DOE-STD-3007-2007, Guidelines for Preparing Criticality Safety Evaluations at Department of Energy Nonreactor Nuclear Facilities

TS DOE-STD-3007-2007 February 2007 DOE STANDARD GUIDELINES FOR PREPARING CRITICALITY SAFETY EVALUATIONS AT DEPARTMENT OF ENERGY NONREACTOR NUCLEAR FACILITIES U.S. Department of Energy AREA SAFT Washington, D.C. 20585 DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. NOT MEASUREMENT SENSITIVE This document has been reproduced from the best available copy. Available to DOE and DOE contractors from the Office of Scientific and Technical Information, P.O. Box 62, Oak Ridge, TN 37831; (423) 576-8401. Available to the public from the U.S. Department of Commerce, Technology Administration, National Technical Information Service, Springfield, VA 22161; (703) 605-6000. Order No. DE98003918 DOE-STD-3007-2007 iii FOREWORD The determination of limits and controls for the safe handling, processing, and storage of fissionable materials is an essential element of a Department of Energy Nuclear Criticality Safety Program. The Criticality Safety Evaluation is the documentation of the thought process and the activities to determine these controls. ANSI/ANS-8.1-1998, Section 4.1.2 requires that “Before a new operation with fissionable material is begun, or before an existing operation is changed, it shall be determined that the entire process will be subcritical under both normal and credible abnormal conditions.” This standard provides a framework for generating Criticality Safety Evaluations that are compliant with the ANSI/ANS-8 series of criticality safety standards. Many Nuclear Criticality Safety professionals and groups have made significant contributions in this major revision of Standard 3007. A select writing team of technical experts was primarily responsible for this revision. They worked with various groups of criticality safety and nuclear safety professionals to bring this standard to fruition. The Department of Energy’s Criticality Safety Support Group, Criticality Safety Coordinating Team, and End Users Group have all participated and contributed. In addition, the Energy Facility Contractor Group’s Safety Analysis Working Group provided review and comments during the preparation phase. The writing team was comprised of: Dr. Jerry McKamy, National Nuclear Security Administration, NA-171, Writing Team Leader and Principle Author Kevin Reynolds, BWXT Y-12, Principle Author Dr. Bob Wilson, DOE Environmental Management Adolf Garcia, DOE Nuclear Energy Idaho Operations Office Randy Janke, National Nuclear Security Administration, Los Alamos Operations Office Kevin Carroll, BWXT Y-12 Dr. Dick Englehart, DOE Office of Health, Safety and Security Dr. Jim Morman, Argonne National Laboratory Calvin Hopper, Oak Ridge National Laboratory DOE-STD-3007-2007 iv TABLE OF CONTENTS SECTION PAGE Definitions and Acronyms ............................................................................................................... v I. Overview............................................................................................................................. 1 II. Content Guidance for Criticality Safety Evaluations.......................................................... 3 A. Introduction................................................................................................................... 3 B. Description .................................................................................................................... 3

C. Unique or Special Requirements................................................................................... 4 D. Methodology and Validation ........................................................................................ 4 E. Process Analysis............................................................................................................ 5 F. Evaluation and Results .................................................................................................. 8 G. Credited Controls and Assumptions ............................................................................. 9 H. Summary and Conclusions............................................................................................ 9 I. References ................................................................................................................... 10 III. Guidance for Special Case Criticality Safety Evaluations................................................ 11 A. Need for Criticality Accident Alarm Systems ............................................................ 11 B. Operations with Shielding and Confinement .............................................................. 12 IV. Linkage to the Documented Safety Analysis.................................................................... 14 A. Classification of Hazard Controls and Technical Safety Requirements ..................... 16 B. Need for Consideration of Beyond Design Basis Accidents....................................... 17 V. Implementation and Surveillance Requirements .............................................................. 19 A. Implementation ........................................................................................................... 19 B. Surveillance Requirements.......................................................................................... 19 Endnotes ..................................................................................................................................... 20 References ..................................................................................................................................... 21 DOE-STD-3007-2007 v DEFINITIONS AND ACROYNMS DEFINITIONS CONTINGENCY – an unlikely change in a process condition important to the Nuclear Criticality Safety of a fissionable material operation. CONTROL – an engineered feature (active or passive) or administrative requirement that establishes constraints on the range of values that process parameters can assume with a given reliability (i.e., failure frequency) thereby providing a barrier to a criticality accident. CREDIBLE – the attribute of being believable on the basis of commonly acceptable engineering judgment. Due to the general lack of statistically reliable data, assigning numerical probabilities to events is not usually justifiable and when used should be backed up with references. CRITICALITY SAFETY EVALUATION – the analysis and documentation that the fissile material process covered by the scope of the evaluation will be subcritical under both normal and credible abnormal conditions. The title “criticality safety evaluation” is generic and refers to any document intended to meet the requirements of ANSI/ANS-8.19-2005, Section 8. Some site-specific synonyms include, but are not limited to, criticality safety report, criticality safety analysis, and double contingency analysis.

CRITICALITY SAFETY PROGRAM – the Criticality Safety Program required by DOE Order 420.1B. DOUBLE-CONTINGENCY PRINCIPLE – ANSI/ANS-8.1-1998, Section 4.2.2 defines the Double- Contingency Principle as “Process designs should incorporate sufficient factors of safety to require at least two unlikely, independent, and concurrent changes in process conditions before a criticality accident is possible.” PROCESS CONDITION – the state of an operation or system involving fissionable material, typically defined by specifying values or ranges of process parameters. DOE-STD-3007-2007 vi PROCESS PARAMETER – a physical property whose value affects the nuclear reactivity of a system. Parameters include the mass, density, concentration, and isotopic enrichment of fissionable material; the geometry, reflection, and interaction conditions of the system; and the moderation, composition and neutron absorption characteristics of the fissionable material mixture and other system materials. UNLIKELY – the attribute of being improbable on the basis of commonly acceptable engineering judgment. An unlikely event is an event that is not expected to occur more than once in the lifetime of a facility. Due to the general lack of statistically reliable data, assigning numerical probabilities to events is not usually justifiable and when used should be backed up with references. ACRONYMS CAAS Criticality Accident Alarm System CCR Criticality Control Review CSE Criticality Safety Evaluation CSP Criticality Safety Program DOE Department of Energy DSA Documented Safety Analysis NCS Nuclear Criticality Safety NCSP Nuclear Criticality Safety Program SSC Structures, Systems or Components TSR Technical Safety Requirement USQ Unreviewed Safety Question DOE-STD-3007-2007 1 I. OVERVIEW This standard provides a framework for generating Criticality Safety Evaluations (CSE) supporting fissionable material operations at Department of Energy (DOE) nonreactor nuclear facilities. This standard imposes no new criticality safety analysis requirements. Revision to the standard was undertaken for two primary reasons. First, it provides DOE expectations for the technical content and analysis practices for CSEs to ensure compliance with the required ANSI/ANS- 8 Standards. Second, it provides the linkage between the CSE process and the Documented Safety Analysis (DSA) process required by 10 CFR 830 Subpart B. Adherence to this standard ensures that requirements for CSEs in the ANSI/ANS-8 Standards and DOE Order 420.1B are met. This standard becomes effective immediately after issuance by DOE and should be implemented as soon as possible according to established DOE protocols for promulgating changes to orders and contracts. Rewriting existing CSEs solely to comply with these guidelines is not required. The same language is used as the ANSI/ANS-8 Standards for differentiating between required (shall), recommended (should), and acceptable practices (may). To conform to this standard, criticality evaluation practices shall be performed in accordance with its requirements but not necessarily with its recommendations. Guidance for the majority of CSEs supporting production, operations, storage, and deactivation and decommissioning activities at DOE facilities is included in Section II. Section II provides guidance to ensure that the analysis supports development of criticality limits and controls to ensure that fissionable

material operations remain subcritical under all normal and credible abnormal conditions. Guidance for some special CSEs and analyses are included in Section III. These evaluations may document and analyze existing conditions and controls or they may develop new controls and limits for special circumstances such as shipping containers, justification for installation or removal of Criticality Accident Alarm Systems, or for operations with shielding and confinement. Section IV of this standard provides specific guidance on the linkage between CSEs and the DSA. DOE’s Nuclear Safety Management Rule, 10 CFR 830 Subpart B, requires the preparation of safety bases, including DSAs and Technical Safety Requirements (TSR), for Hazard Category 1, 2, and 3 DOE-STD-3007-2007 2 nuclear facilities. Chapter 3 of a DSA includes identification and analyses of hazards and hazard controls to provide adequate protection to the public, workers, and the environment. CSEs provide detailed information that should be reviewed when constructing DSA hazard analysis scenarios. However, while such scenario entries in the hazard analysis may summarize CSE information, they are expected to be a “stand-alone” product that does not incorporate CSEs into the DSA. Section V contains provisions for the implementation of this standard and for surveillances that ensure that CSEs are reviewed periodically. There is no requirement to reissue or revise existing CSEs that are fully compliant with the applicable ANSI/ANS-8 Standards solely to meet the expectations of this revision of Standard 3007. Finally, the DOE Nuclear Criticality Safety Program (NCSP) developed a tutorial as a training aid for developing CSEs. It may be found by going to the NCSP website at: http://ncsp.llnl.gov/ The NCS Engineer Training module on CSEs is consistent with the guidance in this standard. It includes an example CSE that may be useful to the reader of this standard. DOE-STD-3007-2007 3 *See Endnotes II. CONTENT GUIDANCE FOR CRITICALITY SAFETY EVALUATIONS The CSE shall1* establish the fact that any proposed fissionable material system or process will remain subcritical under normal and credible abnormal conditions. This shall2 be done by considering the amounts and types of fissionable material used in the system or process, establishing controlled parameters that affect criticality safety, and setting limits on those parameters. The CSE shall3 contain sufficient detail, clarity, and lack of ambiguity to allow a peer reviewer familiar with the facility and processes to independently assess the adequacy and accuracy of the CSE. This section contains guidance for the format and content of CSEs intended for establishing the subcriticality of fissionable material handling, processing, and storage operations in compliance with ANSI/ANS-8.1-1998 and supporting ANSI/ANS-8 Standards. The purpose in performing the type of CSE described in this section is to analyze the criticality hazard associated with a fissionable material process or system and develop limits and controls to prevent a criticality accident. Content guidance for the CSE is provided below, arranged by specific topics and section headings. If any heading or content discussed below is optional, it will be so indicated. The addition of sections and content not discussed herein that are deemed important by the analyst may be included in the CSE. A. INTRODUCTION

The purpose and scope of the evaluation should be stated in this section. Relevant background information should also be presented here. If the evaluation represents a modification or revision to an existing evaluation or system then the reason for the change should be clearly stated. B. DESCRIPTION The system or process is described in this section of the CSE. Illustrations and/or graphics may be provided as needed to provide clarity. Assumptions about the process and scope limitations that impact the CSE should be stated and justified. Assumptions that apply only to computer modeling should not be included here but should be presented in Section D below. If the evaluation covers a specific portion of a system or process or is limited to a particular aspect of a system or process, the potential for interaction with other aspects or systems should be described as well as references to any related CSEs. DOE-STD-3007-2007 4 References, including drawings and operating procedures, may be provided to allow a reviewer the opportunity to further research the system being evaluated and to verify the accuracy of the descriptive information provided. References should be specific enough to identify the cited data. C. UNIQUE OR SPECIAL REQUIREMENTS This section and its content are optional and may be included to indicate any unique requirements not normally associated with DOE CSEs. If any specific technical guidance or requirement is especially pertinent to the process or CSE it may be cited here for emphasis. There is no need to document Rules, DOE Orders, or ANSI/ANS Standards that are routinely applicable. D. METHODOLOGY AND VALIDATION This section of the CSE describes the methodology or methodologies used to establish limits for the operation being evaluated. Four methods that may be used for the establishment of subcritical limits are: • Reference to national consensus standards that present critical and/or subcritical limits; • Reference to accepted handbooks of critical and/or subcritical limits; • Reference to experiments with appropriate adjustments to ensure subcriticality when the uncertainties of parameters reported in the experiment documentation are considered; and/or • Use of validated calculational techniques. (Note: One specific example based on validated calculations that may be used is the Criticality Index (CI) technique useful for setting limits on commingled arrays of fissile material containers.) Note that standards and handbooks provide critical data and subcritical limits, which may not include applied safety margins. The analyst shall4 develop and document margins to be applied to the limits for the operation being evaluated when using values from referenced standards and handbooks to protect against uncertainties in process variables and against a limit being accidentally exceeded. When limits are based on reference documents such as ANSI/ANS-8 Standards, criticality safety handbooks, or published experimental results, complete and specific references shall2 be cited. The applicability of the reference data to the operation being evaluated should be discussed. Calculation methods may include simple hand calculation techniques (e.g., limiting surface density, density analog), deterministic computer codes (e.g., ANISN or other Sn transport theory codes), and Monte Carlo computer codes (e.g., MCNP, KENO-V.a). When applicable, nuclear cross-section data DOE-STD-3007-2007

5 that were used should be identified (i.e., cross-section sets and release versions) along with any cross- section processing codes that were used. References may be provided to allow a reviewer the opportunity to further research the methods used in the evaluation. When computer codes are used as part of the methodology, the type of computing platform along with relevant code configuration control information should be documented here. This information may be provided by reference. ANSI/ANS-8.1-1998, Section 4.3 contains requirements for validation of methods and determination of bias. In addition, validation requirements from other ANSI/ANS-8 Standards should also be followed as appropriate. Compliance with these requirements shall5 be demonstrated in this subsection of the evaluation. Reference may be made to more detailed validation reports; however, the results of these validation reports should be summarized. If no benchmark experiments exist that match the system being evaluated, it may be possible to interpolate or extrapolate from existing benchmark data to that system. Sensitivity and uncertainty analysis tools may be used to assess the applicability of benchmark problems to the system being analyzed. One example of such a tool is TSUNAMI (Tools for Sensitivity and Uncertainty Analysis Methodology Implementation). Proper application of TSUNAMI requires covariance data. The analyst should understand the quality of the underlying nuclear physics data utilized in the application, including the covariance data. E. PROCESS ANALYSIS This section and its contents shall1 be included in the CSE. All normal conditions and credible abnormal conditions (credible contingencies) shall1 be analyzed and documented. This section shall1 document that operations are subcritical under all normal conditions and that no credible abnormal condition can lead to an accidental criticality. This section shall6 identify those controls that have been developed. As part of this effort, the CSE shall7 document that at least two unlikely, independent, and concurrent changes in process conditions (i.e., changes in process parameters) must occur before a criticality accident is possible. The intent of ANSI/ANS-8.1-1998 regarding application of the Double-Contingency Principle is that two independent process parameters should be controlled. It is not always possible to control two independent parameters for every process, thus ANSI/ANS-8.1-1998 does not make the Double-Contingency Principle a requirement. DOE Order 420.1B also allows DOE to approve cases where the Double-Contingency DOE-STD-3007-2007 6 Principle cannot be met. Therefore, in the case where a criticality accident is credible and only one parameter is controlled, the process does not meet the Double-Contingency Principle. A CSE done for the purpose of demonstrating that a mitigated criticality accident is not a credible event cannot simply assume that application of double contingency achieves that result. If a criticality accident is not credible then the risk of a criticality accident is lower than that provided by the application of the Double-Contingency Principle even if only one parameter is controlled. Therefore, in cases where a mitigated (i.e., crediting controls that prevent the accident) criticality accident is not credible, DOE Order 420.1B does not require DOE approval. A CSE showing that a mitigated criticality accident is not

credible should not rely on simplistic formulas for the numbers of controls or contingencies in place (i.e., by defining not-credible as equivalent to three concurrent contingencies or concurrent failure of four controls, etc.). The CSE should provide justification for concluding that a criticality accident is not- credible based on the application of technical practices described in Section 4.2 of ANSI/ANS-8.1-1998. Such a CSE may rely on controls present in the facility. Controls that are relied upon shall6 be documented. Reliance should be placed explicitly on engineered features, specific administrative controls, and/or various administrative programs such as material control and accountability, safeguards and security, on and off-site transportation requirements, and non-destructive assay to support the conclusion that a criticality accident is not a credible event. Finally, DSA and TSR level controls should be developed to ensure that the potential for a criticality accident remains not-credible. See guidance provided in Section IV of this standard for the selection of controls for inclusion in the DSA. The first step in the analysis is to understand and analyze the range of normal processing conditions. Estimates of the normal range of relevant operating parameters including conservative estimates of anticipated variations in those parameters shall6 be determined, documented, and demonstrated to be subcritical. This constitutes the ‘base’ or ‘normal’ case for the CSE. All credible contingencies shall1 be identified, analyzed, and documented. The following three basic steps should be included in performing the contingency analysis: 1. Know the operation and system being evaluated. The criticality safety engineer should directly observe the processes and equipment if they currently exist. Facility and equipment drawings should be reviewed as well as process flow sheets or descriptions. The safety analysis for the facility (DSA or Safety Analysis Report) is an appropriate source of information on failure modes DOE-STD-3007-2007 7 which should be considered, such as sprinkler activation, glove box rupture, rack collapse and natural phenomena, as potential initiators of criticality accidents. 2. Identify potential contingency scenarios. Contingencies shall1 be identified. A disciplined method should be used to identify contingencies. Examples of acceptable methods (see brief descriptions in DOE-STD-1027-92, Change Notice 1, Section 4.1) are: • What If methods; • Qualitative Event or Fault Trees; • Quantitative Probabilistic Risk Assessment methods; • Hazard and Operability Analysis; and/or • Failure Modes and Effects Analysis. Input should be obtained from operations personnel and process specialists thoroughly familiar with the operations and possible abnormal conditions. Whenever practical, identified contingencies should be eliminated by modification of the process. 3. Establish controls. Controlled parameters and their associated limits shall6 be identified in this section. Examples of parameters subject to control include, but are not limited to, fissionable material mass, volume, concentration, moderation, interaction, etc. Appropriate operations staff, engineering staff, and/or process experts should review the postulated contingencies and the proposed controls to assure practicality. The preferred hierarchy of controls shall8 be: (1) passive

engineered features, (2) active engineered features, and (3) administrative controls. Inspections, periodic surveillances, or other quality assurance measures should be developed and implemented to defend the reliability of the selected controls. Other factors that influence the selection of controls and should be considered, include: • The implementation complexity of the control; • The ability of personnel to recognize the failure of the control; • The potential for common mode failure of controls; and, • The final reliability of the set of controls. A table showing the unlikely changes in process conditions (contingencies) and the controls that make the abnormal change unlikely may be summarized in a table. The following is an example of a contingency control table. DOE-STD-3007-2007 8 Example Contingency Control Table Controlled Parameter Contingency (i.e., unlikely process condition) Controls Mass Single double batched container in the workstation in an array of properly loaded containers. 1. Procedure requiring mass measurement 2. Prejob review of applicable criticality safety limits 3. Procedure requiring mass to be checked prior to transfer of material 4. Procedure requiring mass to be verified by independent operator prior to beginning operation Interaction Two containers in contact in one workstation immediately adjacent to two containers in contact in adjoining workstation making a total of four containers in contact. 1. Prejob review of applicable criticality safety limits 2. PC-3 qualified rack holding a maximum of three approved containers 3. Procedures and limits permit only one container out of the rack at a time in each workstation 4. Seismically qualified racks F. EVALUATION AND RESULTS The use of this section heading is optional. However, the content described below shall3 be incorporated by reference or included somewhere in the CSE. If calculational techniques are used, detailed descriptions of the models (e.g. computer input listings, material compositions, etc.) shall3 be presented. The level of detail shall3 be sufficient to allow an independent reviewer to reconstruct the computational model, compare the model with the descriptive information in Subsection B, and determine if the overall model is accurate and appropriate. Significant assumptions and simplifications shall3 be stated. Pertinent calculational parameters important to the understanding of the analysis shall3 be specified or incorporated by reference. All pertinent calculational results shall3 be reported. Where referenced calculations or reports are used to support the results of the evaluation, a summary of the referenced calculations should be included. Plots of data should be clearly labeled. Descriptions/labels of individual computer runs should indicate the physical attributes of the system being analyzed. Estimated uncertainties in the results (e.g., statistical uncertainties associated with Monte Carlo calculations) and any analyzed sensitivities to DOE-STD-3007-2007 9 modeling simplifications (e.g., effects of homogenization, dimension or geometry modifications, etc.) should be included here as well. G. CREDITED CONTROLS AND ASSUMPTIONS All engineered features (active and passive) and administrative controls identified during the performance of the process analysis shall3 be stated in this section. The purpose is to clearly document and highlight

what is being relied upon to prevent a criticality accident. These may or may not be TSRs (see Section IV). This section should also list important assumptions relied upon by the analysis. Assumptions listed here should be closely associated with implemented controls and discussed in the process analysis section. These include but are not limited to the administrative systems relied upon by the analyst (e.g., non- destructive assay, materials control and accountability, combustible material control, etc.). H. SUMMARY AND CONCLUSIONS Inclusion of this section is optional. The overall criticality safety assessment of the system being analyzed may be summarized in this section. The range of applicability and special limitations in the evaluation may be documented here. If unique requirements must be satisfied (those discussed in Subsection C), a statement of compliance with these requirements may be included here. When applicable, reference to normal and abnormal ranges of operational parameters may also be made. Portions of the evaluation that have been deferred to other documents may be summarized here. DOE-STD-3007-2007 10 I. REFERENCES To the extent practical, a CSE should stand on its own. However, references may be used so all external technical information (information from handbooks or information from other reports that is beyond the scope of the evaluation) and relevant descriptive information can be verified. Verbal communications, as references, should be avoided, and crucial conclusions of the evaluation should not depend on verbal communications. Where private communications such as emails or verbal discussions provide significant information related to the evaluation, a copy of the email or a “note to file” documenting the conversation should be included as a reference or as an attachment. References should be documented with sufficient detail to describe applicability to the process being evaluated. In any event, the evaluation shall3 not be so dependent upon references as to prevent an independent reviewer from being able to judge the adequacy of the evaluation as a stand-alone document. DOE-STD-3007-2007 11 III. GUIDANCE FOR SPECIAL CASE CRITICALITY SAFETY EVALUATIONS This portion of the standard concerns itself with special case CSEs. The purpose is to provide guidance for special types of evaluations often encountered at DOE facilities. For these special case CSEs, the format and content provided in Section II of this standard is not required, but may be followed. Content guidance for selected common special case CSEs is provided below. Examples of special case CSEs include evaluating the need for a CAAS (either installation or removal), application of ANSI/ANS-8.10- 1983 for shielded facilities, CSEs supporting transportation and shipping, and to evaluate as-found conditions if a facility has been mischaracterized relative to the need for CAAS. This is not meant to be an exhaustive list of CSE types that could fall outside of the guidance of Section II. The Criticality Safety Program (CSP) description required by DOE Order 420.1B should clearly define what content and regulatory guidance applies to the types of CSEs generated under the CSP. A. NEED FOR CRITICALITY ACCIDENT ALARM SYSTEMS ANSI/ANS-8.3-1997 requires that the need for a CAAS be evaluated if the inventory of fissionable materials exceeds specified amounts. The installation of an alarm system implies a nontrivial risk of

criticality. A nontrivial risk of criticality should be considered to exist in facilities whose inventory exceeds the specified threshold levels in ANSI/ANS-8.3-1997 and where a criticality accident is credible for a process or processes with fissionable materials in the facility. The purpose of an alarm system is to reduce risk to personnel. Evaluation of the overall risk should recognize that hazards may result from false alarms and subsequent sudden interruption of operations and relocation of personnel. Guidance for emergency plans and procedures are contained in relevant ANSI/ANS-8 Standards. A CSE should be prepared that documents the evaluation of the need for a CAAS. This CSE should contain input from appropriate technical disciplines such as NCS, safety basis, operations, emergency preparedness, and radiation protection. The evaluation of overall risk should take into consideration the impact of the CAAS itself on the risk to workers and the public. In some facilities, the hazard of responding to a CAAS alarm, real or inadvertent, may outweigh the benefit of having a facility alarm or detection system in place. One example of such a facility may be a facility where it is possible to have a criticality accident in a shielded portion of a facility such that workers outside the immediate area of the criticality accident will not receive a substantial prompt radiation dose. However, the workers outside the immediate area of the accident might be put at risk if they responded immediately to an evacuation alarm, DOE-STD-3007-2007 12 especially if high-hazard operations were in progress. In this case, it may be preferable to have a local immediate alarm notifying the affected workers followed by a more deliberate planned emergency response for the rest of the facility. Full benefit of localized/portable criticality accident detector and alarm systems and the full suite of detection and annunciation options at the disposal of the facility manager may be considered and appropriately credited for their safety function. Removal of CAASs, whether fixed, permanent, temporary, portable, or transportable systems, from existing facilities should be justified with a CSE evaluating the need for a CAAS in terms of the overall risk benefit of such a system as discussed above. For a CAAS removal evaluation, an important part of a strong argument is a thorough facility characterization detailing the quantity, form, and distribution of fissionable material in the facility. In order to support an assertion that the CAAS is not required, the potential holdup in a facility shall9 be addressed. New facilities that previously have not processed or handled fissionable materials obviously have no holdup. But holdup in older facilities shall9 be addressed. Utilization of operating personnel or facility experts with direct knowledge of operations spanning the full-life cycle of the facility is important. When personnel with direct knowledge of past operations are not available, documentation relevant to the facility operations and off-normal events should be used. A thorough characterization should include: • Description of the operating history of the facility sufficient to support conclusions about the presence or absence of fissionable materials in various locations; • Description of accidents or process upsets, particularly those that might have left significant

quantities of fissionable materials in unexpected locations (e.g., fires, floods, spills, etc.); and • Description of current material inventories, including all accountable fissionable material, inventory differences, and comprehensive fissionable material assays. The characterization should also include a brief description of assay methods used, their accuracy, potential weaknesses, comprehensiveness of the assays, and the meaning of any stated uncertainties. B. OPERATIONS WITH SHIELDING AND CONFINEMENT ANSI/ANS-8.10-1983, Criteria for Nuclear Criticality Safety Controls in Operations with Shielding and Confinement, provides criteria for adequate shielding and confinement that may permit relaxation of criticality safety requirements from those required in unshielded facilities. The standard permits reduced conservatism in the process analysis and single-contingency operations when the shielding and DOE-STD-3007-2007 13 confinement criteria specified in Section 4 of the standard are met. A CSE done for operations covered by ANSI/ANS-8.10-1983 shall10 document that the facility meets the shielding and confinement requirements in addition to documenting the process analysis described in Section II. If single- contingency operations are present and administrative controls are relied upon, then procedures shall11 be established to ensure that no single administrative error on the part of any one individual leads to a criticality. Section IV provides guidance for selection of criticality controls for inclusion in the DSA and TSRs with Sections IV.6 and IV.8 particularly pertinent for this class of operations. DOE-STD-3007-2007 14 IV. LINKAGE TO THE DOCUMENTED SAFETY ANALYSIS This section provides specific guidance on the linkage between the CSEs and the DSA. DOE’s Nuclear Safety Management Rule, 10 CFR 830 Subpart B, requires the preparation of safety bases, including DSAs and TSRs, for Hazard Category 1, 2, and 3 nuclear facilities. Chapter 6 of a DSA prepared according to DOE-STD-3009-94 contains a summary description of the CSP, including a description of how CSEs are conducted. Chapter 3, Hazard and Accident Analysis, is where the hazards are identified and analyzed, and controls are selected. CSEs provide detailed information that should be reviewed when constructing DSA hazard analysis scenarios. However, while such scenario entries in the hazard analysis may summarize CSE information, they are expected to be a “stand-alone” product that does not incorporate CSEs into the DSA. The events identified in the hazard analysis should be those covered in CSE. If the CSE shows that the fissionable material process/system remains subcritical under both normal and credible abnormal conditions and documents that the fissionable material process/system complies with the Double-Contingency Principle, then there is no need to perform a separate analysis in the hazard analysis, only reference the CSE. All controls necessary to prevent and/or mitigate criticality accidents shall12 be considered for inclusion in the facility DSA and TSR. The CSP shall13 have a mechanism to review all changes or potential changes to NCS controls for capture by the configuration control program as well as revisions and updates to the DSA and TSRs. A process to examine the collection of controls developed in the CSEs to determine their importance in DSA space should be developed and documented as part of the CSP. The process should be agreed upon

by both the NCS and safety analysis staff and formally documented as part of the CSP description document. It is important to note that not every CSE or fissionable material process is required to have a control selected for inclusion in the DSA. Eight evaluation criteria that should be used are listed below: 1. The selection of NCS controls for the DSA should be performed using a team of criticality safety, nuclear safety, and operations personnel; DOE-STD-3007-2007 15 2. The consequence of criticality should be examined for the purpose of establishing whether a particular control is safety class or safety significant, equipment important to safety, or merely provides defense in depth; 3. The CSEs that cover the fissionable material operations addressed by the DSA should be examined to ensure that bounding assumptions or analysis conditions are considered as potential DSA/TSR controls; 4. All passive engineered features credited in the CSE should be considered for selection as a DSA design feature; 5. All active engineered features credited in the CSE should be considered for selection as a safety class or safety significant Structures, Systems or Components (SSC) with associated safety limits or limiting condition of operations as appropriate; 6. Not all engineered features (active or passive) need be selected for inclusion in the DSA/TSR. The minimum set of controls selected for inclusion should be those that meet the following conditions: (A) loss of the single control under consideration could directly result in a criticality accident (such a system would require DOE approval according to 420.1B), (B) loss of the control could result in a singly contingent condition, and (C) active controls requiring calibration. Additional engineered features (active or passive) beyond the minimum set may be selected as appropriate; 7. If all of the credible scenarios are shown to be subcritical by engineered features, then specific administrative controls (see DOE-STD-1186-2004, Specific Administrative Controls) are not required; and/or 8. Only administrative controls meeting at least one of the following criteria should be considered for inclusion: (A) credible violation of the control could directly lead to a criticality accident, (B) if the safety function were to be equivalent to a safety class or safety significant engineered control (as discussed in DOE-STD-1186-2004), and (C) general references to control philosophy (e.g., mass control or spacing control or concentration control as an overall control strategy for the process without specific quantification of individual limits). DOE-STD-3007-2007 16 A linking document (referred to in this standard as a “Criticality Control Review” or CCR) should be used to summarize the results of this evaluation process for criticality hazards and controls. The process leading to the development of the CCR should be specified as part of the CSP description document. The CSP should also document how revisions and updates to the CCR and CSEs are treated relative to the USQ process. The advantages to development of a CCR are: 1. The CCR now becomes the technical reference to the DSA for criticality safety; and 2. The CCR allows summarizing several CSEs for a process or a facility in a single document so that identification of commonly important attributes and controls is possible. A. CLASSIFICATION OF HAZARD CONTROLS AND TECHNICAL SAFETY REQUIREMENTS

The process of selecting hazard controls includes classification of them as safety class SSCs, safety significant SSCs; design features; administrative controls that are major contributors to defense in depth, which are designated as specific administrative controls; or a lesser category, sometimes described as SSCs important to safety; and administrative controls. DOE-STD-1186-2004, Specific Administrative Controls, provides guidance applicable to specific administrative controls. DOE G 421.1-2, Section 5.3 provides a general discussion of the hierarchy of safety controls. All controls needed for safety (criticality related, radiation safety, industrial safety, etc.) are identified and characterized during the course of the hazards and accident analyses performed in support of the DSA. A subset of all controls will usually get safety class or safety significant designation. Controls that are identified and discussed in CSEs may or may not end up being elevated to the level of TSRs or identified in the DSA. Depending on the situation, NCS controls that are incorporated into the DSA would be TSRs, design features, or administrative controls. DSA-level controls should be identified on a case-by- case basis and should be graded according to the guidance in DOE-STD-3009-94, Change Notice No. 3 or successor document to establish the hierarchy of hazard controls. Hierarchy requires that engineering controls with an emphasis on safety-related SSCs be preferable to administrative controls or specific administrative controls14 due to the inherent uncertainty of human performance. Specific administrative controls14 may be used to help implement a specific aspect of a programmatic administrative control that is credited in the safety analysis and, therefore, has a higher level of importance. DOE-STD-3007-2007 17 Appendix A of DOE-STD-3009-94, Change Notice 3 provides guidance on unmitigated accident analysis. Unmitigated analysis means that controls intended to prevent or mitigate an accident are assumed not to function. In the case of a criticality event, this means, in part, that the accident is assumed to happen with no mitigative features taken into account. An exception to this is that passive safety features that can be shown to survive the initiating event may be considered in the analysis. For example, if a seismic event causes a criticality accident in a shielded area, and the shield can be shown to survive the event, then the effectiveness of the shield in mitigating worker accident doses can be accounted for in the analysis. For accident analysis of criticality accidents that have the potential for lasting longer than an initial pulse, the accident duration should be limited to two (2) hours, except for scenarios that are slow to develop and complete. In those cases, the accident duration should be limited to eight (8) hours (based on ample time for emergency response and the relative historical rarity of such extended accidents). These analyses should be based on bounding scenarios. The dose integration time should be based on the specific power history of the accident, limited as discussed above. For the criticality accident analysis, DOE-HDBK-3010-94, Change Notice 1 provides estimates of fission yields, and is a recognized source for accident analysis parameters. In addition, ANSI/ANS-8.23-1997 requires evaluation of bounding operational-specific accidents, including locations, yields, and dose

determinations. As with any accident parameter, sources for fission yields other than DOE-HDBK-3010- 94, Change Notice 1 may be used, providing they can be justified and shown to be applicable to the accident situation. B. NEED FOR CONSIDERATION OF BEYOND DESIGN BASIS ACCIDENTS To satisfy the requirement in 10 CFR 830 Subpart B for consideration of the need for beyond design basis criticality accidents, an acceptable approach is to examine the contingencies that were discussed in the applicable CSEs but were not carried further based on their being not-credible. Collectively, the results may indicate that the overall risk of a criticality accident in a facility needs further evaluation. The purpose of the beyond design basis section is to inform the DOE that there may be accidents that were not considered either collectively or individually in the normal CSE process. An example is that of a very large earthquake that may result in a criticality accident with a larger maximum total number of fissions than expected from a design basis earthquake. The individual CSEs would not address such an event in the normal course of process analysis. If such a review shows that there are good and sufficient bases for DOE-STD-3007-2007 18 not carrying the scenarios forward, then the review can be documented with the conclusion that there is no need for further consideration. DOE-STD-3007-2007 19 V. IMPLEMENTATION AND SURVEILLANCE REQUIREMENTS A. IMPLEMENTATION CSEs completed prior to this revision remain valid based on the requirements at the time of the evaluation approval. For new processes, and during the next major revision to existing CSEs, conformance with this standard should be established. B. SURVEILLANCE REQUIREMENTS Major changes to equipment and processes shall15 be subject to the change control process. That process shall15 ensure that revisions to CSEs will be reflected in the appropriate document as part of the overall change package. All operations shall16 be reviewed frequently (at least annually) to ascertain that procedures are being followed and that process conditions have not been altered so as to fall outside the scope of currently approved CSEs. Individuals who are knowledgeable in criticality safety and who, to the extent practicable, are not immediately responsible for the operation shall16 conduct these reviews, in consultation with operating personnel. As part of the annual operations review, a check should be conducted to see if revisions to the safety basis documents are required. Any needed changes should be evaluated and addressed using the established USQD/PISA/JCO process as appropriate. DOE-STD-3007-2007 20 ENDNOTES 1. ANSI/ANS-8.1, Section 4.1.2 2. ANSI/ANS-8.1, Section 4.2 3. ANSI/ANS-8.19, Section 8.3 4. ANSI/ANS-8.1, Section 5 5. ANSI/ANS-8.1, Section 4.3.6 6. ANSI/ANS-8.1, Section 4.2.1 7. DOE Order 420.1B, Section III.3.b(4) 8. DOE Order 420.1B, Section III.3.a(4)(b) 9. DOE Order 420.1B, Section III.3.b(6) 10. ANSI/ANS-8.10, Section 4 11. ANSI/ANS-8.1, Section 5.1 12. DOE Standard 3009, Change Notice 3, Preparation Guide for U.S. Department of Energy Nonnuclear Nuclear Facility Document Safety Analysis 13. DOE Order 420.1B, Section III.3.a(4)(d) 14. DOE-STD-1186 15. ANSI/ANS-8.19, Section 5.5 16. ANSI/ANS-8.1, Section 4.1.6 DOE-STD-3007-2007 21 REFERENCES 10 CFR 830 Subpart B, Nuclear Safety Management

ANSI/ANS-8.1-1998, Nuclear Criticality Safety in Operations with Fissionable Materials Outside Reactors ANSI/ANS-8.3-1997;R2003, Criticality Accident Alarm System ANSI/ANS-8.19-2005, Administrative Practices for Nuclear Criticality Safety ANSI/ANS-8.23-1997, Nuclear Criticality Accident Emergency Planning and Response DOE G 421.1-2, Implementation Guide for Use in Developing Documented Safety Analyses to Meet Subpart B of 10 CFR 830 DOE-HDBK-3010-94, Change Notice 1, Airborne Release Fractions/Rates and Respirable Fraction Nonreactor Nuclear Facilities DOE Order 420.1B, Facility Safety DOE-STD-1027-92, Change Notice 1, Hazard Categorization and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports DOE-STD-1186-2004, Specific Administrative Controls DOE-STD-3009-94, Change Notice 3, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis ANSI/ANS-8.10-1983;R1988;R1999;R2005, Criteria for Nuclear Criticality Safety Controls in Operations with Shielding and Confinement DOE-STD-3007-2007 22 CONCLUDING MATERIAL Review Activity: Field and Operations Offices: Preparing Activity: DOE AL DOE-NA-17 DP-NNSA CH EH ID Project Number: EM Fernald SAFT-0110 NE NV NN-NNSA OAK SC OH FE OR RF RL SF SR Carlsbad Field Office (CBFO) Office of River Protection Area Offices: Amarillo Area Office Argonne Area Office Brookhaven Area Office Fermi Area Office Kirtland Area Office Los Alamos Area Office Princeton Area Office Rocky Flats Area Office Y-12 Area Office