ML18214A199
| ML18214A199 | |
| Person / Time | |
|---|---|
| Site: | 07001113 |
| Issue date: | 08/02/2018 |
| From: | Murray S Global Nuclear Fuel |
| To: | Document Control Desk, Office of Nuclear Material Safety and Safeguards |
| References | |
| M180164 | |
| Download: ML18214A199 (52) | |
Text
M180164 August 2, 2018 Director, Office of Nuclear Material Safety and Safeguards U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001 Attn: Document Control Desk
Subject:
NRC License SNM-1097 - License Amendment Request RAI Response
References:
- 1) SNM-1097, Docket 70-1113
- 2) Letter S.P. Murray (GNF-A) to T. Naquin (NRC), GNF-A SNM 1097 Proposed License Amendment Request, 2/26/18
- 3) Telecom, GNF-A/NRC Staff, 3/16/18
- License Amendment Request, 5/10/18
- 5) Letter T. Naquin (NRC) to S.P. Murray (GNF-A), Request for Additional Information for License Amendment Request for Global Nuclear Fuel - Americas, 6/29/2018
Dear Sir or Madam:
The Global Nuclear Fuel - Americas L.L.C. (GNF-A) facility in Wilmington, North Carolina hereby provides a response to a NRCs Request Request for Additional Information (Reference 5) regarding the SNM-1097 license amendment request for Chapter 5 Nuclear Criticality Safety.
The Attachment to this letter provides the information in response to your request.
Please contact me on (910) 819-5950 if you have any questions or would like to discuss the request.
Sincerely, for Scott P. Murray, Manager Facility Licensing Attachments: 1) GNF Response to NRC 6/29/18 Request for Additional Information - SNM-1097 License Amendment Request
- 2) SNM-1097 Chapter 5 Change Table
- 3) GNF Amended SNM-1097 Chapter 5 Global Nuclear Fuel Scott P. Murray Manager, Facility Licensing 3901 Castle Hayne Road P.O. Box 780 Wilmington, NC 28402 USA T (910) 819-5950 Scott.murray@ge.com
M180164 US NRC May 10, 2018 Page 2 of 2 cc: RK Johnson, USNRC NMSS TD Naquin, USNRC NMSS T. Vukovinsky, USNRC RII SPM 18-042
NRC License SNM-1097 - License Amendment Request RAI Response 8/2/2018
M180164 U.S. NRC August 2, 2018 Page 1 of 11 GNF-A Response to NRC Request for Additional Information (6/29/2018)
CHAPTER 5.0, NUCLEAR CRITICALITY SAFETY
NRC RAI 1 Describe the internal records management requirements for retaining records of criticality safety analyses as discussed in License Application (LA) Section 5.3.2.7, including time frames for retaining those records.
The proposed change removes the commitment that records of criticality safety analyses will be retained during the conduct of licensed activities and for 6 months following cessation of those activities or for a minimum of 3 years, and replaces it with a reference to internal records management requirements. Criticality safety analyses are used to demonstrate that processes will be subcritical under normal and credible abnormal conditions, in accordance with Title 10 of the Code of Federal Regulations (10 CFR) Paragraph 70.61(d). This must be maintained as part of the integrated safety analysis done in accordance with 10 CFR Section 70.62 and as required by 10 CFR 70.61(a).
GNF-A Response Record management requirements are now captured separately in Chapter 11, Management Measures, Section 11.8, Records Management. This includes details covering the requirements for records of documented criticality safety analysis and associated records retention requirements.
Section 5.3.2.7 will be modified to clarify this point as follows:
5.3.2.7 NCS Records Retention Records of criticality safety analyses are maintained in sufficient detail and form to permit independent review and audit of the method of calculation and results. Such records are retained in accord with internal records management requirements outlined in Section 11.8.
NRC RAI 2 Explain when pre-operational audits are considered appropriate to verify that the installed configuration of equipment agrees with the criticality safety analysis, in LA Section 5.4.1.1. Explain if this involves verifying that controls function as required.
The proposed change added the words as needed to the commitment related to pre-operational audits, and removed the statement about verifying that the controls function as intended. Paragraph 70.61(e) of 10 CFR requires that the safety program of 10 CFR 70.62, which includes management measures, ensure that items relied on for safety will be available to perform their intended safety function when needed.
GNF-A Response Pre-operational audits are conducted by criticality safety engineering staff; the responsible criticality safety engineer involved with the CSA or implementing facility change request defines what is required
M180164 U.S. NRC August 2, 2018 Page 2 of 11 for startup authorization of new / revised processes per internal procedure. GNF-A agrees the wording can be improved for clarity purposes as follows:
5.4.1.1 Verification Program The purpose of the verification program is to assure that the controls selected and installed fulfill the requirements identified in the criticality safety analyses. All processes are examined in the "as-built" condition to validate the safety design and to verify the installation. Criticality safety function personnel conduct preoperational audits (e.g., field verification of design features, functional test review) to verify that the installed configuration agrees with the criticality safety analysis.
Operations personnel are responsible for subsequent verification of controls through the use of functional testing or other verification means. When necessary, control calibration and routine maintenance are normally provided by the instrument and calibration and/or maintenance functions. Verification and maintenance activities are performed per established facility practices documented through the use of forms and/or computer tracking systems. Criticality safety function personnel randomly review control verifications and maintenance activities to assure that controls remain effective.
NRC RAI 3 Explain what management measures are applied to passive and active engineered controls for criticality safety. The proposed change added the following sentence to LA Section 5.4.2.1: Beyond appropriate installation, a passive engineered control requires no human action to perform its safety function. Management measures described consist of periodic inspections or verification measurement as appropriate. Passive engineered controls may be subject to corrosion, wear, etc., and may need other management measures to be applied to maintain them (e.g., maintenance). By stating that the only human action needed consists of appropriate installation, this appears to preclude the need for management measures other than those explicitly mentioned. A similar phrase was added to LA Section 5.4.2.2 in regard to active engineered controls, where the only management measures specifically mentioned are periodic calibration and functional testing.
Paragraph 70.61(e) of 10 CFR requires that the safety program of 10 CFR 70.62, which includes management measures, ensure that items relied on for safety will be available to perform their intended safety function when needed.
GNF-A Response The additional statement of Beyond appropriate installation was not intended to change or reduce the application of management measures. GNF-A agrees the wording can be improved for clarity purposes as follows:
5.4.2.1 Passive Engineered Controls A device that uses only fixed physical design features to maintain safe process conditions.
Beyond appropriate installation and management measures (e.g., periodic inspection, preventive maintenance), a passive engineered control requires no human action to perform its
M180164 U.S. NRC August 2, 2018 Page 3 of 11 safety function. Assurance is maintained through specific periodic inspections or verification measurement(s) as appropriate.
5.4.2.2 Active Engineered Controls A physical device that uses active sensors, electrical components, or moving parts to maintain safe process conditions. Beyond appropriate installation and management measures (e.g.,
periodic functional testing), an active engineered control requires no human action to perform its safety function. Assurance is maintained through specific periodic calibration, functional testing, and preventive maintenance as appropriate. Active engineered controls that are designed to be fail-safe (i.e.,meaning failure of the control results in a safe condition) are preferred.
NRC RAI 4
Explain the reason for removing the following sentence from LA Section 5.4.4.2: When only administrative controls are used for mass-controlled systems, double batching is considered to ensure adequate safety margin. If double batching is not always considered under these conditions, describe how adequate safety margins in such cases will be ensured.
Paragraph 70.61(d) of 10 CFR requires that process be shown to be subcritical under normal and credible abnormal conditions, including an approved margin of subcriticality for safety. NUREG-1520, Section 5.4.3.1.7.3(4)(c), states that when overbatching is credible, the largest mass resulting from a single failure, including beyond double batching, should be considered in criticality safety analyses.
GNF-A Response GNF-A considers all credible abnormal conditions (including overbatching) pursuant to Section 5.1.1 process analysis commitment. Additional guidance on safe batch commitments are provided in Section 5.4.3, Specific Parameter Limits.
NRC RAI 5
Clarify what is meant by a primary criticality safety control parameter in connection with moderation control in LA Section 5.4.4.3. The discussion defining moderation control areas (MCAs) and moderation restricted areas (MRAs) has been significantly revised. The distinction between an MCA and MRA depends on whether moderation is controlled in conjunction with other parameters or as the primary criticality safety parameter. These two conditions do not appear to be mutually exclusive or to cover all possible combinations of controls (e.g., moderation could be one of several controlled parameters, but another parameter being considered the primary one).
Paragraph 70.61(d) of 10 CFR requires that nuclear processes be subcritical under normal and credible abnormal conditions, and that preventive controls and measures will be used as the primary means of protection against criticality hazards. Moderation is one of the key parameters used to meet this requirement. This clarification is needed for clarity, and to ensure that adequate control measures are provided to MCAs and MRAs respectively.
M180164 U.S. NRC August 2, 2018 Page 4 of 11 GNF-A Response Primary controlled parameter is a distinction made at GNF-A that refers to a process operation where loss of moderation alone could result in a criticality accident. Based on this RAI, GNF-A will replace the word primary with the word single for clarity. Refer to RAI Response #7.
When the Dry Conversion Process (DCP) began operation, the GNF-A facility desired to make a clear distinction between former moderation controlled areas (or MCA, involving favorable geometry equipment) and the new DCP involving unfavorable geometry equipment (e.g., reactor kiln, large powder containers, homogenizers, blenders). The term moderation restricted area (MRA) was created to emphasize that moderation was the primary [or single] controlled parameter. An operational distinction is made between MCA/MRA processes as a facility-specific practice in accord with ANSI/ANS-8.22, Section 4.1.4. The fundamental physics of assuring undermoderated conditions are retained at all times are the same in both the MCA and MRA processes. In MCA processes, additional controlled parameters are used. In MRA applications, two or more independent controls on moderation are used.
After 20+ years of operating history, GNF-A operational experience / lessons-learned (OE/LL) supports the removal of prior triple contingent commitments previously contained in SNM-1097 Chapter 5 as no longer necessary for designated MRA processes. GNF-A remains committed to demonstrating compliance with the process analysis requirement and double contingency principle as stated in License Application Section 5.1.1 and in accordance with ANSI/ANS-8.1 4.2.2. In addition, ANSI/ANS-8.22 provides adequate guidance for nuclear criticality safety based on limiting and controlling moderators including administrative practices, process evaluations, engineered practices for moderator control areas. GNF-A process evaluations follow these principles and documented criticality safety analyses (CSAs) demonstrate compliance with the double contingency principle and the process remains subcritical under normal and credible abnormal conditions. Corresponding quantitative risk assessments (QRAs) outlined in SNM-1097 ISA Chapter 3 demonstrate compliance with 10 CFR 70.61 performance requirements. GNF-A process operations for which moderator control is used meet both.
NRC RAI 6 In LA Section 5.4.4.3, clarify the difference between controls and barriers. The proposed change added the following wording: Process evaluations for MCA/MRA designated areas shall explicitly identify the limits, controls, and engineered barriers for designated moderator control areas.
Paragraph 70.61(d) of 10 CFR requires that nuclear processes be subcritical under normal and credible abnormal conditions, and that preventive controls and measures will be used as the primary means of protection against criticality hazards. NUREG-1520, Section 5.4.3.1.5(2)(a), among other places, refers to safety limits and controls; criticality controls may be passive engineered, active engineered, or administrative. If there is a distinction between controls and engineered barriers, clarification is needed to ensure that appropriate management measures are applied to each.
GNF-A Response As stated in prior RAI responses, ANSI/ANS-8.22 provides adequate guidance for nuclear criticality safety based on limiting and controlling moderators including administrative practices, process
M180164 U.S. NRC August 2, 2018 Page 5 of 11 evaluations, engineered practices for moderator control areas. Documented criticality safety analyses (CSAs) at GNF-A explicitly derive corresponding subcritical limits and identify corresponding controls and engineered barriers to assure said subcritical limits remain in effect during operation in accord with technical practices outlined in SNM-1097, Section 5.4. Engineered practices for moderator control areas commonly acknowledge engineered barriers used to prevent external moderator entry into a fissionable material process. This may include (but not limited to) a structure such as a primary roof, secondary roof, containment hood, or process equipment structure itself. There is no distinction between control and engineered barrier in this context. If credit for an engineered barrier is required to demonstrate the system remains subcritical under normal and credible abnormal conditions, this barrier will be designated as a passive, active, or administrative control as outlined in Section 5.4.2.
Management measures applied to each control designated an IROFS in accord with SNM-1097 Section 3.5.3. The selection criteria used to identify the appropriate application of management measures (or elements of a specific management measure) includes considering the type of IROFS (active engineered control, passive engineered control, augmented administrative control, or administrative control).
NRC RAI 7
State in LA Section 5.4.4.3 how MCA and MRA will be marked and controlled.
NUREG-1520, Section 5.4.3.1.7.3(9)(c) states that moderation-controlled areas should be conspicuously marked and administrative controls established to prevent credible moderator intrusion.
The current LA stated that such areas will be posted and describes the controls that will be applied in implementing such areas. The proposed change removes this discussion.
GNF-A Response The posting requirement was inferred though not explicitly stated in the proposed moderator control LA Section 5.4.4.3. GNF-A will modify section 5.4.4.3 to make this point clear and to reinstate the posting requirement in the license amendment, in accordance with internal facility practices.
5.4.4.3 Moderation - Moderator control may be used for nuclear criticality safety control on its own or in combination with other control methods. Moderator control areas shall be defined in the process evaluation in which moderators are limited and controlled for nuclear criticality. For areas where moderation is used in conjunction with other control methods, the area is classified as a moderation control area (MCA) and posted accordingly. When moderation is the single criticality safety controlled parameter, the area is classified as a moderation restricted area (MRA) and posted accordingly.
Process evaluations for MCA/MRA designated areas shall explicitly identify the limits, controls, and engineered barriers for designated moderator control areas. Material properties, credible moderator present in, introduced to, or accumulated in an MCA/MRA shall be considered.
Credible non-uniform distribution of moderators, moderator content measurement, and fire suppression methods shall also be considered.
M180164 U.S. NRC August 2, 2018 Page 6 of 11
NRC RAI 8 Describe how the impacts of firefighting on MCA are considered in your criticality safety analyses.
NUREG-1520, Section 5.4.3.1.7.3(9)(d) states that firefighting procedures for use in moderation-controlled areas should be evaluated in criticality safety evaluations, as well as the effects of the fire and activation of fire suppression, and that restrictions on the use of moderating firefighting agents be included in procedures and training. LA Section 5.4.4.3 states only that fire suppression methods are considered.
GNF-A Response Firefighting in moderator-controlled areas (i.e., designated MCA and MRA) are evaluated on a process node basis and credible nuclear criticality safety hazards are documented in internal criticality safety analyses (CSAs).
For example, in a MRA designated facility, the accident sequence associated process equipment is a potential criticality resulting from introduction of moderator into unfavorable geometries as a result of firefighting activities. Initiating events (IEs) postulate a fire occurring in the MRA facility process areas that include unfavorable geometry process equipment or powder containers due to transient combustibles (e.g. HU error hot work; electrical failure, etc.).
In MCA designated facilities, initiating events (IEs) postulate a challenging fire occurring near favorable geometry process equipment due to transient combustibles (e.g. HU error hot work; electrical failure, adjacent fire, etc.). The accident sequence associated with these PHA items is a potential criticality resulting from development of unfavorable geometries as a result of a fire and introduction of moderator as a result of firefighting activities while there is an unsafe mass present. CSAs consider loss of favorable geometry resulting from exposure to fire as a result of equipment damage. Moderator introduction from firefighting activities is assumed to occur.
Effect of fire suppression and sprinkler activation are evaluated on process by process basis within the documented CSA. Personnel (both operators and fire responders) are trained on associated controls include applicable elements of the combustible control program, fire suppression methods, and process equipment barriers used to contain uranium and prevent moderator intrusion.
NRC RAI 9 Describe the approach towards ensuring independence when sole reliance is placed on concentration control in LA Section 5.4.4.4. The proposed change removes the discussion of attaining independence to conform to the double contingency principle.
NUREG-1520, Section 5.4.3.1.7.3(10)(d), states that transfers to unfavorable geometry tanks relying on concentration control should entail dual-independent sampling and/or in-line monitoring. The commitment meeting the intent of this acceptance criterion was removed.
M180164 U.S. NRC August 2, 2018 Page 7 of 11
GNF-A Response GNF-A will modify the wording for clarity purposes as follows:
5.4.4.4 Concentration (or Density) - Concentration control may be used for nuclear criticality safety control on its own or in combination with other control methods. Concentration controls are established to ensure that the concentration level is maintained within defined limits for the system. When concentration is the only parameter controlled to prevent criticality, concentration may be controlled by at least two independent combinations of measurement and physical control, each physical control capable of preventing the concentration limit being exceeded. The preferred method of demonstrating double contingency being that one of the two combinations is a passive control (e.g., favorable geometry tanks) or at least one of the two is an active engineered (e.g., in-line density monitoring).
When precipitating agents are used in systems where concentration is utilized as a criticality control parameter, controls are in place to ensure that the concentration level is maintained within defined limits for the system. Precautions are taken to protect against inadvertent introduction of precipitation agents in accordance with the configuration management program described in Chapter 11.
NRC RAI 10
Explain why the sentence committing to establishing controls necessary to detect and/or mitigate the effects on internal concentration, except when assuming the most reactive credible concentration, was removed from LA Section 5.4.4.4.
NUREG-1520, Section 5.4.3.1.7.3(10)(a), states that controls are established to limit concentration unless the process has been demonstrated subcritical at optimum concentration. The commitment addressing this acceptance criteria was removed.
GNF-A Response
Refer to RAI #9 response.
NRC RAI 11
Explain how the continued presence of an absorber, its distribution, its concentration, and any other characteristics associated with nuclear criticality safety will be ensured for any neutron absorbers credited in criticality safety analyses for in-process fuel. State whether you are committing to American National Standards Institute/American Nuclear Society (ANSI/ANS) 8.21-1995 (R2011). Define what is meant by in-process fuel.
NUREG-1520, Section 5.4.3.1.7.3(12), contains acceptance criteria for the use of neutron absorbers, including committing to ANSI/ANS-8.21. This standard pertains to the use of fixed absorbers, which
M180164 U.S. NRC August 2, 2018 Page 8 of 11 does not include such in-process forms as powders or solutions. The current LA only includes a provision for crediting integral absorbers in completed fuel rods.
GNF-A Response In-process fuel was used to describe nuclear material in a form other than a final process (e.g.,
uranium powder mixture, uranium ceramic pellet, fuel rod). GNF-A took into consideration ANSI/ANS-8.14 for soluble neutron absorbers and ANSI/ANS-8.21 for fixed neutron absorbers. For a form such as a uranium powder mixture, the presence of a neutron absorber does not meet the definition of a fixed absorber in ANSI/ANS-8.21 and is closer to the definition of a soluble neutron absorber (a solid-solid solution). The definition of soluble neutron absorber from ANSI/ANS-8.14 is any neutron poison easily dispersed in liquid, solution, or suspension, used specifically to reduce the reactivity of a system and for which reactivity credit is taken in the nuclear criticality safety evaluation of the system. In the development of changes to Section 5.4.4.5 on neutron absorbers, the administrative requirements and guidance from ANSI/ANS-8.14 was used to develop the requirements established in Section 5.4.4.5 covering in-process fuel. GNF-A will improve the wording for clarity purposes as follows:
5.4.4.5 Neutron Absorber - Neutron absorbing materials may be utilized to provide a method for nuclear criticality safety control for a process, vessel or container. Stable compounds such as boron carbide fixed in a matrix such as aluminum or polyester resin; elemental cadmium clad in appropriate material; elemental boron alloyed stainless steel, or other solid neutron absorbing materials with an established dimensional relationship to the fissionable material are recommended. The use of neutron absorbers in this manner is defined as part of a passive engineered control. Credit may also be taken for neutron absorbers added to fuel, such as gadolinia.
For fixed neutron absorbers used as part of a geometry control, the following requirements apply:
The compositions of the absorber are measured and documented prior to first use.
Periodic verification of the integrity of the neutron absorber system subsequent to installation is performed on a scheduled basis approved by the criticality safety function.
The method of verification may take the form of traceability (e.g., serial number, QA documentation, etc.), visual inspection or direct measurement, as appropriate for the application.
For crediting neutron absorbers added to the fuel, such as gadolinia, the following requirements apply:
For in-process fuel (e.g., mechanical mixing of gadolinia powder with uranium oxide powder), the continued presence of the absorber in the fuel, its distribution, and its concertation is verified using an appropriate method. The system design should include factors such as process conditions, hazards, and human errors for potential degradation of the neutron absorber. Acquisition, storage, preparation and use of the neutron absorbers should conform to the established quality program.
For fuel bundles, the presence of the gadolinia absorber in completed fuel rods is documented and verified using non-destructive testing; and the placement of rods in completed fuel bundles is documented in accordance with established quality control practices.
M180164 U.S. NRC August 2, 2018 Page 9 of 11
NRC RAI 12
Justify removing the larger of in LA Section 5.4.4.6, including justifying that a 12-foot air distance and the greatest distance across an orthographic projection of the largest of the fissile accumulations on a plane perpendicular to the line joining their centers always provide neutron isolation between individual fissile material units.
Paragraph 70.61(d) requires that nuclear systems be demonstrated to be subcritical under normal and credible abnormal conditions. Units that are neutronically isolated may be modeled separately to make this demonstration. When neutron interaction exists or is credible, its effect must be addressed to provide reasonable assurance of subcriticality. The current LA states that units will be considered isolated if they are separated by the larger of a 12-foot air distance or the greatest distance across an orthographic projection as described above. This has been evaluated and approved by the U.S.
Nuclear Regulatory Commission and is consistent with standard industry practice. The proposed change would allow the use of either criterion, rather than the greater of the two, without providing justification.
GNF-A Response GNF-A is updating the wording in Section 5.4.4.6 to provide clarity, including restoring the larger of in the second bullet.
5.4.4.6 Spacing (or Unit Interaction) - Criticality safety controls may be based on isolation or interacting unit spacing. Unless a basis is explicitly documented in the criticality safety analysis, then units or arrays may be considered effectively noninteracting (isolated) when they are separated by either of the following:
12-inches of full density water equivalent, the larger of 12-foot air distance, or the greatest distance across an orthographic projection of the largest of the fissile accumulations on a plane perpendicular to the line joining their centers.
NRC RAI 13
Clarify whether the criticality safety analyses described in LA Section 5.4.5.5 ensure that uncontrolled parameters will be evaluated assuming optimum or worst credible values, unless specified controls are implemented to limit parameters to a particular range of values, and whether justification for evaluating uncontrolled parameters at less than their optimum values is provided in criticality safety analyses. In addition, clarify whether normal operating conditions are described, and system interfaces considered, in your criticality safety analyses.
NUREG-1520, Section 5.4.3.1.7.2(1)(a) contains the acceptance criteria related to evaluating uncontrolled parameters at their optimum or worst credible values. The current LA Section 5.4.5.5 describes the content of criticality safety analyses, which includes a summary of bounding assumptions, including modeling of worst credible conditions, and consideration of system interfaces.
M180164 U.S. NRC August 2, 2018 Page 10 of 11 The proposed change would remove much of the detail in this section, including the discussion of parameter values for controlled and uncontrolled parameters. This information is needed to demonstrate subcriticality under normal and credible abnormal conditions, as required by 10 CFR 70.61(d).
GNF-A Response GNF-A will improve the wording in Section 5.4.5.5 for clarity purposes as follows:
5.4.5.5 Criticality Safety Analysis (CSA)
A CSA is prepared or updated for each new or significantly modified unit or process system within GNF-A in accordance with section 5.1.2.1 and established configuration management control practices defined in Chapter 11.
The scope and content of any particular CSA reflects the needs and characteristics of the system being analyzed, as specified in internal procedures, and typically includes the following elements:
Scope - Defines the extent and purpose of the analysis.
General Process Description - This element presents an overview of the process that is affected by the proposed change. This section includes as appropriate; process description, flow diagrams, normal operating conditions, system interfaces, and other important to design considerations.
Criticality Safety Hazards - A listing and evaluation of credible process upset conditions applicable to scope, and a discussion of how established nuclear criticality safety limits are addressed for each credible process upset condition. Independent controls and management measures that demonstrate compliance with the Double Contingency Principle are described with consideration for common mode failure.
Methodology - A description of compute code(s) used, bias and bias uncertainty, area of applicability, bounding assumptions, calculational assumptions, and design features.
Calculations and Results - A description of model constructs, how calculations were performed, what analytic tools or reference documents were used, and a summary of the calculational result and associated uncertainty (Keff + 3) as a function of key parameter(s). When applicable, the assigned bias and associated bias uncertainty is stated and compared to accident limit results. Limits derived are based on most reactive values of uncontrolled parameters or based on worst credible values of uncontrolled parameters with documented justifications.
Specifications and Requirements for Safety - When applicable, this element presents both bounding design assumptions and the criticality safety requirements for correct implementation of established controls. Interface considerations with other units/processes. The requirements are grouped according to passive, active, or administrative controls. Generic management measures and applicable elements of combustible material control programs may also be included in this element.
M180164 U.S. NRC August 2, 2018 Page 11 of 11 Conclusions - This element concludes the analysis with pertinent summary statements and includes a statement regarding license compliance for process analysis.
References - This element includes a listing of applicable references cited in the analysis.
Attachments - This element includes appropriate attachments to support analysis content and may include (but not limited to) materials used, data trends, sample input file(s), tabulated (Keff + 3) results.
NRC License SNM-1097 - License Amendment Request RAI Response 8/2/2018
M180164 US NRC August 2, 2018 Page 1 of 12 SNM-1097 License Application Chapter 5 Change Table Section Description of Change Reason for Change Chapter 5 - NUCLEAR CRITICALITY SAFETY Chapter 5 Section 5.1.1, Criticality Safety Design Philosophy Continued:
Section 5.1.1, Criticality Safety Design Philosophy First sentence changed The Double Contingency Principle as identified to The Process analysis as discussed in section 4.1.2 and the Double-contingency principle as identified Changed (1998) is the fundamental technical basis to (2014) are fundamental bases Added bullet points:
Before a new operation with fissionable material is begun, or before an existing operation is changed, it shall be determined that the entire process will be subcritical under both normal and credible abnormal conditions.
Process designs should incorporate sufficient factors of safety to require at least two unlikely, independent, and concurrent changes in process conditions before a criticality accident is possible.
Second paragraph deleted an inadvertent and added or process condition changes Third paragraph The established to Established b) deleted an inadvertent e) deleted IROFS added parameter Administrative Update Administrative Update Administrative Update Align with updates to ANSI/ANS 8.1 Administrative Update Administrative Update Administrative Update Administrative Update Section 5.1.2.1 Changes to Facility First paragraph added criticality safety and removed chemical hazards Third paragraph added ISA documents are updated per section 11.2 Clarification Clarification Section 5.1.4.1, Posting of Limits and Controls Updated second paragraph to refer to internal procedures Administrative Update
M180164 US NRC August 2, 2018 Page 2 of 12 SNM-1097 License Application Chapter 5 Change Table Section Description of Change Reason for Change Section 5.3.1 General Configuration Management First sentence changed 2005 to 2014 Administrative Update Section 5.3.2.1, Training and Qualification of NCS Staff Removed The most effective training is on the job facility specific training, which, added CSE qualifications and changed senior NCS management to NCS management in last sentence of second paragraph Clarification Section 5.3.2.2, Auditing, Assessing and Upgrading the NCS Program Fourth paragraph, second sentence changed reported in writing to documented and provided and changed who disseminates the report to line are to and facility Second paragraph, last sentence changed Results in the form of corrective action requests to Findings requiring corrective action Clarification Content not applicable to NCS Section 5.3.2.4, Modifications to Operating and Maintenance Procedures Second sentence, second paragraph changed concerned personnel to affected personnel Clarification 5.3.2.5 Criticality Accident Alarm System (CAAS) Design and Performance Requirements Second sentence changed 2003 to (R2012)
Administrative Update Section 5.3.2.7, NCS Records Retention Records of criticality safety analyses are maintained in sufficient detail and form to permit independent review and audit of the method of calculation and results. Such records are retained in accord with internal records management requirements outlined in Section 11.8.
Administrative Update Wording modified in response to 6/29/2018 RAI
- 1 Section 5.4.1, Control Practices Continued:
Section 5.4.1, Control Practices First paragraph First sentence, added limits and controls and deleted effective Second sentence deleted Prior to use in any enriched uranium process, nuclear criticality safety controls are verified against criticality safety analysis criteria. The ISA program described in Chapter 3 implement performance based management of process requirements and specifications that are important to nuclear criticality safety.
and added The Area Manager, with NCS support, implements the limits Administrative Update Clarification that the Area Manager is responsible for establishing controls necessary for the CSA
M180164 US NRC August 2, 2018 Page 3 of 12 SNM-1097 License Application Chapter 5 Change Table Section Description of Change Reason for Change and controls documented in the CSA.
Section 5.4.1.1, Verification Program The purpose of the verification program is to assure that the controls selected and installed fulfill the requirements identified in the criticality safety analyses. All processes are examined in the "as-built" condition to validate the safety design and to verify the installation. Criticality safety function personnel conduct preoperational audits (e.g., field verification of design features, functional test review) to verify that the installed configuration agrees with the criticality safety analysis.
Operations personnel are responsible for subsequent verification of controls through the use of functional testing or other verification means. When necessary, control calibration and routine maintenance are normally provided by the instrument and calibration and/or maintenance functions. Verification and maintenance activities are performed per established facility practices documented through the use of forms and/or computer tracking systems.
Criticality safety function personnel randomly review control verifications and maintenance activities to assure that controls remain effective.
Clarification to provide a better description of the verification program.
Wording modified in response to 6/29/2018 RAI
- 2 Section 5.4.1.2., Maintenance Program Changed first sentence from The purpose of the maintenance program is to assure that the effectiveness of IROFS designated for a specific process are maintained at the original level of intent and functionality. to The purpose of planned and scheduled maintenance of safety controls is to assure that systems are kept in a condition of readiness to perform the planned and designed functions when required.
Second sentence added calibration Clarification of maintenance program Administrative update Section 5.4.2, Means of Control Changed simple administrative controls to administrative controls in the fourth sentence Administrative update
M180164 US NRC August 2, 2018 Page 4 of 12 SNM-1097 License Application Chapter 5 Change Table Section Description of Change Reason for Change Section 5.4.2.1, Passive Engineered Controls A device that uses only fixed physical design features to maintain safe process conditions. Beyond appropriate installation and management measures (e.g., periodic inspection, preventive maintenance),
a passive engineered control requires no human action to perform its safety function. Assurance is maintained through specific periodic inspections or verification measurement(s) as appropriate.
Clarification of a passive engineered control.
Wording modified in response to 6/29/2018 RAI
- 3 Section 5.4.2.2, Active Engineered Controls A physical device that uses active sensors, electrical components, or moving parts to maintain safe process conditions. Beyond appropriate installation and management measures (e.g., periodic functional testing), an active engineered control requires no human action to perform its safety function. Assurance is maintained through specific periodic calibration, functional testing, and preventive maintenance as appropriate. Active engineered controls that are designed to be fail-safe (i.e.,meaning failure of the control results in a safe condition) are preferred.
Clarification of an active engineered control.
Wording modified in response to 6/29/2018 RAI
- 3 Section 5.4.2.3, Administrative Controls Deleted first sentence Either an augmented administrative control or a simple administrative control as defined herein:
Second bullet changed Simple Administrative Controls to Administrative Controls First sentence, last paragraph changed is to should be Administrative Update Administrative Update Administrative Update Section 5.4.3, Specific Parameter Limits First sentence changed safe geometry values of Table 5.1 below are specifically licensed for use to favorable geometry values of Table 5.1 contain dimensions for sphere, cylinder, and slab which may be used for applicable operations Clarification of safe geometry values
M180164 US NRC August 2, 2018 Page 5 of 12 SNM-1097 License Application Chapter 5 Change Table Section Description of Change Reason for Change Continued:
Section 5.4.3, Specific Parameter Limits Second sentence, first paragraph added and the moderating material is not more effective than water Second paragraph Deleted or explicit stochastic or deterministic modeling methods and added last sentence When not applicable, the Criticality Safety Engineer may use approved validated stochastic or deterministic codes to determine subcritical limits First sentence, third paragraph changed are specifically licensed for use at GNF-A to may be used for applicable operations at GNF-A.
Application of these safe batch values is limited to situations where the neutron reflection present does not exceed that due to full water reflection and the moderating material is not more effective than water.
Added second sentence to third paragraph Application of these safe batch values is limited to situations where the neutron reflection present does not exceed that due to full water reflection and the moderating material is not more effective than water.
Changed kgs to kg in formula Deleted bullet point Where engineered controls prevent over batching, a mass of 75% of the minimum critical mass shall not be exceeded.
Changed Subject to provision for adequate protection against precipitation or other circumstances which may increase concentration, the following safe concentrations are specifically licensed for use at GNF-A: to The safe concentration values below may be used for applicable operations at GNF-A subject to provision for adequate protection against precipitation or other circumstances which may increase concentration. In paragraph under second bullet Clarification of application of geometry controls Clarification of the dimensional limitations of Table 5.1 Administrative Update Clarification of safe batch values Typographical Correction Clarification - No longer used Clarification of safe concentration values
M180164 US NRC August 2, 2018 Page 6 of 12 SNM-1097 License Application Chapter 5 Change Table Section Description of Change Reason for Change Table 5.1 Favorable Geometry Values Change table title from Safe to Favorable Clarification Table 5.2, Safe Batch Values for UO2 and Water Changed Kgs to kg in table Typographical Correction Section 5.4.4.1, Geometry First paragraph, fourth sentence changed conservatively assuming unlimited water or concrete equivalent reflection, optimal hydrogenous moderation, worst credible heterogeneity, and maximum credible enrichment to be processed. to conservatively assuming worst credible conditions (e.g., reflection, moderation, heterogeneity, and enrichment) for the material to be processed.
Clarification of favorable geometry control Section 5.4.4.2, Mass First paragraph, first sentence changed Mass control to Mass Third sentence added along with adequate measurement uncertainty Second paragraph, first sentence changed potential to worst credible Deleted last sentence in second paragraph Administrative Update Clarification of mass control methods Clarification of mass control methods Clarification of mass control methods Section 5.4.4.3. Moderation Moderator control may be used for nuclear criticality safety control on its own or in combination with other control methods. Moderator control areas shall be defined in the process evaluation in which moderators are limited and controlled for nuclear criticality. For areas where moderation is used in conjunction with other control methods, the area is classified as a moderation control area (MCA) and posted accordingly. When moderation is the single criticality safety controlled parameter, the area is classified as a moderation restricted area (MRA) and posted accordingly.
Process evaluations for MCA/MRA designated areas shall explicitly identify the limits, controls, and Clarification of moderation control. Wording modified in response to 6/29/2018 RAI #7
M180164 US NRC August 2, 2018 Page 7 of 12 SNM-1097 License Application Chapter 5 Change Table Section Description of Change Reason for Change Continued:
Section 5.4.4.3. Moderation engineered barriers for designated moderator control areas. Material properties, credible moderator present in, introduced to, or accumulated in an MCA/MRA shall be considered.
Credible non-uniform distribution of moderators, moderator content measurement, and fire suppression methods shall also be considered.
Section 5.4.4.4, Concentration (Density)
Concentration control may be used for nuclear criticality safety control on its own or in combination with other control methods. Concentration controls are established to ensure that the concentration level is maintained within defined limits for the system.
When concentration is the only parameter controlled to prevent criticality, concentration may be controlled by at least two independent combinations of measurement and physical control, each physical control capable of preventing the concentration limit being exceeded.
The preferred method of demonstrating double contingency being that one of the two combinations is a passive control (e.g., favorable geometry tanks) or at least one of the two is an active engineered (e.g., in-line density monitoring). When precipitating agents are used in systems where concentration is utilized as a criticality control parameter, controls are in place to ensure that the concentration level is maintained within defined limits for the system. Precautions are taken to protect against inadvertent introduction of precipitation agents in accordance with the configuration management program described in Chapter 11.
Update for simplification Wording modified in response to 6/29/2018 RAI
- 9 Section 5.4.4.5, Neutron Absorber Neutron absorbing materials may be utilized to provide a method for nuclear criticality safety control for a process, vessel or container. Stable compounds such as boron carbide fixed in a matrix such as aluminum or polyester resin; elemental cadmium clad in appropriate material; elemental boron alloyed stainless steel, or other solid neutron absorbing materials with an established dimensional Clarification of neutron absorber control.
Wording modified in response to 6/29/2018 RAI
- 11
M180164 US NRC August 2, 2018 Page 8 of 12 SNM-1097 License Application Chapter 5 Change Table Section Description of Change Reason for Change (Continued) Section 5.4.4.5, Neutron Absorber relationship to the fissionable material are recommended. The use of neutron absorbers in this manner is defined as part of a passive engineered control. Credit may also be taken for neutron absorbers added to fuel, such as gadolinia.
For fixed neutron absorbers used as part of a geometry control, the following requirements apply:
The compositions of the absorber are measured and documented prior to first use.
Periodic verification of the integrity of the neutron absorber system subsequent to installation is performed on a scheduled basis approved by the criticality safety function. The method of verification may take the form of traceability (e.g., serial number, QA documentation, etc.), visual inspection or direct measurement, as appropriate for the application.
For crediting neutron absorbers added to the fuel, such as gadolinia, the following requirements apply:
For in-process fuel (e.g.,
mechanical mixing of gadolinia powder with uranium oxide powder), the continued presence of the absorber in the fuel, its distribution, and its concertation is verified using an appropriate method. The system design should include factors such as process conditions, hazards, and human errors for potential degradation of the neutron absorber. Acquisition, storage, preparation and use of the neutron absorbers should conform to the established quality program.
For fuel bundles, the presence of the gadolinia absorber in completed fuel rods is documented and
M180164 US NRC August 2, 2018 Page 9 of 12 SNM-1097 License Application Chapter 5 Change Table Section Description of Change Reason for Change verified using non-destructive testing; and the placement of rods in completed fuel bundles is documented in accordance with established quality control practices.
Section 5.4.4.6, Spacing (or Unit Interaction)
Criticality safety controls may be based on isolation or interacting unit spacing. Unless a basis is explicitly documented in the criticality safety analysis, then units or arrays may be considered effectively noninteracting (isolated) when they are separated by either of the following:
12-inches of full density water equivalent, the larger of 12-foot air distance, or the greatest distance across an orthographic projection of the largest of the fissile accumulations on a plane perpendicular to the line joining their centers.
Clarification of spacing control. Wording modified in response to 6/29/2018 RAI #12 Section 5.4.4.8, Reflection Added first sentence Second sentence replaced Most with Generally Changed second sentence from However, subject to approved controls which limit reflection, certain system designs may be analyzed, approved, and operated in situations where the analyzed reflection is less than optimum. to However, subject to an approved analysis documenting controls or process conditions which limit reflection, certain system designs may be approved and operated in situations where the analyzed reflection is less than optimum.
Clarification of definition for reflection Administrative Update Clarification of definition for reflection Section 5.4.5.1, Keff Limit Deleted second sentence in first paragraph including applicable bias and bias uncertainty corrections, for credible process upset (accident) conditions are and added (keff) of the system plus three (3) times the standard deviation of the Monte Carlo code must be Clarification of definition of K effective
M180164 US NRC August 2, 2018 Page 10 of 12 SNM-1097 License Application Chapter 5 Change Table Section Description of Change Reason for Change Second paragraph, second sentence changed accident to upset Administrative Update Section 5.4.5.2, Analytical Methods First sentence added SCALE/KENO Changed Additional to Additionally and deleted Monte Carlo codes (e.g., Keno-Va. and MCNP) or Sn from second sentence Provided additional examples of analytical methods Administrative Update Section 5.4.5.3, Validation Techniques Second paragraph under Minimum Margin of Subcriticality (MMS) added plus three (3) times the standard deviation for the Monte Carlo code Twelfth bullet added outlined in the validation report the USL is defined as and deleted For all benchmark experiments absolutely critical (kexp =
1.0)
Fifth paragraph changed accident to upset Seventh paragraph changed is to are Thirteenth bullet changed to to in and needed to included Clarification of definition of MMS Clarification of definition of MMS Administrative Update Grammatical correction Grammatical correction Section 5.4.5.4, Computer Software & Hardware Configuration Control Second sentence added For codes developed or modified at GNF Clarification Section 5.4.5.5, Criticality Safety Analysis (CSA)
First paragraph moved from Section 5.3.2.7 A CSA is prepared or updated for each new or significantly modified unit or process system within GNF-A in accordance with section 5.1.2.1 and established configuration management control practices defined in Chapter 11.
The scope and content of any particular CSA reflects the needs and characteristics of the system being analyzed, as specified in internal procedures, and typically includes the Administrative Update
M180164 US NRC August 2, 2018 Page 11 of 12 SNM-1097 License Application Chapter 5 Change Table Section Description of Change Reason for Change (Continued) Section 5.4.5.5, Criticality Safety Analysis (CSA) following elements:
Scope - Defines the extent and purpose of the analysis.
General Process Description -
This element presents an overview of the process that is affected by the proposed change. This section includes as appropriate; process description, flow diagrams, normal operating conditions, system interfaces, and other important to design considerations.
Criticality Safety Hazards - A listing and evaluation of credible process upset conditions applicable to scope, and a discussion of how established nuclear criticality safety limits are addressed for each credible process upset condition.
Independent controls and management measures that demonstrate compliance with the Double Contingency Principle are describedwith consideration for common mode failure.
Methodology - A description of compute code(s) used, bias and bias uncertainty, area of applicability, bounding assumptions, calculational assumptions, and design features.
Calculations and Results - A description of model constructs, how calculations were performed, what analytic tools or reference documents were used, and a summary of the calculational result and associated uncertainty (Keff +
- 3) as a function of key parameter(s). When applicable, the assigned bias and associated bias uncertainty is stated and compared to accident limit results. Limits derived are based on most reactive values of uncontrolled
M180164 US NRC August 2, 2018 Page 12 of 12 SNM-1097 License Application Chapter 5 Change Table Section Description of Change Reason for Change (Continued) Section 5.4.5.5, Criticality Safety Analysis (CSA) parameters or based on worst credible values of uncontrolled parameters with documented justifications.
Specifications and Requirements for Safety -
When applicable, this element presents both bounding design assumptions and the criticality safety requirements for correct implementation of established controls. Interface considerations with other units/processes. The requirements are grouped according to passive, active, or administrative controls.
Generic management measures and applicable elements of combustible material control programs may also be included in this element.
Conclusions - This element concludes the analysis with pertinent summary statements and includes a statement regarding license compliance for process analysis.
References - This element includes a listing of applicable references cited in the analysis.
Attachments - This element includes appropriate attachments to support analysis content and may include (but not limited to) materials used, data trends, sample input file(s), tabulated (Keff + 3) results.
NRC License SNM-1097 - License Amendment Request RAI Response 8/2/2018
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.1 CHAPTER 5.0 NUCLEAR CRITICALITY SAFETY 5.1 NUCLEAR CRITICALITY SAFETY PROGRAM MANAGEMENT 5.1.1 CRITICALITY SAFETY DESIGN PHILOSOPHY The Process analysis as discussed in section 4.1.2 and the Double-contingency principle as identified in section 4.2.2 of the nationally recognized American National Standard ANSI/ANS-8.1 (2014) are fundamental bases for design and operation of processes within the GNF-A fuel manufacturing operations using fissile materials. As such, Before a new operation with fissionable material is begun, or before an existing operation is changed, it shall be determined that the entire process will be subcritical under both normal and credible abnormal conditions.
Process designs should incorporate sufficient factors of safety to require at least two unlikely, independent, and concurrent changes in process conditions before a criticality accident is possible.
For each process that has accident sequences that could result in a nuclear criticality, a defense of one or more system parameters provided by at least two independent controls or process condition changes is documented in the criticality safety analysis (CSA), which is reviewed and enforced.
Established design criteria and nuclear criticality safety reviews are applicable to:
all new and existing processes, facilities or equipment that process, store, transfer or otherwise handle fissile materials, and any change in existing processes, facilities or equipment which may have an impact on the established basis for nuclear criticality safety.
GNF-A nuclear criticality safety (NCS) program management commits to the following objectives:
a) providing sufficient safeguards and demonstrate adequate margin of safety to prevent an inadvertent criticality during conversion, production, storage, or shipment of enriched uranium product b) protecting against the occurrence of an identified accident sequence in the ISA Summary that could lead to a nuclear criticality
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.2 c) complying with the NCS performance requirements of 10 CFR 70.61 d) establishing and maintaining NCS controlled parameters and procedures e) establishing and maintaining NCS subcritical limits for identified parameters f) conducting NCS evaluations (herein referred to as criticality safety analyses (CSAs) to assure that under normal and credible abnormal conditions, all fissile uranium processes remain subcritical, and maintain an adequate margin of safety g) establishing and maintaining NCS IROFS, based on current NCS determinations h) complying with established internal nuclear criticality safety design criteria i) complying with the NCS ISA Summary requirements in 10 CFR 70.65(b) j) complying with the NCS ISA Summary change process requirements in 10 CFR 70.72 5.1.2 EVALUATION OF CRITICALITY SAFETY 5.1.2.1 Changes to Facility As part of the design of new facilities or significant additions or changes in existing facilities, Area Managers provide for the evaluation of nuclear criticality safety hazards, hydrogenous content of materials (including firefighting materials), and mitigation of inadvertent unsafe acts by individuals. Specifically, when criticality safety considerations are impacted by these changes, the approval to operate new facilities or make significant changes, modification, or additions to existing facilities is documented in accord with established facility practices and conform to the ISA change management process described in Chapters 3 and 11.
Change requests are processed in accordance with configuration management requirements described in Chapter 11. Change requests which establish or involve a change in existing criticality safety parameters require a senior engineer within the criticality safety function to disposition the proposed change with respect to the need for a criticality safety analysis.
If an analysis is required, the change is not placed into operation until the criticality safety analysis is complete, ISA documents are updated per section 11.2, and other preoperational requirements are fulfilled in accordance with established configuration management practices.
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.3 5.1.2.2 Role of the Criticality Safety Function Qualified personnel as described in Chapter 2.0 assigned to the criticality safety function determine the basis for safety for processing fissile material. Assessing both normal and credible abnormal conditions, criticality safety personnel specify functional requirements for criticality safety controls commensurate with the risk involved.. Responsibilities of the criticality safety function are described in Chapter 2.0.
5.1.3 OPERATING PROCEDURES Procedures that govern the handling of enriched uranium are reviewed and approved by the criticality safety function.
Each Area Manager is responsible for developing and maintaining operating procedures that incorporate limits and controls established by the criticality safety function. Area Managers assure that appropriate area engineers, operators, and other concerned personnel review and understand these procedures through postings, training programs, and/or other written, electronic or verbal notifications.
Documentation of the review, approval and operator orientation process is maintained within the configuration management system. Specific details of this system are described in Chapter 11.
5.1.4 POSTING AND LABELING 5.1.4.1 Posting of Limits and Controls Nuclear criticality safety requirements for each process system that are defined by the criticality safety function are made available to work stations in the form of written or electronic operating procedures, and/or clear visible postings.
Posting may refer to the placement of signs or marking of floor areas to summarize key criticality safety requirements and limits as described in internal procedures..
5.1.4.2 Labeling Where practical, process containers of fissile material are labeled such that the material type, U-235 enrichment, and gross weights can be clearly identified or determined. Deviations from this process include: large process vessels, fuel rods,
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.4 shipping containers, waste boxes/drums, contaminated items, UF6 cylinders containing heels, cold trap cylinders, samples, containers of 1 liter volume or less, or other containers where labeling is not practical, or where the enrichment of the material contained is unknown (e.g., cleanout material).
5.2 ORGANIZATION AND ADMINISTRATION 5.2.1 GENERAL ORGANIZATION AND ADMINSTRATION METHODS Information regarding General Organization and Administration is described in Chapter 2.
5.2.2 NCS ORGANIZATION Specific details of the criticality safety function responsibilities and qualification requirements for manager, senior engineer, and engineer are described in Chapter 2.0.
Criticality safety function personnel are specifically authorized to perform assigned responsibilities identified in Chapter 2.0. All nuclear criticality safety function personnel have authority to shutdown potentially unsafe operations.
5.3 MANAGEMENT MEASURES 5.3.1 GENERAL CONFIGURATION MANAGEMENT In accordance with ANSI/ANS-8.19 (2014), the criticality safety analysis is a collection of information that provides sufficient detail clarity, and lack of ambiguity to allow independent judgment of the results. The CSA documents the physical/safety basis for the establishment of the controls. The CSA is a controlled element of the Integrated Safety Analysis (ISA) defined in Chapter 3.
Documented CSAs establish the nuclear criticality safety bases for a particular system under normal and credible abnormal conditions. A CSA is prepared or updated for new or significantly modified fissile units, processes, or facilities within GNF-A in accordance with established configuration management control practices defined in Chapter 3.
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.5 5.3.2 NCS CONFIGURATION MANAGEMENT 5.3.2.1 Training and Qualification of NCS Staff A formalized Criticality Safety Engineer Training and Qualification Program shall be developed and maintained by more senior GNF-A NCS staff. This training and qualification program shall be premised on on-the-job training, demonstration of proficiency, periodic required technical classes or seminars, and participation in off-site professional development activities.
The established internal CSE Training and Qualification Program content emphasizes on-the-floor experience to fully understand the processes, procedures, and personnel required to assure that NCS controls on identified criticality safety parameters are properly implemented and maintained. CSE qualifications shall be documented by NCS management.
5.3.2.2 Auditing, Assessing and Upgrading the NCS Program Details of the facility criticality safety audit program are described in Chapter 11.
Criticality safety audits are conducted and documented in accordance with a written procedure and personnel approved by the criticality safety function. NCS audit findings are transmitted to Area Managers for appropriate action and tracked until closed.
Audits and assessments of the processes and associated conduct of operations within the facility, including compliance with operating procedures, postings, and administrative guidelines, are also conducted as described in Chapter 11.
A nuclear criticality safety program review is conducted on a planned scheduled basis by nuclear criticality safety professionals independent of the GNF-A fuel manufacturing organization in accordance with Section 11.6. This provides a means for independently assessing the effectiveness of the components of the nuclear criticality safety program.
The audit team is composed of individuals recommended by the manager of the criticality safety function and whose audit qualifications are approved by the GNF-A Facility Manager or Manager, EHS. Audit results are documented and provided to the manager of the nuclear criticality safety function and facility management.
Findings requiring corrective action are tracked to closure.
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.6 5.3.2.3 ISA Summary Revisions (See Chapter 3) 5.3.2.4 Modifications to Operating and Maintenance Procedures Procedures that govern the handling of enriched uranium are reviewed and approved by the criticality safety function.
Each Area Manager is responsible for developing and maintaining operating procedures that incorporate limits and controls established by the criticality safety function. Area Managers assure that appropriate area engineers, operators, and other affected personnel review and understand these procedures through processes such as: postings, training programs, and/or other written, electronic or verbal notifications.
Documentation of the review, approval and operator orientation process is maintained within the configuration management system. Specific details of this system are described in Chapter 11.
5.3.2.5 Criticality Accident Alarm System (CAAS) Design and Performance Requirements The criticality accident alarm system (CAAS) radiation monitoring unit detectors are uniform throughout the facility for the type of radiation detected, the mode of detection, the alarm signal, and the system dependability (e.g., concurrent response of two or more detectors to initiate the alarm). Also, individual unit detectors are located to assure compliance with appropriate requirements of ANSI/ANS-8.3 (R2012). The location and spacing of the detectors are selected, taking into account shielding by massive equipment or materials. Spacing between detectors is reduced where high density building materials such as brick, concrete, or grout-filled cinder block shield a potential accident area from the detector. Low density materials of construction such as wooden stud construction walls, asbestos, plaster, or metal-corrugated panels, doors, non-load walls, and steel office partitions are accounted for with conservative modeling approximations in determining the detector placement.
The CAAS initiates immediate evacuation of the facility. Employees are trained in recognizing the evacuation signal. This system, and proper response protocol, is described in the Radiological Contingency and Emergency Plan for GNF-A.
The CAAS is a safety-significant system and is maintained through routine response checks and scheduled functional tests conducted in accordance with internal
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.7 procedures. In the event of loss of normal power, emergency power is automatically supplied to the criticality accident alarm system.
In the event that CAAS coverage is lost in an area, compensatory measures such as limiting personnel access, halting special nuclear material movement or installing temporary detection equipment are used as an interim measure until the system is restored.
5.3.2.6 Corrective Action Program A GNF-A internal regulatory compliance tracking system is in place to track planned corrective or preventative actions in regard to procedural, operational, regulatory, or safety related deficiencies. This regulatory & compliance tracking system is used by the Operations, Safety and Licensing organizations.
5.3.2.7 NCS Records Retention Records of criticality safety analyses are maintained in sufficient detail and form to permit independent review and audit of the method of calculation and results. Such records are retained in accord with internal records management requirements outlined in Section 11.8.
5.4 METHODOLOGIES AND TECHNICAL PRACTICES 5.4.1 CONTROL PRACTICES Criticality safety analyses identify specific limits and controls necessary for safe operation of a process. The Area Manager, with NCS support, implements the limits and controls documented in the CSA.
5.4.1.1 Verification Program The purpose of the verification program is to assure that the controls selected and installed fulfill the requirements identified in the criticality safety analyses. All processes are examined in the "as-built" condition to validate the safety design and to verify the installation. Criticality safety function personnel conduct preoperational audits (e.g., field verification of design features, functional test review) to verify that the installed configuration agrees with the criticality safety analysis.
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.8 Operations personnel are responsible for subsequent verification of controls through the use of functional testing or other verification means. When necessary, control calibration and routine maintenance are normally provided by the instrument and calibration and/or maintenance functions. Verification and maintenance activities are performed per established facility practices documented through the use of forms and/or computer tracking systems. Criticality safety function personnel randomly review control verifications and maintenance activities to assure that controls remain effective.
5.4.1.2 Maintenance Program The purpose of planned and scheduled maintenance of safety controls is to assure that systems are kept in a condition of readiness to perform the planned and designed functions when required. This requires a combination of routine maintenance, calibration, functional testing, and verification of design specifications on a periodic basis. Details of the maintenance program are described in Chapter 11.
5.4.2 MEANS OF CONTROL The relative effectiveness and reliability of controls are considered during the criticality safety analysis process. Passive Engineered Controls (Section 5.4.2.1) are preferred over all other system controls and are utilized when practical and appropriate. Active Engineered Controls (Section 5.4.2.2) are the next preferred method of control. Administrative Controls (Section 5.4.2.3) are least preferred, however augmented administrative controls are preferred over administrative controls. A criticality safety control must be capable of preventing a criticality accident independent of the operation or failure of any other criticality control for a given credible initiating event.
5.4.2.1 Passive Engineered Controls A device that uses only fixed physical design features to maintain safe process conditions. Beyond appropriate installation and management measures (e.g., periodic inspection, preventive maintenance), a passive engineered control requires no human action to perform its safety function. Assurance is maintained through specific periodic inspections or verification measurement(s) as appropriate.
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.9 5.4.2.2 Active Engineered Controls A physical device that uses active sensors, electrical components, or moving parts to maintain safe process conditions. Beyond appropriate installation and management measures (e.g., periodic functional testing), an active engineered control requires no human action to perform its safety function. Assurance is maintained through specific periodic calibration, functional testing, and preventive maintenance as appropriate. Active engineered controls that are designed to be fail-safe (i.e.,
meaning failure of the control results in a safe condition) are preferred.
5.4.2.3 Administrative Controls Augmented Administrative Control - A procedurally required or prevented human action, combined with a physical device that alerts the operator that the action is needed to maintain safe process conditions or otherwise add substantial assurance of the required human performance. Administrative Control - A procedural human action that is prohibited or required to maintain safe process conditions.
Use of administrative controls should be limited to situations where passive and active engineered controls are not practical. Administrative controls may be proactive (requiring action prior to proceeding) or reactive (proceeding unless action occurs). Proactive administrative controls are preferred. Assurance is maintained through periodic verification, audit, and training.
5.4.3 SPECIFIC PARAMETER LIMITS The favorable geometry values of Table 5.1 contain dimensions for sphere, cylinder, and slab which may be used for applicable operations at GNF-A. Application of these geometries is limited to situations where the neutron reflection present does not exceed that due to full water reflection and the moderating material is not more effective than water. Acceptable geometry margins of safety for units identified in this table are 93% of the minimum critical cylinder diameter, 88% of the minimum critical slab thickness, and 76% of the minimum critical sphere volume.
When cylinders and slabs are not infinite in extent, the dimensional limitations of Table 5.1 may be increased by means of standard buckling conversion methods; reactivity formula calculations which incorporate validated K-infinities, migration areas (M2) and extrapolation distances. When not applicable, the Criticality Safety Engineer may use approved validated stochastic or deterministic codes to determine subcritical limits.
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.10 The safe batch values of Table 5.2 may be used for applicable operations at GNF-A.
Application of these safe batch values is limited to situations where the neutron reflection present does not exceed that due to full water reflection and the moderating material is not more effective than water. Criticality safety may be based on U235 mass limits in either of the following ways:
If double batch is considered credible, the mass of any single accumulation shall not exceed a safe batch, which is defined to be 45% of the minimum critical mass. Table 5.2 lists safe batch limits for homogeneous mixtures of UO2 and water as a function of U235 enrichment over the range of 1.1% to 5% for uncontrolled geometric configurations. The safe batch sized for UO2 of specific compounds may be adjusted when applied to other compounds by the formula:
kg X = (kg UO2 0.88 ) / f where, kg X
= safe batch value of compound X kg UO2
= safe batch value for UO2 0.88
= wt. % U in UO2 f
= wt. % U in compound X The safe concentration values below may be used for applicable operations at GNF-A subject to provision for adequate protection against precipitation or other circumstances which may increase concentration.
A concentration of less than or equal to one-half of the minimum critical concentration.
A system in which the hydrogen to U235 atom ratio (H/U235) is greater than 5200.
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.11 Table 5.1 Favorable Geometry Values Homogeneous UO2-H2O Mixtures Weight Percent U235 Infinite Cylinder*
Diameters (Inches)
Infinite Slab*
Thickness (Inches)
Sphere Volume*
(Liters) 2.00 16.70 8.90 105.0 2.25 14.90 7.90 75.5 2.50 13.75 7.20 61.0 2.75 12.90 6.65 51.0 3.00 12.35 6.25 44.0 3.25 11.70 5.90 38.5 3.50 11.20 5.60 34.0 3.75 10.80 5.30 31.0 4.00 10.50 5.10 29.0 5.00 9.50 4.45 24.0 Homogeneous Aqueous Solutions Weight Percent U235 Infinite Cylinder Diameters (Inches)
Infinite Slab Thickness (Inches)
Sphere Volume (Liters) 2.00 16.7 9.30 106.4 2.25 15.0 8.40 80.5 2.50 14.0 7.80 66.8 2.75 13.3 7.30 56.2 3.00 12.9 7.00 49.7 3.25 12.5 6.70 44.8 3.50 12.1 6.50 41.0 3.75 11.9 6.30 38.0 4.00 11.7 6.00 34.9 5.00 9.5 4.80 26.0 Heterogeneous Mixtures or Compounds Weight Percent U235 Infinite Cylinder Diameters (Inches)
Infinite Slab Thickness (Inches)
Sphere Volume (Liters) 2.00 11.10 5.60 35.7 2.25 10.50 5.10 30.7 2.50 10.10 4.80 27.3 2.75 9.70 4.60 24.7 3.00 9.40 4.40 22.6 3.25 9.20 4.30 20.9 3.50 9.00 4.20 19.2 3.75 8.90 4.10 18.2 4.00 8.80 4.00 16.9 5.00 8.30 3.60 13.0
- These values represent 93%, 88% and 76% of the minimum critical cylinder diameter, slab thickness, and sphere volume, respectively. For enrichments not specified, smooth curve interpolation may be used.
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.12 Table 5.2 Safe Batch Values for UO2 and Water*
Nominal Weight Percent U235 Homogeneous UO2 Powder &
Water Mixtures (kg UO2)
Heterogeneous UO2 Pellets &
Water Mixtures (kg UO2)
Nominal Weight Percent U235 Homogeneous UO2 Powder &
Water Mixtures (kg UO2)
Heterogeneous UO2 Pellets &
Water Mixtures (kg UO2) 1.10 2629.0 510.0 4.00 25.7 24.7 1.20 1391.0 341.0 4.20 23.7 22.9 1.30 833.0 246.0 4.40 21.9 21.4 1.40 583.0 193.0 4.60 20.2 20.0 1.50 404.0 158.0 4.80 19.1 18.8 1.60 293.3 135.0 5.00 18.1 18.1 1.70 225.0 116.0 1.80 183.0 102.0 1.90 150.6 90.5 2.00 127.5 81.6 2.10 109.2 73.1 2.20 96.8 66.4 2.30 84.3 61.0 2.40 74.7 56.1 2.50 68.9 52.1 2.60 60.5 48.8 2.70 56.6 45.4 2.80 52.2 42.9 2.90 47.6 40.1 3.00 44.5 38.1 3.20 38.9 34.1 3.40 34.6 31.0 3.60 31.1 28.5 3.80 28.3 26.4
- NOTE: These values represent 45% of the minimum critical mass. For enrichments not specified, smooth curve interpolation of safe batch values may be used.
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.13 5.4.4 CONTROL PARAMETERS Nuclear criticality safety is achieved by controlling one or more parameters of a system within established subcritical limits. The internal ISA change management process may require nuclear criticality safety staff review of proposed new or modified processes, equipment, or facilities to ascertain impact on controlled parameters associated with the particular system. All assumptions relating to processes, equipment, or facility operations including material composition, function, and operation, including upset conditions, are justified, documented, and independently reviewed.
Identified below are specific control parameters that may be considered during the NCS review process:
5.4.4.1 Geometry - Geometry may be used for nuclear criticality safety control on its own or in combination with other control methods. Favorable geometry is based on limiting dimensions of defined geometrical shapes to established subcritical limits.
Structure and/or neutron absorbers that are not removable constitute a form of geometry control. At GNF-A, favorable geometry is developed conservatively assuming worst credible conditions (e.g., reflection, moderation, heterogeneity, and enrichment) for the material to be processed. Examples include cylinder diameters, annular inner/outer dimensions, slab thickness, and sphere diameters.
Geometry control systems are analyzed and evaluated allowing for fabrication tolerances and dimensional changes that may likely occur through corrosion, wear, or mechanical distortion. In addition, these systems include provisions for periodic inspection if credible conditions exist for changes in the dimensions of the equipment that may result in the inability to meet established nuclear criticality safety limits.
5.4.4.2 Mass - Mass may be used for a nuclear criticality safety control on its own or in combination with other control methods. Mass control may be utilized to limit the quantity of uranium within specific process operations or vessels and within storage, transportation, or disposal containers. Analytical or non-destructive methods along with adequate measurement uncertainty may be employed to verify the mass measurements for a specific quantity of material.
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.14 Establishment of mass limits involves consideration of worst credible moderation, reflection, geometry, spacing, and material concentration. The criticality safety analysis considers normal operations and credible process upsets in determining actual mass limits for the system and for defining additional controls.
5.4.4.3 Moderation - Moderator control may be used for nuclear criticality safety control on its own or in combination with other control methods. Moderator control areas shall be defined in the process evaluation in which moderators are limited and controlled for nuclear criticality. For areas where moderation is used in conjunction with other control methods, the area is classified as a moderation control area (MCA) and posted accordingly. When moderation is the single criticality safety controlled parameter, the area is classified as a moderation restricted area (MRA) and posted accordingly.
Process evaluations for MCA/MRA designated areas shall explicitly identify the limits, controls, and engineered barriers for designated moderator control areas.
Material properties, credible moderator present in, introduced to, or accumulated in an MCA/MRA shall be considered. Credible non-uniform distribution of moderators, moderator content measurement, and fire suppression methods shall also be considered.
5.4.4.4 Concentration (or Density) - Concentration control may be used for nuclear criticality safety control on its own or in combination with other control methods.
Concentration controls are established to ensure that the concentration level is maintained within defined limits for the system. When concentration is the only parameter controlled to prevent criticality, concentration may be controlled by at least two independent combinations of measurements and physical control, each physical control capable of preventing the concentration limit being exceeded. The preferred method of demonstrating double contingency being that one of the two combinations is a passive control (e.g., favorable geometry tanks) or at least one of the two is an active engineered (e.g., in-line density monitoring).
When precipitating agents are used in systems where concentration is utilized as a criticality control parameter, controls are in place to ensure that the concentration level is maintained within defined limits for the system. Precautions are taken to protect against inadvertent introduction of precipitation agents in accordance with the configuration management program described in Chapter 11.
5.4.4.5 Neutron Absorber - Neutron absorbing materials may be utilized to provide a method for nuclear criticality safety control for a process, vessel or container. Stable compounds such as boron carbide fixed in a matrix such as aluminum or polyester resin; elemental cadmium clad in appropriate material; elemental boron alloyed
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.15 stainless steel, or other solid neutron absorbing materials with an established dimensional relationship to the fissionable material are recommended. The use of neutron absorbers in this manner is defined as part of a passive engineered control.
Credit may also be taken for neutron absorbers added to fuel, such as gadolinia.
For fixed neutron absorbers used as part of a geometry control, the following requirements apply:
The composition of the absorber are measured and documented prior to first use.
Periodic verification of the integrity of the neutron absorber system subsequent to installation is performed on a scheduled basis approved by the criticality safety function. The method of verification may take the form of traceability (e.g., serial number, QA documentation, etc.), visual inspection or direct measurement, as appropriate for the application.
For crediting neutron absorbers added to the fuel, such as gadolinia, the following requirements apply:
For in-process fuel (e.g., mechanical mixing of gadolinia powder with uranium oxide powder), the continued presence of the absorber in the fuel, its distribution, and its concertation is verified using an appropriate method. The system design should include factors such as process conditions, hazards, and human errors for potential degradation of the neutron absorber. Acquisition, storage, preparation and use of the neutron absorbers should conform to the established quality program.
For fuel bundles, the presence of the gadolinia absorber in completed fuel rods is documented and verified using non-destructive testing; and the placement of rods in completed fuel bundles is documented in accordance with established quality control practices.
5.4.4.6 Spacing (or Unit Interaction) - Criticality safety controls may be based on isolation or interacting unit spacing. Unless a basis is explicitly documented in the criticality safety analysis, then units or arrays may be considered effectively non-interacting (isolated) when they are separated by either of the following:
12-inches of full density water equivalent, the larger of 12-foot air distance, or the greatest distance across an orthographic projection of the largest of the fissile accumulations on a plane perpendicular to the line joining their centers For Solid Angle interaction analyses, a unit where the contribution to the total solid angle in the array is less than 0.005 steradians is also considered non-interacting (provided the total of all such solid angles neglected is less than one half of the total
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.16 solid angle for the system). Transfer pipes of 2 inches or less in diameter may be excluded from interaction consideration, provided they are not grouped in close arrays.
Techniques which produce a calculated effective multiplication factor of the entire system (e.g., validated Monte Carlo or Sn Discrete Ordinates codes) may be used.
Techniques which do not produce a calculated effective multiplication factor for the entire system but instead compare the system to accepted empirical criteria may also be used. In either case, the criticality safety analysis must comply with the requirements of Sections 5.1.1 and 5.4.5.5.
5.4.4.7 Material Composition (or Heterogeneity) - The criticality safety analysis for each process determines the effects of material composition (e.g., type, chemical form, physical form) within the process being analyzed and identifies the basis for selection of compositions used in subsequent system modeling activities.
It is important to distinguish between homogeneous and heterogeneous system conditions. Heterogeneous effects within a system can be significant and therefore must be considered within the criticality safety analysis when appropriate.
Evaluation of systems where the particle size varies take into consideration effects of heterogeneity appropriate for the process being analyzed.
5.4.4.8 Reflection - Worst credible reflection conditions will be considered in the development of all system controls and limits. Generally, systems are designed and operated with the assumption of 12-inch water or optimum reflection. However, subject to an approved analysis documenting controls or process conditions which limit reflection, certain system designs may be approved and operated in situations where the analyzed reflection is less than optimum.
In criticality safety analysis, the neutron reflection properties of the credible process environment are considered. For example, reflectors more effective than water (e.g.,
concrete) are considered when appropriate.
5.4.4.9 Enrichment - Enrichment control may be utilized to limit the percent U-235 within a process, vessel, or container, thus providing a method for nuclear criticality safety control. Active engineered or administrative controls are required to verify enrichment and to prevent the introduction of uranium at unacceptable enrichment levels within a defined subsystem within the same area. In cases where enrichment control is not utilized, the maximum credible area enrichment is utilized in the criticality safety analysis.
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.17 5.4.4.10 Process Characteristics - Within certain manufacturing operations, credit may be taken for physical and chemical properties of the process and/or materials as nuclear criticality safety controls. Use of process characteristics is predicated upon the following requirements:
The bounding conditions and operational limits are specifically identified in the criticality safety analysis and, are specifically communicated, through training and procedures, to appropriate operations personnel.
Bounding conditions for such process and/or material characteristics are based on established physical or chemical reactions, known scientific principles, and/or facility-specific experimental data supported by operational history.
The devices and/or procedures which maintain the limiting conditions must have the reliability, independence, and other characteristics required of a criticality safety control.
Examples of process characteristics which may be used as controls include:
Conversion and oxidation processes that produce dry powder as a product of high temperature reactions.
Experimental data demonstrating low moisture pickup in or on uranium materials that have been conditioned by room air ventilation equipment.
Experimental/historical process data demonstrating uranium oxide powder flow characteristics to be directly proportional to the quantity of moisture present.
5.4.5 ANALYSIS METHODS 5.4.5.1 Keff Limit Validated computer analytical methods may be used to evaluate individual system units or potential system interaction. When these analytical methods are used, it is required that the effective neutron multiplication factor (keff) of the system plus three (3) times the standard deviation of the Monte Carlo code must be less than or equal to the established Upper Subcritical Limit (USL), that is:
keff + 3 USL Normal operating conditions include maximum credible conditions expected to be encountered when the criticality control systems function properly. Credible process upsets include anticipated off-normal or credible upset conditions and must be demonstrated to be critically safe in all cases in accordance with Section 5.1.1. The sensitivity of key parameters with respect to the effect on Keff are evaluated for each
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.18 system such that adequate criticality safety controls are defined for the analyzed system.
5.4.5.2 Analytical Methods Methodologies currently employed by the criticality safety function include hand calculations utilizing published experimental data (e.g., ARH-600 handbook), Solid Angle methods (e.g., SAC code), and Monte Carlo codes (e.g., GEMER, GEKENO, SCALE/KENO) which utilize stochastic methods to approximate a solution to the 3-D neutron transport equation. Additionally, Discrete Ordinates codes (e.g., ANISN, DORT, TORT or the DANTSYS code package) may be used after validation as described in Section 5.4.5.3 below has been performed.
GEMER (Geometry Enhanced MERIT) is a multi-group Monte Carlo program which approximates a solution to the neutron transport equation in 3-dimensional space. The GEMER criticality program is based on 190-energy group structure to represent the neutron energy spectrum. In addition, GEMER treats resolved resonances explicitly by tracking the neutron energy and solving the single-level Breit-Wigner equation at each collision in the resolved resonance range in regions containing materials whose resolve resonances are explicitly represented. The cross-section treatment in GEMER is especially important for heterogeneous systems since the multi-group treatment does not accurately account for resonance self-shielding.
GEKENO (Geometry Enhanced KENO) is a multi-group Monte Carlo program which approximates a solution to the neutron transport equation in 3-dimensional space. The GEKENO criticality program utilizes the 16-energy group Knight-Modified Hansen Roach cross-section data set, and a potential scattering p resonance correction to compensate for flux depression at resonance peaks.
GEKENO is normally used for homogeneous systems. For infinite systems, K can be calculated directly from the Hansen Roach cross-sections using the program KINF.
5.4.5.3 Validation Techniques The validity of the calculational method (computer code and nuclear cross-sectional data set) used for the evaluation of nuclear criticality safety must be demonstrated and sufficiently documented in a validation report according to written procedures to allow understanding of the methodology by a qualified and knowledgeable individual. The validation of the computer code will be performed consistent with the guidance outlined in section 4.3 of ANSI/ANS-8.1-1998 and include the code calculational bias, bias uncertainty, and the minimum margin of subcriticality using well-characterized and adequately documented critical experiments.
The following definitions apply to the documented validation report(s):
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.19 Bias - the systematic difference between the calculated results and the experimentally measured values of keff for a fissile system.
Bias Uncertainty - the integrated uncertainty in the experimental data, calculational methods and models, and should be estimated by a valid statistical analysis of calculated keff values for the critical experiments.
Minimum Margin of Subcriticality (MMS) - an allowance for any unknown (or difficult to identify or quantify) errors or uncertainties in the method of calculating keff, that may exist beyond those which have been accounted for explicitly in calculating the bias and bias uncertainty.
Consistent with the requirements of ANSI/ANS-8.1 (1998), the criteria at GNF-A to establish subcriticality requires that for a system or process to be considered subcritical the calculated keff plus three (3) times the standard deviation for the Monte Carlo code must be less than or equal to an established Upper Subcritical Limit (USL) as presented in the validation reports. The validation of the calculational method and cross-sections considers a diverse set of parameters which include, but are not limited to:
Fuel enrichment, composition and form of associated uranium materials; Geometry configuration of the system(e.g., shape, size, spacing, reflector, lattice pattern);
Degree of neutron moderation in the system (e.g., H/fissile atom ratio)
Homogeneity or heterogeneity of the system; and Characterization of the neutron energy spectra.
The selection of critical experiments for the GNF-As criticality safety computer code validation for each identified area of applicability incorporates the following considerations:
Critical experiments are assessed for completeness, accuracy, and applicability to the GNF-A nuclear fuel fabrication facility prior to its selection and use as a critical benchmark.
Critical experiments are selected to cover the spectrum of parameters spanning the range of normal and credible abnormal conditions anticipated for past, current, and future analyzed uranium systems for GNF-A modeled systems.
Critical experiments are drawn from multiple series and sources of critical experiments to minimize systematic error. The range of parameters characterized by selected critical experiments is used to define the area of applicability for the code.
The calculational bias, bias uncertainty and USL over the defined area of applicability are determined by statistical methods as follows:
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.20 The normality of calculated keff values based on a set of critical experiments similar in the system configuration and nuclear characteristics is verified prior to the estimation of the bias and bias uncertainty.
The calculational bias is determined either as a constant, if no trends exist or as a smooth and well-behaved function of selected characteristic parameters (e.g., hydrogen-to-fissile ratio, etc.) by regression analysis if trends exist with parameters statistically significant over the area of applicability. The bias is applied over its negative range and assigned a value of zero over its positive range.
The bias uncertainty is estimated by a confidence interval of uniform width that ensures that there is at least a 95% level of confidence that a future keff value for a critical system will be above the lower confidence limit.
The USL is established based on confidence interval with MMS for the area of applicability as outlined in the validation report. The USL is defined as follows:
USL = 1 + bias - bias uncertainty - MMS At GNF-A, a minimum MMS = 0.03 shall be used to establish the acceptance criteria for criticality calculations.
The following acceptance criteria, considering worst-case credible upset conditions, must be satisfied when using keff calculations by Monte Carlo methods to establish subcritical limits for the GNF-A facility:
keff + 3 USL where is the standard deviation of the keff value obtained with Monte Carlo calculation.
If parameters needed for anticipated applications are beyond the range of the critical benchmark experiments, the Area of Applicability (AOA) may be extended by extrapolation using the established trends in the bias. In general, if the extrapolation is too large, new factors that could affect the bias may be introduced as the physical phenomena in the system or process change. For conservatism, the extrapolation should be based on the following rules:
The extrapolation should not result in a large underlying physics or neutronic behavior change in the anticipated application. If there is a rapid or non-conservative change in bias in the vicinity of the AOA range endpoints of a trending parameter, extra safety margin should be included. Otherwise, critical experiments should be added for further justification.
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.21 Statistical methods should be used to ensure that the extrapolation is not large. The leverage statistic, a measure of the distance between the extrapolation point x for a predication and the mean of trending parameter values in the critical benchmark data set can be used to determine if an extrapolation using the regression model is acceptable when making predications at x.
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.22 5.4.5.4 Computer Software & Hardware Configuration Control The software and hardware used within the criticality safety calculational system is configured and controlled in accordance with internal software configuration procedures. For codes developed or modified at GNF, software changes are conducted in accordance with an approved configuration management program described in Chapter 11 that addresses both hardware and software qualification.
Software designated for use in nuclear criticality safety are compiled into working code versions with executable files that are traceable by length, time, date, and version. Working code versions of compiled software are validated against critical experiments using an established methodology with the differences in experiment and analytical methods being used to calculate bias and uncertainty values to be applied to the calculational results. Each individual workstation is verified to produce results identical to the development workstation prior to use of the software for criticality safety calculations demonstrations on the production workstation.
Modifications to software and nuclear data that may affect the calculational logic require re-validation of the software. Modifications to hardware or software that do not affect the calculational logic are followed by code operability verification, in which case, selected calculations are performed to verify identical results from previous analyses. Deviations noted in code verification that might alter the bias or uncertainty requires re-validation of the code prior to release for use.
5.4.5.5 Criticality Safety Analysis (CSA)
A CSA is prepared or updated for each new or significantly modified unit or process system within GNF-A in accordance with section 5.1.2.1 and established configuration management control practices defined in Chapter 11.
The scope and content of any particular CSA reflects the needs and characteristics of the system being analyzed, as specified in internal procedures, and typically includes the following elements:
Scope - Defines the extent and purpose of the analysis.
General Process Description - This element presents an overview of the process that is affected by the proposed change. This section includes as appropriate; process description, flow diagrams, normal operating conditions, system interfaces, and other important to design considerations.
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.23 Criticality Safety Hazards - A listing and evaluation of credible process upset conditions applicable to scope, and a discussion of how established nuclear criticality safety limits are addressed for each credible process upset condition. Independent controls and management measures that demonstrate compliance with the Double Contingency Principle are described with consideration for common mode failure.
Methodology - A description of compute code(s) used, bias and bias uncertainty, area of applicability, bounding assumptions, calculational assumptions, and design features.
Calculations and Results - A description of model constructs, how calculations were performed, what analytic tools or reference documents were used, and a summary of the calculational result and associated uncertainty (Keff + 3) as a function of key parameter(s). When applicable, the assigned bias and associated bias uncertainty is stated and compared to accident limit results. Limits derived are based on most reactive values of uncontrolled parameters or based on worst credible values of uncontrolled parameters with documented justifications.
Specifications and Requirements for Safety - When applicable, this element presents both bounding design assumptions and the criticality safety requirements for correct implementation of established controls. Interface considerations with other units/processes. The requirements are grouped according to passive, active, or administrative controls. Generic management measures and applicable elements of combustible material control programs may also be included in this element.
Conclusions - This element concludes the analysis with pertinent summary statements and includes a statement regarding license compliance for process analysis.
References - This element includes a listing of applicable references cited in the analysis.
Attachments - This element includes appropriate attachments to support analysis content and may include (but not limited to) materials used, data trends, sample input file(s), tabulated (Keff + 3) results.
LICENSE SNM-1097 DATE 08/02/18 Page DOCKET 70-1113 REVISION 5
5.24 5.4.5.6 Technical Reviews Independent technical reviews of proposed criticality safety control limits specified in criticality safety analyses are performed. A senior engineer within the criticality safety function is required to perform the independent technical review.
The independent technical review consists of a verification that the neutronics geometry model and configuration used adequately represent the system being analyzed. In addition, the reviewer verifies that the proposed material characterizations such as density, concentration, etc., adequately represent the system. The reviewer also verifies that the proposed criticality safety controls are adequate.
The independent technical review of the specific calculations and computer models is performed using one of the following methods:
Verify the calculations with an alternate computational method.
Verify methods with an independent analytic approach based on fundamental laws of nuclear physics.
Verify the calculations by performing a comparison to results from a similar design or to similar previously performed calculations.
Verify the calculations using specific checks of the computer codes used, as well as, evaluations of code input and output.
Based on one of these prescribed methods, the independent technical review provides a reasonable measure of assurance that the chosen analysis methodology and results are correct.