DOE-STD-3007-2017, Preparing Criticality Safety Evaluations at Department of Energy Nonreactor Nuclear Facilities (Invoked)

DOE-STD-3007-2017 December 2017 DOE TECHNICAL STANDARD PREPARING CRITICALITY SAFETY EVALUATIONS AT DEPARTMENT OF ENERGY NONREACTOR NUCLEAR FACILITIES U.S. Department of Energy AREA SAFT Washington, D.C. 20585 DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. TS NOT MEASUREMENT SENSITIVE TS DOE-STD-3007-2017 i FOREWORD 1. This Department of Energy (DOE) Standard has been approved to be used by DOE, including the National Nuclear Security Administration, and their contractors. 2. Beneficial comments (recommendations, additions, and deletions), as well as any pertinent data that may be of use in improving this document, should be emailed to nuclearsafety@hq.doe.gov or sent to: Office of Nuclear Safety (AU-30) Office of Environment, Health, Safety, and Security U.S. Department of Energy 19901 Germantown Road Germantown, MD 20874 3. This Standard is a significant revision of and successor to DOE-STD-3007-2007. It provides updated requirements and guidance for generating Criticality Safety Evaluations meeting the criteria in the American National Standards Institute/American Nuclear Society (ANSI/ANS)-8 series of criticality safety standards. mailto:nuclearsafety@hq.doe.gov DOE-STD-3007-2017 ii TABLE OF CONTENTS 1. Introduction ......................................................................................................................................... 1 1.1 Scope ........................................................................................................................................ 1 1.2 Applicability ............................................................................................................................ 1 1.3 Background .............................................................................................................................. 1 1.4 Overview of the Standard ........................................................................................................ 2 1.5 Terminology (SHALL, SHOULD, AND MAY) ..................................................................... 2 1.6 Definitions ............................................................................................................................... 3 2. Responsibilities.................................................................................................................................... 3 3. Content Requirements For Criticality Safety Evaluations................................................................... 4 3.1 Introduction (recommended) ................................................................................................... 4 3.2 Description ............................................................................................................................... 4 3.3 Unique or Special Requirements (Recommended) .................................................................. 5 3.4 Methodology And Validation .................................................................................................. 5 3.4.1 Methodology ................................................................................................................ 5 3.4.2 Validation .................................................................................................................... 6

3.5 Process Analysis ...................................................................................................................... 7 3.5.1 General Guidance and Requirements .......................................................................... 7 3.5.2 Process Analysis Sequence .......................................................................................... 9 3.6 Summary of Controls And Assumptions ............................................................................... 10 3.7 Summary And Conclusions (Recommended) ........................................................................ 10 3.8 List of Cited References ........................................................................................................ 10 3.9 Appendices (Recommended) ................................................................................................. 10 4. Evaluating Design Basis Events ........................................................................................................ 11 4.1 Identifying the Design Basis Events ...................................................................................... 11 4.2 Design Basis NPH Events ...................................................................................................... 12 4.3 Other Design Basis Events .................................................................................................... 13 5. Needs Analysis for Criticality Accident Alarm systems ................................................................... 14 6. Interface Between the CSE and the DSA .......................................................................................... 15 6.1 Selection of Candidate NCS SSCs for Inclusion in the DSA ................................................ 16 6.1.1 Exceeding Dose Thresholds....................................................................................... 16 6.1.2 Active Engineered Controls ....................................................................................... 17 6.1.3 Criticality Accident Alarm System ............................................................................ 18 6.2 Considerations for Designation of SSCs as Safety Significant or Safety Class .................... 18 6.3 Documentation of SSCs included in the DSA ....................................................................... 18 7. REFERENCES .................................................................................................................................. 19 Appendix A. Commonly Used Handbooks and Calculational Methods................................................. A-1 DOE-STD-3007-2017 iii ACRONYMS ANSI/ANS American National Standards Institute/American Nuclear Society CAAS Criticality Accident Alarm System CCR Criticality Control Review CSE Criticality Safety Evaluation DOE Department of Energy DSA Documented Safety Analysis NCS Nuclear Criticality Safety NDC NPH Design Category NNSA National Nuclear Safety Administration NPH Natural Phenomena Hazards SSC Structure, System, and Component DOE-STD-3007-2017 1 1. INTRODUCTION The purpose of this standard is to provide a framework for generating Criticality Safety Evaluations (CSE) that are compliant with the American National Standards Institute/American Nuclear Society (ANSI/ANS-8) series of criticality safety standards and all applicable DOE Directives. The CSE documents the analysis establishing limits and controls for the safe handling, processing, and storage of fissionable materials. This revision of DOE-STD-3007-2007 has been undertaken to incorporate:

• issuance of DOE-STD-3009-2014, Preparation of Nonreactor Nuclear Facility Documented Safety Analysis governing the preparation of documented safety analyses to comply with 10 CFR Part 830; • issuance of DOE-STD-1020-2016, Natural Phenomena Hazards Analysis and Design Criteria for DOE Facilities that provides guidance on protecting facilities from the effects of natural phenomena hazards (NPH); • guidance provided by the Criticality Safety Support Group within DOE’s Nuclear Criticality Safety (NCS) Program; and • the latest revisions of the ANSI/ANS-8 series of national consensus standards. 1.1 SCOPE This standard provides requirements and guidance on acceptable methods for developing CSEs for DOE’s nonreactor nuclear facilities. 1.2 APPLICABILITY This Standard applies to all DOE elements, including the National Nuclear Safety Administration (NNSA), and all DOE and NNSA contractors with responsibility for nuclear facilities and activities that involve or will potentially involve radionuclides in such quantities that are equal to or greater than the single parameter limits for fissionable materials listed in ANSI/ANS-8.1-2014, Nuclear Criticality Safety in Operations with Fissionable Materials Outside Reactors, and ANSI/ANS-8.15-1981, Nuclear Criticality Control of Special Actinide Elements. These limits must be adjusted where process conditions could credibly involve moderators or reflectors that are more effective than light water. 1.3 BACKGROUND Section 830.204(b)(6) of 10 CFR Part 830 specifies the requirement with respect to a nonreactor nuclear facility with fissionable material in a form and amount sufficient to pose a potential for criticality, to define a criticality safety program that: • Ensures that operations with fissionable material remain subcritical under all normal and credible abnormal conditions, • Identifies applicable nuclear criticality safety standards, and • Describes how the program meets applicable nuclear criticality safety standards. DOE-STD-3007-2017 2 NCS program requirements are established in DOE O 420.1C, Change 1, Facility Safety. This Order states that CSEs must be conducted in accordance with DOE-STD-3007-2007, Guidelines for Preparing Criticality Safety Evaluations at Department of Energy Non-Reactor Nuclear Facilities, or by other documented methods approved by DOE. This revision meets the requirement of a “documented method” approved by DOE. 1.4 OVERVIEW OF THE STANDARD Section 2 of this standard presents the responsibilities of the criticality safety engineer for generating a CSE. Section 3 of this standard provides a framework for generating CSEs in support of fissionable material facility design and operations (production, operations, storage, transportation, and deactivation and decommissioning) at DOE nonreactor nuclear facilities. Section 4 of this standard provides guidance regarding the evaluation of design basis events, including on the linkage between the hazard methodology in this standard to the requirements in DOE-STD-1020- 2016. This particular subject is not explicitly addressed within the ANSI/ANS-8 series of standards. Section 5 of this standard presents information relevant to performing a “needs” analysis regarding the use of a Criticality Accident Alarm System (CAAS). This subject is not explicitly addressed within the ANSI/ANS-8 series of standards.

Section 6 of this standard provides specific guidance on the linkage between CSEs and the Documented Safety Analysis (DSA). Guidance is given to the criticality safety engineer on the integration of the hazards analysis method in this standard into the DSA. Appendix A provides information on commonly used handbooks and references for use in developing a CSE. CSEs that are fully compliant with the applicable ANSI/ANS-8 Standards are not required to be reissued or revised solely to meet the expectations of this version of Standard 3007. However, for sites that transition to this version of Standard 3007, new or significant revisions to CSEs shall be performed in accordance with this version. 1.5 TERMINOLOGY (SHALL, SHOULD, AND MAY) Throughout this Standard, the word “shall” is used to denote a requirement of this Standard; the word “should” is used to denote a recommendation of this Standard; and, the word “may” is used to denote permission, but not a requirement or a recommendation of this Standard. To satisfy this Standard, all applicable “shall” statements must be met. Alternate approaches that demonstrate an equivalent level of safety are also acceptable, if approved by the DOE field element. “Should” statements represent DOE technical recommendations. Alternative approaches to “should” statements are permitted and do not require approval by DOE. DOE-STD-3007-2017 3 1.6 DEFINITIONS Credible – The attribute of being believable on the basis of commonly acceptable engineering judgment.1 Criticality Safety Evaluation – the analysis and documentation that the fissionable material process covered by the scope of the evaluation will be subcritical under both normal and credible abnormal conditions. The title “criticality safety evaluation” is generic and refers to any document intended to meet the requirements of ANSI/ANS-8.19-2014, Administrative Practices for Nuclear Criticality Safety. Site- specific synonyms may be used. Criticality Safety Program – the Criticality Safety Program required by Attachment 2, Chapter III of DOE Order 420.1C. Parameter - One of the total set of factors that defines a fissionable system and determines its neutronic behavior. Controlled Parameter – A parameter that is kept within specified limits. Process Conditions - The identifying characteristics of a process that have an effect on nuclear criticality safety (e.g., parameters, environment, and operations). Unlikely – The attribute of being improbable on the basis of commonly-accepted engineering judgment.2 Criticality Accident − The release of energy as a result of accidentally producing a self-sustaining or divergent fission chain reaction3. 2. RESPONSIBILITIES The criticality safety engineer is the primary analyst responsible for complete development of the CSE. While the criticality safety engineer is not necessarily a definitive expert on all aspects of the fissionable material process being evaluated, he or she must possess a deep understanding of how a CSE is performed and implemented. The criticality safety engineer relies on other organizations such as operations, system engineering, maintenance, and nuclear materials control and accountability, to assist in: • documenting a thorough and accurate process description with clear boundaries for the scope of the evaluation, • identifying normal and credible abnormal conditions, and • establishing limits and controls that are implementable, verifiable and compatible with the

1 Additional information on the term “credible” is presented in ANSI/ANS-8.1-2014. 2 Additional information is provided in Section 3.5.1. 3 Paxton, Hugh C., Glossary of Nuclear Criticality Terms, Los Alamos National Laboratory report LA-11627-MS, Los Alamos, NM, October 1989. DOE-STD-3007-2017 4 planned operation. The end result should be a CSE combining expertise in criticality safety and knowledge of the fissionable material operations of concern. 3. CONTENT REQUIREMENTS FOR CRITICALITY SAFETY EVALUATIONS This portion of the standard contains guidance for the format and content of CSEs.4 The purpose in performing the CSE described herein is to analyze the criticality hazard associated with a fissionable material process or system and develop limits and controls to prevent a criticality accident. All CSE sections noted below are mandatory unless stated to be “recommended”. The addition of sections and content not discussed below may be included in the CSE. The primary customer of the CSE is the first line supervisor or manager of the operation, and the CSE supports operation’s ownership for safety of the fissionable operation. Therefore, the formatting and arrangement of the CSE should consider how the document will be used by the supervisory and operating staff. Accordingly, the sections may be presented in any order convenient to the operating staff. It is permissible to combine or further subdivide mandatory sections, provided the required topics are thoroughly addressed. Local work instructions should specify the order of the sections for the site. 3.1 INTRODUCTION (RECOMMENDED) The purpose and scope of the evaluation should be stated in this section of the CSE. Relevant background information should also be presented here. If the evaluation represents a modification or revision of an existing evaluation or system, then the reason for the change should be clearly stated. If an introduction is not used, the suggested content should be included in the “Description” section of the CSE. 3.2 DESCRIPTION The system or process to be evaluated shall be described in this section of the CSE. This description establishes the foundation for normal and credible abnormal conditions and the boundaries of the fissionable material operation. It also provides useful information for the performance of periodic reviews to ensure the CSE is current. Illustrations and/or graphics may be provided as needed. Assumptions about the process and scope limitations that have a significant effect on the CSE shall be stated and justified. Assumptions that apply only to computer modeling should be presented in the “Methodology and Validation” section of the CSE (see below). If the evaluation covers a specific portion of a system or process, or is limited to a particular aspect of a system or process, the potential for interaction with other processes or systems should be described as well as references to any related CSEs. 4 Additional information may be found on the DOE Nuclear Criticality Safety Program website (Nuclear Criticality Safety Engineer Training Module 12, Preparation of Nuclear Criticality Safety Evaluations, http://ncsp.llnl.gov/ncspMain.html) and the American Nuclear Society Nuclear Criticality Safety Division website (white paper on CSEs, http://ncsd.ans.org/). http://ncsp.llnl.gov/ncspMain.html http://ncsd.ans.org/ DOE-STD-3007-2017 5

References, including drawings and operating procedures, may be provided to assist a reviewer in researching the system being evaluated and in verifying the accuracy of the descriptive information provided. Citations to references should be specific enough to identify the cited data. To the extent practical, a CSE should stand on its own. However, references may be used to ensure that all external technical information (such as information in handbooks or other reports beyond the scope of the evaluation) and relevant descriptive information can be verified by a reviewer or user. References should be documented with sufficient detail to describe applicability to the process being evaluated. Where private communications such as emails or verbal discussions provide significant information related to the evaluation, the information should be included as an attachment or otherwise made retrievable. Note that private communications rarely constitute validated design input meeting the quality assurance requirements of 10 CFR Part 830, Subpart A, so that information should be treated as unverified. Statements in the Description section may imply that limits are being specified, but this should not be the case. Any such statements should be clear whether the meaning is descriptive or a specification. Any description of controls should be consistent when the evaluation is finished. All final needed limits and controls shall be later summarized in the appropriate section. 3.3 UNIQUE OR SPECIAL REQUIREMENTS (RECOMMENDED) This section of the CSE may be used to discuss any unique requirements not normally associated with DOE facility CSEs. If any specific technical requirement is especially pertinent to the process or CSE, it may be cited here for emphasis. There is no need to discuss well-known site requirements, DOE requirements, or consensus standards such as the ANS-8 series. 3.4 METHODOLOGY AND VALIDATION This section of the CSE describes the methodology or methodologies used to establish limits for the operation being evaluated. One or more of the following methods may be used to establish such limits: a. Relevant criticality experiments with appropriate consideration given to parametric uncertainties in the experimental data b. National consensus standards that establish relevant critical and/or subcritical limits c. Accepted and current handbooks of critical and/or subcritical limits d. Validated calculational techniques5 3.4.1 METHODOLOGY Consensus standards and handbooks provide critical data and subcritical limits that may not include applied safety margins. The analyst shall develop and document margins to be applied to these limits for the operation being evaluated to protect against uncertainties in process variables and prevent a limit being accidentally exceeded. Complete and specific references shall be cited. The applicability of the 5 See ANSI/ANS 8.24-2007, Validation of Neutron Transport Methods for Nuclear Criticality Safety Calculations, for more information. DOE-STD-3007-2017 6 reference data to the operation being evaluated shall be discussed. If calculational techniques are used, descriptions of the models shall be presented (e.g., in this section, in the process analysis, in appendices) or be available for review in other references. The level of detail shall be sufficient to allow an independent reviewer to reconstruct the computational model, compare the model with the information in the Description section, and determine if the overall model is representative and appropriate for the operation being evaluated. Significant assumptions and simplifications shall be stated and justified. Pertinent calculational parameters important to the understanding of the analysis shall be specified or incorporated by reference.

Calculational techniques may be hand calculation methods6 or computer-based neutron transport calculations. The neutron transport computer code systems listed below are developed and maintained through rigorous expert review of neutron transport theory, cross section data, and Monte Carlo methods in accordance with DOE software quality assurance requirements. These code systems are distributed by the Radiation Safety Information Computational Center at Oak Ridge National Laboratory. The following code systems are accepted programs for use in NCS applications when used in accordance with a site-specific software quality assurance program for classifying and controlling software: • SCALE: A Comprehensive Modeling and Simulation Suite for Nuclear Safety Analysis and Design • MCNP®: Monte Carlo N-Particle Transport Code System • COG: Multiparticle Monte Carlo Code System for Shielding and Criticality Use All pertinent calculational results shall be reported. Where referenced calculations or reports are used to support the results of the evaluation, a summary of the referenced calculations should be included. Plots of data should be clearly labeled. Descriptions/labels of individual computer runs should indicate the physical attributes of the system being analyzed. Estimated uncertainties in the results (e.g., statistical uncertainties associated with Monte Carlo calculations) and analyzed sensitivities to modeling simplifications that are not bounding (e.g., effects of homogenization, dimension or geometry modifications) should be included here as well. 3.4.2 VALIDATION When computer codes are used as part of the methodology, the required documentation such as type of computing platform and relevant code configuration control information should be documented or referenced in this section. The validation shall be included or referenced here, and the acceptable subcritical limits used from the application of the validation shall be stated. If there are too few benchmark experiments available that appropriately represent the system being evaluated, it may be possible to interpolate or extrapolate from existing benchmark data to that system. Sensitivity and uncertainty analysis tools may be used to strengthen and improve a validation analysis by aiding in the selection of applicable critical experiments, to improve the understanding of fissionable 6 For example, LA-14244-M, Hand Calculation Methods for Criticality Safety – A Primer. DOE-STD-3007-2017 7 systems, and to assist in assessing the adequacy of an existing validation.7 3.5 PROCESS ANALYSIS 3.5.1 GENERAL GUIDANCE AND REQUIREMENTS American National Standards Institute/American Nuclear Society (ANSI/ANS)-8.1-2014, Nuclear Criticality Safety in Operations with Fissionable Materials Outside Reactors, Section 4.1.2, requires that “Before a new operation with fissionable material is begun, or before an existing operation is changed, it shall be determined that the entire process will be subcritical under both normal and credible abnormal conditions.” This requirement, known as the “Process Analysis Requirement,” shall be met by performing a process analysis and documenting via the CSE. This section of the CSE documents the process analysis and demonstrates that operations remain subcritical under all normal conditions and that no credible abnormal condition can lead to a criticality accident.

All normal and credible abnormal conditions shall be analyzed and documented. DOE Order 420.1C includes the requirement to evaluate design basis events as credible abnormal conditions. Section 4 of this standard provides additional guidance regarding the evaluation of design basis events. ANSI/ANS 8.1-2014, Section 4.2, Technical Practices, supports demonstrating the Process Analysis Requirement through the use of the following technical practices: • Controlled System Parameters • Double Contingency Principle8 • Geometry Control • Use of Neutron Absorbers • Moderation Control • Other Parameter Controls that Influence keff • Subcritical Limits Operations may be evaluated using the safety guidance contained in ANSI/ANS-8.10-2015, Criteria for Nuclear Criticality Safety Controls in Operations with Shielding and Confinement. Identifying normal and credible abnormal conditions should be done with the proper degree of conservatism to assure validity of derived controls. The word “credible” in the Process Analysis requirement sets a limit (i.e., an upper bar) on abnormal conditions that shall be considered. Unlikely conditions are those that are less frequent than conditions with normal variations and uncertainties in the process condition. An unlikely change in a process condition usually results in a significant consequence or negative impact on a controlled parameter. For example, an over-mass upset on the order of grams may be an anticipated upset, but a double batch of mass may be sufficiently large that the upset may be 7 Expertise is needed to apply cross-section covariance data to a criticality safety validation analysis. Further guidance may be obtained from the response to CSSG Tasking 2014-02, Validation with Limited Benchmark Data and in ANSI/ANS-8.24, Validation of Neutron Transport Method for Nuclear Criticality Safety Calculations. 8 Further guidance into the meaning of the Double Contingency Principle, and how it relates to the process analysis requirement, is contained in Section 4.2.2 and Appendix B of ANSI/ANS-8.1-2014. DOE-STD-3007-2017 8 considered unlikely or not credible. A CSE considers many factors in the analysis of normal and credible abnormal conditions, including operating limits, physical and chemical conditions of fissionable material, and equipment features. A well-prepared CSE relies on controllable factors for establishing the limits and conditions considered in the process analysis. Use of sound engineering judgment is appropriate and unavoidable in establishing some of the conditions considered in the analysis. Establishing contingent conditions that are at least unlikely and conservative enough to bound what is considered credible often relies on the judgment of knowledgeable personnel. For example, judgment may be applied in areas such as: • establishing normal conditions that bound anticipated variations and uncertainties in the process condition; • identifying the extent of a credible abnormal over-mass condition; • identifying configurations resulting from water mixing with insoluble fissionable material; and • establishing reflection conditions. Such judgments may be within the NCS engineer’s expertise when they are related to process conditions or nuclear science. NCS engineers are cautioned to not make judgments outside of their expertise, and should consult with process engineers, system engineers, operations personnel, and other process experts to form defensible positions on process conditions. Examples of areas where consultation is advisable include:

• The draining rate of glovebox drains, • The credibility of a gas furnace exploding, • The chemistry of the fissionable material operations, and • The depth of liquid from process leaks. The evaluation process of identifying normal and credible abnormal conditions should be performed by a team of experts, including criticality safety and operations staff at a minimum. As mentioned later, other experts may be needed. The determination of subcritical and critical conditions is typically done in parallel with the identification of normal and credible abnormal conditions. This determination is primarily the responsibility of the NCS engineer. In some cases, evaluation of credible abnormal conditions may result in subcriticality not being assured. In this case changes to the process or additional controls are necessary. Assistance from other experts and management should be obtained to determine if it is more effective to change the process than to add limits and controls. The DSA and supporting hazards analyses for the facility are valuable sources of information on failure modes or potential upset conditions such as inadvertent sprinkler activation, glove box rupture, rack collapse, and NPH events. However, the NCS engineer should not assume that safety analysis documents identify all potential changes in process conditions that may diminish criticality safety. DOE-STD-3007-2017 9 3.5.2 PROCESS ANALYSIS SEQUENCE The following steps should be followed using the guidance provided in Section 3.5.1 during the analysis process: 1. Obtain firsthand knowledge of the operations and systems being evaluated. The criticality safety engineer should directly observe the processes and equipment. Facility and equipment drawings should be reviewed as well as process flow sheets or descriptions. The safety basis for the facility or activity, such as a DSA, is an appropriate source of information on failure modes which should be considered. Failures such as sprinkler activation, glove box rupture, rack collapse and NPH events are potential initiators of criticality accidents. 2. Normal process conditions. The next step in the process analysis is to understand and analyze the range of normal processing conditions. Conservative estimates of the normal range of relevant operating parameters and of anticipated variations in those parameters (e.g., uncertainties or expected minor upset conditions) shall be calculated and documented to show that the process remains subcritical. This constitutes the base or normal case for the CSE. Normal conditions shall be determined using input from operations and other knowledgeable individuals as appropriate. 3. Identify credible abnormal conditions. Next, credible abnormal conditions shall be identified, analyzed, and documented based on input from operations and other knowledgeable individuals as appropriate. Identification of credible abnormal conditions is facilitated by using a disciplined method to identify changes in process conditions. Acceptable disciplined methods include: • “What If” Analysis • Qualitative Event or Fault Trees • Hazard and Operability Analysis • Failure Modes and Effects Analysis • Quantitative Probabilistic Risk Assessment If a formal hazard analysis team is formed, the team should be trained on the use of the methods chosen. 4. Select controls.

Parameters and their associated limits and controls shall be identified. Examples of parameters subject to control include fissionable material mass, volume, concentration, moderation, and interaction. Understanding the impact of parameter variations on overall system reactivity is important in establishing proper limits and controls. Appropriate operations staff, engineering DOE-STD-3007-2017 10 staff, and/or process experts should review the proposed limits and controls to ensure they are verifiable, implementable and compatible with the planned operation. The preferred hierarchy of controls is: (1) passive engineered features, (2) active engineered features, and (3) administrative controls. Inspections, periodic surveillances, or other quality assurance measures should be developed and implemented to ensure the reliability of the selected controls. Other factors that influence the evaluation of potential controls include: • the implementation complexity of the control; • the ability of personnel to recognize the failure of the control; • the potential for common mode failure of controls; and • the overall reliability of the set of controls. 3.6 SUMMARY OF CONTROLS AND ASSUMPTIONS All criticality safety limits and controls identified during the performance of the process analysis shall be stated in this section of the CSE. The purpose is to summarize the limits and controls derived in the process analysis to aid in the implementation of the CSE. A subset of these controls may be elevated to the DSA for further evaluation regarding functional classification (safety significant or safety class). Section 6 of this standard provides guidance on the elevation of criticality controls to the DSA. The assumptions upon which the established criticality limits and controls directly depend such that changes to the assumptions would necessitate changes to the limits and controls shall be documented in this section of the CSE. Documented assumptions shall be supported by appropriate bases. Assumptions may include safety management programs or administrative systems relied upon by the analysis. 3.7 SUMMARY AND CONCLUSIONS (RECOMMENDED) The overall criticality safety assessment of the system being analyzed may be summarized in this section of the CSE. The range of applicability, unique requirements, and special limitations in the evaluation may be documented here. 3.8 LIST OF CITED REFERENCES This is a list of references cited in the CSE. 3.9 APPENDICES (RECOMMENDED) Appendices in the CSE should be used to provide detailed information that would impair readability of the CSE if it was included in the main body of the process analysis. Appendices may also be used to capture references not readily retrievable, such as the content of personal communications, letters, e- mails, and information from websites. If computer code systems are used to model process conditions, and the description in the body of the CSE is not sufficiently detailed to recreate the code input files, sample input files should be included in an appendix. DOE-STD-3007-2017 11 4. EVALUATING DESIGN BASIS EVENTS DOE Order 420.1C, Facility Safety, Attachment 2, Chapter III, Paragraph 3(f) states: Criticality safety evaluations must show that entire processes involving fissionable materials will remain subcritical under normal and credible abnormal conditions, including those initiated by design basis events.

The first portion of the requirement is a paraphrase of the Process Analysis Requirement contained in ANSI/ANS-8.1-2014, Section 4.1.2 that states: Before a new operation with fissionable material is begun, or before an existing operation is changed, it shall be determined that the entire process will be subcritical under both normal and credible abnormal conditions. The Process Analysis Requirement of ANSI/ANS-8.1-2014 focuses on fissionable processes within a facility. DOE Order 420.1C adds an additional requirement regarding abnormal conditions “including those initiated by design basis events.” Some design basis events/accidents, such as a fire incident, may be within a facility, and the CSE would normally evaluate the potential changes in process conditions associated with facility fire protection features (e.g., water sprinklers). Other design basis events include NPH events (e.g., high winds) that may cause catastrophic damage. In either case, design basis events are typically postulated to be initiating events that provide a common cause impact to many facility features. The concept of “design basis events” is not explicitly addressed within the ANSI/ANS-8 series of standards under the process analysis requirement. At facilities where design basis events have not been identified (often due to the age of the facility), representative evaluation basis events are identified and evaluated for purposes of determining safety classification of controls. For the purpose of this standard, design basis accidents and evaluation basis accidents will be referred to as “design basis events.” 4.1 IDENTIFYING THE DESIGN BASIS EVENTS DOE-STD-3009-2014 defines “design basis accidents” as: Accidents explicitly considered as part of the facility design for a new facility (or major modifications) for the purpose of establishing functional and performance requirements for safety class and/or safety significant controls. The functional and performance requirements become part of the set of requirements that bound the design of structures, systems, and components (SSCs) within the facility. A CSE of the design basis events should, therefore, establish the appropriate functional and performance requirements for SSCs important to NCS. Documentation of the functional and performance requirements for SSCs important to criticality safety may be in individual CSEs or in a facility level evaluation. Typical design basis events that should be considered for impact on criticality safety are fires, energetic events such as explosions, seismic events, wind, tornado, and hurricane events, external flood events, precipitation events, and aircraft crash events. DOE-STD-3007-2017 12 4.2 DESIGN BASIS NPH EVENTS DOE-STD-1020-2016, or successor document, identifies the types of NPH events to be evaluated and establishes NPH design categories (NDC). The selection of the NDC for each type of event is based upon the unmitigated consequences (see Section 6.1) when subjected to NPH events. The design basis NPH events for SSCs relied on for criticality safety are established in the same way that they are for all other radiological hazards, based on consequences alone using Table 2-1 in DOE-STD-1020-2016. In general, the radiological consequences of a nuclear criticality accident would typically result in NDC-1 or NDC-2 for a DOE non-reactor nuclear facility. In addition to the selection of the NDC, an appropriate limit state is established as part of the seismic performance criteria. DOE-STD-1020-2016 defines limit state as:

The limiting acceptable condition of the SSC. The limit state may be defined in terms of a maximum acceptable displacement, strain, ductility, or stress. Four limit states are specified in ASCE/SEI 43-05: A = Short of collapse, but structurally stable B = Moderate permanent deformation C = Limited permanent deformation D = Essentially elastic SSCs relied upon to ensure subcriticality for a seismic event are assigned a limit state depending upon the tolerance for the degree of damage due to a seismic event. For example, Limit State C may be assigned to SSCs that may tolerate minor permanent spacing distortion and remain subcritical; Limit State D may be assigned to SSCs that cannot be allowed to leak fissionable solution to an unfavorable geometry. A criticality process analysis should identify SSCs that must perform their safety functions to prevent a criticality accident during and after a design basis NPH. The analysis of the NPH design basis event may be performed in accordance with the ANSI/ANS-8 series of standards. In cases dealing with design basis NPH initiators, qualitative engineering judgment, amenable to peer review, is sufficient to fulfill the ANSI/ANS-8.1 process analysis requirement. The level of depth of the NPH analysis is limited by guidance contained in ANSI/ANS-8.1, Nuclear Criticality Safety in Operations with Fissionable Materials Outside Reactors, Appendix B, which states: The intent of this requirement is to protect the safety of the worker and the public during operations with fissionable material. One aspect of meeting the PA requirement is reconciling the phrase “credible abnormal conditions” with Sec. 1, which states “Good safety practices should recognize economic considerations, but the protection of operating personnel and the public is the dominant consideration.” * * * The word “credible” is not defined in the standard but relies on the judgment of the key professionals involved (nuclear criticality safety staff, operations supervisors, etc.) to determine DOE-STD-3007-2017 13 the credible abnormal conditions for a particular fissionable material operation. The abnormal conditions that are deemed credible can differ from process to process and from site to site. Elimination of all risk is not possible; the goal is to ensure an acceptably low level of risk to workers and the public. Resources expended in the control of criticality accident risks should be consistent with those applied to the control of other hazards with similar consequences. DOE application of this guidance is that the CSE shall not analyze an unrealistic NPH scenario that is constructed to achieve a critical configuration (i.e., a “smart” event). Such an unrealistic scenario may lead to design requirements or administrative controls inconsistent with the controls for other hazards of similar consequences. Specific guidance on the performance of NCS NPH evaluations is as follows: • The design of the building structure to the appropriate NDC and Limit State (for seismic) may be sufficient to ensure protection of NCS SSCs for the majority of the NPH events (high winds, tornados, hurricanes, external floods, and precipitation events), and therefore will ensure subcriticality. If so, detailed evaluations of NCS SSCs for such events are not normally required. • The assignment of a Limit State for individual NCS SSCs is dependent on the need for the SSC to perform its NCS safety function during and after the NPH event.

• Failure of SSCs beyond the appropriate NDC and Limit State is considered a “beyond design basis accident,” and is therefore not considered a credible abnormal event in application of the ANS-8 series of standards. • The evaluation of an NPH event does not include assuming a concurrent abnormal condition (such as a fissionable mass over batch) unrelated to the NPH event. That is, other process conditions should be assumed to be normal when an NPH event occurs. • Common cause failures and seismic system interactions shall be considered.9 The associated NCS SSCs shall be assumed to perform to their NDC and Limit State. 4.3 OTHER DESIGN BASIS EVENTS Specific guidance on the NCS analysis of design basis events other than NPH is as follows: • As already noted, the CSE shall not analyze an unrealistic design basis scenario that is specifically constructed to achieve a critical configuration or that postulates failure of a design basis barrier. For example, a hypothetical full-facility fire may be postulated in the DSA for purposes of determining the bounding radiological release. For a CSE, postulating a significant fire that causes loss of SSC integrity or structural damage is not warranted if the design of the facility and the associated fire hazards do not lead to a credible abnormal condition resulting from such a fire. • The combination of an unlikely design basis event and the subsequent unlikely series of events necessary to reach the critical state may be sufficient to meet the intent of the process analysis requirement. 9 DOE-STD-1020-2016 states: “The methods to address common-cause failure and system interaction as presented in ANSI/ANS-2.26-2004 (R2010) should be followed for design basis NPH events.” DOE-STD-3007-2017 14 • Non-combustible building structures and SSC design features may contribute to the basis of the design basis event being unlikely or less frequent. As an example, a building designed to NFPA codes may reduce the likelihood of ignition sources and minimize in-situ combustibles such that a significant fire is determined to be unlikely or not credible. • SSCs designed to applicable industry standards can be relied upon to prevent or mitigate the design basis event even though the SSCs are not functionally classified as safety significant or safety class. For example, a fire sprinkler system designed to requirements according to DOE- STD-1066-2016, Fire Protection, may be relied upon to control smaller fires from becoming large fires of concern. 5. NEEDS ANALYSIS FOR CRITICALITY ACCIDENT ALARM SYSTEMS ANSI/ANS-8.3-1997 requires that the need for a CAAS be evaluated if the inventory of fissionable materials exceeds specified amounts. The installation of an alarm system implies a nontrivial risk of criticality10 and would generally reduce the overall consequence to the worker. A nontrivial risk of criticality accident should be considered to exist in facilities whose inventory exceeds the specified threshold levels in ANSI/ANS-8.3-1997 and where a criticality accident is credible for a process or processes with fissionable materials in the facility. Input from appropriate technical disciplines such as criticality safety, facility safety, operations, emergency preparedness, and radiation protection is important when developing the needs analysis. The needs analysis should be simple. It may be presented in the criticality safety program description that is required by DOE O 420.1C, or successor document. The needs analysis and system design include consideration of specific hazards associated with a CAAS alarm response.

It is possible for some operations that an impulsive response to a CAAS alarm may cause another type of risk. For example, assume that workers involved in a high-hazard operation are located in an area safe from criticality events due to distance or shielding. An alarm actuation in this case might have two adverse effects. First, it may startle workers carrying out the hazardous operations, causing an accident. Second, it may cause workers to flee the safe area to evacuate, and inadvertently enter a high radiation field. In such cases, it may be preferable to have a local immediate alarm notify the workers handling fissionable materials, followed by a well-planned and disciplined emergency response for the rest of the facility. In this case, a portable criticality accident detector and alarm system and the full suite of detection and annunciation options may together be credited for providing worker safety. Documenting the basis for removal of a CAAS, whether fixed, permanent, temporary, portable, or transportable, from existing facilities may address removal in the same terms of the overall risk and benefit of such a system as discussed above. For a CAAS removal evaluation, a thorough facility characterization detailing the quantity, form, and distribution of fissionable material in the facility should be performed. The potential fissionable material holdup in a facility should be addressed to support that the CAAS is not required. Operating personnel or facility experts with direct knowledge of operations spanning the full-life cycle of the facility is another important source of information when documenting the basis for removal. Documentation relevant to facility operations and off-normal events is especially 10 See ANSI/ANS-8.3-1997, Section 4.1.1. DOE-STD-3007-2017 15 important when personnel with direct knowledge of past operations are not available. A thorough characterization includes a description of: • the operating history of the facility sufficient to support conclusions about the presence or absence of fissionable materials in various locations; • previous occurrences or abnormal conditions, particularly those that may have left significant quantities of fissionable materials in unexpected locations; • current material inventories, including all accountable fissionable material, inventory differences, and comprehensive fissionable material assays; and • assay methods used, their accuracy, potential weaknesses, comprehensiveness of the assays, and the meaning of any stated uncertainties. An analysis showing that there is a trivial risk of a criticality accident and thus a CAAS is not required cannot rely on simplistic formulas for the numbers of controls or contingencies in place.11 Justification for concluding a trivial risk of a criticality accident should address the total aggregate risk to personnel from a criticality accident in the facility. 6. INTERFACE BETWEEN THE CSE AND THE DSA Appendix A to Subpart B of 10 CFR Part 830 requires the establishment of a safety basis for Hazard Category 1, 2, or 3 DOE nuclear facilities. This requirement involves the performance of a hazard analysis and the generation of a DSA. Appendix A to Subpart B of Part 830 recognizes DOE-STD-3009- 2014, Preparation of Nonreactor Nuclear Facility Documented Safety Analysis, as a successor document of DOE-STD-3009, Change Notice 1, 2000, as an acceptable method for the preparation of DSAs. DOE- STD-3009-2014 in turn recognizes DOE-STD-3007-2007 and the ANSI/ANS-8 series of standards as an acceptable means to perform the hazards analysis for NCS.12 Finally, use of DOE-STD-3007-2007 is identified by DOE O 420.1C, or successor document, as an acceptable standard to use for performing CSEs.

The CSE process, compliant with ANSI/ANS-8.1, evaluates the normal and credible abnormal conditions associated with a fissionable material operation, and identifies the controls necessary for the operation to remain safely subcritical. However, the CSE process does not include an evaluation to determine functional classification of controls. The functional classification determination is part of the process established by DOE-STD-3009-2014. The CSE is an input to the DSA on NCS-related SSCs that may 11 An example of a simplistic formula would be defining as not-credible a particular number of concurrent contingencies or concurrent control failures. 12 Other safe harbor methods such as DOE-STD-3011-2016, Preparation of Documented Safety Analysis for Interim Operations at DOE Nuclear Facilities, and DOE-STD-1120-2016, Preparation of Documented Safety Analysis for Decommissioning and Environmental Restoration Activities, rely on a tailored application of provisions from DOE- STD-3009-2014 for the DSA hazards analysis, which also applies to hazards analysis for nuclear criticality safety if applying this version of DOE-STD-3007. DOE-STD-3009-94, Chg. Notice 3 may also be the safe harbor implemented. Site specific application of the tie between this version of DOE-STD-3007 and the safe harbor method implemented at a nuclear facility may be made in the Criticality Safety Program document required by DOE O 420.1C, Attachment 2, Chapter III. DOE-STD-3007-2017 16 need to be designated as safety significant or safety class. Although such determinations are not part of the CSE process, the strong interface between the CSE and the DSA warrants amplifying guidance on determining which NCS controls are candidates for further evaluation under DOE-STD-3009-2014. 6.1 SELECTION OF CANDIDATE NCS SSCS FOR INCLUSION IN THE DSA Section 3.1.3.2 of DOE-STD-3009-2014 states: In addition, the DSA hazard evaluation shall include: • Events where consequences (from the criticality itself or subsequent impact to hazardous material) exceed the high radiological consequence thresholds for either the co-located workers or the MOI in Table 1, unless it has been determined that an unmitigated criticality accident is not credible; and • Situations where an active engineered control(s) is required by the Nuclear Criticality Safety (NCS) analysis to ensure subcriticality. If the NCS program requires a criticality accident alarm system, then the criticality accident alarm system shall be discussed in the hazard evaluation and carried forward to evaluation in accordance with Section 3.3 of this Standard. The above bullets do not specifically identify administrative controls, because administrative controls are generally considered the least reliable type of controls, and therefore, the least preferable method to ensure subcriticality. While most administrative controls are defense-in-depth measures, those administrative controls relied upon to prevent criticality accidents where consequences exceed dose thresholds for either the co-located worker or the Maximally-Exposed Offsite Individual should be considered for elevation to specific administrative controls in the DSA. Sections 2.1 and 4 of DOE-STD-3009-2014 identify as a DSA task to “summarize” criticality safety. The information to be included in Chapter 3 of the DSA does not need to capture all of the information contained in a CSE that elevates controls to the DSA. A summary of the CSE that provides a high-level basis for the associated controls to be evaluated in the DSA should be all that is necessary. The subsequent evaluation of NCS SSCs for functional classification is then performed in accordance with DOE-STD-3009-2014.

Additional guidance on the three conditions listed above from DOE-STD-3009-2014 follows. 6.1.1 EXCEEDING DOSE THRESHOLDS Unmitigated13 consequence analyses shall be performed as part of the safety analysis process to determine the total effective dose consequences associated with a credible, representative criticality accident. The consequence analysis results are used to establish design criteria for design basis accidents and to give guidance for functional classification of controls (i.e., safety significant and safety class). DOE-STD- 13 “Unmitigated” here means assuming that limits and controls from a process analysis have not been implemented. DOE-STD-3007-2017 17 3009-2014, or successor document, identifies requirements associated with performing such an analysis, which is typically performed by facility safety analysts. The NCS engineer should provide information to the facility safety analyst on the types of criticality accidents that are credible so that a representative criticality accident can be established for the purposes of calculating dose consequences. Criticality accident dose consequences are not part of the CSE process analysis or contained in the CSE. In general, the consequences of a criticality accident are limited to facility workers, which limits the representative accident scenarios to be addressed in the DSA. However, the very rare case that a credible representative criticality accident exceeding the total effective dose thresholds to the co-located worker or the public specified in DOE-STD-3009-2014, or successor document, is identified, the NCS control strategy documented in the CSE should be used to identify SSCs (preferable) or SACs (least preferred) that need to be considered for safety significant or safety class designation. The process to decide which criticality controls are candidates for inclusion in the DSA may be combined with the process for selecting controls for criticality accidents exceeding dose thresholds. The NCS and safety analysis staff should have input into this process. The following guidance should be considered when selecting NCS SSCs for further evaluation in the DSA based on exceeding of DOE-STD-3009- 2014, or successor document, dose thresholds for the co-located worker or the public. (“high dose accidents”). • Features in the process that provide significant contribution to the cause of a high dose accident should be considered. Large excursions are typically associated with large-volume systems or systems that may have high reactivity addition rates. SSCs that may prevent or mitigate large excursions should be candidates for functional classification evaluation in the DSA. For example, fissionable solution transfer systems may have functional requirements that limit the reactivity addition through limited transfer rates. Another example is shielding that mitigates the dose to the worker. • If the high dose accident is due to a slow excursion that occurs over a long period of time where the pulses are not significantly higher than typical process accidents, then the selection of active engineered features and/or the CAAS may be sufficient for these accidents. Personnel doses associated with long duration types of events may be mitigated through evacuation initiated by a CAAS or by shielding provided by the building structure.

• The most robust SSCs that are instrumental in the NCS control strategy should be the preferred SSCs to be evaluated in the DSA. One purpose of the DSA evaluation is to select reliable controls for elevation to safety class or safety significant. Passive design features that ensure subcriticality are generally the most reliable SSCs as NCS controls and should be considered for DSA evaluation in addition to active engineered controls. 6.1.2 ACTIVE ENGINEERED CONTROLS Active engineered controls require routine surveillances, calibrations, and testing to ensure reliability and operability. Therefore, active engineered controls credited for ensuring subcriticality shall be candidates for evaluation in the DSA to see if a functional classification of safety significant or safety class are warranted. DOE-STD-3007-2017 18 6.1.3 CRITICALITY ACCIDENT ALARM SYSTEM If a facility has a criticality accident alarm system, the system shall be evaluated in the DSA for further functional classification. In some cases, a criticality accident alarm system may not be required because of “trivial risk.” (See Section 5 for additional guidance on CAAS related risk determinations.) 6.2 CONSIDERATIONS FOR DESIGNATION OF SSCS AS SAFETY SIGNIFICANT OR SAFETY CLASS DOE-STD-3009 requires unmitigated analysis of all plausible process-related hazards (i.e., operational accidents). DOE-STD-3009-2014 defines the term “plausible” and establishes that the use of a lower binning threshold such as 10-6/year by itself is not appropriate to dismiss the evaluation of physically possible, low probability operational accidents. The concept of “credible” in this standard is consistent with ANS-8.1, which specifically does not define the term “credible” but describes it qualitatively (ANS- 8.1, Appendix B.2). The concept of “credible” is not tied to a numerical probability, and it may or may not meet the concept of “plausible” as defined in DOE-STD-3009-2014. Therefore, the selection of controls for hazard scenarios involving criticality events that are to be elevated to the DSA for functional classification determination should be performed jointly between NCS and nuclear facility safety staff to ensure the intent of DOE requirements are met. Although an SSC may be identified per the criteria in Section 6.1 for evaluation in the DSA, it may or may not be elevated to safety significant or safety class. The DSA process will evaluate the SSC along with other layers of protection to ascertain if the SSC will be carried forward as safety significant or safety class. The CSE is the technical basis that provides the information necessary to make that determination. If the SSC is one of multiple layers of protection as part of the defense-in-depth strategy, the SSC may not need to be carried forward as safety significant or safety class. It may be sufficient to identify the SSC as defense-in-depth and part of the NCS strategy in the DSA, thereby protecting the SSC through the Unreviewed Safety Question process. If the SSC is a significant aspect of the NCS control strategy, then a safety significant or safety class designation may be appropriate. 6.3 DOCUMENTATION OF SSCS INCLUDED IN THE DSA

There is no prescribed or preferred method to document the basis for elevation of SSCs to the DSA. Two possible options that may be used for documenting the basis for elevation are the CSE itself or a “Criticality Control Review” (CCR) document. The CCR is a document summarizing the basis for elevating SSCs to the DSA on a broader scope than an individual CSE. Either method, or a site-specific alternate method, is acceptable. The method used should be identified in the criticality safety program description document to obtain DOE approval or concurrence. DOE-STD-3007-2017 19 Supporting information derived from the CSE that is useful in performing a functional classification determination in the DSA includes: • A summary of the fissionable operation • A summary of the NCS control strategy for that operation • The safety function of the SSC • The functional requirement of the SSC • The performance criteria of the SSC 7. REFERENCES 10 CFR Part 830, Nuclear Safety Management, Subpart B, Safety Basis Requirements ANSI/ANS-8.1-2014, Nuclear Criticality Safety in Operations with Fissionable Materials Outside Reactors ANSI/ANS-8.3-1997, Criticality Accident Alarm System ANSI/ANS-8.10-2015, Criteria for Nuclear Criticality Safety Controls in Operations with Shielding and Confinement ANSI/ANS-8.19-2014, Administrative Practices for Nuclear Criticality Safety ANSI/ANS 8.24-2007, Validation of Neutron Transport Methods for Nuclear Criticality Safety Calculations DOE Order 420.1C, Change 1, Facility Safety DOE-STD-1020-2016, Natural Phenomena Hazards Analysis and Design Criteria for DOE Facilities DOE-STD-1066-2016, Fire Protection DOE-STD-1120-2016, Preparation of Documented Safety Analysis for Decommissioning and Environmental Restoration Activities DOE-STD-3009-2014, Preparation of Nonreactor Nuclear Facility Documented Safety Analysis DOE-STD-3011-2016, Preparation of Documented Safety Analysis for Interim Operations at DOE Nuclear Facilities DOE-STD-3007-2017 A-1 APPENDIX A. COMMONLY USED HANDBOOKS AND CALCULATIONAL METHODS The following list of handbooks and guidance documents is not exhaustive. Additional documents are identified on the DOE Nuclear Criticality Safety Program website (http://ncsp.llnl.gov/ncspMain.html). Some of the referenced documents give both limits and calculational methods. All are considered acceptable for use in performing a process analysis for criticality safety in DOE facilities. The “Review of Criticality Accidents is included” because accident descriptions and analyses are instructive in avoiding future accidents. Reference No. Title Author Date PNNL-19176 Anomalies of Nuclear Criticality Clayton February 2010 LA-3366 Criticality Control in Operations with Fissile Material Paxton November 1972 LA-13638 A Review of Criticality Accidents McLaughlin, et al. 2000 Revision LA-14244-M Hand Calculation Methods for Criticality Safety - A Primer Bowen & Busch November 2006 NUREG/CR-0095 ORNL/NUREG/CSF-6 The Nuclear Safety Guide TID-7016, Rev. 2 Thomas June 1978 LA-12808 Nuclear Safety Guide Pruvost & Paxton September, 1996 TID 7028 Critical Dimensions of Systems Containing 235U, 239Pu, and 233U Paxton et al. June 1964 LA-10860-MS Critical Dimensions of Systems Containing 235U, 239Pu, and 233U, 1986 Revision Paxton & Pruvost July 1987 LA-11627-MS Glossary of Nuclear Criticality Terms Paxton October 1989 ARH-600 Criticality Handbook, Volumes I, II, & III (see also http://ncsp.llnl.gov/ARH- 600/index.htm)

Carter, et al. June 1968 ICSBEP Handbook International Handbook of Evaluated Criticality Safety Benchmark Experiments Electronic Edition released Annually (see NCSP.llnl.gov) http://ncsp.llnl.gov/ncspMain.html 1. Introduction 1.1 Scope 1.2 Applicability 1.3 Background 1.4 Overview of the Standard 1.5 Terminology (SHALL, SHOULD, AND MAY) 1.6 Definitions 2. Responsibilities 3. Content Requirements For Criticality Safety Evaluations 3.1 Introduction (recommended) 3.2 Description 3.3 Unique or Special Requirements (Recommended) 3.4 Methodology And Validation 3.4.1 Methodology 3.4.2 Validation 3.5 Process Analysis 3.5.1 General Guidance and Requirements 3.5.2 Process Analysis Sequence 3.6 Summary of Controls And Assumptions 3.7 Summary And Conclusions (Recommended) 3.8 List of Cited References 3.9 Appendices (Recommended) 4. Evaluating Design Basis Events 4.1 Identifying the Design Basis Events 4.2 Design Basis NPH Events 4.3 Other Design Basis Events 5. Needs Analysis for Criticality Accident Alarm systems 6. Interface Between the CSE and the DSA 6.1 Selection of Candidate NCS SSCs for Inclusion in the DSA 6.1.1 Exceeding Dose Thresholds 6.1.2 Active Engineered Controls 6.1.3 Criticality Accident Alarm System 6.2 Considerations for Designation of SSCs as Safety Significant or Safety Class 6.3 Documentation of SSCs included in the DSA 7. REFERENCES Appendix A. Commonly Used Handbooks and Calculational Methods