DOE-STD-1134-99, Review Guide for Criticality Safety Evaluations

NOT MEASUREMENT SENSITIVE DOE-STD-1134-99 September 1999 DOE STANDARD REVIEW GUIDE FOR CRITICALITY SAFETY EVALUATIONS U.S. Department of Energy AREA SAFT Washington, D.C. 20585 DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. TS This document has been reproduced from the best available copy. Available to DOE and DOE contractors from ES&H Technical Information Services, U.S. Department of Energy, (800) 473-4375, fax: (301) 903-9823. Available to the public from the U.S. Department of Commerce, Technology Administration, National Technical Information Service, Springfield, VA 22161; (703) 605-6000. DOE-STD-1134-99 iii FOREWORD This Department of Energy Standard is approved for use by all DOE criticality safety personnel. It contains guidelines that should be followed when reviewing Criticality Safety Evaluations that were developed by DOE Contractors to demonstrate the safety of fissile material handling at DOE Non-Reactor Nuclear Facilities. Adherence to these guidelines will enhance consistency and uniformity of reviews of Criticality Safety Evaluations across the DOE complex and compliance with either DOE Order 5480.24 or DOE Order 420.1 requirements. A working group with the following participants prepared this DOE Standard: PARTICIPANTS AFFLIATION Dr. Jerry McKamy DOE-EH Roger Dintaman DOE-DP Dennis Cabrilla DOE-EM Ivon Fergus DOE-NS Ted Wyka DOE-S3.1 Adolf Garcia DOE-ID Calvin Hopper ORNL Jim Mincey ORNL Mike Westfall ORNL Tom Reilly WSRC Tom McLaughlin LANL Richard Anderson LANL Robert Wilson SSOC Jim Morman ANL James Felty SAIC John Evans S-3.1/Vista George Bidinger Consultant Gypsy Tweed Consultant Beneficial comments (recommendations, additions, and deletions) which may be of use in improving this document should be addressed to: Dr. Jerry McKamy DOE EH-34 jerry.mckamy@eh.doe.gov Phone: 301-903-8031 DOE-STD-1134-99 iv This page intentionally left blank. DOE-STD-1134-99 v Table of Contents FOREWORD.............................................................................................................................iii ACRONYMS ............................................................................................................................vii I. OVERVIEW............................................................................................................................1 II. GUIDANCE KEYED TO SECTIONS IN DOE-STD-3007-93..............................................2 1.0 Introduction ......................................................................................................................2 2.0 Description .......................................................................................................................2 Key Review Issues ...............................................................................................................3 3.0 Requirements....................................................................................................................3 Key Review Issues ...............................................................................................................4 4.0 Methodology.....................................................................................................................4 Key Review Issues (As Applicable)......................................................................................5 5.0 Discussion of Contingencies .............................................................................................5

Helpful Rules of Thumb .......................................................................................................7 Key Review Issues ...............................................................................................................8 6.0 Evaluation & Results ........................................................................................................8 Key Review Issues ...............................................................................................................9 7.0 Design Features (Passive & Active) And Administratively Controlled Limits & Requirements.........................................................................................................................10 Key Review Issues .............................................................................................................10 8.0 Summary & Conclusions ................................................................................................10 Key Review Issues .............................................................................................................10 9.0 References ......................................................................................................................10 Key Review Issues .............................................................................................................11 10.0 APPENDICES..............................................................................................................11 Key Review Issues .............................................................................................................11 III. REFERENCES ..................................................................................................................13 DOE-STD-1134-99 vi This page intentionally left blank. DOE-STD-1134-99 iv Acronyms ANSI/ANS American National Standards Institute/American Nuclear Society CSA Criticality Safety Authorization CSE Criticality Safety Evaluation DOE Department of Energy HRA Human Reliability Analysis KENO Monte Carlo Code MCNP Monte Carlo Code NCS Nuclear Criticality Safety PD Process Description PRA Probabilistic Risk Assessment SME Subject Matter Expert DOE-STD-1134-99 viii This page intentionally left blank. DOE-STD-1134-99 1 I. OVERVIEW As in all safety disciplines, this Standard can only be constructively put to use by experienced criticality safety professionals utilizing their professional judgment and expertise. The purpose of this document is to provide a set of guidelines, not checklists, for use by DOE criticality safety personnel when reviewing criticality safety evaluations produced by the contractor. This review guide is intended to provide a consistent framework for assuring that acceptable evaluations are produced by DOE contractors. This Standard is focused first, on assessing criticality safety; and second, on literal DOE Order/Rule compliance. It does not deal with issues of routine document quality assurance that any technical writer should impose upon the product. The Standard contains complementary material to DOE-STD-3007-93 and associated change notice dated September 1998. While the Standard is keyed to sections in DOE-STD-3007-93, it is not necessary that the contractor use this format for documenting criticality safety evaluations. This formalism is used for convenience and to provide a common frame of reference only. The reviewer should concern himself only with the technical content of the criticality safety evaluation, not the format in which it is documented.

From a safety perspective, a graded approach is recommended when reviewing criticality safety evaluations (CSEs). The most important decision to make prior to reviewing an evaluation of a fissile material operation is whether or not criticality is credible for the system or process being analyzed. If, in the judgment of the reviewer, criticality may be credible, but unlikely, then the reviewer should make sure the arguments presented in the evaluation are supported by identified, experienced engineering and operational individuals’ judgement. However, the conclusion that criticality is incredible or unlikely in aging facilities is made much more difficult by such things as lack of accurate facility drawings, incomplete knowledge of holdup, residue and waste quantities, and lack of experienced operators utilizing administrative controls. Extreme care should be exercised in concluding that criticality is incredible. Such a conclusion should be made only after careful consideration of the adequacy of the existing facility characterization and the impact of historical operations on potential abnormal event scenarios. The reviewer should assure that the derivation of the conclusion of incredibility of criticality is fully documented. However, in the preponderance of fissile operations, criticality is both possible and credible. This Standard is primarily for use with CSEs covering these kinds of operations. While a comprehensive and thorough review is necessary, some review criteria are flexible (i.e., graded approach) and these will be pointed out in the Standard. DOE-STD-1134-99 2 II. GUIDANCE KEYED TO SECTIONS IN DOE-STD-3007-93 1.0 Introduction This introductory material is very general in nature and not of technical consequence. It should contain enough information to let the reviewer know why the evaluation was performed. The introduction should also contain a statement of what is being evaluated. This section has no safety significance and no technical comments should ensue from a review. 2.0 Description This section must contain sufficient descriptive technical detail to understand and reconstruct the system being analyzed. The description of the operation should include drawings or sketches sufficient to allow the reviewer to make a determination that the model and analysis assumptions apply to the system described herein. If the system is complex, drawings and documents may be included by reference (e.g., an approved, field verified, process description). The key question for the reviewer to ask is, "From reading this section can I get a good picture of what's being evaluated?" If the answer is no, then deficiencies exist. The deficiencies must be resolved. As a rule of thumb, personnel familiar with the system under analysis should perform technical reviews of CSEs. At a minimum, the reviewer should possess enough knowledge of the system/process being analyzed to independently judge the accuracy of the process description (PD) insofar as it impacts the safety conclusions contained in the CSE. If the reviewer is not familiar with the system, facility walk-downs and discussions with the SME should be performed prior to completing the review. In the absence of system knowledge, all a reviewer can state is that the evaluator did indeed analyze what was purported to be analyzed (i.e., the CSE is internally consistent).

Discrepancies in the system description are likely to be in the area of disagreements with the model assumptions and the "as built, as found" condition in the facility. These will only be discovered by facility walk-downs. Before walk-downs are initiated, a determination of the sensitivity of the reactivity of the system to changes in parameters should be made. The determination should be made by whatever means deemed prudent by the reviewer. In most cases, this determination will be the technical judgment of the reviewer based on his experience and knowledge. For example, if the model shows worst case full flooding of a glovebox remains subcritical, the safety of the system does not depend on the presence or absence of a criticality drain. On the other hand, if analysis shows greater than 2" of solution on the floor of the glovebox goes critical, then the presence of a functioning criticality drain is essential. Both the requirement of the drain and for regular inspection of the drain should be clearly identified in the evaluation and a walkdown performed to verify this attribute. Another example is annular solution storage tanks. The thickness of the annulus must be nominally the same as that assumed by the evaluation. However, the height of the tank does not significantly affect the reactivity of DOE-STD-1134-99 3 the system. Discrepancies in the annular thickness are potentially safety significant and must be corrected whereas discrepancies in the height are immaterial and no further action is required. Therefore, if a given system parameter can be extended to infinity or an infinite system and criticality is not achieved, discrepancies in the model or report related to this parameter are not safety significant. One area where an overly detailed model can impact the analysis and operation adversely is in the area of "infraction traps." If the description section is extremely detailed then there is a good chance the associated limits and controls will be similarly prescriptive. Such unnecessary “requirements” can overwhelm operations with trivial demands, damage the credibility of the criticality safety program, and mask more serious noncompliance issues. The reviewer should be aware of the potential to "over describe" the system and define controls which have no bearing on the criticality safety of the operation. Consider the annular tank example again. Assume the description section specifies the annular dimension as 1.500 +/- 0.125 inches. Then the associated limit follows suit. Note that if the actual annular dimension is found to be either 1.3 inches or 1.7 inches, a criticality safety infraction ensues. For an isolated annular tank, the tank will remain subcritical with an annular thickness up to just over 3 inches (assuming uranyl nitrate solution concentrations not exceeding 400 g/l). There is no need to specify a minimum annular tank thickness unless it is an Engineering Safety Requirement in Section 7. Hence, operations will be unduly impacted by a criticality infraction that has no bearing on safety (i.e., "infraction trap"). The reviewer should ensure that the descriptions of the system and associated models are detailed enough to ensure that potential criticality scenarios are analyzed appropriately without unnecessary specification. For example, if the tank deformation must be bounded, design pressure and available pressure sources for the tank system must be discussed. Key Review Issues

• If not familiar with the fissile system/operation, conduct a walkdown of the facility. • Identify those items and parameters with safety significance. • Ensure there is enough detail to understand what was analyzed. • Compare the system description to calculational models (internal consistency) and to the "as found" facility (external consistency). • Identify safety significant discrepancies. • Look for unnecessary specification of the system and "infraction traps." • Look for equipment used in the operation that has criticality safety significance. 3.0 Requirements Any special requirements that impact the methodology of the analysis or drive special documentation are specified in this section. References to predecessor criticality safety evaluations relied upon to provide detailed documentation of the safety basis may be included. There is no need to state requirements of "routine" orders (e.g., 5480.24) and standards (e.g., ANSI/ANS) either explicitly or by reference. DOE-STD-1134-99 4 Key Review Issues • Ensure any referenced material in this section is available and valid. 4.0 Methodology This section of the evaluation describes how the subcritical limits and controls for the process or operation were obtained or derived. This section should contain a brief summary of the method(s) relied upon to develop the subcritical limits on the process. The preferred method, as stated in ANSI/ANS-8.1, is by reference to experiments or "accepted" published subcritical limits. The alternative is to perform hand calculations or, more probably, computer calculations. Detailed documentation of the verification and validation of computer codes need not be included in this section. A reference to an existing validation document is sufficient. The calculations themselves may reside in referenced documents so long as the documentation trail is recorded. Review of this section is very straightforward if single parameter subcritical limits are used from ANSI/ANS-8.1. These will invariably be conservative and only the value from the standard need be quoted and a brief (i.e., a sentence or two) reason for why the limit is applicable. If other handbook data is cited, the reviewer needs to be aware of some potential pitfalls. In general, subcritical limits may be taken from ARH-600, LA-10860, TID-7016, etc. The data in ARH-600 are from calculations that did not have extensive peer review but are nevertheless very helpful in understanding sensitivity of controlled parameters. Although some caution is prudent, the reference is nevertheless helpful. The data in LA-10860 and TID-7016 are mostly taken from critical experiments, however, calculational results appear in spots. The intent is to establish subcritical limits using critical data by applying an appropriate safety margin. A typical rule of thumb is that the maximum subcritical value will not exceed 90% of the critical value after a contingency occurs. Note that the minimum subcritical value does not correspond to a keff of 0.95, or any other particular value of keff. In practice, values taken from these industry accepted-handbooks, with appropriate allowances for uncertainty, are roughly equivalent, with regards to establishing safety margins, to the single parameter limits contained in ANSI/ANS- 8.1.

The trickiest analysis to review is one based on hand calculations. This is so because of the many assumptions implicit in the method. Hand calculations are, in general, extrapolations from known critical data to a specific application. The reviewer should be very familiar with the hand-calculation method being used. The reviewer should be alert for mis-application and incorrect mathematics. This section should include a reference to the publication or technical data on which the hand calculation is based. If done properly within the area of applicability for the method, hand calculations will yield conservative results. The reviewer should spot-check the mathematics and review the reference against the model to assure compatibility. DOE-STD-1134-99 5 The final method to consider is computer code reactivity calculations. Typically these will involve KENO and/or MCNP. The code and cross section set (e.g., Hansen-Roach 16 Group, ENDFB-v, etc.) used should be stated. Key Review Issues (As Applicable) • Clear statement of method used to derive subcritical values. • Referenced handbook or ANSI/ANS standard data. • Description any hand-calculations relied upon. • Listing of code and cross-section set utilized. • Referenced code validation calculations. 5.0 Discussion of Contingencies This is perhaps the most important section of the entire evaluation. This discussion of contingencies should provide a stand-alone summary of double-contingency regardless of the underlying references. As stated in Appendix A of ANSI/ANS-8.1: The few criticality accidents that have occurred in industrial operations have resulted from failure to anticipate conditions that might arise; none has resulted from a faulty calculation of keff. Appendix A of ANSI/ANS-8.1 contains a list of typical scenarios to consider when reviewing the contingency analysis for a particular evaluation. The reviewer must be familiar with the operation being evaluated to perform an adequate review. Without such knowledge, no decision can be made relative to whether postulated abnormal events are "anticipated", "unlikely", or "incredible," or if any credible contingencies have been omitted. Each contingency that could lead to criticality should be shown to be unlikely, independent and non-concurrent with other contingencies that could lead to criticality. If this can not be done, then the contingency under evaluation becomes part of the normal operating conditions, i.e., an anticipated event. Two simplifications are possible here. Criticality scenarios that are deemed "incredible" and those that are not physically possible need no contingency analysis. The reviewer’s task in each of these two cases is to decide whether the arguments against criticality occurring are sound. The reviewer should take care to note the definition of "contingency" and "credible" in DOE-STD- 3007-93. If a quantitative probabilistic risk assessment is utilized in the CSE despite the qualitative definition of “credible”, the reviewer should rigorously scrutinize any calculations and assumptions leading to extremely small probabilities. In the more likely situation, the experienced, professional judgement of engineering and operational personnel will be the basis for this argument. The bases for these judgements should be carefully documented in the NCS Evaluation. The reviewer’s task is to verify that the bases (assumptions and conditions) for the experts’ judgement are reflected, as appropriate, in the NCS limits and requirements for NCS controls.

DOE-STD-1134-99 6 In other cases, where criticality is possible, the reviewer's task is to assure that no credible single failure can result in the potential for a criticality accident. To accomplish this, all credible failure modes known to the reviewer that are applicable to the process should be bounded by the analysis or adequate barriers to its occurrence must be in place. The reviewer should ask, “How bad can the situation credibly get? If it gets that bad, will it remain subcritical?” and ensure that the documented contingency analysis considers the scenario. This contingency discussion must contain a clear description of the process upsets (i.e., contingencies) considered by the NCS analyst. The contingencies should be specific enough to provide a definitive boundary to the process upset. For example, rather than stating a mass contingency as “overbatch”, state “double batching” if this has been determined to be the maximum credible overbatch. The former means any overbatch no matter how small would have to be an “unlikely” event. The latter concludes that while a small overbatch would be an “anticipated” event, double-batching would be an “unlikely” event. The reviewer need not document all conceivable abnormal pathways or scenarios, only those deemed reasonable and credible. The second role of the reviewer is to assure that controls (administrative and physical) are adequate, properly justified and implemented appropriately. The reviewer must be satisfied that the controls make the identified contingency an “unlikely” event. The controls must be implementable by operations and there must be an implementing mechanism in place (i.e., procedures, configuration control, postings, etc.). There are several pitfalls to be avoided as a reviewer. First, the reviewer should not be concerned about quantitative human failure probabilities. Failure rates for human failures exist. For example, see Alain Swain’s handbook. Quantitative equipment failure frequencies are generally subjective and based on professional judgment because there is no compilation of failure rates for the types of processes most commonly occurring within DOE facilities. However, if equipment failure data exists then it should be considered. The reviewer should simply convince himself that, in his professional judgment, "unlikely events" are unlikely and "incredible events" are incredible. Second, the format used to document the contingency analysis is irrelevant - any kind will do as long as it is understandable. Text, charts, fault trees, event trees and tables are all acceptable formats. Typically, the contingency analysis is comprised of a simple spreadsheet showing the contingencies, controls, and summary of the subcriticality evaluations. Third, just because a reviewer conceives a mechanistic scenario that is a variation on those documented does not necessarily mean the evaluation is incomplete or inadequate. If the barriers imposed on the operation cover the hypothesized variation, then the analysis should be deemed adequate. The reviewer must decide when the variation becomes a distinct scenario that was not adequately considered or, if missing, is indicative of an incomplete analysis. The reviewer should use discretion when drawing the conclusion that the analysis may be incomplete in other areas because a specific, bounded and controlled scenario is not explicitly documented. The reviewer should document his conclusions and file them with the controlled copy of the evaluation.

DOE-STD-1134-99 7 Helpful Rules of Thumb When the analysis depends upon multiple controls on a single parameter, the reviewer should assure himself that the controls are independent (i.e., no common mode failures) and that the failure of each control is an unlikely event. When the safety evaluation credits the results of sampling of solutions, one needs to consider the findings of NSTR 016-97, “Review of the Criticality Safety of Bottle Storage and Handling,” which evaluated the failure mode of the sampling system. It is important that analyzed contingencies not credit the same sample result. Certain controls are more vulnerable to operational error, and must be explained if they are used. The reviewer should consider the control in the context of the proposed work to verify that the control is an effective barrier to an unlikely event. Examples of controls that deserve extra scrutiny include: Examples of control failure or events that will, in general, qualify as unlikely events (i.e. contingencies) by themselves include: In general, failure of a single administrative control by itself does not constitute a contingency. However, if two independent administrative controls must fail concurrently before criticality becomes possible, then the combination of the two would probably constitute a valid contingency (e.g., a signoff that valves are aligned properly followed by an independent check and signoff at a different time by a different person, provided that the second person is at least as qualified as the first person). • Failure to properly signoff a procedure or checklist • Failure to properly second check a procedure or checklist • Failure of administrative spacing • Failure of administrative mass controls leading to a minor overbatch • Failure to administratively maintain a planar array of containers • Failure to administratively control the number of items • Failure to administratively control the number of containers • Failure to administratively control volumes of containers • Fires (which lead to sprinkler activation) • Earthquakes and seismic events • Floods including room and glovebox floods • Failure of criticality drains DOE-STD-1134-99 8 All anticipated or unlikely abnormal events (i.e., contingencies) must result in a subcritical system. The evaluation must contain a summary statement concluding that the system will remain subcritical after the unlikely event occurs. This typically takes the form of a “margin of safety” statement. EXAMPLE MARGIN OF SAFETY STATEMENT “If the system is double batched it will remain subcritical as shown by Monte-Carlo calculations. A quadruple batch with full water reflection is required before criticality can be achieved.” Key Review Issues • Reasonable, credible failures are bounded and/or controlled. • Contingencies are unlikely, independent events. • Abnormal, unlikely events considered are documented clearly and specifically. • Statements of subcriticality or safety margin for the contingent events are provided. • Abnormal conditions listed in any available process description are dispositioned appropriately. 6.0 Evaluation & Results The calculational results, if applicable, are summarized in section. The "normal" and "credible abnormal" cases should be documented in this section and the associated calculations must demonstrate that these are subcritical. The calculations may be incorporated explicitly and completely, as in a completely new evaluation, or by reference to existing evaluations (e.g., CSAs). The discussion in this section should clearly define the connection between the calculational models and the process descriptions, as applicable.

In the case of a new CSE, the reviewer should compare the models described here to the description of the system contained in Section 2 to ensure they are the same. Geometries and dimensions should be spot checked for accuracy and consistency. It is good practice to perform a "sanity check" on the reported results by comparing to accepted industry (i.e., handbook) data or by performing appropriate hand calculations. The reviewer should have a good idea of what configurations are critical and which ones are clearly subcritical. A quick review of applicable handbook data and/or hand calculations will serve to independently confirm the results of this section. If any calculation does not seem consistent with this "sanity check" or analysis from previous work, further investigation of the calculational models is warranted. Another good "sanity check" is to look at fission densities. In a large array of fissile material, incorrect neutron start types can be used. The easiest way to check this is to look for similar fissile items in an array and assure that the fission densities are similar when reflector and edge effects are taken into consideration. If similar units have dissimilar fission densities, something is wrong and the results should be questioned. DOE-STD-1134-99 9 If parameter studies are performed and the keff results are plotted, the curves should be smooth and continuous. Discontinuities, outside of statistics, are generally, but not always, a signal of a mistake in the model. Such discontinuities should be understood and explained before taking them as indicators of errors. The reviewer should be aware that apparently minor changes in calculational models could have significant effects on the reactivity of the system. It is common for an analyst to gloss over minor changes or variations when reporting results and still report large differences in keff. The reviewer should seek to understand the underlying model changes that caused the reactivity changes. Typical model variations to watch for in Monte-Carlo calculations include: Boundary conditions (specular, albedo, vacuum, etc.); Reflector type (types of concrete, water, polyethylene, etc.); Reflector thickness; Presence or absence of moderators; Moderation type; Minor spacing variations; Number of neutron histories; Neutron start distribution; Reversed geometry; Density variations; and Mistakes in material compositions and locations. These kinds of potential variations are particularly important to watch for when the CSE references previous work. The CSE should clearly document why calculational results from previous CSEs apply to the system currently being analyzed and why the variations, if any, exist in the reactivity results for very similar models. The previous CSE should be summarized so that the reviewer knows what was determined in the previous study and how it applies. There is no need to produce a complete copy of the prior analysis results. The reviewer should perform spot checks of the "worst case abnormal" models to see if they match those described in Section 5.0. A common practice in Monte Carlo is to slightly change the models for the "worst case" situations (i.e., to reduce or eliminate conservative assumptions) to "tweak" the reactivity result under some arbitrary cutoff. The reviewer should be aware of this tactic and assure himself that it is inconsequential if it occurs. Key Review Issues

• Calculational results for normal and abnormal scenarios are present and summarized. • Variations in keff from calculation to calculation are explained adequately in terms of model changes corresponding to process variations. • A "sanity check" using handbooks, previous analyses and/or hand calculations is consistent with reported results. • Results applied from previous CSEs are adequately justified. • No unexplained discontinuities are present in parameter studies. • Look for geometry plot to check the model configuration. DOE-STD-1134-99 10 7.0 Design Features (Passive & Active) And Administratively Controlled Limits & Requirements The controls and constraints placed on the operation are described in this section. The reviewer should ensure that the controls correspond to those listed in Section 5.0. The most typical mistake made here is that controls are inadvertently dropped or ad-hoc controls are added. The key here is the implementation of the controls. Potential common mode failure evaluations from Section 2.0 must be addressed herein. A mechanism must be in place within the Contractor infrastructure to implement and assess the adequacy of the controls. The control limits should be measurable and auditable. Appropriate links to the configuration control system (including maintenance and procurement of replacement parts) should be in place to ensure that physical design features are not altered unintentionally. To the degree practicable, physical design features should be used in place of administrative controls. Finally, watch for "infraction traps" alluded to in Section 2.0. Only those controls needed for criticality safety as documented by the contingency analysis should be imposed. Key Review Issues • All controls and design features are consistent with contingency analysis. • Physical controls are used where applicable. • Implementation mechanisms are in place and adequate for all controls. • Ties exist to a configuration control program. • Infraction traps are avoided. 8.0 Summary & Conclusions This section should summarize the conclusion of the CSE that the system is subcritical, as well as "double contingent." Some discussion of the safety margin during normal and credible abnormal conditions is appropriate here, too. Key Review Issues • A positive statement of double contingency or discussion of accepted risk for single contingent operations. 9.0 References All references should be included in this section. Of particular interest are handbooks, previous analyses, technical reports, and controlled drawings. However, to the extent possible, the CSE should be self-contained. At a minimum the reviewer should be able to identify all documents used as input to the CSE. DOE-STD-1134-99 11 Key Review Issues None. 10.0 APPENDICES Appendices should contain walkdown sheets, detailed calculations, listings of computer code input, internal memos containing information pertinent to the CSE, material descriptions, documentation of QA reviews, and any other information the NCS analyst deems appropriate. These serve as background information for the reviewer. One special area of interest would be any internal QA reviews done previously. These sometimes reveal dispositions of potential technical deficiencies that still exist in the document. Appendices can also shed light on whether or not internal procedures have been followed because certain QA checks (e.g., field walkdowns, HRA & PRA reviews, etc.) might be included here.

Key Review Issues • Ensure input decks and other attached documents match results reported in evaluation. DOE-STD-1134-99 12 This page intentionally left blank. DOE-STD-1134-99 13 III. REFERENCES 1. J. T. Thomas, ed., Nuclear Safety Guide, TID-7016, Rev. 2 NUREG/CR-0095 (ORNL/NUREG/CSD-6), June 1978. 2. H. C. Paxton and N.L. Pruvost, Critical Dimensions of Systems Containing 235U, 239Pu, 233U, 1986 Revision, LA-10860-MS, July 1987. 3. R. D. Carter, G. R. Kiel, and K. R. Ridgway, Criticality Handbook, Atlantic Richfield Company, ARH-600, Vol. I to III, 1969/71. 4. DOE-STD-3007-93 (Change Notice No. 1., September 1998), Guidelines for Preparing Criticality Safety Evaluations at Department of Energy Non-Reactor Nuclear Facilities, September 1998. 5. NSTR-016-97, Review of the Criticality Safety of Bottle Storage and Handling, 6. ANSI/ANS-8.1-1998, Nuclear Criticality Safety in Operations with Fissionable Material Outside Reactors, September 1998. 7. A. D. Swain and H. E. Guttman, Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications, NUREG/CR-1278, August 1983. DOE-STD-1134-99 14 This page intentionally left blank. DOE-STD-1134-99 CONCLUDING MATERIAL Review Activity: Preparing Activity: EH-34 Project Number: SAFT-0071 DOE Field Offices EH-32 AL DP-20 ID EH-22 ORO EH-31 RL EH-34 DP-13 EM-65 National Laboratories ANL LLNL PNNL ORNL Others Bechtel-Jacobs B&W Hanford Consultants DNFSB Staff FDH FDNW Georgia Tech University LMITCO Hanford NISYS Corp. SAIC Richland WSRC Cover