SSR-4 Safety of Nuclear Fuel Cycle Facilities

Hledej:

Sekce	Odstavec	Text
Main	1.1.	This Safety Requirements publication establishes requirements for all the important areas of safety in all stages of the lifetime of a nuclear fuel cycle facility, including design and operation and all activities performed to achieve the purpose for which the facility was constructed. These activities include maintenance, in-service inspection and other associated activities, as well as the processing of radioactive material from its introduction to the facility to its exit from the facility. This publication supersedes the Safety Requirements publication, IAEA Safety Standards Series No. NS-R-5, Safety of Nuclear Fuel Cycle Facilities, issued in 2008 and revised and reissued with additional appendices in 2014.¹
Main	1.2.	Requirements for nuclear safety are intended to ensure the highest level of safety that can reasonably be achieved for the protection of workers, the public and the environment from harmful effects of ionizing radiation arising from nuclear facilities [1]. It is recognized that technology and scientific knowledge advance, and that nuclear safety and the adequacy of protection against radiation risks need to be considered in the context of the present state of knowledge. This Safety Requirements publication reflects the present international consensus and the experience of IAEA Member States from using the previous edition.
Main	1.3.	In this publication, nuclear fuel cycle facilities are nuclear installations, other than nuclear power plants, research reactors and critical assemblies, in which nuclear material and radioactive material are processed, handled, stored and prepared for disposal, in quantities or concentrations that pose potential hazards to personnel, the public and the environment. Nuclear fuel cycle facilities include facilities for: Mining and processing of uranium and thorium ores; Conversion and enrichment of uranium; Reconversion and fabrication of nuclear fuels of all types; Interim storage of fissile material and fertile material before and after irradiation; Production of nuclear energy for power, research and other purposes; Reprocessing of spent nuclear fuel and breeder materials from thermal reactors and fast reactors; Associated waste conditioning, effluent treatment and facilities for interim storage of waste that allow for retrieval of the waste for later disposal; Separation of radionuclides from irradiated thorium and uranium; Related research and development.
Main	1.4.	Nuclear fuel cycle facilities employ many diverse technologies and processes. Radioactive material is often processed through a series of interconnected units and consequently can be found throughout an entire facility. The physical and chemical forms of the processed material may also vary within a single facility. Some of the processes use hazardous chemical substances and gases, which may be toxic, corrosive, combustible or reactive and consequently may give rise to the need for specific requirements in addition to requirements for nuclear safety. For example, the reactive chemicals used in many nuclear fuel cycle facilities can cause exothermic reactions that may need to be controlled to prevent effects such as overheating, fire or explosion. A further feature specific to nuclear fuel cycle facilities is that they are often characterized by frequent changes in the mode of operation, in equipment and in processes. Operations at nuclear fuel cycle facilities generally require more operator intervention than operations at nuclear reactors, which may result in specific hazards for personnel. On the other hand, the overall hazard to the public from many nuclear fuel cycle facilities can be low. The nature and diversity of the processes associated with nuclear fuel cycle facilities result in a broad range of hazardous conditions and possible accidents that need to be considered in the safety analysis. In view of the wide range of facilities and hazards, requirements established in this publication are to be applied using a graded approach where stated [1].
Main	1.5.	The objective of this publication is to establish a basis for safety and for safety assessment for all stages in the lifetime of a nuclear fuel cycle facility by establishing requirements for site evaluation, design, construction, commissioning, operation and preparation for decommissioning that must be satisfied to ensure safety.
Main	1.6.	This publication is intended for use by organizations involved in the design, manufacture, construction, modification, maintenance, operation and decommissioning of nuclear fuel cycle facilities, in safety analysis, verification and review and in the provision of technical support, as well as by regulatory bodies. Particular emphasis is given to safety requirements for design and operation including commissioning.
Main	1.7.	This publication also provides references to other IAEA Safety Requirements publications on aspects relating to regulatory supervision, management of safety, and site evaluation for nuclear fuel cycle facilities. This publication is intended to be used in conjunction with these related IAEA Safety Requirements publications and with IAEA Safety Guides, which provide recommendations on meeting these requirements for specific facility types and specific activities.
Main	1.8.	This Safety Requirements publication applies to nuclear fuel cycle facilities of all types and sizes, including facilities for the processing, refining, conversion, enrichment, and fabrication of fuel, the storage of spent nuclear fuel and the reprocessing of spent nuclear fuel, nuclear fuel cycle research and development facilities and supporting ancillary facilities in which radioactive material is handled. The scope of this publication extends from uranium refining and conversion to the storage of radioactive waste prior to disposal. Facilities for the mining and processing of natural ore, nuclear power plants, research reactors, critical assemblies and waste disposal facilities are outside the scope of this publication. The types of radioactive material covered by these requirements include nuclear material used as fissile or fertile fuel in thermal and fast reactors. In addition to processed uranium, such materials include plutonium, MOX (mixed uranium oxide, UO₂, and plutonium oxide, PuO₂) fuel, thorium breeder material and other types of experimental fuel. Facility specific requirements for the predisposal management of waste and the management of effluents containing radioactive material and associated hazardous chemicals are also included. The processes and hazards at facilities that produce isotopes by chemical separation from nuclear material can be similar to the processes and hazards at facilities for the processing and reprocessing of nuclear fuel. The requirements of this publication relating to criticality safety and confinement can also be applied to these processes, in accordance with a graded approach.
Main	1.9.	The safety requirements established in this publication are to be applied for new nuclear fuel cycle facilities and are also to be applied to existing nuclear fuel cycle facilities to the extent practicable.
Main	1.10.	In view of the broad diversity of facilities and operations covered, the requirements established in this publication are to be applied in a manner that is commensurate with the potential hazard for each facility, in accordance with a graded approach. Each case in which the application of the requirements is to be graded shall be identified, with account taken of the nature and possible magnitude of the hazards presented by the given facility and the activities conducted (see Section 2).
Main	1.11.	This publication does not address: Requirements that are specifically covered in other IAEA Safety Requirements publications (e.g. Refs [2–6]), except in requiring a graded approach to the application of some of these other requirements. Matters relating to nuclear security (other than requirements on the interfaces between nuclear safety and nuclear security, which are established in Section 11) or to the State system of accounting for, and control of, nuclear material. Conventional industrial safety matters that under no circumstances could interfere with the nuclear safety of the nuclear fuel cycle facility. (For instance, a diesel spillage during transfer of diesel generator fuel is not addressed if it could not affect the nuclear safety of the facility, but a release of HF due to the escape and hydrolysis of UF₆ is addressed.)
Main	1.12.	If a particular nuclear fuel cycle facility or activity involving radioactive material does not conform exactly to the scope or description provided in para. 1.8, the safety requirements established in this publication still apply as a basis for establishing specific requirements.
Main	1.13.	Terms in this publication are to be understood as defined and explained in the IAEA Safety Glossary [7], unless otherwise stated (see Definitions).
Main	1.14.	Section 2 of this publication, which draws on IAEA Safety Standards Series No. SF-1 [1], Fundamental Safety Principles, introduces the general safety objective, concepts and principles for the safety of nuclear installations, with emphasis on the radiation safety and nuclear safety aspects of nuclear fuel cycle facilities. Section 3, which draws on IAEA Safety Standards Series No. GSR Part 1 (Rev. 1), Governmental, Legal and Regulatory Framework for Safety [3], establishes the general requirements on the legal and regulatory infrastructure as far as these are relevant for nuclear fuel cycle facilities. Section 4 establishes the requirements relating to the management and verification of safety. This section is based on IAEA Safety Standards Series No. GSR Part 2, Leadership and Management for Safety [4]. Section 5 establishes the requirements for site evaluation for new and existing nuclear fuel cycle facilities. This section is based on IAEA Safety Standards Series No. NS-R-3 (Rev. 1), Site Evaluation for Nuclear Installations [5]. Section 6 establishes the requirements for safety assessment for the safe design of all types of nuclear fuel cycle facility. It applies to new facilities and can also be applied in reviewing the safety of existing facilities. Section 7 establishes the requirements for construction of a nuclear fuel cycle facility. Section 8 establishes the requirements for the commissioning process. It also establishes requirements for a phased transition from inactive commissioning to active commissioning, when the requirements for operation first apply. Sections 7 and 8 can also be applied to modifications of existing facilities, in accordance with a graded approach.
Main	1.15.	Section 9 establishes the requirements for the safe operation of a nuclear fuel cycle facility, including maintenance, utilization and modification. It also covers requirements for records and reports for a nuclear fuel cycle facility, which are also applicable at other stages in the lifetime of a facility. Section 10 establishes the requirements for the preparation for the safe decommissioning of a nuclear fuel cycle facility on the basis of IAEA Safety Standards Series No. GSR Part 6, Decommissioning of Facilities [8], while Section 11 establishes the requirements for the interfaces between safety and security. The Appendix provides lists of postulated initiating events to be considered in the safety analysis for a nuclear fuel cycle facility. The Annex provides information on establishing risk criteria for safety.
Main	2.1.	SF-1 [1] establishes the fundamental safety objective and ten safety principles that provide the basis for requirements and measures to protect workers, the public and the environment from harmful effects of ionizing radiation and for the safety of facilities and activities that give rise to radiation risks. Restricting the likelihood of events that might lead to a loss of control of subcriticality or loss of confinement of radioactive material, or radiation exposures of people, also requires control over chemical hazards and other non-radiological hazards of nuclear fuel cycle facilities.
Main	2.2.	The fundamental safety objective is to protect people and the environment from harmful effects of ionizing radiation. Paragraph 2.1 of SF-1 [1] states that: To control the radiation exposure of people and the release of radioactive material to the environment; To restrict the likelihood of events that might lead to a loss of control over a nuclear reactor core, nuclear chain reaction, radioactive source or any other source of radiation; To mitigate the consequences of such events if they were to occur.”
Main	2.3.	Paragraph 2.2 of SF-1 [1] states that:
Main	2.4.	In the context of nuclear fuel cycle facilities, non-radiological hazards associated with the radioactive material in the facility also need to be controlled, in order to minimize risks to workers, the public and the environment. Events initiated by chemical hazards and the toxic chemicals that are used in the facility can have a significant bearing on achieving the fundamental safety objective. Industrial hazards associated with radioactive material need to be considered in the design, commissioning and operation of the facility. Activities at nuclear fuel cycle facilities may also include industrial processes that pose additional hazards to safe nuclear operations, site personnel and to the environment. Purely industrial hazards also need to be considered where these can interfere with the nuclear safety of the facility.
Main	2.5.	Paragraph 2.3 of SF-1 [1] states that:
Main	2.6.	The requirements presented in this publication are derived from the fundamental safety objective of protecting people and the environment, and the related safety principles [1]:
Main	2.7.	In order to satisfy the safety principles, it is required to ensure that for all operational states (normal operation and anticipated operational occurrences) of a nuclear fuel cycle facility, doses from exposure to radiation within the facility or exposure due to radioactive discharges are kept within operational limits and below the dose limits and as low as reasonably achievable (protection and safety is required to be optimized [2]).
Main	2.8.	To apply the safety principles, nuclear fuel cycle facilities are required to be designed and operated so as to keep all sources of radiation and all nuclear material under strict technical and administrative control (see Requirement 57). However, these principles do not preclude limited exposures or the release of authorized amounts of radioactive materials to the environment from the facility in operational states. Such exposures and radioactive releases are required to be strictly controlled, to be measured or estimated, to be recorded and to be kept as low as reasonably achievable, in compliance with regulatory and operational limits as well as radiation protection requirements.
Main	2.9.	Although measures are taken to limit radiation exposure in all operational states to levels that are as low as reasonably achievable and to minimize the likelihood of an event that could lead to the loss of normal control over the source of radiation, there will remain a probability — albeit very low — that an accident could happen. Therefore, emergency arrangements are required to be in place to ensure that the consequences of any accident that does occur are mitigated. Such measures and arrangements include: engineered safety features; safety features for design extension conditions⁴; on-site emergency arrangements established by the operating organization; and, where necessary, off-site emergency arrangements established by the appropriate authorities in accordance with IAEA Safety Standards Series No. GSR Part 7, Preparedness and Response for a Nuclear or Radiological Emergency [6].
Main	2.10.	The primary means of preventing accidents at a nuclear fuel cycle facility and mitigating the consequences of accidents if they do occur is the application of the concept of defence in depth (SF-1 [1], Principle 8). This concept is applied to all safety related activities, whether organizational, behavioural or design related, in all operational states, and including activities with chemical hazards. This is to ensure that all safety related activities are subject to independent layers of protection (or barriers), so that if a failure were to occur in any one of these layers, it would be detected and compensated for or corrected through the successful application of measures in the other layers.
Main	2.11.	Application of the concept of defence in depth throughout design and operation provides protection against transients, anticipated operational occurrences and accidents, including those resulting from equipment failure or human action within the installation, and events induced by external hazards.
Main	2.12.	Paragraph 3.31 of SF-1 [1] states that: The purpose of the first level of defence is to prevent deviations from normal operation and the failure of items important to safety. This leads to requirements that the facility be soundly and conservatively sited, designed, constructed, maintained, operated and modified in accordance with a management system and appropriate and proven engineering practices. To meet these requirements, careful attention is paid to the selection of appropriate design codes and materials, and to the quality control of the manufacture of components and construction of the facility, as well as to its commissioning. Design options, including the selection of processes, that reduce the potential for internal hazards also contribute to the prevention of accidents at this level of defence. Attention is also paid to the processes and procedures involved in design, manufacture, construction and in-service inspection, maintenance and testing, to the ease of access for these activities, and to the way the facility is operated and to how operating experience is utilized. This process is supported by a detailed analysis that determines the requirements for operation and maintenance of the facility and the requirements for quality management for operational and maintenance practices. The purpose of the second level of defence is to detect and control deviations from operational states in order to prevent anticipated operational occurrences at the facility from escalating to accident conditions⁵. This is in recognition of the fact that postulated initiating events are likely to occur over the operating lifetime of a nuclear fuel cycle facility, despite the care taken to prevent them. This second level of defence necessitates the provision of specific systems and features in the design, the confirmation of their effectiveness through safety analysis, and the establishing of operating procedures to prevent such initiating events, or else to minimize their consequences, and to return the facility to a safe state. For the third level of defence, it is assumed that, although very unlikely, the escalation of certain anticipated operational occurrences or postulated initiating events might not be controlled at a preceding level and that an accident could occur. In the design of the facility, such are postulated to occur. This leads to the requirement that inherent and/or engineered safety features, fail-safe design and procedures be provided to control the consequences of such . Such engineered safety features will be capable of preventing extensive damage to the facility or significant off-site releases and returning the facility to a safe state, and maintaining at least one physical barrier for the confinement of radioactive material. This barrier may be provided by a combination of a ‘static’ barrier with a complementary ‘dynamic’ barrier (e.g. a ventilation system), which together provide effective confinement of radioactive material. The most important objective for this level is to prevent releases of radioactive material and associated hazardous material or radiation levels that require off-site protective actions. The purpose of the fourth level of defence is to mitigate the consequences of accidents that result from failure of the third level of defence in depth. The most important objective for this level is to ensure that the confinement function is maintained, thus ensuring that radioactive releases are kept as low as reasonably achievable. The purpose of the fifth level of defence is to mitigate the radiological consequences and associated chemical consequences of releases or radiation levels that could potentially result from . This requires the provision of adequately equipped emergency response facilities and emergency plans and emergency procedures for on-site and off-site emergency response.
Main	2.13.	In the application of the concept of defence in depth, the chemical hazards associated with the radioactive material (i.e. dangerous properties arising from the chemistry of radioactive materials or as a consequence of activities at the facility) need to be taken into account at every level of defence. The potential interaction of multiple facilities or multiple on the same site also needs to be considered at the fourth and fifth levels of defence where applicable.
Main	2.14.	The safety philosophy that is followed to fulfil the objective and principles stated in SF-1 [1] relies on the concept of defence in depth and on the adoption of measures for the management and verification of safety over the entire lifetime of the nuclear fuel cycle facility. In addition to automatic control, many nuclear fuel cycle facilities rely on operator actions to maintain and control the safety of radioactive material throughout the facility. The safety philosophy addresses the means with which the organization supports individuals and groups in performing their tasks safely, taking the interactions between humans, technology and organizational aspects into account. The awareness by individuals of safety matters and the commitment of individuals to safety, and where appropriate the effective leadership and management of safety, are therefore essential to the proper application of the concept of defence in depth.
Main	2.15.	Nuclear fuel cycle facilities are of diverse natures and types. Their design and operating characteristics may differ significantly and present a variety of different hazards. Where certain hazards are demonstrated to be non-existent or very small, application of some features or procedures required for other higher hazard facilities may be less relevant or important. Because nuclear fuel cycle facilities present a greater range of hazards than do power reactors, a graded approach can be used in the application of certain identified requirements of this publication (see Requirement 11).
Main	3.1.	According to SF-1 [1], the government is responsible for the adoption of legislation that assigns the prime responsibility for safety to the operating organization and for the establishment of a regulatory body responsible for systems of authorization and inspection⁶, for the regulatory control of nuclear activities and for the enforcement of the legislation, regulations and conditions of the authorization. These principles are established in section 3 (Principles 1 and 2) of SF-1 [1].
Main	3.2.	General requirements to fulfil these principles are established in GSR Part 1 (Rev. 1) [3], which covers the essential aspects of the governmental and legal framework for establishing a regulatory body and for taking actions necessary to ensure the effective regulatory control of facilities and activities — existing and new — utilized for peaceful purposes. Other responsibilities and functions are also covered, such as liaison within the global safety regime and liaison for providing the necessary support services for the purposes of safety (including radiation protection), emergency preparedness and response, and the interfaces with nuclear security⁷ (see GSR Part 1 (Rev. 1) [3] and Ref. [11]) and with the State system of accounting for and control of nuclear material. These general requirements apply to the general legal and governmental infrastructure for the safety of nuclear fuel cycle facilities during site evaluation, design, construction, commissioning, operation, modification and preparation for decommissioning. A graded approach commensurate with the potential hazards of the facility shall be used in the application of these requirements (see para. 2.15).
Main	3.3.	Different types of authorization are required to be obtained for the different stages in the lifetime of a facility [3]. The authorization process may differ among States but the stages in the lifetime of a nuclear fuel cycle facility usually include the following: Site evaluation; Design; Construction; Commissioning; Operation, including utilization and modification;⁸ Shutdown; Decommissioning; Release from regulatory control.
Main	3.4.	In some cases, several stages may be authorized by a single licence, with conditions attached to control the subsequent stages. Other stages, such as the termination of operation, could be required by the regulatory body.
Requirement 1: Licensing documentation		The operating organization shall demonstrate the safety of its facility through a set of documents known as the licensing documentation (or safety case). The licensing documentation shall provide a basis for the safety of the facility at all stages of its lifetime and shall be updated periodically, to take account of modifications made to the facility and other changes. The licensing documentation shall be considered by the regulatory body in determining whether the authorizations necessary under national legislative and regulatory requirements are to be granted.
Requirement 1: Licensing documentation	3.5.	The licensing documentation shall include an adequate safety analysis report and the operational limits and conditions, as well as any other information required by the regulatory body. The licensing documentation shall provide a detailed demonstration of the safety of the facility and shall form the basis of all decisions relating to the safety of the facility that are made by the operating organization; thus it forms an important link between the operating organization and the regulatory body.
Requirement 1: Licensing documentation	3.6.	The safety analysis report shall describe all activities with safety significance in appropriate detail, including any restrictions on inputs to and outputs from the facility. It shall describe the application of the safety principles and criteria in the design for the protection of workers, the public and the environment. The safety analysis report shall contain an analysis of the hazards associated with the operation of the facility and shall demonstrate compliance with the regulatory requirements and criteria. It shall also contain analyses of accidents and of the safety features incorporated in the design for preventing or minimizing the likelihood of their occurrence and for mitigating their consequences in accordance with the concept of defence in depth.
Requirement 1: Licensing documentation	3.7.	The safety functions, associated safety limits and items important to safety shall be identified in the safety analysis report, which shall also provide details about the operating organization, the conduct of operations and the management system throughout the lifetime of the nuclear fuel cycle facility. The licensing documentation shall provide details of the emergency arrangements for the facility.
Requirement 1: Licensing documentation	3.8.	The level of detail in the information to be presented in the safety analysis report shall be determined using a graded approach. The safety analysis report shall cite additional references that may be necessary for its thorough review and assessment. The referenced material shall be made readily available to the regulatory body. In all cases, the safety analysis report shall cover all the topics identified in paras 3.6 and 3.7.
Requirement 1: Licensing documentation	3.9.	The licensing documentation shall specify the required intervals for periodic testing and inspection of items important to safety. Consideration of the application of the principle of optimization of protection (Principle 5 of SF-1 [1]) in the design and operation of the facility shall be included in the licensing documentation.
Requirement 1: Licensing documentation	3.10.	The operating organization shall give adequate notice to the regulatory body of its intent to move from one stage to another in the lifetime of the facility. Decisions on the need for authorization shall be documented by the regulatory body, which shall assess the licensing documentation prior to granting an authorization. The operating organization shall submit the licensing documentation to the regulatory body in support of its application for authorization of the facility or activity. A schedule for the submission of documents for review and assessment for the stages in the authorization process shall be agreed between the regulatory body and operating organization.
Requirement 1: Licensing documentation	3.11.	The regulatory body shall base subsequent authorization for stages in the lifetime of the facility on relevant objectives, principles and associated criteria for safety to ensure that the facility presents no undue radiation risks to the personnel at the site, the public and the environment. The regulatory body shall take account of associated chemical hazards and security advice when making its assessment. The specific objectives of the regulatory review and assessment are provided in GSR Part 1 (Rev. 1) [3]. The review and assessment by the regulatory body shall be commensurate with the potential magnitude of the hazard associated with the facility in accordance with a graded approach.
Criteria for judging safety	3.12.	Each State shall develop its approach to criteria for judging safety, in accordance with its particular legal and regulatory infrastructure. The criteria for judging safety shall be based on principles for safe design and operation and shall be made available to the operating organization, ideally before the nuclear fuel cycle facility project commences. The Annex to this publication illustrates the concept of criteria for judging safety, expressed in terms of the relationship between the likelihood of an event occurring and the consequences of the event.
Criteria for judging safety	3.13.	Paragraph 2.5 of GSR Part 1 (Rev. 1) [3] states that the governmental, legal and regulatory framework for safety “shall set out … Provision for the inspection of facilities and activities, and for the enforcement of regulations, in accordance with a graded approach”.
Criteria for judging safety	3.14.	Paragraph 4.50 of GSR Part 1 (Rev. 1) [3] states that:
Criteria for judging safety	3.15.	Requirement 30 of GSR Part 1 (Rev. 1) [3] states that:
Criteria for judging safety	3.16.	If there is evidence of non-compliance or if risks are identified, including risks unforeseen in the authorization process, enforcement actions as described in para. 4.55 of GSR Part 1 (Rev. 1) [3] shall be taken.
Requirement 2: Responsibilities in management for safety		The operating organization shall have the prime responsibility for the safety of a nuclear fuel cycle facility over its lifetime. This responsibility includes ensuring that the design meets all applicable safety requirements.
Requirement 2: Responsibilities in management for safety	4.1.	The operating organization and all other organizations engaged in activities important to the safety of a nuclear fuel cycle facility shall be responsible for ensuring that safety matters are given the highest priority. The operating organization shall possess the necessary competence to ensure that the facility meets all applicable safety requirements and shall retain responsibility for safety when contracting out any processes, including the design or other analysis.
Requirement 2: Responsibilities in management for safety	4.2.	In order to ensure rigour and thoroughness by individuals at all levels in the achievement and maintenance of safety in all activities, the operating organization: Shall clearly define responsibilities and accountabilities for safety with corresponding lines of authority and communication and shall ensure that individuals are not given other business roles that conflict with their responsibilities for safety; Shall ensure that it has sufficient qualified individuals with appropriate experience at all levels; Shall foster a strong safety culture and shall strictly adhere to sound procedures for all activities that may affect safety, ensuring that managers and supervisors promote and support good safety practices and correct poor safety practices; Shall review, monitor and audit⁹ all safety related matters on a regular basis and shall implement appropriate corrective actions where necessary; Shall allocate adequate financial resources to ensure safety, including provision for financial resources for decommissioning where these are not provided by the government.
Requirement 2: Responsibilities in management for safety	4.3.	The operating organization shall prepare a detailed demonstration of safety, which shall include an adequate safety analysis, at each stage in the lifetime of the facility. The safety analysis at each stage shall include an adequate demonstration of how the operating organization intends to discharge its responsibility for safety at all subsequent stages in the lifetime of the nuclear fuel cycle facility.
Requirement 2: Responsibilities in management for safety	4.4.	In a timely manner, the operating organization shall submit to the regulatory body any information that it has requested. The operating organization shall inform the regulatory body of any additional new information and of significant changes to information submitted previously. All information provided by the operating organization to the regulatory body shall be complete and accurate. The format and content of the safety documentation submitted to the regulatory body by the operating organization in support of the application for authorization shall be consistent with the requirements established in this publication.
Requirement 3: Safety policy		The operating organization shall establish and implement safety, health and environmental policies that give protection and safety the overriding priority warranted by their significance.
Requirement 3: Safety policy	4.5.	The safety policy established and implemented by the operating organization shall give safety the utmost priority, overriding all other demands, including those of facility production and project schedules or research and development programmes. The safety policy shall promote a strong safety culture, including a questioning attitude and a commitment to excellent performance in all activities important to safety. Managers shall promote an attitude of safety consciousness among individuals in the organization (see Ref. [12]).
Requirement 3: Safety policy	4.6.	The safety policy shall stipulate clearly the leadership role of the highest level of management in safety matters. Senior management¹⁰ shall be responsible for communicating and implementing the provisions of the safety policy throughout the organization. All individuals in the organization shall be made aware of the safety policy and of their responsibilities for ensuring safety. The behavioural expectations of senior management shall be clearly communicated to all individuals, including external support organizations and contractors, and it shall be ensured that such expectations are understood by all those who are expected to meet them.
Requirement 3: Safety policy	4.7.	The safety policy of the operating organization shall include a commitment to achieving enhancements in operational safety. The strategy of the operating organization for enhancing safety and for finding more effective ways of meeting safety standards shall be continuously monitored, periodically revised and supported by means of a clearly specified programme with clear objectives and targets.
Requirement 4: Management system		The operating organization shall establish, implement, assess and continuously improve an integrated management system for ensuring that all safety requirements are met at all stages of the lifetime of the nuclear fuel cycle facility.
Requirement 4: Management system	4.8.	The operating organization shall establish and apply a single coherent management system in which all the constituents of the organization, including its structure, resources and processes, are integrated to enable the organization’s objectives to be achieved.¹¹ The requirements for an integrated management system for facilities and activities are established in GSR Part 2 [4]. These requirements and the associated objectives and principles shall be taken into account in the development and implementation of the management system for a nuclear fuel cycle facility on the basis of the importance to safety of each item, service or process. The extent of development and application of the management system shall be determined in accordance with a graded approach for a particular nuclear fuel cycle facility.
Requirement 4: Management system	4.9.	The operating organization shall ensure through the establishment and application of the management system that the nuclear fuel cycle facility is sited, designed, constructed, commissioned, operated and decommissioned in a safe manner and within operational limits and conditions identified in the licensing documentation such as the safety analysis report.
Requirement 4: Management system	4.10.	Management arrangements shall be developed and established in a timely manner before transitions between major stages in the lifetime of the nuclear fuel cycle facility. In particular, activities for site investigation, which are usually initiated a long time before the establishment of a project, shall be covered by the management system.
Requirement 4: Management system	4.11.	The management system shall include all the elements of management so that processes and activities important to safety are established and conducted coherently with other requirements, including those relating to leadership, human performance, security, quality, protection of health and protection of the environment. The management system shall implement the safety policy.
Requirement 4: Management system	4.12.	The management system shall identify and include the following requirements: The relevant statutory and regulatory requirements of the State; Any requirements agreed with interested parties; Relevant IAEA safety standards on matters not addressed by points (a) and (b).
Requirement 4: Management system	4.13.	The documentation of the management system shall be reviewed and made subject to approval¹² at appropriate levels of management in the operating organization and shall be submitted for review and assessment by the regulatory body if so required.
Requirement 4: Management system	4.14.	The provisions of the management system shall be based on four functional categories: management responsibility; resource management; process implementation; and measurement, assessment and improvement.
Management responsibility	4.15.	Management responsibility includes planning, implementing and providing the means and support necessary to achieve the organization’s objectives. Before major decisions affecting safety are taken, management shall seek independent advice and the agreement of the regulatory body where necessary. In this regard, the management system shall include provisions for ensuring effective communication and clear assignment of responsibilities, in which accountabilities are unambiguously assigned to individual roles within the organization and to suppliers, to ensure that processes and activities important to safety are controlled and performed in a manner that ensures that safety objectives are achieved.
Resource management	4.16.	Resource management includes measures to ensure that the resources essential to the implementation of safety policy and the enhancement of safety and the achievement of the organization’s objectives are identified and made available. The management system shall ensure that: The operating organization is resourced with sufficient qualified personnel for the safe operation of the facility. Suppliers, manufacturers and designers of items important to safety have an effective management system in place. External personnel (including suppliers of both materials and services) are adequately qualified and are performing their activities under the same controls and to the same standards as the facility personnel. Equipment, tools, materials, hardware and software necessary to operate the facility at all stages of its lifetime in a safe manner are specified, supplied, checked, verified and maintained in accordance with the management system.
Process implementation	4.17.	Process implementation includes the actions and tasks necessary to achieve an appropriate level of quality, in accordance with a graded approach. Such actions and tasks include identification of the processes of the management system, and determination of the sequences in and interaction between those processes.
Process implementation	4.18.	The management system shall include provisions to ensure that the design, including subsequent changes, modifications or safety improvements, construction, commissioning, operational activities, and decommissioning of the nuclear fuel cycle facility are carried out in accordance with established codes, standards, specifications, procedures and administrative controls¹³. Means of detecting and correcting deficiencies in any of these activities shall be provided. Items and services important to safety shall be specified and controlled to ensure their proper use, maintenance and configuration. The use of computer codes for the justification of the safety of the facility, and their validation and verification (e.g. tests and experiments), shall be covered by the management system.
Process implementation	4.19.	For the manufacturing, installation and construction of items important to safety for the nuclear fuel cycle facility, processes shall be established to ensure that the relevant regulations and safety requirements are met and that the construction work is properly carried out. The processes shall be such as to allow the operating organization to ensure that the fabrication and construction of items important to safety are performed in accordance with the design intent and regulatory requirements (see Requirement 13).
Process implementation	4.20.	As part of the management system, processes for the control of modifications shall be established, and graded in accordance with the safety significance of the modification. These processes shall cover the design, review, assessment and approval, fabrication, testing and implementation of a modification project. Relevant procedures describing the processes shall be put into effect by the operating organization before the commissioning stage of the nuclear fuel cycle facility. For nuclear fuel cycle research and development facilities, the activities of the utilization programme (including new experiments) shall be subjected to the same requirements as those for modifications.
Process implementation	4.21.	Where a nuclear fuel cycle facility imports nuclear, toxic or flammable materials or generates products, waste or effluents, any safety implications of these materials and of any on-site transfer of these materials shall be covered by the processes of the management system, in accordance with a graded approach. The requirements for the transport of radioactive material off the site are established in SSR-6 [9].
Process implementation	4.22.	The management system shall ensure that items and services under procurement meet established design, quality and performance criteria. Suppliers shall be evaluated and selected on the basis of specified criteria, which shall be periodically reviewed and the suppliers then re-evaluated. Requirements for reporting deviations from procurement specifications shall be specified in the procurement documents. Evidence that purchased items and services meet procurement specifications shall be made available for verification before the items are used or the services are provided.
Measurement, assessment, evaluation and improvement	4.23.	Measurement, assessment and evaluation provide an indication of the effectiveness of management processes and work performance. The effectiveness of the management system shall be periodically assessed through audits. Weaknesses in processes and performance shall be identified and corrective actions shall be taken in a timely manner. The operating organization shall evaluate the results of such audits and shall determine and implement the necessary actions for continuous improvement.
Requirement 5: Safety assessment and periodic safety review		The adequacy of the design of the nuclear fuel cycle facility shall be verified by means of comprehensive safety assessment that results in a safety analysis report and that defines the operational limits and conditions required for safety. The safety of the facility or activity for all facility states shall be assessed in the safety analysis and shall be independently reviewed. The operating organization shall conduct systematic safety assessments of the facility, in accordance with regulatory requirements, throughout the lifetime of the facility. On the basis of the results of such periodic safety reviews, the operating organization shall implement any necessary corrective actions and shall consider the need for modifications to enhance safety.
Requirement 5: Safety assessment and periodic safety review	4.24.	Requirements for safety assessment for facilities and activities are established in IAEA Safety Standards Series No. GSR Part 4 (Rev. 1), Safety Assessment for Facilities and Activities [13]. The adequacy of the design of the nuclear fuel cycle facility, including design tools and design inputs and outputs, shall be verified, validated and approved using a systematic safety assessment process. The safety assessment process shall be undertaken by individuals or groups independent from those who originally carried out the design work. Verification, validation and approval of the facility design shall be completed as early as is practicable in the design and construction processes, and in any case before commissioning of the facility is commenced. The verification that takes place before validation under active conditions shall be sufficiently rigorous to support decisions of safety significance.
Requirement 5: Safety assessment and periodic safety review	4.25.	Safety assessment shall be part of the design process, with iterations made between the design activities and the confirmatory analytical activities and with increasing scope and level of detail of the safety assessment as the design progresses. The basis for the safety assessment in the design stage shall be the information derived from the safety analysis (see Section 6) as well as information from other sources such as research and operating experience at other facilities. If non-permanent equipment is important for safety, it shall be included in the analysis.
Requirement 5: Safety assessment and periodic safety review	4.26.	In accordance with national regulatory requirements, the operating organization shall carry out systematic periodic safety reviews of the nuclear fuel cycle facility throughout its lifetime, with account taken of ageing, modifications, human and organizational factors, operating experience, technical developments, new information on site evaluation and other information relating to safety from other sources. The operating organization shall verify by analysis, surveillance, testing and inspection that the physical state of the facility, including any modifications, is as described in the safety analysis report and other safety documents and that the facility was commissioned and is operated in accordance with the safety analysis and operational limits and conditions.
Requirement 5: Safety assessment and periodic safety review	4.27.	The periodic safety review shall confirm that the safety analysis report and other documents (such as the operational limits and conditions and documentation on maintenance and training) remain valid in view of current regulatory requirements, or shall indicate where improvements may be necessary. In such reviews, changes in the site characteristics, changes in the utilization programme (particularly for research and development facilities), the cumulative effects of ageing and modifications, changes to procedures, feedback from operating experience and technical developments shall be considered. It shall also be verified that items and software important to safety comply with the design requirements.
Requirement 5: Safety assessment and periodic safety review	4.28.	The findings of safety assessments and periodic safety reviews shall be considered by the safety committee (see Requirement 6). The operating organization shall report to the regulatory body as required, in a timely manner, the confirmed findings of the periodic safety review that have implications for safety. Any modifications that arise from these findings shall be implemented in a timely manner, in accordance with the safety categorization of the modification.
Requirement 6: Safety committee		An independent safety committee (or an advisory group) shall be established to advise the management of the operating organization on all safety aspects of the nuclear fuel cycle facility.
Requirement 6: Safety committee	4.29.	The operating organization shall establish one or more internal safety committees (or advisory groups) to advise the management of the operating organization on safety issues relating to the commissioning, operation and modification of the facility. The safety committee shall have among its membership experts with the necessary breadth of knowledge and experience to provide appropriate advice. The committee shall be independent of the regulatory body and its membership shall, to the extent practicable, be independent of the operations management.¹⁴
Requirement 6: Safety committee	4.30.	The functions, responsibilities, composition and terms of reference of the safety committee shall be documented and, if required, shall be submitted to the regulatory body. For a new facility, the safety committee¹⁵ shall be fully functioning before active commissioning commences.
Requirement 6: Safety committee	4.31.	A list of items that the safety committee is required to review shall also be established. The list shall include, for example, the following: Proposed changes in any operational limits and conditions for the facility; Proposed new tests, equipment, systems or procedures that have significance for safety; Commissioning plans and results; Proposed modifications (temporary or permanent) to processes, structures, systems or components that may have significance for safety; Where applicable, violations of operational limits and conditions, of the licence and of procedures that are significant to safety; Events that are required to be reported or that have been reported to the regulatory body, other than occasional false alarms; The findings of periodic reviews of the operational performance and safety performance of the facility; Reports on routine releases of radioactive material to the environment; Reports on radiation exposure of personnel at the facility and of the public; The decommissioning plan; Safety reports to be provided to the regulatory body; Reports on regulatory inspections for safety.
Requirement 6: Safety committee	4.32.	The management system shall include provisions to ensure that relevant aspects of the facility design, changes to the design, operating procedures, organizational structure and safety assessment are subject to an appropriate level of review by the safety committee.
Requirement 6: Safety committee	4.33.	Where the volume of work or a multifacility site requires that more than one safety committee be established, the management system shall include provisions to ensure that the committees’ considerations and advice are complementary, consistent and coherent and that safety is not compromised. The scope of the agenda and frequency of meetings by the safety committee shall be established in accordance with a graded approach.
Requirement 6: Safety committee	5.1.	The main safety objective in site evaluation for a nuclear fuel cycle facility is the protection of the public and the protection of the environment against the radiological and associated chemical hazards arising from normal and accidental releases of radioactive material (see NS-R-3 (Rev. 1) [5]). This requires the identification and assessment of site characteristics affecting, or potentially affecting, the facility and the effects that the facility has, or may have, on its surroundings. Information shall be collected in sufficient detail to support the safety analysis to demonstrate that the facility can be safely operated at the site. The site evaluation may constitute the first part of the development of the licensing documentation for a new facility, or it may form part of a safety reassessment for redevelopment or for licence renewal. The results of the site evaluation shall be documented and presented in sufficient detail to permit an independent assessment by the regulatory body.
Requirement 6: Safety committee	5.2.	In the evaluation of the suitability of a site for a nuclear fuel cycle facility, the following aspects shall be considered: The effects of external events occurring in the region of the particular site (external events could be of natural origin or human induced and may originate on the site, see NS-R-3 (Rev. 1) [5]); The characteristics of the site and its environment that could influence the transfer to persons and to the environment of radioactive material that has been released; The population density and population distribution and other characteristics of the surrounding area, for specifying off-site emergency planning zones and emergency planning distances, as specified in GSR Part 7 [6], and the need to evaluate the risks to individuals and to the population; The interface between nuclear security and nuclear safety; For facilities handling self-heating materials, the capability for an ultimate heat sink; Other factors determined by the government, which may include public acceptability.
Requirement 6: Safety committee	5.3.	The site evaluation shall be graded such that the amount of detail required for facilities where the intrinsic hazard is low (e.g. a natural uranium fuel fabrication facility) can be substantially less than the amount of detail required for a medium or high hazard facility (e.g. a light water reactor fuel fabrication facility or a reprocessing facility). The area covered by the site evaluation and the amount of detail in the evaluation shall provide sufficient factual evidence to define safety performance criteria for the facility. For the site evaluation, the following requirements apply: Environmental characteristics of the area that may potentially be affected by the radiological impact and the associated chemical impact¹⁶ of the facility in all facility states shall be investigated. An appropriate monitoring system shall be designed to verify the predicted environmental impact. The possible locations near the facility where radioactive material and other hazardous material could be discharged or could otherwise pass into the environment shall be investigated. Hydrological and hydrogeological investigations shall be carried out to assess, to the extent necessary, the dilution and dispersion characteristics of water bodies. The models used to evaluate the possible impacts of the contamination of surface water and groundwater on the public and the environment shall be described. The meteorological conditions for the region around the site shall be investigated and the dispersion of atmospheric discharges shall be analysed. Models used to assess the dispersion of radioactive material and other hazardous material released to the environment in all facility states shall meet the needs of the operating organization and the requirements of the regulatory body. Information shall be collected that, together with the anticipated discharges of radioactive material and other hazardous material from the facility and with the transfer behaviour of the radioactive material, permits the assessment of doses to the public and of the contamination of biological systems and food chains. In the analysis of the suitability of the site, consideration shall be given to the storage and transport of radioactive material, processing chemicals, radioactive waste and chemical wastes, and to the existing site infrastructure (e.g. the power supply and its reliability).
Requirement 6: Safety committee	5.4.	The site evaluation includes an analysis of the effect of the facility in all facility states on people and the environment around the site. If events of lesser severity but higher probability make a significant contribution to the overall risk, these shall be considered when specifying design acceptance criteria for the structures, systems and components of the facility.
Requirement 6: Safety committee	5.5.	If the evaluation of the site and the area of operations, including their foreseeable evolution, identifies deficiencies that cannot be compensated for by means of engineered features, site protection measures or administrative controls, the site shall be deemed unsuitable. Design features and site protection measures are the preferred means of compensating for deficiencies.
Requirement 6: Safety committee	5.6.	Hazards arising from external events (or from combinations of events) shall be considered in the design of the nuclear fuel cycle facility. Information and records relating to the occurrence and severity of important natural phenomena shall be collected for the region in which the site is located and shall be carefully analysed for reliability, accuracy and completeness. Combinations of external events, internal events and anticipated operational occurrences leading to large releases and early releases of radioactive material¹⁷ shall also be considered in the design.
Requirement 6: Safety committee	5.7.	The external events to be considered for evaluation include (see Requirements 16 and 19 and NS-R-3 (Rev. 1) [5]): Earthquakes, volcanoes and surface faulting; Meteorological events, including extreme values of meteorological phenomena and rare events such as lightning, tornadoes and tropical cyclones; Floods, including water waves induced by earthquakes or other geological phenomena or floods and waves caused by failure of water control structures; Geotechnical hazards, including slope instability, collapse, subsidence or uplift of the site surface, and soil liquefaction; External human induced events, including transport events such as aircraft crashes and accidents at surrounding activities such as chemical explosions.
Requirement 6: Safety committee	5.8.	External hazards data generated by multiple applicants and licensees in the same region shall be combined, after comparisons and quality checks have been completed.
Requirement 6: Safety committee	5.9.	In relation to the characteristics and distribution of the population, the combined effects of the site and the installation shall be such that: For all operational states of the facility, the radiation exposure of the population and the exposure of the population to associated toxic hazards remain as low as reasonably achievable and in any case are in compliance with national requirements, with account taken of international recommendations. The radiation risks to the population associated with accident conditions, including those accidents that could lead to emergency response actions being necessary, are acceptably low.
Requirement 6: Safety committee	5.10.	In the site evaluation and before the start of construction of a nuclear fuel cycle facility, it shall be confirmed that there will be no insurmountable difficulties in the development of off-site emergency arrangements, where appropriate, prior to the start of operation of the nuclear fuel cycle facility [5, 6].
Requirement 6: Safety committee	5.11.	The site evaluation shall include an assessment of the initial radiological and chemical characteristics of the site, which may arise from naturally occurring or artificial sources.
Requirement 6: Safety committee	5.12.	When a new nuclear fuel cycle facility is planned in or near to an urban or suburban environment, the suitability of the site to accommodate a nuclear installation shall be carefully analysed to avoid unacceptable radiation risks to site personnel and the public.
Requirement 6: Safety committee	5.13.	The operating organization shall establish a programme of monitoring throughout the lifetime of the facility to evaluate natural and human-made changes in the area, including changes in demographics. The programme of monitoring shall be in place no later than the start of construction and shall continue through to decommissioning until termination of the authorization. The operating organization shall review the results of monitoring to compare them with the original predictions of possible changes to site characteristics.
Requirement 6: Safety committee	5.14.	The results of ongoing site monitoring and feedback from operating experience shall be re-evaluated periodically, typically every ten years. A re-evaluation after a shorter interval shall be considered in the event of evidence of potentially significant changes in hazards. If the re-evaluation identifies new information with regard to site characteristics, safety precautions such as engineering controls and emergency preparedness, these shall be reviewed and modified as necessary. The site re-evaluation may be combined with the periodic safety review for the facility.
Requirement 7: Main safety functions		The design shall be such that the following main safety functions are met for all facility states of the nuclear fuel cycle facility: (a) Confinement and cooling of radioactive material and associated harmful materials; (b) Protection against radiation exposure; (c) Maintaining subcriticality of fissile material.
Requirement 7: Main safety functions	6.1.	The main safety functions, the loss of which may lead to significant radiological or associated chemical consequences for personnel, the public or the environment, address the principles in SF-1 [1] and specific requirements in IAEA Safety Standards Series No. GSR Part 3, Radiation Protection and Safety of Radiation Sources: International Basic Safety Standards [2]. A systematic approach shall be taken to identifying those items important to safety that are necessary to fulfil the main safety functions and to defining the conditions and inherent features that contribute to or affect fulfilling the main safety functions for all facility states. A hazards analysis (or equivalent) shall be conducted to identify all design basis accidents and their associated initiating events that could challenge or cause the failure of the main safety functions¹⁸ and result in unacceptable consequences. The items relied on to ensure the main safety functions shall be independent, to the extent practicable, of those used for normal operation of the facility.¹⁹
Requirement 7: Main safety functions	6.2.	Confinement shall prevent any unplanned release of radioactive material or materials with associated hazardous properties. Secondary safety functions shall be specified where necessary to prevent accidents and to mitigate their effects. Secondary safety functions associated with confinement include measures to prevent accumulations of flammable or explosive materials such as gases from radiolysis.
Requirement 7: Main safety functions	6.3.	In nuclear fuel cycle facilities, the confinement and control of radioactive material can be dependent on the effective removal of heat from radioactive decay and chemical reactions. Where cooling is required for control, cooling shall be considered a safety function (see Requirement 39).
Requirement 7: Main safety functions	6.4.	Subcriticality shall be ensured for all facilities handling fissile material (see Requirement 38). It is often impracticable to provide shielding for protection against an excursion or a shutdown system for criticality in a fuel cycle facility, and so emphasis shall be placed on prevention of excursions and criticality.
Requirement 7: Main safety functions	6.5.	Means of monitoring the status of the facility shall be provided for ensuring that the main safety functions are fulfilled for all facility states.
Requirement 8: Radiation protection		The design of a nuclear fuel cycle facility shall ensure that radiation doses to workers and other personnel at the facility and to members of the public do not exceed the dose limits, and that doses are kept as low as reasonably achievable in operational states for the entire lifetime of the facility, and that they remain below acceptable limits and as low as reasonably achievable during, and following, accident conditions.
Requirement 8: Radiation protection	6.6.	The design of a facility shall provide for adequate protection of workers and the public from radiation exposure and associated hazards for operational states and accident conditions. Acceptable limits for radiation protection associated with the relevant categories of all facility states shall be established, consistent with the regulatory requirements, for both internal and external exposure. Protection and safety shall be optimized with the use of dose constraints, in accordance with GSR Part 3 [2].
Requirement 8: Radiation protection	6.7.	The chemical form of releases and the kinetics of the exposure pathway shall be considered when determining the consequences of accidents. The design shall ensure that facility states that could lead to high radiation doses, large radioactive releases or associated major chemical consequences are practically eliminated²⁰ and that there are no facility states with more than minor potential radiological consequences with a significant likelihood of occurrence.
Requirement 9: General design considerations		The design of a nuclear fuel cycle facility shall ensure that the facility and items important to safety have the appropriate characteristics to ensure that the safety functions can be performed with the necessary reliability, that the facility can be operated safely within the operational limits and conditions for its entire lifetime and can be safely decommissioned, and that impacts on people and the environment are as low as reasonably achievable.
Requirement 9: General design considerations	6.8.	The design of a nuclear fuel cycle facility shall be such that the needs of the operating organization, the requirements of the regulatory body and the requirements of relevant legislation, as well as applicable national and international codes and standards, are met. In the design, due account shall be taken of human capabilities and limitations and of factors that could influence human performance. Adequate information on the design shall be provided for ensuring the safe operation, utilization, maintenance and decommissioning of the nuclear fuel cycle facility, and to allow subsequent modifications and new operating regimes to be implemented.
Requirement 9: General design considerations	6.9.	The design shall take due account of the safety objectives in Section 2 and relevant available experience that has been gained in the design, construction and operation of other nuclear fuel cycle facilities, and of the results of relevant research and development programmes.
Requirement 9: General design considerations	6.10.	The specification of design features, controls and arrangements to provide the appropriate degree of defence in depth shall take account of the results of deterministic safety analyses (and complementary probabilistic safety analyses, as appropriate) to ensure the prevention of and the mitigation of their consequences. The safety analysis shall demonstrate that the design meets safety and regulatory requirements and that the design is based on the application of sound engineering practices, research and feedback from operating experience.
Requirement 9: General design considerations	6.11.	Hazards shall be considered in designing the layout of the facility and in determining the postulated initiating events and generated loadings for use in the design of relevant items important to safety. Adequate space shall be provided for operations and processes involving radioactive material, to satisfy requirements for ergonomic design (e.g. for maintenance) and for the optimization of protection and to minimize the risk of collisions that may affect safety.
Requirement 9: General design considerations	6.12.	The expected behaviour of the facility in any postulated initiating event shall be such that the following conditions can be achieved, in order of priority: Following a postulated initiating event, the facility would be rendered safe by means of passive safety features or by the action of systems that are continuously available. Following a postulated initiating event, the facility would be rendered safe by the actuation of active items important to safety that need to be brought into operation in response to the postulated initiating event. Following a postulated initiating event, the facility would be rendered safe by following specified procedures.
Requirement 9: General design considerations	6.13.	Where prompt and reliable action would be necessary in response to a postulated initiating event, provision shall be made in the design for automated safety actions, to prevent progression to conditions more severe than design basis accidents.²¹
Requirement 9: General design considerations	6.14.	Where prompt action in response to a postulated initiating event would not be necessary, it is permissible for reliance to be placed on the manual initiation of systems or on other operator actions. For such cases, the time interval between detection of the postulated initiating event or accident and the required action shall be sufficiently long, and adequate administrative controls shall be specified to ensure the performance of such actions. An assessment shall be made of human reliability in the operation of equipment, diagnosis of the event and the necessary recovery process.
Requirement 9: General design considerations	6.15.	The operator actions that would be necessary to diagnose the state of the nuclear fuel cycle facility following a postulated initiating event and to put it into a safe and stable condition in a timely manner shall be facilitated, as necessary, by the provision in the design of adequate instrumentation to monitor the status of the facility, and adequate means for the manual operation of equipment (see Requirement 43).
Requirement 9: General design considerations	6.16.	The safety analysis shall demonstrate the ability of the design to withstand combinations of anticipated operating occurrences.
Requirement 9: General design considerations	6.17.	As far as practicable, the quantity and activity content of waste (including secondary wastes) and discharges to the environment shall be minimized by application of control measures that “are generally applied in the following order: reduce waste generation, reuse items as originally intended, recycle materials and, finally, consider disposal as waste” (see para. 4.6 of IAEA Safety Standards Series No. GSR Part 5, Predisposal Management of Radioactive Waste [14]). The design provisions to facilitate this approach are established in Requirement 24.
Requirement 9: General design considerations	6.18.	The designer shall arrange for the orderly and comprehensive provision of quality assured design documentation to the operating organization.
Requirement 10: Application of the concept of defence in depth		The design of a nuclear fuel cycle facility shall apply the concept of defence in depth. The levels of defence in depth shall be independent as far as is practicable.
Requirement 10: Application of the concept of defence in depth	6.19.	The defence in depth concept shall be applied to provide the appropriate number of levels of defence to prevent accidents and to ensure that appropriate measures are taken to mitigate harmful consequences if prevention fails [1, 15].
Requirement 10: Application of the concept of defence in depth	6.20.	The continued operation of the facility during the unavailability of any of the levels of defence shall be justified for specific modes of operation including maintenance operations, with account taken of the safety classification of the structures, systems and components providing the remaining levels of defence.
Requirement 10: Application of the concept of defence in depth	6.21.	The design of the nuclear fuel cycle facility: Shall provide for successive verifiable barriers to fulfil the main safety functions listed in Requirement 7. Shall use conservative margins, and manufacturing and construction shall be of high quality so as to provide assurance that failures and deviations from normal operation are minimized and that accidents are prevented as far as is practicable. Safety margins shall be sufficient to ensure that a small deviation in a facility parameter does not lead to a cliff edge effect. Shall provide for the control of facility behaviour by means of inherent and engineered features, such that failures and deviations from normal operation requiring the actuation of safety systems are minimized or excluded by design, to the extent possible. Shall provide for supplementary controls for the facility by means of automatic actuation of safety systems, such that failures and deviations from normal operation that exceed the capability of control systems can be controlled with a high level of confidence. Whenever operator actions are necessary in such events, the actions shall only be credited in the early phase of the failure of a safety system if it can be ensured that the operator will have sufficient time to take the necessary actions. Shall provide for structures, systems and components and procedures to control the course of and, as far as practicable, to limit the consequences of failures and deviations from normal operation that exceed the capability of safety systems. Shall provide reliable means for ensuring that each of the main safety functions is performed, thereby ensuring the effectiveness of the items important to safety and the procedures that prevent an event progressing or that mitigate its effects. These means provided shall be diverse and independent where possible, e.g. static and dynamic barriers providing confinement (see Requirement 23).
Requirement 10: Application of the concept of defence in depth	6.22.	The design shall prevent, as far as is practicable: Challenges to the integrity of physical barriers and to the reliability of procedural levels of protection; Failure of one or more barriers or levels of protection; Failure of a barrier or level of protection as a consequence of the failure of another barrier or level of protection, and common cause failures; The possibility of harmful consequences of errors or omissions in operation and maintenance.
Requirement 10: Application of the concept of defence in depth	6.23.	Depending on their safety classification, the structures, systems and components providing different levels of defence in depth shall be independent to avoid a failure of one level reducing the effectiveness of other levels. In normal operation, items important to safety shall not routinely be activated or challenged or shall be challenged only with a very wide safety margin.
Requirement 10: Application of the concept of defence in depth	6.24.	The safety analysis for a nuclear fuel cycle facility shall extend to the fourth and fifth levels of defence in depth. The design of the facility shall include provisions for emergency preparedness and response (Requirement 47), including the necessary emergency power supply (Requirement 49), provisions for fire protection (Requirement 41) and provisions for the evacuation of personnel in an emergency, in accordance with the emergency preparedness category of the facility. The need for operator actions before evacuation (to prevent fire, criticality, explosion or toxic release) shall be considered in the analysis and appropriate protection for personnel shall be provided.
Requirement 10: Application of the concept of defence in depth	6.25.	As far as practicable, emergency response facilities shall be independent of the facilities used for normal operation. Where appropriate, a separate emergency response facility shall be provided (see Requirement 48).
Requirement 10: Application of the concept of defence in depth	6.26.	Where off-site protective actions could be necessary to achieve the goals of emergency response in accordance with international standards, emergency arrangements shall be established for postulated events that have not been considered in the first, second or third levels of defence in depth, including events that have occurred in other facilities in the same emergency preparedness category (see table 1 in GSR Part 7 [6]). For multifacility sites, the potential interaction with or impact from at other facilities on the same site shall be considered in the analysis of the fourth and fifth levels of defence in depth.
Requirement 10: Application of the concept of defence in depth	6.27.	Defence in depth shall be applied taking into account a graded approach, as described in Section 2 and Requirement 11. The amount and type of radioactive material and toxic material present, their potential for dispersion, the potential for nuclear, chemical or thermal reactions, and the kinetics of such events shall all be considered in determining the required number of levels of defence, the strength of each level of defence and their independence from each other.
Requirement 11: Use of a graded approach		The use of a graded approach in application of the safety requirements for a nuclear fuel cycle facility shall be commensurate with the potential risk of the facility and shall be based on safety analysis, expert judgement and regulatory requirements.
Requirement 11: Use of a graded approach	6.28.	A graded approach shall be used in the stringency of application of certain indicated requirements of this publication. The use of a graded approach shall not be considered as a means of waiving requirements and shall not compromise safety. Qualitative categorization of the facility shall be performed on the basis of the potential hazard associated with the facility. The analyses and expert judgements used to perform the categorization shall be documented. The use of a graded approach by the operating organization shall be justified in accordance with the categorization of the facility, which shall be subject to review by the regulatory body.
Requirement 11: Use of a graded approach	6.29.	The application of the safety requirements for any nuclear fuel cycle facility shall be commensurate with its potential hazards. The facility type and the following facility specific attributes shall be taken into account: The nature and the physical and chemical forms of the radioactive material that is used, processed and stored at the facility; The scale of operations undertaken at the facility (i.e. the ‘throughput’ of the facility) and the inventory of hazardous material, including products and waste in storage; The processes, technologies and hazardous chemicals that are associated with the radioactive material; The strategy for radioactive waste management, including available routes for the discharge of effluents and facilities for the storage of radioactive waste; The proximity and scale of other hazards that could interfere with the safe operation of the facility; The site, including external hazards associated with the site and proximity of the site to population groups.
Requirement 11: Use of a graded approach	6.30.	The grading of requirements that could have a significant impact on safety shall be supported by detailed analyses and the judgement of experts with suitable qualifications and experience.
Requirement 12: Proven engineering practices for the design		Items important to safety for a nuclear fuel cycle facility shall be designed in accordance with the relevant national and international codes and standards.
Requirement 12: Proven engineering practices for the design	6.31.	Items important to safety shall preferably be of a design that has previously been proven in equivalent applications.²² In any case, items shall be of high quality and of a technology that has been qualified and tested.
Requirement 12: Proven engineering practices for the design	6.32.	National and international codes and standards that are used as engineering design rules for items important to safety shall be identified and evaluated to determine their applicability, adequacy and sufficiency, and shall be supplemented or modified as necessary to ensure that the quality of the design is commensurate with the associated safety function and consequences of failure.
Requirement 12: Proven engineering practices for the design	6.33.	In the case of items important to safety for which there are no appropriate established codes or standards, an approach derived from existing codes or standards for similar equipment having similar environmental and operational requirements shall be applied. In the absence of such codes and standards, the results of experience, tests, analysis or a combination of these shall be applied. The use of a results based approach shall be justified.
Requirement 12: Proven engineering practices for the design	6.34.	Where an unproven design feature is introduced or where there is a departure from an established engineering practice, processes shall be specified in the management system to ensure that safety is demonstrated by means of appropriate supporting research programmes, performance tests with specific acceptance criteria or the examination of operating experience from other relevant applications. The new design feature or new practice shall be adequately tested to the extent practicable before being brought into service, and shall be monitored in service to verify that the behaviour of the nuclear fuel cycle facility is as expected.
Requirement 12: Proven engineering practices for the design	6.35.	Acceptance criteria for safety shall be established for all facility states. For the design of items important to safety, acceptance criteria in the form of engineering design rules may be used. These rules may include requirements in relevant codes and standards established in the State or internationally. The acceptance criteria for significant items important to safety shall be provided to the regulatory body for review [3].
Requirement 12: Proven engineering practices for the design	6.36.	Many nuclear fuel cycle facilities use aggressive chemicals under harsh environmental conditions, often involving thermal and mechanical cycling and the transfer of materials containing abrasive particulates and, in some cases, complex mixtures of elements and compounds unique to the facility. In establishing engineering design rules and acceptance criteria, the effects of corrosion, erosion and similar processes shall be considered. These effects shall also be considered when establishing monitoring and inspection requirements and, where appropriate, for the management of facility ageing.
Requirement 13: Safety classification of items important to safety		All items important to safety for a nuclear fuel cycle facility shall be identified and shall be classified on the basis of their safety function and their safety significance.
Requirement 13: Safety classification of items important to safety	6.37.	The safety significance of structures, systems and components shall be used for grading the application of safety requirements for design. The method for classifying²³ items important to safety shall be based primarily on deterministic methods complemented, where appropriate, by probabilistic methods (if available), with due account taken of factors such as: The safety function(s) to be performed by the item; The consequences of failure to perform a safety function; The time following a postulated initiating event at which, or the period for which, the item will be called upon to perform a safety function.
Requirement 13: Safety classification of items important to safety	6.38.	The design shall be such as to ensure that any interference between items important to safety will be prevented, and in particular that any failure of items important to safety in a system in a lower safety class will not propagate to a system in a higher safety class or to items in other levels of defence in depth.
Requirement 13: Safety classification of items important to safety	6.39.	Equipment that performs multiple safety functions shall be classified in a safety class that is assigned to those functions having the highest safety significance.
Requirement 13: Safety classification of items important to safety	6.40.	Items and software for instrumentation and control that are important to safety shall be classified in accordance with their function and significance for safety. The basis for the safety classification of items, including software, shall be stated and the design requirements shall be applied in accordance with the safety classification.
Requirement 14: Design basis for items important to safety		The design basis for items important to safety for a nuclear fuel cycle facility shall specify the necessary capability, reliability and functionality for the relevant operational states, for accident conditions and for conditions arising from internal and external hazards, to meet the specific acceptance criteria over the lifetime of the facility.
Requirement 14: Design basis for items important to safety	6.41.	The design shall be such as to ensure, as far as is practicable, that accidents are not likely to occur over the operating lifetime of the nuclear fuel cycle facility. The design basis for each item important to safety shall be systematically justified and documented. The documentation shall provide all the necessary information for the operating organization to operate the nuclear fuel cycle facility safely and to maintain and, if necessary, eventually to replace the item with a replacement or substitute item meeting the design intent and all functional requirements of the original item.
Requirement 14: Design basis for items important to safety	6.42.	The challenges that the nuclear fuel cycle facility may be expected to face during its lifetime shall be taken into consideration in the design process. For example, such challenges include all the foreseeable conditions and events relating to stages in the operating lifetime of the facility and to all facility states, site characteristics, design requirements and limits of parameters and modes of operation.
Requirement 15: Internal hazards		All foreseeable internal hazards shall be identified and all facility conditions that could directly or indirectly affect safety shall be examined.
Requirement 15: Internal hazards	6.43.	The goal of the safety assessment shall be to demonstrate that the risks to personnel, the public and the environment from the radioactive material and associated chemicals in the facility are sufficiently low in all facility states, when account is taken of the capabilities of the facility and the safety of operations.
Requirement 15: Internal hazards	6.44.	All foreseeable hazards and correlated events shall be examined systematically and in combination with facility conditions²⁴ and operator actions, to identify all sources of potential radiological hazard or associated chemical hazard. Internal industrial hazards that could interfere with the safe operation of the facility shall be identified.
Requirement 15: Internal hazards	6.45.	All credible failures of safety functions and all human errors that could result in a hazardous event shall be examined for all operating conditions of the facility, including shutdown. Hazards that arise from the processing of the radioactive material itself shall be included. All non-radiological hazards, e.g. industrial and chemical hazards, that may affect facility safety and lead to unacceptable radiological or chemical consequences, shall be taken into account.
Requirement 15: Internal hazards	6.46.	The potential for internal hazards such as explosion, fire, flooding, missile generation, pipe whip, jet impact, corrosion, erosion, vibration, thermal or pressure cycling or the release of fluid from failed systems or from other installations on the site shall be taken into account in the design of the facility (see the Appendix). Appropriate preventive measures and mitigatory measures shall be taken to ensure that safety is not compromised. The interrelation or interaction of external events with internal hazards shall also be considered in the design where appropriate.
Requirement 15: Internal hazards	6.47.	The set of identified hazards shall be confirmed to be comprehensive and shall be defined in such a way that it covers credible failures of items important to the safety of the facility and human errors that could occur in any of the operating conditions of the facility.
Requirement 15: Internal hazards	6.48.	Internal and external hazards that could affect multiple facilities on the same site shall be identified.
Requirement 16: External hazards		All foreseeable external events, both individually and in credible combinations, shall be evaluated.
Requirement 16: External hazards	6.49.	The design basis for natural and human induced external events shall be determined. The events to be considered shall include those that have been identified in the site evaluation (see the Appendix). The potential for external events to initiate internal fires or flooding or to lead to the generation of missiles shall be considered.
Requirement 16: External hazards	6.50.	Natural external hazards shall be addressed, including meteorological, hydrological, geological and seismic events, and all credible combinations thereof. Human induced external hazards arising from nearby industries and transport routes shall be addressed. In the short term, the safety of the facility shall not be dependent on the availability of off-site services such as electricity supply and firefighting services. The design shall take due account of site specific conditions to determine the maximum delay time by which off-site services need to be available.
Requirement 16: External hazards	6.51.	The need for the nuclear fuel cycle facility to be equipped with a seismic detection system shall be considered. Automatic processes or facility shutdown systems shall be actuated, in accordance with a graded approach, in the event of earthquakes exceeding thresholds specified by the safety analysis.
Requirement 16: External hazards	6.52.	Features shall be provided to minimize any interactions between buildings containing items important to safety (including power cabling and instrumentation and control cabling) and any other structure as a result of external events considered in the design.
Requirement 16: External hazards	6.53.	The design shall be such as to ensure that all items important to safety are capable of withstanding the effects of the external hazards considered; if not, other features such as passive barriers shall be provided to protect the nuclear fuel cycle facility and to ensure that the main safety functions will be achieved.
Requirement 16: External hazards	6.54.	The design shall provide for adequate margins to protect items important to safety against levels of external hazards more severe than those selected for the design basis as derived from the site hazard evaluation.
Requirement 17: Design criteria and engineering design rules		Design criteria corresponding to relevant physical parameters shall be specified for each operational state of the facility and for each design basis accident or equivalent. Engineering design rules shall be applied to provide for safety margins such that no significant consequences would occur even if the operational limits were exceeded within these margins.
Requirement 17: Design criteria and engineering design rules	6.55.	The operating organization shall identify the criteria, codes and standards applicable to items important to safety and shall justify their use, using a graded approach. Typical areas covered by codes and standards include structural, mechanical and electrical design, criticality safety and fire protection. In particular, if different criteria, codes and standards are used for different aspects of the same item or system, consistency between them shall be demonstrated. Where required, the selection of design codes shall be subject to review by the regulatory body.
Requirement 17: Design criteria and engineering design rules	6.56.	Conservative design criteria shall be used in the assessment of design basis accidents (or equivalent) in order to identify the most challenging parameter values for design.²⁵ The resulting limiting parameter values, with a reasonable margin, shall be used in the design of items important to safety, including experimental devices in research and development facilities.
Requirement 17: Design criteria and engineering design rules	6.57.	The operating organization shall specify recognized engineering design rules for the design, to avoid cliff edge effects and to prevent the occurrence of facility states that are more severe than those foreseen as anticipated operational occurrences.
Requirement 18: Specification of operational limits and conditions		Operational limits and conditions shall be prepared in the design stage, confirmed in the commissioning stage and established before operations of the facility commence.
Requirement 18: Specification of operational limits and conditions	6.58.	Operational limits and conditions are a set of rules setting forth parameter limits, the functional capability and the performance levels of equipment and personnel for the safe operation of a facility. Operational limits and conditions necessary for safe operation shall be developed in the design stage for a new facility and updated, if necessary, during commissioning to allow time for validation and approval.
Requirement 18: Specification of operational limits and conditions	6.59.	The safety analysis report shall describe the assumptions and provide the basis for the operational limits and conditions presented in the licensing documentation.
Requirement 19: Postulated initiating events		Postulated initiating events, including human induced events, that could affect safety shall be identified and their effects, both individually and in credible combinations, shall be evaluated.
Requirement 19: Postulated initiating events	6.60.	The list of internal and external hazards, including human induced hazards (see Requirements 15 and 16), shall be used to select initiating events for detailed further analysis. Postulated initiating events shall be identified on the basis of expert judgement, feedback from operating experience and deterministic assessment, complemented by probabilistic methods where appropriate. The resulting set of identified postulated initiating events shall be confirmed to be comprehensive.
Requirement 19: Postulated initiating events	6.61.	Certain events might be consequences of other events, such as a flood following an earthquake. An external hazard, such as an earthquake, is able to cause multiple simultaneous events on a site and major releases of hazardous chemicals and radioactive material from various source locations. Credible consequential effects shall be considered to be part of the initiating event. The impact of multiple correlated events on a single facility and the impact of a single event on all facilities on the same site shall be considered in the safety analysis.
Requirement 19: Postulated initiating events	6.62.	The postulated initiating events used for developing the performance requirements for the items important to safety in the overall safety assessment and the detailed analysis of the nuclear fuel cycle facility shall be used to identify bounding cases that provide the basis for the design and the operational limits for items important to safety.
Requirement 19: Postulated initiating events	6.63.	An analysis of the postulated initiating events shall be made to establish the preventive and protective measures that are necessary to ensure that the required safety functions will be performed.
Requirement 19: Postulated initiating events	6.64.	A technically supported justification shall be provided for exclusion from the design of any initiating event that is identified in accordance with the comprehensive set of postulated initiating events.
Requirement 20: Design basis analysis		A comprehensive safety analysis shall be carried out in the design process for a nuclear fuel cycle facility. Systematic and recognized methods of deterministic analysis shall be used, complemented by probabilistic assessments where appropriate, in accordance with a graded approach. The purpose of the analysis shall be to ensure that the design provides an adequate level of safety and meets the required design acceptance criteria.
Requirement 20: Design basis analysis	6.65.	The safety analysis and the design are interactive and iterative processes undertaken to ensure an adequate level of safety. The safety analysis shall cover all operational states (including radiation exposure expected to occur in normal operation) and accident conditions [13]. For each design basis accident or equivalent, the consequences to personnel, the public and the environment shall be evaluated. Non-radiological consequences of operation of the nuclear fuel cycle facility shall be considered in the safety analysis. For a new nuclear fuel cycle facility, the potential effect of the facility on existing nuclear activities nearby shall be included in the safety analysis.
Requirement 20: Design basis analysis	6.66.	As part of the safety analysis, event scenarios or groups of event scenarios shall be identified and design basis accidents or equivalent shall be postulated. Event scenarios may be grouped by event and hazard type (e.g. loss of confinement, criticality, fire). The analysis shall confirm that the risk of consequences from design basis accidents is acceptably low and that the likelihood of an accident has been minimized to the extent practicable. The potential for multiple accident scenarios developing simultaneously from a single initiating event shall be considered.
Requirement 20: Design basis analysis	6.67.	For each event scenario (or group of event scenarios), the safety functions and corresponding items important to safety and administrative controls that are used to implement the defence in depth concept shall be identified. The safety analysis shall provide assurance that uncertainties have been given adequate consideration in the design and especially that adequate margins are available to avoid cliff edge effects and large releases or early releases of radioactive material.
Requirement 20: Design basis analysis	6.68.	The following hierarchy of design measures shall be used for protection against potential hazards: Selection of operating processes such that inherent hazards are avoided; Passive design features; Active design features; Administrative controls (see Requirement 57).
Requirement 20: Design basis analysis	6.69.	The operating organization shall specify explicit design criteria for the level of safety to be achieved, in accordance with these safety requirements and the general framework for safety presented in Section 2. Dose constraints, risk constraints and reference levels shall be set for the protection of workers, the public and the environment from direct and indirect exposures to radiation, and authorized radioactive discharges in all facility states. Such constraints and reference levels shall be set equal to, or below, the limits established in national regulations, regulatory guidance, international and national standards to ensure compliance across the full range of facility conditions and throughputs.²⁶ Associated chemical and industrial hazards shall also be taken into account in deriving appropriate design criteria from the relevant legislation and standards.
Requirement 20: Design basis analysis	6.70.	In setting acceptable limits for design basis accidents, the risks from adverse events shall be characterized as tolerable risks or unacceptable risks depending on both the severity of the consequences and the frequency or probability of occurrence. Acceptable limits for the environment, the public, workers and other personnel on the site may be different. Where the consequences of accidents in the design basis exceed the acceptable limits, additional provision shall be made in accordance with the defence in depth principle to reduce the frequency of the and/or to mitigate its consequences, so as to bring the resulting risk within the tolerable region (see the Annex).
Requirement 20: Design basis analysis	6.71.	Depending on their safety classification, the design of structures, systems and components and the confirmatory analysis activities shall be iterated until adequate levels of safety have been attained by the design in accordance with the specified acceptance criteria.
Requirement 20: Design basis analysis	6.72.	The principal conclusions of the safety analysis shall include the safety limits for items and activities important to safety and any operational limits and conditions necessary. The preparation of operating procedures and plans for radiological protection, criticality prevention, industrial safety and emergency preparedness and response shall be based on the results of the safety analysis.
Requirement 21: Design extension conditions		A set of design extension conditions shall be derived on the basis of deterministic analysis and engineering judgement with complementary probabilistic assessments (as appropriate), in accordance with a graded approach, to further improve the safety of the nuclear fuel cycle facility by enhancing its capabilities to withstand, without unacceptable consequences, that are either more severe than design basis accidents or that involve additional failures. The design extension conditions shall be used to identify the additional accident scenarios to be addressed in the design and to plan practicable provisions for the prevention of such accidents or mitigation of their consequences.
Requirement 21: Design extension conditions	6.73.	An analysis of design extension conditions shall be performed for existing facilities and new facilities for which there is a potential for a large release or an early release of radioactive material. The main technical objective of considering the design extension conditions shall be to provide assurance that the design of the facility is such as to prevent accident conditions²⁷ not considered design basis accidents, or to mitigate their consequences, as far as is reasonably achievable. The potential for cliff edge effects to lead to an beyond the design basis shall be considered. For facilities where design extension conditions have been identified by the analysis, additional appropriately qualified features, or extensions to the capability of safety systems and procedures, shall be provided to prevent cliff edge effects and other events considered in design extension conditions and to mitigate their consequences.
Requirement 21: Design extension conditions	6.74.	New facilities shall be designed such that the possibility of conditions arising that could lead to early releases of radioactive material or to large releases of radioactive material is practically eliminated. The design shall be such that, for design extension conditions, off-site protective actions that are limited in terms of times and areas of application shall be sufficient for the protection of the public, and sufficient time shall be available to take such actions. The postulated initiating events that lead to design extension conditions shall also be analysed for their capability to compromise the ability to provide an effective emergency response. Only those protective actions that can be reliably initiated within sufficient time at the location shall be considered available.
Requirement 21: Design extension conditions	6.75.	The analysis undertaken shall include identification of the features that are designed for use in, or that are capable of preventing, events considered in the design extension conditions or mitigating their consequences. These features: Shall be capable of performing in the environmental conditions pertaining to design extension conditions, as appropriate; Shall have a reliability that is commensurate with the function that they are required to fulfil.
Combinations of events and failures	6.76.	Where the results of expert judgement and deterministic safety analyses complemented by probabilistic safety assessments (if available) indicate that combinations of events could lead to combinations of anticipated operating occurrences with other accident conditions, such combinations of events shall be considered to be design basis accidents or shall be included as part of design extension conditions, depending mainly on their likelihood of occurrence and the magnitude of their potential consequences. Certain events might be consequences of other events, such as a fire following an earthquake, or multiple events within the facility, such as several leaks, might be initiated by one external event. Such consequential effects shall be considered to be part of the original postulated initiating event.
Requirement 22: Analysis of fire and explosion		The potential for external and internal fires and explosions shall be analysed and related potential initiating events shall be identified for use in the safety analysis. Specific controls required for fires and explosions shall be identified clearly.
Requirement 22: Analysis of fire and explosion	6.77.	A fire hazard analysis and an explosion hazard analysis shall be carried out for the nuclear fuel cycle facility to determine the necessary ratings of fire barriers and to identify means of passive protection and appropriate physical separation against fire and explosion. Fires and explosions originating externally to the site and within the site shall be considered. The analysis shall cover all means of fire and explosion prevention and fire control: Fire prevention; Prevention of runaway chemical reactions; Fire detection; Fire extinction; Segregation and barriers to prevent the spread of fire and smoke; Escape routes for personnel.
Requirement 22: Analysis of fire and explosion	6.78.	The fire hazard analysis and the explosion hazard analysis shall explicitly consider both fires involving radioactive material and fires affecting radioactive material. The analyses shall demonstrate that a single event cannot prevent the safe shutdown of the facility or result in an uncontrolled release of radioactive material or associated hazardous material from the facility. The analyses shall identify: Postulated initiating events for use in the safety analysis; The potential for a common cause failure caused by a fire or explosion; Appropriate limits on flammable materials in process areas, switch rooms and control rooms.
Requirement 22: Analysis of fire and explosion	6.79.	Where appropriate, the analysis shall demonstrate that fire extinguishing systems would not increase the criticality risk, would not harm operating personnel, would not significantly impair the capability of items important to safety, and would not simultaneously affect redundant safety groups and thereby render ineffective the measures taken to comply with the single failure criterion (see Requirement 23). Rupture and spurious or inadvertent operation of fire extinguishing systems shall be covered in the analysis, in accordance with a graded approach.
Requirement 22: Analysis of fire and explosion	6.80.	The safety assessment shall identify those items, including buildings, whose failure due to internal or external events could compromise the main safety functions, and their failure shall be prevented by design. Depending on their importance to safety, items shall be designed and located, with due consideration of other implications for safety, to withstand the effects of hazards or to be protected against hazards and against common cause failure mechanisms.
Requirement 22: Analysis of fire and explosion	6.81.	Items important to safety (including buildings) shall be designed for all operational states, for design basis accidents and, as far as practicable, for design extension conditions. The design shall take account of the human and organizational factors identified under Requirement 27.
Requirement 22: Analysis of fire and explosion	6.82.
Requirement 22: Analysis of fire and explosion	6.83.	The design for process control shall incorporate provisions for bringing abnormal operating conditions to a safe and stable state. If a sudden shutdown of the facility or part(s) thereof is necessary, the interdependences between different processes shall be considered.
Requirement 22: Analysis of fire and explosion	6.84.	In anticipated operational occurrences and in accident conditions, it may be necessary for the operator to take further action to place the facility in a safe and stable long term state. Manual operator actions shall be analysed appropriately and shall be sufficiently reliable to bring the process to a safe state provided that: Adequate time is available for the operator to take actions for safety; The information available has been suitably processed and presented; The diagnosis is simple and the necessary action is clearly specified; The demands imposed on the operator are not excessive.
Requirement 22: Analysis of fire and explosion	6.85.	If any of the above conditions may not be met, the safety systems shall be such as to ensure that the facility attains a safe state.
Requirement 22: Analysis of fire and explosion	6.86.	A capability shall be provided for monitoring all essential processes and equipment during and following anticipated operating occurrences and accidents. If necessary, a remote monitoring capability and a remote safe shutdown capability shall be provided.
Requirement 22: Analysis of fire and explosion	6.87.	Within the design of the facility, consideration shall be given to further increasing shielding designed to address external exposure, where practical, in order to reduce the consequences of a criticality accident. The design and layout of shielding shall take account of its potential for degradation.
Requirement 22: Analysis of fire and explosion	6.88.	Consideration shall be given to the strengthening of structures to withstand or mitigate the effects of accident conditions such as explosion or criticality.
Requirement 22: Analysis of fire and explosion	6.89.	Items important to safety either shall be capable of functioning after a loss of support systems, e.g. compressed air, or, if not, shall be designed to fail to a safe configuration, with acceptable positions, settings and signals (or clear indication of their failed status).
Requirement 22: Analysis of fire and explosion	6.90.	The operating organization shall ensure that it has full access to the knowledge of the design and its configuration that are needed for safe operation, maintenance (including adequate intervals for testing) and modification.
Requirement 23: Redundancy, diversity and independence		As required by the safety analysis, the design shall make adequate provision for redundancy, diversity and independence of equipment.
Requirement 23: Redundancy, diversity and independence	6.91.	The facility shall be designed so that a single fault or equipment failure cannot lead to exceeding the conditions of the design basis. Adequate redundancy, diversity and independence with physical separation shall be provided for items important to safety.
Requirement 23: Redundancy, diversity and independence	6.92.	The principles of redundancy and independence shall be applied as important design principles for improving the reliability of functions important to safety. Depending on their safety classification, items important to safety shall be physically separated and the use of shared systems shall be minimized. It shall be demonstrated that the design of the facility is such as to ensure that no single failure could result in a loss of the capability of a system to perform as intended, unless the time available from onset of the would be sufficient for operator actions.
Requirement 23: Redundancy, diversity and independence	6.93.	The principle of diversity shall be considered in the design of the facility to enhance the reliability of items important to safety and to reduce the potential for common cause failures.
Requirement 24: Design provisions for radioactive waste management		The incorporation of provisions for radioactive waste management at the nuclear fuel cycle facility shall be considered at the design stage. The generation of radioactive waste shall be kept to the minimum practicable in terms of both activity and volume, by means of appropriate design measures. The predisposal management and disposal routes for waste shall be considered with the same aim of minimizing the overall impact on the workers, the public and the environment.
Requirement 24: Design provisions for radioactive waste management	6.94.	The design of the facility shall provide appropriate features to facilitate radioactive waste management. Systems and facilities shall be provided for the safe management of radioactive waste to enable radioactive waste characterization, segregation, conditioning, pretreatment, immobilization and interim storage that cover the current and future inventory of radioactive waste. These systems and facilities shall be provided in accordance with pre-established criteria and the national policy and strategy on radioactive waste management, and shall take into consideration both on-site and off-site storage capacity and disposal options. Radioactive waste management facilities are themselves nuclear fuel cycle facilities to which the requirements of this publication apply, with a graded approach.
Requirement 24: Design provisions for radioactive waste management	6.95.	The design of the facility shall enable the safe management of radioactive waste and effluents arising from operational states, maintenance and periodic clean-out of the facility. Due consideration shall be given to the various characteristics, compositions and activity levels of the waste generated in the facility.
Requirement 24: Design provisions for radioactive waste management	6.96.	The design shall incorporate: The most suitable materials and, where applicable, surface finishes, so that amounts of radioactive waste will be minimized to the extent practicable and decontamination will be facilitated; The access capabilities and the means of handling, including lifting requirements, that might be necessary; The facilities necessary for the processing (i.e. pretreatment, treatment and conditioning) and storage of radioactive waste generated during operation and provision for managing the radioactive waste that will be generated in the decommissioning of the facility.
Requirement 24: Design provisions for radioactive waste management	6.97.	The design of facilities shall endeavour, as far as practicable, to ensure that all waste types anticipated to be produced during the lifetime of the facility have designated disposal routes. Where such routes do not exist at the design stage of the facility, provision shall be made to facilitate envisioned future options.
Requirement 24: Design provisions for radioactive waste management	6.98.	Waste processing and, where necessary, interim storage facilities shall be considered within the scope of the overall facility design. The requirements on the generation, processing and storage of radioactive waste established in GSR Part 5 [14] shall be applied.
Requirement 24: Design provisions for radioactive waste management	6.99.	Nuclear materials that generate heat shall be stored in facilities that maintain a suitably reliable heat removal function in addition to adequate confinement and shielding (see Requirement 39).
Requirement 25: Design for the management of atmospheric and liquid radioactive discharges		Design provisions shall be established for ensuring that discharges of gaseous, liquid and particulate radioactive material and associated hazardous chemicals to the environment comply with authorized limits. Such provisions shall ensure that doses to the public and effects on the environment are as low as reasonably achievable.
Requirement 25: Design for the management of atmospheric and liquid radioactive discharges	6.100.	Nuclear fuel cycle facilities shall be designed to minimize the impact of radioactive material and associated toxic effluents from normal operations on the public and the environment. The management of radioactive effluents including discharges shall meet the requirements established in GSR Part 3 [2] and GSR Part 5 [14]. The designer shall consider the whole site when applying these requirements, taking account of the principle of optimization of protection and safety.
Requirement 25: Design for the management of atmospheric and liquid radioactive discharges	6.101.	Systems shall be provided for the treatment of gaseous and liquid radioactive effluents to keep their volumes, activity concentrations and the total amount of radioactivity as low as reasonably achievable and below the authorized limits for discharges. These provisions shall account for hazardous chemicals and particulate matter that are present or potentially present.
Requirement 25: Design for the management of atmospheric and liquid radioactive discharges	6.102.	The safety assessment and the environmental impact assessment in the licensing documentation shall consider the need for the monitoring, collection and appropriate treatment of potentially contaminated effluents (e.g. by ion exchange or filtering) prior to their discharge to the environment. Design features shall be provided to ensure discharges are within authorized limits prior to their release to the environment.
Requirement 25: Design for the management of atmospheric and liquid radioactive discharges	6.103.	The design shall accommodate the testing (in accordance with accepted international standards) of the efficiency of the final stages of the means for removal of hazardous and radioactive materials (by filters, scrubbers or beds) to ensure that this corresponds to the removal efficiency considered in the design.
Requirement 25: Design for the management of atmospheric and liquid radioactive discharges	6.104.	The safety assessment shall determine the need for real time measurements to confirm that cleaning systems are working effectively and to ensure that discharges are measured continuously. Design provisions shall be established for monitoring aerial and liquid radioactive discharges to the environment.
Requirement 26: Design for maintenance, periodic testing and inspection of items important to safety		Items important to safety shall be designed to facilitate maintenance, inspection and testing for their functional capability over the lifetime of the facility.
Requirement 26: Design for maintenance, periodic testing and inspection of items important to safety	6.105.	The design and layout of items important to safety shall include provisions to optimize protection in maintenance, inspection and testing activities. The term ‘maintenance’ includes both preventive actions and corrective actions.
Requirement 26: Design for maintenance, periodic testing and inspection of items important to safety	6.106.	Specific attention shall be paid to design for maintenance of equipment that is:²⁹ Installed in high active areas such as hot cells; To be used in facilities with a long design lifetime.
Requirement 27: Human factors engineering		Human and organizational factors and the human–machine interface shall be considered throughout the design process.
Requirement 27: Human factors engineering	6.107.	The design process shall give due consideration to the layout of facilities and equipment, and to procedures, including procedures for maintenance and inspection, facilitating the interaction between the operators and the facility in all facility states.
Requirement 27: Human factors engineering	6.108.	Human factors and ergonomic principles shall be applied in the design of remote handling equipment, gloveboxes, control rooms and panels, with consideration of the situational awareness of operators (e.g. through a holistic assessment of workload, layout, communications and operator support tools). Control panels shall be provided with clear displays and audible signals for those parameters that are important to safety.
Requirement 27: Human factors engineering	6.109.	The design shall minimize demands on operators in normal operation, in anticipated operational occurrences and in accident conditions, by considering provision of the following: Automatic actuation of appropriate actions to promote the success of the operation; Clear indications whenever significant changes of process state occur; Appropriate interlocks, keys, passwords and other control devices for prevention of errors.
Requirement 27: Human factors engineering	6.110.	Individuals undertaking analyses of human and organizational factors shall be appropriately trained and qualified. Operating personnel who have gained operating experience in similar facilities shall, as far as practicable, be actively involved in the design process, in order to ensure that consideration is given to the future operation of the facility (in all facility states) and maintenance of equipment.
Requirement 28: Control over the transfer of radioactive material and other hazardous material		The transfer of radioactive material and other hazardous material shall be considered in the safety analysis and the necessary controls shall be identified. The design shall provide features to ensure the safe transfer of radioactive material and associated chemicals.
Requirement 28: Control over the transfer of radioactive material and other hazardous material	6.111.	The control over transfers of radioactive material, fissile material and other hazardous material³⁰ between areas and buildings shall be addressed in the safety analysis. Provision shall be made for operators to specify the destination of material accurately, to detect misdirected material and to reject incoming materials that do not meet acceptance criteria. Particular care shall be taken for controls on potential routes to effluent streams or to the environment and the transfer of materials from within the containment or shielding to areas of lower levels of confinement or shielding. The safety of radioactive material can be challenged by chemicals that may not be hazardous in themselves.
Requirement 28: Control over the transfer of radioactive material and other hazardous material	6.112.	Packages containing fissile material subject to criticality controls shall be clearly labelled. Appropriate instrumentation and control, isolation and sampling shall be provided, in accordance with a graded approach.
Requirement 29: Design provisions for construction		Items important to safety for a nuclear fuel cycle facility shall be designed so that they can be manufactured, constructed, assembled, installed and erected in accordance with established processes that ensure the achievement of the design specifications and the required level of safety.
Requirement 29: Design provisions for construction	6.113.	Due account shall be taken of relevant experience that has been gained in the construction of other similar facilities and their associated structures, systems and components. Where best practices from other relevant industries are adopted, such practices shall be shown to be appropriate to the specific nuclear application.
Requirement 30: Qualification of items important to safety		A qualification programme shall be implemented to verify that items important to safety are capable of performing their intended functions when necessary, and in the prevailing environmental conditions, throughout their design life, with due account taken of conditions during maintenance and testing.
Requirement 30: Qualification of items important to safety	6.114.	The environmental and service conditions considered in the qualification programme for items important to safety at a nuclear fuel cycle facility shall include the variations in ambient environmental conditions that are anticipated in the design basis³¹ and for identified design extension conditions.
Requirement 30: Qualification of items important to safety	6.115.	The qualification programme for items important to safety³² shall include the consideration of ageing effects caused by environmental factors (such as irradiation, humidity or temperature) over the expected service life of the items important to safety. When the items important to safety are subject to natural external events and are required to perform a safety function during or following such an event, the qualification programme shall replicate as far as is practicable the conditions imposed on the items important to safety by the event, either by test or by analysis or by a combination of both.
Requirement 31: Design provisions for commissioning		The design shall include features as necessary to facilitate the commissioning process for the nuclear fuel cycle facility.
Requirement 31: Design provisions for commissioning	6.116.	In the context of nuclear fuel cycle facilities, commissioning is the process by means of which systems and components, having been constructed, are made operational and verified to be in accordance with the design and to have met the required performance criteria. All items important to safety shall be designed and arranged so that their safety functions can be adequately inspected, tested, and maintained whenever necessary, in accordance with their safety classification. Where possible, items important to safety shall be qualified before the commissioning stage. If it is not practicable to provide adequate testability of a component, the safety analysis shall take into account the possibility of undetected failures of such equipment. (See Section 8.)
Requirement 32: Design considerations for the management of ageing		Design safety margins shall be adopted so as to accommodate the anticipated properties of items important to safety, to allow for the effects of materials ageing and degradation processes.
Requirement 32: Design considerations for the management of ageing	6.117.	The design and layout of items important to safety, including containment systems and neutron absorbers, shall take account of ageing degradation of materials and the potential for premature failure. Where components provide a safety function, replacement components of equivalent quality shall be provided.
Requirement 32: Design considerations for the management of ageing	6.118.	Where details of the characteristics of materials whose mechanical properties may change in service are unavailable, a system of monitoring shall be developed in the design to minimize the risks brought about by the effects of ageing, process chemistry, erosion, corrosion and irradiation on materials (see Requirements 26 and 60).
Requirement 33: Design provisions for decommissioning		In the design of a nuclear fuel cycle facility, consideration shall be given to facilitating its ultimate decommissioning so as to keep the exposure of workers and the public, arising from decommissioning, as low as reasonably achievable and to ensure protection of people and protection of the environment, as well as to minimize the amount of radioactive waste generated in decommissioning.
Requirement 33: Design provisions for decommissioning	6.119.	While ensuring the safe operation of the facility, the design: Shall minimize the number and size of contaminated areas to facilitate cleanup in the decommissioning stage; Shall choose materials for containment that are resistant to all chemicals in use and that have sufficient wear resistance, to facilitate their decontamination at the end of their lifetime; Shall avoid undesired accumulations of chemicals or radioactive material; Shall allow for remote decontamination, as necessary; Shall consider the amenability to processing, storage, transport and disposal of the waste to be generated in the decommissioning stage; Shall make provision for the management of relevant knowledge of the design; Shall ensure that major system components and potential points of contamination, particularly in the facility structure, are readily accessible to facilitate decommissioning.
Requirement 34: Design for protection against internal radiation exposure		The design shall ensure that workers, the public and the environment are protected against uncontrolled releases of radioactive material in all facility states. Releases shall be kept as low as reasonably achievable and within authorized limits in normal operation and within acceptable limits in accident conditions.
Requirement 34: Design for protection against internal radiation exposure	6.120.	In normal operation, internal exposure shall be minimized by design and shall be as low as reasonably achievable. In accordance with a graded approach, the design features for controlling and limiting internal exposure include means for confinement and leak detection as follows: Provision shall be made for preventing the unnecessary release or dispersion of radioactive materials, radioactive waste and contamination at the facility. The facility layout shall be designed to ensure that access of operating personnel to areas of possible contamination is adequately controlled. Means of monitoring and appropriate alarm systems for airborne contamination shall be installed. Mobile or personal air-monitoring systems shall be provided at workplaces with significant quantities of radioactive material.
Requirement 34: Design for protection against internal radiation exposure	6.121.	Areas occupied by workers shall be classified in accordance with foreseeable levels of surface contamination and airborne contamination, and monitoring equipment shall be installed in accordance with this classification (see Requirement 24 of GSR Part 3 [2]). The need for appropriate provisions for specific operations in contaminated areas shall be taken into account in the design. Stationary and mobile equipment shall be provided to detect surface contamination on people, equipment, products and other objects to verify the effective confinement of radioactive material.
Requirement 34: Design for protection against internal radiation exposure	6.122.	Facilities shall be provided for the decontamination of operating personnel and equipment.
Requirement 35: Means of confinement		The design shall include means for the dynamic and static confinement of radioactive material and associated hazardous materials, as required by the safety analysis. Leak detection shall be implemented as appropriate for the control of contamination.
Requirement 35: Means of confinement	6.123.	The nature and number of confinement barriers and their design performance, as well as the design performance of ventilation systems, shall be commensurate with the degree of the potential hazards, with special attention paid to the potential for dispersion of alpha emitters. Levels of airborne contamination shall be as low as reasonably achievable and shall be kept within authorized limits.
Requirement 35: Means of confinement	6.124.	Containment shall be the primary method for confinement against the spreading of contamination. An appropriate number of complementary static physical barriers and dynamic containment systems shall be provided as determined by the safety analysis: The static containment system shall consist of physical barriers between radioactive material and the personnel or the environment. The number of physical barriers shall be determined on a case-by-case basis as determined by a safety analysis. The dynamic containment system shall be used to create airflow towards areas with higher levels of contamination for treatment before discharge.³³ The dynamic containment system shall be designed such that its effectiveness is maintained as far as achievable in case of loss of static confinement.
Requirement 35: Means of confinement	6.125.	The ingestion of a small quantity of some radioactive materials can result in a significant exposure. In new facilities where such materials are handled in mobile form (e.g. in MOX fuel fabrication facilities or reprocessing facilities), at least two static barriers shall be provided, so that radioactive material is confined inside the first static barrier during normal operations. The second static barrier shall be designed with features for the control of airborne contamination to minimize the radiation exposures of personnel in operational states for the entire lifetime of the facility, and to limit contamination within the facility to the extent practicable.
Requirement 35: Means of confinement	6.126.	Dynamic containment systems in nuclear fuel cycle facilities shall be designed with an appropriately sized ventilation system in areas that have been identified as having significant potential for concentrations of airborne hazardous material in all facility states.
Requirement 35: Means of confinement	6.127.	In the design of dynamic containment systems, account shall be taken of the performance criteria for ventilation and static confinement, including the pressure difference between zones, the types of filter to be used, the differential pressure across filters and the appropriate flow velocity for operational states.
Requirement 35: Means of confinement	6.128.	The effectiveness of filters and their resistance to chemicals, humidity, high temperatures of exhaust gases and fire conditions shall be taken into consideration. The buildup of material shall also be taken into consideration. The design of the ventilation system shall facilitate monitoring and testing of performance.
Requirement 36: Design for protection against external radiation exposure		Provision shall be made for ensuring that doses to workers and the public will be kept as low as reasonably achievable, with account taken of the relevant dose constraints, and shall be kept below the dose limits.
Requirement 36: Design for protection against external radiation exposure	6.129.	Radiation sources throughout the facility shall be comprehensively identified, and exposures and radiation risks associated with them shall be kept as low as reasonably achievable by a graded application of the requirements for protection, which are established in GSR Part 3 [2].
Requirement 36: Design for protection against external radiation exposure	6.130.	The design of the facility shall optimize human occupancy, the layout of equipment and radioactive material, and shielding equipment to ensure radiation exposures are maintained as low as reasonably achievable and kept within limits, in all operational states. The safety benefit from using automation and remote handling equipment shall also be considered, with an appropriate assessment of the allocation of functions between humans and automated systems.³⁴
Requirement 36: Design for protection against external radiation exposure	6.131.	The designer shall classify areas by taking into consideration the magnitude of the expected normal exposures, the likelihood and magnitude of potential exposures, and the nature and extent of the required protection and safety procedures. The requirement for worker access to areas where radiation levels may cause exposures that give rise to high doses shall be limited by design, with a level of control commensurate with the hazards [2].
Requirement 36: Design for protection against external radiation exposure	6.132.	Means of monitoring radiation levels shall be provided so that any abnormal conditions would be detected in a timely manner and personnel may be evacuated.
Requirement 36: Design for protection against external radiation exposure	6.133.	The facility layout shall be such that the doses received by workers during normal operation can be kept as low as reasonably achievable, and due account shall be taken of the necessity for any special equipment to be provided to meet these requirements. As far as practicable, equipment subject to frequent maintenance or manual operation shall be located in areas of low dose rate to reduce the exposure of workers.
Requirement 36: Design for protection against external radiation exposure	6.134.	Appropriate design features shall be provided to prevent direct radiation shine paths through and around penetrations in shielding.
Requirement 37: Radiation monitoring systems		Equipment shall be provided at the nuclear fuel cycle facility to ensure that there is adequate radiation monitoring in operational states, in design basis accidents and, if appropriate, in design extension conditions.
Requirement 37: Radiation monitoring systems	6.135.	Radiation monitoring systems at the facility shall include: Stationary dose rate meters for monitoring the local radiation dose rate at places that are routinely accessible by workers and at other places where access is allowed only for certain specified periods of time in operational states (e.g. cells for routine maintenance and ejector galleries where radiation levels may change). Stationary dose rate meters to indicate the general radiation levels at suitable locations of the facility in anticipated operation occurrences, design basis accidents and, as practicable, design extension conditions. The stationary dose rate meters shall provide sufficient information in the appropriate control position that operating personnel can initiate protective actions and corrective actions if necessary. Monitors for measuring the activity of radioactive materials in the atmosphere in those areas routinely occupied by personnel and where the levels of airborne activity may be expected to be such as to necessitate protective actions. Stationary equipment and laboratories for determining, in a timely manner, the concentrations of selected radionuclides in fluid process systems and in gas and liquid samples³⁵ taken from the facility or from the environment, in all facility states. Stationary equipment for monitoring and controlling effluents prior to or during their discharge to the environment. Such equipment shall be capable of detecting unplanned releases of radioactive material and associated toxic chemicals to the environment. Devices for measuring surface contamination. Installations and equipment for measuring doses to and contamination of personnel, waste and tools before exit from radiologically controlled areas. In accordance with a graded approach and commensurate with the risks involved, radiation monitoring at gates and other possible points of egress from the facility for radioactive material being removed from the facility building without permission or by unintentional contamination.
Requirement 37: Radiation monitoring systems	6.136.	Measures shall be taken to prevent the spread of radioactive contamination, including by means of adequate monitoring systems (see also Requirements 35 and 36).
Requirement 37: Radiation monitoring systems	6.137.	In addition to monitoring within the facility, arrangements shall also be made to assess exposures and other radiological parameters to determine the radiological impact of the facility on the environment, as necessary.
Requirement 38: Design for criticality safety		The design shall ensure an adequate margin of subcriticality, under operational states and conditions that are referred to as credible abnormal conditions, or conditions included in the design basis.
Requirement 38: Design for criticality safety		.
Prevention	6.138.	In areas of the facility where the quantity of fissile material involved is so low or the isotopic composition is such that it meets exemption criteria specified by, or agreed with, the regulatory body, then a full criticality safety assessment is not necessary.³⁶ In all other cases, criticality safety shall be ensured by means of preventive measures that are, as far as reasonably achievable, established in the design. In this context, the area subject to criticality control may be an entire enrichment cascade, a building or the entire site.
Prevention	6.139.	Methods of ensuring criticality safety in any process shall include, but shall not be limited to, any one of or a combination of: Passive engineered control involving equipment design; Active engineered control involving the use of process control instrumentation; Chemical means, such as the prevention of conditions that allow precipitation; Reliance on inherently safe processes; Administrative controls to ensure compliance with operating procedures.
Prevention	6.140.	Criticality evaluations and calculations shall be performed on the basis of conservative assumptions.
Prevention	6.141.	A rigorous, conservative and proven method of safety analysis shall be used and defence in depth shall be considered for the prevention of criticality accidents. Safety controls for criticality shall be independent, diverse and robust. Any change to the design or the assumptions that affect processes or activities involving fissile material shall be reassessed for criticality safety.
Prevention	6.142.	For the prevention of criticality by means of design, the double contingency principle shall be the preferred approach. For application of the double contingency principle, the design for a process shall include sufficient safety factors to require at least two unlikely, independent and concurrent changes in process conditions before a criticality accident is possible.
Prevention	6.143.	Criticality safety shall be achieved by keeping one or more of the following parameters of the system within subcritical limits for operational states and for conditions that, in accordance with national regulations, are referred to as (a) credible abnormal conditions, or (b) conditions included in the design basis (e.g. fire, flooding or loss of cooling): Mass and enrichment of fissile material present in a process; Geometry (limitation of the dimensions or shape) of processing equipment; Concentration of fissile material in solutions; Degree of moderation; Control of reflectors; Presence of appropriate neutron absorbers.
Prevention	6.144.	The safety of the design for a facility shall be demonstrated by means of a specific criticality analysis in which the following important factors are considered both singly and in combination: Fissile reference medium: the most reactive radioactive and chemical form of the fissile material involved, in operational states or accident conditions, shall be determined. Enrichment: the maximum authorized enrichment in any part of the facility shall be used in all assessments unless the impossibility of reaching this level of enrichment is demonstrated in accordance with the double contingency principle. Mass: criticality safety shall be assessed with a significant margin. Geometry: the analysis shall include the layout of the facility, and the dimensions of pipes, vessels and other process units. The potential for changes in dimensions (e.g. due to erosion or deformation) during operational states and accident conditions shall be considered. Concentration, density and form of materials: where applicable, a range of fissile material concentrations for solutions shall be considered in the analysis to determine the most reactive conditions that could occur. Unless the homogeneity of the solution can be guaranteed, the worst case concentration of fissile material in the processing and storage parts of the facility shall be considered. Moderation: the analysis shall consider a range of degrees of moderation to determine the most reactive conditions that could occur. Reflection: a conservative assumption for reflection shall be made. Neutron interaction: consideration shall be given to neutron interaction between all facility units that may be involved, including any mobile unit that may approach the array. Neutron absorbers: when taken into account in the safety analysis, and if there is a risk of degradation, or if they could become broken or dislodged, the presence and the integrity of neutron absorbers shall be verifiable during periodic inspection. Uncertainties in all parameters (e.g. mass, density, geometry and nuclear cross-section data sets) shall be considered in the criticality calculations.
Prevention	6.145.	Computer codes used for demonstrating criticality safety shall be verified and validated (see GSR Part 4 (Rev. 1) [13]).
Prevention	6.146.	In the demonstration of criticality safety, account shall be taken of: The potential for misdirection, accumulation, overflow and spills of fissile material (e.g. mistransfer due to human error) or for carry-over of fissile material (e.g. from evaporators). The potential for leaks to evaporate, leading to an increase in concentrations, particularly where there is a potential for evaporation to occur before the leak is detected. The choice of fire extinguishing media (e.g. water or powder) and the safety of their use shall be addressed. The effects of corrosion, erosion and vibration in systems exposed to oscillations, e.g. leaks and changes in geometry. When criticality control of fissile liquid is achieved by geometry, loss of confinement shall be anticipated by, for example, the use of criticality safe drip trays or monitoring liquid levels. The potential for internal and external flooding and other internal and external hazards that may compromise measures for criticality prevention. The potential use of neutron poisons such as gadolinium or boron shall be addressed in normal operation (e.g. to increase the safe mass of fissile material in a dissolver), during deviations from normal operation (e.g. dilutions of soluble neutron poisons below a specified limit of concentration) and in accident conditions. Transitory configurations of fissile material during transfers.
Prevention	6.147.	Particular consideration shall be given to: System interfaces where fissile material is transferred between different locations, e.g. between different processes, process vessels, sub-facilities or rooms; Situations in which there is a change in the state of the fissile material or in the method of criticality control, for example changes in physical and chemical forms and concentration; The transfer of fissile material from equipment with a favourable geometry to equipment with a geometry not meeting the acceptance criteria. 6.148. If the design of the facility takes into account burnup credit, its use shall be appropriately justified in the criticality safety analysis.
Mitigation	6.149.	States have adopted various approaches to mitigatory measures for, and consequence assessments of, criticality accidents. The need for and suitability of the following measures shall be assessed: The installation of a criticality detection and alarm system to initiate immediate evacuation; The identification and marking of appropriate evacuation routes and regrouping areas; The provision of appropriate emergency equipment; Specific measures to protect the public (see para. 6.150).
Mitigation	6.150.	When designing a new facility, the effectiveness of protective actions (see GSR Part 7 [6]) for protection of the public against off-site consequences of a criticality accident shall be evaluated. If it is determined that the protective actions cannot be effective owing to the sudden nature of a criticality accident, adequate preventive measures (distance, shielding and containment) shall be considered such that off-site consequences of a criticality accident do not exceed the criteria established for temporary public evacuation.
Mitigation	6.151.	In addition to the requirements established in paras 6.138 to 6.150, the following facility specific requirements shall be met.
Mixed uranium and plutonium oxide powders	6.152.	The safety of the design for a MOX fuel fabrication facility shall be achieved by keeping one or more of the following parameters of the system within subcritical limits in operational states and design basis accidents: PuO₂ (input): Mass and geometry in accordance with the safety specification of PuO₂ isotopic composition and moderation; Presence of appropriate neutron absorbers. UO₂ (input): mass and geometry in accordance with the safety specification of UO₂ isotopic composition and moderation. MOX powder (formed in the fuel fabrication process): mass, geometry and moderation in accordance with the isotopic specification and the PuO₂ content at each stage of the process. MOX pellets (produced in the fuel fabrication process): mass, geometry and moderation, taking into account the increase of density of fissile material. MOX rods and assemblies (manufactured): mass and moderation, taking account of the geometry of the rods. Mass and geometry in accordance with the safety specification of PuO₂ isotopic composition and moderation; Presence of appropriate neutron absorbers.
Mixed uranium and plutonium liquids	6.153.	A reference flowsheet shall be defined. This shall specify compositions and flow rates for active feed material and reagent feed material. Faults relating to incorrect reagent flows or compositions having the potential to impact criticality safety shall be assessed.
Mixtures of powders or liquids containing fissile material	6.154.	For laboratories and, if necessary, for solid plutonium waste, the safe mass and geometry (for storage) of plutonium shall be assessed with the specification of the isotopic composition, in accordance with para. 6.152(a) and (c).
Mixtures of powders or liquids containing fissile material	6.155.	The safety of the design for a facility in which mixtures of powders or liquids containing fissile material are handled shall be demonstrated by means of a specific criticality analysis in which the plutonium isotopic composition and the plutonium content and uranium enrichment (if ²³⁵U > 1%) are considered. The maximum authorized compositions in any part of the process shall be used in all assessments unless the impossibility of reaching this plutonium composition or content (and uranium enrichment, if applicable) is demonstrated in accordance with the double contingency principle.
Mixtures of powders or liquids containing fissile material	6.156.	A reference composition for the fissile material (the reference fissile medium) shall be defined. The criticality safety assessment performed using such a reference shall be a conservative bounding case for the actual composition of the fissile material being handled or processed, e.g. on the basis of the isotopic compositions of the uranium or plutonium, the moderator, the total plutonium content and the mass and volume of the fissile material.
Requirement 39: Design of provisions for heat removal		Cooling systems and the necessary support systems shall be provided to remove heat from radioactive decay and chemical reactions. The capacity, availability and reliability of cooling systems and their support systems shall be analysed and justified in the safety analysis.
Requirement 39: Design of provisions for heat removal	6.157.	Cooling systems shall be designed and provided to prevent overheating resulting in boiling or loss of confinement and the consequent release and dispersion of significant quantities of radioactive material from highly active systems for processing and storage of spent fuel, plutonium and other highly radioactive material.
Requirement 39: Design of provisions for heat removal	6.158.	Alternate heat sinks shall be provided where the safety assessment identifies the potential for widespread consequences resulting from loss of the primary heat sink (see para. 6.3 and Requirement 23).
Requirement 39: Design of provisions for heat removal	6.159.	The loss of electrical power supply and compressed air services is addressed in Requirements 49 and 50.
Requirement 40: Design measures to prevent and control hazardous reactions between materials		The design shall include features to control reactive, flammable, corrosive and pyrophoric materials and mixtures used or produced in the processing of radioactive material.
Requirement 40: Design measures to prevent and control hazardous reactions between materials	6.160.	The chemistry of any reactive, pyrophoric, flammable or highly corrosive materials used or produced in the processing of nuclear materials shall be considered in the safety analysis. Examples of such materials include hydrogen, hydrofluoric acid and red oil, which may be used or produced in processes including dissolution, extraction and fuel fabrication. Such materials may be present deliberately or as by-products of other processes, e.g. of radiolysis.
Requirement 40: Design measures to prevent and control hazardous reactions between materials	6.161.	Where hazardous materials are present, systems and controls shall be provided: To limit the storage (by concentration or by volume) of hazardous materials in areas where radioactive material is handled; To maintain concentrations of gas mixtures below flammable levels; To prevent solvents and their degradation products from undergoing rapid chemical decomposition and highly exothermic reactions in heated equipment; To avoid the potential for rapid exothermic reactions and ignition in downstream processes, including waste treatment, and prevent the exposure of pyrophoric materials to air.
Requirement 41: Design measures to prevent and control fires and to prevent explosions		The facility shall be designed and located so as to prevent and control fires and to prevent explosions with potential radiological consequences and to minimize their effects.
Requirement 41: Design measures to prevent and control fires and to prevent explosions	6.162.	Items important to safety shall be designed and located, subject to compliance with other safety requirements, so as to minimize the effects of fires and explosions, which could lead directly or indirectly to radiological consequences. The necessary ratings of the fire barriers and means of passive protection and physical separation against fires and explosions shall be based on a documented fire hazard analysis and an explosion hazard analysis for the nuclear fuel cycle facility.³⁷ The design shall include provisions to: Prevent fires and explosions; Detect and extinguish quickly those fires that do start, thus limiting the damage caused; Prevent the spread of those fires that are not extinguished, and prevent fire induced explosions, thus minimizing their effects on the safety of the facility.
Requirement 41: Design measures to prevent and control fires and to prevent explosions	6.163.	Internal fires and explosions shall not challenge redundant safety groups. Fire extinguishing systems shall be automatically actuated as necessary.
Requirement 41: Design measures to prevent and control fires and to prevent explosions	6.164.	Fire extinguishing systems shall be designed and located so as to ensure that their use or rupture or spurious or inadvertent operation would not cause an accident (see Requirement 22).
Requirement 41: Design measures to prevent and control fires and to prevent explosions	6.165.	Non-combustible or fire retardant and heat resistant materials shall be used wherever practicable throughout the nuclear fuel cycle facility, in particular in locations in which safety functions are performed, such as switch rooms and the control room. Flammable gases and liquids, reactive chemicals, oxidizing reagents and combustible materials that could produce or contribute to explosive mixtures shall be kept to the minimum necessary amounts and shall be stored in adequate facilities to keep reactive substances segregated. The use of organic substances (such as lubricating oil) shall be limited where they could come into contact with electrical circuits or reactive materials (such as UF₆).
Requirement 41: Design measures to prevent and control fires and to prevent explosions	6.166.	Fires and explosions shall not prevent achievement of the main safety functions or prevent monitoring of the status of the facility. These shall be maintained by means of the appropriate incorporation of redundant structures, systems and components, diverse systems and design for fail-safe operation.
Requirement 41: Design measures to prevent and control fires and to prevent explosions	6.167.	The design of inerting systems for the prevention of fire shall ensure their required availability, sustainability and reliability.
Requirement 42: Design for protection against toxic chemicals		The design shall ensure that personnel, the public and the environment are protected against toxic chemical exposures associated with radioactive material.
Requirement 42: Design for protection against toxic chemicals	6.168.	The design shall consider the publications issued by the IAEA with international organizations for the control of toxic chemicals (see Refs [17, 18]). To avoid health effects from exposures to toxic chemicals associated with radioactive material, the design shall follow the hierarchy of prevention, control and mitigation, as follows: The minimization of inventories of toxic chemicals; The safe transport, storage and use of hazardous process materials; The safe configuration and control over credible changes that may lead to the release of toxic materials; Adequate local ventilation and adequate facility ventilation; A detection and alarm capability for chemical or toxic releases; The chemical compatibility of materials that are likely to come into contact with one another; Personal protective equipment to protect against exposures to chemical compounds or toxic materials.
Requirement 43: Design of instrumentation and control systems		Instrumentation and control systems shall be provided for monitoring and control of all the process parameters that are necessary for safe operation in all operational states. Instrumentation shall provide for bringing the system to a safe state and for monitoring of accident conditions. The reliability, redundancy and diversity required of instrumentation and control systems shall be proportionate to their safety classification.
Requirement 43: Design of instrumentation and control systems	6.169.	The facility shall be provided with manual controls and automatic controls, as appropriate, to maintain parameters within the operational limits and conditions for the facility (see Requirements 9 and 18). Where urgent manual intervention would be necessary to respond to an event, the safety analysis shall demonstrate that there is sufficient time available for diagnosis and response. Safety related instrumentation and control systems shall be designed to withstand events within the design basis and design extension conditions, in accordance with their safety classification.
Requirement 43: Design of instrumentation and control systems	6.170.	The facility shall be provided with necessary and sufficient indicators and recording instrumentation to provide the operators with an adequate level of situational awareness by monitoring important safety parameters for all facility states. The design shall permit the control of the facility during occurrences and accidents to bring the facility back within normal operational limits or to a safe shutdown state. There shall be adequate physical separation between hazardous facilities and instrumentation and control systems used for emergency control (see Requirements 47 and 48).
Requirement 43: Design of instrumentation and control systems	6.171.	Adequate means shall be provided for measuring process parameters that are relevant to the safety of the facility, for both of the following: — In operational states, to ensure that all processes are being conducted within the operational limits and conditions and to provide an indication of significant deviations in processes; — For detecting and managing accident conditions, such as criticality or adverse effects due to external hazards such as an earthquake or flooding (e.g. fire, release of hazardous materials, loss of support systems).
Instrumentation and control systems for control of criticality	6.172.	Instrumentation and control systems used to ensure subcriticality shall be of high quality and shall be calibrated against known standards. Changes to computer codes and data shall be controlled to a high standard by means of the management system.
Instrumentation and control systems for control of criticality	6.173.	Radiation detectors (gamma and/or neutron detectors), with audible and, where necessary, visible alarms for initiating immediate evacuation from the affected area, shall cover all the areas where significant quantities of fissile material are present, unless the safety analysis demonstrates that no reasonably foreseeable set of circumstances can initiate a criticality accident, or that a large radiation dose to personnel in the event of criticality is not credible.
Instrumentation and control systems for hot cells, gloveboxes and hoods	6.174.	Hot cells, gloveboxes and hoods shall be equipped with instrumentation and control systems for fulfilling their requirements for static and dynamic confinement.
Chemical hazards	6.175.	For facilities handling and processing UF₆: Before heating a UF₆ cylinder, its mass shall be verified by means of a weighing scale, which shall be identified as important to safety. During heating, the temperature of the cylinder shall be controlled by means of two independent systems. There shall be two containment barriers (or more) around UF₆ in liquid form. In the event of an overfilled cylinder, the excess UF₆ shall be transferred by sublimation only.
Chemical hazards	6.176.	In areas with a significant chemical hazard (e.g. due to UF₆ or HF) and with limited human occupancy, detectors shall be installed, unless it can be demonstrated that a chemical release is highly unlikely.
Chemical hazards	6.177.	In diffusion enrichment facilities, in-line contaminant concentration detectors shall be used to avoid uncontrolled chemical reactions between UF₆ and possible impurities.
Requirement 44: Reliability and testability of instrumentation and control systems		All instrumentation and control based items important to safety shall be designed and arranged so that their safety functions can be adequately inspected and tested, and the systems important to safety can be maintained.
Requirement 44: Reliability and testability of instrumentation and control systems	6.178.	All instrumentation and control based items important to safety shall be designed and arranged so that their safety functions can be adequately inspected and tested, and that they can be maintained, as appropriate, before commissioning and at suitable and regular intervals thereafter in accordance with their importance to safety. If it is not practicable to provide adequate testability of a component, the safety analysis shall take into account the possibility of undetected failures of such equipment (see also Requirement 26).
Requirement 45: Design and development of computer based equipment in systems important to safety		If a system is dependent upon computer based equipment, appropriate standards and practices for the development and testing of computer hardware and software shall be established and implemented throughout the service life of the system, and in particular throughout the software development cycle. The entire development cycle shall be subject to a quality management system.
Requirement 45: Design and development of computer based equipment in systems important to safety	6.179.	The reliability achieved by hardware and software systems shall be proportional to their safety classification. The reliability of such systems shall be achieved by means of the following: A high quality of, and best practices for, hardware and software shall be used, in accordance with the importance of the system to safety. The entire development process, including the control, testing and commissioning of design changes, shall be systematically documented and shall be reviewable. Software specifically developed for items important to safety shall be tested on a platform that is as realistic as possible, prior to active commissioning [13]. Protection shall be provided against disruption of or interference with system operation that includes isolation from data systems of lower safety classification.
Requirement 46: Design of control rooms and panels		Where control rooms and/or panels are needed for safety, including for emergency response, their accessibility and habitability shall be ensured by design to satisfy the requirements resulting from the safety assessment.
Requirement 46: Design of control rooms and panels	6.180.	Appropriate measures shall be taken and adequate information shall be provided for the protection of occupants of control rooms against hazards such as high radiation levels resulting from accident conditions, releases of radioactive material, fire, or explosive or toxic gases. Adequate means of communication between control locations and the emergency response facility shall be provided.
Requirement 47: Design for emergency preparedness and response		The design of a nuclear fuel cycle facility shall include adequate provisions to enable prompt response to an emergency. Such provisions shall include alarms, escape routes and means for monitoring, communication and accounting for personnel.
Requirement 47: Design for emergency preparedness and response	6.181.	The inclusion of specific design features for facilitating emergency preparedness and response shall be considered, depending on the potential hazard associated with the facility. Requirements for such design features shall be based on the emergency preparedness category of the facility [6] and supported by analyses of design extension conditions. Acceptable measures for facilitating emergency preparedness and response shall be based where possible on realistic or best estimate assumptions, methods and analytical criteria.
Requirement 47: Design for emergency preparedness and response	6.182.	The facility shall be provided with adequate storage for emergency equipment (such as personal protective equipment), instrumentation (including portable instrumentation) for hazard monitoring and a sufficient number of escape routes, clearly and durably marked, with reliable emergency lighting, ventilation and other services essential to their safe use. The escape routes shall meet the relevant international requirements for radiation zoning and fire protection and the relevant national requirements for industrial safety.
Requirement 47: Design for emergency preparedness and response	6.183.	Suitable alarm systems and means of communication shall be provided so that all persons present at the facility and on the site can be given warnings and instructions, in all facility states. The availability of the means of communication necessary for safety within the facility shall be ensured at all times. Means of communication shall be available in the control room and also in the emergency response facility from which the emergency response is coordinated. This requirement shall be taken into account in the design and in the diversity of the means of communication selected for use.
Requirement 48: Provision of an emergency response facility		A safety assessment shall determine the need for an emergency response facility, on or near the site, from which the on-site response to an emergency can be coordinated.
Requirement 48: Provision of an emergency response facility	6.184.	On a large site with a number of facilities, provision of an appropriately resilient emergency response facility that can continue to perform its functions under design extension conditions shall be considered. It shall be demonstrated that the emergency response facility will be habitable and accessible during design basis accidents and design extension conditions, or an alternative emergency centre shall be identified. The emergency response facility shall be separated from any control locations used for normal operations. Information about important facility parameters and radiological and chemical conditions at the site shall be provided in the emergency response facility.
Requirement 48: Provision of an emergency response facility	6.185.	The emergency response facility shall provide means of communication with on-site and off-site emergency response organizations and with appropriate locations on the site.
Requirement 48: Provision of an emergency response facility	6.186.	Appropriate measures shall be taken to protect the occupants of the emergency response facility against hazards resulting from accident conditions. Where required, the emergency response facility shall include the necessary systems and services to permit extended periods of occupation and operation by emergency response personnel.
Requirement 49: Provision of an emergency power supply		The electrical power supply systems relied upon for safety functions shall be identified in the safety assessment. The design of electrical power supply systems shall ensure their required availability, sustainability and reliability, with provisions for an emergency power supply where necessary.
Requirement 49: Provision of an emergency power supply	6.187.	The design of the facility shall include an emergency power supply capable of supplying the necessary power in anticipated operational occurrences, design basis accidents and identified design extension conditions in the event of a loss of off-site power.
Requirement 49: Provision of an emergency power supply	6.188.	The design shall also include features to enable the safe use of non-permanent equipment to restore the necessary power supply.
Requirement 49: Provision of an emergency power supply	6.189.	For facilities with potentially high hazards (e.g. facilities processing, handling and storing spent nuclear fuel), emergency power supplies shall be provided for identified items important to safety. The reliability and diversity of the emergency power supply shall be considered in the safety analysis. The restoration of electrical power shall be organized and prioritized to ensure such restoration is adequate and timely following a loss of normal electrical power supply.
Requirement 50: Provision of compressed air systems		Compressed air systems relied upon for safety functions shall be identified in the safety analysis and appropriate design features shall be provided.
Requirement 50: Provision of compressed air systems	6.190.	The design for any compressed air system that services an item important to safety (such as valve actuation) shall specify the quality, pressure and flow rate of the air to be provided. The design of compressed air systems shall also ensure their required reliability. The provision of auxiliary compressed air tanks shall be considered for items important to safety.
Requirement 50: Provision of compressed air systems	6.191.	If required, the instruments for compressed air systems shall provide an indication of the systems’ status³⁸ in a visible location for all facility states.
Requirement 51: Design for handling and storage of fissile material and other radioactive material		The design of a nuclear fuel cycle facility shall include provisions for the safe handling and storage of fissile material and other radioactive material.
Requirement 51: Design for handling and storage of fissile material and other radioactive material	6.192.	Accidents in the handling and storage of fissile material and other radioactive material shall be considered in the safety analysis and their severity shall be determined, in accordance with a graded approach.
Requirement 51: Design for handling and storage of fissile material and other radioactive material	6.193.	Handling and storage systems for fissile material and other radioactive material shall be designed: To prevent criticality by a specified margin, by physical means, and preferably by use of geometrically safe configurations, even under conditions of optimum moderation; To permit inspection of the fissile material and other radioactive material; To permit maintenance, periodic inspection and testing of components important to safety; To prevent damage to fissile material and other radioactive material; To prevent the dropping of fissile material and other radioactive material in transit; To provide for the identification of individual packages of fissile material and other radioactive material; To ensure that adequate operating procedures and a system of accounting for, and control of, fissile material and other radioactive material can be implemented to prevent any loss of material, or loss of control.
Requirement 51: Design for handling and storage of fissile material and other radioactive material	6.194.	Wherever possible, movements of fissile material and other radioactive material (lifts) shall be inherently safe, e.g. at low height and avoiding sensitive equipment. Handling systems shall be designed to reduce the frequency and consequences of associated with movements of fissile material and other radioactive material, in accordance with the safety analysis.
Requirement 51: Design for handling and storage of fissile material and other radioactive material	6.195.	In addition, the fuel handling and storage systems for irradiated fuel shall be designed: To permit adequate removal of heat from the fuel in all facility states; To prevent unacceptable handling stresses being applied on fuel elements or fuel assemblies; To prevent potentially damaging drops of heavy objects, such as spent fuel casks or cranes, onto the fuel; To permit the safe keeping of suspect or damaged fuel elements or fuel assemblies; To control levels of soluble absorber if this is used for criticality safety; To facilitate the maintenance and future decommissioning of fuel handling and storage facilities; To facilitate the decontamination of fuel handling and storage areas and equipment when necessary; To facilitate the removal of fuel from storage and its preparation for transport on or off the site.
Requirement 51: Design for handling and storage of fissile material and other radioactive material	6.196.	Where a water pool is used for the storage of spent fuel or breeder elements, the design of the facility shall prevent the uncovering of assemblies in all operational states, so as to practically eliminate the possibility of an early or large radioactive release and to avoid high radiation fields on the site. The design of the facility shall provide: The necessary cooling capabilities for self-heating materials; Features to prevent the uncovering of fuel assemblies in the event of a leak or a pipe break; Reliable monitoring of the water level; (d) Means to restore the water level.
Requirement 51: Design for handling and storage of fissile material and other radioactive material	6.197.	The design of pools shall also include features to enable the safe use of non-permanent equipment³⁹ to provide water for the long term cooling of spent fuel and for providing shielding against radiation.
Requirement 51: Design for handling and storage of fissile material and other radioactive material	6.198.	The design shall include the following: Means for monitoring and controlling coolant temperatures for all facility states that are of relevance for self-heating materials; Means for monitoring and controlling the activity in water and in air for operational states and means for monitoring the activity in water and in air for accident conditions that are of relevance for a spent fuel pool; Means for monitoring and controlling the coolant chemistry for operational states.
Requirement 52: Design for monitoring and analysis of process chemistry		The design shall incorporate features for determining, by analysis or by monitoring, the chemical and radiochemical characteristics of various materials, as necessary for safety.
Requirement 52: Design for monitoring and analysis of process chemistry	6.199.	Features shall be provided in the design to ensure that the chemistry of all processes is being conducted within the operational limits and conditions. The design shall ensure that samples taken are representative, with preference given to techniques that optimize radiation protection and minimize waste generation and provide results in a timely manner. Equipment for obtaining samples shall be designed in accordance with ergonomic principles.
Requirement 53: Construction programme		Items important to safety shall be constructed, assembled, installed and erected in accordance with established processes that ensure that the design specifications and design intent are met. The safety implications of design changes during construction shall be assessed and documented.
Requirement 53: Construction programme	7.1.	The construction of a nuclear fuel cycle facility shall start only after the operating organization has verified that the main safety issues in the design have been resolved and has demonstrated conformity of the design with the relevant regulatory requirements. The responsibility for ensuring that the construction is in accordance with the design lies with the operating organization.
Requirement 53: Construction programme	7.2.	For large or complex facilities, authorization by the regulatory body may be granted in several stages. Each stage may have a hold point and regulatory approval may be necessary to proceed to the next stage. The extent of involvement by the regulatory body during construction shall be commensurate with the potential hazards of the facility.
Requirement 53: Construction programme	7.3.	Before construction begins, the operating organization shall make adequate arrangements with the selected contractor(s) concerning the responsibility for ensuring safety during construction and the identification and control of any adverse impacts of the construction activities on facility operations and of facility operations on the construction activities.
Requirement 53: Construction programme	7.4.	Records shall be maintained in accordance with the management system to demonstrate that the facility and its equipment have been constructed in accordance with the design specifications. Quality assurance records for construction activities shall be sampled and checked by the operating organization, in accordance with a graded approach.
Requirement 53: Construction programme	7.5.	The construction of large or complex nuclear fuel cycle facilities can take a number of years and construction personnel, including engineers and architects, may move away to other work and be replaced. Knowledge and experience relating to construction shall be maintained throughout the construction period and, as necessary, through the commissioning and operating stages.
Requirement 53: Construction programme	7.6.	Following construction of the facility, the operating organization shall review the as built documents to confirm that the design intent has been met and the safety functions specified will be fulfilled.⁴⁰ The as built documents (including information important to decommissioning and engineering drawings) shall be retained until the facility has been decommissioned and the site is released for unrestricted use.
Requirement 53: Construction programme	7.7.	The operating organization shall, as required, seek agreement by the regulatory body to proceed to the commissioning stage.
Requirement 54: Commissioning programme		The operating organization shall ensure that a commissioning programme for the nuclear fuel cycle facility is established and implemented.
Requirement 54: Commissioning programme	8.1.	An adequate commissioning programme shall be prepared for the testing of the components and systems of the nuclear fuel cycle facility after their construction or modification to demonstrate that they meet the design objective and the performance criteria. The programme shall be subject to regulatory review and assessment prior to its implementation.
Requirement 54: Commissioning programme	8.2.	The commissioning programme shall cover the full range of facility conditions considered in the design. The commissioning programme shall establish the organization of and responsibilities for commissioning, the commissioning stages, the suitable testing of items on the basis of their importance to safety, the test schedule, the commissioning procedures and reports, the methods of review and verification, the treatment of deficiencies and deviations, and the requirements for documentation.
Requirement 54: Commissioning programme	8.3.	The requirements on the commissioning programme as established in this section shall also apply to the restart of existing facilities (or processes within a facility) after a prolonged shutdown period, as advised by the safety committee.
Organization and responsibilities for commissioning	8.4.	The operating organization, designers and manufacturers shall be involved in the preparation and implementation of the commissioning programme. The commissioning process shall involve cooperation between the operating organization and the suppliers and constructors to allow the operating organization to gain a good understanding of the characteristics of the facility.
Organization and responsibilities for commissioning	8.5.	The operating organization shall ensure that the interfaces and the communication lines between different groups (i.e. groups for design, for construction, for commissioning and for operations, and suppliers and contractors) are clearly specified and controlled.
Organization and responsibilities for commissioning	8.6.	Authorities and responsibilities shall be clearly specified and shall be delegated to the individuals and groups performing the commissioning activities. The operating organization shall be responsible for ensuring that construction activities are of appropriate quality and that data on the completion of commissioning activities and comprehensive baseline data, documentation and information are collected and retained for use throughout the lifetime of the facility. The operating organization shall also be responsible for ensuring that the equipment supplied is manufactured in accordance with a management system that includes inspection for proper fabrication, cleanliness, calibration and verification of operability.
Organization and responsibilities for commissioning	8.7.	During construction and commissioning, the facility shall be monitored, preserved and maintained so as to protect facility equipment, to support the testing stage and to maintain conformity with the safety analysis report.
Organization and responsibilities for commissioning	8.8.	During construction and commissioning, a comparison shall be carried out between the as built facility and its design parameters. A comprehensive process shall be established to address non-conformities in design, manufacturing, construction and operation. Resolutions to correct differences from the initial design and non-conformities shall be documented.
Organization and responsibilities for commissioning	8.9.	At appropriate stages during commissioning, the following activities, which may differ depending on the type of facility, shall be performed, in accordance with a graded approach: Confirmation of the performance of shielding and containment systems, including confirmation of the weld quality of the static containment, where appropriate; Confirmation of the effectiveness of effluent controls; Confirmation, where practicable, of the performance of criticality control measures; Demonstration of the availability of criticality detection and alarm systems; Demonstration of the performance of emergency shutdown systems; Demonstration of systems for fire detection and control; Demonstration of the availability of the emergency power supply; Demonstration of the availability of other support systems, e.g. the compressed air supply and cooling.
Organization and responsibilities for commissioning	8.10.	During commissioning, operational limits and conditions and values for significant parameters shall be confirmed, as well as acceptable variations in values due to facility transients and other small perturbations. Any margins necessary to make allowance for the precision of measurements or the response times of equipment shall be determined and incorporated in control, alarm and safety trip settings and operational limits and conditions, as necessary.
Organization and responsibilities for commissioning	8.11.	The results and analyses of tests directly affecting safety shall be made available to the safety committee and the regulatory body for review and approval as appropriate. Liaison shall be maintained between the regulatory body and the operating organization throughout the commissioning process, in accordance with established procedures.
Commissioning tests and stages	8.12.	Commissioning tests shall be arranged in functional groups and in a logical sequence, and, as far as is reasonably achievable, shall cover all planned operational aspects. No test sequence shall proceed unless the previous required steps have been successfully completed. The point at which the safety evaluation of modifications is transferred from a design stage evaluation process to an operation stage evaluation process shall be specified, to ensure the proper transfer of responsibilities.
Commissioning tests and stages	8.13.	When the direct testing of safety functions is not practicable, alternative methods for adequately demonstrating their performance shall be applied, subject to appropriate approval in accordance with national requirements. This is particularly applicable to nuclear fuel reprocessing facilities.
Cold commissioning	8.14.	Cold (or ‘inactive’) commissioning includes all commissioning and inspection activities conducted with and without the use of non-active materials, before the introduction of radioactive material into the facility. The following activities shall, as a minimum, be performed in cold commissioning:⁴¹ Verification of safety functions that cannot be verified during construction or during hot commissioning, or those that are necessary to be confirmed before going to the hot commissioning stage; Confirmation of the performance of shielding and containment systems, including the weld quality of the static containment and the performance of ventilation functions, where appropriate; Confirmation of the performance of antisiphoning devices, where appropriate; Demonstration of the performance of emergency shutdown systems; Training, drills and exercises for emergency preparedness and response [6].
Cold commissioning	8.15.	For facilities authorized to handle fissile material, the following activities shall be performed: Demonstration of the availability of criticality detection and alarm systems; Training, drills and exercises for preparedness for and response to a criticality emergency.
Hot commissioning	8.16.	Hot (or ‘active’) commissioning begins with the introduction of radioactive material. Adequate measures shall be put in place to address changes in personnel and equipment, containment, criticality safety, and the radiation controls and protection arrangements that are normally necessary for hot commissioning.
Hot commissioning	8.17.	In hot commissioning (and in the early years of operation of the facility, as practicable), the following activities shall be performed: Confirmation of the performance of criticality safety controls; Verification of items that cannot be verified in cold commissioning, or that can be verified more effectively in hot commissioning than in cold commissioning; Verification that actual external and internal doses to workers are consistent with the assumptions made and the calculations performed during the design, when possible; Verification that actual discharges⁴² are consistent with calculated discharges and verification of the performance of discharge reduction and control systems, when possible.
Hot commissioning	8.18.	By the end of hot commissioning, all the items important to safety shall be made operational and verified to be in accordance with the design and to have met the required performance criteria for active operations and all operational assumptions in the safety analysis shall be confirmed. Any exceptions shall be justified in the licensing documentation for operations.
Commissioning procedures and reports	8.19.	Procedures shall be prepared, reviewed and made subject to approval for each commissioning stage prior to the commencement of tests for that stage. Commissioning activities shall be performed in accordance with the approved procedures. If necessary, the procedures shall include hold points for the notification and involvement of the safety committee, external bodies, manufacturers and the regulatory body.
Commissioning procedures and reports	8.20.	The commissioning programme shall include provisions and procedures for audits, reviews and verifications intended to ensure that the programme has been conducted as planned and that its objectives have been fully achieved. Provisions shall also be included for resolving any deviation or deficiency that is discovered in the commissioning tests.
Commissioning procedures and reports	8.21.	Reports covering the scope, sequence and expected results of commissioning tests shall be prepared in appropriate detail and in accordance with the management system requirements. The reports shall cover the following: The purpose of the tests, and acceptance criteria; The safety precautions, prerequisites and provisions required necessary during the tests; The test procedures; The test reports, including a summary of the data collected and their analysis, an evaluation of the results, the identification of deficiencies, if any, and implementation of any necessary corrective actions.
Commissioning procedures and reports	8.22.	The results of all commissioning tests, whether conducted by a member of the operating organization or a supplier, shall be made available to the operating organization and shall be retained for the lifetime of the facility.
Commissioning procedures and reports	8.23.	The commissioning report, produced at the conclusion of commissioning, shall identify any updates required to the licensing documentation and any changes made to safety measures or work practices as a result of commissioning.
Commissioning procedures and reports	8.24.	In addition to the requirements established in paras 8.1 to 8.23, the following facility specific requirements shall be met.
Reprocessing facilities	8.25.	For reprocessing facilities, the following activities shall, as a minimum, be performed in cold and hot commissioning: Demonstration of spent fuel feed controls; Demonstration of iodine monitoring and control.
Reprocessing facilities	8.26.	The commissioning requirements established in paras 8.1 to 8.23 apply in full, without grading, to reprocessing facilities.
Plutonium processing facilities and plutonium fuel fabrication facilities	8.27.	For facilities handling plutonium (i.e. reprocessing, plutonium and MOX fuel fabrication facilities), plutonium (or hot) commissioning requires major changes in personnel and equipment, containment, criticality, training and radiation protection arrangements: For the operating personnel, behaviours and attitudes supporting a strong safety culture shall be reinforced so as to ensure safe operation with plutonium. The management shall ensure that both the facility and the operating personnel are fully ready for the transition to plutonium commissioning before it is implemented.
Plutonium processing facilities and plutonium fuel fabrication facilities	9.1.	In accordance with Requirement 2 of this publication, the prime responsibility for safety rests with the operating organization of the nuclear fuel cycle facility. This prime responsibility includes the responsibility for supervising the activities of all other related groups, such as designers, suppliers, manufacturers and constructors, employers and contractors, as well as the responsibility for operation of the facility by the operating organization itself. The operating organization shall discharge this responsibility in accordance with its management system [4].
Plutonium processing facilities and plutonium fuel fabrication facilities	9.2.	The operating organization shall establish an appropriate management structure for the nuclear fuel cycle facility and shall provide the necessary infrastructure for operations to be conducted safely. The operating organization shall ensure that adequate resources are available for all functions relating to the safe operation and utilization of the nuclear fuel cycle facility, such as criticality safety, maintenance, periodic testing and inspection, radiation protection, application of the management system, emergency preparedness and response and other relevant supporting activities, and shall take into account industrial safety and chemical safety.
Plutonium processing facilities and plutonium fuel fabrication facilities	9.3.	The operating organization shall ensure that safety related structures and resources shared between facilities on the same site (including pipebridges, trenches and other transfer systems) are considered. Boundaries between different facilities shall be unambiguously defined. Arrangements for the use of shared resources shall be clearly defined and effective communication routes between different relevant organizations shall be established.
Plutonium processing facilities and plutonium fuel fabrication facilities	9.4.	As necessary, and in accordance with national regulations, a dedicated organization and specific rules for on-site transport shall be established.
Plutonium processing facilities and plutonium fuel fabrication facilities	9.5.	The operating organization shall ensure that all activities involving radiation exposure or potentially involving exposure are planned, supervised and carried out such that exposure is minimized. The operating organization shall ensure that adequate measures are put in place to provide protection against radiological and associated chemical hazards arising from modifications to the facility.
Plutonium processing facilities and plutonium fuel fabrication facilities	9.6.	In collaboration with designers and suppliers, the operating organization shall have overall responsibility for the satisfactory completion of any testing that cannot be completed during commissioning (e.g. measurement of actual doses to workers and testing of environmental discharge control measures).
Plutonium processing facilities and plutonium fuel fabrication facilities	9.7.	The operating organization shall prepare periodic summary reports on matters relating to safety as required by the regulatory body, which shall be reviewed by the safety committee and submitted to the regulatory body if so required.
Plutonium processing facilities and plutonium fuel fabrication facilities	9.8.	The operating organization shall ensure that: Adequate facilities and services are available for all facility states; The facility management is provided with sufficient authority and resources to enable it to fulfil its duties effectively.
Requirement 55: Structure and functions of the operating organization		The structure of the operating organization and the functions, roles and responsibilities of its personnel shall be established and documented, in accordance with a graded approach.
Requirement 55: Structure and functions of the operating organization	9.9.	Functional responsibilities, lines of authority, and lines of internal and external communication for the safety of operations in all facility states shall be clearly specified in writing. The functions and responsibilities of the key positions within the operating organization shall be established. In particular, the operating organization shall clearly establish lines of authority and arrangements for communications between senior management of the facility, the safety committee(s)⁴³, nuclear criticality safety staff, radiation protection personnel, groups responsible for maintenance, modification and engineering, and the personnel responsible for establishing and applying the management system.
Requirement 55: Structure and functions of the operating organization	9.10.	Documentation of the organizational structure and of the arrangements for discharging responsibilities shall be made available to the staff and to the regulatory body. The structure of the operating organization shall be specified so that all roles that are important for safe operation are specified and described. Proposed organizational changes to the structure and associated arrangements, which might be of importance to safety, shall be evaluated in advance by the operating organization. Where required by national regulations, proposals for such organizational changes shall be submitted to the regulatory body for approval.
Requirement 55: Structure and functions of the operating organization	9.11.	The operating organization may delegate to other organizations work necessary for discharging its responsibilities, in accordance with the regulatory requirements, but the overall responsibility and control shall be retained by the operating organization.
Requirement 55: Structure and functions of the operating organization	9.12.	The operating organization shall be responsible for ensuring that the necessary knowledge, skills, behaviours and attitudes supporting a strong safety culture and safety expertise are sustained at the nuclear fuel cycle facility,⁴⁴ and that human resource policies are developed and long term objectives for human resources are met.
Requirement 56: Operating personnel		The operating organization shall ensure that the nuclear fuel cycle facility is staffed with competent managers and sufficient qualified personnel for the safe operation of the facility.
Requirement 56: Operating personnel	9.13.	The operating organization shall assign direct responsibility and authority for the safe operation of the nuclear fuel cycle facility to senior management. Senior management shall have overall responsibility for the safety of all aspects of operation, training, maintenance, periodic testing, inspection, utilization and modification of the nuclear fuel cycle facility. Discharge of this responsibility shall be the primary duty of senior management.
Requirement 56: Operating personnel	9.14.	Senior management shall clearly document the duties, the responsibilities, the necessary experience and the training requirements of operating personnel, and their lines of communication. The duties, responsibilities and lines of communication of other personnel involved in the operation or use of the nuclear fuel cycle facility (e.g. technical support personnel and researchers) shall also be clearly documented.
Requirement 56: Operating personnel	9.15.	Senior management shall determine the minimum staffing requirements for the various disciplines required to ensure safe operation for all operational states. The required operating personnel, both the number of personnel and the duties for which they are required to be authorized,⁴⁵ shall be specified either in the operational limits and conditions or through appropriate arrangements approved under the licence. A qualified person with responsibility for the direct supervision of the operation of the nuclear fuel cycle facility shall be clearly identified by the operating organization at all times. The availability of the staff that would be required to perform duties in a nuclear or radiological emergency shall also be specified (see Requirement 21 of GSR Part 7 [6]).
Requirement 56: Operating personnel	9.16.	A detailed programme for the operation and utilization of the nuclear fuel cycle facility shall be prepared in advance and shall be subject to the approval of senior management.
Requirement 56: Operating personnel	9.17.	Senior management shall be responsible for and shall make arrangements for all the activities associated with safety, including the handling of fissile material.
Requirement 56: Operating personnel	9.18.	Senior management shall periodically review the operation of the nuclear fuel cycle facility and shall take appropriate corrective actions to address any problems identified. Senior management shall seek the advice of the safety committee(s) or shall call upon specialist advisors to review important safety issues arising in the commissioning, operation, maintenance, periodic testing and inspection, and modification of the facility.
Requirement 56: Operating personnel	9.19.	All safety significant aspects of operation, maintenance, periodic testing, inspection, utilization and modification of the nuclear fuel cycle facility shall be carried out by certified or authorized operating personnel (which may include personnel from external organizations). All certified or authorized operating personnel shall have the authority to terminate processes and activities in the interest of safety.
Requirement 56: Operating personnel	9.20.	A maintenance group shall be established by the operating organization to implement the programmes for maintenance, periodic testing and inspection (see Requirement 65).
Radiation protection personnel	9.21.	The radiation protection programme shall include the establishment within the operating organization of a radiation protection group, and the appointment of one or more qualified radiation protection officers who are technically competent in radiation protection matters and knowledgeable about the radiological aspects of the design, operation and hazards of the facility.
Radiation protection personnel	9.22.	The radiation protection personnel shall provide advice to the operating personnel and the advice and concerns of the radiation protection personnel shall be taken into consideration by the levels of management within the operating organization with the authority to establish and enforce operational procedures.
Nuclear criticality safety staff	9.23.	For nuclear fuel cycle facilities where there is the potential for an accidental criticality, the operating organization shall appoint qualified nuclear criticality safety staff who are knowledgeable about the physics of nuclear criticality and the associated safety standards, codes and best practices, and who are familiar with the facility design and operations. This function shall, to the extent necessary, be independent of the operations management.
Nuclear criticality safety staff	9.24.	The nuclear criticality safety staff shall provide assistance in the training of personnel, shall provide technical guidance and expertise for the development of operating procedures and shall check and validate all operations that may require criticality control.
Waste and effluent specialists	9.25.	There shall be sufficient qualified staff to ensure that policies for the management of waste and discharge of effluents are carried out in accordance with authorized limits and with the objective of minimizing the generation of radioactive waste.
Additional technical support personnel	9.26.	Any additional technical personnel, such as training staff, personnel with responsibilities for industrial and chemical safety and personnel responsible for establishing and applying the management system, shall follow the safety rules and procedures specified by the operating organization.
Requirement 57: Operational limits and conditions		The operating organization shall ensure that the nuclear fuel cycle facility is operated in accordance with the set of operational limits and conditions.
Requirement 57: Operational limits and conditions	9.27.	The facility shall be operated within a comprehensive set of operational limits and conditions to prevent situations arising that could lead to anticipated operational occurrences or accident conditions, and to mitigate the consequences of such events if they do occur. The operating organization shall derive operational limits and conditions from the safety analysis, with use of a graded approach, to ensure that the facility is being operated in accordance with the design assumptions and intent, as well as in accordance with its licence conditions. The operational limits and conditions, including safety limits, safety system settings and limiting conditions for safe operation, shall be subject to review by the safety committee. The operational limits and conditions shall be submitted to the regulatory body, with the licensing documentation, for assessment and approval before the commencement of operation, if so required by the regulatory body.
Requirement 57: Operational limits and conditions	9.28.	The operating organization shall maintain sufficient records to demonstrate compliance with operational limits and conditions (see Requirement 62).
Safety limits	9.29.	Safety limits shall be maintained to provide adequate protection of the integrity of the physical barriers against radiation and the uncontrolled release of radioactive material.
Safety system settings	9.30.	For each parameter for which a safety limit is required and for other important safety related parameters, there shall be a system that monitors the parameter and provides a signal (that can be utilized in an automatic mode if possible) to prevent that parameter from exceeding the set safety limit. The setting for the level at which a safety system is automatically actuated and which will provide the minimum acceptable safety margin is the safety system setting. This safety margin will allow for, among other things, behaviour in system transients, the equipment response time and inaccuracy of the measuring devices.
Limiting conditions for safe operation	9.31.	Limiting conditions for safe operation are conditions established to ensure that there are acceptable margins between normal operating values and the safety system settings for items important to safety.⁴⁶ The settings for limiting conditions for safe operation shall be such as to avoid the undesirably frequent actuation of safety systems. Limiting conditions for safe operation shall include limits on operating parameters, requirements relating to minimum operable equipment and minimal staffing levels, and actions to be taken by operating personnel to avoid the need for actuation of safety systems.
Limiting conditions for safe operation	9.32.	Limiting conditions for safe operation shall be established for authorizing the transfer of hazardous (radioactive, fissile or chemically reactive) materials between buildings. Such transfer shall depend on the positive acceptance of the material by operators in the receiving building before transfer commences.
Periodic testing and surveillance	9.33.	Requirements shall be established for the frequency and scope of periodic testing and surveillance for all items important to safety to ensure compliance with operational limits and conditions, safety system settings and limiting conditions for safe operation.
Operation outside operational limits or conditions	9.34.	In the event that the operation of the facility deviates from one or more operational limits and conditions, corrective actions shall be taken and the regulatory body shall be notified.
Operation outside operational limits or conditions	9.35.	Actions shall be specified to be taken by operators within a specified time if a limiting condition for safe operation is violated. The facility management shall conduct an investigation of the cause and the consequences and shall take appropriate actions to prevent a recurrence. The regulatory body shall be notified in a timely manner.
Administrative controls	9.36.	The administrative controls for operational procedures, staffing, the training and retraining of personnel, review and audit procedures, maintenance, modifications, records and reports, and required actions following a violation of operational limits and conditions shall be the responsibility of key positions in the operating organization. The operational limits and conditions shall include administrative requirements concerning the organizational structure of the operating organization and the responsibilities of key positions necessary for the safe operation of the facility.
Administrative controls	9.37.	The operating organization shall ensure the maintenance of and compliance with administrative controls specified in the safety assessment report and operational limits and conditions.
Requirement 58: Training, retraining and qualification of personnel		The operating organization shall ensure that all activities that may affect safety are performed by suitably qualified and competent persons.
Requirement 58: Training, retraining and qualification of personnel	9.38.	The operating organization shall clearly define the requirements for qualification and competence to ensure that personnel performing safety related functions are capable of safely performing their duties. Certain operating positions may require formal authorization or a licence.
Requirement 58: Training, retraining and qualification of personnel	9.39.	Suitably qualified personnel shall be selected and shall be given the necessary training and instruction to enable them to perform their duties correctly for all facility states, in accordance with the appropriate procedures.
Requirement 58: Training, retraining and qualification of personnel	9.40.	A suitable training and retraining programme shall be established and maintained for the operating personnel.⁴⁷ The training programme shall include provision for periodic confirmation of the competence of personnel and for refresher training on a regular basis. The refresher training shall also include retraining provision for personnel who have had extended absences from their authorized⁴⁸ duties.
Requirement 58: Training, retraining and qualification of personnel	9.41.	The training shall promote behaviour and attitudes supporting a strong safety culture and shall emphasize the importance of safety in all aspects of the facility, including its design features, safety analysis, human and organizational factors, operational limits and conditions, operating procedures, radiation protection (including contamination control), criticality safety, emergency preparedness and response, waste management and specific industrial safety hazards such as chemical and fire hazards. The scope of training on radiological and non-radiological hazards shall be commensurate with the hazard posed by the nuclear fuel cycle facility.
Requirement 58: Training, retraining and qualification of personnel	9.42.	Senior management shall be responsible for ensuring that all individuals selected for duties that impact safety are given the training and retraining necessary for the safe operation of the facility and that this training and retraining is appropriately evaluated. There shall be adequate training in the procedures to be followed for all facility states.
Requirement 58: Training, retraining and qualification of personnel	9.43.	Even where there are separate radiation protection personnel, the operating personnel, including technical support personnel, shall be given suitable training in radiation protection before the start of their duties. Periodic retraining in operational radiation protection shall be conducted.
Requirement 58: Training, retraining and qualification of personnel	9.44.	Specific training and drills for operating personnel, internal and external firefighters and other personnel relevant for emergency response shall be provided relevant to their assigned response functions in the event of a fire or explosion at the facility (see Requirement 25 of GSR Part 7 [6]). The extent of the training and retraining programmes shall be in accordance with the potential hazards of the facility and its processes.
Requirement 58: Training, retraining and qualification of personnel	9.45.	Specific attention shall be paid to the qualification and training of personnel for dealing with radiological hazards (e.g. criticality and contamination) and specific conventional hazards such as chemical hazards and fire hazards.
Requirement 58: Training, retraining and qualification of personnel	9.46.	The training programmes, training materials, the training itself and training outcomes (including those for retraining) shall be subject to review and audit in accordance with the established management system.
Requirement 58: Training, retraining and qualification of personnel	9.47.	In addition to the requirements established in paras 9.38 to 9.46, the following facility specific requirements shall be met.
Mixed oxide fuel fabrication facilities and reprocessing facilities	9.48.	Special attention shall be paid to training in glovebox operations, including actions to be taken if contamination occurs.
Facilities for conversion, uranium enrichment and fuel fabrication	9.49.	Operators shall be given training in the safe handling and processing of large quantities of UF₆ and other hazardous chemicals. The extent of the training shall be commensurate with the risks associated with the operation. For releases of UF₆ and other chemicals, adequate training shall be given to all site personnel to take appropriate action in the event of a chemical release.
Nuclear fuel cycle research and development facilities	9.50.	Both researchers and operators shall be qualified and trained to handle radioactive material and to conduct tests and experiments.
Requirement 59: Conduct of safety related activities		The operating organization shall ensure that all safety related activities are adequately analysed and controlled to ensure that the risks associated with ionizing radiation and associated toxic chemicals are kept as low as reasonably achievable.
Requirement 59: Conduct of safety related activities	9.51.	All operational activities shall be assessed for the potential risks associated with ionizing radiation and associated toxic chemicals. The level of assessment and control shall depend on the safety significance of the activity.
Requirement 59: Conduct of safety related activities	9.52.	If there is a need to conduct a non-routine operation or test that is not covered by existing operating procedures, a specific safety review shall be carried out and a special procedure shall be developed and made subject to approval, in accordance with the established procedures for modifications.
Requirement 60: Ageing management		The operating organization shall ensure that an effective ageing management programme is implemented to manage the ageing of items important to safety so that the required safety functions are fulfilled over the entire operating lifetime of the nuclear fuel cycle facility.
Requirement 60: Ageing management	9.53.	The ageing management programme shall determine the consequences of ageing and the activities necessary to maintain the operability and reliability of items important to safety. The ageing management programme shall be coordinated with, and be consistent with, other relevant programmes, including the programmes for in-service inspection, periodic safety review⁴⁹ and maintenance. A systematic approach shall be taken to providing for the development, implementation and continuous improvement of ageing management programmes.
Requirement 60: Ageing management	9.54.	Where details of the characteristics of materials and systems are unavailable and could affect safety, a suitable surveillance programme shall be implemented by the operating organization. Results derived from this programme shall be used to review the adequacy of the facility design at appropriate intervals.
Requirement 60: Ageing management	9.55.	The programme for maintenance and replacement of equipment shall be adjusted in accordance with the conclusions of the ageing management programme. The design life of equipment shall be considered in safety assessments for extended operation.
Requirement 61: Operational control of modifications		The operating organization shall establish and implement a programme for the control of modifications to the facility.
Requirement 61: Operational control of modifications	9.56.	The operating organization shall have the overall responsibility for all safety aspects of the preparation and performance of modifications. In addition, it shall establish procedures for the control of modification projects. The operating organization may assign or subcontract the execution of certain tasks to other organizations but it shall not delegate its responsibilities. In particular, the operating organization shall be responsible for the management of proposed modification projects, in which senior management shall participate in accordance with the established procedures. For major modifications, this participation shall include the setting of the objectives and the structure of the project, the appointment of a project manager, the specification of responsibilities and the allocation of adequate resources.
Requirement 61: Operational control of modifications	9.57.	The operating organization shall be responsible for ensuring that: For multifacility sites, a modification in the nuclear fuel cycle facility will not adversely affect the operability or safety of associated or adjacent facilities. The management system is applied at all stages in the preparation and performance of the modification to ensure that all applicable safety requirements and criteria are satisfied. The relevant safety documentation (e.g. the safety assessment report and operational limits and conditions) of the facility is applied by all individuals involved in making a modification, and protection of the public and protection of the environment are optimized. The relevant licensing documentation for each modification is prepared and the associated requirements for review and approval are met. These may include the requirement to obtain the approval of the regulatory body for the modification. All personnel who will be involved in making a proposed modification are suitably trained, qualified and experienced for the task and, if necessary, are trained in advance on the effect of the modification on facility operations and the safety characteristics of the facility. All documents affected by the modification that relate to the safety characteristics of the facility, such as the safety assessment report, the operational limits and conditions and the relevant procedures for operation, maintenance and emergencies, are promptly updated as necessary. Appropriate commissioning is carried out, the results are recorded and assessed and any findings are incorporated in the appropriate documentation, including changes to the safety assessment as necessary. In accordance with national requirements, the regulatory body is informed of modifications in advance and, where necessary, authorization to make a modification is sought and obtained before changes are made. Other requirements of this publication are met, as appropriate.
Requirement 61: Operational control of modifications	9.58.	Proposals for modifications to the facility shall be categorized and relevant criteria for this categorization shall be established, in accordance with a graded approach. Proposals for modifications shall be categorized either in accordance with the safety significance of the modification or on the basis of a statement of whether or not the proposed change will reduce the safety margins or challenge current operational limits and conditions or other significant acceptance criteria (e.g. collective or individual doses to workers).
Requirement 61: Operational control of modifications	9.59.	Modification projects having major safety significance shall be subjected to safety analyses and to procedures for design, construction and commissioning that are equivalent to those described in Sections 6, 7 and 8 for the design, construction and commissioning of the facility itself.
Requirement 61: Operational control of modifications	9.60.	In implementing modification projects for a nuclear fuel cycle facility, the radiation exposure of the workers involved shall be kept as low as reasonably achievable.
Requirement 61: Operational control of modifications	9.61.	Temporary modifications shall be limited in time and number to minimize their cumulative safety significance. Temporary modifications shall be clearly identified at their location and at any relevant control position. The operating organization shall establish a formal system for informing relevant personnel in a timely manner of temporary modifications and of their consequences for the operation and safety of the facility.
Requirement 62: Records and reports		The operating organization shall establish and maintain a system for the control of records and reports in the nuclear fuel cycle facility.
Requirement 62: Records and reports	9.62.	For the safe operation of the facility, the operating organization shall retain all essential information concerning the design, construction, commissioning, current configuration and operation of the facility. This information shall be maintained up to date throughout the operational stage of the facility and shall be kept available during decommissioning. The operating organization shall make arrangements for generating and controlling records and reports that have safety significance for the operation and decommissioning stages, including: The complete collection of revisions to the licensing documentation; Results of periodic safety reviews; Commissioning documents; Procedures and operating instructions; The history of and data on modifications; Operational data for the facility; Data from maintenance, testing, surveillance and inspection; Reports on events and incidents; Radiation protection data, including personnel monitoring data; Data on amounts and movements of nuclear and other radioactive material; Records of the discharges of effluents; Records of the storage and transport of radioactive waste; Results of environmental monitoring; Records of the main work activities performed in each location of the facility.
Requirement 62: Records and reports	9.63.	Procedures consistent with the management system shall be developed for the generation, collection, retention and archiving of records and reports. Information entries in log books, checklists and other appropriate records shall be properly dated and signed.
Requirement 62: Records and reports	9.64.	Records of non-compliance and the measures taken to return the facility to compliance shall be prepared and retained and shall be made available to the regulatory body. The operating organization shall ensure that records are retained for their specified retention periods.
Requirement 62: Records and reports	9.65.	The management system shall include arrangements for storing and maintaining records and reports. The document management system shall be designed to ensure that obsolete documents are archived and that personnel use only the latest version of each document. The need for off-site storage (e.g. in the emergency response facility) of documents for access in an emergency shall be considered.
Requirement 63: Operating procedures		Operating procedures shall be developed that apply comprehensively for normal operation, anticipated operational occurrences and accident conditions, in accordance with the policy of the operating organization and the requirements of the regulatory body.
Requirement 63: Operating procedures	9.66.	Operating procedures shall be developed for all safety related operations that may be conducted over the entire lifetime of the facility.
Requirement 63: Operating procedures	9.67.	Operating procedures shall be developed by the operating personnel, in cooperation whenever possible with the designer and manufacturer and with other staff of the operating organization, including radiation protection staff. Operating procedures shall be consistent with and useful in the observance of the operational limits and conditions and shall be prepared in accordance with management system procedures that govern the format, development, review and control of such procedures.
Requirement 63: Operating procedures	9.68.	The operating procedures shall be reviewed and updated periodically on the basis of lessons identified in using the procedures and in accordance with the management system. They shall be readily available at the point of use.
Requirement 63: Operating procedures	9.69.	All personnel involved in the operation and use of the facility shall be adequately trained in the use of these procedures, as relevant to their duties.
Requirement 63: Operating procedures	9.70.	When activities that are not covered by existing procedures are planned, an appropriate procedure shall be prepared and reviewed and shall be subject to appropriate approval before the activity is started. Additional training of relevant staff in these procedures shall be provided.
Requirement 64: Operational housekeeping and material conditions		The operating organization shall develop and implement programmes to maintain a high standard of material conditions, housekeeping and cleanliness in all working areas.
Requirement 64: Operational housekeeping and material conditions	9.71.	Administrative controls (see Requirement 57) shall be established to ensure that operational premises and equipment are maintained, well-lit and accessible, and that temporary storage is controlled and limited. Equipment that is degraded (owing to leaks, corrosion spots, loose parts or damaged thermal insulation, for example) shall be identified, reported and corrected in a timely manner.
Requirement 64: Operational housekeeping and material conditions	9.72.	There shall be a programme of monitoring for material degradation for vessels and containers holding mixtures of corrosive chemicals with fissile or highly radioactive materials.
Requirement 64: Operational housekeeping and material conditions	9.73.	The operating organization shall be responsible for ensuring that the identification and labels for items important to safety, rooms, piping and instruments are accurate, legible and well maintained, and that they employ compatible materials and inks.
Requirement 65: Maintenance, periodic testing and inspection		The operating organization shall ensure that effective programmes for maintenance, periodic testing and inspection are established and implemented.
Requirement 65: Maintenance, periodic testing and inspection	9.74.	Maintenance, periodic testing and inspection shall be conducted to ensure that items important to safety are able to function in accordance with their design intent and safety requirements, in compliance with the operational limits and conditions, and shall support the long term safety of the facility. In this context, maintenance includes both preventive actions and corrective actions.
Requirement 65: Maintenance, periodic testing and inspection	9.75.	The requirements for periodic testing and surveillance of items important to safety shall include a specification that clearly states the applicability, the frequency of periodic testing and surveillance and the criteria for acceptability. In order to provide operational flexibility, the specification of the frequency shall state average intervals, with a maximum interval that is not to be exceeded.
Requirement 65: Maintenance, periodic testing and inspection	9.76.	Programmes based on the safety assessment report shall be established for the maintenance, periodic testing and inspection of all items important to safety and shall be documented. It shall be ensured by means of these programmes that the level of safety is not reduced during the conduct of maintenance, periodic testing and inspection.
Requirement 65: Maintenance, periodic testing and inspection	9.77.	The maintenance, periodic testing and inspection programmes and their performance shall be reviewed at regular intervals to incorporate lessons learned from experience (see Requirement 73). All maintenance, periodic testing and inspection of items important to safety shall be carried out by following approved procedures.
Requirement 65: Maintenance, periodic testing and inspection	9.78.	The procedures shall specify the measures to be taken in the event of any changes from the normal configuration of the facility, including temporary isolations during maintenance, and shall include procedures for the restoration of the normal configuration on the completion of the activity.
Requirement 65: Maintenance, periodic testing and inspection	9.79.	Non-routine inspections or corrective maintenance of items important to safety shall be performed in accordance with a specially prepared plan and procedures. In-service inspections conducted for safety purposes and on a programmatic basis shall also be carried out in accordance with a specially prepared plan and procedures.
Requirement 65: Maintenance, periodic testing and inspection	9.80.	The frequency of maintenance, periodic testing and inspection of individual items important to safety shall be adjusted on the basis of experience and shall be such as to ensure adequate reliability. The operating organization shall assess the results of maintenance, periodic testing and inspection, and shall incorporate the feedback for continuous improvement.
Requirement 65: Maintenance, periodic testing and inspection	9.81.	The operating organization shall take actions to minimize the risks associated with maintenance during shutdown (intercampaign periods).
Requirement 65: Maintenance, periodic testing and inspection	9.82.	Any failure to comply with these requirements shall, in a timely manner, be recorded, investigated and reported to the regulatory body in accordance with national requirements and effective improvement actions shall be taken to prevent recurrence.
Requirement 66: Criticality control in operation		All operations with fissile material shall be carried out to maintain an adequate margin of subcriticality, under operational states and conditions that are referred to as credible abnormal conditions or conditions included in the design basis.
Requirement 66: Criticality control in operation	9.83.	The criticality safety programme shall ensure that operators are aware of the criticality hazard. All operations to which nuclear criticality safety is pertinent shall be governed by approved procedures. Operators shall be trained in and made aware of the conditions that may cause a criticality. The procedures shall specify all the parameters that they are intended to control and the criteria to be fulfilled. The programme shall set limits for quantities and concentrations of fissile material in transfers and at appropriate other points in processes. Prior to changing the location of process equipment or its process connections, or of neutron reflectors, the criticality assessment shall be reviewed in accordance with procedures for the control of modifications (see Requirement 61).
Requirement 66: Criticality control in operation	9.84.	Depending on the potential for criticality arising from accumulations of fissile material, including waste and residues, a surveillance programme shall be developed and implemented to ensure that uncontrolled accumulations of fissile material are detected and further accumulation is prevented. Deviations from procedures and unforeseen changes in process conditions that could affect nuclear criticality safety shall be reported to senior management and shall be investigated promptly. The regulatory body shall also be informed. Action shall be taken to prevent the recurrence of such deviations and unforeseen changes.
Requirement 66: Criticality control in operation	9.85.	For all types of nuclear fuel cycle facility (including research and development facilities) where there is a potential for criticality: The potential for the accidental transfer of two batches of fissile material instead of one (‘double batching’) shall be analysed in the demonstration of the criticality safety. Double batching shall be prevented by design and by means of administrative control measures (see Requirements 18 and 57). Procedures for the transfer or temporary movement of fissile material during operational states (including maintenance) shall be defined. Fissile material, including waste that has not been monitored for fissile content, shall not be accumulated in containers unless the containers have been specifically designed and approved for that purpose. All transfers of fissile material, including waste, shall be carried out in accordance with the criticality safety requirements of both the sending area and the receiving area, shall be certified as meeting these requirements by the sending facility and shall be accepted by the receiving facility prior to sending.
Enriched uranium fuel fabrication facilities	9.86.	In addition to the requirements established in paras 9.83 to 9.85, the following requirements shall be met for enriched uranium fuel fabrication facilities: If the facility is designed to produce in parallel fuel pellets of different enrichments, operations shall be managed to exclude the mixing of powders, pellets and rods of different enrichments. The process material balance shall be verified and controlled.
MOX fuel fabrication facilities	9.87.	In addition to the requirements established in paras 9.83 to 9.85, the following requirements shall be met for MOX fuel fabrication facilities: In normal operations, a number of parameters shall be measured and controlled to prevent a criticality event. These parameter values shall be of high integrity and shall be calibrated against known standards. Changes to computer codes and data shall be controlled to a high standard by means of the management system. The process material balance shall be verified and controlled.
Uranium enrichment and conversion facilities	9.88.	In addition to the requirements established in paras 9.83 to 9.85, the following requirements shall be met for enrichment and conversion facilities: Where there could be high concentrations of HF in the product stream of an enrichment facility, the pressure shall be maintained below the vapour pressure of hydrogen fluoride at that temperature to avoid the condensation of HF during crystallization (desublimation) of UF6 in a cylinder or intermediate vessel. When emptying process equipment and cylinders before wet cleaning (for maintenance or decommissioning), criticality shall be prevented by means of the following process, which may be iterative: Non-destructive monitoring⁵⁰ or visually checking for uranium holdup; Switching to dry cleaning in the event that uranium holdup is detected. Special procedures shall be implemented to ensure criticality safety during decommissioning operations when dismantling equipment whose safety is controlled by geometry.
Fuel reprocessing facilities	9.89.	In addition to the requirements established in paras 9.83 to 9.85, the following requirements shall be met for fuel reprocessing facilities: The feed programme for receiving and reprocessing spent fuel shall be prepared and assessed to ensure that the safety requirements are met throughout the reprocessing processes. Appropriate computational tools shall be used for this purpose. Wash lines and chemical feed lines for vessels and boxes containing fissile material shall be subject to appropriate technical and administrative controls, including when they are not in use. Specific provisions shall be provided to reduce the risk of accumulation of organic phase in tanks that handle aqueous solutions containing fissile material and to detect such accumulations, where necessary. Non-fissile chemical reagents that are important to process chemistry shall be assessed. If addition of either the wrong composition or the wrong quantity of a chemical reagent could pose a criticality hazard, then this shall be controlled.
Requirement 67: Radiation protection programme		The operating organization shall establish and implement a radiation protection programme.
Requirement 67: Radiation protection programme	9.90.	The operating organization shall ensure that the radiation protection programme is in compliance with the requirements of GSR Part 3 [2]. The operating organization shall verify, by means of surveillance, inspections and audits, that the radiation protection programme is being correctly implemented and that its objectives are being met. The radiation protection programme shall be reviewed on a regular basis and shall be updated if necessary.
Requirement 67: Radiation protection programme	9.91.	The radiation protection programme shall ensure that for all operational states and design basis accidents, doses due to exposure to ionizing radiation and doses due to any discharges of radioactive material from the facility are kept as low as reasonably achievable and are below authorized limits.
Requirement 67: Radiation protection programme	9.92.	There shall be sufficient, independent radiation protection staff and resources available to the operating organization to provide guidance on, and to ensure compliance with, radiation protection regulations, standards and procedures and safe working practices.
Requirement 67: Radiation protection programme	9.93.	Dose constraints shall be set for radiation exposures and reference levels shall be set for protective actions, as appropriate, to ensure that protection of workers is optimized [2]. In all operational states, the main aims of radiation protection shall be to minimize exposure to radiation and to keep doses below the dose constraints to comply with the fundamental safety objective.
Requirement 67: Radiation protection programme	9.94.	For accident conditions, the radiological consequences shall be kept low by means of appropriate engineered safety features and by implementation of the arrangements provided for in the emergency plan.
Control of occupational exposure	9.95.	All workers who may be occupationally exposed to radiation shall have their doses measured, recorded and assessed, as required by the regulatory body or other competent authority. These records shall be made available to the regulatory body and other competent authorities as designated in national regulations.
Control of occupational exposure	9.96.	The control of exposure shall be considered in the arrangements for routine activities, for instance the sampling devices, sample transfer methods, sample storage and the analytical laboratories shall be organized to minimize doses to operating personnel.
Control of occupational exposure	9.97.	Adequate time, distance and shielding requirements shall be instituted for personnel handling and inspecting radioactive material in process areas or storage who could potentially incur significant cumulative doses.
Control of occupational exposure	9.98.	Appropriate radiation monitoring equipment, including stationary or mobile monitors, shall be provided at the facility to ensure that there is adequate radiation monitoring in operational states and, as far as is practicable, in accident conditions. Owing to the wide range of radiation types and physical and chemical forms of radioactive material, the type of monitor to be used (both stationary and mobile) shall be specified by suitably qualified radiation protection personnel.
Control of contamination	9.99.	The spread of radioactive contamination shall be controlled and minimized as far as reasonably achievable. Access to areas where contamination levels may lead to high doses to workers shall be restricted and the level of control applied shall be commensurate with the hazard [2]. Close attention shall be paid to the confinement of fine radioactive powders and aqueous solutions containing thorium, plutonium, enriched uranium or other radioactive concentrates.
Control of contamination	9.100.	During operation (including maintenance interventions) the prevention of internal exposure shall be controlled by both physical and administrative measures, limiting the need for personal protective equipment as far as practicable. Adequate ventilation and/or respiratory protection shall be provided for protecting personnel and for controlling the spread of contamination when equipment and containers containing radioactive material, such as UF₆ cylinders, are opened.
Control of contamination	9.101.	In particular, where there is a likelihood of exposure that cannot be limited by design, workers shall be provided with personal protective equipment to protect against the hazards likely to be encountered.
Requirement 68: Management of radioactive waste and effluents		The operating organization shall establish and implement a programme for the management of radioactive waste and effluents.
Requirement 68: Management of radioactive waste and effluents	9.102.	The facility shall be operated so as to control and minimize, as far as reasonably achievable, the generation of radioactive waste of all kinds in terms of both activity and volume. The waste hierarchy set out in para. 6.17 shall be used in operations to facilitate the management of radioactive waste and associated hazardous waste.
Requirement 68: Management of radioactive waste and effluents	9.103.	The waste management programme shall include, as appropriate, the collection, characterization, classification, processing (pretreatment, treatment and conditioning), transport and storage of radioactive waste, the discharge of effluents and the disposal of waste. All activities concerning radioactive waste and associated hazardous chemical waste and effluents shall be conducted in accordance with the management system. Further requirements on the predisposal management of radioactive waste are established in GSR Part 5 [14].
Requirement 68: Management of radioactive waste and effluents	9.104.	Discharges of radioactive effluents and associated hazardous chemical effluents shall be authorized and conducted in accordance with regulations for the protection of the public and the environment. Discharges shall be monitored and the results shall be recorded in order to verify compliance with the applicable regulatory requirements. Records shall be maintained on the generation of waste and effluents, as well as on the classification, processing, storage and transfer of waste. An appropriate record shall be kept of the quantities, types and characteristics of the radioactive waste processed and stored on the site or transferred to authorized facilities for processing, storage or disposal. Such information shall also be reported periodically to the regulatory body in accordance with its requirements.
Requirement 68: Management of radioactive waste and effluents	9.105.	Approved procedures shall be followed for the collection, characterization, classification, processing, transport and storage of radioactive waste and its transfer to an authorized disposal facility. These activities shall be carried out in accordance with the requirements of the regulatory body.
Requirement 68: Management of radioactive waste and effluents	9.106.	Where a decision is made to store radioactive waste pending the provision of a disposal route, all the available information for waste characterization shall be retrievable.

Sekce

Odstavec

Text

Main

1.1.

This Safety Requirements publication establishes requirements for all the important areas of safety in all stages of the lifetime of a nuclear fuel cycle facility, including design and operation and all activities performed to achieve the purpose for which the facility was constructed. These activities include maintenance, in-service inspection and other associated activities, as well as the processing of radioactive material from its introduction to the facility to its exit from the facility. This publication supersedes the Safety Requirements publication, IAEA Safety Standards Series No. NS-R-5, Safety of Nuclear Fuel Cycle Facilities, issued in 2008 and revised and reissued with additional appendices in 2014.¹

Main

1.2.

Requirements for nuclear safety are intended to ensure the highest level of safety that can reasonably be achieved for the protection of workers, the public and the environment from harmful effects of ionizing radiation arising from nuclear facilities [1]. It is recognized that technology and scientific knowledge advance, and that nuclear safety and the adequacy of protection against radiation risks need to be considered in the context of the present state of knowledge. This Safety Requirements publication reflects the present international consensus and the experience of IAEA Member States from using the previous edition.

Main

1.3.

In this publication, nuclear fuel cycle facilities are nuclear installations, other than nuclear power plants, research reactors and critical assemblies, in which nuclear material and radioactive material are processed, handled, stored and prepared for disposal, in quantities or concentrations that pose potential hazards to personnel, the public and the environment. Nuclear fuel cycle facilities include facilities for:

Mining and processing of uranium and thorium ores;
Conversion and enrichment of uranium;
Reconversion and fabrication of nuclear fuels of all types;
Interim storage of fissile material and fertile material before and after irradiation;
Production of nuclear energy for power, research and other purposes;
Reprocessing of spent nuclear fuel and breeder materials from thermal reactors and fast reactors;
Associated waste conditioning, effluent treatment and facilities for interim storage of waste that allow for retrieval of the waste for later disposal;
Separation of radionuclides from irradiated thorium and uranium;
Related research and development.

Main

1.4.

Nuclear fuel cycle facilities employ many diverse technologies and processes. Radioactive material is often processed through a series of interconnected units and consequently can be found throughout an entire facility. The physical and chemical forms of the processed material may also vary within a single facility. Some of the processes use hazardous chemical substances and gases, which may be toxic, corrosive, combustible or reactive and consequently may give rise to the need for specific requirements in addition to requirements for nuclear safety. For example, the reactive chemicals used in many nuclear fuel cycle facilities can cause exothermic reactions that may need to be controlled to prevent effects such as overheating, fire or explosion. A further feature specific to nuclear fuel cycle facilities is that they are often characterized by frequent changes in the mode of operation, in equipment and in processes. Operations at nuclear fuel cycle facilities generally require more operator intervention than operations at nuclear reactors, which may result in specific hazards for personnel. On the other hand, the overall hazard to the public from many nuclear fuel cycle facilities can be low. The nature and diversity of the processes associated with nuclear fuel cycle facilities result in a broad range of hazardous conditions and possible accidents that need to be considered in the safety analysis. In view of the wide range of facilities and hazards, requirements established in this publication are to be applied using a graded approach where stated [1].

Main

1.5.

The objective of this publication is to establish a basis for safety and for safety assessment for all stages in the lifetime of a nuclear fuel cycle facility by establishing requirements for site evaluation, design, construction, commissioning, operation and preparation for decommissioning that must be satisfied to ensure safety.

Main

1.6.

This publication is intended for use by organizations involved in the design, manufacture, construction, modification, maintenance, operation and decommissioning of nuclear fuel cycle facilities, in safety analysis, verification and review and in the provision of technical support, as well as by regulatory bodies. Particular emphasis is given to safety requirements for design and operation including commissioning.

Main

1.7.

This publication also provides references to other IAEA Safety Requirements publications on aspects relating to regulatory supervision, management of safety, and site evaluation for nuclear fuel cycle facilities. This publication is intended to be used in conjunction with these related IAEA Safety Requirements publications and with IAEA Safety Guides, which provide recommendations on meeting these requirements for specific facility types and specific activities.

Main

1.8.

This Safety Requirements publication applies to nuclear fuel cycle facilities of all types and sizes, including facilities for the processing, refining, conversion, enrichment, and fabrication of fuel, the storage of spent nuclear fuel and the reprocessing of spent nuclear fuel, nuclear fuel cycle research and development facilities and supporting ancillary facilities in which radioactive material is handled. The scope of this publication extends from uranium refining and conversion to the storage of radioactive waste prior to disposal. Facilities for the mining and processing of natural ore, nuclear power plants, research reactors, critical assemblies and waste disposal facilities are outside the scope of this publication. The types of radioactive material covered by these requirements include nuclear material used as fissile or fertile fuel in thermal and fast reactors. In addition to processed uranium, such materials include plutonium, MOX (mixed uranium oxide, UO₂, and plutonium oxide, PuO₂) fuel, thorium breeder material and other types of experimental fuel. Facility specific requirements for the predisposal management of waste and the management of effluents containing radioactive material and associated hazardous chemicals are also included. The processes and hazards at facilities that produce isotopes by chemical separation from nuclear material can be similar to the processes and hazards at facilities for the processing and reprocessing of nuclear fuel. The requirements of this publication relating to criticality safety and confinement can also be applied to these processes, in accordance with a graded approach.

Main

1.9.

The safety requirements established in this publication are to be applied for new nuclear fuel cycle facilities and are also to be applied to existing nuclear fuel cycle facilities to the extent practicable.

Main

1.10.

In view of the broad diversity of facilities and operations covered, the requirements established in this publication are to be applied in a manner that is commensurate with the potential hazard for each facility, in accordance with a graded approach. Each case in which the application of the requirements is to be graded shall be identified, with account taken of the nature and possible magnitude of the hazards presented by the given facility and the activities conducted (see Section 2).

Main

1.11.

This publication does not address:

Requirements that are specifically covered in other IAEA Safety Requirements publications (e.g. Refs [2–6]), except in requiring a graded approach to the application of some of these other requirements.
Matters relating to nuclear security (other than requirements on the interfaces between nuclear safety and nuclear security, which are established in Section 11) or to the State system of accounting for, and control of, nuclear material.
Conventional industrial safety matters that under no circumstances could interfere with the nuclear safety of the nuclear fuel cycle facility. (For instance, a diesel spillage during transfer of diesel generator fuel is not addressed if it could not affect the nuclear safety of the facility, but a release of HF due to the escape and hydrolysis of UF₆ is addressed.)

Main

1.12.

If a particular nuclear fuel cycle facility or activity involving radioactive material does not conform exactly to the scope or description provided in para. 1.8, the safety requirements established in this publication still apply as a basis for establishing specific requirements.

Main

1.13.

Terms in this publication are to be understood as defined and explained in the IAEA Safety Glossary [7], unless otherwise stated (see Definitions).

Main

1.14.

Section 2 of this publication, which draws on IAEA Safety Standards Series No. SF-1 [1], Fundamental Safety Principles, introduces the general safety objective, concepts and principles for the safety of nuclear installations, with emphasis on the radiation safety and nuclear safety aspects of nuclear fuel cycle facilities. Section 3, which draws on IAEA Safety Standards Series No. GSR Part 1 (Rev. 1), Governmental, Legal and Regulatory Framework for Safety [3], establishes the general requirements on the legal and regulatory infrastructure as far as these are relevant for nuclear fuel cycle facilities. Section 4 establishes the requirements relating to the management and verification of safety. This section is based on IAEA Safety Standards Series No. GSR Part 2, Leadership and Management for Safety [4]. Section 5 establishes the requirements for site evaluation for new and existing nuclear fuel cycle facilities. This section is based on IAEA Safety Standards Series No. NS-R-3 (Rev. 1), Site Evaluation for Nuclear Installations [5]. Section 6 establishes the requirements for safety assessment for the safe design of all types of nuclear fuel cycle facility. It applies to new facilities and can also be applied in reviewing the safety of existing facilities. Section 7 establishes the requirements for construction of a nuclear fuel cycle facility. Section 8 establishes the requirements for the commissioning process. It also establishes requirements for a phased transition from inactive commissioning to active commissioning, when the requirements for operation first apply. Sections 7 and 8 can also be applied to modifications of existing facilities, in accordance with a graded approach.

Main

1.15.

Section 9 establishes the requirements for the safe operation of a nuclear fuel cycle facility, including maintenance, utilization and modification. It also covers requirements for records and reports for a nuclear fuel cycle facility, which are also applicable at other stages in the lifetime of a facility. Section 10 establishes the requirements for the preparation for the safe decommissioning of a nuclear fuel cycle facility on the basis of IAEA Safety Standards Series No. GSR Part 6, Decommissioning of Facilities [8], while Section 11 establishes the requirements for the interfaces between safety and security. The Appendix provides lists of postulated initiating events to be considered in the safety analysis for a nuclear fuel cycle facility. The Annex provides information on establishing risk criteria for safety.

Main

2.1.

SF-1 [1] establishes the fundamental safety objective and ten safety principles that provide the basis for requirements and measures to protect workers, the public and the environment from harmful effects of ionizing radiation and for the safety of facilities and activities that give rise to radiation risks. Restricting the likelihood of events that might lead to a loss of control of subcriticality or loss of confinement of radioactive material, or radiation exposures of people, also requires control over chemical hazards and other non-radiological hazards of nuclear fuel cycle facilities.

Main

2.2.

The fundamental safety objective is to protect people and the environment from harmful effects of ionizing radiation. Paragraph 2.1 of SF-1 [1] states that:

To control the radiation exposure of people and the release of radioactive material to the environment;
To restrict the likelihood of events that might lead to a loss of control over a nuclear reactor core, nuclear chain reaction, radioactive source or any other source of radiation;
To mitigate the consequences of such events if they were to occur.”

Main

2.3.

Paragraph 2.2 of SF-1 [1] states that:

Main

2.4.

In the context of nuclear fuel cycle facilities, non-radiological hazards associated with the radioactive material in the facility also need to be controlled, in order to minimize risks to workers, the public and the environment. Events initiated by chemical hazards and the toxic chemicals that are used in the facility can have a significant bearing on achieving the fundamental safety objective. Industrial hazards associated with radioactive material need to be considered in the design, commissioning and operation of the facility. Activities at nuclear fuel cycle facilities may also include industrial processes that pose additional hazards to safe nuclear operations, site personnel and to the environment. Purely industrial hazards also need to be considered where these can interfere with the nuclear safety of the facility.

Main

2.5.

Paragraph 2.3 of SF-1 [1] states that:

Main

2.6.

The requirements presented in this publication are derived from the fundamental safety objective of protecting people and the environment, and the related safety principles [1]:

Main

2.7.

In order to satisfy the safety principles, it is required to ensure that for all operational states (normal operation and anticipated operational occurrences) of a nuclear fuel cycle facility, doses from exposure to radiation within the facility or exposure due to radioactive discharges are kept within operational limits and below the dose limits and as low as reasonably achievable (protection and safety is required to be optimized [2]).

Main

2.8.

To apply the safety principles, nuclear fuel cycle facilities are required to be designed and operated so as to keep all sources of radiation and all nuclear material under strict technical and administrative control (see Requirement 57). However, these principles do not preclude limited exposures or the release of authorized amounts of radioactive materials to the environment from the facility in operational states. Such exposures and radioactive releases are required to be strictly controlled, to be measured or estimated, to be recorded and to be kept as low as reasonably achievable, in compliance with regulatory and operational limits as well as radiation protection requirements.

Main

2.9.

Although measures are taken to limit radiation exposure in all operational states to levels that are as low as reasonably achievable and to minimize the likelihood of an event that could lead to the loss of normal control over the source of radiation, there will remain a probability — albeit very low — that an accident could happen. Therefore, emergency arrangements are required to be in place to ensure that the consequences of any accident that does occur are mitigated. Such measures and arrangements include: engineered safety features; safety features for design extension conditions⁴; on-site emergency arrangements established by the operating organization; and, where necessary, off-site emergency arrangements established by the appropriate authorities in accordance with IAEA Safety Standards Series No. GSR Part 7, Preparedness and Response for a Nuclear or Radiological Emergency [6].

Main

2.10.

The primary means of preventing accidents at a nuclear fuel cycle facility and mitigating the consequences of accidents if they do occur is the application of the concept of defence in depth (SF-1 [1], Principle 8). This concept is applied to all safety related activities, whether organizational, behavioural or design related, in all operational states, and including activities with chemical hazards. This is to ensure that all safety related activities are subject to independent layers of protection (or barriers), so that if a failure were to occur in any one of these layers, it would be detected and compensated for or corrected through the successful application of measures in the other layers.

Main

2.11.

Application of the concept of defence in depth throughout design and operation provides protection against transients, anticipated operational occurrences and accidents, including those resulting from equipment failure or human action within the installation, and events induced by external hazards.

Main

2.12.

Paragraph 3.31 of SF-1 [1] states that:

The purpose of the first level of defence is to prevent deviations from normal operation and the failure of items important to safety. This leads to requirements that the facility be soundly and conservatively sited, designed, constructed, maintained, operated and modified in accordance with a management system and appropriate and proven engineering practices. To meet these requirements, careful attention is paid to the selection of appropriate design codes and materials, and to the quality control of the manufacture of components and construction of the facility, as well as to its commissioning. Design options, including the selection of processes, that reduce the potential for internal hazards also contribute to the prevention of accidents at this level of defence. Attention is also paid to the processes and procedures involved in design, manufacture, construction and in-service inspection, maintenance and testing, to the ease of access for these activities, and to the way the facility is operated and to how operating experience is utilized. This process is supported by a detailed analysis that determines the requirements for operation and maintenance of the facility and the requirements for quality management for operational and maintenance practices.
The purpose of the second level of defence is to detect and control deviations from operational states in order to prevent anticipated operational occurrences at the facility from escalating to accident conditions⁵. This is in recognition of the fact that postulated initiating events are likely to occur over the operating lifetime of a nuclear fuel cycle facility, despite the care taken to prevent them. This second level of defence necessitates the provision of specific systems and features in the design, the confirmation of their effectiveness through safety analysis, and the establishing of operating procedures to prevent such initiating events, or else to minimize their consequences, and to return the facility to a safe state.
For the third level of defence, it is assumed that, although very unlikely, the escalation of certain anticipated operational occurrences or postulated initiating events might not be controlled at a preceding level and that an accident could occur. In the design of the facility, such are postulated to occur. This leads to the requirement that inherent and/or engineered safety features, fail-safe design and procedures be provided to control the consequences of such . Such engineered safety features will be capable of preventing extensive damage to the facility or significant off-site releases and returning the facility to a safe state, and maintaining at least one physical barrier for the confinement of radioactive material. This barrier may be provided by a combination of a ‘static’ barrier with a complementary ‘dynamic’ barrier (e.g. a ventilation system), which together provide effective confinement of radioactive material. The most important objective for this level is to prevent releases of radioactive material and associated hazardous material or radiation levels that require off-site protective actions.
The purpose of the fourth level of defence is to mitigate the consequences of accidents that result from failure of the third level of defence in depth. The most important objective for this level is to ensure that the confinement function is maintained, thus ensuring that radioactive releases are kept as low as reasonably achievable.
The purpose of the fifth level of defence is to mitigate the radiological consequences and associated chemical consequences of releases or radiation levels that could potentially result from . This requires the provision of adequately equipped emergency response facilities and emergency plans and emergency procedures for on-site and off-site emergency response.

Main

2.13.

In the application of the concept of defence in depth, the chemical hazards associated with the radioactive material (i.e. dangerous properties arising from the chemistry of radioactive materials or as a consequence of activities at the facility) need to be taken into account at every level of defence. The potential interaction of multiple facilities or multiple on the same site also needs to be considered at the fourth and fifth levels of defence where applicable.

Main

2.14.

The safety philosophy that is followed to fulfil the objective and principles stated in SF-1 [1] relies on the concept of defence in depth and on the adoption of measures for the management and verification of safety over the entire lifetime of the nuclear fuel cycle facility. In addition to automatic control, many nuclear fuel cycle facilities rely on operator actions to maintain and control the safety of radioactive material throughout the facility. The safety philosophy addresses the means with which the organization supports individuals and groups in performing their tasks safely, taking the interactions between humans, technology and organizational aspects into account. The awareness by individuals of safety matters and the commitment of individuals to safety, and where appropriate the effective leadership and management of safety, are therefore essential to the proper application of the concept of defence in depth.

Main

2.15.

Nuclear fuel cycle facilities are of diverse natures and types. Their design and operating characteristics may differ significantly and present a variety of different hazards. Where certain hazards are demonstrated to be non-existent or very small, application of some features or procedures required for other higher hazard facilities may be less relevant or important. Because nuclear fuel cycle facilities present a greater range of hazards than do power reactors, a graded approach can be used in the application of certain identified requirements of this publication (see Requirement 11).

Main

3.1.

According to SF-1 [1], the government is responsible for the adoption of legislation that assigns the prime responsibility for safety to the operating organization and for the establishment of a regulatory body responsible for systems of authorization and inspection⁶, for the regulatory control of nuclear activities and for the enforcement of the legislation, regulations and conditions of the authorization. These principles are established in section 3 (Principles 1 and 2) of SF-1 [1].

Main

3.2.

General requirements to fulfil these principles are established in GSR Part 1 (Rev. 1) [3], which covers the essential aspects of the governmental and legal framework for establishing a regulatory body and for taking actions necessary to ensure the effective regulatory control of facilities and activities — existing and new — utilized for peaceful purposes. Other responsibilities and functions are also covered, such as liaison within the global safety regime and liaison for providing the necessary support services for the purposes of safety (including radiation protection), emergency preparedness and response, and the interfaces with nuclear security⁷ (see GSR Part 1 (Rev. 1) [3] and Ref. [11]) and with the State system of accounting for and control of nuclear material. These general requirements apply to the general legal and governmental infrastructure for the safety of nuclear fuel cycle facilities during site evaluation, design, construction, commissioning, operation, modification and preparation for decommissioning. A graded approach commensurate with the potential hazards of the facility shall be used in the application of these requirements (see para. 2.15).

Main

3.3.

Different types of authorization are required to be obtained for the different stages in the lifetime of a facility [3]. The authorization process may differ among States but the stages in the lifetime of a nuclear fuel cycle facility usually include the following:

Site evaluation;
Design;
Construction;
Commissioning;
Operation, including utilization and modification;⁸
Shutdown;
Decommissioning;
Release from regulatory control.

Main

3.4.

In some cases, several stages may be authorized by a single licence, with conditions attached to control the subsequent stages. Other stages, such as the termination of operation, could be required by the regulatory body.

Requirement 1: Licensing documentation

The operating organization shall demonstrate the safety of its facility through a set of documents known as the licensing documentation (or safety case). The licensing documentation shall provide a basis for the safety of the facility at all stages of its lifetime and shall be updated periodically, to take account of modifications made to the facility and other changes. The licensing documentation shall be considered by the regulatory body in determining whether the authorizations necessary under national legislative and regulatory requirements are to be granted.

Requirement 1: Licensing documentation

3.5.

The licensing documentation shall include an adequate safety analysis report and the operational limits and conditions, as well as any other information required by the regulatory body. The licensing documentation shall provide a detailed demonstration of the safety of the facility and shall form the basis of all decisions relating to the safety of the facility that are made by the operating organization; thus it forms an important link between the operating organization and the regulatory body.

Requirement 1: Licensing documentation

3.6.

The safety analysis report shall describe all activities with safety significance in appropriate detail, including any restrictions on inputs to and outputs from the facility. It shall describe the application of the safety principles and criteria in the design for the protection of workers, the public and the environment. The safety analysis report shall contain an analysis of the hazards associated with the operation of the facility and shall demonstrate compliance with the regulatory requirements and criteria. It shall also contain analyses of accidents and of the safety features incorporated in the design for preventing or minimizing the likelihood of their occurrence and for mitigating their consequences in accordance with the concept of defence in depth.

Requirement 1: Licensing documentation

3.7.

The safety functions, associated safety limits and items important to safety shall be identified in the safety analysis report, which shall also provide details about the operating organization, the conduct of operations and the management system throughout the lifetime of the nuclear fuel cycle facility. The licensing documentation shall provide details of the emergency arrangements for the facility.

Requirement 1: Licensing documentation

3.8.

The level of detail in the information to be presented in the safety analysis report shall be determined using a graded approach. The safety analysis report shall cite additional references that may be necessary for its thorough review and assessment. The referenced material shall be made readily available to the regulatory body. In all cases, the safety analysis report shall cover all the topics identified in paras 3.6 and 3.7.

Requirement 1: Licensing documentation

3.9.

The licensing documentation shall specify the required intervals for periodic testing and inspection of items important to safety. Consideration of the application of the principle of optimization of protection (Principle 5 of SF-1 [1]) in the design and operation of the facility shall be included in the licensing documentation.

Requirement 1: Licensing documentation

3.10.

The operating organization shall give adequate notice to the regulatory body of its intent to move from one stage to another in the lifetime of the facility. Decisions on the need for authorization shall be documented by the regulatory body, which shall assess the licensing documentation prior to granting an authorization. The operating organization shall submit the licensing documentation to the regulatory body in support of its application for authorization of the facility or activity. A schedule for the submission of documents for review and assessment for the stages in the authorization process shall be agreed between the regulatory body and operating organization.

Requirement 1: Licensing documentation

3.11.

The regulatory body shall base subsequent authorization for stages in the lifetime of the facility on relevant objectives, principles and associated criteria for safety to ensure that the facility presents no undue radiation risks to the personnel at the site, the public and the environment. The regulatory body shall take account of associated chemical hazards and security advice when making its assessment. The specific objectives of the regulatory review and assessment are provided in GSR Part 1 (Rev. 1) [3]. The review and assessment by the regulatory body shall be commensurate with the potential magnitude of the hazard associated with the facility in accordance with a graded approach.

Criteria for judging safety

3.12.

Each State shall develop its approach to criteria for judging safety, in accordance with its particular legal and regulatory infrastructure. The criteria for judging safety shall be based on principles for safe design and operation and shall be made available to the operating organization, ideally before the nuclear fuel cycle facility project commences. The Annex to this publication illustrates the concept of criteria for judging safety, expressed in terms of the relationship between the likelihood of an event occurring and the consequences of the event.

Criteria for judging safety

3.13.

Paragraph 2.5 of GSR Part 1 (Rev. 1) [3] states that the governmental, legal and regulatory framework for safety “shall set out … Provision for the inspection of facilities and activities, and for the enforcement of regulations, in accordance with a graded approach”.

Criteria for judging safety

3.14.

Paragraph 4.50 of GSR Part 1 (Rev. 1) [3] states that:

Criteria for judging safety

3.15.

Requirement 30 of GSR Part 1 (Rev. 1) [3] states that:

Criteria for judging safety

3.16.

If there is evidence of non-compliance or if risks are identified, including risks unforeseen in the authorization process, enforcement actions as described in para. 4.55 of GSR Part 1 (Rev. 1) [3] shall be taken.

Requirement 2: Responsibilities in management for safety

The operating organization shall have the prime responsibility for the safety of a nuclear fuel cycle facility over its lifetime. This responsibility includes ensuring that the design meets all applicable safety requirements.

Requirement 2: Responsibilities in management for safety

4.1.

The operating organization and all other organizations engaged in activities important to the safety of a nuclear fuel cycle facility shall be responsible for ensuring that safety matters are given the highest priority. The operating organization shall possess the necessary competence to ensure that the facility meets all applicable safety requirements and shall retain responsibility for safety when contracting out any processes, including the design or other analysis.

Requirement 2: Responsibilities in management for safety

4.2.

In order to ensure rigour and thoroughness by individuals at all levels in the achievement and maintenance of safety in all activities, the operating organization:

Shall clearly define responsibilities and accountabilities for safety with corresponding lines of authority and communication and shall ensure that individuals are not given other business roles that conflict with their responsibilities for safety;
Shall ensure that it has sufficient qualified individuals with appropriate experience at all levels;
Shall foster a strong safety culture and shall strictly adhere to sound procedures for all activities that may affect safety, ensuring that managers and supervisors promote and support good safety practices and correct poor safety practices;
Shall review, monitor and audit⁹ all safety related matters on a regular basis and shall implement appropriate corrective actions where necessary;
Shall allocate adequate financial resources to ensure safety, including provision for financial resources for decommissioning where these are not provided by the government.

Requirement 2: Responsibilities in management for safety

4.3.

The operating organization shall prepare a detailed demonstration of safety, which shall include an adequate safety analysis, at each stage in the lifetime of the facility. The safety analysis at each stage shall include an adequate demonstration of how the operating organization intends to discharge its responsibility for safety at all subsequent stages in the lifetime of the nuclear fuel cycle facility.

Requirement 2: Responsibilities in management for safety

4.4.

In a timely manner, the operating organization shall submit to the regulatory body any information that it has requested. The operating organization shall inform the regulatory body of any additional new information and of significant changes to information submitted previously. All information provided by the operating organization to the regulatory body shall be complete and accurate. The format and content of the safety documentation submitted to the regulatory body by the operating organization in support of the application for authorization shall be consistent with the requirements established in this publication.

Requirement 3: Safety policy

The operating organization shall establish and implement safety, health and environmental policies that give protection and safety the overriding priority warranted by their significance.

Requirement 3: Safety policy

4.5.

The safety policy established and implemented by the operating organization shall give safety the utmost priority, overriding all other demands, including those of facility production and project schedules or research and development programmes. The safety policy shall promote a strong safety culture, including a questioning attitude and a commitment to excellent performance in all activities important to safety. Managers shall promote an attitude of safety consciousness among individuals in the organization (see Ref. [12]).

Requirement 3: Safety policy

4.6.

The safety policy shall stipulate clearly the leadership role of the highest level of management in safety matters. Senior management¹⁰ shall be responsible for communicating and implementing the provisions of the safety policy throughout the organization. All individuals in the organization shall be made aware of the safety policy and of their responsibilities for ensuring safety. The behavioural expectations of senior management shall be clearly communicated to all individuals, including external support organizations and contractors, and it shall be ensured that such expectations are understood by all those who are expected to meet them.

Requirement 3: Safety policy

4.7.

The safety policy of the operating organization shall include a commitment to achieving enhancements in operational safety. The strategy of the operating organization for enhancing safety and for finding more effective ways of meeting safety standards shall be continuously monitored, periodically revised and supported by means of a clearly specified programme with clear objectives and targets.

Requirement 4: Management system

The operating organization shall establish, implement, assess and continuously improve an integrated management system for ensuring that all safety requirements are met at all stages of the lifetime of the nuclear fuel cycle facility.

Requirement 4: Management system

4.8.

The operating organization shall establish and apply a single coherent management system in which all the constituents of the organization, including its structure, resources and processes, are integrated to enable the organization’s objectives to be achieved.¹¹ The requirements for an integrated management system for facilities and activities are established in GSR Part 2 [4]. These requirements and the associated objectives and principles shall be taken into account in the development and implementation of the management system for a nuclear fuel cycle facility on the basis of the importance to safety of each item, service or process. The extent of development and application of the management system shall be determined in accordance with a graded approach for a particular nuclear fuel cycle facility.

Requirement 4: Management system

4.9.

The operating organization shall ensure through the establishment and application of the management system that the nuclear fuel cycle facility is sited, designed, constructed, commissioned, operated and decommissioned in a safe manner and within operational limits and conditions identified in the licensing documentation such as the safety analysis report.

Requirement 4: Management system

4.10.

Management arrangements shall be developed and established in a timely manner before transitions between major stages in the lifetime of the nuclear fuel cycle facility. In particular, activities for site investigation, which are usually initiated a long time before the establishment of a project, shall be covered by the management system.

Requirement 4: Management system

4.11.

The management system shall include all the elements of management so that processes and activities important to safety are established and conducted coherently with other requirements, including those relating to leadership, human performance, security, quality, protection of health and protection of the environment. The management system shall implement the safety policy.

Requirement 4: Management system

4.12.

The management system shall identify and include the following requirements:

The relevant statutory and regulatory requirements of the State;
Any requirements agreed with interested parties;
Relevant IAEA safety standards on matters not addressed by points (a) and (b).

Requirement 4: Management system

4.13.

The documentation of the management system shall be reviewed and made subject to approval¹² at appropriate levels of management in the operating organization and shall be submitted for review and assessment by the regulatory body if so required.

Requirement 4: Management system

4.14.

The provisions of the management system shall be based on four functional categories: management responsibility; resource management; process implementation; and measurement, assessment and improvement.

Management responsibility

4.15.

Management responsibility includes planning, implementing and providing the means and support necessary to achieve the organization’s objectives. Before major decisions affecting safety are taken, management shall seek independent advice and the agreement of the regulatory body where necessary. In this regard, the management system shall include provisions for ensuring effective communication and clear assignment of responsibilities, in which accountabilities are unambiguously assigned to individual roles within the organization and to suppliers, to ensure that processes and activities important to safety are controlled and performed in a manner that ensures that safety objectives are achieved.

Resource management

4.16.

Resource management includes measures to ensure that the resources essential to the implementation of safety policy and the enhancement of safety and the achievement of the organization’s objectives are identified and made available. The management system shall ensure that:

The operating organization is resourced with sufficient qualified personnel for the safe operation of the facility.
Suppliers, manufacturers and designers of items important to safety have an effective management system in place.
External personnel (including suppliers of both materials and services) are adequately qualified and are performing their activities under the same controls and to the same standards as the facility personnel.
Equipment, tools, materials, hardware and software necessary to operate the facility at all stages of its lifetime in a safe manner are specified, supplied, checked, verified and maintained in accordance with the management system.

Process implementation

4.17.

Process implementation includes the actions and tasks necessary to achieve an appropriate level of quality, in accordance with a graded approach. Such actions and tasks include identification of the processes of the management system, and determination of the sequences in and interaction between those processes.

Process implementation

4.18.

The management system shall include provisions to ensure that the design, including subsequent changes, modifications or safety improvements, construction, commissioning, operational activities, and decommissioning of the nuclear fuel cycle facility are carried out in accordance with established codes, standards, specifications, procedures and administrative controls¹³. Means of detecting and correcting deficiencies in any of these activities shall be provided. Items and services important to safety shall be specified and controlled to ensure their proper use, maintenance and configuration. The use of computer codes for the justification of the safety of the facility, and their validation and verification (e.g. tests and experiments), shall be covered by the management system.

Process implementation

4.19.

For the manufacturing, installation and construction of items important to safety for the nuclear fuel cycle facility, processes shall be established to ensure that the relevant regulations and safety requirements are met and that the construction work is properly carried out. The processes shall be such as to allow the operating organization to ensure that the fabrication and construction of items important to safety are performed in accordance with the design intent and regulatory requirements (see Requirement 13).

Process implementation

4.20.

As part of the management system, processes for the control of modifications shall be established, and graded in accordance with the safety significance of the modification. These processes shall cover the design, review, assessment and approval, fabrication, testing and implementation of a modification project. Relevant procedures describing the processes shall be put into effect by the operating organization before the commissioning stage of the nuclear fuel cycle facility. For nuclear fuel cycle research and development facilities, the activities of the utilization programme (including new experiments) shall be subjected to the same requirements as those for modifications.

Process implementation

4.21.

Where a nuclear fuel cycle facility imports nuclear, toxic or flammable materials or generates products, waste or effluents, any safety implications of these materials and of any on-site transfer of these materials shall be covered by the processes of the management system, in accordance with a graded approach. The requirements for the transport of radioactive material off the site are established in SSR-6 [9].

Process implementation

4.22.

The management system shall ensure that items and services under procurement meet established design, quality and performance criteria. Suppliers shall be evaluated and selected on the basis of specified criteria, which shall be periodically reviewed and the suppliers then re-evaluated. Requirements for reporting deviations from procurement specifications shall be specified in the procurement documents. Evidence that purchased items and services meet procurement specifications shall be made available for verification before the items are used or the services are provided.

Measurement, assessment, evaluation and improvement

4.23.

Measurement, assessment and evaluation provide an indication of the effectiveness of management processes and work performance. The effectiveness of the management system shall be periodically assessed through audits. Weaknesses in processes and performance shall be identified and corrective actions shall be taken in a timely manner. The operating organization shall evaluate the results of such audits and shall determine and implement the necessary actions for continuous improvement.

Requirement 5: Safety assessment and periodic safety review

The adequacy of the design of the nuclear fuel cycle facility shall be verified by means of comprehensive safety assessment that results in a safety analysis report and that defines the operational limits and conditions required for safety. The safety of the facility or activity for all facility states shall be assessed in the safety analysis and shall be independently reviewed. The operating organization shall conduct systematic safety assessments of the facility, in accordance with regulatory requirements, throughout the lifetime of the facility. On the basis of the results of such periodic safety reviews, the operating organization shall implement any necessary corrective actions and shall consider the need for modifications to enhance safety.

Requirement 5: Safety assessment and periodic safety review

4.24.

Requirements for safety assessment for facilities and activities are established in IAEA Safety Standards Series No. GSR Part 4 (Rev. 1), Safety Assessment for Facilities and Activities [13]. The adequacy of the design of the nuclear fuel cycle facility, including design tools and design inputs and outputs, shall be verified, validated and approved using a systematic safety assessment process. The safety assessment process shall be undertaken by individuals or groups independent from those who originally carried out the design work. Verification, validation and approval of the facility design shall be completed as early as is practicable in the design and construction processes, and in any case before commissioning of the facility is commenced. The verification that takes place before validation under active conditions shall be sufficiently rigorous to support decisions of safety significance.

Requirement 5: Safety assessment and periodic safety review

4.25.

Safety assessment shall be part of the design process, with iterations made between the design activities and the confirmatory analytical activities and with increasing scope and level of detail of the safety assessment as the design progresses. The basis for the safety assessment in the design stage shall be the information derived from the safety analysis (see Section 6) as well as information from other sources such as research and operating experience at other facilities. If non-permanent equipment is important for safety, it shall be included in the analysis.

Requirement 5: Safety assessment and periodic safety review

4.26.

In accordance with national regulatory requirements, the operating organization shall carry out systematic periodic safety reviews of the nuclear fuel cycle facility throughout its lifetime, with account taken of ageing, modifications, human and organizational factors, operating experience, technical developments, new information on site evaluation and other information relating to safety from other sources. The operating organization shall verify by analysis, surveillance, testing and inspection that the physical state of the facility, including any modifications, is as described in the safety analysis report and other safety documents and that the facility was commissioned and is operated in accordance with the safety analysis and operational limits and conditions.

Requirement 5: Safety assessment and periodic safety review

4.27.

The periodic safety review shall confirm that the safety analysis report and other documents (such as the operational limits and conditions and documentation on maintenance and training) remain valid in view of current regulatory requirements, or shall indicate where improvements may be necessary. In such reviews, changes in the site characteristics, changes in the utilization programme (particularly for research and development facilities), the cumulative effects of ageing and modifications, changes to procedures, feedback from operating experience and technical developments shall be considered. It shall also be verified that items and software important to safety comply with the design requirements.

Requirement 5: Safety assessment and periodic safety review

4.28.

The findings of safety assessments and periodic safety reviews shall be considered by the safety committee (see Requirement 6). The operating organization shall report to the regulatory body as required, in a timely manner, the confirmed findings of the periodic safety review that have implications for safety. Any modifications that arise from these findings shall be implemented in a timely manner, in accordance with the safety categorization of the modification.