Issue Date:

2009/03/03

Review Date:

2013/03/03

Open Government Status:

Fully Open

Approved By:

A N Hall

1 Purpose and scope

1.1 This document provides guidance to NII inspectors in respect of the assessment of nuclear licensees' arrangements for criticality safety, as described in outline in NII Safety Assessment Principles ECR.1 and ECR.2, together with their associated supporting text in paragraphs 470 475, Ref 1. As with all guidance, inspectors should use their judgement and discretion in the depth and scope to which they employ this guidance.

1.2 This guidance is aimed primarily at applications to new facilities. It should also be applied to existing facilities, including modifications and decommissioning activities. For facilities that were designed and constructed to standards that are different from current standards, the issue of whether sufficient measures are available to satisfy ALARP considerations should be judged on a case by case basis.

2 Relationship to Licence and Other Relevant Legislation

 

2.1 LC 4: Restrictions on Nuclear Matter on the Site

The purpose of this licence condition is to ensure that the licensee carries out his responsibilities to control the introduction and storage of nuclear matter, including fissile material.

2.2 LC 15: Periodic Review

The adequacy of the safety case, including criticality aspects and the control of nuclear matter, should be reviewed at regular intervals against the current operating conditions, current good practice and statutory requirements to ensure that adequate safety provisions are in place for current and future operations.

2.3 LC 19: Construction or Installation of New Plant

The design of new facilities should be considered at an early stage in order to minimise the likelihood of criticality and installation must be carefully controlled, e.g. to ensure that materials and construction meet the design specification.

2.4 LC 20: Modification to Design of Plant Under Construction

Such modifications should be assessed to ensure that they do not impact adversely on the control of nuclear matter within and criticality safety of the facility (e.g. by changing the sizes of vessels or specification of materials).

2.5 LC 21: Commissioning

Inactive and, where appropriate, active commissioning tests should be carried out to ensure, for example, that design criteria have been met and that engineered protection is in place and operating effectively.

2.6 LC 22: Modification or Experiment on Existing Plant

Such modifications should be assessed to ensure that they do not impact adversely on the control of nuclear matter within and criticality safety of the facility (e.g. by changing the sizes of vessels or specification of materials).

2.7 LC 23: Operating Rules

The limits and conditions necessary in the interests of criticality safety should be clearly specified in the safety case. These limits and conditions, which are known as operating rules, should be placed on readily measurable parameters, e.g. the masses of fissile materials and moderators.

2.8 LC 24: Operating Instructions

These will be required, for example, in respect of all operations with fissile material which may affect safety and to ensure that operating rules are implemented and that the risk of criticality is kept ALARP at all times.

2.9 LC 25: Operational Records

These may include, for example, records of fissile inventories in specific locations in the facility, sampling and analysis results, and dimensional checks.

2.10 LC 27: Safety Mechanisms, Devices and Circuits

The licensee should identify safety mechanisms, devices and circuits that are important to criticality safety and ensure that they are adequately maintained in accordance with LC 28.

2.11 LC 28: Examination, Inspection, Maintenance and Testing

It is expected that equipment associated with ensuring criticality safety, such as neutron counters, enrichment monitors and weighing scales would form part of the licensee's site wide arrangements under this licence condition.

2.12 IRR99 Regulation 7: Prior Risk Assessment

The licensee should carry out a prior risk assessment in order to identify the measures required to restrict the exposures of workers and the public to ionising radiation. In cases where fissile material will be present, such measures should include the provision of safety systems to minimise the probability of criticality.

2.13 IRR99 Regulation 8: Restriction of Exposure

The restriction of exposure to ionising radiation should, wherever reasonably practicable, be achieved by engineering controls and design features, which could include safety systems to minimise the probability of criticality.

2.14 IRR99 Regulation 10: Maintenance and Examination of Engineering Controls etc and Personal Protective Equipment

The licensee should put in place adequate maintenance and examination arrangements to ensure that safety systems provided to minimise the probability of criticality are working correctly.

3 Relationship to SAPs, WENRA Reference Levels and IAEA Safety Standards

 

3.1 SAPs Addressed

It should be noted that the SAPs form a complete document and should be taken as a whole. This is particularly true for matters relating to the assessment of criticality safety. It is not appropriate to base an assessment on a few selected principles, possibly taken out of context, without considering all other relevant principles. Indeed, many of the principles are relevant to criticality safety and the NII assessor should constantly bear this in mind. Hence, in order to carry out a comprehensive assessment, it will generally be necessary to refer to several other Technical Assessment Guides (TAGs) in addition to this one. This section reproduces the SAPs and their associated supporting text that refer explicitly to criticality safety.

470 Criticality safety principles apply to the processing, handling or storage of fissile materials in significant quantities with respect to the minimum critical mass, and in locations where criticality is not intended. The principles in this sub-section, which should be read in conjunction with the Fault Analysis section, are specific to criticality safety.

ECR.1 Wherever significant amounts of fissile materials may be present, there should be a system of safety measures to minimise the likelihood of unplanned criticality.

471 The hierarchy of controls set out in the Key Principles sub-section (paragraph 135ff) is appropriate for criticality safety, and gives preference to minimising the amount of fissile material present, consistent with the process requirements. For non-reactor facilities, the principal means of passive engineering control of criticality should be geometrical constraint. Where sub-criticality cannot be maintained through geometrical constraint alone, additional engineered safety measures should be specified, such as fixed neutron absorbers. Reliance on neutron absorbers requires assurance of their continued presence and effectiveness.

472 Further safety measures may need to be specified such as:

1. controlling the mass and isotopic composition of the fissile material present in a nuclear process;
2. controlling the concentration of fissile material in solutions; and
3. controlling the amount of neutron moderating and reflecting material associated with the fissile material.

473 The design and operation of facilities and equipment dealing with fissile material should be such as to facilitate the termination of a criticality incident.

ECR.2 A criticality safety case should incorporate the double contingency approach.

474 The double contingency approach requires that unintended criticality cannot occur unless at least two unlikely, independent, concurrent changes in the conditions originally specified as essential to criticality safety have occurred.

475 For long-term storage of radioactive waste containing fissile materials, traditional deterministic criticality assessments can lead to very conservative limits on fissile materials. Consideration should be given to a risk-informed approach that balances the risks from an unplanned criticality against other factors, such as the dose accrued as a result of the preparation of waste packages.

3.2 Discussion of SAPs

Paragraph 470

3.2.1 This paragraph points out that the scope of criticality safety is limited to processes intended to be subcritical. This covers essentially all facilities apart from reactors, which constitute a special case in that they are designed to achieve criticality in a controlled manner. Here, protection of the workforce is achieved by the provision of massive bulk shielding and multiple high-integrity containment systems. In general, in all other situations, including reactor fuel situated outside a reactor, there is insufficient bulk shielding and/or containment to provide adequate protection of the workforce in the event of criticality.

3.2.2 Formal criticality safety analysis may not be required for processes containing only a small fraction of the minimum critical mass of the relevant fissile isotope, e.g. no more than 15g of U-235 or Pu-239, where there is no reasonably foreseeable mechanism of significantly increasing the mass of fissile material present. An explicit demonstration of the lack of need for criticality safety measures should be provided in the facility safety case.

3.2.3 It should be pointed out that the Fault Analysis principles in the SAPs apply to all types of fault, including criticality, and hence the NII assessor should also refer to these principles when carrying out an assessment.

Principle ECR.1

3.2.4 NII would expect the licensees safety case to identify a system of criticality safety measures, which should follow the generally accepted hierarchy of protection:

1. Passive engineered measures, i.e. measures that are continuously available and require no action by a safety system or an operator to achieve and maintain a safe state.
2. Active engineered measures, i.e. measures requiring action by a safety system to achieve and maintain a safe state.
3. Administrative measures, i.e. measures requiring action by an operator to achieve and maintain a safe state.

We would expect to see a robust justification where criticality safety is maintained by administrative measures alone.

Paragraph 471

3.2.5 The preferred means of ensuring criticality safety is the introduction of geometrical constraints, e.g. limited volume vessels and limited diameter pipes. The geometrical constraints mean that the neutron leakage is sufficiently great to prevent a critical chain reaction. The safety case should show that the dimensions of components are such that criticality safety will be maintained for any reasonably foreseeable mass and concentration of fissile material, and any reasonably foreseeable change in geometry.

3.2.6 Regarding neutron poisons, it should be noted that such materials are generally only effective for thermal neutrons. Hence, in cases where reliance is placed on neutron poisons to maintain criticality safety, the licensee must provide assurance that sufficient neutron poison and sufficient neutron moderating material will be present to ensure the effectiveness of the poison under all reasonably foreseeable conditions. Strong preference should be given to the use of fixed poisons rather than soluble poisons, since the latter require continuous demonstration of their presence and appropriate concentration during operations.

Paragraph 472

3.2.7 In addition to the use of geometrical constraints and neutron poisons, there are several other parameters, control of which can be used to achieve criticality safety:

1. Fissile mass. Criticality safety can be achieved by restricting the mass of fissile material to below the minimum critical mass appropriate to the process conditions. If this approach is adopted, consideration must be given to fault sequences which could increase the reactivity, e.g. the introduction of excess fissile material. Robust safety measures must be put in place to prevent the accumulation of an unsafe mass.
2. Isotopic composition. The most important fissile isotopes in current nuclear industry applications are U-235 and Pu-239. Uranium normally contains mostly U-235 and U-238, whereas plutonium normally contains mostly Pu-239 and Pu-240 (with possibly a small amount of Pu-241). NII would expect the licensees safety case to identify safe limits and conditions with regard to isotopic composition. The safety case should identify appropriate measures to ensure that these limits and conditions are satisfied.
3. Moderation. The critical mass of fissile material can be significantly reduced by the presence of moderating material. Ideally, the safety case should demonstrate that criticality safety would be maintained even with optimum moderation. In choosing the moderating material to consider in the safety assessment, all materials that may reasonably be present should be considered and the most reactive configuration should be identified. This will often be optimum moderation by a hydrogenous material such as water or oil. It should be noted that licensees sometimes attempt to make criticality safety cases based on limited moderation arguments. Here, it is argued that while some moderator may be present, there will be an insufficient quantity to form a critical system. Such arguments may be acceptable if adequately substantiated.
4. Reflection. Similarly, the critical mass of fissile material can be significantly reduced by the presence of reflecting material. In general, a close-fitting thick reflector should be assumed. In choosing the reflecting material to consider in the safety assessment, all materials that may reasonably be present should be considered. In addition to materials within the process, the reflecting effects of other nearby materials and structures, including personnel, should also be addressed. It should be noted that licensees sometimes attempt to make criticality safety cases based on limited reflection arguments. Here, it is argued that while some reflector may be present, there will be an insufficient quantity to form a critical system. NII assessors should resist arguments based on limited reflection unless adequately substantiated.
5. Density. For fissile material in solid form, there will generally be a range of possible densities, up to the maximum theoretical density. It is well established that, for fissile material in solid form, the critical mass decreases with increasing density, Ref 2. Hence, safety cases should generally consider the maximum theoretical density unless it can be demonstrated deterministically that the process cannot give rise to this density, or should provide assurance that this density cannot be achieved.
6. Concentration. The reactivity of fissile material in solution or suspension will vary as a function of the concentration of the fissile material. This is largely due to the competing effects of dilution of the fissile material, i.e. reducing the density, and moderation and absorption by the liquid. There will be a concentration at which the reactivity is highest. This is known as the optimum concentration. Ideally, the safety case should demonstrate that criticality safety would be maintained even at optimum concentration. If this is not possible then assurance should be provided that the concentration can never achieve an unsafe value.
7. Interaction. This concerns multiple fissile units, each of which is subcritical in isolation. The combined system may be critical due to the interaction between the units, i.e. the transfer of neutrons between the units. In cases where interaction effects may be important, safety measures should be put in place to ensure criticality safety. Such measures may take the form of spacers to constrain the separation of the units, or absorbing material placed between the units.
8. Homogeneity/Inhomogeneity. For high-enriched uranium systems, i.e. where the U-235 content is above around 5%, a homogeneous system is more reactive than a heterogeneous system. However, for low-enriched uranium systems, i.e. where the U-235 content is below around 5%, a heterogeneous system can be more reactive than a homogeneous system. For example, natural uranium can only be made to go critical in a heterogeneous system such as a magnox reactor.

Paragraph 473

3.2.8 The consequences of some criticality incidents e.g. Tokai Mura in Japan in 1999, could have been reduced if there had been an effective means of terminating the incident rapidly. Hence, the licensee should give prior consideration to the provision of systems that can reduce the reactivity of a critical system to a subcritical level. An example of this might be a system that injects a neutron poison such as boron into a critical solution or can safely modify conditions in the facility from a safe location. This may require the provision of additional engineered hardware at the design stage.

Principle ECR.2

3.2.9 The Double Contingency Principle (DCP) is well established in both UK and international standards, Refs 3, 4 and 5, and represents a very important element in the demonstration of defence in depth and reinforces Key Engineering Principles EKP.1 to EKP.5. We would expect licensees to provide a clear demonstration of compliance. In particular, all reasonably foreseeable contingencies should be identified and it should be shown that no single contingency, e.g. the maximum credible extent of flooding or over batching, could result in a criticality incident.

Paragraph 474

3.2.10 As mentioned above, the DCP is well established in both UK and international standards and has been used successfully for many years. Hence, it has been included in the criticality SAPs.

3.2.11 The Fault Analysis SAPs require Design Basis Analysis (DBA) to be carried out for all faults, including criticality faults. The purpose of this section is to explain how the DCP and DBA should ideally be applied for criticality faults.

3.2.12 In general, there may be several initiating faults that can lead to each contingency. For example, flooding may result from several initiating faults, e.g. operator error, pipe or vessel failure, fire fighting, extreme weather etc.
Based on the initiating fault frequency and unmitigated consequences, DBA should be used to ensure suitable and sufficient safety measures are in place to provide robust protection against the contingency.

3.2.13 In addition, there may be several contingencies that could result in a criticality incident, e.g. flooding, over batching, increased reflection, loss of poison etc. It should be shown that the contingencies are independent, i.e. such that one contingency cannot cause another, and that the contingencies must occur concurrently, e.g. simultaneous flooding and over batching, in order to present a criticality hazard. It should then be shown that at least two unlikely, independent and concurrent contingencies are required to result in a criticality incident.

3.2.14 It is recognised that it may not be reasonably practicable to apply the approach outlined above in all situations. Such situations will be considered on a case by case basis by NII inspectors in order to come to a judgement on whether the licensee has included all safety measures that are reasonably practicable.

Paragraph 475

3.2.15 Traditional deterministic criticality assessments can lead to very conservative limits for fissile materials in waste packages. In these cases, a risk-based approach should be considered. This should balance the risks from unplanned criticality against other factors.

3.3 WENRA Reference Levels and IAEA Standards

3.3.1 Part of the specification for the update of the Safety Assessment Principles was to consider the Reactor, Decommissioning and Storage Safety Reference Levels published by the Western European Nuclear Regulators Association (WENRA), and IAEA Standards, Guidance and Documents. The update of this Technical Assessment Guide also considers the WENRA and IAEA publications for specific applicability.

3.3.2 There are no WENRA reference levels referring explicitly to criticality safety.

3.3.3 The need for safety measures to minimise the probability of unintended criticality is mentioned in many IAEA publications, e.g. Ref 6.

4 General Advice to Assessors

 

4.1 Introduction

4.1.1 The purpose of this guidance is to ensure that those in NII who are assessing criticality safety cases, and who have a good working knowledge of the subject, are better placed to examine safety cases and to identify, in the context of our regulatory function, any possible weaknesses or safety issues of concern.

4.1.2 In carrying out a criticality assessment, the NII inspector may wish to consult industry standard handbook data, Refs 7 to 12, and current national and international standards, Refs 3, 4, 5, 13 to 19. A further useful source of guidance for NII inspectors is in published papers presented at international conferences and practitioner meetings, Refs 20 to 24.

4.1.3 NII assessors should also take into consideration the lessons that can be learned from past criticality incidents and near misses.

4.1.4 Criticality safety is of particular importance on account of the very high levels of neutron and gamma radiation associated with criticality accidents. Individuals in the immediate vicinity of such an event may receive radiation doses that could result in severe deterministic effects, which will often be fatal. For this reason, an unplanned criticality can be a major hazard to the operator, particularly in nuclear chemical facilities where work on fissile material is often carried out in lightly shielded areas. Nuclear facilities that contain significant quantities of fissile material with respect to the minimum critical values should thus be designed and operated to provide adequate protection against the hazard from an unplanned criticality.

4.1.5 For processes entirely contained within suitably shielded cells or cooling ponds, the likelihood of an unplanned criticality event occurring should be reduced such that it is as low as reasonably practicable. The immediate consequences of such an event may be small in radiological terms, but would indicate a significant loss of process or management control and would be contrary to the objective of minimising the generation of radioactive waste.

4.2 Operating Rules

4.2.1 Under the requirements of LC 23, the licensee shall produce an adequate safety case to demonstrate safety and to identify the limits and conditions necessary in the interests of safety. Such limits and conditions are referred to as operating rules. For a criticality safety case, these should be limits and conditions on readily measurable parameters. NII considers that masses or volumes of fissile material or moderators are appropriate parameters to define operating rule limits. Detailed guidance on operating rules is given in Ref 25.

4.3 ALARP

4.3.1 The ALARP principle applies to criticality, as it does to all risks. In general, we would expect the licensee to implement all criticality safety measures that are reasonably practicable and to follow relevant good practice. We would also expect the licensee to demonstrate that the minimum quantity of fissile material will be used consistent with the process requirements, and that the minimum number of fissile material movements will be carried out consistent with the process requirements.

4.3.2 Optioneering is a very important part of an ALARP justification. Licensees should demonstrate that an appropriate optioneering study has been undertaken to identify all the options available for carrying out a particular process and that the safest reasonably practicable option has been implemented, in accordance with HSE guidance, Ref 26.

4.3.3 We would expect that the generally accepted hierarchy of protection has been applied. The hierarchy of protection states that the preferred order of protective measures is as follows:

1. Passive engineered safety measures.
2. Active engineered safety measures.
3. Administrative safety measures.

4.3.4 Further guidance on the hierarchy of protection is given in Ref 1.

4.3.5 A licensee may attempt to justify not implementing criticality safety measures on the basis of a Cost Benefit Analysis (CBA). Specifically, it may be argued that the cost of criticality safety measures would be grossly disproportionate to the risk that would be averted by their introduction.

4.3.6 However, it should be noted that CBA is only one possible input into the overall ALARP decision-making process in assessing the adequacy of criticality safety measures. In particular, the results of a CBA are always subject to uncertainty and so the conclusions should be viewed with caution. Primary consideration should be given to relevant good practice, e.g. the hierarchy of protection, which may override the conclusions of a CBA.
4.3.7 Detailed guidance on the ALARP principle is given in Ref 26.

4.4 Hazard Identification

4.4.1 NII assessors should seek assurance that all credible faults that could give rise to a criticality incident have been identified. (Evidence of this may be provided through detailed HAZOP studies, facility walkdowns and reviews of past incidents and near misses). The list of credible faults should consider normal operations and maintenance activities and should include: process faults, internal and external hazards, and human errors. The importance of considering human errors cannot be overemphasised since most of the criticality incidents that have occurred have been due to human error. Advice from fault studies and human factors specialists should be obtained where appropriate.

4.4.2 In identifying all the credible faults that could lead to a criticality incident, consideration should not be restricted to the major process vessels and pipework where fissile material normally resides, but should also include adventitious accumulation in unexpected locations, e.g. ducts and drains. In addition, the licensee should also consider the possibilities of precipitation of fissile material from solutions and of fissile solutions drying out due to evaporation, leading to the unexpected accumulation of solid fissile material.

4.4.3 NII assessors may seek further evidence from licensees where criticality faults are claimed to be incredible.

4.5 Assessment Philosophy

4.5.1 Operating configurations should be analysed using worst-case conditions, taking into account all reasonably foreseeable circumstances. This is necessary to identify the most reactive condition. Analysis may be based on configurations of materials, or on circumstances other than the most reactive, but these should be fully justified. The analysis should fully take account of the variability of factors such as geometry, material composition, neutron moderation, reflection and absorption (including neutron poisons), fissile material quantity (e.g. adventitious accumulation) and interaction effects, and of deficiencies in accounting procedures and enrichment identification. The effects of burn-up credit may be considered where appropriate.

4.5.2 Preference should be given to a safety justification based on the widely accepted Double Contingency Principle. This requires that at least two unlikely, independent and concurrent changes in the process conditions must occur before a criticality incident is possible.

4.5.3 The safety justification may be supplemented by a Probabilistic Safety Analysis (PSA) where appropriate. PSA may be particularly useful in complex systems to confirm that a balanced design of the facility has been achieved such that no particular feature of the facility makes a disproportionate contribution to the overall risk of criticality. Additionally, a PSA should be performed where appropriate to enable a numerical assessment of the risk arising from the facility to be made, and a judgement made as to its acceptability against the accident frequency principles.

4.6 Calculation Methods

4.6.1 Licensees use a variety of hand calculation methods and computer codes in criticality safety assessments. NII specialist assessors may use hand calculation methods to perform independent checks and scoping calculations on a sampling basis. NII assessors will use their discretion in the level and depth of sampling and may be influenced by the safety significance of the submission.

4.6.2 However, where more detailed calculations (e.g. using computer codes) are required, consultants working under contract to NII may be asked to perform these calculations. Commonly used criticality hand calculation methods are discussed in Ref 2.

4.6.3 In cases where Monte Carlo computer codes have been used, NII assessors may seek evidence from the licensee that the calculations are adequately sampled and converged.

4.6.4 The calculation methods and data used in criticality safety assessments should be verified and validated for the expected range of conditions.

4.6.5 Validation should be against experiment whenever this is reasonably practicable. Note that there is a large quantity of validation data available in the ICSBEP database. Where suitable experimental data are not available, validation by comparison with an independent method may be acceptable. Further guidance on validation is given in Ref 27.

4.6.6 Verification should demonstrate that the calculation method or computer code has been used correctly, in accordance with its specification, and for situations for which it has been validated.

4.7 Fissile Inventory Identification

4.7.1 Licensees should determine the fissile inventory of the relevant system conservatively, taking into account all fissile isotopes present. These will usually be uranium and plutonium isotopes but could, in some circumstances, include other exotic species, e.g. curium isotopes.

4.7.2 In uranium systems, the dominant isotopes are usually U-235, which is fissile, and U-238, which is fissionable. (Cases may occasionally be submitted that consider U-233, which is fissile). In plutonium systems, the dominant isotopes are usually Pu-239, which is fissile, and Pu-240, which is fissionable.

4.7.3 In uranium systems, it is necessary to determine the maximum U-235 (or U-233) content. Similarly, in plutonium systems, it is necessary to determine the maximum Pu-239 content. It should be noted that some exotic species have relatively low minimum critical masses. Hence, in cases where exotic species are modelled as U-235 or Pu-239, evidence should be provided that the representation is suitably conservative.

4.8 Movement Control

4.8.1 A reliable and robust movement control and prior authorisation system should be provided in facilities handling fissile material in order to minimise the probability of forming a critical assembly. Ideally, the movement control system and supporting operational records should track the locations and movements of fissile material and moderators. Reflectors and neutron poisons should also be tracked where appropriate.

4.8.2 The licensee should demonstrate that there is an adequate movement control and prior authorisation system in place. For example, in cases where complex fissile material movements are carried out, the movement control system may consist of a computer-based system supplemented by checks of paper-based records by facility personnel who are independent of the process operators. This system may be periodically validated by physical inventory verification.
4.8.3 However, where fissile material movements are simple, it may not be reasonably practicable to provide a computer-based system. In such cases, a paper-based records system may be adequate.

4.9 Commissioning and Decommissioning

4.9.1 Special arrangements may need to be employed during commissioning and decommissioning of facilities, where the level of uncertainty may be higher than for normal operation of a facility. In particular, there may be uncertainty in the amount, form and location of fissile material present. In such circumstances, it would be expected that greater sub-critical margins should be adopted than for normal operating facilities and increased levels of inspection and monitoring would be provided. Characterisation of the fissile content should be undertaken as far as reasonably practicable, and the addition of neutron poisons may also be considered.

4.10 Mitigation of Criticality Consequences

4.10.1 Consideration should be given during facility design, operation and periodic review to the actions that may be necessary to make the facility safe following a criticality accident. Possible approaches could take the form of installation of isolation valves, remote control systems, local stocks of soluble neutron poisons, portable shielding or other means of safely altering process conditions to achieve a safe state and restore management control.

4.10.2 The radiological effects from an unplanned criticality should be identified and minimised (see principle FP.6 in the SAPs). This should include identification of those individuals at risk from injury and identification of the range of measures that have the potential to reduce exposures. Such measures should be commensurate with the level of risk and may include fixed warning systems, portable gamma monitors or the provision of suitable shielding.

4.10.3 The NRPB (now part of the HPA) have provided general guidance on the protection of on-site personnel in the event of a radiation accident, Ref 28. This guidance applies to all types of sites, including nuclear sites. They point out that a radiation accident may give rise to both deterministic health effects and stochastic health effects. (Note that, in general, off-site personnel are unlikely to receive doses high enough to result in deterministic effects as a result of a criticality incident).

4.10.4 The NRPB guidance states that the purpose of prior measures for on-site personnel for radiation accidents should be to avoid deterministic effects and to reduce the probability of stochastic effects so far as is reasonably practicable (in line with the ALARP principle). Priority should be given to the avoidance of deterministic effects.

4.10.5 A criticality incident is one type of radiation accident that could give rise to very high doses, resulting in deterministic effects to on-site personnel. Hence, a system of safety measures should be provided to reduce the probability of a criticality incident so far as is reasonably practicable. This is fully consistent with principle ECR.1 in the SAPs.

4.11 Working Party on Criticality

4.11.1 In the UK, the Working Party on Criticality has existed for over 20 years and includes practitioners from regulatory bodies and industry. The papers and minutes of this committee provide a guide to current industry good practice. The committee is non-executive in status but nonetheless is recognised and authoritative and has a number of roles, including the provision for exchange of information between different UK organisations. It also has a role in co-ordinating the UK response to international initiatives.

4.12 Assessment Guidance

4.12.1 This section presents suggested guidance in the form of a list of points the NII assessor may look for when considering a licensees criticality safety assessment. This list is not exhaustive.

1. Comprehensive and conservative fissile inventory identification.
2. Adequate knowledge of the process and flowsheet conditions.
3. Identification of possible faults that could lead to criticality.
4. Production of a safety analysis, including limits and conditions necessary in the interests of safety (operating rules).
5. Appropriate choice of calculation methods, i.e. computer calculations and/or hand calculations.
6. Adequate sampling and convergence of Monte Carlo computer codes.
7. Adequate validation and verification of calculation methods.
8. Where appropriate, cross checks of calculations using independent methods.
9. Independent peer review carried out where appropriate.
10. Adequate ALARP assessment, including a demonstration that the minimum quantity of fissile material will be used and the minimum number of fissile moves will be carried out, consistent with the process requirements.
11. Compliance with the hierarchy of protection, i.e. preference given to passive engineered safety measures such as geometrically favourable vessels and pipework.
12. Confirmation that the licensees criticality safety analyst and peer reviewer are SQEP.

References

1. Safety Assessment Principles for Nuclear Facilities, HSE, 2006.
2. Nuclear Criticality Safety Theory and Practice, R A Knief, American Nuclear Society, 1985.
3. BS 3598:1998 Fissile Materials - Criticality safety in handling and processing - Recommendations.
4. ANSI/ANS-8.1-1998: Nuclear criticality safety in operations with fissionable materials outside reactors.
5. ISO 1709:1995 Fissile Materials Principles of criticality safety in storing, handling and processing.
6. NS-G-1.13, Radiation Protection Aspects of Design for Nuclear Power Plants Safety Guide, December 2005.
7. LA-12808, Nuclear Safety Guide, Los Alamos National Laboratory, 1996.
8. LA-10860-MS, Critical Dimensions of Systems Containing U-235, Pu-239 and U-233, Los Alamos National Laboratory, 1987.
9. AHSB Handbook, UKAEA Health and Safety Branch, 1967.
10. ARH-600, Criticality Handbook, Vols 1, 2 and 3, Atlantic Richfield Hanford, 1968.
11. NTD B/0062 AEAT Criticality Handbook.
12. JAERI - Review 95-013: Nuclear Criticality Safety Handbook.
13. ANSI/ANS-8.5-1996: Use of borosilicate - glass raschig rings as a neutron absorber in solutions of fissile material.
14. ANSI/ANS-8.7-1998: Guide for nuclear criticality safety in the storage of fissile materials.
15. ANSI/ANS-8.14-2004: Use of soluble neutron absorbers in nuclear facilities outside reactors.
16. ANSI/ANS-8.15-1981: Nuclear criticality control of special actinide elements.
17. ANSI/ANS-8.19-2005: Administrative practices for nuclear criticality safety.
18. ANSI/ANS-8.21-1995: Use of fixed neutron absorbers in nuclear facilities outside nuclear reactors.
19. ANSI/ANS-8.22-1997: Nuclear criticality safety based on limiting and controlling moderators.
20. The UK's programme for nuclear criticality safety research, D N Simister, Proceedings of the Topical Meeting as Criticality Safety Challenges in the Next Decade, Chelan, Washington Sept 7-11 1997 ISBN 0-89448-618-7.
21. The UK regulatory approach to deterministic and probabilistic safety case analysis in criticality safety cases. K Smith and D N Simister, ICNC '95 Albuquerque Sept 17-21 1995.
22. The Health and Safety Executive's regulatory framework for control of nuclear criticality safety, K Smith and D N Simister, ICNC '91 Oxford, pages 111-6, 111-3.
23. The results of the Health and Safety Executive's criticality performance test, A J Rudge and D N Simister, Proceedings of ICNC '91, 9-13 September 1991, Oxford pages 111-72, 111-79.
24. Analysis of infringements or potential infringements of criticality rules, Dr D N Simister, ICNC 95, Albuquerque.
25. T/AST/035 - The Limits and Conditions for Nuclear Plant Safety.
26. T/AST/005 - ND Guidance on the Demonstration of ALARP (As Low As Reasonably Practicable).
27. T/AST/042 - Validation of Computer Codes and Calculation Methods.
28. Protection of On-Site Personnel in the Event of a Radiation Accident, Documents of the NRBP, Volume 16, No 1, 2005.