Criticality Safety Evaluations (CSEs)
undefined
C
r
i
t
i
c
a
l
i
t
y
S
a
f
e
t
y
E
v
a
l
u
a
t
i
o
n
s
(
C
S
E
s
)
J
a
s
o
n
M
.
C
r
y
e
,
P
h
D
NCS Engineer
1
C
h
r
i
s
H
a
u
g
h
t
Chief NCS Engineer
O
u
t
l
i
n
e
•
Purpose
•
Safety Criteria
•
Typical Steps
•
Other Considerations
2
P
u
r
p
o
s
e
s
o
f
C
r
i
t
i
c
a
l
i
t
y
S
a
f
e
t
y
E
v
a
l
u
a
t
i
o
n
s
•
To demonstrate that the operation is adequately subcritical:
•
under normal operating conditions
•
under contingent (upset) conditions
•
To demonstrate that the operation meets ANSI/ANS-8.1 and
-8.19 safety criteria
•
To derive limits and controls that ensure the above
conclusions and bases are valid
•
To communicate to other analysts
•
To convince regulators that the above conclusions and
bases are acceptable
3
4
O
N
E
B
A
S
I
C
S
A
F
E
T
Y
C
R
I
T
E
R
I
O
N
F
r
o
m
A
N
S
I
/
A
N
S
-
8
.
1
(
§
4
.
1
.
2
)
a
n
d
-
8
.
1
9
(
§
7
.
1
)
,
P
r
o
c
e
s
s
A
n
a
l
y
s
i
s
(
P
A
)
Before a new operation with fissionable material is
begun, or before an existing operation is changed,
it
shall
be determined that the entire process will
be subcritical under both normal and
credible
abnormal conditions.
P
r
o
c
e
s
s
A
n
a
l
y
s
i
s
(
P
A
)
R
e
q
u
i
r
e
m
e
n
t
•
Abnormal conditions may include:
•
A change in shape or dimensions
•
Increase in mass of fissile material
•
A change in concentration of fissile material in solution
•
A reduction in the quantity of neutron absorber
•
An increase in reflection
•
An increase in interaction
•
Physiochemical condition changes (boiling, precipitation, significant
temperature reduction from cryogenic fluids, etc.)
5
P
r
o
c
e
s
s
C
o
n
d
i
t
i
o
n
s
:
“
T
h
e
i
d
e
n
t
i
f
y
i
n
g
c
h
a
r
a
c
t
e
r
i
s
t
i
c
s
o
f
a
p
r
o
c
e
s
s
t
h
a
t
h
a
v
e
a
n
e
f
f
e
c
t
o
n
n
u
c
l
e
a
r
c
r
i
t
i
c
a
l
i
t
y
s
a
f
e
t
y
”
P
r
o
c
e
s
s
A
n
a
l
y
s
i
s
R
e
q
u
i
r
e
m
e
n
t
A
l
l
c
r
e
d
i
b
l
e
a
b
n
o
r
m
a
l
c
o
n
d
i
t
i
o
n
s
?
•
Identification of credible abnormal conditions is crucial
•
Be aware that no process criticality accident occurred as a
result of an erroneous calculation; many occurred as a
result of a fault pathway that was not previously identified
•
A thorough understanding of the process or activity is key
to ensuring an adequate control set is developed
•
A defense in depth philosophy is needed for prevention of
nuclear criticality accidents
•
More to follow on defense in depth
6
7
N
O
T
E
:
A
N
S
I
/
A
N
S
-
8
.
1
d
o
e
s
n
o
t
d
e
f
i
n
e
“
c
r
e
d
i
b
l
e
”
o
r
o
t
h
e
r
i
m
p
o
r
t
a
n
t
t
e
r
m
s
When ANSI standards use such terms without
specific definition within the standard, the
meaning of the terms is as defined by ordinary
English usage (i.e., what Webster’s or other
standard dictionary definitions state).
But “credible” is discussed in the new Appendix
B…
P
r
o
c
e
s
s
A
n
a
l
y
s
i
s
R
e
q
u
i
r
e
m
e
n
t
H
o
w
t
o
a
p
p
l
y
c
r
e
d
i
b
l
e
?
•
Reconciling “credible abnormal conditions” with “economic
considerations” and “protection of operating personnel and
the public” is part of applying the Process A analysis
requirement
•
Cosmic impact? Major earthquake? Airplane crash?
•
“…relies on the judgment of the key professionals…”
•
“…can differ from process to process and site to site”
•
“Elimination of all risk is not possible”
•
Resources expended for NCS control should be
commensurate with other hazards of similar consequences
(paraphrased)
8
P
r
o
c
e
s
s
A
n
a
l
y
s
i
s
R
e
q
u
i
r
e
m
e
n
t
T
o
m
e
e
t
t
h
e
P
r
o
c
e
s
s
A
n
a
l
y
s
i
s
r
e
q
u
i
r
e
m
e
n
t
:
•
Combinations of upset conditions should be considered.
•
Rarely does occurrence of a single upset condition yield a criticality
scenario. (Most criticality accidents result from multiple failures.)
•
However, one event might affect multiple process conditions
•
Examples: fire, violent chemical reactions, explosions, flood
9
I
f
t
h
e
c
o
m
b
i
n
a
t
i
o
n
o
f
m
u
l
t
i
p
l
e
u
p
s
e
t
c
o
n
d
i
t
i
o
n
s
i
s
c
r
e
d
i
b
l
e
a
n
d
p
r
e
s
e
n
t
s
t
h
e
p
o
s
s
i
b
i
l
i
t
y
o
f
a
c
r
i
t
i
c
a
l
i
t
y
a
c
c
i
d
e
n
t
,
t
h
e
n
t
h
e
o
p
e
r
a
t
i
o
n
b
e
i
n
g
e
v
a
l
u
a
t
e
d
d
o
e
s
n
o
t
m
e
e
t
t
h
e
b
a
s
i
c
s
a
f
e
t
y
c
r
i
t
e
r
i
o
n
o
f
A
N
S
-
8
.
1
4
.
1
.
2
.
10
A
N
O
T
H
E
R
B
A
S
I
C
S
A
F
E
T
Y
C
R
I
T
E
R
I
O
N
F
r
o
m
A
N
S
I
/
A
N
S
-
8
.
1
,
§
4
.
2
.
2
D
o
u
b
l
e
-
c
o
n
t
i
n
g
e
n
c
y
P
r
i
n
c
i
p
l
e
(
D
C
P
)
P
r
o
c
e
s
s
d
e
s
i
g
n
s
s
h
o
u
l
d
i
n
c
o
r
p
o
r
a
t
e
s
u
f
f
i
c
i
e
n
t
f
a
c
t
o
r
s
o
f
s
a
f
e
t
y
t
o
r
e
q
u
i
r
e
a
t
l
e
a
s
t
t
w
o
u
n
l
i
k
e
l
y
,
i
n
d
e
p
e
n
d
e
n
t
,
a
n
d
c
o
n
c
u
r
r
e
n
t
c
h
a
n
g
e
s
i
n
p
r
o
c
e
s
s
c
o
n
d
i
t
i
o
n
s
b
e
f
o
r
e
a
c
r
i
t
i
c
a
l
i
t
y
a
c
c
i
d
e
n
t
i
s
p
o
s
s
i
b
l
e
.
D
o
u
b
l
e
C
o
n
t
i
n
g
e
n
c
y
P
r
i
n
c
i
p
l
e
(
D
C
P
)
•
DCP does not limit changes in process conditions to only
those that are considered credible
•
DCP does establish a lower limit on expected frequency of
such changes: unlikely
•
Typically considered once in 100 years (10
-2
probability) or once in the
lifetime of a facility
•
What about changes in process conditions expected to occur more
frequently?
11
D
o
u
b
l
e
C
o
n
t
i
n
g
e
n
c
y
P
r
i
n
c
i
p
l
e
•
More on “Double”
•
Not two contingencies! There will most likely be numerous upsets to
consider.
•
Not two controls! Maybe only a few NCS controls are needed.
Maybe scores of controls are needed. This is determined by the
analysis, not the Double Contingency Principle.
•
Two layers of defense? Maybe two, maybe more. Again,
determined by the analysis.
•
So, how many controls are needed?
•
“…sufficient factors of safety…”
12
D
o
u
b
l
e
C
o
n
t
i
n
g
e
n
c
y
P
r
i
n
c
i
p
l
e
•
Historically, regulatory agencies have required that “double
contingency” be implemented as a requirement, without full
understanding by regulation authors of:
•
the original intent, or
•
the difficulty in truly meeting double contingency for many categories
of fissile operations.
13
D
o
u
b
l
e
C
o
n
t
i
n
g
e
n
c
y
P
r
i
n
c
i
p
l
e
•
Why isn’t the Double Contingency Principle a requirement?
•
There are situations where consequence mitigation minimizes the
need for defense in depth (e.g. shielded facilities or underground
tanks)
•
Single barriers that are sufficiently robust (e.g. LEU UF
6
cylinders)
•
Credibility of a single change in process conditions (mass of a single
HEU item)
•
It is difficult if not impossible to verify (subjective rule)
14
D
C
P
H
i
s
t
o
r
i
c
a
l
P
e
r
s
p
e
c
t
i
v
e
L
A
-
2
0
6
3
,
1
9
5
6
L
A
-
3
3
6
6
,
1
9
6
4
15
D
C
P
a
n
d
N
u
c
l
e
a
r
P
a
r
a
m
e
t
e
r
s
D
C
P
R
e
q
u
i
r
e
M
u
l
t
i
p
l
e
P
a
r
a
m
e
t
e
r
C
o
n
t
r
o
l
?
•
“Nuclear Parameters” – MAGIC MERV
•
DCP recommending control of at least two independent
parameters has historically been an unofficial interpretation
(i.e. not an official ANSI interpretation)
•
No longer required by DOE
•
ANSI/ANS-8.1 2014 version provides some clarification…
16
D
C
P
a
n
d
N
u
c
l
e
a
r
P
a
r
a
m
e
t
e
r
s
D
C
P
i
n
A
N
S
-
8
.
1
-
2
0
1
4
,
A
p
p
e
n
d
i
x
B
•
“…does not refer to parameters or controls…”
•
“The phrases ‘multiple controls on a single parameter’ or
‘multiple parameter control’ have no bearing on whether
DCP is properly satisfied.”
•
The appendix suggests that crediting “multiple independent
controls to prevent a single change in process conditions” is
acceptable for complying with PA but not compliant with
DCP
•
DCP does not address credibility of “unlikely” changes
17
M
y
P
e
r
s
p
e
c
t
i
v
e
o
n
D
C
P
•
Goals
•
Defense in Depth
•
Diversity of Controls (such that one change is not expected to affect
all controls)
•
Practicality
•
Control of two independent parameters may be effective for
demonstrating subcriticality, but may lead to controls being out of
balance with other similar hazards (safe mass and safe geometry?)
•
Overall protection of the worker should guide application of DCP
18
A
N
S
I
/
A
N
S
-
8
.
1
9
R
e
q
u
i
r
e
m
e
n
t
s
•
Requires PA
•
Credible abnormal determined with input from
knowledgeable individuals
•
Evaluation determine/identify controlled parameters and
their limits
•
Evaluation documented w/sufficient “detail, clarity, and lack
of ambiguity” to allow for “independent judgment” of results
•
Reviewer familiar with NCS and operations
19
A
N
S
I
/
A
N
S
-
8
.
1
9
R
e
c
o
m
m
e
n
d
a
t
i
o
n
s
•
NCS staff performing evaluation observe relevant
equipment, activities, and practices
•
Supervisor responsible for operation confirm normal and
credible abnormal conditions; derived requirements are
verifiable and compatible with operation
20
C
r
i
t
i
c
a
l
i
t
y
S
a
f
e
t
y
E
v
a
l
u
a
t
i
o
n
s
(
C
S
E
s
)
21
Normal
Conditions
Credible
Abnormal
Conditions
Criticality
Accident
Possible
.
.
.
Contingencies
Must be unlikely, independent
(
s
e
l
f
-
e
v
i
d
e
n
t
)
,
a
n
d
s
u
b
c
r
i
t
i
c
a
l
.
.
.
Barrier Analysis
T
y
p
i
c
a
l
P
A
Whether or not documented,
analyst must understand where
criticality is possible
22
T
y
p
i
c
a
l
P
r
o
c
e
s
s
F
o
r
D
e
v
e
l
o
p
m
e
n
t
o
f
C
S
E
s
(See Note)
Note: this step is a formality; users should be involved during the development
P
a
r
t
A
r
t
,
P
a
r
t
S
c
i
e
n
c
e
R
e
q
u
e
s
t
f
o
r
N
C
S
E
v
a
l
u
a
t
i
o
n
•
New or modified fissile material activity
•
Understand what is wanted
•
Understand what is needed
•
Sometimes, wants ≠ needs (operational flexibility vs. convenient
controls)
•
Sometimes, wants and needs change while the evaluation is being
developed.
•
Example
•
Multiple batches in a glovebox with controls on # containers, spacing,
lids on containers
•
One batch at a time limited by fissile material mass
23
U
n
d
e
r
s
t
a
n
d
i
n
g
t
h
e
P
r
o
c
e
s
s
/
A
c
t
i
v
i
t
y
M
o
s
t
i
m
p
o
r
t
a
n
t
s
t
e
p
!
R
e
s
e
a
r
c
h
,
S
t
u
d
y
,
a
n
d
L
e
a
r
n
•
Material characteristics (physical, chemical properties)
•
Process chemistry
•
Material flows (incoming, outgoing, flow rates, waste
streams, etc.)
•
Material unaccounted for (normal and abnormal equipment
holdup)
24
U
n
d
e
r
s
t
a
n
d
i
n
g
t
h
e
P
r
o
c
e
s
s
/
A
c
t
i
v
i
t
y
•
Research, Study, and Learn
•
Adjacent processes and operations (upstream, downstream, and
lateral)
•
Physical layout of equipment
•
Function of the equipment
•
Capability of the equipment
25
U
n
d
e
r
s
t
a
n
d
i
n
g
t
h
e
P
r
o
c
e
s
s
/
A
c
t
i
v
i
t
y
•
Talk to operators, engineers, NCS analysts
•
Ask what can go wrong
•
Review safety analyses (e.g. ISAs and DSAs)
•
Inspect the field, observe operations
•
Pore over drawings, read procedures
B
e
c
o
m
e
a
s
k
n
o
w
l
e
d
g
e
a
b
l
e
a
s
t
h
e
s
y
s
t
e
m
e
n
g
i
n
e
e
r
26
U
n
d
e
r
s
t
a
n
d
i
n
g
t
h
e
P
r
o
c
e
s
s
/
A
c
t
i
v
i
t
y
•
Remember, no accident has occurred as a result of an
erroneous calculation
•
Understanding the process/activity will provide a firm
foundation for the NCS evaluation
W
i
t
h
o
u
t
s
u
c
h
a
n
u
n
d
e
r
s
t
a
n
d
i
n
g
,
y
o
u
r
a
n
a
l
y
s
i
s
i
s
b
u
i
l
t
o
n
a
h
o
u
s
e
o
f
c
a
r
d
s
27
U
n
d
e
r
s
t
a
n
d
i
n
g
t
h
e
P
r
o
c
e
s
s
/
A
c
t
i
v
i
t
y
N
o
w
t
h
a
t
y
o
u
u
n
d
e
r
s
t
a
n
d
t
h
e
p
r
o
c
e
s
s
…
•
Document a description of the process
–
Include assumptions relevant to the evaluation
–
Discuss inputs – fissile materials, chemical reagents, materials of
construction, etc.
–
Discuss product and waste streams
28
U
n
d
e
r
s
t
a
n
d
i
n
g
t
h
e
P
r
o
c
e
s
s
/
A
c
t
i
v
i
t
y
D
e
s
c
r
i
p
t
i
o
n
o
f
t
h
e
p
r
o
c
e
s
s
•
Discuss physical changes
•
Discuss chemical reactions
•
Present the boundaries of the system
•
Discuss interfacing systems – ensure evaluations for these
systems properly consider materials from your process
•
Discuss utilities such as water, vacuum, or air
29
I
d
e
n
t
i
f
y
N
o
r
m
a
l
C
o
n
d
i
t
i
o
n
s
T
h
e
A
r
t
–
A
n
A
n
a
l
y
t
i
c
a
l
M
o
d
e
l
o
f
“
N
o
r
m
a
l
”
•
Normal conditions should bound actual conditions, plus…
•
Including process upsets not considered to be unlikely (e.g. minor
mass upsets)
•
Including process variability (e.g. fissile solution concentration or
powder density)
•
Ensure conservatism in NCS evaluation
•
Gain practical flexibility in operations (e.g. no NCS controls on
concentration or density)
30
W
h
y
i
s
a
“
n
o
r
m
a
l
”
c
o
n
d
i
t
i
o
n
a
n
a
l
y
s
i
s
n
e
e
d
e
d
?
•
Establish margin of safety.
•
In determining the normal condition is subcritical, the
important operational and process characteristics that
ensure subcriticality are defined.
•
e.g. limited fissile mass, dryness, low fissile concentration, etc.
•
Helps identify credible abnormal changes to the process/activity
31
I
d
e
n
t
i
f
y
C
o
n
t
i
n
g
e
n
t
C
o
n
d
i
t
i
o
n
s
U
n
l
i
k
e
l
y
C
r
e
d
i
b
l
e
A
b
n
o
r
m
a
l
C
o
n
d
i
t
i
o
n
=
C
o
n
t
i
n
g
e
n
c
y
•
What can go wrong (e.g. excess fissile mass)
•
How can it go wrong (e.g. container overloaded)
•
To what extent it can go wrong (e.g. volumetrically full with
some overflow)
•
A contingency is not simply a control failure
•
Important system attribute(s) must be affected
•
Example: lid left off container
32
I
d
e
n
t
i
f
y
C
o
n
t
i
n
g
e
n
t
C
o
n
d
i
t
i
o
n
s
T
h
e
A
r
t
–
A
n
a
l
y
t
i
c
a
l
M
o
d
e
l
s
f
o
r
C
o
n
t
i
n
g
e
n
c
i
e
s
•
Understand basic routes/sequences leading from normal
conditions to abnormal conditions
•
This is why you should be as knowledgeable as the cognizant system
engineer
•
This is why other knowledgeable individuals should review
•
Identify what can go wrong in physical space, such as an
addition of the wrong chemical reagent, operator inattention,
process temperature too high, etc.
33
I
d
e
n
t
i
f
y
C
o
n
t
i
n
g
e
n
t
C
o
n
d
i
t
i
o
n
s
•
Likelihood
•
If a scenario does not meet your judgment for unlikely, it should be
folded in with normal (e.g. small spill of fissile material)
•
Credible extent of upset must be established (e.g. degree overmass
or number of noncompliant containers in storage)
•
Beware of "single" events that affect multiple parameters
and controls
•
Flooding (reflection and moderation)
•
Fire (physical damage plus flooding)
34
E
v
a
l
u
a
t
e
C
o
n
d
i
t
i
o
n
s
T
h
e
S
c
i
e
n
c
e
•
NCS analysis – determining the system model is subcritical
•
Comparative analysis to critical experiments or guides based on
critical data
•
Reference to nuclear safety guides and standards
•
Hand calculations
•
Computer code calculations (validated by comparison to critical
experiments)
35
E
v
a
l
u
a
t
e
C
o
n
d
i
t
i
o
n
s
•
Demonstrate normal conditions are subcritical
•
Establishes controlled parameters
•
Establishes margin of safety
•
Demonstrate contingent conditions are subcritical
•
Satisfies PA
•
What if a contingent condition is not subcritical?
•
additional controls must be established to preclude the possibility of a
criticality accident (render scenario not credible; reduce degree of
upset)
36
E
v
a
l
u
a
t
e
C
o
n
d
i
t
i
o
n
s
•
The process/activity is understood in terms of
physiochemical attributes such as weight, temperature,
pressure, concentrations, flow rates, layout, capacities, etc.
•
Need a way to relate these attributes to what is evaluated
for nuclear criticality safety…
37
E
v
a
l
u
a
t
e
C
o
n
d
i
t
i
o
n
s
S
y
s
t
e
m
a
t
t
r
i
b
u
t
e
s
A
n
a
l
y
s
i
s
P
a
r
a
m
e
t
e
r
s
M
A
G
I
C
M
E
R
V
i
s
t
h
e
d
e
c
r
y
p
t
i
o
n
k
e
y
t
h
a
t
o
p
e
n
s
t
h
e
N
C
S
a
n
a
l
y
s
i
s
•
Identify parameters that must be controlled
•
Understand how changes affect system reactivity
•
Determine limitations on those parameters
•
Meets intent of ANS-8.1 and -8.19 requirements and
recommendations
38
E
s
t
a
b
l
i
s
h
L
i
m
i
t
s
I
d
e
n
t
i
f
y
w
h
i
c
h
p
a
r
a
m
e
t
e
r
(
s
)
n
e
e
d
t
o
b
e
l
i
m
i
t
e
d
•
The value of the limit
•
Limits must be within appropriate criteria for subcriticality
(i.e. not exceed a subcritical limit or critical limit with margin
applied)
•
Criteria for calculated k
eff
derived from validation
39
E
s
t
a
b
l
i
s
h
C
o
n
t
r
o
l
s
/
R
e
q
u
i
r
e
m
e
n
t
s
T
r
a
n
s
l
a
t
e
p
a
r
a
m
e
t
e
r
l
i
m
i
t
s
f
r
o
m
a
n
a
l
y
s
i
s
b
a
c
k
t
o
t
h
e
p
h
y
s
i
c
a
l
s
t
a
t
e
•
NCS requirements should be expressed using the same
attributes by which the system is understood
•
physical attributes such as weight, temperature, pressure,
concentrations, flow rates, layout, capacities, etc.
40
E
s
t
a
b
l
i
s
h
C
o
n
t
r
o
l
s
/
R
e
q
u
i
r
e
m
e
n
t
s
•
Three types of controls: 1) Passive engineered, 2) Active
Engineered, 3) Administrative
•
Passive Engineered: Reliance should be placed on
equipment design where dimensions are limited
•
Most preferred per ANS-8.1
•
LA-2063, 1956
41
E
s
t
a
b
l
i
s
h
C
o
n
t
r
o
l
s
/
R
e
q
u
i
r
e
m
e
n
t
s
A
c
t
i
v
e
E
n
g
i
n
e
e
r
e
d
•
Uranium solution concentration monitor
•
Programmed setpoint
•
Interlocked to stop flow if setpoint is exceeded
A
d
m
i
n
i
s
t
r
a
t
i
v
e
(
l
e
a
s
t
p
r
e
f
e
r
r
e
d
)
•
Withdraw sample of solution
•
Analyze for concentration
B
e
a
w
a
r
e
,
a
d
m
i
n
i
s
t
r
a
t
i
v
e
e
l
e
m
e
n
t
s
t
o
m
a
i
n
t
a
i
n
i
n
g
e
n
g
i
n
e
e
r
e
d
f
e
a
t
u
r
e
s
42
E
s
t
a
b
l
i
s
h
C
o
n
t
r
o
l
s
/
R
e
q
u
i
r
e
m
e
n
t
s
•
Avoid impractical controls (e.g. mass limit where no means
to weigh material).
•
Do not avoid controls for non-safety pressures.
•
Do not bias the type of controls for expediency (e.g. admin
over new design feature)
•
Work with Operations counterparts to ensure the proposed
requirements can be met
I
f
c
o
n
t
r
o
l
s
a
r
e
n
o
t
c
o
n
v
e
n
i
e
n
t
t
o
f
o
l
l
o
w
,
t
h
e
y
w
i
l
l
v
e
r
y
l
i
k
e
l
y
b
e
v
i
o
l
a
t
e
d
!
43
E
s
t
a
b
l
i
s
h
C
o
n
t
r
o
l
s
/
R
e
q
u
i
r
e
m
e
n
t
s
O
t
h
e
r
C
o
n
t
r
o
l
C
o
n
s
i
d
e
r
a
t
i
o
n
s
•
Nature of the operation vs. NCS control
•
Chemical and physical properties of products
•
ANSI/ANS-8.1 allows for credit of “natural or credible course of
events”
•
Examples: density of powder, H/X of material
•
Need for independent verification
•
Compensate for sensitivity in the controlled parameter
•
Ability to recognize control failure
•
Periodic surveillances
•
Verification before beginning operation
•
Not acceptable to remain unknown
44
E
s
t
a
b
l
i
s
h
C
o
n
t
r
o
l
s
/
R
e
q
u
i
r
e
m
e
n
t
s
A
p
p
l
y
a
d
d
i
t
i
o
n
a
l
d
e
f
e
n
s
e
i
n
d
e
p
t
h
c
o
n
t
r
o
l
s
w
h
e
r
e
j
u
d
g
e
d
a
p
p
r
o
p
r
i
a
t
e
f
o
r
r
i
s
k
m
a
n
a
g
e
m
e
n
t
•
Reduced operational limit where process does not require
full allowance afforded by a subcritical limit
•
Use of nuclear poisons where practical (e.g. borosilicate
glass equipment)
45
T
h
o
u
g
h
t
s
o
n
C
o
n
s
e
r
v
a
t
i
s
m
I
n
c
l
u
d
e
c
o
n
s
e
r
v
a
t
i
s
m
w
h
e
r
e
f
e
a
s
i
b
l
e
:
•
To account for real-world uncertainties.
•
To simplify modeling.
•
To meet facility/site safety policies (e.g. optimum
moderation, full enrichment).
B
e
w
a
r
e
o
f
u
n
i
n
t
e
n
d
e
d
c
o
n
s
e
q
u
e
n
c
e
s
:
•
May hinder operations, restrict productivity, or cause
other safety problems.
•
May result in confusing requirements being imposed on
operations personnel
M
a
y
e
n
c
o
u
r
a
g
e
s
h
o
r
t
c
u
t
s
46
A
c
c
e
p
t
a
n
c
e
b
y
U
s
e
r
s
T
h
e
o
p
e
r
a
t
i
n
g
o
r
g
a
n
i
z
a
t
i
o
n
i
s
u
l
t
i
m
a
t
e
l
y
r
e
s
p
o
n
s
i
b
l
e
f
o
r
s
a
f
e
t
y
•
The NCS analyst must clearly explain the intent of the
controls
•
The operating organization must
•
Validate the controls can be met
•
Identify how controls will be implemented and maintained
47
O
t
h
e
r
C
o
n
s
i
d
e
r
a
t
i
o
n
s
f
o
r
E
v
a
l
u
a
t
i
o
n
•
Criticality accident alarm system coverage
•
Access to references and supporting NCS calculations
•
Document control and record retention
•
Interface with regulatory oversight
•
Interface with facility safety documentation
•
Consistency with safety analysis
•
Elevation of NCS controls (i.e. ISAs or DSAs)
48
Internal Use Only
Criticality Safety Evaluations (CSEs) are essential in nuclear operations to ensure subcritical conditions, meet safety criteria, derive controls, and communicate with stakeholders. They involve Process Analysis (PA) to identify conditions affecting nuclear criticality safety. Proper identification of credible abnormal conditions is crucial to prevent criticality accidents. A defense-in-depth approach is necessary for robust accident prevention.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Criticality Safety Evaluations (CSEs) Chris Haught Jason M. Crye, PhD Chief NCS Engineer NCS Engineer 1
Outline Purpose Safety Criteria Typical Steps Other Considerations 2
Purposes of Criticality Safety Evaluations To demonstrate that the operation is adequately subcritical: under normal operating conditions under contingent (upset) conditions To demonstrate that the operation meets ANSI/ANS-8.1 and -8.19 safety criteria To derive limits and controls that ensure the above conclusions and bases are valid To communicate to other analysts To convince regulators that the above conclusions and bases are acceptable 3
ONE BASIC SAFETY CRITERION From ANSI/ANS-8.1 ( 4.1.2) and -8.19 ( 7.1), Process Analysis (PA) Before a new operation with fissionable material is begun, or before an existing operation is changed, it shall be determined that the entire process will be subcritical under both normal and credible abnormal conditions. 4
Process Analysis (PA) Requirement Process Conditions: The identifying characteristics of a process that have an effect on nuclear criticality safety Abnormal conditions may include: A change in shape or dimensions Increase in mass of fissile material A change in concentration of fissile material in solution A reduction in the quantity of neutron absorber An increase in reflection An increase in interaction Physiochemical condition changes (boiling, precipitation, significant temperature reduction from cryogenic fluids, etc.) 5
Process Analysis Requirement All credible abnormal conditions? Identification of credible abnormal conditions is crucial Be aware that no process criticality accident occurred as a result of an erroneous calculation; many occurred as a result of a fault pathway that was not previously identified A thorough understanding of the process or activity is key to ensuring an adequate control set is developed A defense in depth philosophy is needed for prevention of nuclear criticality accidents More to follow on defense in depth 6
NOTE: ANSI/ANS-8.1 does not define credible or other important terms When ANSI standards use such terms without specific definition within the standard, the meaning of the terms is as defined by ordinary English usage (i.e., what Webster s or other standard dictionary definitions state). But credible is discussed in the new Appendix B 7
Process Analysis Requirement How to apply credible? Reconciling credible abnormal conditions with economic considerations and protection of operating personnel and the public is part of applying the Process A analysis requirement Cosmic impact? Major earthquake? Airplane crash? relies on the judgment of the key professionals can differ from process to process and site to site Elimination of all risk is not possible Resources expended for NCS control should be commensurate with other hazards of similar consequences (paraphrased) 8
Process Analysis Requirement To meet the Process Analysis requirement: Combinations of upset conditions should be considered. Rarely does occurrence of a single upset condition yield a criticality scenario. (Most criticality accidents result from multiple failures.) However, one event might affect multiple process conditions Examples: fire, violent chemical reactions, explosions, flood If the combination of multiple upset conditions is credible and presents the possibility of a criticality accident, then the operation being evaluated does not meet the basic safety criterion of ANS-8.1 4.1.2. 9
ANOTHER BASIC SAFETY CRITERION From ANSI/ANS-8.1, 4.2.2 Double-contingency Principle (DCP) Process designs should incorporate sufficient factors of safety to require at least two unlikely, independent, and concurrent changes in process conditions before a criticality accident is possible. 10
Double Contingency Principle (DCP) DCP does not limit changes in process conditions to only those that are considered credible DCP does establish a lower limit on expected frequency of such changes: unlikely Typically considered once in 100 years (10-2 probability) or once in the lifetime of a facility What about changes in process conditions expected to occur more frequently? 11
Double Contingency Principle More on Double Not two contingencies! There will most likely be numerous upsets to consider. Not two controls! Maybe only a few NCS controls are needed. Maybe scores of controls are needed. This is determined by the analysis, not the Double Contingency Principle. Two layers of defense? Maybe two, maybe more. Again, determined by the analysis. So, how many controls are needed? sufficient factors of safety 12
Double Contingency Principle Historically, regulatory agencies have required that double contingency be implemented as a requirement, without full understanding by regulation authors of: the original intent, or the difficulty in truly meeting double contingency for many categories of fissile operations. 13
Double Contingency Principle Why isn t the Double Contingency Principle a requirement? There are situations where consequence mitigation minimizes the need for defense in depth (e.g. shielded facilities or underground tanks) Single barriers that are sufficiently robust (e.g. LEU UF6 cylinders) Credibility of a single change in process conditions (mass of a single HEU item) It is difficult if not impossible to verify (subjective rule) 14
DCP Historical Perspective LA-2063, 1956 The nuclear safety of any process will be assured, wherever possible, by the dimensions of the components - such as pipe sizes and container capacities including spacing between individual components of the same or adjacent systems. Where safety based on geometry alone is precluded, designs may be predicated on batch sizes and/or chemical concentrations, or combinations of them with geometry, and such designs will be considered satisfactory only if two or more simultaneous and independent contingencies must occur to promote a chain reaction. LA-3366, 1964 is generally accepted as a guide to the proper degree of protection against operational abnormalities that are improbable but still cannot be ignored. This rule calls for controls such that no single mishap can lead to a criticality accident regardless of its probability of occurrence. It is understood, further, that there should be protection against chains of related mishaps and against combinations with other abnormalities that cannot be considered improbable. Obviously, this rather subjective rule does little more than establish a point of view about criticality control - it cannot substitute for expert judgment, experience and common sense usually provide the only basis for classifying a conceivable mishap as likely or unlikely, or for ruling it out as an impractical concept . 15
DCP and Nuclear Parameters DCP Require Multiple Parameter Control? Nuclear Parameters MAGIC MERV DCP recommending control of at least two independent parameters has historically been an unofficial interpretation (i.e. not an official ANSI interpretation) No longer required by DOE ANSI/ANS-8.1 2014 version provides some clarification 16
DCP and Nuclear Parameters DCP in ANS-8.1-2014, Appendix B does not refer to parameters or controls The phrases multiple controls on a single parameter or multiple parameter control have no bearing on whether DCP is properly satisfied. The appendix suggests that crediting multiple independent controls to prevent a single change in process conditions is acceptable for complying with PA but not compliant with DCP DCP does not address credibility of unlikely changes 17
My Perspective on DCP Goals Defense in Depth Diversity of Controls (such that one change is not expected to affect all controls) Practicality Control of two independent parameters may be effective for demonstrating subcriticality, but may lead to controls being out of balance with other similar hazards (safe mass and safe geometry?) Overall protection of the worker should guide application of DCP 18
ANSI/ANS-8.19 Requirements Requires PA Credible abnormal determined with input from knowledgeable individuals Evaluation determine/identify controlled parameters and their limits Evaluation documented w/sufficient detail, clarity, and lack of ambiguity to allow for independent judgment of results Reviewer familiar with NCS and operations 19
ANSI/ANS-8.19 Recommendations NCS staff performing evaluation observe relevant equipment, activities, and practices Supervisor responsible for operation confirm normal and credible abnormal conditions; derived requirements are verifiable and compatible with operation 20
Criticality Safety Evaluations (CSEs) Contingencies Credible Abnormal Conditions Criticality Accident Possible Normal Conditions . . . . . . Must be unlikely, independent (self-evident), and subcritical Barrier Analysis Whether or not documented, analyst must understand where criticality is possible Typical PA 21
Typical Process For Development of CSEs Part Art, Part Science Request made, Acceptance by Users (See Note) Neutronic analysis (calculations, handbooks) Understanding Process/Activity Evaluate Conditions Understood? Doable? Identify Normal Conditions Limitations on nuclear parameters "Normal" may not be typical Establish Limits Evaluation Approved Establish Controls/ Requirements How the parameters will be controlled. Identify Contingent Conditions What can go wrong? Implement NCS Controls Note: this step is a formality; users should be involved during the development 22
Request for NCS Evaluation New or modified fissile material activity Understand what is wanted Understand what is needed Sometimes, wants needs (operational flexibility vs. convenient controls) Sometimes, wants and needs change while the evaluation is being developed. Example Multiple batches in a glovebox with controls on # containers, spacing, lids on containers One batch at a time limited by fissile material mass 23
Understanding the Process/ Activity Most important step! Research, Study, and Learn Material characteristics (physical, chemical properties) Process chemistry Material flows (incoming, outgoing, flow rates, waste streams, etc.) Material unaccounted for (normal and abnormal equipment holdup) 24
Understanding the Process/Activity Research, Study, and Learn Adjacent processes and operations (upstream, downstream, and lateral) Physical layout of equipment Function of the equipment Capability of the equipment 25
Understanding the Process/Activity Talk to operators, engineers, NCS analysts Ask what can go wrong Review safety analyses (e.g. ISAs and DSAs) Inspect the field, observe operations Pore over drawings, read procedures Become as knowledgeable as the system engineer 26
Understanding the Process/Activity Remember, no accident has occurred as a result of an erroneous calculation Understanding the process/activity will provide a firm foundation for the NCS evaluation Without such an understanding, your analysis is built on a house of cards 27
Understanding the Process/Activity Now that you understand the process Document a description of the process Include assumptions relevant to the evaluation Discuss inputs fissile materials, chemical reagents, materials of construction, etc. Discuss product and waste streams 28
Understanding the Process/Activity Description of the process Discuss physical changes Discuss chemical reactions Present the boundaries of the system Discuss interfacing systems ensure evaluations for these systems properly consider materials from your process Discuss utilities such as water, vacuum, or air 29
Identify Normal Conditions The Art An Analytical Model of Normal Normal conditions should bound actual conditions, plus Including process upsets not considered to be unlikely (e.g. minor mass upsets) Including process variability (e.g. fissile solution concentration or powder density) Ensure conservatism in NCS evaluation Gain practical flexibility in operations (e.g. no NCS controls on concentration or density) 30
Why is a normal condition analysis needed? Establish margin of safety. In determining the normal condition is subcritical, the important operational and process characteristics that ensure subcriticality are defined. e.g. limited fissile mass, dryness, low fissile concentration, etc. Helps identify credible abnormal changes to the process/activity 31
Identify Contingent Conditions Unlikely Credible Abnormal Condition = Contingency What can go wrong (e.g. excess fissile mass) How can it go wrong (e.g. container overloaded) To what extent it can go wrong (e.g. volumetrically full with some overflow) A contingency is not simply a control failure Important system attribute(s) must be affected Example: lid left off container 32
Identify Contingent Conditions TheArt Analytical Models for Contingencies Understand basic routes/sequences leading from normal conditions to abnormal conditions This is why you should be as knowledgeable as the cognizant system engineer This is why other knowledgeable individuals should review Identify what can go wrong in physical space, such as an addition of the wrong chemical reagent, operator inattention, process temperature too high, etc. 33
Identify Contingent Conditions Likelihood If a scenario does not meet your judgment for unlikely, it should be folded in with normal (e.g. small spill of fissile material) Credible extent of upset must be established (e.g. degree overmass or number of noncompliant containers in storage) Beware of "single" events that affect multiple parameters and controls Flooding (reflection and moderation) Fire (physical damage plus flooding) 34
Evaluate Conditions The Science NCS analysis determining the system model is subcritical Comparative analysis to critical experiments or guides based on critical data Reference to nuclear safety guides and standards Hand calculations Computer code calculations (validated by comparison to critical experiments) 35
Evaluate Conditions Demonstrate normal conditions are subcritical Establishes controlled parameters Establishes margin of safety Demonstrate contingent conditions are subcritical Satisfies PA What if a contingent condition is not subcritical? additional controls must be established to preclude the possibility of a criticality accident (render scenario not credible; reduce degree of upset) 36
Evaluate Conditions The process/activity is understood in terms of physiochemical attributes such as weight, temperature, pressure, concentrations, flow rates, layout, capacities, etc. Need a way to relate these attributes to what is evaluated for nuclear criticality safety 37
Evaluate Conditions System attributes Analysis Parameters MAGIC MERV is the decryption key that opens the NCS analysis Identify parameters that must be controlled Understand how changes affect system reactivity Determine limitations on those parameters Meets intent of ANS-8.1 and -8.19 requirements and recommendations 38
Establish Limits Identify which parameter(s) need to be limited The value of the limit Limits must be within appropriate criteria for subcriticality (i.e. not exceed a subcritical limit or critical limit with margin applied) Criteria for calculated keff derived from validation 39
Establish Controls/Requirements Translate parameter limits from analysis back to the physical state NCS requirements should be expressed using the same attributes by which the system is understood physical attributes such as weight, temperature, pressure, concentrations, flow rates, layout, capacities, etc. 40
Establish Controls/Requirements Three types of controls: 1) Passive engineered, 2) Active Engineered, 3) Administrative Passive Engineered: Reliance should be placed on equipment design where dimensions are limited Most preferred per ANS-8.1 LA-2063, 1956 41
Establish Controls/Requirements Active Engineered Uranium solution concentration monitor Programmed setpoint Interlocked to stop flow if setpoint is exceeded Administrative (least preferred) Withdraw sample of solution Analyze for concentration Be aware, administrative elements to maintaining engineered features 42
Establish Controls/Requirements Avoid impractical controls (e.g. mass limit where no means to weigh material). Do not avoid controls for non-safety pressures. Do not bias the type of controls for expediency (e.g. admin over new design feature) Work with Operations counterparts to ensure the proposed requirements can be met If controls are not convenient to follow, they will very likely be violated! 43
Establish Controls/Requirements Other Control Considerations Nature of the operation vs. NCS control Chemical and physical properties of products ANSI/ANS-8.1 allows for credit of natural or credible course of events Examples: density of powder, H/X of material Need for independent verification Compensate for sensitivity in the controlled parameter Ability to recognize control failure Periodic surveillances Verification before beginning operation Not acceptable to remain unknown 44
Establish Controls/Requirements Apply additional defense in depth controls where judged appropriate for risk management Reduced operational limit where process does not require full allowance afforded by a subcritical limit Use of nuclear poisons where practical (e.g. borosilicate glass equipment) 45
Thoughts on Conservatism Include conservatism where feasible: To account for real-world uncertainties. To simplify modeling. To meet facility/site safety policies (e.g. optimum moderation, full enrichment). Beware of unintended consequences: May hinder operations, restrict productivity, or cause other safety problems. May result in confusing requirements being imposed on operations personnel May encourage shortcuts 46
Acceptance by Users The operating organization is ultimately responsible for safety The NCS analyst must clearly explain the intent of the controls The operating organization must Validate the controls can be met Identify how controls will be implemented and maintained 47
Other Considerations for Evaluation Criticality accident alarm system coverage Access to references and supporting NCS calculations Document control and record retention Interface with regulatory oversight Interface with facility safety documentation Consistency with safety analysis Elevation of NCS controls (i.e. ISAs or DSAs) 48
