should be verified on a regular basis.
Design provisions for decontamination and decommissioning	8.36.	The operating organization should have a system in place which ensures that the information and experience gained through maintenance activities is collected, recorded, analysed and utilized in the operating experience feedback programme.
Design provisions for decontamination and decommissioning	8.37.	A programme of periodic inspections of the facility should be established. Its purpose is to verify that the facility and its structures, systems and components are operating in accordance with the operational limits and conditions. Suitably qualified and experienced persons should perform these inspections.
Design provisions for decontamination and decommissioning	8.38.	Places in the process line identified by the operating organization as those with potential for accumulation of uranium and/or plutonium compounds should be periodically inspected.
Design provisions for decontamination and decommissioning	8.39.	The operating organization should take into account the following in implementing an ageing management programme in accordance with Requirement 60 of SSR‑4 [1]: Ensuring support for the ageing management programme by the management of the operating organization; Ensuring early implementation of an ageing management programme; Following a proactive approach based on an adequate understanding of the ageing of structures, systems and components, rather than a reactive approach responding to failures of structures, systems and components; Ensuring optimal operation of structures, systems and components to slow down the rate of ageing degradation; Ensuring the proper implementation of maintenance and testing activities in accordance with operational limits and conditions, design requirements and manufacturers’ recommendations, and following approved operating procedures; Minimizing human performance factors that might lead to premature degradation, through enhancement of personnel motivation, sense of ownership and awareness, and understanding of the basic concepts of ageing management; Ensuring availability and use of correct operating procedures, tools and materials, and of a sufficient number of qualified staff for a given task; Collecting operating experience feedback to learn from relevant ageing related events.
Design provisions for decontamination and decommissioning	8.40.	The ageing management programme should consider the physical as well as the non‑physical aspects of ageing, and its effectiveness should be regularly assessed and reviewed.
Design provisions for decontamination and decommissioning	8.41.	The periodic tests and inspections should be completed by regular checks performed by the operating personnel, such as the following: Monitoring of deterioration; Regular visual inspections of structures, systems and components (e.g. UO₂ and PuO₂ powder pipes); Monitoring of operating conditions (e.g. taking heat images of electrical cabinets, checking temperatures of ventilator bearings).
Design provisions for decontamination and decommissioning	8.42.	Requirement 61 of SSR‑4 [1] states that “The operating organization shall establish and implement a programme for the control of modifications to the facility.” The management system of a MOX fuel fabrication facility should include a standard process for all modifications (see para. 3.20). The work control system, quality assurance procedures and appropriate testing procedures of the facility should be used for the implementation of modifications.
Design provisions for decontamination and decommissioning	8.43.	The operating organization should prepare procedural guidelines and provide training to ensure that the responsible personnel have the necessary training and authority to ensure that modification projects are carefully considered (see paras 9.57(e) and 9.58 of SSR‑4 [1]). The safety of modifications should be assessed for potential hazards during installation, commissioning and operation. Decision making relating to modifications should be conservative.
Design provisions for decontamination and decommissioning	8.44.	Proposed modifications should be scrutinized by, and be subject to approval by, qualified and experienced persons to verify that the arguments used to demonstrate safety are suitably robust. This is considered particularly important if the modification could have an effect on criticality safety.
Design provisions for decontamination and decommissioning	8.45.	The depth of the safety arguments and the degree of scrutiny to which they are subjected should be commensurate with the safety significance of the modification (see also para. 9.59 of SSR‑4 [1]).
Design provisions for decontamination and decommissioning	8.46.	In accordance with para. 4.31(d) of SSR‑4 [1], the safety committee is required to review the proposed modifications. Suitable records should be kept of its decisions and recommendations.
Design provisions for decontamination and decommissioning	8.47.	The modification should also specify which documentation will need to be updated as a result of the modification (e.g. training plans, specifications, the safety assessment, notes, drawings, engineering flow diagrams, process instrumentation diagrams, operating procedures). Procedures for the control of documentation should be put in place to ensure that documents are changed within a reasonable time period following the modification. Personnel should be informed and trained accordingly before operation commences.
Design provisions for decontamination and decommissioning	8.48.	An adequate management process should be used as an overall means of monitoring the progress of modifications through the system and as a means of ensuring that all modification proposals receive an equivalent and sufficient level of scrutiny. The modification documentation should also specify the functional (commissioning) checks that are required before the modified system may be declared fully operational again.
Design provisions for decontamination and decommissioning	8.49.	Modifications performed on design, layout or procedures of the facility might adversely affect security equipment and vice versa. For example, the malfunction of safety equipment might damage nearby security equipment. Therefore, in addition to the safety review, the interface of proposed modifications with security should be evaluated before approval and implementation to verify that they do not compromise each other (see Requirement 75 of SSR‑4 [1]).
Design provisions for decontamination and decommissioning	8.50.	The modifications made to a facility (including those to the operating organization) should be reviewed on a regular basis to ensure that the cumulative effects of a number of modifications with minor safety significance do not have unforeseen effects on the overall safety of the facility. This should be part of (or additional to) the periodic safety review or an equivalent review process.
Design provisions for decontamination and decommissioning	8.51.	The modification control documentation (see para. 9.57(f) of SSR‑4 [1]) should be retained at the facility in accordance with national requirements.
Design provisions for decontamination and decommissioning	8.52.	The requirements for criticality safety in MOX fuel fabrication facilities are established in Requirement 66 and paras 9.83–9.85 and 9.87 of SSR‑4 [1], and general recommendations are provided in SSG‑27 (Rev. 1) [4]. The procedures and measures for controlling criticality hazards should be strictly applied.
Design provisions for decontamination and decommissioning	8.53.	Operational aspects of the control of criticality hazards in MOX fuel fabrication facilities should be taken into consideration, including the following: Prevention of unexpected changes in conditions that could increase the probability of a criticality accident, for example unplanned accumulation of PuO₂or MOX powder (e.g. in gloveboxes or ventilation ducts) or hydrogenated materials; Management of moderating materials, particularly hydrogenated materials such as those used for the decontamination of gloveboxes, and leakages of oils from gear boxes; Management of mass in transfers of plutonium and uranium (e.g. using procedures, mass measurement, systems and records) for which mass control is used; Reliable methods for detecting the onset of any of the conditions described in points (a)–(c); Periodic calibration or testing of systems for the control of criticality hazards (e.g. control of movements of material, balances, scales); Evacuation drills to prepare for the occurrence of a criticality event and/or the actuation of an alarm.
Design provisions for decontamination and decommissioning	8.54.	The tools used for the purposes of nuclear material accounting and control, such as the instruments used to conduct measurements of mass, volume or isotopic composition and the software used for these purposes, may also have application in the area of criticality safety. However, if there is any uncertainty about the characteristics of fissile material, conservative values should be used for parameters such as the plutonium content and the isotopic composition.
Design provisions for decontamination and decommissioning	8.55.	Criticality hazards might be encountered when performing maintenance work. Waste and residues arising from decontamination and maintenance activities should be collected in containers with a favourable geometry approved for the work and should be stored in criticality controlled areas. Maintenance instructions and procedures for equipment that possibly contains fissile material should be reviewed and approved by criticality safety personnel before the work starts. Special care, including the effect of moderation (including by a human body), should be taken to ensure the proper spacing of vessels or installation parts that may contain fissile material.
Design provisions for decontamination and decommissioning	8.56.	The requirements for radiation protection in operation are established in Requirement 67 and paras 9.90–9.101 of SSR‑4 [1] and in GSR Part 3 [17]; recommendations are provided in IAEA Safety Standards Series No. GSG‑7, Occupational Radiation Protection [32]. The operating organization should have a policy to optimize protection and safety and is required to ensure that doses are below national dose limits and within any dose constraints set by the operating organization (see para. 9.91 of SSR‑4 [1]).
Design provisions for decontamination and decommissioning	8.57.	In a MOX fuel fabrication facility, the main radiological hazard for both the personnel and the public is from the inhalation of airborne plutonium oxide or MOX powder. Plutonium oxide and MOX powders pose a particular hazard because of their long biological half‑lives (and therefore effective half‑lives)⁵, and their typically relatively small particle size (typically a few micrometres in diameter) when encountered in MOX fuel fabrication facilities. Thus, close attention should be paid to the confinement of plutonium oxide and MOX powders and the control of contamination in the workplace.
Design provisions for decontamination and decommissioning	8.58.	For MOX fuel fabrication facilities, in normal operation, the external dose rate from beta and gamma radiation and neutron emission is relatively low. A high external dose rate might be encountered in the case of a criticality accident.
Design provisions for decontamination and decommissioning	8.59.	The doses caused by plutonium should be controlled by integrity of the first confinement barrier, which should be monitored close to the workplace of the operator by means of continuous air sampling and routine monitoring for surface contamination.
Design provisions for decontamination and decommissioning	8.60.	Workplace monitoring for purposes of radiation protection inside and outside the MOX fuel fabrication facility buildings should be complemented by regular, routine monitoring by trained personnel. This should be organized to provide, as far as practicable, regular workplace monitoring of the whole MOX fuel fabrication facility site. Particular attention should be paid to the recording, labelling or posting (where necessary), evaluating and reporting of abnormal radiation levels or abnormal situations. The frequency of workplace monitoring should be related to the relative risk of radiation or contamination in the individual areas. Radiation protection personnel should consider assigning a frequency for the monitoring of each facility area based upon easily identified boundaries. The use of photographs or drawings of the area or equipment should be considered for reporting the findings.
Design provisions for decontamination and decommissioning	8.61.	Radiation protection personnel should be part of the decision making processes associated with the application of the requirements for minimization of exposure (e.g. for the early detection and mitigation of hot spots) and proper housekeeping (e.g. waste segregation, packaging and removal).
Design provisions for decontamination and decommissioning	8.62.	Interventions for maintenance and/or modifications are activities that require justification and optimization of protective actions as specified in GSR Part 3 [17]. The procedures for intervention should include the following: Estimation of doses due to external exposure before the intervention. Preparatory activities to minimize the doses due to occupational exposure, including the following: Specifically identifying the risks associated with the intervention; Specifying in the work permit protective measures for the intervention, such as for the individual as well as collective means of protection (e.g. use of masks, clothing and gloves, time limitation). Measurement of the doses due to occupational exposure during the intervention. Implementation of feedback of information for identifying possible improvements. Specifically identifying the risks associated with the intervention; Specifying in the work permit protective measures for the intervention, such as for the individual as well as collective means of protection (e.g. use of masks, clothing and gloves, time limitation).
Design provisions for decontamination and decommissioning	8.63.	The risks of exposure of members of the public should be minimized by ensuring that, as far as reasonably practicable, radioactive material is kept away and/or removed from ventilation exhaust gases to prevent its entrainment in the effluent waste stream and subsequent discharge to the atmosphere.
Design provisions for decontamination and decommissioning	8.64.	The monitoring results from the radiation protection programme should be compared with the operational limits and conditions, and corrective actions are required to be taken if necessary (see para. 9.34 of SSR‑4 [1]). Furthermore, these monitoring results should be used to verify the dose calculations made in the initial environmental impact assessment.
Design provisions for decontamination and decommissioning	8.65.	Internal exposure should be controlled by the following means: Performance targets should be set for all parameters relating to internal exposure (e.g. levels of contamination). Enclosures and ventilation systems should be routinely inspected, tested and maintained to ensure that they continue to fulfil their design requirements. Regular flow checks should be performed at ventilation hoods and entrances to confinement areas. Pressure drops across air filter banks should be checked and recorded regularly. Operators should be made aware of and specially trained in the immediate actions necessary in the event of the puncture of a glove and/or a breach of confinement integrity. A high standard of housekeeping should be maintained at the facility. Cleaning techniques that do not give rise to airborne radioactive material should be used (e.g. the use of vacuum cleaners with HEPA filters). Regular contamination surveys of areas of the facility and equipment should be performed to confirm the adequacy of cleaning programmes. Contamination zones should be delineated and clearly indicated. Continuous air monitoring should be performed to alert facility operators if levels of airborne radioactive material exceed predetermined action levels. Mobile air samplers should be used at possible sources of contamination, as necessary. An investigation should be conducted promptly in response to the detection of high levels of airborne radioactive material. Personnel and equipment should be checked for contamination and should undergo decontamination, if necessary, before leaving contamination zones. Entry to and exit from the work area should be controlled to prevent the spread of contamination. In particular, changing rooms and decontamination facilities should be provided. Temporary means of ventilation and means of confinement should be used when intrusive work increases the potential for causing contamination by airborne radioactive material (e.g. during periodic testing, inspection or maintenance). Personal protective equipment (e.g. respirators, gloves, clothes) should be made available and should be used when dealing with possible releases of radioactive material from its normal means of confinement in specific operational circumstances (e.g. bag‑out and/or bag‑in operations, certain maintenance operations, changing of gloves of gloveboxes). Personal protective equipment should be maintained in good condition, should be cleaned as necessary and should be periodically inspected. Any personnel with wounds should protect them with an impervious covering for work in contamination zones.
Design provisions for decontamination and decommissioning	8.66.	In vivo monitoring and biological sampling should be available, as necessary, as a complementary measure for monitoring doses due to occupational exposure. Whole body measurements should also be performed periodically to check for internal exposure of workers.
Design provisions for decontamination and decommissioning	8.67.	The extent and type of workplace monitoring should be commensurate with the expected level of airborne activity, contamination levels and radiation type, and the potential for any of these parameters to change.
Design provisions for decontamination and decommissioning	8.68.	For exposures which are expected to be low, the method for assessing doses due to internal exposure should be based on the collection of data from air sampling in the workplace, in combination with personnel occupancy data. This method should be assessed and should be reviewed as appropriate by the regulatory body.
Design provisions for decontamination and decommissioning	8.69.	In performing the activities for periodic testing, inspection and maintenance, precautions should be taken to limit, by the use of temporary enclosures and ventilation systems, the spread of radioactive material.
Design provisions for decontamination and decommissioning	8.70.	On completion of maintenance work, the area concerned should be decontaminated and air sampling and smear sampling of surfaces should be performed to confirm that the area can be returned to normal use.
Design provisions for decontamination and decommissioning	8.71.	Estimates should be regularly made, by means of monitoring data on effluents, of doses due to internal exposure received by members of the public who live in the vicinity of the site.
Design provisions for decontamination and decommissioning	8.72.	External exposure due to gamma radiation from americium (and residual fission products from uranium oxide, where appropriate) and neutron radiation from plutonium oxide should be controlled by means of an appropriate combination of requirements on time, distance and shielding. Radioactive sources are used in a MOX fuel fabrication facility for scanning rods and in the laboratory.
Design provisions for decontamination and decommissioning	8.73.	Although most of the processes in a MOX fuel fabrication facility are automated, there are some actions that require manual work in gloveboxes. Owing to the proximity of the hands of operators to plutonium oxide when work in gloveboxes is being performed, the hands are more susceptible to exposure than other parts of the body. The dose to the hands should therefore be monitored (by extremity dosimetry) together, when necessary, with doses to the lens of the eye.
Design provisions for decontamination and decommissioning	8.74.	External exposure should be controlled by the following: Training personnel in radiation hazards and the use of dose monitoring equipment; Removing plutonium oxide and other radioactive material from process areas in use for extended maintenance work; Ensuring that radiation sources are changed by suitably qualified and experienced persons; Avoiding unnecessary staff presence in the vicinity of gloveboxes; Using individual and temporary shielding; Performing routine surveys of radiation dose rates.
Design provisions for decontamination and decommissioning	8.75.	The requirements relating to industrial and chemical safety are established in Requirement 70 of SSR‑4 [1].
Design provisions for decontamination and decommissioning	8.76.	A mixture of argon and hydrogen is generally used in the sintering furnaces in MOX fuel fabrication facilities. Nitrogen may be used in gloveboxes to ensure the quality of the product. Carbon dioxide may be used in automatic fire suppression systems, except where it might cause a criticality hazard. A leakage of any of these gases might cause asphyxiation. Additionally, there is a potential for explosion at the location outside the main processing building where the mixing of hydrogen with argon is conducted.
Design provisions for decontamination and decommissioning	8.77.	The industrial and chemical hazards present in MOX fuel fabrication facilities may be summarized as follows: Asphyxiation hazards due to the presence of argon or hydrogen or mixtures thereof, or of nitrogen or carbon dioxide; Explosion of hydrogen storage bottles outside the main MOX processing building; Fire hazards, including metallic fires involving zirconium metal shavings; Gas storage bottles becoming missiles; Chemical hazards in the laboratory.
Design provisions for decontamination and decommissioning	8.78.	The exposure of personnel to chemical hazards should be assessed using a method similar to that for the assessment of radiation doses and should be based on the collection of data from air sampling in the workplace, in combination with personnel occupancy data. This method should be assessed and reviewed, as appropriate, by the regulatory body. The acceptance levels of exposure for various chemical hazards in a MOX fuel fabrication facility can be found in Ref. [24].
Design provisions for decontamination and decommissioning	8.79.	The selection of personal protective equipment should be commensurate to the hazard present (e.g. acid filters for protective equipment for acids, particulate filters for particulates and combination filters where both hazards are present).
Design provisions for decontamination and decommissioning	8.80.	Gas storage bottles are used to store various gases such as carbon dioxide, hydrogen and mixtures of argon and hydrogen. Procedures should be developed and used to ensure the proper storage and handling of gas storage bottles to prevent them from becoming missiles.
Design provisions for decontamination and decommissioning	8.81.	Chemicals are used mostly in the laboratory for performing product analyses. Personnel should be made aware of the potential chemical hazards. Written procedures should be developed and used to control the quantity and handling of chemicals in the laboratory to prevent events such as explosion, fire, high toxicity and undesirable chemical interactions. Chemicals should be stored in well aerated premises or in racks outside the process and laboratory area.
Design provisions for decontamination and decommissioning	8.82.	To minimize the fire hazard of pyrophoric metals (e.g. zirconium or uranium particles), locations where such materials could accumulate should be monitored, should be periodically checked and should be cleaned in accordance with procedures. In some cases, routine flushing out (i.e. high flow rate washing) of equipment may be necessary.
Design provisions for decontamination and decommissioning	8.83.	The procedures and training for response to fires in areas containing fissile material should pay particular attention to the prevention of a criticality event and to the prevention of any unacceptable reduction of criticality safety margins.
Design provisions for decontamination and decommissioning	8.84.	The work permits and facility procedures and instructions should include an adequate assessment of and, as necessary, a check sheet on the potential radiological consequences of fires resulting from activities that involve potential ignition sources (e.g. welding), and should define the precautions necessary for performing such work.
Design provisions for decontamination and decommissioning	8.85.	The prevention and control of accumulation of waste material (contaminated material and ‘clean’ material) should be rigorously enforced to minimize the fire load (or fire potential) in all areas of the MOX fuel fabrication facility. Auditing for accumulation of waste material should be an important element in all routine inspection and surveillance activities by personnel at all levels. Periodic inspections by fire safety professionals should be part of the audit programme.
Design provisions for decontamination and decommissioning	8.86.	A health surveillance programme should be set up, in accordance with national regulations, for routinely monitoring the health of personnel who might be exposed to chemicals. Monitoring of the chemical effects of uranium and of the radiological effects of plutonium, as necessary, should be considered the core part of the health surveillance programme. The surveillance programme should address short term effects (acute exposure) and long term effects (chronic exposure).
Design provisions for decontamination and decommissioning	8.87.	During an emergency, special consideration should be given to the presence of both chemical and radiological hazards.
Design provisions for decontamination and decommissioning	8.88.	The requirements relating to the management of radioactive waste and effluents in operation are established in Requirement 68 and paras 9.102–9.108 of SSR‑4 [1].
Design provisions for decontamination and decommissioning	8.89.	Radioactive gases should be treated, where appropriate, by means of HEPA filters or equivalent (see para. 5.147). Performance standards should be set to specify performance levels at which filters or scrubber media should be changed, including filter age. After filter changes, tests should be performed to ensure that new filters are correctly seated and yield a removal efficiency as assumed in the analyses. Suitable storage and quality control measures should be implemented for new filters.
Design provisions for decontamination and decommissioning	8.90.	The generation of solid radioactive waste should be minimized by removing as much outer packing as possible before material is transferred to radiologically controlled areas. The operating organization should use the best available techniques in minimizing the generation of radioactive waste (including incineration, metal melting and compaction). As far as reasonably practicable, and in accordance with national regulations, radioactive material should be treated to allow its further use. Cleaning methods that minimize the generation of waste should be adopted at the facility.
Design provisions for decontamination and decommissioning	8.91.	The requirements for emergency preparedness and response are established in Requirement 72 and paras 9.120–9.132 of SSR‑4 [1] and in GSR Part 7 [25], and recommendations are provided in GS‑G‑2.1 [26] and in IAEA Safety Standards Series No. GSG‑2, Criteria for Use in Preparedness and Response for a Nuclear or Radiological Emergency [33]. The conditions at a MOX fuel fabrication facility that might require an off‑site emergency response to be initiated include releases of plutonium, criticality accidents, fires and explosions, and loss of services (see para. 9.126(a) of SSR‑4 [1]).
Design provisions for decontamination and decommissioning	8.92.	As part of emergency preparedness, arrangements should be developed for the interfaces with local, regional and national response organizations. These arrangements should be tested periodically to ensure effective operation during an emergency. Clear communication and authorization protocols should be established with local authorities to ensure that the emergency response organization can respond effectively to an emergency at the facility.
Design provisions for decontamination and decommissioning	8.93.	The operating organization should ensure availability of personnel with specific expertise on the nature and extent of hazards in the facility as well as the availability and reliability of all supplies, equipment, communication systems, plans, procedures and other arrangements necessary for effective response in an emergency. The operating organization and response organizations should develop analytical tools that may be used early in an emergency response for supporting decision making on protective actions and other response actions.
Design provisions for decontamination and decommissioning	8.94.	As specified in GSR Part 7 [25], emergency plans, security plans and contingency plans should be developed in a coordinated manner, considering all responsibilities of the facility personnel and security forces, to ensure that all crucial functions can be performed in a timely manner in the case of an event when the simultaneous response of both groups is needed. Emergency response plans should consider nuclear security events as possible initiators of an emergency, as well as their implications on emergency situations, and these plans should be coordinated with the security response. Strategies for rapidly determining the origin of events and deploying appropriate first responders (i.e. emergency response personnel, security forces or a combination of both) should be developed. These strategies should also include the roles and actions of security forces and emergency response personnel, with a focus on coordinated command and control interfaces and communications. The response to such events should be jointly exercised and evaluated by security forces and emergency response personnel. From these exercises or evaluations, lessons should be identified and recommendations should be made to improve the overall response to a potential event.
Design provisions for decontamination and decommissioning	8.95.	For establishing access control procedures for an emergency, when there is a necessity for rapid access and egress of personnel, safety specialists and security specialists should cooperate closely. Both safety objectives and security objectives should be met in an emergency, in accordance with regulatory requirements. When this is not possible, the best solution that takes into account both objectives should be pursued.
Design provisions for decontamination and decommissioning	8.96.	Requirements on feedback of operating experience are established in paras 9.133–9.137 of SSR‑4 [1]. Further recommendations on the operating experience programme are provided in SSG‑50 [14].
Design provisions for decontamination and decommissioning	8.97.	The programme for the feedback of operating experience at MOX fuel fabrication facilities should cover experience and lessons identified from events and accidents at the facility as well as from other nuclear fuel cycle facilities worldwide and other relevant non‑nuclear accidents. It should also include evaluation of trends in operational disturbances, trends in malfunctions, near misses and other incidents that have occurred at the MOX fuel fabrication facility and, as far as applicable, at other nuclear installations. The programme should include consideration of technical, organizational and human factors. Useful information on the causes and consequences of many of the most important anomalies and accidents that have been observed in MOX fuel fabrication facilities and other nuclear fuel cycle facilities is provided in the Fuel Incident Notification and Analysis System (FINAS) database (see Ref. [34]).
Design provisions for decontamination and decommissioning	9.1.	Requirements for the preparation for safe decommissioning of a MOX fuel fabrication facility are established in paras 10.1–10.13 of SSR‑4 [1], and in IAEA Safety Standards Series No. GSR Part 6, Decommissioning of Facilities [35].
Design provisions for decontamination and decommissioning	9.2.	To facilitate decommissioning, the gloveboxes should be routinely cleaned in the operational stage, in accordance with the justification provided for the cleaning interventions (the balance of cost and benefit in respect of exposure and the generation of waste).
Design provisions for decontamination and decommissioning	9.3.	Special measures should be implemented during the preparatory work for decommissioning to ensure that criticality control is maintained when handling equipment containing nuclear material whose subcriticality is controlled by geometry, moderation or absorption. Care should also be taken over possible changes in the fissile material form.
Design provisions for decontamination and decommissioning	9.4.	In addition to the general preparations for decommissioning described in IAEA Safety Standards Series No. SSG‑47, Decommissioning of Nuclear Power Plants, Research Reactors and Other Nuclear Fuel Cycle Facilities [36], the following preparatory steps specific to MOX fuel fabrication facilities should be followed: The facility status at the beginning of decommissioning, including the list of systems that should be operational, should be described. During the transition period between shutdown and decommissioning, post‑operational cleanout should be performed to remove all bulk amounts of plutonium oxide and MOX powder in gloveboxes in order to reduce the residual inventory of plutonium. The plutonium inventory should be determined on the basis of accounting data for nuclear material. Any ground (surface and subsurface), groundwater, parts of buildings and equipment contaminated with radioactive material or chemical material and their levels of contamination should be identified by means of comprehensive site characterization. Parts of buildings and items of equipment that are contaminated with plutonium and their levels of contamination should be identified. Methods for decontamination of the facility to reach the levels required by the regulatory body for cleanup operations or the lowest reasonably achievable level of residual contamination should be determined. Risk assessments and method statements for the decommissioning process should be prepared. Preparations for the dismantling of process equipment, gloveboxes and ducts upstream of the HEPA filters (or equivalent) should be made, including the following: Selection and justification of the dismantling methods and equipment (such as ventilated tents), with account taken of all the options for waste management (pre‑treatment, conditioning and disposal); Organization and planning of the dismantling interventions; Assessment of the risks associated with dismantling, including emergency preparedness and response. Selection and justification of the dismantling methods and equipment (such as ventilated tents), with account taken of all the options for waste management (pre‑treatment, conditioning and disposal); Organization and planning of the dismantling interventions; Assessment of the risks associated with dismantling, including emergency preparedness and response.
Design provisions for decontamination and decommissioning	9.5.	The developed decommissioning plan and the safety assessment should be periodically reviewed and updated throughout the commissioning and operation stages of the MOX fuel fabrication facility (see Requirements 8 and 10 of GSR Part 6 [35]) to take into account new information and emerging technologies to ensure the following: That the (updated) decommissioning plan is realistic and can be implemented safely; That updated provisions are made for adequate resources and their availability, when needed; That the radioactive waste anticipated remains compatible with available (or planned) storage capacities and disposal considering its transport and treatment. INTERNATIONAL ATOMIC ENERGY AGENCY, Safety of Nuclear Fuel Cycle Facilities, IAEA Safety Standards Series No. SSR‑4, IAEA, Vienna (2017). INTERNATIONAL ATOMIC ENERGY AGENCY, Safety of Uranium Fuel Fabrication Facilities, IAEA Safety Standards Series No. SSG‑6 (Rev. 1), IAEA, Vienna (2023). INTERNATIONAL ATOMIC ENERGY AGENCY, Safety of Nuclear Fuel Reprocessing Facilities, IAEA Safety Standards Series No. SSG‑42, IAEA, Vienna (2017). INTERNATIONAL ATOMIC ENERGY AGENCY, Criticality Safety in the Handling of Fissile Material, IAEA Safety Standards Series No. SSG‑27 (Rev. 1), IAEA, Vienna (2022). INTERNATIONAL ATOMIC ENERGY AGENCY, Governmental, Legal and Regulatory Framework for Safety, IAEA Safety Standards Series No. GSR Part 1 (Rev. 1), IAEA, Vienna (2016). INTERNATIONAL ATOMIC ENERGY AGENCY, Nuclear Security Recommendations on Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/ Revision 5), IAEA Nuclear Security Series No. 13, IAEA, Vienna (2011). INTERNATIONAL ATOMIC ENERGY AGENCY, Physical Protection of Nuclear Material and Nuclear Facilities (Implementation of INFCIRC/225/Revision 5), IAEA Nuclear Security Series No. 27‑G, IAEA, Vienna (2018). INTERNATIONAL ATOMIC ENERGY AGENCY, Leadership and Management for Safety, IAEA Safety Standards Series No. GSR Part 2, IAEA, Vienna (2016). INTERNATIONAL ATOMIC ENERGY AGENCY, Application of the Management System for Facilities and Activities, IAEA Safety Standards Series No. GS‑G‑3.1, IAEA, Vienna (2006). INTERNATIONAL ATOMIC ENERGY AGENCY, The Management System for Nuclear Installations, IAEA Safety Standards Series No. GS‑G‑3.5, IAEA, Vienna (2009). INTERNATIONAL ATOMIC ENERGY AGENCY, Leadership, Management and Culture for Safety in Radioactive Waste Management, IAEA Safety Standards Series No. GSG‑16, IAEA, Vienna (2022). INTERNATIONAL ATOMIC ENERGY AGENCY, The Management System for the Safe Transport of Radioactive Material, IAEA Safety Standards Series No. TS‑G‑1.4, IAEA, Vienna (2008). INTERNATIONAL ATOMIC ENERGY AGENCY, Safety Assessment for Facilities and Activities, IAEA Safety Standards Series No. GSR Part 4 (Rev. 1), IAEA, Vienna (2016). INTERNATIONAL ATOMIC ENERGY AGENCY, Operating Experience Feedback for Nuclear Installations, IAEA Safety Standards Series No. SSG‑50, IAEA, Vienna (2018). INTERNATIONAL ATOMIC ENERGY AGENCY, Site Evaluation for Nuclear Installations, IAEA Safety Standards Series No. SSR‑1, IAEA, Vienna (2019). INTERNATIONAL ATOMIC ENERGY AGENCY, Site Survey and Site Selection for Nuclear Installations, IAEA Safety Standards Series No. SSG‑35, IAEA, Vienna (2015). EUROPEAN COMMISSION, FOOD AND AGRICULTURE ORGANIZATION OF THE UNITED NATIONS, INTERNATIONAL ATOMIC ENERGY AGENCY, INTERNATIONAL LABOUR ORGANIZATION, OECD NUCLEAR ENERGY AGENCY, PAN AMERICAN HEALTH ORGANIZATION, UNITED NATIONS ENVIRONMENT PROGRAMME, WORLD HEALTH ORGANIZATION, Radiation Protection and Safety of Radiation Sources: International Basic Safety Standards, IAEA Safety Standards Series No. GSR Part 3, IAEA, Vienna (2014). INTERNATIONAL ATOMIC ENERGY AGENCY, UNITED NATIONS ENVIRONMENT PROGRAMME, Prospective Radiological Environmental Impact Assessment for Facilities and Activities, IAEA Safety Standards Series No. GSG‑10, IAEA, Vienna (2018). INTERNATIONAL ATOMIC ENERGY AGENCY, Seismic Hazards in Site Evaluation for Nuclear Installations, IAEA Safety Standards Series No. SSG‑9 (Rev. 1), IAEA, Vienna (2022). INTERNATIONAL ATOMIC ENERGY AGENCY, WORLD METEOROLOGICAL ORGANIZATION, Meteorological and Hydrological Hazards in Site Evaluation for Nuclear Installations, IAEA Safety Standards Series No. SSG‑18, IAEA, Vienna (2011). INTERNATIONAL ATOMIC ENERGY AGENCY, Volcanic Hazards in Site Evaluation for Nuclear Installations, IAEA Safety Standards Series No. SSG‑21, IAEA, Vienna (2012). INTERNATIONAL ATOMIC ENERGY AGENCY, Design of Nuclear Installations Against External Events Excluding Earthquakes, IAEA Safety Standards Series No. SSG‑68, IAEA, Vienna (2021). INTERNATIONAL ATOMIC ENERGY AGENCY, Safety Reassessment for Nuclear Fuel Cycle Facilities in Light of the Accident at the Fukushima Daiichi Nuclear Power Plant, Safety Reports Series No. 90, IAEA, Vienna (2016). AMERICAN CONFERENCE OF GOVERNMENTAL INDUSTRIAL HYGIENISTS, 2021 Threshold Limit Values (TLVs) and Biological Exposure Indices (BEIs), ACGIH, Cincinnati, OH (2021). FOOD AND AGRICULTURE ORGANIZATION OF THE UNITED NATIONS, INTERNATIONAL ATOMIC ENERGY AGENCY, INTERNATIONAL CIVIL AVIATION ORGANIZATION, INTERNATIONAL LABOUR ORGANIZATION, INTERNATIONAL MARITIME ORGANIZATION, INTERPOL, OECD NUCLEAR ENERGY AGENCY, PAN AMERICAN HEALTH ORGANIZATION, PREPARATORY COMMISSION FOR THE COMPREHENSIVE NUCLEAR‑TEST‑BAN TREATY ORGANIZATION, UNITED NATIONS ENVIRONMENT PROGRAMME, UNITED NATIONS OFFICE FOR THE COORDINATION OF HUMANITARIAN AFFAIRS, WORLD HEALTH ORGANIZATION, WORLD METEOROLOGICAL ORGANIZATION, Preparedness and Response for a Nuclear or Radiological Emergency, IAEA Safety Standards Series No. GSR Part 7, IAEA, Vienna (2015). FOOD AND AGRICULTURE ORGANIZATION OF THE UNITED NATIONS, INTERNATIONAL ATOMIC ENERGY AGENCY, INTERNATIONAL LABOUR OFFICE, PAN AMERICAN HEALTH ORGANIZATION, UNITED NATIONS OFFICE FOR THE COORDINATION OF HUMANITARIAN AFFAIRS, WORLD HEALTH ORGANIZATION, Arrangements for Preparedness for a Nuclear or Radiological Emergency, IAEA Safety Standards Series No. GS‑G‑2.1, IAEA, Vienna (2007). (A revision of this publication is in preparation.) INTERNATIONAL ATOMIC ENERGY AGENCY, Predisposal Management of Radioactive Waste, IAEA Safety Standards Series No. GSR Part 5, IAEA, Vienna (2009). INTERNATIONAL ATOMIC ENERGY AGENCY, The Safety Case and Safety Assessment for the Predisposal Management of Radioactive Waste, IAEA Safety Standards Series No. GSG‑3, IAEA, Vienna (2013). INTERNATIONAL ATOMIC ENERGY AGENCY, Classification of Radioactive Waste, IAEA Safety Standards Series No. GSG‑1, IAEA, Vienna (2009). INTERNATIONAL ATOMIC ENERGY AGENCY, Predisposal Management of Radioactive Waste from Nuclear Fuel Cycle Facilities, IAEA Safety Standards Series No. SSG‑41, IAEA, Vienna (2016). INTERNATIONAL ATOMIC ENERGY AGENCY, Construction for Nuclear Installations, IAEA Safety Standards Series No. SSG‑38, IAEA, Vienna (2015). INTERNATIONAL ATOMIC ENERGY AGENCY, INTERNATIONAL LABOUR OFFICE, Occupational Radiation Protection, IAEA Safety Standards Series No. GSG‑7, IAEA, Vienna (2018). FOOD AND AGRICULTURE ORGANIZATION OF THE UNITED NATIONS, INTERNATIONAL ATOMIC ENERGY AGENCY, INTERNATIONAL LABOUR OFFICE, PAN AMERICAN HEALTH ORGANIZATION, WORLD HEALTH ORGANIZATION, Criteria for Use in Preparedness and Response for a Nuclear or Radiological Emergency, IAEA Safety Standards Series No. GSG‑2, IAEA, Vienna (2011). INTERNATIONAL ATOMIC ENERGY AGENCY, OECD NUCLEAR ENERGY Agency, IAEA/NEA Fuel Incident Notification and Analysis System (FINAS) Guidelines, Services Series No. 14, IAEA, Vienna (2006). INTERNATIONAL ATOMIC ENERGY AGENCY, Decommissioning of Facilities, IAEA Safety Standards Series No. GSR Part 6, IAEA, Vienna (2014). INTERNATIONAL ATOMIC ENERGY AGENCY, Decommissioning of Nuclear Power Plants, Research Reactors and Other Nuclear Fuel Cycle Facilities, IAEA Safety Standards Series No. SSG‑47, IAEA, Vienna (2018).
Design provisions for decontamination and decommissioning		Figure I–1 shows the typical process routes in a mixed oxide (MOX) fuel fabrication facility.
Design provisions for decontamination and decommissioning	II–1.	This annex provides examples of structures, systems and components important to safety and possible challenges to safety function for MOX fuel fabrication facilities. A safety function, as used in Table II–1, can serve one or more of the following purposes: Criticality prevention; Confinement of radioactive material; Protection against external exposure.
Design provisions for decontamination and decommissioning	III–1.	This annex provides examples of parameters that can be used for defining the operational limits and conditions in the various processing areas of the facility. A safety function, as used in Table III–1, can serve one or more of the following purposes: Criticality prevention; Confinement of radioactive material; Protection against external exposure.

Sekce

Odstavec

Text

Main

1.1.

Requirements for all the important areas of safety in all stages of the lifetime of a nuclear fuel cycle facility are established in IAEA Safety Standards Series No. SSR‑4, Safety of Nuclear Fuel Cycle Facilities [1].

Main

1.2.

This Safety Guide provides specific recommendations on the safety of uranium and plutonium mixed oxide (MOX) fuel fabrication facilities.

Main

1.3.

Plutonium is a valuable energy resource that arises from the civil and military industries in a number of States. When plutonium oxide (PuO2) is mixed with uranium oxide (UO2), the resulting mixed oxide can be fabricated into fuel suitable for loading into thermal reactors and fast reactors, thereby utilizing this energy resource.

Main

1.4.

The MOX fuel fabrication processes rely to a large extent on passive and active engineered safety measures in addition to administrative controls to ensure safety. The potential hazards of a MOX fuel fabrication facility are release of actinides (i.e. plutonium, americium and uranium, in order of significance), increased radiotoxicity due to transuranium actinides and nuclear criticality.

Main

1.5.

As the toxicity of plutonium is high, it is important that best practices be employed at all stages of the fabrication of MOX fuel and that plutonium be handled, processed, treated and stored safely. It is important that best practices also be considered as part of applying optimization to the generation and management of all radioactive waste and effluents generated in MOX fuel fabrication facilities.

Main

1.6.

This Safety Guide supersedes IAEA Safety Standards Series No. SSG‑7, Safety of Uranium and Plutonium Mixed Oxide Fuel Fabrication Facilities¹.

Main

1.7.

The objective of this Safety Guide is to provide recommendations on the siting, design, construction, commissioning, operation including management for safety, and preparation for decommissioning of MOX fuel fabrication facilities to meet the applicable requirements established in SSR‑4 [1].

Main

1.8.

The recommendations in this Safety Guide are aimed primarily at operating organizations of MOX fuel fabrication facilities, regulatory bodies, designers and other relevant organizations.

Main

1.9.

The safety requirements applicable to fuel cycle facilities (i.e. facilities for uranium refining; conversion; enrichment; reconversion²; storage of fissile material; fabrication of fuel including MOX fuel; storage and reprocessing of spent fuel; associated conditioning and storage of waste; and facilities for fuel cycle related research and development) are established in SSR‑4. [1]. This Safety Guide provides recommendations on meeting these requirements for MOX fuel fabrication facilities.

Main

1.10.

This Safety Guide deals with the handling, processing, material transfer, and storage of (i) plutonium oxide powder; (ii) depleted, natural or reprocessed uranium oxide powder as it relates to MOX fuel fabrication facilities; and (iii) MOX fuel pellets, rods and assemblies fabricated from plutonium oxide and uranium oxide powders for use in thermal reactors and fast reactors. This Safety Guide also deals with the generation and management of wastes and effluents arising from the handling and processing of these materials.

Main

1.11.

This Safety Guide is limited to the safety of MOX fuel fabrication facilities; it does not deal with any impact that the fabricated fuel assemblies might have on the safety of the reactors in which they are to be used.

Main

1.12.

The fuel fabrication processes covered by this Safety Guide are dry processes and processes related to the mixing and processing of uranium dioxide and plutonium dioxide powders. The wet MOX fabrication process and the production of oxide powders are not addressed in this Safety Guide. IAEA Safety Standards Series Nos SSG‑6 (Rev. 1), Safety of Uranium Fuel Fabrication Facilities [2], and SSG‑42, Safety of Nuclear Fuel Reprocessing Facilities [3], provide additional recommendations on the safety of producing uranium and plutonium oxide powders.

Main

1.13.

This Safety Guide covers the production of MOX fuel from mixtures of uranium and plutonium oxides, obtained either by blending separate uranium oxide powders and plutonium oxide powders or as a prepared blend. Many aspects, such as the facility design, the safety analysis and the operation of the facility, depend on the nuclide compositions of these oxides. This Safety Guide covers all possible combinations of oxide composition.

Main

1.14.

The recommendations on ensuring criticality safety in a MOX fuel fabrication facility in this publication supplement the recommendations provided in IAEA Safety Standards Series No. SSG‑27 (Rev. 1), Criticality Safety in the Handling of Fissile Material [4].

Main

1.15.

The implementation of safety requirements on the legal and governmental framework and regulatory supervision (e.g. requirements for the authorization process, regulatory inspection and regulatory enforcement) as established in IAEA Safety Standards Series No. GSR Part 1 (Rev. 1), Governmental, Legal and Regulatory Framework for Safety [5], is not addressed in this Safety Guide.

Main

1.16.

This Safety Guide does not include recommendations on nuclear security for a MOX fuel fabrication facility. Recommendations on nuclear security are provided in IAEA Nuclear Security Series No. 13, Nuclear Security Recommendations on Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/ Revision 5) [6], and guidance is provided in IAEA Nuclear Security Series No. 27‑G, Physical Protection of Nuclear Material and Nuclear Facilities (Implementation of INFCIRC/225/Revision 5) [7]. However, this Safety Guide includes recommendations on managing interfaces between safety, nuclear security and the State system for nuclear material accounting and control.

Main

1.17.

Section 2 provides an overview of the hazards in a MOX fuel fabrication facility. Section 3 provides recommendations on the development of a management system for a MOX fuel fabrication facility and the activities associated with it. Section 4 describes the safety aspects to be considered in the evaluation and selection of a site to avoid or minimize any environmental impact of operations. Section 5 addresses safety in the design stage; it provides recommendations on the safety analysis for operational states and accident conditions and covers the safety aspects of radioactive waste management in the MOX fuel fabrication facility, and other design considerations. Section 6 addresses safety aspects in the construction stage. Section 7 addresses safety considerations in commissioning. Section 8 deals with safety in the stage of operation of the facility; it provides recommendations on the management of operation, maintenance and periodic testing, control of modifications, criticality control, radiation protection, industrial safety, the management of waste and effluents, and emergency preparedness and response. Section 9 provides recommendations on meeting the safety requirements for the preparation for decommissioning of a MOX fuel fabrication facility. Annex I shows the typical process routes in a MOX fuel fabrication facility. Annex II provides examples of structures, systems and components important to safety in MOX fuel fabrication facilities, grouped in accordance with process areas. Annex III provides examples of parameters for defining the operational limits and conditions for a MOX fuel fabrication facility.

Main

2.1.

In MOX fuel fabrication facilities, large amounts of fissile material and radioactive material are present in a dispersible form. This is particularly the case in the early stages of the fuel fabrication process, when the material is in powder form. In addition, the radioactive material encountered exists in diverse physical forms. Thus, in MOX fuel fabrication facilities the main hazards are potential nuclear criticality, loss of confinement and radiation exposure (both internal and external).

Main

2.2.

In MOX fuel fabrication facilities, plutonium oxide and uranium oxide and/or mixed oxide are processed. The factors affecting the safety of a MOX fuel fabrication facility include the following:

Plutonium having high radiological toxicity, the consequences to the personnel, the public and the environment following an accident might be expected to be high.
The powder processes used for MOX fuel fabrication have a potential for the dispersion of radioactive material.
The isotopic characteristics of plutonium have an effect on nuclear criticality safety, radiation exposure and heat generation.

Main

2.3.

External exposure assessment should include exposure due to neutron emission from ²³⁸Pu and ²⁴⁰Pu isotopes and gamma radiation from ²⁴¹Am, which is formed through the radioactive decay of ²⁴¹Pu during storage. Gamma radiation from ²²⁸Th decay products (including ²⁰⁸Tl) should also be considered.

Main

2.4.

The decay heat of ²³⁸Pu should be included in the calculation of heat generation.

Main

2.5.

A MOX fuel fabrication facility using only dry processes does not store or process significant quantities of hazardous chemicals. Thus, chemical hazards that could lead to radiological consequences are low. However, this would not be the case for MOX fuel fabrication facilities using wet processes. To meet the requirements established in SSR‑4 [1], the operating organization is required to perform a safety analysis in which potential accidents are analysed to ensure that they are adequately prevented and, if they do occur, detected and their consequences mitigated. This requires application of the concept of defence in depth (see Requirement 10 of SSR‑4 [1]). For the MOX fuel fabrication facility to also remain in a safe state when the fuel fabrication process is stopped (i.e. when there is no movement or transfer of material), the following systems should continue to operate:

Heat removal systems in storage areas to remove decay heat from reactor grade plutonium;
Systems supporting confinement functions to supplement the physical confinement barriers and to provide mitigation and monitoring of radioactive discharges;
Inert gas feed systems of sintering furnaces and gloveboxes;
Criticality accident detection and alarm systems.

Main

3.1.

A documented management system that integrates safety, health, environmental, security, quality, and human and organizational factors of the operating organization is required to be established and implemented with adequate resources, in accordance with Requirement 4 of SSR‑4 [1]. The integrated management system should be established and put into effect by the operating organization early in the design stage of a MOX fuel fabrication facility, to ensure that safety measures are specified, documented, implemented, monitored, audited and periodically reviewed throughout the lifetime of the facility or the duration of the activity.

Main

3.2.

Requirements for the management system are established in IAEA Safety Standards Series No. GSR Part 2, Leadership and Management for Safety [8]. Associated recommendations are provided in IAEA Safety Standards Series Nos GS‑G‑3.1, Application of the Management System for Facilities and Activities [9]; GS‑G‑3.5, The Management System for Nuclear Installations [10]; GSG‑16, Leadership, Management and Culture for Safety in Radioactive Waste Management [11]; and TS‑G‑1.4, The Management System for the Safe Transport of Radioactive Material [12].

Main

3.3.

Coordination of the nuclear safety and security interface in the establishment of the integrated management system should be ensured. The management system should consider the specific concerns of each discipline regarding the management of information. Potential conflicts between the need for transparency of information relating to safety matters and the need for protection of information for security reasons should be addressed.

Main

3.4.

In determining how the management system for the safety of MOX fuel fabrication facilities is to be developed and applied, a graded approach is required to be used (see Requirement 7 and para. 4.15 of GSR Part 2 [8]). This approach should be based on the relative importance to safety of each item or process.

Main

3.5.

The management system is required to support the development and maintenance of a strong safety culture, including in all aspects of criticality safety (see Requirement 12 of GSR Part 2 [8]).

Main

3.6.

In accordance with paras 4.15–4.23 of SSR‑4 [1], the management system is required to address the following functional areas:

Management responsibility, which includes the necessary support and commitment of the management to achieve the objectives of the operating organization.
Resource management, which includes the measures necessary to ensure that the resources essential to the implementation of safety policy and the enhancement of safety and the achievement of the objectives of the operating organization are identified and made available.
Process implementation, which includes the actions and tasks necessary to achieve the goals of the operating organization.
Measurement, assessment, evaluation and improvement, which provide an indication of the effectiveness of management processes and work performance compared with objectives or benchmarks. It is through measurement, assessment and evaluation that opportunities for improvement are identified.

Main

3.7.

The prime responsibility for safety, including criticality safety, rests with the operating organization. In accordance with para. 4.11 of GSR Part 2 [8], the management system for a MOX fuel fabrication facility is required to clearly specify the following:

The organizational structure;
Functional responsibilities;
Levels of authority.

Main

3.8.

The documentation of the management system should describe the interactions between the individuals managing, performing and assessing the adequacy of the processes and activities important to safety. The documentation should also cover other management measures, including planning, scheduling and resource allocation (see para. 9.9 of SSR‑4 [1]).

Main

3.9.

Paragraph 4.15 of SSR‑4 [1] states:

Main

3.10.

The operating organization is required to ensure that safety assessments and analyses are conducted, documented and updated (see Requirement 24 and para. 4.65 of IAEA Safety Standards Series No. GSR Part 4 (Rev. 1), Safety Assessment for Facilities and Activities [13], and Requirement 5 of SSR‑4 [1]).

Main

3.11.

In accordance with para. 4.2(d) of SSR‑4 [1], the operating organization is required to audit all safety related matters on a regular basis. This should include the examination of arrangements for emergency preparedness and response, such as emergency communications, evacuation routes and signage. Checks should be performed by the nuclear criticality safety personnel who performed the safety assessments to confirm that the data used and the implementation of criticality safety measures are correct. Audits should be performed by personnel who are independent of those who performed the safety assessments or conducted the activities important for safety. The data from audits should be documented and submitted for management review and for action, if necessary.

Main

3.12.

The operating organization is required to provide adequate resources (both human and financial) for the safe operation of the MOX fuel fabrication facility (see Requirement 9 of GSR Part 2 [8]), including resources for mitigating the consequences of accidents.

Main

3.13.

The management of the operating organization should undertake the following:

Determine the necessary competence of personnel and provide training, as necessary;
Prepare and issue specifications and procedures on safety related activities and operations;
Support the conduct of and perform safety assessments, including modifications;
Have frequent personal contact with personnel, including observing work in progress;
Make provisions for adequate staffing³, succession planning and retention of corporate knowledge.

Main

3.14.

Requirement 58 of SSR‑4 [1] states that “The operating organization shall ensure that all activities that may affect safety are performed by suitably qualified and competent persons.”

Main

3.15.

In accordance with Requirement 58 and paras 9.39–9.47 of SSR‑4 [1], the operating organization is required to ensure that these personnel receive training and refresher training at suitable intervals, appropriate to their level of responsibility. In particular, personnel involved in activities with fissile material (both uranium and plutonium), radioactive material (including waste) and chemicals should understand the nature of the hazard posed by these materials and how these risks are controlled by the established safety measures, operational limits and conditions, and operating procedures.

Main

3.16.

Requirement 11 of GSR Part 2 [8] states that “The organization shall put in place arrangements with vendors, contractors and suppliers for specifying, monitoring and managing the supply to it of items, products and services that may influence safety.” In accordance with paras 4.33–4.36 of GSR Part 2 [8], the management system for a MOX fuel fabrication facility is required to include arrangements for procurement.

Main

3.17.

In accordance with para. 4.16(b) of SSR‑4 [1], the operating organization is required to ensure that suppliers of items and resources important to safety have an effective management system in place. To meet these requirements, the operating organization should conduct audits of the management systems of the suppliers.

Main

3.18.

Requirement 63 of SSR‑4 [1] states:

Main

3.19.

The management system for a MOX fuel fabrication facility should include management for criticality safety. Further recommendations on the management system for criticality safety are provided in SSG‑27 (Rev. 1) [4].

Main

3.20.

Any proposed modifications to existing facilities or activities, or proposals for the introduction of new activities, are required to be assessed for their implications for existing safety measures and appropriately approved before implementation (see paras 9.57(b) and (c) of SSR‑4 [1]). Modifications of safety significance are required to be subjected to safety assessment and regulatory review and, where necessary, they are required to be authorized by the regulatory body before they are implemented (see paras 9.57(h) and 9.59 of SSR‑4 [1]). The facility or activity documentation is required to be updated to reflect modifications (see paras 9.57(f) and (g) of SSR‑4 [1]). The operating personnel, including supervisors, should receive adequate training on the modifications.

Main

3.21.

Requirement 75 of SSR‑4 [1] states:

Main

3.22.

The audits performed by the operating organization (see para. 3.11), as well as proper control of modifications to facilities and activities (see para. 3.20), are particularly important for ensuring subcriticality. The results of audits are required to be evaluated by the operating organization, and corrective actions are required to be taken where necessary (see para. 4.2(d) of SSR‑4 [1]).

Main

3.23.

Deviations from operational limits and conditions, deviations from operating procedures and unforeseen changes in process conditions that could affect nuclear criticality safety are required to be reported and promptly investigated by the operating organization, and the operating organization is required to inform the regulatory body (see paras 9.34, 9.35 and 9.84 of SSR‑4 [1]). The depth and extent of the investigation should be proportionate to the safety significance of the event, in accordance with a graded approach. The investigation should cover the following:

An analysis of the causes of the deviation to identify lessons and to determine and implement corrective actions to prevent a recurrence;
An analysis of the operation of the facility or conduct of the activity, including an analysis of human factors;
A review of the safety assessment and analyses that were previously performed, including the safety measures that were originally established.

Main

3.24.

Requirement 73 of SSR‑4 [1] states that “The operating organization shall establish a programme to learn from events at the facility and events at other nuclear fuel cycle facilities and in the nuclear industry worldwide.” Recommendations on operating experience programmes are provided in IAEA Safety Standards Series No. SSG‑50, Operating Experience Feedback for Nuclear Installations [14].

Main

3.25.

In accordance with Requirement 5 of SSR‑4 [1], the safety of a MOX fuel fabrication facility is required to be assessed in the safety analysis and verified by periodic safety reviews. The operating organization should ensure that these periodic safety reviews of the facility form an integral part of the organization’s management system.

Main

3.26.

Requirement 6 of SSR‑4 [1] states that “An independent safety committee (or an advisory group) shall be established to advise the management of the operating organization on all safety aspects of the nuclear fuel cycle facility.”

Main

3.27.

The safety committee of a MOX fuel fabrication facility should have members or access to experts in areas of human factors, criticality safety and radiation protection. Such experts should be available to the facility at all times during operation.

Main

4.1.

The site evaluation process for a MOX fuel fabrication facility will depend on a large number of variables. At the earliest stage of planning a facility, a list of these variables should be prepared and considered in accordance with their safety significance. The risks posed by possible significant external hazards (e.g. earthquakes, accidental aircraft crashes, fires, nearby explosions, floods, extreme meteorological conditions) will probably dominate in the site evaluation process and should be taken into account in the design of the facility. Requirements for site evaluation for MOX fuel fabrication facilities are established in IAEA Safety Standards Series No. SSR‑1, Site Evaluation for Nuclear Installations [15], and further recommendations are provided in IAEA Safety Standards Series No. SSG‑35, Site Survey and Site Selection for Nuclear Installations [16].

Main

4.2.

The scope of the site evaluation for a MOX fuel fabrication facility is established in Requirement 3 of SSR‑1 [15] and Requirement 11 and paras 5.1–5.14 of SSR‑4 [1] and should reflect the specific hazards listed in Section 2 of this Safety Guide.

Main

4.3.

For a MOX fuel fabrication facility where a dry process is used to manufacture fuel, appropriate design and operation can ensure that gaseous releases are negligible under normal operating conditions. The main hazard in accident conditions is the potential release of plutonium (as plutonium oxide or MOX) as particles to the atmosphere or to the air of the working zone.

Main

4.4.

A MOX fuel fabrication facility should be considered to be a facility with a high hazard potential. This should be taken into consideration when applying a graded approach to the implementation of the requirements of SSR‑4 [1] to the facility. The following characteristics of the site should be considered, to ensure the safety of the facility: — Legal requirements: Using a site for which regulatory consent to process plutonium has already been granted. — Transport links: Minimizing the distance by which fissile material needs to be transported (e.g. by siting a MOX fuel fabrication facility on the same site as the plutonium production). Combined hazards and hazard interactions between the facilities on the same site should be understood and taken into consideration.

Main

4.5.

The population density and population distribution in the vicinity of a MOX fuel fabrication facility are required to be considered in the site evaluation process to minimize any possible health consequences for people in the event of a release of radioactive material and hazardous chemicals (see Requirements 4 and 12 of SSR‑1 [15]). Also, in accordance with Requirement 25 and paras 6.1 and 6.2 of SSR‑1 [15], the dispersion in air and water of radioactive material released from the MOX fuel fabrication facility is required to be assessed, taking into account the orography, land cover and meteorological features of the region. The environmental impact from the facility under all facility states is required to be evaluated (see para. 5.3 of SSR‑4 [1]) and should meet the applicable criteria.

Main

4.6.

Security advice is required to be taken into account in the selection of a site for a MOX fuel fabrication facility (see para. 11.4 of SSR‑4 [1]). Considering the presence of plutonium in the facility, special attention should be given to the management of the interface between nuclear safety and nuclear security during site evaluation (see Requirement 75 of SSR‑4 [1]). The selection of a site should take into account both safety and security aspects and should be facilitated by both safety experts and security experts.

Main

4.7.

Even if an existing nuclear site is used for a MOX fuel fabrication facility, the site evaluation should be performed using a process similar to that used for the siting of a new facility at a new site (see paras 3.24–3.27 of SSG‑35 [16]).

Main

4.8.

The operating organization should maintain a full record of the decisions taken on the selection of a site for a MOX fuel fabrication facility and the reasons behind those decisions.

Main

4.9.

The site characteristics should be reviewed periodically for their adequacy and persistent applicability during the lifetime of a MOX fuel fabrication facility. Any changes to these characteristics that might require safety reassessment should be identified and evaluated (see para. 5.14 of SSR‑4 [1]). This includes the case of an increase of the production capacity beyond the original envelope.

Main

5.1.

Requirement 7 of SSR‑4 [1] states:

Confinement and cooling of radioactive material and associated harmful materials;
Protection against radiation exposure;
Maintaining subcriticality of fissile material.”

Main

5.2.

The requirements on the confinement and cooling of radioactive material are established in Requirements 35 and 39 and paras 6.123–6.128 and 6.157–6.159 of SSR‑4 [1].

Main

5.3.

The requirements on protection against internal radiation exposure are established in Requirement 34 and paras 6.120–6.122 of SSR‑4 [1]. The requirements on protection against external radiation exposure are established in Requirement 36 and paras 6.129–6.134 of SSR‑4 [1]. Concerning the radiation associated with plutonium (i.e. neutron emissions and gamma radiation), an appropriate combination of requirements on source limitation, distance, time and shielding is necessary for the protection of personnel as relates to whole body exposure, exposure of the hands and exposure of the lens of the eye. For neutron emissions, a general design principle is to place the shielding as close as possible to the source. In some cases, remote operation should be considered if necessary. Individual monitoring of neutron doses to the personnel should be conducted in addition to individual monitoring of gamma radiation.

Main

5.4.

The requirements on maintaining subcriticality are established in Requirement 38 and paras 6.138–6.156 of SSR‑4 [1]. Recommendations on the design of a MOX fuel fabrication facility to ensure subcriticality are provided in section 3 of SSG‑27 (Rev. 1) [4].

Design basis and safety analysis

5.5.

A design basis accident is a postulated accident leading to accident conditions for which a facility is designed in accordance with established design criteria and conservative methodology, and for which releases of radioactive material are kept within acceptable limits [1].

Design basis and safety analysis

5.6.

The safety requirements relating to the design basis for items important to safety and for the design basis analysis for a nuclear fuel cycle facility are established in Requirements 14 and 20 of SSR‑4 [1], respectively.

Design basis and safety analysis

5.7.

The specification of a design basis (or equivalent) will depend on the design of the facility, the siting of the facility and regulatory requirements. However, particular consideration should be given to the following hazards in the specification of the design basis safety analysis for MOX fuel fabrication facilities:

Release of plutonium inside and/or outside the facility;
Internal and external hazards, including internal and external explosions (in particular hydrogen explosions), internal and external fires, dropped loads and handling errors, extreme meteorological phenomena (in particular earthquakes, flooding and tornadoes) and accidental aircraft crashes.

Design basis and safety analysis

5.8.

These hazards are of major safety significance as they might result in radiological consequences for the facility personnel. In addition, these hazards could also result in some adverse off‑site consequences for the public or the environment.

Design basis and safety analysis

5.9.

The hazards listed in para. 5.7 might occur as a consequence of a postulated initiating event. Selected postulated initiating events for nuclear fuel cycle facilities are provided in the appendix to SSR‑4 [1].

Structures, systems and components important to safety

5.10.

Paragraph 6.21 of SSR‑4 [1] states:

Confinement of radioactive material

5.11.

To meet Requirement 35 of SSR‑4 [1] in a MOX fuel fabrication facility, three static barriers (or more, as dictated by the safety analysis) should be provided, in accordance with a graded approach. The first static barrier normally consists of gloveboxes, fuel cladding, material containers or other equipment containing radioactive material. The second static barrier normally consists of the rooms around the gloveboxes. The third static barrier is the building itself. The design of the static containment system should consider openings between the different confinement zones (e.g. doors, penetrations). Such openings should be designed to ensure that confinement is maintained in all operational states, especially during maintenance (e.g. by the provision of permanent or temporary additional barriers) and, as far as practicable, in accident conditions.

Confinement of radioactive material

5.12.

Each physical barrier of the containment system should be complemented by one or more associated systems, which should establish a cascade of pressure between the environment outside the building and the air that might contain contaminated material inside the building, and across all static barriers within the building. The associated systems should be designed to prevent the movement or diffusion of radioactive or toxic gases, vapours and airborne particulates through any openings in the barriers to areas of lower contamination or concentration of these materials. The design of the associated systems should address the following, as far as applicable:

Operational states and accident conditions;
Maintenance, which may cause localized changes to conditions (e.g. opening access doors, removing access panels);
Where more than one ventilation system is used, protection in case of a failure of a lower pressure (higher contamination) system, causing pressure differentials and airflows to be reversed;
The need to ensure that all static barriers, including any filters or other effluent control equipment, can withstand the maximum differential pressures and airflows generated by the system, including increasing the filter resistance during operation and considering conservative assumptions regarding the meteorological conditions.

Confinement of radioactive material

5.13.

Specific attention should be paid in the design to operations that lead to the transfer of contaminated materials outside the static containment system. Normal operations should not involve any transfer of radioactive powders outside the first barrier (with gloveboxes and tunnels linking them). Design features should be provided for the removal of materials and items (such as waste or scrap) from the gloveboxes when needed.

Confinement of radioactive material

5.14.

Devices for monitoring air contamination should be included in the design of confinement areas close to working locations, especially at gloveboxes. The location of such devices should be finalized during cold commissioning, when precise airflows are established.

Confinement of radioactive material

5.15.

In confinement areas, appropriate equipment should be provided for monitoring surfaces for contamination. Contamination can be detected by smear sampling of surfaces or by using portable devices.

Confinement of radioactive material

5.16.

The design of a MOX fuel fabrication facility should be such as to facilitate operation, maintenance and decontamination activities. Building compartmentalization should be considered in the design to prevent contamination of large areas of the MOX fuel fabrication facility.

Confinement of radioactive material

5.17.

The ventilation system normally includes filters in series to protect the public and the environment. The air drawn into the ventilation system from the environment as well as the air discharged from the facility should be filtered. The filters filter the air during normal operation and ensure the continuity of the static barriers in the event of loss of ventilation.

Confinement of radioactive material

5.18.

The ventilation system should be designed and operated to minimize the opportunity for buildup of particulates. Appropriate procedures should be established and instruments should be provided to control the potential buildup of plutonium powder or MOX powder particulates in the ventilation ducts and in the high efficiency particulate air (HEPA) filters.

Confinement of radioactive material

5.19.

Primary filters should be located as close to the source of contamination as practicable (e.g. near or in the gloveboxes) to minimize the potential buildup of plutonium powder or MOX particulates in the ventilation ducts. Multiple primary filters in series should preferably be used to prevent any transfer of contamination during maintenance of one of the filters.

Confinement of radioactive material

5.20.

Filtration should be provided at ventilation inlet points to prevent the loss of particulates due to reverse or static flow conditions in case of ventilation system failure.

Confinement of radioactive material

5.21.

In addition, operating fans and standby fans should be provided and should be powered such that, in the case of loss of normal power, the uninterrupted functioning of glovebox ventilation systems is ensured. Local monitoring systems and alarm systems should be installed to alert operators to system malfunctions that might result in differential pressures that are considered too high or too low.

Confinement of radioactive material

5.22.

Last stage filters (see also para. 5.35) should be used to protect the public and the environment and should normally be located close to the location at which discharges to the environment occur.

Confinement of radioactive material

5.23.

To prevent the propagation of a fire through the ventilation ducts and to maintain the integrity of firewalls, ventilation systems should be equipped with fire and smoke dampers (see also para. 5.61).

Confinement of radioactive material

5.24.

At the design stage, provision should be made for the installation of equipment for monitoring airborne radioactive material. Monitoring points should be chosen that would correspond most accurately to the exposure of personnel and would minimize the time for detection of any leakage from the first barrier.

Confinement of radioactive material

5.25.

The design of a MOX fuel fabrication facility should allow all planned activities associated with operation or maintenance to be performed without breaching the primary containment.

Protection of workers

5.26.

Requirements on the design of MOX fuel fabrication facilities to ensure radiation protection are established in Requirement 8 of SSR‑4 [1].

Protection of workers

5.27.

The first static barrier normally protects the workers. The specifications for the design of the first static barrier should be established to ensure and to control the integrity of this barrier. The design should include specifications for: welding; selection of materials; leaktightness (for gloveboxes, for the ratio of the leak rate to the flow rate); the ability to withstand seismic loads; the design of the equipment (internal equipment for gloveboxes); penetration seals for electrical and mechanical penetrations; and the ease of performing maintenance work.

Protection of workers

5.28.

Gloveboxes often consist of welded stainless steel enclosures with windows, arranged either singly or in interconnected groups. Access to equipment inside the glovebox is provided through access holes in the glovebox window that are fitted with gloves (made of various materials depending on the work being performed in the glovebox) which maintain the confinement barrier.

Protection of workers

5.29.

Gloveboxes, fume hoods and filtered ventilation systems should be used to minimize the radiation exposure of personnel and their exposure to hazardous material that could become airborne and be inhaled. In addition, personal protective equipment should be used to avoid contamination of workers with radioactive material and other hazardous material, if protection cannot be achieved by design solutions only.

Protection of workers

5.30.

For normal operation, the need for the use of respiratory protection should be minimized through careful design of the static and dynamic containment systems and of devices for the immediate detection of low thresholds of airborne radioactive material. Respiratory protection during normal operation should be used only as a complementary means of protection in addition to existing barriers (see also paras 9.100 and 9.101 of SSR‑4 [1]).

Protection of workers

5.31.

Audio alarm systems should be installed to alert operators to fan failures and to high or low differential pressures across filters. At the design stage, provision is also required to be made for the installation of equipment for monitoring airborne uranium concentration and/or gas concentration (see para. 6.120 of SSR‑4 [1]). Monitoring points should be chosen that would correspond most accurately to the exposure of personnel and would minimize the time for detection of any leakage (see para. 6.121 of SSR‑4 [1]).

Protection of workers

5.32.

To facilitate decontamination and decommissioning of the facility, the walls, floors and ceilings in areas of the uranium fuel fabrication facility where contamination is likely should be made non‑porous and easy to clean. This may be done by applying special coatings, such as epoxy, to surfaces. In addition, all surfaces that could become contaminated should be made readily accessible to allow for periodic decontamination as necessary.

Protection of the public and the environment

5.33.

Paragraph 3.9 of IAEA Safety Standards Series No. GSR Part 3, Radiation Protection and Safety of Radiation Sources: International Basic Safety Standards [17], states:

Protection of the public and the environment

5.34.

The uncontrolled dispersion of radioactive substances to the environment as a result of an accident can occur if multiple confinement barriers are impaired. Barriers that may provide environmental protection comprise the room and the building itself. The provision of multiple redundant filters in parallel should be considered for the final stage of filtration before the discharge of exhaust gases through a stack. Filtration, including final stage filtration, also provides a means of minimizing the release of radioactive particulates to the environment under normal operating conditions, usually reducing gaseous discharges to acceptably low levels.

Protection of the public and the environment

5.35.

The design of a MOX fuel fabrication facility should also provide measures for ensuring that the performance of filtration is the same as that claimed in the facility safety analysis, particularly for the last stage filters. Provisions to ensure the performance of filtration may include testing the particulate removal efficiency (e.g. by aerosol challenge testing), differential pressure measurements and monitoring of alpha particles in ductwork. The design should include provisions to monitor the environment around the facility and to identify breaches of the confinement barriers.

Protection against external exposure

5.36.

Relevant requirements on design provisions for protection against external radiation exposure are established in Requirement 36 and paras 6.129–6.134 of SSR‑4 [1].

Protection against external exposure

5.37.

External exposure of workers should be controlled by means of an appropriate combination of requirements on source reduction, distance, time and shielding. Owing to the specific activity of plutonium, the shielding provided by the vessels and/or gloveboxes of a MOX fuel fabrication facility might not be sufficient to control exposure adequately, and thus additional controls on time, distance and shielding should be considered, where necessary.

Protection against external exposure

5.38.

If necessary, consideration should be given to the remote operation of process equipment and the installation of equipment for powder collection to prevent any spreading of radioactive powder in gloveboxes.

Protection against external exposure

5.39.

Provision for shielding in material storage areas, at process gloveboxes (e.g. where powder processing or pellet processing is performed) and in the fuel assembly area should be considered.

Prevention of nuclear criticality

5.40.

Prevention of nuclear criticality is an important topic with various aspects to be considered during the design and operation of a MOX fuel fabrication facility (see Requirement 38 of SSR‑4 [1]). Paragraphs 5.41–5.49 provide recommendations on some of the main elements of criticality safety that are specific for MOX fuel fabrication facilities. Detailed recommendations on criticality safety are provided in SSG‑27 (Rev. 1) [4].

Prevention of nuclear criticality

5.41.

The criticality safety analysis should demonstrate that the design of equipment and the related safety measures are such that the facility is in a subcritical state at all times (i.e. the values of the controlled parameters are always maintained in the subcritical range). This should be achieved by determining the effective neutron multiplication factor (k_eff), which mainly depends on the mass, the geometry, the distribution and the nuclear properties of the fissionable material and all other materials with which it is associated. The calculated value of k_eff (including all uncertainties and biases) should then be compared with the value specified by the design limit (which should be set in accordance with paras 2.8–2.12 of SSG‑27 (Rev. 1) [4]), and actions should be taken to maintain the value of k_eff under this limit.

Prevention of nuclear criticality

5.42.

Paragraph 6.142 of SSR‑4 [1] states that “For the prevention of criticality by means of design, the double contingency principle shall be the preferred approach.” For ensuring criticality safety in a MOX fuel fabrication facility, one or more of the following parameters of the system should be kept within subcritical limits:

PuO₂ (receipt):
1. Mass and geometry (i.e. limitation of the dimensions or shape) should be selected in accordance with the safety specification of PuO₂ isotopic composition and moderation.
2. The presence of appropriate neutron absorbers should be ensured.
UO₂ (receipt): Mass and geometry should be selected in accordance with the safety specification of UO₂ isotopic composition and moderation.
MOX powder (receipt or preparation): MOX powder is formed in the fuel fabrication process, and the associated criticality hazard should be assessed in accordance with the isotopic specifications and the PuO₂ content at each stage of the process:
1. Mass, geometry and moderation should be considered.
2. The presence of appropriate neutron absorbers should be ensured.
MOX pellets: Mass, geometry and moderation should be selected in accordance with the isotopic specifications, the PuO₂ content and the size of the pellets.
Fuel rods: Geometry and moderation should be selected in accordance with the isotopic specifications, the PuO₂ content and the design of the rods (e.g. size, cladding).
Fuel assemblies: Geometry and moderation should be selected in accordance with the isotopic specifications, the PuO₂ content distribution in the different rods and the design of the assembly.
Mass and geometry (i.e. limitation of the dimensions or shape) should be selected in accordance with the safety specification of PuO₂ isotopic composition and moderation.
The presence of appropriate neutron absorbers should be ensured.
Mass, geometry and moderation should be considered.
The presence of appropriate neutron absorbers should be ensured.

Prevention of nuclear criticality

5.43.

Some examples of the parameters subject to control for the prevention of criticality are as follows:

PuO₂(receipt):
1. The isotopic composition of plutonium (the ratios of the amount of a particular isotope of plutonium to the total amount of plutonium: ²³⁹Pu/Pu, ²⁴⁰Pu/Pu, ²⁴¹Pu/Pu,²⁴²Pu/Pu). ²³⁸Pu should not be taken into account as its isotopic content and neutron properties are not as well qualified as for the other plutonium isotopes.
2. The amount of moisture (degree of moderation) for control of criticality in the next stages of the MOX fuel fabrication process.
3. The upper bounded PuO₂ density.
UO₂ (receipt):
1. The isotopic composition of uranium (the ratio of the amount of ²³⁵U to the total amount of uranium: ²³⁵U/U). When this ratio is less than 1%, and provided that there is no significant presence of deuterium, beryllium or graphite present in the facility, no criticality hazard is to be considered for uranium powders.
2. The amount of moisture (degree of moderation) for control of criticality in the next stages of the MOX fuel fabrication process.
3. The upper bounded UO₂ density.
MOX powder (receipt or preparation):
1. The ratio of PuO₂ to the total amount of oxides (PuO₂/(UO₂ + PuO₂)).
2. The amount of moisture (degree of moderation) and the amount of additives (degree of moderation) for assessment of the criticality hazard at each stage of the process.
3. The upper boundary of the UO₂–PuO₂ (MOX) density.
4. The presence of non‑homogeneous distributions of moderators, if considered necessary.
MOX pellets (in addition to previous controls): Diameter range of the pellets.
Fuel rods (in addition to previous controls): Cladding thickness range of the rods.
Fuel assemblies (in addition to previous controls): Distribution of the fuel rods within the assembly.
The isotopic composition of plutonium (the ratios of the amount of a particular isotope of plutonium to the total amount of plutonium: ²³⁹Pu/Pu, ²⁴⁰Pu/Pu, ²⁴¹Pu/Pu,²⁴²Pu/Pu). ²³⁸Pu should not be taken into account as its isotopic content and neutron properties are not as well qualified as for the other plutonium isotopes.
The amount of moisture (degree of moderation) for control of criticality in the next stages of the MOX fuel fabrication process.
The upper bounded PuO₂ density.
The isotopic composition of uranium (the ratio of the amount of ²³⁵U to the total amount of uranium: ²³⁵U/U). When this ratio is less than 1%, and provided that there is no significant presence of deuterium, beryllium or graphite present in the facility, no criticality hazard is to be considered for uranium powders.
The amount of moisture (degree of moderation) for control of criticality in the next stages of the MOX fuel fabrication process.
The upper bounded UO₂ density.
The ratio of PuO₂ to the total amount of oxides (PuO₂/(UO₂ + PuO₂)).
The amount of moisture (degree of moderation) and the amount of additives (degree of moderation) for assessment of the criticality hazard at each stage of the process.
The upper boundary of the UO₂–PuO₂ (MOX) density.
The presence of non‑homogeneous distributions of moderators, if considered necessary.

Prevention of nuclear criticality

5.44.

In order to perform criticality analysis of a MOX fuel fabrication facility, the following input data should be specified:

The plutonium and uranium isotopic composition;
The PuO₂ content of the final MOX powder mix (PuO₂/(UO₂+PuO₂)) value;
The maximum density of the final MOX powder mix;
The final moderator material content in the mix (i.e. powder moisture, hydrogen and carbon content (composition) of the additives).

Prevention of nuclear criticality

5.45.

Several methods that vary widely in basis and form can be used to perform the criticality safety analysis, such as the use of experimental data, reference books or consensus standards, hand calculations and calculations by means of deterministic or probabilistic computer codes. For more extensive recommendations on performing a criticality safety assessment, including recommendations on validation of computer codes, see section 4 of SSG‑27 (Rev. 1) [4].

Prevention of nuclear criticality

5.46.

The criticality safety analysis should include the following:

The use of a conservative approach taking into account the following:
1. Uncertainties in physical parameters, the physical possibility of optimal moderation conditions and the potential for non‑homogeneous distributions of moderators;
2. The optimal geometry configuration of a system with fissile material;
3. Plausible operational occurrences and their combinations if they cannot be shown to be independent;
4. Operational states that might result from external hazards.
The use of appropriate verified and validated computer codes that are validated together with the appropriate data libraries of nuclear reaction cross‑sections for the normal and credible abnormal conditions being analysed, while taking into account any bias and its uncertainties (see paras 4.22–4.29 of SSG‑27 (Rev. 1) [4]).
Uncertainties in physical parameters, the physical possibility of optimal moderation conditions and the potential for non‑homogeneous distributions of moderators;
The optimal geometry configuration of a system with fissile material;
Plausible operational occurrences and their combinations if they cannot be shown to be independent;
Operational states that might result from external hazards.

Prevention of nuclear criticality

5.47.

Consideration should be given to criticality safety during pelletizing of the final MOX powder mix as the powder undergoes compression and changes in geometry. The approach to criticality safety, including safety analysis after this stage in the production, is similar to the approach taken in a uranium fuel fabrication facility, with additional considerations applicable to plutonium in MOX as presented in SSG‑27 (Rev. 1) [4].

Prevention of nuclear criticality

5.48.

The following are recommendations for conducting a criticality analysis for a MOX fuel fabrication facility to meet the safety requirements established in para. 6.144 of SSR‑4 [1]:

Enrichment: In criticality calculations, the use of an ‘effective enrichment’⁴ should be avoided unless the validity of the data used can be demonstrated with a high level of confidence.
Mass: The mass margin should be sufficient to compensate for possible overbatching of PuO₂ or MOX, or underbatching of UO₂.
Geometry: The potential for changes in dimensions (e.g. bulging of slab hoppers) during operational states and accident conditions is required to be considered in accordance with para. 6.144(d) of SSR‑4 [1].
Concentration, density and form of materials (in an analytical laboratory and in liquid effluent units): The analysis should cover a range of (i) plutonium and uranium concentrations for solutions and (ii) powder and pellet densities and moderators for different forms of MOX (e.g. powder, green and sintered pellets, rods) to determine the most reactive conditions that could occur.
Moderation: Water, oil and other hydrogenous substances such as additives are common moderators that are present in MOX fuel fabrication facilities or that might be present in accident conditions (e.g. water from firefighting). Special consideration should be given to cases of non‑homogeneous moderation.
Reflection: The most conservative margin should be retained of those resulting from different assumptions such as (i) a hypothetical thickness of water around the processing unit and (ii) consideration of the actual neutron reflection effect due, for example, to the presence of human beings, organic materials, shielding materials, or the concrete or steel of the container in or around the processing unit. Consideration should be given to situations where material might be present that could lead to a greater increase of the neutron multiplication factor than in a full water reflection system.
Neutron interaction: Consideration should be given to neutron interaction between all facility parts. This includes the minimum distance of mobile units containing UO₂ or PuO₂ and the engineered means for ensuring the minimal distance between equipment containing UO₂ or PuO₂.
Neutron absorbers: The neutron absorbers that may be used in MOX fuel fabrication facilities include cadmium and boron, and the safety analysis should incorporate their effect as neutron absorbers; however, ignoring their effects would yield conservative results. The use of mobile neutron absorbers should be avoided. Absorber parameters include thickness, density and nuclide composition of both the absorber material and the hydrogenated material used to increase its absorption efficiency (if applicable).

Prevention of nuclear criticality

5.49.

For processes in which fissile material is handled in a discontinuous manner (i.e. batch processing), the process and the related equipment should be designed to ensure that fissile material is transferred only when the limits defined for the next process are satisfied.

Prevention of nuclear criticality

5.50.

In accordance with para. 6.60 of SSR‑4 [1], postulated initiating events for detailed further analysis from the list of internal and external hazards are required to be identified for MOX fuel fabrication facilities.

Fire and explosion

5.51.

Fire in MOX fuel fabrication facilities might lead to the dispersion of radioactive material by breaching the confinement barriers or might cause a criticality accident by affecting the system or the parameters used for the control of criticality (e.g. the moderation control system or the dimensions of the processing equipment). Special consideration should be given to the fire extinguishing media deployed and their potential moderation effect.

Fire and explosion

5.52.

The fire hazards that are specifically encountered in a MOX fuel fabrication facility are associated with the presence of flammable and combustible materials such as electrical cabling and shielding, in particular when associated with gloveboxes and hydrogen in the sintering furnaces.

Fire and explosion

5.53.

As an important aspect of fire hazard analysis for a MOX fuel fabrication facility, areas of the facility that need special consideration should be identified (see Requirement 22 of SSR‑4 [1]). Fire hazard analyses of the facility should give particular consideration to the following:

Areas where fissile material is processed and stored;
Gloveboxes, especially those in which nuclear material is processed as powder or powder is produced;
Workshops and laboratories in which flammable liquids and/or combustible liquids, solvents and resins and reactive chemicals are used, or zirconium metal is mechanically treated (e.g. producing cuttings or shavings);
Areas with high fire loads, such as waste storage areas;
Waste treatment areas;
Rooms housing safety related equipment, for example items such as air filtering systems, and electrical switch rooms, whose ageing issues might lead to radiological consequences or consequences in terms of criticality that are considered to be unacceptable;
Process control rooms and emergency control rooms;
Evacuation routes.

Fire and explosion

5.54.

An analysis of fire and explosion is required to be conducted for MOX fuel fabrication facilities to meet Requirement 22 and the requirements established in paras 6.77–6.79 of SSR‑4 [1]. Fire hazard analysis should involve identification of the causes of fires, assessment of the potential consequences of a fire and, where appropriate, estimation of the frequency or probability of occurrence of fires. Fire hazard analysis should be used to assess the inventory of fuels and initiation sources, and to determine the appropriateness and adequacy of measures for fire protection. Computer modelling of fires may sometimes be used in support of the fire hazard analysis.

Fire and explosion

5.55.

The estimation of the likelihood of fires can be used as a basis for making decisions or for identifying weaknesses that might otherwise go undetected. Even if the estimated likelihood of fire may seem low, a fire might have significant consequences for safety, and thus certain protective measures should be undertaken, such as delineating small fire areas, to prevent fires or prevent a fire from spreading.

Fire and explosion

5.56.

The analysis of fire hazards should also involve a review of the provisions made at the design stage for preventing, detecting and mitigating fires.

Fire and explosion

5.57.

Prevention is the most important aspect of fire protection. Facilities should be designed to limit fire risks through the incorporation of measures to ensure that fires do not break out. Measures for mitigation should be put in place to minimize the consequences of a fire in the event that a fire breaks out despite preventive measures.

Fire and explosion

5.58.

To accomplish the twofold aim of fire prevention and mitigation of the consequences of a fire, a number of general and specific measures should be taken, including the following:

Minimization of the amount of combustible material present in gloveboxes; nevertheless, it may be necessary to maintain an inert atmosphere and install alarm systems for monitoring oxygen levels to minimize the probability of a large fire.
Separation of the areas where non‑radioactive hazardous material is stored from the process areas.
Minimization of the fire load of individual rooms.
Selection of materials, including building materials, process components and glovebox components and materials for penetrations, in accordance with functional criteria and fire resistance ratings.
Compartmentalization of the building and ventilation ducts as far as possible to prevent the spreading of fires. The building should be divided into fire zones and the structural design should take into consideration the respective fire load. Measures should be put in place to prevent or severely curtail the potential for the fire and smoke to generate soot and spread beyond the fire zone in which the fire breaks out. The higher the fire risk, the greater the number of fire zones the building should have.
Suppression or limitation of the number of possible ignition sources such as open flames or electrical sparks.

Fire and explosion

5.59.

Paragraph 6.79 of SSR‑4 [1] establishes requirements for the analysis with regard to fire extinguishing systems. Fire extinguishing devices, automatic or manually operated, with the use of an adequate extinguishing agent should be installed in zones where a fire is possible and where the consequences of a fire could lead to the dispersion of plutonium contamination outside the first static barrier. The installation of automatic firefighting devices with water sprays should be avoided for areas where uranium, plutonium and/or mixed oxide might be present, with account taken of the potential for criticality. Extinguishing gas other than carbon dioxide may be used in the event of a fire breaking out in a glovebox. The possible use of carbon dioxide should be considered in the criticality safety assessment.

Fire and explosion

5.60.

A detection and/or suppression system should be installed such that it is commensurate with the risks from internal fires and explosions. This system should be established in compliance with the national requirements.

Fire and explosion

5.61.

The design of ventilation systems should be given particular consideration with regard to fire prevention. Dynamic containment systems comprise ventilation ducts and filter units, which might constitute weak points in the fire protection system unless they are of suitable design. Fire dampers should be mounted in the ventilation system. Spark arrestors should be used to protect the filters if necessary. The required operational performance of the ventilation system should be specified so as to comply with fire protection requirements.

Fire and explosion

5.62.

Lines that cross the boundaries between fire zones (e.g. electricity lines, gas and process lines) should be designed to ensure that fire does not spread.

Fire and explosion

5.63.

In MOX fuel fabrication facilities, the use of hydrogen in the sintering furnaces is a potential cause of explosion. Hydrogen should be diluted with an inert gas (e.g. argon) before it enters the sintering furnace to reduce the likelihood of a hydrogen explosion. The supply of premixed gas should be automatically stopped when the concentration of hydrogen in the premixed gas exceeds a specified limit. The measurement of the concentration of hydrogen in the premixed gas should be subject to quality control. The composition of the premixed gas should be permanently monitored during operation.

Fire and explosion

5.64.

In addition, effective gas locks should be provided between rooms with a hydrogen atmosphere and other areas of the facility. Systems for detecting hydrogen leakages should be installed in rooms with a hydrogen atmosphere.

Fire and explosion

5.65.

The concentration of oxygen within gloveboxes filled with inert gas, presenting a risk of explosion, should be monitored.

Flooding

5.66.

Flooding in a MOX fuel fabrication facility might lead to the dispersion of radioactive material and to changes in the conditions for moderation.

Flooding

5.67.

Gloveboxes should not be connected to the water supply in normal operating conditions.

Flooding

5.68.

In facilities where vessels and/or pipes containing water are present, the criticality analysis should take into account the presence of the maximum credible amount of water that could be contained within the room under consideration, as well as the maximum credible amount of water in any connected rooms. Such rooms or premises should be clearly identified and the personnel should be informed.

Flooding

5.69.

Walls (and floors if necessary) of rooms where flooding could occur should be capable of withstanding the water load, and safety related equipment should not be affected by flooding.

Leaks and spills

5.70.

The amount of liquid present in a MOX fuel fabrication facility is limited. Water is used for cooling sintering furnaces. Possible steam explosions resulting from water entry due to a leak in the cooling system should be considered.

Leaks and spills

5.71.

Spillages might occur outside gloveboxes from cans, drums and waste packages during transit within the facility and/or in storage. Appropriate mechanical protection and appropriate confinement should be provided for movements of radioactive material.

Leaks and spills

5.72.

Where spillages in quantities that could be significant from the standpoint of criticality safety are possible, consideration should be given to installing design features to prevent water or moderator intrusion (e.g. as ingress of water from condensed humidity through ventilation systems). In these areas, installation of humidity detectors and drainage systems should also be considered.

Leaks and spills

5.73.

The surfaces of floors and walls should be chosen to facilitate their cleaning. This will also facilitate the minimization of waste from decommissioning.

Loss of services

5.74.

To meet the requirements established in Requirements 49 and 50 and para. 6.89 of SSR‑4 [1], electric power supplies and other support systems in a MOX fuel fabrication facility should be of high integrity. In the event of loss of normal power and depending on the status of the facility, an emergency power supply should be provided to certain structures, systems and components important to safety, including the following:

Criticality accident detection and alarm systems;
Ventilation fans and glovebox monitoring systems for the confinement of radioactive material;
Detection and alarm systems for leaks of hazardous materials, including explosive gases;
Heat removal systems;
Emergency control systems;
Fire detection and suppression systems;
Monitoring systems for radiation protection;
Lighting within the process facility.

Loss of services

5.75.

The loss of items such as gas for instrumentation and control, cooling water for process equipment and ventilation systems, heating water, breathing air and compressed air might also have consequences for safety. Examples of suitable measures to be addressed in the design of a MOX fuel fabrication facility to ensure safety include the following:

Loss of gas supply to gas actuated safety valves and dampers. In accordance with the safety analysis, valves should be used that are designed to fail to a safe position.
Loss of cooling water. Adequate backup capacity or a redundant supply should be provided for in the design.
Loss of breathing air. Adequate backup capacity or a redundant supply should be provided to allow work to continue to be performed in areas with airborne radioactive material.

Loss of services

5.76.

MOX materials generate heat due to presence of ²³⁸Pu, and storage rooms, storage gloveboxes and larger production units in MOX fuel fabrication facilities have potentially large heat loads. Overheating might challenge the safety functions.

Loss of services

5.77.

Ventilation systems are designed to provide cooling and to maintain temperatures below specified values. In a MOX fuel fabrication facility, in the event of a failure of the ventilation system, the time interval before the means of confinement are breached should be adequate for repairing the failure or for taking alternative actions. All structures, systems and components important to safety should be designed such that they can withstand heat loads generated during this interval.

Loss or excess of process media

5.78.

The loss of process media such as process gas supplies (e.g. hydrogen, helium, nitrogen, argon) and additives, or any excess of these media, might have consequences for safety. Some examples are the following:

Excess of additives in the powder preparation process should be considered in the criticality safety analysis.
Increase of levels of airborne contamination and/or concentration of hazardous material in the work areas of the facility because of overpressure in the gloveboxes (containing, for example, nitrogen, argon or helium).
Reduction of criticality safety due to loss of favourable geometry or loss of moderation control by excess of process gases.
Releases of large amounts of nitrogen, argon or helium might result in a reduction in the oxygen concentration in breathing air in the work areas of the facility.
For reasons of fire protection, inert gas may be used for the atmosphere in some gloveboxes. Failure of the gas supply, therefore, would remove one protective barrier. Consideration should be given to the integrity of the gas supply by providing a suitable backup supply or by ensuring diversity of supply.

Handling errors

5.79.

Handling systems (e.g. cranes) should be designed to reduce the frequency of occurrence of load drops. The consequences of possible load drops should be minimized, for example by qualification of the containers for drops, by the design of the floors and/or by the provision of safe travel paths.

Handling errors

5.80.

Mechanical failures or human errors during the handling of radioactive material might result in a degradation of criticality control, confinement or shielding. Mechanical failures or human errors during the handling of loads of non‑radioactive material might also result in a degradation of the safety functions of the MOX fuel fabrication facility.

Facility failures and equipment failures

5.81.

Measures for the industrial safety of commercial grade equipment installed in gloveboxes (e.g. mechanical guards) should be adapted to the nuclear environment.

Facility failures and equipment failures

5.82.

The design should minimize the potential for mechanical impacts on containers of hazardous and/or radioactive material caused by moving devices such as vehicles and cranes.

Facility failures and equipment failures

5.83.

Mechanical failures during the processing of nuclear material could result in damage to equipment (e.g. by crushing, bending or breakage) that might result in a degradation of criticality control, confinement or shielding. The design should ensure that the movement of heavy loads by cranes above vessels and piping containing large amounts of hazardous and/or radioactive material is minimized. For complex or important systems (e.g. rod handling systems designed to avoid the hazard of breaking a rod), a systematic method of failure analysis should be implemented.

Facility failures and equipment failures

5.84.

Failure due to fatigue or chemical corrosion or lack of mechanical strength should be considered in the design of containment systems for hazardous and/or radioactive material.

Facility failures and equipment failures

5.85.

To prevent failure of equipment containing hazardous materials (e.g. furnaces), effective programmes for maintenance, periodic testing and inspection should be established at the design stage (see also paras 5.164 and 5.165).

Radiolysis

5.86.

The irradiation of organic or hydrogenated substances by plutonium, or the resulting decomposition of molecules, might lead to the generation of gas (especially the release of hydrogen) or to the degradation of containment systems. The potential for radiolysis should be taken into account in the safety analysis for the following:

Liquid effluents and organic solvents used in the laboratory;
Contaminated oils and inflammable waste;
Process scraps enclosing hydrogenated additives;
Containers or plastic bags containing PuO₂ or MOX.

Radiolysis

5.87.

Pressurization caused by alpha decay generating helium in a sealed system and the potential for water evaporation due to radiolytic heat generation should be considered.

External hazards

5.88.

A MOX fuel fabrication facility should be designed in accordance with the nature and severity of the external hazards, either natural or human induced, identified and evaluated in accordance with the provisions of SSR‑1 [15]. Detailed recommendations on external hazards are provided in IAEA Safety Standards Series Nos SSG‑9 (Rev. 1), Seismic Hazards in Site Evaluation for Nuclear Installations [19]; SSG‑18, Meteorological and Hydrological Hazards in Site Evaluation for Nuclear Installations [20]; SSG‑21, Volcanic Hazards in Site Evaluation for Nuclear Installations [21]; and SSG‑68, Design of Nuclear Installations Against External Events Excluding Earthquakes [22]. Recommendations for specific external hazards for a MOX fuel fabrication facility are provided in paras 5.89–5.104.

Earthquakes

5.89.

To ensure that the design of a MOX fuel fabrication facility provides the required degree of robustness, a detailed seismic assessment (see SSR‑1 [15] and SSG‑9 (Rev. 1) [19]) should be made of the MOX fuel fabrication facility design, including the following seismically induced events:

Loss of cooling.
Loss of support services, including utilities.
Loss of confinement functions (static and dynamic).
Loss of safety functions for ensuring the return of the facility to a safe state and maintaining the facility in a safe state after an earthquake, including structural functions and functions for the prevention of other hazards (e.g. fire, explosion, load drop, flooding).
Loss of criticality safety controls such as geometry, moderation, absorption and reflection as a result of the following:
1. Deformation (geometry control);
2. Displacement (geometry control, fixed neutron absorbers, neutron interaction);
3. Loss of material (geometry control, soluble neutron absorbers);
4. Ingress of moderating material (moderation control).
Deformation (geometry control);
Displacement (geometry control, fixed neutron absorbers, neutron interaction);
Loss of material (geometry control, soluble neutron absorbers);
Ingress of moderating material (moderation control).

Earthquakes

5.90.

A MOX fuel fabrication facility should be designed for the design basis earthquake to ensure that the earthquake will not impair the function of control rooms. Supplementary control rooms or emergency control panels should be accessible and operable by staff after an earthquake exceeding the design basis. Equipment necessary to maintain the MOX fuel fabrication facility in a safe and stable state and equipment necessary to monitor the facility and environment should be tested (as far as practicable) and qualified using appropriate conservative methodologies, including the use of an earthquake simulation platform.

Earthquakes

5.91.

Depending on the site characteristics and location of the MOX fuel fabrication facility, as evaluated in the site assessment (see Section 4), the effect of a tsunami induced by an earthquake and of other extreme flooding events should be addressed in the facility design.

External fires and explosions and external toxic hazards

5.92.

Hazards from external fires and explosions could arise from various sources in the vicinity of a MOX fuel fabrication facility, such as petrochemical installations; forests; pipelines and road, rail or sea routes used for the transport of flammable material such as gas or oil; and volcanic hazards.

External fires and explosions and external toxic hazards

5.93.

To demonstrate that the risks associated with such external hazards are below acceptable levels, the operating organization should first identify all potential sources of hazards and then estimate the associated event sequences affecting the facility. The radiological or associated chemical consequences of any damage should be evaluated, and it should be verified that they are within acceptance criteria. Toxic hazards should be assessed to verify that specific gas concentrations meet the acceptance criteria. It should be ensured that external toxic hazards would not adversely affect the control of the facility. The operating organization should conduct a survey of potentially hazardous installations and transport operations for hazardous material in the vicinity of the facility. In the case of explosions, risks should be assessed for compliance with overpressure criteria.

External fires and explosions and external toxic hazards

5.94.

To evaluate the possible effects of flammable liquids, toxic spills, volcanic ashes, falling objects (such as chimneys), air shock waves and missiles resulting from explosions, their possible distance from the facility and hence their potential for causing physical damage should be assessed.

Extreme meteorological phenomena

5.95.

A MOX fuel fabrication facility should be protected against extreme meteorological conditions as identified in the site evaluation (see Section 4) by means of appropriate design provisions. These should generally include the following:

The ability of structures important to safety to withstand extreme weather loads, with particular assessment of parts of the facility structure designed to provide confinement;
The ability to maintain the availability of cooling systems under extreme temperatures and other extreme conditions;
The prevention of flooding of the facility including adequate means to evacuate water from the roof in cases of extreme rainfall;
The safe shutdown of the facility in accordance with the operational limits and conditions, followed by maintaining the facility in a safe and stable shutdown state, where necessary;
Events consequential to extreme meteorological conditions.

Extreme meteorological phenomena

5.96.

Measures for the protection of the facility against tornadoes will depend on the meteorological conditions for the area in which the facility is located. The design of buildings and ventilation systems should comply with specific national regulations relating to hazards from tornadoes. If specific national regulations do not exist, the design should adhere to international good practices.

Extreme meteorological phenomena

5.97.

High winds are capable of lifting and propelling objects as large as automobiles or utility poles. The possibility of impacts of tornado missiles such as these should be taken into consideration in the design stage for the facility, as regards both the initial impact and the effects of possible secondary fragments arising from collisions with and spallation from concrete walls or from other types of transfer of momentum.

Extreme meteorological phenomena

5.98.

The potential duration of extreme low or high temperatures should be taken into account in the design of support system equipment to prevent unacceptable effects such as the freezing of cooling circuits or to prevent adverse effects on venting and cooling systems.

Extreme meteorological phenomena

5.99.

If safety limits for humidity or temperature are specified in a building or a compartment, the air‑conditioning system should be designed to perform efficiently, including under extreme hot or wet weather conditions. The effect of condensation inside the facility should also be taken into consideration. Structural components of buildings (as static containment) should also be designed for extreme temperature and humidity and their associated thermal stress effects such as shrinkage in concrete.

Extreme meteorological phenomena

5.100.

The occurrence of snowfall and ice storms and their effects should be taken into account in the design of the facility and the safety analysis. Snow and ice are generally taken into account as an additional load on the roofs of buildings. In addition, snow and ice might impact ventilation systems and electrical equipment outside the buildings. The neutron reflecting effect and/or the interspersed moderation effect of the snow should be considered, if relevant.

Extreme meteorological phenomena

5.101.

For any flood events such as extreme rainfall (for an inland site) or storm surge (for a coastal site) attention should be focused on potential leak paths (breaks in the confinement barrier) into active cells and structures, systems and components important to safety when these are vulnerable to damage. Equipment containing fissile material should be designed to prevent any criticality accident in the event of flooding. Gloveboxes should be designed to be resistant (i.e. to remain undamaged and static) to the dynamic effects of flooding, and all glovebox penetrations should be above any potential flood levels. Electrical systems, instrumentation and control systems, emergency power systems (e.g. batteries, power generation systems) and control rooms should be protected by design.

Extreme meteorological phenomena

5.102.

For extreme rainfall, attention should be focused on the stability of buildings (e.g. hydrostatic and dynamic effects), the water level and, where relevant, the potential for mudslides. Consideration should be given to the highest flood level historically recorded and to siting the facility above this flood level, at sufficient elevation and with sufficient margin to account for uncertainties (e.g. in postulated effects of global warming), to avoid major damage from flooding.

Accidental aircraft crashes

5.103.

In accordance with the risks identified in the site evaluation (see Section 4), a MOX fuel fabrication facility should be designed to withstand the design basis impact.

Accidental aircraft crashes

5.104.

For evaluating the consequences of impacts or the adequacy of the design to resist aircraft impacts, only realistic crash scenarios should be considered, which may demand the knowledge of such factors as the possible angle of impact, velocity of the aircraft or the potential for fire and explosion due to the aviation fuel load. In general, fire cannot be ruled out following an aircraft crash. Therefore, specific requirements for fire protection and for emergency preparedness and response should be established.

Accidental aircraft crashes

5.105.

Instrumentation should be provided to monitor the relevant parameters (e.g. radiation doses due to external exposure, air quality of operational areas, building pressure), systems (e.g. ventilation systems) and general conditions of the facility (e.g. temperature, contamination) over their respective ranges for (a) normal operation, (b) anticipated operational occurrences and (c) accident conditions, to ensure that adequate information can be obtained on the status of the operations and the facility, and proper actions can be undertaken in accordance with operating procedures.

Accidental aircraft crashes

5.106.

Instrumentation should be provided for measuring all the main parameters whose variation might affect the safety of processes (e.g. pressure, temperature, flow rate). In addition, instrumentation should be provided for monitoring general conditions at the facility (e.g. criticality safety related parameters, radiation levels, individual dosimetry for external and internal exposure of personnel, releases of effluents, ventilation conditions), and for obtaining any other information about the facility necessary for its reliable and safe operation (e.g. presence of personnel, environmental conditions).

Accidental aircraft crashes

5.107.

Passive and active engineering controls are more reliable than administrative controls and should be preferred for control in operational states and in accident conditions. Automatic systems should be designed to maintain process parameters within the operational limits and conditions or to bring the process to a predetermined safe state, which for a MOX fuel fabrication facility is generally the shutdown state.

Accidental aircraft crashes

5.108.

Appropriate information should be made available to the operator for monitoring the effects of automatic actions. The layout of instrumentation and the manner of presentation of information should provide the operating personnel with an adequate picture of the status and performance of the facility. Devices should be installed that provide in an efficient manner visual and, as appropriate, audio indications of operational states that have deviated from normal conditions and that could affect safety. Provision should be made for the automatic measurement and recording of values of parameters that are important to safety and, where applicable, manual periodic testing should be used to complement automated continuous testing of conditions.

Control rooms and panels

5.109.

Control rooms and human–machine interface panels should be provided to centralize the availability of information and monitoring of actions. The need for and location of control rooms and panels in different areas should be evaluated taking into account occupational exposure, safety of personnel and emergency response. Where applicable, it may be useful to have dedicated control rooms to allow for the remote monitoring of operations, thereby reducing exposures and risks to personnel. Particular consideration should be given to identifying those events, both internal and external to the control rooms, that might pose a direct threat to the operators and to the operation of control rooms. Ergonomic factors should be taken into account in the design of control rooms and the design of control room displays and systems.

Safety related instrumentation and control systems

5.110.

The safety related instrumentation and control systems of a MOX fuel fabrication facility should include systems for the following:

Criticality control, criticality detection and alarm:
1. Depending on the method of criticality control, the control parameters usually include mass, density, moisture content, isotopic composition, fissile content, moderation and reflection of additives, and spacing between items.
2. Radiation detectors (gamma and/or neutron detectors) with audio and, where necessary, visual alarms for initiating immediate evacuation from the affected area, should cover all the areas where a significant quantity of fissile material is present (see para. 6.173 of SSR‑4 [1]).
Fire detection and suppression:
1. All rooms with fire loads or significant amounts of fissile and/or toxic chemical material should be equipped with fire alarms.
2. Gas detectors should be used in areas where a leakage of gases (e.g. hydrogen) could produce an explosive atmosphere.
Process control:
1. A safety related control system is the means of confirming the correct concentration of hydrogen in the gas supply to the sintering furnaces.
2. Temperatures, pressures, flow rates, concentrations of chemicals and/or radioactive material, and tank levels should be indicated.
Monitoring and control of ventilation:
1. Monitoring and control of ventilation is needed to ensure that the airflows in all areas of the MOX fuel fabrication facility are flowing in the correct direction (i.e. toward areas that are more contaminated). In working areas, the temperature and humidity levels and the level of pollutants should be controlled to ensure the comfort of personnel and good levels of hygiene. In some cases, local ventilation should be used (e.g. in rooms housing backup batteries).
2. Monitoring and control of ventilation should be applied in particular in areas where sintering furnaces and pellet grinding equipment are located.
Control of occupational radiation exposure:
1. External exposure. Direct reading dosimeters with real time displays and/or alarms should be used to monitor radiation doses to workers, in particular in areas in which inspection equipment such as X ray equipment and radioactive sources are located. Portable equipment and installed equipment should be used to monitor whole body exposures and exposures of the hands to gamma radiation and neutron emissions.
2. Internal exposure. Owing to the specific hazards of airborne plutonium, the following provisions should be considered:
  1. Continuous air monitors to detect plutonium should be installed as close as possible to the working areas to ensure the early detection of any dispersion of plutonium.
  2. Continuous air‑sampling devices should be installed in the breathing zone of personnel for the retrospective assessment of doses due to internal exposure.
  3. Devices for detecting alpha surface contamination should be installed close to the working areas and also close to the exits of rooms in which working areas are located
  4. Devices for detecting and assessing doses to the lens of the eye should be installed where appropriate (assessment of doses to the lens of the eye can also be performed by calculation methods).
Control of gaseous and liquid effluents:
1. MOX fuel fabrication facilities using dry fabrication processes have low volumes of liquid discharges that can usually be monitored for control purposes by sampling and analysis and by measuring the volumes of discharges. Real time measurements should be provided for continuous discharges. Special arrangements should be made for effluents from laboratories, which can differ from site to site.
2. Real time measurements should be made to confirm that filtration systems are working effectively.
3. The detection and alarm system of abnormal releases should be ensured.
Control of transfers of nuclear material.
Detection of surface contamination and airborne radioactive material and alarm systems.
Glovebox control:
1. Gloveboxes should be equipped with instrumentation and control systems ensuring negative pressure.
2. For gloveboxes containing inert gas, the in‑leakage gas concentration should be monitored for safety and, if necessary, to verify product quality. Temperature levels should also be monitored.
Depending on the method of criticality control, the control parameters usually include mass, density, moisture content, isotopic composition, fissile content, moderation and reflection of additives, and spacing between items.
Radiation detectors (gamma and/or neutron detectors) with audio and, where necessary, visual alarms for initiating immediate evacuation from the affected area, should cover all the areas where a significant quantity of fissile material is present (see para. 6.173 of SSR‑4 [1]).
All rooms with fire loads or significant amounts of fissile and/or toxic chemical material should be equipped with fire alarms.
Gas detectors should be used in areas where a leakage of gases (e.g. hydrogen) could produce an explosive atmosphere.
A safety related control system is the means of confirming the correct concentration of hydrogen in the gas supply to the sintering furnaces.
Temperatures, pressures, flow rates, concentrations of chemicals and/or radioactive material, and tank levels should be indicated.
Monitoring and control of ventilation is needed to ensure that the airflows in all areas of the MOX fuel fabrication facility are flowing in the correct direction (i.e. toward areas that are more contaminated). In working areas, the temperature and humidity levels and the level of pollutants should be controlled to ensure the comfort of personnel and good levels of hygiene. In some cases, local ventilation should be used (e.g. in rooms housing backup batteries).
Monitoring and control of ventilation should be applied in particular in areas where sintering furnaces and pellet grinding equipment are located.
External exposure. Direct reading dosimeters with real time displays and/or alarms should be used to monitor radiation doses to workers, in particular in areas in which inspection equipment such as X ray equipment and radioactive sources are located. Portable equipment and installed equipment should be used to monitor whole body exposures and exposures of the hands to gamma radiation and neutron emissions.
Internal exposure. Owing to the specific hazards of airborne plutonium, the following provisions should be considered:
1. Continuous air monitors to detect plutonium should be installed as close as possible to the working areas to ensure the early detection of any dispersion of plutonium.
2. Continuous air‑sampling devices should be installed in the breathing zone of personnel for the retrospective assessment of doses due to internal exposure.
3. Devices for detecting alpha surface contamination should be installed close to the working areas and also close to the exits of rooms in which working areas are located
4. Devices for detecting and assessing doses to the lens of the eye should be installed where appropriate (assessment of doses to the lens of the eye can also be performed by calculation methods).
Continuous air monitors to detect plutonium should be installed as close as possible to the working areas to ensure the early detection of any dispersion of plutonium.
Continuous air‑sampling devices should be installed in the breathing zone of personnel for the retrospective assessment of doses due to internal exposure.
Devices for detecting alpha surface contamination should be installed close to the working areas and also close to the exits of rooms in which working areas are located
Devices for detecting and assessing doses to the lens of the eye should be installed where appropriate (assessment of doses to the lens of the eye can also be performed by calculation methods).
MOX fuel fabrication facilities using dry fabrication processes have low volumes of liquid discharges that can usually be monitored for control purposes by sampling and analysis and by measuring the volumes of discharges. Real time measurements should be provided for continuous discharges. Special arrangements should be made for effluents from laboratories, which can differ from site to site.
Real time measurements should be made to confirm that filtration systems are working effectively.
The detection and alarm system of abnormal releases should be ensured.
Gloveboxes should be equipped with instrumentation and control systems ensuring negative pressure.
For gloveboxes containing inert gas, the in‑leakage gas concentration should be monitored for safety and, if necessary, to verify product quality. Temperature levels should also be monitored.

Safety related instrumentation and control systems

5.111.

The requirements relating to human factors engineering are established in Requirement 27 of SSR‑4 [1].

Safety related instrumentation and control systems

5.112.

Human factors in operation, inspection, periodic testing and maintenance should be considered at the design stage. Human factors to be considered for MOX fuel fabrication facilities should include the following:

The ease of intervention by the operator in all facility states;
Possible effects on safety of inappropriate or unauthorized human actions (with account taken of tolerance of human error);
The potential for occupational exposure.

Safety related instrumentation and control systems

5.113.

The design of the facility to take account of human factors is a specialist area. Experts and experienced operators should be involved from the earliest stages of design. Areas that should be considered include the following:

Design of working conditions to ergonomic principles:
1. The operator–process interface, for example electronic control panels displaying all the necessary information and no superfluous information;
2. The working environment, for example ensuring good access to, and adequate space around, equipment and suitable finishes to surfaces for ease of cleaning.
Choice of location and clear labelling of equipment to facilitate maintenance, testing, cleaning and replacement.
Provision of fail‑safe equipment and automatic control systems for accident sequences for which reliable and rapid protection is required.
Good task design and ease of implementing operating procedures, particularly during maintenance work, when automated control systems may be disabled.
Minimization of the need to use additional means of personal radiation protection.
The criticality mass limit, the actual mass of fissile material and the monitoring thresholds in a glovebox should be visible to the operator. The availability of this information should be considered in case of computer failure.
Operating experience feedback relevant to human factors.
The operator–process interface, for example electronic control panels displaying all the necessary information and no superfluous information;
The working environment, for example ensuring good access to, and adequate space around, equipment and suitable finishes to surfaces for ease of cleaning.

Safety related instrumentation and control systems

5.114.

In the design and operation of gloveboxes, the following specific considerations should be taken into account:

In the design of equipment inside gloveboxes, the potential for conventional industrial hazards that might result in injuries to personnel, including internal radiation exposure through cuts in the gloves and/or wounds on the operator’s skin, and/or the possible failure of confinement;
Ease of physical access to gloveboxes and adequate space and good visibility in the areas in which gloveboxes are located;
The potential for damage to gloves from sharp edges and corners on equipment and fittings and associated tools;
Training of operators on procedures to be followed for normal and abnormal conditions.

Safety related instrumentation and control systems

5.115.

Requirement 14 of GSR Part 4 (Rev. 1) [13] states that “The performance of a facility or activity in all operational states and, as necessary, in the post‑operational phase shall be assessed in the safety analysis.” The safety analysis of MOX fuel fabrication facilities should include an analysis of various hazards for the whole facility and all activities.

Safety related instrumentation and control systems

5.116.

The list of postulated initiating events identified should take into account all the internal and external hazards and the resulting event scenarios. The safety analysis should be performed taking into consideration all the structures, systems and components important to safety that might be affected by the postulated initiating events identified.

Safety related instrumentation and control systems

5.117.

For MOX fuel fabrication facilities, the safety analysis should be performed iteratively with the development of the design, with the objectives of achieving the following:

That doses to personnel and the public during operational states are within acceptable and operational limits for those states and consistent with the optimization of protection and safety (see Requirements 11 and 12 of GSR Part 3 [17]);
That the radiological and chemical consequences of design basis accidents (or equivalent) to the public are within the limits specified for accident conditions and consistent with the optimization of protection and safety (see GSR Part 3 [17]);
That appropriate operational limits and conditions are developed.

Safety analysis for operational states

5.118.

A facility specific, realistic, enveloping and robust (i.e. conservative) assessment of internal and external occupational exposure and public exposure during normal operation and anticipated operational occurrences should be performed on the basis of the following:

Calculations of the estimated doses due to occupational exposure should be made on the basis of the conditions at the most exposed workplaces, should use maximum annual working times and should account for maintenance activities.
Calculations of the envelope source term should be made on the basis of (i) reference isotopic compositions of plutonium and traces of associated transuranic elements and fission products and (ii) the highest specific activities of these radioactive materials. On the basis of data on dose rates collected during commissioning runs and as necessary, the operational limits and conditions may include maximum annual working times for particular workplaces.
Calculations of estimated doses to the public should be made on the basis of the maximum estimated releases of radioactive material to the air and to water, the maximum depositions to the ground and direct exposure. Conservative models and parameters should be used to calculate the estimated doses to the public in the initial stages of design, with consideration given to further refinement as appropriate.
Calculations of the source term should use the licensed inventories of radioactive material present in each piece of equipment and in each glovebox and storage area.
Calculations of the efficiency of shielding during normal operation should be made on the basis of conservative assumptions regarding the performance of shielding.
Calculations of the estimated doses due to occupational exposure should be made using the maximum cumulative annual working time at each workplace for operation and anticipated maintenance work.

Safety analysis for operational states

5.119.

A best estimate methodology with the use of adequate margins may also be used in the safety analysis.

Safety analysis for operational states

5.120.

The design of equipment; the layout of equipment in, for example, gloveboxes; and the placement of shielding should be determined on the basis of adequate interaction and feedback between process and mechanical designs, safety assessment and operational experience from similar facilities and/or facilities upstream in the process (e.g. spent fuel reprocessing or plutonium polishing facilities). Cleaning operations (e.g. elimination of heavy dust from gloveboxes) should be given special consideration in the design.

Safety analysis for operational states

5.121.

As soon as plutonium is introduced into the MOX fuel fabrication facility, the calculated doses should be compared with actual dose rates. If considered necessary, maximum permissible annual working times for specific workplaces may be included in the operational limits and conditions.

Methods and assumptions for safety analysis for accident conditions

5.122.

The acceptance criteria associated with the accident analysis should be defined in accordance with Requirement 16 of GSR Part 4 (Rev. 1) [13] and with respect to national regulations and relevant criteria.

Methods and assumptions for safety analysis for accident conditions

5.123.

For a MOX fuel fabrication facility, the consequences of design basis accidents could result in consequences for individuals on the site and close to the location of the accident. The consequences depend on various factors such as the amount and rate of release of radioactive material, the distance between the source of the release and the individuals exposed or affected, the pathways for the transport of material to individuals and the exposure times.

Methods and assumptions for safety analysis for accident conditions

5.124.

To estimate the on‑site and off‑site consequences of an accident, the entire range of physical processes that could lead to a release of radioactive material to the environment or to a loss of shielding should be modelled in the accident analysis and the worst credible consequences should be determined.

Methods and assumptions for safety analysis for accident conditions

5.125.

Accident consequences should be assessed in accordance with the requirements established in GSR Part 4 (Rev. 1) [13] and with relevant parts of its supporting Safety Guides.

Analysis of design extension conditions

5.126.

The safety analysis should identify design extension conditions, and their progression and consequences should be analysed in accordance with Requirement 21 of SSR‑4 [1]. The objective is to identify and analyse additional accident scenarios to be addressed in the design of a MOX fuel fabrication facility. Paragraph 6.74 of SSR‑4 [1] states:

Analysis of design extension conditions

5.127.

Design extension conditions include events more severe than design basis accidents that could originate from extreme events, or combinations of events, which could cause damage to structures, systems and components important to safety or which could challenge the fulfilment of the main safety functions. The postulated initiating events provided in the appendix to SSR‑4 [1] are required to be used, including combinations of initiating events as well as events with additional failures. Accidents that have more severe consequences as well as progressions of events that could potentially lead to radiological or chemical releases should also be analysed to support emergency preparedness and response and assist in the development of emergency plans to mitigate the consequences of an accident.

Analysis of design extension conditions

5.128.

Additional safety features or increased capability of safety systems, identified during the analysis of design extension conditions, should be implemented in the facility where practicable.

Analysis of design extension conditions

5.129.

For analysing design extension conditions, best estimate methods with realistic boundary conditions can be applied. Acceptance criteria for this analysis, in accordance with para. 6.74 of SSR‑4 [1], should be defined by the operating organization and should be reviewed by the national regulatory body.

Analysis of design extension conditions

5.130.

Examples of design extension conditions that are applicable to MOX fuel fabrication facilities can be found in Ref. [23].

Analysis of design extension conditions

5.131.

Analysis of design extension conditions should also demonstrate that the MOX fuel fabrication facility can be brought into a state where the confinement function and subcriticality can be maintained in the long term (see also SSG‑27 (Rev. 1) [4]).

Assessment of possible radiological or associated chemical consequences

5.132.

The main steps for the assessment of possible radiological or chemical consequences in the safety analysis should include the following:

Analysis of the actual site conditions (e.g. meteorological, geological and hydrogeological site conditions) and conditions expected in the future, including internal and external initiating events with the potential for adverse effects.
Specification of facility design information and facility configurations, with the corresponding operating procedures and administrative controls for operations.
Identification of individuals and population groups (for facility personnel and members of the public) who could possibly be affected by radiation risks and/or associated chemical risks arising from the operation of the facility.
Identification and analysis of conditions at the facility, including internal and external initiating events that could lead to a release of material or of energy with the potential for adverse effects, the time frame for emissions and the exposure time, in accordance with reasonable scenarios.
Quantification of the consequences for the individuals and population groups identified in the safety assessment.
Identification and specification of the structures, systems and components important to safety that may be credited to reduce the likelihood and/or to mitigate the consequences of accidents. These structures, systems and components that are credited in the safety assessment should be qualified to perform their functions in accident conditions.
Characterization of the source term (e.g. material, mass, release rate, temperature).
Identification and analysis of pathways by which material that is released could be dispersed in the environment.
Considerations for the interface between safety and nuclear security.

Assessment of possible radiological or associated chemical consequences

5.133.

The analysis of the conditions at the site and the conditions expected in the future involves a review of the meteorological, geological and hydrological conditions at the site that might influence facility operations or might play a part in transporting material or transferring energy that might be released from the facility.

Assessment of possible radiological or associated chemical consequences

5.134.

Environmental transfer of material should be calculated with qualified computer codes or by using data derived from qualified codes, with account taken of the meteorological and hydrological conditions at the site that would result in the highest exposure of the public.

Assessment of possible radiological or associated chemical consequences

5.135.

The identification of personnel and members of the public (i.e. the representative person) who might potentially be affected by an accident involves a review of descriptions of the facility and of demographic information.

Assessment of possible radiological or associated chemical consequences

5.136.

In the assessment of the consequences of design extension conditions, less conservative assumptions compared with those made in the design basis analysis may be used (e.g. on prevailing wind directions on the site).

Assessment of possible radiological or associated chemical consequences

5.137.

The magnitude and severity of conditions considered in design extension conditions as well as the acceptance criteria used for acceptability of consequences of design extension conditions should be approved by the national regulatory body.

Assessment of possible radiological or associated chemical consequences

5.138.

Further recommendations on the assessment of potential radiological impact to the public can be found in GSG‑10 [18]. Useful guidelines for assessing the acute and chronic toxic effects of chemicals used in MOX fuel fabrication facilities are provided in Ref. [24].

Assessment of possible radiological or associated chemical consequences

5.139.

A comprehensive hazard assessment should be performed in accordance with Requirement 4 of IAEA Safety Standards Series No. GSR Part 7, Preparedness and Response for a Nuclear or Radiological Emergency [25], before the commissioning of the facility. The results of the hazard assessment should provide a basis for identifying the emergency preparedness category relevant to the facility and the on‑site areas and, as relevant, off‑site areas where protective actions and other response actions may be warranted in the case of a nuclear or radiological emergency. Further recommendations are provided in IAEA Safety Standards Series No. GS‑G‑2.1, Arrangements for Preparedness for a Nuclear or Radiological Emergency [26].

Assessment of possible radiological or associated chemical consequences

5.140.

The operating organization of a facility is required to establish emergency arrangements that take into account the potential hazards at the facility (see Requirement 72 of SSR‑4 [1]). The emergency plan and procedures and the necessary equipment and provisions should be determined on the basis of selected scenarios for design extension conditions and beyond design basis accidents (or the equivalent). The conditions under which an off‑site emergency response might be required to be initiated should include criticality accidents, widespread fires and earthquakes.

Assessment of possible radiological or associated chemical consequences

5.141.

The general requirements for optimization of protection and safety for waste and effluent management and the formulation of a waste strategy are established in IAEA Safety Standards Series No. GSR Part 5, Predisposal Management of Radioactive Waste [27], and recommendations are provided in IAEA Safety Standards Series Nos GSG‑3, The Safety Case and Safety Assessment for the Predisposal Management of Radioactive Waste [28]; GSG‑1, Classification of Radioactive Waste [29]; SSG‑41, Predisposal Management of Radioactive Waste from Nuclear Fuel Cycle Facilities [30]; and GSG‑16 [11]. Recommendations on aspects that are particularly relevant or specific to MOX fuel fabrication facilities are provided in paras 5.142–5.143.

Assessment of possible radiological or associated chemical consequences

5.142.

In accordance with Requirement 24 of SSR‑4 [1], the generation of radioactive waste is required to be kept to the minimum practicable in terms of both activity and volume, by means of appropriate design measures. Recovery of nuclear material and reuse of chemicals should be applied to the extent practicable in MOX fuel fabrication facilities to minimize the generation of waste in both solid and liquid forms. The main type of waste encountered in MOX fuel fabrication facilities is material contaminated with plutonium (from plutonium oxide or MOX). The following aspects should be considered in the design of MOX fuel fabrication facilities:

Generation of waste:
1. The design of the facility should be such as to minimize the amount of materials imported into gloveboxes in order to minimize radioactive waste generation.
2. Appropriate management options (including, as appropriate, disposal routes) should be identified for all waste streams that will be generated, and the design of the facilities should be such as to facilitate waste management.
3. It is possible that segregation of wastes with different properties (including different levels of radioactivity) may be possible at some stages of the process and should be considered in order to facilitate disposal by optimized routes (e.g. removal of uncontaminated outer packaging for disposal separate to plutonium contaminated inner packaging).
Removal of waste:
1. Waste should be first bagged in the glovebox and then removed from the glovebox using bagging ports in which a bag is attached to the glovebox and the waste is inserted and then removed after sealing to maintain confinement. The size of the port should be such as to accommodate the expected waste, which may include equipment that has been replaced.
2. Filters from the gloveboxes and the ventilation system should be packed using appropriate radioactive waste containers.
3. First stage aerosol filters should be recycled to return nuclear material to production.
Collection of waste:
1. For the assessment and management of waste contaminated with plutonium, provision should be made for a central waste management area. In this central area, waste should be monitored for its plutonium content and may be treated and placed in containers for interim storage.
2. Design features for the collection and transport of waste should be such as to reduce the potential for dropping bags of waste.
3. An indicative measurement or qualified estimate of fissile material mass in a waste package should be made before the package is moved to the central waste management area to ensure criticality safety.
4. Design features should be provided for the collection and transport of waste in containers to provide an additional level of confinement.
5. Consideration should be given to criticality control and radiation exposure of the personnel when a number of bags of waste are collected.
Interim storage of waste: Subsequent treatment outside the MOX fuel fabrication facility may include conditioning, compaction and washing of the waste before its long term storage.
The design of the facility should be such as to minimize the amount of materials imported into gloveboxes in order to minimize radioactive waste generation.
Appropriate management options (including, as appropriate, disposal routes) should be identified for all waste streams that will be generated, and the design of the facilities should be such as to facilitate waste management.
It is possible that segregation of wastes with different properties (including different levels of radioactivity) may be possible at some stages of the process and should be considered in order to facilitate disposal by optimized routes (e.g. removal of uncontaminated outer packaging for disposal separate to plutonium contaminated inner packaging).
Waste should be first bagged in the glovebox and then removed from the glovebox using bagging ports in which a bag is attached to the glovebox and the waste is inserted and then removed after sealing to maintain confinement. The size of the port should be such as to accommodate the expected waste, which may include equipment that has been replaced.
Filters from the gloveboxes and the ventilation system should be packed using appropriate radioactive waste containers.
First stage aerosol filters should be recycled to return nuclear material to production.
For the assessment and management of waste contaminated with plutonium, provision should be made for a central waste management area. In this central area, waste should be monitored for its plutonium content and may be treated and placed in containers for interim storage.
Design features for the collection and transport of waste should be such as to reduce the potential for dropping bags of waste.
An indicative measurement or qualified estimate of fissile material mass in a waste package should be made before the package is moved to the central waste management area to ensure criticality safety.
Design features should be provided for the collection and transport of waste in containers to provide an additional level of confinement.
Consideration should be given to criticality control and radiation exposure of the personnel when a number of bags of waste are collected.

Assessment of possible radiological or associated chemical consequences

5.143.

Appropriate quality controls should be applied throughout the management of waste from all waste streams. Recommendations on the management system for radioactive waste management are provided in GSG‑16 [11].

Assessment of possible radiological or associated chemical consequences

5.144.

MOX fuel fabrication facilities should be designed so that the need for discharges is avoided. If discharges cannot be avoided, the operating organization should ensure that discharge limits can be met in normal operation and that accidental releases to the environment are prevented.

Assessment of possible radiological or associated chemical consequences

5.145.

Liquid effluents to be discharged to the environment should be monitored, treated and managed as necessary to reduce the discharges of radioactive material and hazardous chemicals.

Assessment of possible radiological or associated chemical consequences

5.146.

Where necessary, equipment should be installed to reveal potential failure of treatment systems, such as differential pressure gauges to identify failed filters. If required by the safety analysis or the relevant authorization, discharge monitoring should be provided via continuous sampling of the activity in the liquid or gas, coupled with continuous measurement of the discharge flow rate.

Assessment of possible radiological or associated chemical consequences

5.147.

MOX fuel fabrication facilities which use dry processes generate dust. The gaseous effluent discharges from MOX fuel fabrication facilities should be reduced by filtration, which normally consists of a number of HEPA filters in series.

Customer specifications on fuel characteristics

5.148.

Customer specifications on fuel characteristics that have implications for safety in the design and operation of MOX fuel fabrication facilities (e.g. criticality, shielding, thermal effects) should be taken into account at an early stage in the design of the facility and equipment, especially in the specifications for the plutonium content and anticipated or conservatively bounding isotopic vector as input and the specifications for MOX fuel assemblies as output.

Gloveboxes

5.149.

Gloveboxes should be designed to facilitate the use of dry methods of cleaning (e.g. with vacuum cleaners).

Radiation protection and shielding

5.150.

Plutonium oxide and MOX can generate significant dose rates depending on the isotopic composition of the material processed. MOX from higher burnup plutonium oxide can give rise to significant neutron dose rates, while the presence of ²⁴¹Am (a decay product of²⁴¹Pu) can give rise to gamma radiation. Uranium oxide from reprocessing may also contain residual fission products and ²³²U with its decay products that give rise to beta and gamma radiation.

Radiation protection and shielding

5.151.

As unwanted accumulation of plutonium powder along the process might lead to high dose rates to personnel performing maintenance, the design of process lines should allow periodic inspection and cleaning of the systems in order to lower the ambient dose rate.

Radiation protection and shielding

5.152.

As there might be significant dose rates in areas of the MOX fuel fabrication facility occupied by personnel, consideration should be given at the design stage to the need for neutron and gamma shielding.

Radiation protection and shielding

5.153.

Effective shielding from 60 keV gamma radiation from ²⁴¹Am and from neutron emissions may be applied to the faces of gloveboxes, but this can restrict visibility and thus lead to increased occupancy periods at the glovebox by personnel. The type of shielding should therefore be selected on the basis of the estimated total doses due to occupational exposure during normal operation and maintenance.

Intermediate storage of MOX and plutonium oxide

5.154.

Plutonium oxide may be stored in MOX fuel fabrication facilities pending its processing. MOX may be stored at intermediate stages in the process as powder, pellets, rods or assemblies. The necessary storage capacity should be determined by process buffer quantities.

Modularization

5.155.

To facilitate the construction and commissioning of a MOX facility to meet Requirement 29 of SSR‑4 [1], the modularization of structures, systems and components should be considered. Modularization enables manufacturers of structures, systems and components to preassemble parts of the production line out of the facility site in better space conditions and using specific tools and equipment, and to perform initial tests of the structures, systems and components. This helps the installation on the site and reduces manufacturing deficiencies of the structures, systems and components before their transport to the facility site.

Modularization

5.156.

The design should consider using a limited number of types of modules, as well as combining modules for different purposes, so as to reduce the complexity of the structures, systems and components in order to achieve a lower frequency of maintenance activities and reduced doses to workers (see Requirement 36 of SSR‑4 [1]).

Maintenance policy

5.157.

The maintenance policy should cover the following aspects:

Consideration of whether maintenance should be performed by remote operation or manually by using gloves. This may vary for different stages in the process.
Criticality safety conditions such as limitations on the introduction of liquids, solvents, plastics and other moderators.
Prevention of contamination when replacing equipment (e.g. motors and drives may be located outside gloveboxes).
Limitation and removal of dust. Gloveboxes might become dusty unless cleaned regularly. A dusty environment might reduce visibility and might increase the whole body exposure and the occupational hand exposure (when hands are placed in dusty gloves).
Loss of shielding material. Shielding on gloveboxes is often provided for normal process operations and may need to be removed for access for maintenance. Ideally, it should be possible to remove the source before removing the shielding.
The design should avoid, where possible, sharp edges and the need for sharp equipment in gloveboxes to minimize the potential for causing wounds that could become contaminated.

Design provisions for on‑site transfer of radioactive material and hazardous materials

5.158.

Requirements for control over the transfer of radioactive material and other hazardous materials are established in Requirement 28 and paras 6.111 and 6.112 of SSR‑4 [1].

Design provisions for on‑site transfer of radioactive material and hazardous materials

5.159.

The design of the facility and the production processes should take into account the number of on‑site transfers of radioactive material across different safety related zones (e.g. contamination and criticality controlled areas).

Design provisions for on‑site transfer of radioactive material and hazardous materials

5.160.

For incoming containers containing radioactive material, sufficient technical provisions for checking the integrity should be considered during the design stage.

Design provisions for on‑site transfer of radioactive material and hazardous materials

5.161.

All containers used for transfer of radioactive material on the site should be considered in the safety analysis.

Design provisions for on‑site transfer of radioactive material and hazardous materials

5.162.

For cases where misidentification of containers could pose a hazard, provisions for easy identification of the content should be used (e.g. use of unique colours, shapes and/or valves).

Design provisions for on‑site transfer of radioactive material and hazardous materials

5.163.

Technical provisions for inspection and maintenance of containers that are classified as items important to safety should be available. All containers should be controlled by a computer based system (e.g. to monitor the actual status, position and technical conditions of the containers).

Design provisions for on‑site transfer of radioactive material and hazardous materials

5.164.

The analyses of handling arrangements should cover the following:

Transport routes and intersections within the facility;
Technical limits of the transport vehicles;
Handling failures during transport.