OFFICIAL USE ONLY – SECURITY- RELATED INFORMATION

OFFICIAL USE ONLY – SECURITY- RELATED INFORMATION

ML103430615

Final Safety Evaluation Report for the License Application

To Possess and Use Radioactive Material at the Mixed Oxide Fuel 

Fabrication Facility in Aiken, SC

Docket No. 70-3098

Shaw AREVA MOX Services

Manuscript Completed: December 2010

Division of Fuel Cycle Safety and Safeguards

Office of Nuclear Material Safety and Safeguards

U.S. Nuclear Regulatory Commission

Washington, D.C. 20555-0001
OFFICIAL USE ONLY – SECURITY- RELATED INFORMATION

 iii 

OFFICIAL USE ONLY – SECURITY- RELATED INFORMATION

ABSTRACT 

This report documents the U.S. Nuclear Regulatory Commission (NRC) staff review and safety 

and safeguards evaluation of the Shaw AREVA MOX Services (MOX Services) application for a 

license to receive, acquire, possess, use, store, and transfer by-product material, source 

material, and special nuclear material (SNM) at the Mixed Oxide Fuel Fabrication Facility 

located in Aiken, South Carolina. 

The objective of the review is to evaluate the potential adverse impacts of operation of the 

facility on worker and public health and safety under both normal operating and accident 

conditions. The review also considers physical protection of SNM and classified matter, 

material control and accounting of SNM, and the management organization and administrative 

programs to ensure the safe design and operation of the facility. 

The NRC staff concludes, in this Safety Evaluation Report, that the applicant’s descriptions, 

specifications, commitments, and analyses provide an adequate basis for safety and safeguards 

of facility operations and that operation of the facility does not pose an undue risk to worker and 

public health and safety. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

v

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

TABLE OF CONTENTS

ABSTRACT.............................................................................................. iii

TABLE OF CONTENTS.............................................................................. v

EXECUTIVE SUMMARY............................................................................. ix

1. GENERAL INFORMATION

1.1 Facility and Process Overview 1-1

1.2 Institutional Information 1-5

1.3 Site Description 1-9

2. FINANCIAL QUALIFICATIONS 

2.1 Conduct of Review 2-1

2.2 Evaluation Findings 2-3

3. PROTECTION OF CLASSIFIED MATTER 

3.1 Regulatory Requirements 3-1

3.2 Regulatory Acceptance Criteria 3-1

3.3 Staff Review and Analysis 3-1

3.4 Evaluation Findings 3-3

4. ORGANIZATION AND ADMINISTRATION

4.1 Conduct of Review 4-1

4.2 Evaluation Findings 4-2

5. SAFETY PROGRAM AND INTEGRATED SAFETY ANALYSIS

5.1 Regulatory Requirements 5-1

5.2 Safety Program 5-2

5.3 Areas of Review 5-3

5.4 Evaluation Findings 5-4

6. NUCLEAR CRITICALITY SAFETY 

6.1 License Application Review 6-1

6.2 ISA Summary Review 6-15

6.3 Evaluation Findings 6-38

7. FIRE PROTECTION

7.1 Regulatory Requirements 7-1

7-2 Regulatory Acceptance Criteria 7-1

7.3 Staff Review and Analysis 7-2

7.4 Evaluation Findings 7-42
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

vi

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

8. CHEMICAL SAFETY

8.1 Conduct of Review 8-1

8.2 Evaluation Findings 8-100

9. RADIATION SAFETY 

9.1 Regulatory Requirements 9-1

9.2 Facility Design Features 9-1

9.3 Radiation Protection Program Implementation 9-4

9.4 Evaluation Findings 9-14

9.5 Exemption Request for Radiation Labeling 9-15

10. ENVIRONMENTAL PROTECTION

10.1 Regulatory Requirements 10-1

10.2 Regulatory Acceptance Criteria 10-2

10.3 Staff Review and Analysis 10-2

10.4 Evaluation Findings 10-9

11.0 PLANT SYSTEMS

11.1 Mixed Oxide Process Description 11-1

11.1.1 Conduct of Review 11-1

11.1.2 Evaluation Findings 11-15

11.2 Aqueous Polishing Process and Chemistry 11-15

11.2.1 Conduct of Review 11-15

11.2.2 Evaluation Findings 11-64

11.3 Ventilation and Confinement Systems 11-65

11.3.1 Regulatory Requirements 11-65

11.3.2 Regulatory Acceptance Criteria 11-66

11.3.3 Staff Review and Analysis 11-66

11.3.4 Evaluation Findings 11-83

11.4 Electrical Systems

11.4.1 Regulatory Requirements 11-86

11.4.2 Regulatory Acceptance Criteria 11-86

11.4.3 Electrical Power Systems Description 11-87

11.4.4 Design Bases for Electrical Power Systems and 

Applicable BDC 11-95 

11.4.5 External Manmade Hazard Event Sequences 11-100

11.4.6 Evaluation Findings 11-101

11.5 Instrumentation and Control Systems 11-105

11.5.1 Regulatory Requirements 11-105

11.5.2 Regulatory Acceptance Criteria 11-106

11.5.3 Instrumentation and Control Systems Description 11-107

11.5.4 Design Bases for Instrumentation and Control 

Systems and Applicable BDC 11-112

11.5.5 Evaluation Findings 11-117

11.6 Material-Handling Systems 11-121

11.6.1 Regulatory Requirements 11-122
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

vii

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

11.6.2 Regulatory Acceptance Criteria 11-122

11.6.3 Material-Handling Equipment Description 11-122

11.6.4 Design Bases for Material-Handling Items 

Relied on for Safety 11-126

11.6.5 Load-Handling Accident Sequences 11-126

11.6.6 Codes and Standards 11-136

11.6.7 Evaluation 11-136

11.7 Fluid Transport Systems 11-136

11.7.1 Regulatory Requirements 11-137

11.7.2 Regulatory Acceptance Criteria 11-137

11.7.3 Fluid Transport Description 11-138

11.7.4 Fluid Transport System Evaluation 11-140

11.7.5 Loss of Confinement Event Sequences 11-144

11.7.6 Explosion Event Sequences 11-148

11.7.7 Codes and Standards 11-150

11.7.8 Evaluation 11-150

11.8 Fluid Systems 11-151

11.8.1 Regulatory Requirements 11-151

11.8.2 Regulatory Acceptance Criteria 11-151

11.8.3 Staff Review and Analyses 11-152

11.8.4 Evaluation 11-162

11.8.5 Evaluation Finding 11-166 

11.9 Heavy Lilft Cranes 11-167

11.9.1 Conduct of Review 11-167

11.9.2 Regulatory Requirements 11-168

11.9.3 Regulatory Acceptance Criteria 11-168

11.9.4 System Description 11-168

11.9.5 Accident Sequences and Items Relied on for Safety 11-169

11.9.6 Evaluation Findings 11-169

11.10 Laboratory 11-170

11.10.1 Conduct of Review 11-170

11.10.2 Staff Review of Laboratory Safety 11-176

11.10.3 Evaluation Findings 11-177

 11.11 Civil Structural Systems 11-178

11.11.1 Regulatory Requirements 11-178

11.11.2 Regulatory Acceptance Criteria 11-178

11.11.3 System Description 11-179

11.11.4 Structural Analysis and Design 11-188

11.11.5 Seismic Qualification of Civil Structures 11-193

11.11.6 Natural Phenomena Accident Sequences 11-193

11.11.7 External Manmade Hazard Events 11-196

11.11.8 Explosion Events 11-197

11.11.9 Evaluation Findings 11-198

12. HUMAN FACTORS ENGINEERING 12-1

12.1 Regulatory Requirements 12-1

12.2 Regulatory Acceptance Criteria 12-1

12.3 Regulatory Review and Analysis 12-2

12.4 Overall Evaluation Findings 12-24
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

viii

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

13. SAFEGUARDS AND SECURITY

13.1 PHYSICAL PROTECTION 13-1

13.2 MATERIAL CONTROL AND ACCOUNTING 13-3

14. EMERGENCY MANAGEMENT 14-1

14.1 Regulatory Requirements 14-1

14.2 Facility Description 14-1

14.3 Types of Accidents 14-2

14.4 Interaction with Savannah River Site and Offsite Officials 14-3

14.5 Evaluation

15. MANAGEMENT MEASURES 15-1

15.1 Regulatory Requirements 15-1

15.2 Regulatory Acceptance Criteria 15-2

15.3 Staff Review and Analysis 15-2

15.4 Evaluation Findings 15-35

16.EXEMPTIONS AND SPECIAL AUTHORIZATIONS 16-1

16.1 Purpose of Review 16-1

16.2 Areas of Review 16-1
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

ix

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

EXECUTIVE SUMMARY

The U.S. and the former Soviet Union (Russian Federation) began dismantling thousands of 

nuclear weapons when the Cold War ended in the late 1980s. The dismantlement resulted in 

large quantities of surplus weapons-grade highly enriched uranium and plutonium. This surplus 

material necessitates special safety and management measures because of many issues 

related to protection of the environment, protection of public health and safety, and control of 

fissile material. One challenge is to dispose of this surplus material to significantly reduce both 

its accessibility and attractiveness for retrieval and future use in weapons.

Because of concerns over the vast stockpiles of nuclear weapons each country possessed, the 

U.S. and Russian Federation signed an agreement in September 2000, committing each 

country to dispose of 34 metric tons (approximately 75,000 pounds) of surplus plutonium. U. S. 

Department of Energy (DOE) evaluated different strategies to dispose of this material, and 

ultimately developed the Surplus Plutonium Disposition Program. Under this program, DOE 

plans to convert the surplus weapons-grade plutonium into Mixed Oxide (MOX) fuel to be 

irradiated in commercial nuclear power reactors. 

In May 1998, DOE issued a request for proposals to design, construct, and operate a Mixed 

Oxide Fuel Fabrication Facility (MFFF), and eventually supply commercial fuel to an affiliated 

nuclear utility to be irradiated in its reactor. In March 1999, DOE selected a consortium 

consisting of Duke, Cogema, and Stone & Webster (DCS) (subsequently renamed Shaw 

AREVA MOX Services (MOX Services)). This partnership is to: (a) design the commercial 

MOX fuel; (b) design, construct, operate, and deactivate an MFFF; (c) design and execute the 

reactor modifications necessary for use of MOX fuel; and (d) provide the architect/engineering 

and construction management services associated with these activities. 

The MFFF would be U.S. Government-owned and would be used to dispose of surplus 

plutonium and some waste from DOE’s nuclear processes (alternate feedstock). Under the 

Strom Thurmond National Defense Authorization Act for Fiscal Year 1999, the U.S. Nuclear 

Regulatory Commission (NRC) was granted regulatory and licensing authority over the MFFF. 

The licensing review of the MFFF used existing regulations. Also, NRC developed a facilityspecific Standard Review Plan (NUREG-1718), dated August 2000 (NRC, 2000), to help review 

the License Application (LA) (MOX, 2010a). It should be noted that NRC is also the regulatory 

authority for the commercial nuclear power reactor(s) that would irradiate the MOX fuel.

NRC regulatory review of the MFFF is being performed in two stages. The first stage, which 

has already been completed, consisted of the review and evaluation of the Construction 

Authorization Request (CAR) (DCS, 2004). This stage required the applicant to submit a 

description and safety assessment that detailed the design bases of the principal structures, 

systems, and components (PSSCs) of the plant, including provisions for protection against 

natural phenomena and the consequences of potential accidents [refer to Title 10 of the Code of 

Federal Regulations (10 CFR) 70.22(f) and 70.23(b)]. The second stage consists of a review of 

an LA for authority to possess and use the licensed material at the MFFF. 

In February 2001, DCS submitted a CAR for an MFFF at DOE=s Savannah River Site (SRS), 

near Aiken, South Carolina (SC). NRC conducted environmental and safety reviews of the 

MFFF CAR and supporting documentation. The results of the staff's environmental review are 

discussed in NUREG-1767, “Final Environmental Impact Statement on the Construction and 

Operation of a Proposed Mixed Oxide Fuel Fabrication Facility at the Savannah River Site, 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

x

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

South Carolina,” issued in January 2005 (NRC, 2005a). In March 2005, NRC issued a 

Construction Authorization (CA) (NRC, 2005b) to DCS for the MFFF. NRC staff's technical 

basis for issuing the CA is set forth in NUREG-1821, “Final Safety Evaluation Report on the 

Construction Authorization Request for the Mixed Oxide Fuel Fabrication Facility at the 

Savannah River Site, South Carolina,” issued in March 2005 (NRC, 2005c). 

MOX Services has submitted an LA (MOX, 2010a) and Integrated Safety Analysis (ISA) 

Summary (MOX, 2010b) for the MFFF at the SRS in Aiken, SC. 

This safety evaluation report (SER) documents the results of the review of the application for a 

license to receive, acquire, possess, use store, and transfer by-product material, source 

material, and special nuclear material (SNM) at the MFFF. 

The regulatory requirements of 10 CFR 70.23(a)(8), states that an application for a license will 

be approved if the Commission determines that, where the proposed activity is the operation of 

a plutonium processing and fuel fabrication plant, construction of the PSSCs approved pursuant 

to 10 CFR 70.23 (b) has been completed in accordance with the application. Thus in 

accordance with 10 CFR 70.23(a)(8), the staff has determined that the license to possess and 

use SNM will not be issued, before a determination that construction of the PSSCs is approved 

pursuant to 70.23(b) is in accordance with the application”. 

A summary of the NRC’s review and findings in each of the review areas is provided below.

General Information

The staff concluded that (1) the level of detail in the facility and process overview provided an 

adequate understanding of the facility and processes and conveyed the purpose of the facility; 

(2) the facility and the process overview appropriately cross-referenced material presented in 

later sections of the LA; and (3) the facility and process overview is consistent with, yet less 

detailed than, material in later sections of the application.

The staff concluded that the applicant provided the geographic, demographic and land use, 

meteorologic, hydrologic, geologic, and seismic information relevant to the MFFF site. This 

information is generally current, appropriately referenced, and consistent with information in the 

safety assessments used to support the design bases of the item relied on for safety (IROFS)

structures. The staff finds that the applicant has accurately described the site so as to properly 

define potential accident conditions. Based on its review of the LA and the relevant 

supplementary information provided by the applicant, the staff further finds that the applicant 

has met the baseline design criteria (BDC) in 10 CFR 70.64(a)(2) for natural phenomena 

hazards.

Financial Qualifications

As stated in §1.2.4.2 of the Construction Authorization Request (CAR) (DCS, 2004), the DOE 

has agreed to indemnify MOX Services in accordance with the provisions of the Price-Anderson 

Act set forth in §170(d) of the Atomic Energy Act of 1954, as amended, 42 U.S.C. 2210(d). 

Based upon the DOE Indemnity Agreement and for the reasons discussed below, MOX 

Services requested an exemption from the NRC's requirements concerning agreements of 

indemnification and related financial protection requirements set forth in 10 CFR § 140.20 and 

§140.13a. 10 CFR §140.8. Based on its review of the exemption request, the staff finds that 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

xi

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

the requested exemption from the indemnity agreement and financial protection requirements of 

10 CFR §140.20 and §140.13a is authorized by law and in the public interest.

Protection of Classified Matter

The specific risk of a loss or compromise of project-related classified information is the 

theft/diversion or radiological sabotage to the SNM at the MFFF. There is also a general risk to 

the classified technical information associated with the project. Classified matter will be in the 

form of information related to classified components. The applicant’s submittals provided 

sufficient information, in accordance with 10 CFR Part 25 and 10 CFR Part 95, for the staff to 

determine that classified information will be adequately protected. Factors in the staff’s decision 

also include the licensee’s oversight by DOE and the MFFF location within the DOE SRS.

Organization and Administration

The staff evaluated the proposed organization for operation; the administration of the project; 

and the responsibilities, qualifications, and authorities of key management positions. The 

proposed organization, administration, and key management position descriptions and 

qualifications are consistent with guidance in NUREG-1718 and meet the regulatory 

requirements for organization and administration in 10 CFR 70.22 and 70.23 and are, therefore, 

acceptable.

The staff concludes that the applicant’s organization and administration provide reasonable 

assurance that the applicant has an acceptable organization, appropriate administrative 

policies, and qualified key management positions to satisfy the regulatory requirements for a 

license to possess and use radioactive material.

Integrated Safety Analysis

The staff’s review confirmed that the applicant's license application contains appropriate 

commitments, including commitments to: (1) perform and maintain an ISA; (2) compile and 

maintain process safety information; (3) engage personnel with appropriate training to conduct 

the ISA; (4) use appropriate methods to conduct the ISA; and (5) implement appropriate 

measures and procedures to ensure that the ISA stays accurate and up-to-date. 

The staff has also verified that the applicant performed an ISA to identify and evaluate the 

hazards and potential accidents associated with the facility, and to establish engineered and 

administrative controls to ensure facility operation will be within the bounds of the 70.61 

performance requirements. The staff confirmed that the applicant's ISA Summary (1) identified 

the hazards at the facility; (2) analyzed for accident sequences through the use of process 

hazards analysis; (3) evaluated and assigned consequences to the accident sequences; and (4) 

evaluated the likelihood of each accident consistent with the guidance in NUREG-1718. 

Moreover, the applicant identified all items relied on for safety, including administrative and 

engineered controls and has included a listing of these controls, including sole IROFS, in their 

ISA Summary. As a result, the NRC staff has concluded that there is reasonable assurance 

that the applicant's postulated accidents resulting from the facility hazards that may be 

anticipated to occur should be in compliance with the performance requirements of 10 CFR 

70.61. 

Also, the applicant uses features to reduce the challenge to IROFS where it is practical. For 

example, to minimize the ignition sources, the applicant will ground pipes, vessels, and 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

xii

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

gloveboxes. The NRC staff finds that these features comply with the defense-in-depth 

requirements of 10 CFR 70.64(b).

The staff concludes that the identification and evaluation of the hazards and accidents as part of 

the ISA and establishment of controls to maintain safe facility operation from their 

consequences meet the requirements for a license to possess and use SNM under 10 CFR Part 

70, and provide reasonable assurance that the health and safety of the public, the workers, and 

the environment will be adequately protected. 

Nuclear Criticality Safety

The staff reviewed the description of the applicant’s Nuclear Criticality Safety (NCS) Program 

contained in Chapter 6 of the license application. Based on the review, the staff determined that 

there is reasonable assurance that the applicant will establish and maintain a program sufficient 

to ensure health and safety and compliance with all criticality safety regulatory requirements. In 

particular, the staff has reasonable assurance that the applicant will: (1) have in place a staff 

qualified to develop, implement, and maintain an NCS Program in accordance with the 

application’s description of facility organization, administration, and management measures; (2) 

conduct its operations based on technical practices sufficient to ensure that licensed material 

will be possessed, stored, and used safely according to the requirements of 10 CFR Part 70; (3) 

develop, implement, and maintain a criticality accident alarm system in accordance with the 

requirements of 10 CFR 70.24; and (4) establish safety limits and controls sufficient to ensure 

subcriticality, including an appropriate margin of subcriticality for safety, and the BDC of 10 CFR 

70.64. Based on this review, the staff has reasonable assurance that the applicant’s NCS 

Program, will meet the requirements for a license to possess and use SNM under 10 CFR Part 

70, and will ensure protection of public health and safety, including workers and the 

environment. 

The staff also reviewed selected portions of the applicant’s ISA Summary and supporting on-site 

ISA documents. Based on the review, the staff determined that there is reasonable assurance 

that the applicant will implement and maintain safety limits and controls sufficient to ensure 

health and safety and compliance with all criticality safety regulatory requirements. In particular, 

the staff has reasonable assurance that the applicant will establish controls on all credible 

accident sequences leading to criticality sufficient to ensure that: (1) credible accident 

sequences will be highly unlikely, (2) that all processes will be subcritical under normal and 

credible abnormal conditions; and (3) that all processes will adhere to the double contingency 

principle. Based on this review, the staff has reasonable assurance that the applicant’s 

implementation of its ISA, will meet the applicable requirements of 10 CFR 70.66(a), and will 

ensure protection of public health and safety, including workers and the environment.

Fire Protection

The staff evaluated the organization and conduct of operations, facility fire protection features 

and systems, manual firefighting capability, and the fire hazards analysis and concludes that the 

applicant’s proposed equipment and facilities are adequately described and will protect health 

and minimize danger to life or property. 

The staff reviewed the applicant’s fire accident analyses including the reliability and applicability 

of selected IROFS to the postulated initiators and fire area hazards. The staff concludes that 

the applicant’s proposed equipment, facilities, and procedures provide a reasonable level of 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

xiii

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

assurance that adequate fire protection will be provided and maintained for those IROFS to 

meet the safety performance requirements and the BDC of 10 CFR Part 70.61. 

The staff reviewed the design bases for fire protection systems, fire related administrative 

controls, and buildings as described in the LA and ISA Summary. The staff concludes that fire 

protection related IROFS and defense in depth controls will be designed, constructed, and/or 

utilized consistent with good engineering practice which dictates that certain minimum 

requirements be applied as design and safety considerations for any new nuclear process or 

facility. These minimum requirements are met through the applicant’s use of applicable 

nationally accepted fire protection codes and standards. The staff concludes that the facility 

meets 10 CFR 70.64(a)(3) with respect to fire protection.

Chemical Safety

The staff evaluated information provided by the applicant in the license application, ISA 

Summary, Nuclear Safety Evaluations, various technical reports, and responses to requests for 

additional information. Staff found applicant’s facility and system design and facility layout 

pertaining to chemical safety are based upon defense-in-depth practices; and the applicant’s 

facility design and items relied on for safety provide reasonable assurance of chemical safety at 

the facility for routine operations, off-normal conditions, and potential accidents. Based on the 

review of the license application, the staff concluded that the applicant adequately described 

and assessed accident sequences having potentially significant chemical consequences and 

effects that could result from the handling, storage, or processing of licensed materials. The 

license application and ISA Summary identified those chemical process hazards and potential 

accidents, and established safety controls to ensure safe facility operation. To ensure that the 

performance requirements in 10 CFR Part 70 are met, the applicant will ensure that controls are 

maintained available and reliable. The staff reviewed these safety controls and the applicant's 

plan for managing chemical process safety and its potential effects upon licensed radioactive 

materials and finds them acceptable. 

The staff concludes that the applicant's plan for managing chemical process safety and the 

chemical process safety controls meet the requirements to possess and use SNM according to 

10 CFR Part 70.

Radiation Safety

The applicant’s radiation protection (RP) program includes the following: 

• an effective, documented program to ensure that occupational radiological exposures 

are as low as reasonably achievable (ALARA)

• an organization with adequate qualification requirements for the radiation safety 

personnel 

• approved written RP procedures for RP activities 

• radiation safety training for all personnel who have access to restricted areas 

• requirements for an air sampling program 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

xiv

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

• control of radiological contamination within the facility 

• a respiratory protection program 

• requirements for radiological measurement instrumentation 

• a program for monitoring the external and internal radiation exposure of personnel 

Conformance to this program should ensure safe operation and provide early detection of 

unfavorable trends to allow prompt corrective action.

The NRC staff concludes, with reasonable assurance, that the applicant’s RP program is 

adequate and that the applicant has the necessary technical staff to administer an effective RP 

program that meets the requirements of 10 CFR Parts 19, 20, and 70 for a license to possess 

and use SNM.

Environmental Protection

The applicant has developed a program to implement adequate environmental protection 

measures during operation. These measures include (1) environmental and effluent monitoring 

and (2) effluent controls to maintain doses to the public ALARA as part of the RP program. The 

NRC staff concludes that the applicant’s program, as described in its application and 

environmental report, is adequate to protect the environment and the health and safety of the 

public and complies with regulatory requirements imposed by the Commission in 

10 CFR Part 20; 10 CFR Part 30, “Rules of General Applicability to Domestic Licensing of 

Byproduct Material”; 10 CFR Part 40, “Domestic Licensing of Source Material”; 10 CFR Part 51, 

“Environmental Protection Regulations for Domestic Licensing and Related Regulatory 

Functions”; and 10 CFR Part 70, “Domestic Licensing of Special Nuclear Material.”

Plant Systems

Mixed Oxide Process Description

In Section 11.1 of the LA and Section 4.1 of the ISA Summary, the applicant provided design 

basis information for the Mixed Oxide Process (MP) process and identified IROFS for the 

facility. Based on the staff’s review of the LA and ISA Summary and supporting information 

provided by the applicant relevant to the MP process, the staff finds that the applicant has met 

the BDC set forth in 10 CFR 70.64(a)(3) for explosions and 10 CFR 70.64(a)(5) for chemical 

safety.

Aqueous Polishing Process and Chemistry

In Section 11.2 of the LA and Section 4.2 of the ISA Summary, the applicant provided design 

basis information for chemical process safety IROFS indentified for the MFFF. Based on the 

staff’s review of the chapters and supporting information, provided by the applicant, that is 

relevant to Aqueous Polishing and chemical process safety, the staff finds that, for the reasons 

discussed above, MOX Services has met the BDC set forth in 10 CFR 70.64(a)(3) for 

explosions, and 10 CFR 70.64(a)(5) for chemical safety. Further, the staff concludes, pursuant 

to 10 CFR 70.23(b), that the design bases of the IROFS identified by the applicant will provide 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

xv

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

reasonable assurance of protection against natural phenomena and the consequences of 

potential accidents.

Ventilation and Confinement Systems

In Section 11.3 of the revised LA and Section 4.3 of the ISA Summary, the applicant provided 

information for the ventilation and confinement systems that it identified as IROFS for the 

proposed MFFF. The staff evaluated the above information and based on the review of this 

information and relevant supporting information provided by the applicant, the staff concluded 

that the applicant’s ventilation and confinement system designs and operations satisfy the staff’s 

acceptance criteria and the systems are adequately available and reliable to perform their 

intended functions when needed. The applicant has satisfactorily addressed the applicable 

regulatory requirements, including the performance requirements, the BDC, and the defense-indepth practices contained in 10 CFR Part 70.

Electrical Systems

The NRC staff has evaluated the information provided by the applicant for Electrical Systems in 

the Section 11.4 LA and the Section 4.4 of the ISA Summary. Based on the review of the 

chapters and supporting information, provided by the applicant, the NRC staff concludes that 

the BDC of 10 CFR 70.64 has been achieved, and that the concept of defense-in-depth has 

been applied to the design of the electrical power systems. In addition, there is reasonable 

assurance that the electrical systems design and operation will fulfill the functional requirements 

of providing reliable power to enable the MFFF IROFS to perform their required safety actions, 

and the electrical systems will be available and reliable to perform their intended safety 

functions when needed. 

Instrumentation and Control Systems

The NRC staff has evaluated the information provided by the applicant for Instrumentation and 

Control (I&C) Systems in Section 11.5 of the LA and Section 4.5 of ISA Summary. Based on 

the review of the chapters and supporting information, provided by the applicant, the NRC staff 

has determined that the design guidance and recommendations contained in the regulatory 

guidance, industry codes and standards, and licensing review guidance documents to which the 

applicant has committed for use in completing the design of the MFFF will provide a reasonable 

assurance that the design criteria identified in the regulations will be adequately addressed. 

The NRC staff also concludes that the BDC of 10 CFR 70.64 has been achieved, and that the 

concept of defense-in-depth has been applied to the design of these systems. In addition, there 

is reasonable assurance that the I&C systems design and operation will be available and 

reliable to enable the MFFF IROFS to perform their required safety actions when needed.

Material Handling Systems

The staff evaluated the information provided by the applicant for material-handling equipment 

and controls in Section 11.6 of the LA and Section 4.6 of the ISA summary. The review of the 

design and operation of the material-handling systems was also closely coordinated with the 

review of other applicable portions of Chapters 4 and 5 of the ISA Summary, which discusses 

the material-handling operations and potential load-handling events.

The staff concluded that the applicant’s proposed equipment, facilities, and procedures provide 

a reasonable level of assurance that load-handling events that cause a release of radioactive 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

xvi

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

material or radiation exposures in excess of the performance requirements of 10 CFR 70.61 are 

highly unlikely, given the use of the designated IROFS, codes and standards, and management 

measures, as well as the quality assurance (QA) program. The staff further concludes that the 

baseline design requirements of 10 CFR 70.64 are satisfied

Fluid Transport Systems

The staff evaluated the information provided by the applicant for fluid transport equipment and 

controls in Chapter 11.7 and Section 4.7 of the ISA Summary. The staff concluded that the 

applicant’s proposed equipment, controls, and procedures provide a reasonable level of 

assurance that events related to the fluid transport systems that could cause a release of 

radioactive material or radiation exposures in excess of the performance requirements of in 10 

CFR 70.61 are highly unlikely with the use of the designated IROFS, codes and standards, 

management measures and the QA program and that the baseline design requirements of 10 

CFR 70.64 are satisfied

Fluid Systems

The applicant provided design information for the fluid systems that are identified as IROFS. 

Based on the staff’s review of Section 11.8 of the LA and Section 4.8 of the ISA Summary and 

supporting information provided by the applicant relevant to the fluid systems, the staff 

concludes, a) pursuant to 10 CFR 70.61(e) that each engineered or administrative control or 

control system that is needed to meet the performance requirements be designated as an 

IROFS and relating to the safety program that ensures each IROFS will be available and 

reliable to perform its intended function when needed and b), that the design bases of the 

IROFS evaluated in this section will provide reasonable assurance of protection against natural 

phenomena and the consequences of potential accidents.

Heavy Lift Cranes

In Section 11.9 of the LA, the applicant provided design-basis information for the heavy lift 

cranes in the proposed facility. The applicant stated that “no MFFF heavy lift cranes have been 

identified as an item relied on for safety.” Based on the staff's review of the Chapter 11.9 of the 

LA and Section 4.9 of the ISA Summary, the staff agrees with this finding and concludes, 

pursuant to 10 CFR 70.61(e), that regarding the heavy lift cranes of the MFFF, the applicant’s 

proposed equipment and facilities are adequate to protect health and minimize danger to life or 

property

Laboratory Description

The applicant provided information related to the laboratory in Section 11.10 of the LA and 

Section 4.10 of the ISA summary. Based on the staff’s review of these Sections and supporting 

information provided by the applicant relevant to the laboratory, the NRC staff finds the 

descriptions of the MFFF laboratory to be adequate to facilitate an understanding of the 

operations and possible hazards. The safety strategy for the explosion scenarios satisfies the 

applicant’s ISA strategy. The NRC staff reasonable assurance that the identified highconsequence scenarios are highly unlikely. Therefore, the proposed safety strategy and IROFS 

comply with the performance requirements of 10 CFR 70.61, the BDC in 10 CFR 70.64(a)(3) 

and 10 CFR 70.64(a)(5), and the defense-in-depth practices in 10 CFR 70.64(b).
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

xvii

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

Civil Structural Systems

Section 1.1.2 of the LA and Sections 2 and 3 of the ISA summary provided design-basis and 

structural design information for civil structural systems for the MFFF. Based on the staff review 

of the LA, ISA summary and supporting information that the applicant provided relevant to civil 

structural systems, the staff finds that the applicant has met the BDC set forth in 

10 CFR 70.64(a)(2). In addition, the staff concludes, pursuant to 10 CFR 70.23(b), that the 

design bases of the civil structural systems identified by the applicant will provide reasonable 

assurance of protection against natural phenomena and the consequences of potential 

accidents. 

Human Factors Engineering

The staff reviewed the application of Human Factors Engineering (HFE) to personnel activities 

described in Chapter 12 of the LA. The staff concludes that the applicant included commitments 

that applied HFE to personnel activities identified as IROFS, consistent with the results of the 

ISA, and that its personnel activities meet the requirements associated with human factors given 

in 10 CFR Part 70.

Safety and Security

Material Control and Accounting

The staff reviewed the MFFF license application to possess and use strategic special nuclear 

materials and special nuclear materials according to Section 13.2 of NUREG-1718 (NRC, 2000)

and 10 CFR Part 74. Based on the review of the license application, the staff concludes that the 

applicant provided an acceptably robust FNMCP for the facility operations that will meet the 

applicable 10 CFR Part 74 requirements. The FNMCP describes acceptable methods for 

achieving the performance objectives in 10 CFR 74.51(a) and the system capabilities of 

10 CFR 74.51(b). As a result, the staff has determined that the applicant meets the 

requirements in the area of MC&A to operate the facility under 10 CFR Part 74.

Physical Protection

The NRC staff reviewed the applicant’s Physical Protection Plan (PPP) for fixed site physical 

protection of Strategic Special Nuclear Materials (SSNM). The methods, alternate methods, and 

procedures outlined in the PPP satisfy or sometimes exceed the performance objectives, 

systems capabilities, and reporting requirements specified in 10 CFR 73.45 and 73.46. The PPP 

for the facility is acceptable and provides reasonable assurance that the requirements for the 

physical protection of SSNM will be met.

The NRC staff’s reviewed the applicant’s Safeguards Contingency Response Plan (SCRP). 

The methods, alternate methods, and procedures outlined in the SCRP satisfy or sometimes 

exceed the performance objectives, systems capabilities, and reporting requirements specified 

in 10 CFR 73.45, 73.46, and Part 73 Appendix C. The SCRP for the facility is acceptable and 

provides reasonable assurance that the requirements for the physical protection of SSNM will 

be met.

The NRC staff’s reviewed the applicant’s Training and Qualification Plan (T&QP). The methods, 

alternate methods, and procedures outlined in the T&QP satisfy or sometimes exceed the 

performance objectives, systems capabilities, and reporting requirements specified in 10 CFR 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

xviii

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

73.45, 73.46, and part 73 Appendix B. The T&QP for the facility is acceptable and provides 

reasonable assurance that the requirements for the physical protection of SSNM will be met.

Emergency Management

The staff has reviewed MOX Services dose calculations and determined that (1) the calculated 

dose to the offsite public is reasonable and conservative, (2) the dose to the offsite public is less 

than 0.01 Sieverts (1 rem) effective dose equivalent or an intake of 2 mg of soluble uranium, 

and (3) no formal emergency plan is required. 

The staff notes that although an NRC-approved emergency plan is not required by 

10 CFR 70.22, “Contents of Applications,” the MFFF has committed to maintaining an 

emergency plan, implementing procedures, and emergency response organization for internal 

use. The staff considers this commitment prudent and acceptable. Based on this evaluation, 

the staff concludes that the MFFF has demonstrated reasonable assurance of compliance with 

10 CFR 70.22(i)(1)(i), 10 CFR 70.65(a)(6), and the performance criteria in NUREG-1718, 

Sections 14.4.1 through 14.4.3.1.4 (NRC, 2000).

Management Measures

The staff reviewed the applicant’s management measures in Chapter 15 of the LA including a) 

QA, b) configuration management, c) maintenance, d) training and qualification, e) procedures, 

f) audits and assessments, g) incident investigations, and h) records management.

Based on the evaluation of the applicant’s management measures program, the staff concludes 

that the applicant has demonstrated reasonable assurance of compliance with 10 CFR 

70.62(a)(3), 10 CFR 70,62(d), 10 CFR 70.63(a)(1), 10 CFR 70.64(a)(8), and 10 CFR 70.74(a).

Authorizations and Exemptions

The staff finds that the criteria provided by the applicant for determining whether prior NRC 

approval is needed are consistent with the type of changes that would be made to the LA. The 

staff finds that the timeliness required for prompt updating of the onsite documentation and the 

timeframe for reporting changes not requiring NRC prior approval are reasonable and consistent 

with the process for making changes to the safety program as described in 10 CFR 70.72. The 

staff also finds that the commitment to performing and documenting the evaluation of NRC prior 

approval and maintaining records is acceptable. The staff therefore finds that the authorization 

for making changes to the LA is acceptable. 

The staff evaluated the requests for exemptions related to radiation labeling, decommissioning, 

and financial assurance, and found them acceptable. 

REFERENCES

(DCS, 2004) Mixed Oxide Fuel Fabrication Facility Construction Authorization Request, 

Charlotte, NC, 2004.

(MOX, 2010a) Shaw AREVA MOX Services, “MFFF—License Application,” Aiken, SC, March 

2010.
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

xix

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

(MOX, 2010b) Shaw AREVA MOX Services, “MFFF—Integrated Safety Analysis Summary,” 

Aiken, SC, March 2010.

(NRC, 2005a) NUREG-1767, Final Environmental Impact Statement on the Construction and 

Operation of a Proposed Mixed Oxide Fuel Fabrication Facility at the Savannah River Site, 

South Carolina, Washington, DC, January 2005). 

(NRC, 2005b) Construction Authorization for the Mixed Oxide Fuel Fabrication Facility, 

Washington, DC, March 2005 (CA) to DCS for the MFFF. 

(NRC, 2005c) U.S. Nuclear Regulatory Commission, NUREG-1821, “Final Safety Evaluation 

Report on the Construction Authorization Request for the Mixed Oxide Fuel Fabrication Facility 

at the Savannah River Site, South Carolina,” March 2005.

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” August 2000.

10 CFR Part 20, “Standards for Protection Against Radiation”,

10 CFR Part 30, “Rules of General Applicability to Domestic Licensing of Byproduct Material”; 

10 CFR Part 40, “Domestic Licensing of Source Material”;

10 CFR Part 51, “Environmental Protection Regulations for Domestic Licensing and Related 

Regulatory Functions”;

10 CFR 70, Domestic Licensing of Special Nuclear Material

Atomic Energy Act, as amended 1954

Strom Thurmond National Defense Authorization Act for Fiscal Year 1999

Price-Anderson Nuclear Industries Indemnity Act, Washington, DC, 1957
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 1 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1.0 GENERAL INFORMATION 

1.1 Facility and Process Overview

1.1.1 Conduct of Review 

This chapter of the Safety Evaluation Report (SER) discusses general information contained in 

Chapter 1 of the revised Mixed Oxide (MOX) Fuel Fabrication Facility (MFFF or the facility) 

license application (LA) to possess and use radioactive material (MOX 2009). Chapter 1 of the 

MFFF LA provides general information about the facility processes and the site. It consists of a 

general facility description, material flow, and process overview. The objective of SER Chapter 

1 is to familiarize the reader with the pertinent features of the proposed facility and the site. 

1.1.1.1 General Facility Description 

The facility will be a “plutonium processing and fuel fabrication plant,” as defined in Title 10

Code of Federal Regulations (10 CFR), Section 70.4, “Definitions,” of the 10 CFR 70.4. The 

facility is designed to convert surplus weapons-grade plutonium into MOX fuel that can be used 

to generate electricity at commercial nuclear power stations. The assemblies are composed of 

fuel rods which contain fuel pellets consisting of a blend of uranium and plutonium dioxides 

(PuO2) (i.e., mixed oxides). The PuO2 to be used would be obtained from weapons-grade 

plutonium inventories held by the U.S. Department of Energy (DOE), which are declared surplus 

to national security needs. 

The MFFF is located in the F-Area of the DOE Savannah River Site (SRS) near Aiken, South 

Carolina (SC). The site encompasses approximately 0.17 km2

 (41 a), of which approximately 

6.9 × 10-2 km2 (17 acres (a)) will be developed with roads, facilities, or buildings. No roads, 

railroads, or waterways traverse the MFFF. 

1.1.1.1.1 Controlled Area Boundary 

With respect to the controlled area boundary (CAB), 10 CFR 70.61(f) requires that the applicant 

establish a controlled area, as defined in 10 CFR 20.1003, “Definitions.” Section 20.1003 of 10 

CFR defines the controlled area as “means an area, outside of a restricted area but inside the 

site boundary, access to which can be limited by the licensee for any reason.” 

The controlled area established for the MFFF includes those areas and buildings that are under 

Shaw AREVA MOX Services (MOX Services or the applicant) control and that are a direct part 

of the MFFF. The CAB is coincident with the MFFF site boundary. The CAB is depicted in 

Figure 1.1.2-2 of the LA. 

1.1.1.1.2 Facility Buildings and Structures 

Facility buildings consist of the MOX fuel fabrication building, the emergency diesel generator 

building, the emergency fuel storage vault, safe haven buildings, the reagent processing 

building, the standby diesel generator building, the secured warehouse building, the 

administration building, and the technical support building. Miscellaneous site structures consist 

of a bulk gas storage pad; heating, ventilation, air-conditioning, and process chiller pads; diesel 

fuel filling stations; and other minor structures. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 2 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

The main building is the MOX fuel fabrication building. This building will contain all of the PuO2 

handling, fuel processing, and fuel fabrication operations of the facility. It is a reinforced 

concrete building having a footprint of approximately 91.5 m (300 ft) by 137 m (450 ft) by 

approximately 22.3 m (73 ft) above grade. The building is composed of three major functional 

areas, (1) the MOX processing (MP) area, (2) the aqueous polishing (AP) area, and (3) the 

shipping and receiving area. In the AP area, PUO2 feedstock received from either the pit 

disassembly and conversion facility (PDCF), or from alternate feedstock, would be processed to 

remove impurities, such as gallium and americium. The purified PUO2 would then be blended 

with depleted uranium dioxide (UO2) powder and processed into MOX fuel, and ultimately fuel 

assemblies, in the MP area. In the shipping and receiving area, plutonium and UO2 would be 

received along with other materials necessary to produce fuel assemblies. Completed fuel 

assemblies would be shipped to commercial nuclear power plants from this area. 

1.1.1.2 Material Flow 

The facility would receive PuO2 from the PDCF, to be located on the SRS near the facility, as 

well as other DOE sources (i.e., alternate feedstock). The material would be transported to the 

shipping and receiving area of the facility in approved shipping containers. The material would 

be unloaded and inspected according to the MFFF Material Control and Accounting (MC&A) 

and Radiation Protection Programs. The material would then be moved to the AP Area. The 

facility also would receive depleted UO2 at the material receipt area of the secured warehouse 

building, where it would be inspected according to the MC&A and Radiation Protection 

Programs. The depleted UO2 would be trucked to the shipping and receiving area of the facility. 

Fresh MOX fuel assemblies would be stored in the assembly storage vault in the facility before 

shipping offsite. For shipping to commercial power plants, the assemblies would be moved to 

the shipping and receiving area of the facility where they would be loaded into a MOX fresh fuel 

transportation package that had been approved by the U. S. Nuclear Regulatory Commission 

(NRC) in accordance with 10 CFR Part 71, and then loaded onto a secure transport vehicle for 

transport to commercial power plants for irradiation. 

1.1.1.3 Process Overview 

The facility would have two main process operations, (1) an AP process that serves to remove 

impurities, such as americium and gallium (i.e., polishing), and (2) the MP which converts the 

plutonium and depleted UO2 into fuel pellets, fuel rods, and fuel assemblies. A summary of the 

major processes in the facility is provided below. A more detailed discussion of process 

chemistry and chemical safety is provided in Chapter 8 and Sections 11.1 and 11.2 of this SER. 

1.1.1.3.1 Aqueous Polishing Process Overview 

All feedstock, both from the PDCF and from other DOE sources, will be received as PuO2. The 

PuO2 received at the MFFF will contain small amounts of impurities that must be removed for 

use of the MOX fuel in reactors. Feedstock from the PDCF will contain impurities such as 

gallium, americium, and highly enriched uranium. The diversity of impurities and the level of 

impurities will be higher in alternate feedstock. Some of this alternate feedstock may have 

higher than normal salt contaminants (other than chlorides), some will contain chloride 

contaminants, and some will contain small amounts of uranium. The AP process is used to 

remove these impurities. The AP process consists of three major steps, (1) dissolution, (2) 

purification, and (3) conversion. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 3 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

In the dissolution step, the PuO2 powder received from the PDCF and other DOE sources would 

be placed into solution by electrolytic dissolution with silver in nitric acid. For AFS material 

containing chlorides, a dechlorinization process will be performed in the electrolyser prior to 

dissolution with silver in nitric acid. 

The purification step involves purification of the plutonium solution in pulsed columns by solvent 

extraction. The solvent mixture would be tibutyl phosphate dissolved in hydrogenated 

polypropylene tertrame solvent. The plutonium and uranium are extracted into the organic 

phase and the impurities (americium, gallium, silver, etc.) remain in the aqueous phase as 

raffinates. The plutonium is then separated from the uranium in the solvent by reducing the 

valence state of the plutonium from +4 to +3 with the addition of hydroxylamine nitrate and acid 

stripping, during which the plutonium is removed from the organic stream into the aqueous 

stream. In the aqueous purified nitrate stream, the plutonium valence state is oxidized back to 

the +4 valence state by passing nitrous oxide fumes through the plutonium solution in a packed 

column. Downstream of the plutonium separation process, the solvent solution with the 

plutonium removed is stripped of uranium with a nitric acid solution. The unloaded solvent 

solution in sent to the solvent recovery unit, while the uranium stream is sent to the aqueous 

liquid waste system. 

The organic waste streams are collected and sent to the solvent recovery unit where they are 

scrubbed in a multistage mixer-settler unit to remove the degradation products. The 

composition of the solvent mixture is adjusted to 30% tributylphosphate in the multistage mixersettler before being recycled to the purification step. 

Various aqueous waste streams are collected and sent to the acid recovery unit where the 

raffinates are concentrated and the nitric acid is recovered in a two-step concentration process 

that is followed by rectification. The recovered acid is then reused in the process while excess 

acid and concentrated raffinates are sent to the aqueous waste stream. 

The conversion step converts the purified plutonium nitrate stream to PuO2 powder by the 

processes of precipitation and calcination. The plutonium nitrate stream is reacted with oxalic 

acid to form a plutonium oxalate slurry that is collected by a filter and dried in a rotary calciner 

where the oxalate is converted into oxide at high temperature. The PuO2 powder is then 

homogenized, sampled, and stored in cans for use in the fuel fabrication process. The filtered 

oxalic liquor stream is treated with manganese to facilitate the decomposition of the oxalates, 

concentrated, and then recycled to the beginning of the extraction cycle to maximize plutonium 

recovery. Off gas from the rotary calciner is routed through High Efficiency Particulate Air filters 

prior to discharge to the atmosphere through the plant vent stack. 

1.1.1.3.2 MOX Processing Overview 

The purified PuO2 powder would be used in the MP where it would be blended with depleted 

UO2 powder to make MOX fuel. The MP process consists of four major steps, (1) powder 

blending, (2) pellet production, (3) rod production, and (4) fuel assembly production. 

The first operation is the production of the powder master blend. Polished PuO2 is mixed with 

Depleted UO2 and recycled powder/pellet material to produce an initial mixture that is 

approximately 20% plutonium. This mixture is subjected to micronization in a ball mill and 

mixed with additional Depleted UO2 and recycled material to produce a final blend with the 

required plutonium content (typically from 2% to 6%). This final blend is further homogenized to 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 4 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

meet plutonium distribution requirements. During the final homogenizing steps, a lubricant and 

pore-former are added to control density. 

The final homogenized powder blend is pressed to form “green” pellets, which are then sintered 

to obtain the required ceramic qualities. The sintering step removes organic products dispersed 

in the pellets and removes the previously introduced pore-former. The sintered pellets are 

ground to a specified diameter in center-less grinding machines and sorted. Powder recovered 

from grinding and discarded pellets are recycled through a ball mill and reused in the powder 

processing. 

Fuel rods are loaded to an adjusted pellet column length, pressurized with helium, welded, and 

then decontaminated. The decontaminated rods are removed from the gloveboxes and placed 

on racks for inspection and assembly. Fuel rods are inserted into the fuel assembly skeleton, 

and the fuel assembly construction is completed. Each MOX fuel assembly is subjected to a 

final inspection prior to shipment in a fresh fuel shipping cask. 

1.1.2 Evaluation Findings

The staff reviewed the facility and process overview from the applicant’s LA to possess and use 

radioactive material at the MFFF in accordance to Section 1.1 of NUREG-1718. The staff 

evaluated the facility and process overview descriptions provided by the applicant in Section 1.1 

of the LA focusing on new or changed material when compared to the safety evaluation for the 

construction authorization (NRC, 2005). 

The staff concluded that (1) the level of detail in the facility and process overview provided an 

adequate understanding of the facility and processes and conveyed the purpose of the facility; 

(2) the facility and the process overview appropriately cross-referenced material presented in 

later sections of the LA; and (3) the facility and process overview is consistent with, yet less 

detailed than, material in later sections of the application. As a result, the staff finds that the 

application meets the regulatory requirements of 10 CFR Part 70.22 and 70.65 for providing a 

facility and process overview for a license to possess and use radioactive material. More 

detailed facility and process descriptions are provided in other sections of the LA and are 

discussed in other chapters of this SER. 

REFERENCES 

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide Fuel Fabrication Facility,” Washington, DC, 

August 2000. 

(NRC, 2005) U.S. Nuclear Regulatory Commission, NUREG-1821, “Final Safety Evaluation 

Report on the Construction Authorization Request for the Mixed Oxide Fuel Fabrication Facility 

at the Savannah River Site, South Carolina.” Washington DC, March 2005 

(MOX, 2009) Shaw AREVA MOX Services, “License Application,” Aiken, SC, October 2009. 

10 CFR Part 20, “Standards for Protection Against Radiation” 

10 CFR Part 70, “Domestic Licensing of Special Nuclear Material” 

10 CFR Part 71, “Packaging and Transportation of Radioactive Material” 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 5 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

SECY-07-0047, “Staff Approach to Verifying the Closure of Inspections, Tests, Analyses, and 

Acceptance Criteria Through a Sample-Based Inspection Program,” dated May 16, 2007 

1.2 Institutional Information 

1.2.1 Conduct of Review 

This chapter of the SER contains the staff’s review of institutional information described by the 

applicant in Chapter 1 of the LA. The staff used Chapter 1 in NUREG-1718, “Standard Review 

Plan for the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” (NRC, 

2000) as guidance in performing the review. 

1.2.1.1 Corporate Identity 

MOX Services is the applicant for the license to possess and use by-product material, source 

material, and special nuclear material (SNM). MOX Services is incorporated in the State of 

South Carolina as an LLC owned by Shaw Project Services Group, Inc. (SPSG), Shaw 

Environmental & Infrastructure, Inc. (SE&I), and AREVA, Inc. These three companies are the 

equity owners of the LLC (SPSG 40%, SE&I 30%, and AREVA 30%). MOX Services was 

formed to provide MOX fuel fabrication and other services to support the mission of DOE for the 

disposition of U.S.-owned surplus weapons-usable plutonium. 

1.2.1.2 Foreign Ownership, Control, or Influence 

DOE is the owner of the MFFF, which is located at SRS in Aiken, SC. MOX Services is a South 

Carolina LLC, whose direct owners are all U.S. corporations. AREVA, Inc. (formerly COGEMA, 

Inc.), which owns a minority share of MOX Services (30%), is itself a wholly owned subsidiary of 

AREVA NC, a French company. SPSG and SE&I together hold a 70% majority interest in MOX 

Services. As a result, there is no direct foreign ownership, no foreign control, and no significant 

foreign interest in MOX Services. Furthermore, in awarding the contract to MOX Services to 

design, construct, and operate the MFFF, DOE engaged in a foreign ownership, control, or 

influence (FOCI) review in accordance with DOE Order 470.1, “Safeguards and Security 

Program”. Based upon that review, DOE rendered a favorable FOCI determination on July 9, 

1999, based on a Security Control Agreement between Shaw AREVA MOX Services, LLC and 

DOE, mitigating FOCI. Additionally, a favorable FOCI determination has been made for SE&I 

(30 September 2006, through reciprocity with the Department of Defense). 

The NRC accepts DOE FOCI determinations based on a memorandum of understanding 

between the NRC and DOE dated October 9, 1996. 

1.2.1.3 Proposed License Information 

The applicant requested a license to receive, acquire, possess, use store, and transfer byproduct material, source material, and SNM pursuant to 10 CFR Part 30, “Rules of General 

Applicability to Domestic Licensing of Byproduct Material”, 10 CFR Part 40, “Domestic Licensing 

of Source Material”, and 10 CFR Part 70 for the materials identified in Table 1.2-1. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 6 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

 

 

The term of the license that was requested is 20 years. 

1.2.1.3.1 Regulatory Requirements to be Met Prior to Issuing a License to MOX Services for 

the MFFF 

The regulatory requirements of 10 CFR 70.23(a)(8) states that an application for a license will 

be approved if the Commission determines that, where the proposed activity is the operation of 

a plutonium processing and fuel fabrication plant, construction of the principal systems, 

structures, and components (PSSCs) approved pursuant to 10 CFR 70.23(b) has been 

completed in accordance with the application. PSSCs are safety controls that are identified in 

the design bases as providing protection against the consequences of accidents or natural 

phenomena. A safety control is a system, device, or procedure intended to regulate a device, 

process, or human activity to maintain a safe state. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 7 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

Thus in accordance with 10 CFR § 70.23(a)(8), the staff has determined that any license to 

possess and use SNM will not be issued, before a determination that construction of the PSSCs 

approved pursuant to section 70.23(b), is in accordance with the application. 

The MFFF Construction Authorization Requests (CAR) lists the 53 PSSCs in Table 5.6-1 and 

their associated safety functions. The PSSCs are identified as administrative controls, active 

engineered controls or passive engineered controls. Since the NRC approval of the MFFF CAR 

on in March 2005 (NRC, 2005), the applicant has identified in the Integrated Safety Analysis 

(ISA) Summary associated with the LA, approximately 15,000 Items Relied On for Safety 

(IROFS) designated to perform the design basis safety functions of the PSSCs. 

The staff’s findings as documented in the MFFF construction authorization, stated “in 

accordance with 10 CFR 70.23(b), on the basis of information described in the CAR, as revised, 

and the additional statements and commitments heretofore made by DCS (now called Shaw 

Areva MOX Services), the design bases of the PSSCs for the proposed MFFF and the quality 

assurance program, provide reasonable assurance of protection against natural phenomena 

and the consequences of potential accidents”, Additionally, the ISA Summary provides the 

IROFS for the facility that support the performance of the MFFF’s safety functions. These 

IROFS perform the safety functions needed to satisfy the design bases defined in the CAR. 

The verification of the construction of a PSSC will vary depending on the type and nature of the 

system, structure, or component. In some cases, a PSSC may be an administrative control 

(e.g., combustion loading controls), an active or passive engineering control, use of an 

approved item (e.g., 3013 transport cask approved under 10 CFR Part 71), or some 

combination of the above. Verification of PSSCs includes evaluations of procedures and of 

administrative and engineering IROFS. To support the verification, PSSCs that include items 

such as safety related inaccessible tanks in process cells will need to be verified prior to 

their entrapment. 

As applicable to the specific type of PSSC, NRC construction inspection and/or the technical 

review programs will verify that the construction of each PSSC listed in Table 5.6-1 of the MFFF 

CAR has been completed and the design basis safety function can be met. It is expected that 

the IROFS related to a specific PSSC will range from one to several thousand. 

Inspection of each IROFS is not required for providing reasonable assurance that construction 

of the PSSCs has been completed in accordance with the application. For this reason, the NRC 

has historically relied on a sample-based inspection program. One approach is for the staff to 

rely on a randomly selected set of samples for inspection. An alternative approach is to select a 

sample of inspection targets IROFS to determine if there is a reasonable basis for concluding 

that construction of the PSSCs has been successfully completed. The staff’s chosen approach 

for a particular PSSC will be that which best fits the nature of the PSSC and can be practically 

performed. 

The staff will prioritize potential IROFS for inspection considering the following attributes: (1) 

safety significance; (2) propensity for errors; (3) construction and testing experience; and (4) 

opportunity to verify by other means. A more detailed discussion of these attributes can be 

found in SECY-07-0047 (NRC, 2007), dated May 16, 2007. The NRC will focus its inspections 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 8 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

on activities contributing to IROFS determined to have higher inspection value1

. Similar to the 

definition in SECY-07-0047, it is not the IROFS that are prioritized, but rather the value of 

inspecting the IROFS to maximize the agency’s ability to detect significant construction flaws. 

This inspection sample will include both observation of IROFS-related work at the MFFF 

construction site, vendor facilities, and review of calculations and analyses by the Office of 

Nuclear Material Safety and Safeguards (NMSS) technical staff. These inspection targets will 

define the minimum sample set the NRC will inspect. This will provide the staff with a 

comprehensive sample based on inspection and technical review for IROFS-related work. 

It should be noted that some of the PSSCs described in the MFFF CAR have only one safety 

function and have only a few IROFS associated with that safety function. In that scenario, the 

inspection target sample size would be equal to the number of IROFS. The verification process 

will incorporate one or more of the following methods: (1) PSSC field inspection results; (2) 

technical staff reviews and evaluations; and (3) staff review of MOX Services PSSC completion 

bases. The inspections will include reviews of procedures, design verification and engineering 

reviews, vendor and procurement inspections, receipt inspections, installation inspections, 

reviews of testing and surveillance and maintenance inspections. 

For each PSSC, the NRC will develop a verification plan to outline the inspection and technical 

review activities that will be performed in order to support the staff findings regarding 10 CFR 

70.23 a(8). The NRC will certify that the verification of construction completion for all PSSCs 

will be subject to verification through inspection and technical review. The certification process 

is similar to that described in Inspection Procedure 94300 and will include the issuance of a 

PSSC construction completion memorandum following staff verification. This certification would 

indicate that there is reasonable assurance that the construction of each PSSC has been 

completed based on a comprehensive inspection verification process and include references to 

the relevant inspection reports. The NRC will file a notice advising the Atomic Safety and 

Licensing Board (if the record is still open) or the Commission (if the record is closed) once all 

information relevant to the verification of construction completion is before the agency. 

1.2.2 Evaluation Findings 

The staff evaluated the institutional information for approval to construct an MFFF at the SRS 

according to Section 1.2 of NUREG-1718 (NRC, 2000). The staff evaluated institutional 

information identifying the applicant’s corporate structure, FOCI determinations, and proposed 

license possession limits in the license application focusing on new or changed material when 

compared to the safety evaluation of the construction authorization (NRC, 2005). The staff finds 

that the information is complete and accurate, is consistent with the recommendations in 

NUREG-1718 (NRC, 2000), and is, therefore, acceptable. 

Based on the review, the staff concluded that the applicant meets the regulatory requirements in 

10 CFR Part 70 for ownership, location, planned activities, and nuclear material to be handled in 

connection with the LA to possess and use radioactive material for the MFFF. 

 

1

 The term higher inspection value is defined in SECY-07-0047, “Staff Approach to Verifying the Closure of 

Inspections, Tests, Analyses, and Acceptance Criteria Through a Sample-Based Inspection Program,” dated May 16, 

2007. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 9 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

REFERENCES 

(NRC, 2000) NRC. NUREG-1718, “Standard Review Plan for the Review of an Application for a 

Mixed Oxide Fuel Fabrication Facility”. Washington, DC, 2000. 

(NRC, 2005) U.S. Nuclear Regulatory Commission, NUREG-1821, “Final Safety Evaluation 

Report on the Construction Authorization Request for the Mixed Oxide Fuel Fabrication Facility 

at the Savannah River Site, South Carolina.” Washington DC, March 2005. 

(MOX, 2008) Shaw AREVA MOX Services. “License Application,” October 2009. 

(MOX, 2005) Duke Cogema Stone and Webster, “Construction Authorization Request”, March 

2005. 

(NRC, 2007) SECY-07-0047, “Staff Approach to Verifying the Closure of Inspections, Tests, 

Analyses, and Acceptance Criteria Through a Sample-Based Inspection Program,” dated 

May 16, 2007. 

1.3 Site Description

1.3.1 Conduct of Review 

This section of the SER contains the staff’s review of the site description provided by the 

applicant in the Shaw AREVA MOX Services LA (MOX, 2010a) and ISA Summary (MOX, 

2010b). This review (1) ensures that site conditions, including site geography, demographics, 

meteorology, hydrology, and geology, are accurately described to properly define potential 

accident conditions and (2) determines whether Items Relied Upon for Safety (IROFS) and their 

design bases, identified by the applicant, provide reasonable assurance of protection against 

natural phenomena and the consequences of potential accidents. The staff based its review of 

the site description on the natural phenomena accident sequences described in the ISA 

Summary. The staff’s review was performed in accordance with the review guidance in NUREG1718 (NRC, 2000.) 

The staff reviewed how the information in the LA addresses the following regulations: 

• 10 CFR 70.61(e). “Performance requirements,” which requires that each engineered or 

administrative control or control system that is needed to meet the performance 

requirements be designated as an IROFS. It also requires that the safety program will 

ensure that each IROFS will be available and reliable to perform its intended function 

when needed. 

• 10 CFR 70.64, “Requirements for new facilities or new processes at existing facilities,” 

which requires that baseline design criteria and defense-in-depth practices be 

incorporated into the design of new facilities. With respect to natural phenomena 

hazards, 10 CFR 70.64(a)(2) requires that the design of new facilities must adequately 

protect against such hazards, considering the most severe documented historical events 

for the site. 

Section 1.3 of the LA discusses the geographic location of the MFFF and its environment, 

including demographic, meteorological, hydrological, geological, seismological, and 

geotechnical characteristics of the site and the surrounding area. It describes population 

distribution near the site, land and water uses, transportation routes, and nearby industrial 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 10 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

facilities that potentially affect the site. It also describes and evaluates site characteristics that 

influence the magnitude of natural phenomena (e.g., rain, snow, wind, and earthquakes) that 

may affect the site. This section also evaluates site characteristics with respect to safety and 

identifies assumptions and input needed to evaluate safety and the design bases. 

The staff evaluated site characteristics and made findings of regulatory compliance by reviewing 

Section 1.3 of the LA, documents cited in the LA, and other relevant literature. 

1.3.1.1 Site Geography 

The application provided information on the site location, including State, county, municipality, 

and topographic information; public and SRS roads, railroads, and waterways; nearby bodies of 

water; and significant geographic features. 

The MFFF site is located in the F-Area of the SRS in southwestern South Carolina near Aiken. 

The site has restricted access. There are no unrestricted public roads near the F-Area. DOE 

operates a rail system at the SRS, which connects to commercial rail lines outside SRS 

boundaries. 

Nearby, the principal bodies of water are Thurmond Lake and the Savannah River. The 

Savannah River forms the SRS southwestern boundary. The only river navigation that takes 

place is infrequent construction-related barge traffic. The significant physiographic features at 

the SRS are the Pleistocene Coastal Terraces and the Aiken Plateau. 

Only two airports that provide scheduled air passenger services are within 97 kilometers (km) 

(60 miles (mi)) of the SRS. The applicant identified six general aviation airports. An Internet 

search confirmed that the list of airports identified in the LA is complete. Wackenhut Services, 

Inc., operates a heliport at the SRS in the B-Area, approximately 4.8 km (3 mi) from the MFFF. 

Section 1.1.3.2.3 of this SER discusses aircraft hazards. 

The geographic information provided in the application is current, accurate, and is consistent 

with information used in the LA to support the design bases of IROFS and meets the guidance 

in Section 1.3.3(A) of NUREG-1718 (NRC, 2000). 

1.3.1.2 Demographics and Land Use 

In the LA, the applicant provided information on demographics and land use. This information 

includes data for the area and for minority and low-income populations; a description, and 

distance and direction to, nearby population centers, public facilities, hospitals, and industrial 

facilities that could present potential hazards; residential, industrial, commercial, and agricultural 

land use data in the vicinity of the proposed site; and uses of nearby bodies of water. Data was 

derived by the applicant from a Westinghouse Savannah River Site document that was 

prepared in 2000. The applicant did not update its demographic data since the submittal of the 

Construction Authorization Request (CAR)(DCS, 2004). 

Based on the 1990 Census data, 621,527 people live within 80 km (50 mi) of the proposed 

facility site. The population is expected to grow to slightly more than 1 million in 2030. This 

population includes those living in the two metropolitan areas of Augusta, GA, and Aiken, SC. 

Because the site is on the SRS, there are no residents within 8 km (5 mi). Between 8 km (5 mi) 

and 16 km (10 mi) from the site, 6,528 people reside, the majority in the towns of New Ellenton 

and Jackson, SC. Note that the applicant stated that the population within 50 miles of the MFFF 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 11 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

increased by 16% based on the 2000 census, which is 2% greater than the project data from 

1990. However, the applicant stated that since the ISA Summary does not use any of this 

population data in any calculations of event consequences and the difference in population data 

from the 1990 census to the 2000 census is small, that population data did not need to be 

updated. 

Nearby industrial areas include the following: 

• other DOE SRS operations 

• several other Federal- and State-sponsored activities 

• Chem-Nuclear Systems, Inc., commercial low-level waste disposal and waste 

transportation activities in Barnwell County 

• Transnuclear, Inc., waste transportation activities in Aiken County 

• Carolina Metals, Inc., depleted uranium processing operations in Barnwell County 

• Vogtle Electric Generating Plant nuclear power generating operations across the 

Savannah River in Georgia 

• Urquhart Station fossil fuel-fired electric generating operations 32 km (20 mi) north of the 

SRS 

• Fort Gordon Army post operations southwest of Augusta, GA 

Within the SRS, land use is controlled for the purposes of DOE operations and timber 

management. The U.S. Forest Service manages forested areas within the SRS. 

The Savannah River water is classified as Class B, suitable for domestic supply after treatment, 

fish propagation, and commercial and agricultural uses. Domestic uses of water from the 

Savannah River occur approximately 161 km (100 mi) downstream at treatment plants near 

Hardeeville, SC, and Savannah, GA. Except for limited transportation of construction 

equipment, no commercial shipping occurs on the river. 

Ground water extracted near the SRS is used for domestic, industrial, and agricultural activities. 

Small communities, schools, and small commercial businesses also use local ground water. 

Nearly 133 million liters per day (35 million gallons per day) of ground water were pumped and 

used in 1985, by 56 communities and industries near the SRS. 

The demographic and land use information provided in the application is appropriately 

referenced, and is consistent with information used in the LA to support the design bases of 

IROFS and meets the guidance in Section 1.3.3 (B) of NUREG-1718 (NRC, 2000). This 

information was previously evaluated by the staff in NUREG-1821 (NRC, 2005) 

1.3.1.2 Meteorology

In the LA, the applicant provided meteorological information on temperatures; windspeeds and 

average and prevailing wind directions; amounts and forms of precipitation; design-basis values 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 12 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

for maximum snow and ice loads and probable maximum precipitation; and types, magnitudes, 

and frequency of severe weather events, such as tornadoes, hurricanes, and lightning. 

Temperature data for the SRS are presented in the LA based on 35 years of measurements at 

the site. The annual average temperature is 18.2 degrees Celsius (C) (64.7 degrees 

Fahrenheit (F)). Observed temperature extremes ranged from 41.7 to !19.4 degrees C (107 to 

!3 degrees F). Data in the LA for Augusta, Georgia, indicate that daytime high temperatures 

rarely fall below 0 degrees C (32 degrees F) during the winter. Temperatures are above 

32.2 degrees C (90 degrees F) on more than half the days in the summer months. 

Winds near the SRS are generally light to moderate, with the highest windspeeds occurring in 

the spring. The lightest winds occur in the summer and fall. The prevailing wind direction varies 

throughout the year, coming from the northwest in the winter, from the southeast in the late 

spring and early autumn, and from the southwest in the summer. The peak wind gust at Bush 

Field (airport) in Augusta, GA, was 96.5 kilometers per hour (km/h) (60 miles per hour (mph)) 

based on 10 years of data. 

The average annual precipitation for the SRS from 1967 to 1996 was 126 centimeters (cm) 

(49.6 inches (in.)). The most rainfall during a 24-hour period was 19 cm (7.5 in.) in 

October 1990. During summer thunderstorms, rainfall rates of up to 5.1 cm/h (2 in./h) can 

occur. An average of 54 thunderstorm days per year has been observed. Hail storms occur 

infrequently—an average of once every 2 years. 

Snowfalls of 2.5 cm (1 in.) or greater occur an average of once every 3 years. The greatest 

single snowfall recorded from 1951 to 1995 occurred in Augusta, GA, in 1973, when 35.6 cm 

(14.0 in.) of snow fell. The maximum ground snow load for a 100-year recurrence period is 

0.29 kilopascals (kPa) (6 pounds per square foot (psf)). Ice accumulates once every 2 years. 

The maximum accumulation for a 100-year recurrence period is 1.7 cm (0.67 in.) or an ice load 

of 0.14 kPa (3 psf). 

During a 30-year period (1967–1997), 165 tornadoes occurred near the SRS. Five 

Fujita scale 2 and four Fujita scale 1 tornadoes have occurred on site or nearby since site 

operations began. Damage was primarily to trees. One of these tornadoes produced 

windspeeds up to 241 km/h (150 mph). Design-basis windspeeds for the DOE 

moderate-hazard performance category (PC-3) facilities and high-hazard performance category 

(PC-4) facilities are 290 km/h (180 mph) and 386 km/h (240 mph), respectively. The “IROFS 

safety” structures are evaluated for a tornado recurrence interval of 2×10!6

 per year and a 

design-basis tornado with a 3-second tornado speed of 386 km/h (240 mph). 

For other extreme winds from hurricanes, tropical weather systems, thunderstorms, and winter 

storms, IROFS structures are evaluated based on a recurrence period of 1×10!4

 per year for a 

3-second windspeed of 209 km/h (130 mph). These extreme windspeeds are based on SRS 

meteorological data and data from National Weather Service stations in Columbia, SC, and 

Augusta, Macon, and Athens, GA. 

During the period 1700–1992, 36 hurricanes caused damage in South Carolina. However, no 

hurricane-force winds of greater than 120 km/h (75 mph) have been measured at the SRS. 

Extreme rainfalls generally occur during spring and summer thunderstorms and tropical storms. 

The IROFS structures are evaluated for a design-basis rainfall representing a recurrence 

interval of 1×10!5

 for various rainfall durations (e.g., 9.9 cm (3.9 in.) for a 15-minute rainfall and 

58 cm (22.7 in.) for a 24-hour rainfall). 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 13 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

The number of lightning strikes is estimated at 10 strikes/km2

/year (yr) (26 strikes/mi2/yr). From 

1989 to 1993, SRS data show an average of 4 strikes/km2

/yr (10.4 strikes/km2/yr). 

The applicant used meteorological data in support of the natural phenomena (NPH) design 

bases. The NPH design bases was established in the CAR and reviewed by the staff (as 

documented in NUREG-1821) and is consistent with the safety assessment of the design bases 

presented in the CAR and the ISAS. The information reflects observations of meteorology over 

a period of years and was sufficient to establish the design basis. Additionally, dispersion 

factors which were used to calculate offsite dosed were bases on SRS data conservatively 

calculated based on the 95% meteorological conditions. This dispersion data was used by the 

applicant to demonstrate compliance with 10 CFR Part 70.61 for normal and accident conditions 

(MOX, 2010c). 

Meteorological information provided in the application is appropriately referenced, and is 

consistent with information used in the LA to support the design bases of IROFS and meets the 

guidance in Section 1.3.3 (C) of NUREG-1718 (NRC, 2000). 

1.3.1.3 Hydrology

In the LA, the applicant provided information on surface hydrology, including descriptions of 

nearby rivers, streams, and other water bodies; subsurface water hydrology, including water 

table depths, flow characteristics, potentiometric surfaces, and aquifer characteristics; and 

design-basis floods. 

The Savannah River forms the southwestern boundary of the SRS and is the dominant body of 

surface water in the nearby area. The Savannah River Basin drains an area of 27,394 km2

(10,577 mi2

) and extends 465 km (289 mi) from the Atlantic Ocean to the Blue Ridge Mountains. 

The principal streams that enter the Savannah River from the SRS are Upper Three Runs, 

Fourmile Branch, Pen Branch (PB), Steel Creek, and Lower Three Runs. These streams 

discharge water from rainfall, subsurface waters, and various effluent streams from SRS 

operations. Surface water bodies include Par Pond and L Lake, which were created as cooling 

water reservoirs for production reactors, marshes, and natural basins, including Carolina bays. 

The record historical Savannah River flood at Augusta, GA, in 1796 had a discharge of 

10,000 cubic meters per second (m3

/s) (360,000 cubic feet per second (ft3/s)). The peak 

Savannah River flow recorded by the U.S. Geological Survey was 9,900 m3

/s (350,000 ft3/s) in 

1929. No major floods have occurred in the Augusta area since dams were constructed 

upstream of Augusta beginning in the 1950s. The estimated 50-year maximum flow is 

2,100 m3

/s (74,600 ft3/s). The probable maximum flood at the SRS is a water level of 

68.4 meters (m) (224.5 feet (ft)) above mean sea level. The normal Savannah River flow 

elevation at the SRS boat dock is 25.9 m (85 ft). The design-basis flood for the MFFF is 63.4 m 

(207.9 ft) above mean sea level with an annual recurrence interval of 1×10!5

. Because the 

facility is located at an elevation of 83 m (272 ft), the probabilities of flooding the site are 

calculated to be less than 1×10!5

 per year. A cascading failure of the Savannah River dams 

upstream of Augusta, GA, was estimated to produce a peak flow in the Savannah River of 

27,751 m3

/s (980,000 ft3/s) and a flood elevation of 43 m (141 ft) at the Vogtle station, which is 

directly across from the SRS on the Georgia side. Because the MFFF is at an elevation of 83 m 

(272 ft), this cascading failure and other events, such as ice flooding, wave surges, and seiches, 

will not affect the facility based on review of the information in the LA. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 14 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

Three aquifer systems that overlie the bedrock formations of the Southeastern Coastal Plain 

characterize the ground water setting at the SRS. The Southeastern Coastal Plain consists of 

sediments deposited from erosional processes of the Appalachian Mountains that lie to the west 

of the SRS. These sediments consist of water-bearing sandy materials and limestone and 

clayey confining units. In the F-Area, the confining units of the three aquifer systems become 

disjointed and have poor separation that allows flow between aquifer systems. In the 

uppermost Floridan Aquifer System (FAS), the Three Runs Aquifer overlies the deeper Gordon 

Aquifer. These aquifers are separated by a Gordon confining unit. Recharge of these aquifers 

is primarily through local precipitation, and discharge is primarily through local streams. 

Because Upper Three Runs Creek and the Savannah River incise the FAS, there is a head 

reversal between the Floridan Aquifer and the Crouch Branch Aquifer in the Dublin Aquifer 

System, which lies just below the FAS. This means that ground water from the lower system is 

under a greater head and flows up into the Floridan. This phenomenon tends to limit migration 

of contamination into the lower aquifer systems. The Midville Aquifer System is the deepest 

system and lies just above the bedrock formations. 

At the MFFF site, the ground water table is nearly 15 m (50 ft) below the existing ground level. 

Potentiometric surface maps show that ground water in the uppermost Upper Three Runs 

Aquifer flows principally toward Upper Three Runs Creek and toward the unnamed creek 

located northeast of the proposed site. The underlying Gordon Aquifer flows horizontally toward 

the Savannah River. The deeper Dublin and Midville Aquifer Systems flow to the southeast 

toward the Savannah River and the coast. The hydraulic conductivity of the Upper Three Runs 

Aquifer varies from less than 0.3 meters per day (m/d) (1.0 foot per day (ft/d)) to almost 10 m/d 

(33 ft/d), with an average of nearly 3 m/d (10 ft/d). At the MFFF site, ground water is abundant, 

usually soft, slightly acidic, and low in dissolved solids. Ground water used in site operations 

from the F-Area is treated to raise the pH and remove iron. 

The F-Area seepage basin, located west of the MFFF site, was remediated in 2000 according to 

a hazardous waste Part B postclosure permit issued by the State of South Carolina. After 

remediating the site, boundary wells hydrologically downstream of the seepage basin were 

installed and samples were analyzed. The first set of analyses indicated that a contamination 

plume, exceeding the U.S. Environmental Protection Agency drinking water standards, exists. 

This contaminant plume extends beneath the MFFF site and is most pronounced under the 

western edge of the site. 

The applicant indicated that there is radioactive contamination in the Upper Three Runs aquifer 

from upgradient contamination sources in the F-Area, as well as the F-Area seepage basin. 

This ground water contamination consists of concentrations of gross alpha and beta activity, 

uranium, tritium, and trichloroethylene exceeding the maximum contamination limits for drinking 

water. The applicant also indicated that ground water contamination occurs at least 9.1 m 

(30 ft) below the deepest level of expected construction. 

During site characterization activities, the applicant measured radioactivity levels of soils using 

Geiger-Mueller detector scans and gross alpha and beta measurements of soil samples. The 

applicant indicated that the sensitivity of the gross alpha and beta measurements was 

7,407,407 becquerels per kilogram (Bq/kg) (200,000,000 picocuries per kilogram (pCi/kg)) and 

3,704 Bq/kg (100,000 pCi/kg), respectively. In responses (Hastings, 2003), the applicant stated 

that the sensitivity of soil radioactivity measurement in the preconstruction environmental 

monitoring report (Fledderman, 2002) was much better than that described in the calendar year 

2000 geotechnical investigations. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 15 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

The 2002 preconstruction environmental monitoring report measured actinide concentrations in 

soil and reported a mean value of 0.46 Bq/kg (12.5 pCi/kg) 239Pu and a maximum of 162 Bq/kg 

(4,380 pCi/kg) 239Pu, for example. The SRS radiological soil guideline for SRS worker 

protection is 9,185 Bq/kg (248,000 pCi/kg) (Jannik, 1995). Across the depth profile, the values 

for 239Pu follow in Table 1.3-1. 

Table 1.3-1 239PU Content at Various Depths 

Depth, cm (in.) Mean, Bq/kg (pCi/kg) Maximum, Bq/kg (pCi/kg) 

0–7.6 (0–3) 5.0 (137.0) 25.6 (690) 

7.6–15.2 (3–6) 3.2 (87.1) 58.9 (1,590) 

15.2–22.9 (6–9) 5.70 (154.0) 162.2 (4,380) 

22.9–30.1 (9–12) 4.5 (121.0) 158.5 (4,280) 

These values correspond to a calculated potential maximum dose of 0.003 millisieverts (mSv) 

(0.3 millirem (mrem)) to an exposed worker using the mean values, and a maximum exposure 

of 0.033 mSv (3.3 mrem) using the maximum values (Fledderman, 2002). The 0.033-mSv 

(3.3-mrem) annual projected dose is acceptable because the NRC’s annual limit for members of 

the public, including construction workers in the controlled area, is 1 mSv (100 mrem). 

The hydrologic information provided in the application is appropriately referenced, and is 

consistent with information used in the LA to support the design bases of IROFS and meets the 

guidance in Section 1.3.3 (D) of NUREG-1718 (NRC, 2000). 

Construction of the facility will not penetrate into the upper ground water table that exists 15 m 

(50 ft) below grade level. Therefore, the ground water contamination in the Upper Three Runs 

Aquifer is not expected to result in hazardous conditions that could affect the facility. 

1.3.1.5 Seismic Hazards 

To assess the potential seismic hazard at the site, the applicant established two sets of ground 

motion spectra in the LA: one for the design of the surface facilities and one for soil stability 

analyses (liquefaction and dynamic settlements). Although the details of these spectra differ, 

analyses presented in the LA show that they are comparable. The design spectra (both vertical 

and horizontal) for the facility use a spectrum included in Regulatory Guide (RG) 1.60, “Design 

Response Spectra for Seismic Design of Nuclear Power Plants” (NRC, 1973), anchored at 

0.20g peak ground acceleration (PGA). The spectra are also used for the design of the nearby 

Vogtle Nuclear Power Plant (licensed under 10 CFR Part 50, “Domestic Licensing of Production 

and Utilization Facilities”). For soil stability, a spectrum was developed based on the existing 

DOE uniform hazard spectra developed for the SRS. Because the seismic design and analyses 

rely on these established spectra, much of the site-specific seismic hazard information 

presented in the LA was developed to establish that these two proposed design and soil stability 

analysis spectra are adequate to meet the regulatory requirements of 10 CFR Part 70 and the 

performance guidelines in NUREG-1718 (NRC, 2000). 

The following areas concerning the seismic hazards applicable to the safety analysis and design 

of the proposed facility were reviewed: 

• seismic source characterization 

• ground motion attenuation 

• seismic hazard calculations 

• SRS-wide rock and surface response spectra 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 16 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

• site response and design ground motion 

• surface faulting 

1.3.1.5.1 Seismic Source Characterization 

1.3.1.5.1.1 Geological and Tectonic Setting

The LA details the local and regional geologic and tectonic characteristics. The LA notes that 

the SRS is located on sediments of the Upper Atlantic Coastal Plain in South Carolina. These 

sediments consist of stratified, but generally unconsolidated, sands, silts, clays, and 

carbonaceous muds deposited in fluvial, deltaic, near-shore, and marine shelf environments. 

They range in age between Late Cretaceous (about 100 million years) and the present and 

reach a maximum thickness of approximately 1,200 m (4,000 ft). Similar to Coastal Plain 

sedimentary sequences along the entire Atlantic seaboard, the South Carolina Coast sediments 

rest without conformity on Precambrian to Paleozoic (about 1,100–245 million years) 

metamorphic, metasedimentary, and igneous rocks of the Appalachian Orogen and on Triassic 

to Early Jurassic (about 245–180 million years) siliciclastic rocks associated with early rifting 

along the North American continental margin. Age and distribution of the rocks and strata 

provide an adequate geologic record to assess faulting and earthquake hazards. 

Earthquakes that could affect safe operation of the proposed facility are associated with two 

seismic sources: repeat of the Charleston 1886 earthquake within the Middle 

Place-Summerville Seismic Zone and small shallow earthquakes of the South Carolina 

Piedmont. Earthquake source characteristics associated with these seismic zones are 

consistent with information used in two seismic hazard studies for the eastern United States: 

the Electric Power Research Institute report “Probabilistic Seismic Hazard Evaluations at 

Nuclear Power Plants in the Central and Eastern United States: Resolution of the Charleston 

Earthquake Issue” (EPRI, 1989) and NUREG-1488, “Revised Livermore Seismic Hazard 

Estimates for Sixty-Nine Nuclear Power Plant Sites East of the Rocky Mountains” (NRC, 1994). 

As discussed in Section 1.3.1.5.2 of this report, the bedrock uniform hazard spectra for both of 

these sources form the basis for the sitewide DOE PC-3 and PC-4 hazard spectra 

(Westinghouse Savannah River Company (SRC), 1997). 

1.3.1.5.1.2 Historical Seismicity

The LA includes a summary of the records of historical seismicity, including those from the 

cultural historical record (historical accounts date back to about 1698), as well as more recent 

instrumented earthquake records (the South Carolina seismic network and the SRS network, 

both in operation since the mid-1970s). As noted in the LA, the most significant earthquake 

source would be s a repeat of the 1886 Charleston, estimated to have a modified Mercalli 

intensity (MMI) at the SRS of VI–VII. The magnitude estimate of the 1886 Charleston 

earthquake is M 7.3 ± 0.3 (Johnston, 1996; Ambraseys, 1988). Other significant historical 

earthquakes felt at the SRS include the 1913 Union County earthquake (an MMI of VII at the 

epicenter and an MMI of II–III at Aiken, SC); the 1811–12 New Madrid earthquakes (M greater 

than 8.0 at New Madrid, MO); and the 1897, Giles County, VA, earthquake (MMI of VII, M 5.6 at 

Pearisburg, VA). 

Paleoliquefaction features indicate that the Charleston-type earthquake has recurred at least 

seven times in the last 6,000 years (Talwani and Schaeffer, 2001). These prehistoric 

earthquakes appear to be restricted to the Carolina Coastal Plain (Talwani and Schaeffer, 

2001). Two scenarios have been proposed to explain the distribution of the paleoliquefaction 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 17 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

features. In the first scenario, the earthquakes occurred at Charleston, Georgetown, and 

Bluffton, SC. In the second scenario, all the prehistoric earthquakes occurred at Charleston. 

Hu, et al. (2002) concluded that the paleoliquefaction features were produced by earthquakes 

with magnitudes between 5.3 and 7.8. 

No definitive geologic evidence has yet been discovered to tie the 1886 Charleston earthquake 

to a causative seismogenic fault. Tarr, et al. (1981) defined the Middleton Place—Summerville 

Seismic Zone to include the known distribution of seismicity and paleoseismicity associated with 

the Charleston-type earthquake. The Middleton Place—Summerville Seismic Zone is located 

20 km (12 mi) northwest of Charleston, SC. Based on geological and geophysical data, Marple 

(1994), Madabhushi and Talwani (1993), and Marple and Talwani (2000) all inferred that 

complex and interactive strike slip and reverse faulting associated with the northwest trending 

Ashley River fault and the north-northeast trending Woodstock fault were the most likely causes 

of the Charleston earthquake. Recently, Weems and Lewis (2002) concluded that the region 

around Charleston, SC, is an active tectonic zone that accommodates differential movement 

between the Cape Fear arch and the Southeast Georgia embayment. All these models are 

consistent with the source characterization of the Charleston-type earthquake presented in the 

EPRI (1989) and Lawrence Livermore National Laboratory (LLNL) (NRC, 1994) probabilistic 

seismic hazard assessment (PSHA) studies. 

Near the SRS, instrumented historical seismic records indicate that seismicity associated with 

the SRS and surrounding region is closely related to the earthquake activity within the South 

Carolina Piedmont (Bollinger, 1992). This activity is characterized by shallow, small-magnitude, 

and infrequent earthquakes. A search of the National Earthquake Information Center and 

Council of the National Seismic System showed that the vast majority of these earthquakes are 

M 3 or less. The largest magnitude earthquakes in the record are the 1974 M 4.9 and M 4.7 

events. All instrumented earthquakes on the SRS itself were M 2.7 or less. 

1.3.1.5.1.3 Earthquake Recurrence

The long repeat times (more than 500 years) and relatively brief historical record (less than 

350 years), coupled with the absence of active surficial deformation, limit estimates of 

earthquake recurrence for a Charleston-type earthquake. The most complete record of the 

temporal and spatial distribution of large prehistoric earthquakes comes from identification of 

earthquake-induced liquefaction features called sand blows. Numerous sand blows have been 

identified throughout the South Carolina coastal area, but few if any outside this region 

(Westinghouse SRC, 2000a). Recent reanalysis of the paleoliquefaction investigations in South 

Carolina and the recalibrated ages using the radiometric 14C dating technique suggest that as 

many as seven large-magnitude earthquakes occurred in the Charleston region within the last 

6,000 years (Talwani and Schaeffer, 2001). These results translate to a recurrence interval for 

the Charleston-type earthquake of 500 to 600 years. This estimated recurrence interval is 

conservative because it assumes the maximum number of possible paleoearthquakes using the 

age constraints derived from the 14C age data. Talwani and Schaeffer (2001) used 1σ error 

ranges to develop their list of age-distinct paleoearthquakes. Overlap of the 14C ages using 

2σ error ranges, as advised by Tuttle (2001), would result in a smaller number of age-distinct 

paleoearthquakes during this same 6,000-year interval and thereby increase the recurrence 

interval. Nevertheless, the recurrence interval of 500 to 600 years for the Charleston-type 

earthquake is consistent with the LLNL and EPRI PSHA studies. 

Staff Review of Seismic Source Characterization
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 18 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

The staff reviewed the seismic source information presented in the LA and finds it sufficient 

because the applicant identified and assessed all of the potentially significant seismic sources 

related to the SRS (including, but not limited to, the Charleston seismic zone). The 

characterization of the tectonic setting and identification of capable seismic sources are based 

on extensive review of the published geological literature, regional and site geological and 

geophysical data, historical and instrumental seismicity data, regional stress field analysis, and 

geological investigations of prehistoric earthquakes. The information follows guidelines 

presented in RG 1.165, “Identification and Characterization of Seismic Sources and 

Determination of Safe Shutdown Earthquake Ground Motion” (NRC, 1997) and NUREG-0800, 

“Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: 

LWR Edition,” Section 2.5.2.2 (NRC, 1987). Criteria used to assess capable fault and areal 

source zones include those outlined in Appendix A, “Seismic and Geologic Siting Criteria for 

Nuclear Power Plants,” to 10 CFR Part 100, “Reactor Site Criteria,” as well as those in “Natural 

Phenomena Hazards Characterization Criteria” (DOE, 1994). 

Information provided by the applicant to determine the tectonic setting of the facility is presented 

in a coherent, well-documented discussion that provides an adequate technical basis to 

evaluate the seismic potential of the site. Specifically, documentation in the LA is sufficient to 

determine the earthquake potential of geological structures and potential tectonic zones (i.e., 

regions of uniform earthquake potential). The information provided in the LA is also sufficient to 

evaluate uncertainties associated with seismic source geometry (e.g., fault dip, width, 

segmentation, and depth of seismogenic crust) and recurrence models. Thus, the staff 

reviewed the information in the LA and finds it acceptable because the basic geologic and 

seismic characteristics of the site and vicinity are adequately detailed to allow investigation of 

seismic characteristics at the facility. 

1.3.1.5.2 Ground Motion Attenuation 

Seismic hazards used to define bedrock uniform hazard spectra at the SRS are based on the 

LLNL and EPRI PSHAs. The LLNL and EPRI bedrock uniform hazard spectra were averaged 

and then broadened using the site-specific spectral shapes to develop bedrock response 

spectra. 

Ground motion attenuation models contained in the LLNL and EPRI hazard studies incorporated 

several models developed for the southeastern United States. These models represent 

state-of-the-art studies of ground motion attenuation characteristics in the region and have 

captured the diverse opinions in the scientific community. 

The ground motion attenuation model used to develop site-specific spectral shapes was the 

band limited white noise/random vibration theory ground motion model (Hanks and McGuire, 

1981; Boore, 1983). In applying this stochastic approach, the applicant used the layered crustal 

velocity model developed by Herrmann (1986), with some modifications; the EPRI median site 

attenuation model (Q-model); and the range of the EPRI site-dependent parameter kappa 

values (EPRI, 1989). 

Staff Review of Ground Motion Attenuation

Ground motion attenuation models used in the LLNL and EPRI studies represent the current 

scientific understanding of ground motion attenuation in the southeastern United States. These 

attenuation models adequately capture uncertainty in ground motion estimates, including the 

potential for Moho bounce effects. For example, a recent ground motion attenuation model for 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 19 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

the eastern United States (Campbell, 2003), which accounts for Moho bounce effects, yields 

ground motion estimates consistent with those derived using the LLNL and EPRI studies. 

Application of the LLNL and EPRI models to the SRS and, consequently, to the facility is 

considered acceptable. The NRC staff has previously accepted the LLNL and EPRI ground 

motion modeling for sites in the central and eastern United States (NRC, 1997). 

The use of the stochastic model or numerically simulated ground motions in the central and 

eastern United States, instead of recorded ground motions, is consistent with common practice 

and the state of knowledge because sufficient strong motion data are lacking in this tectonic 

regime as a result of low seismicity rates. The staff accepted the approach in its review of the 

PSHA for the Paducah Gaseous Diffusion Plant (Center for Nuclear Waste Regulatory 

Analyses, 1999). In addition, the random vibration theory model has been shown to yield 

conservative results for crustal conditions in the eastern United States (Silva, 1989). Thus, the 

staff has determined that the applicant’s ground motion attenuation modeling provides 

reasonable assurance of the accuracy of ground motion attenuation modeling. 

1.3.1.5.3 Seismic Hazard Calculations 

The applicant used the seismic hazard results from the LLNL and EPRI PSHAs to define 

bedrock uniform hazard spectra at the SRS. No other probabilistic seismic hazard calculations 

were conducted specifically for the SRS or the facility. The LLNL and EPRI hazard studies 

include site-specific hazard calculations for the SRS. 

Staff Review of Seismic Hazard Calculations

The LLNL and EPRI studies represent the state-of-the-art probabilistic hazard studies in the 

southeastern United States. Application of these results to the SRS and, consequently, to the 

facility is acceptable. The NRC staff previously accepted the LLNL and EPRI data, seismic 

sources, seismic hazard methods, and results for sites in the central and eastern United States 

(NRC, 1997). Thus, the staff finds that the use of LLNL and EPRI hazard results is technically 

sound. 

1.3.1.5.4 Savannah River Sitewide Rock and Surface Response Spectra 

Westinghouse SRC developed the SRS-wide rock response spectra for the entire site 

(Westinghouse SRC, 1997). These are site-specific uniform hazard spectra for bedrock from 

the LLNL and EPRI seismic probabilistic hazard studies, broadened by using site-specific 

spectral shapes. The rock response spectra were used as the bases for developing bedrock 

time histories as input into site response analyses for the facility and the SRS-wide surface 

response spectra. 

The SRS-wide surface response spectra are not directly used in the design of structures or in 

soil stability analyses for the facility. However, the applicant used them to justify the sufficiency 

of the selected design spectra for the facility. 

The SRS-specific rock uniform hazard spectra for bedrock were developed following the 

guidance and methodologies outlined in “Natural Phenomena Hazards Assessment Criteria,” 

Change Notice No. 1 (DOE, 1995). Probabilistic hazards were developed according to DOE 

PC-3 and PC-4 spectra. The DOE PC-3 and PC-4 spectra were developed following seismic 

design and evaluation criteria in “Natural Phenomena Hazards Design and Evaluation Criteria 

for DOE Facilities” (DOE, 1996) and Change Order No. 1 to that document (DOE, 2002). In 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 20 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

DOE’s 1996 report, PC-3 and PC-4 categories have mean annual probabilities of exceedance 

for design ground motions at 5×10!4

 and 1×10!4, respectively. In terms of the annual return 

period ground motions, mean annual probabilities of exceedance of 5×10!4

 and 1×10!4 

correspond to mean 2,000-year and 10,000-year return period ground motions, respectively. 

The development of the rock response spectra included the following procedures: 

• The mean bedrock uniform hazard spectra were computed for two mean annual 

probabilities of exceedance, 5×10!4

 and 1×10!4 (corresponding to performance 

categories of PC-3 and PC-4, respectively), by averaging the LLNL and EPRI mean 

uniform hazard spectra for the SRS. 

• Site-specific spectral shapes were generated using EPRI mean magnitude and mean 

distance values based on the magnitude and distance deaggregation results at each 

probability of exceedance. 

• The spectral shapes were then scaled to the corresponding mean bedrock uniform 

hazard spectrum at frequencies of 1 to 2.5 and 5 to 10 hertz (Hz). 

• The resulting three spectra (the averaged LLNL and EPRI uniform hazard spectrum and 

the 1 to 2.5-Hz and the 5 to 10-Hz-scaled site-specific spectra) were then enveloped and 

smoothed to obtain the broadened bedrock response spectra for the PC-3 and PC-4 

hazards. 

Sitewide Surface Response Spectra

Sitewide surface response spectra were obtained by multiplying the broadened bedrock uniform 

hazard spectra by frequency-dependent site amplification factors to account for soil effects. In 

deriving site amplification factors, hypothetical bedrock spectra were vertically propagated 

through soil columns representative of the site soil conditions using the one-dimensional 

equivalent linear analysis procedure developed by Silva (1989). The procedure was considered 

equivalent to SHAKE analyses summarized in Idriss and Sun (1992). 

The hypothetical bedrock spectra were power spectral density functions and spectral 

accelerations for a suite of PGAs at the soil/bedrock interface (bedrock motions described 

previously) and were developed using the random vibration theory model (Boore, 1983). Three 

magnitude- and distance-dependent spectra were developed for each control motion 

acceleration representing the 5th, 50th, and 95th percentile contributions to the probability of 

exceedance. Again, the magnitude and distance pairs were obtained from the EPRI 

deaggregated hazard results. 

The calculation of the site amplification factors considered SRS-wide variability in velocity 

profile, soil column thickness, bedrock velocity, and dynamic properties (Westinghouse SRC, 

1997). Soil conditions characterized in the most recent study of the site’s geotechnical 

properties (Duke Cogema Stone & Webster (DCS), 2003) are consistent with subsurface 

conditions reported in the previous geotechnical reports for the site. The sitewide, uniformhazard-based response spectrum was taken as the envelope of all soil response spectra 

obtained by multiplying the broadened mean bedrock uniform hazard spectra by the site 

amplification factors for different soil/bedrock categories, scaling frequencies, and magnitude 

levels. As with the design ground motions, the site-specific soil spectra were shown to envelop 

the Charleston earthquake spectra. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 21 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

Staff Review of Savannah River Site Rock and Surface Response Spectra

The LLNL and EPRI studies represent the state-of-the-art probabilistic hazard studies for the 

southeastern United States. Applying these probabilistic hazard results to the SRS and, 

consequently, to the facility is acceptable. The NRC staff previously accepted the LLNL and 

EPRI ground motion modeling for sites in the central and eastern United States (NRC, 1997). In 

addition, broadening the LLNL and EPRI bedrock uniform hazard spectral shapes and the 

development of surface response spectra is consistent with the methodologies of DOE (1995). 

These methodologies and procedures are well established within the ongoing seismic program 

at the SRS. Westinghouse SRC and DOE have extensively reviewed these site-specific 

adjustments. Thus, the staff has determined that SRS-wide rock and surface response spectra 

provides reasonable assurance that potential seismic hazards are sufficiently estimated. 

1.3.1.5.5 Design Spectra and Site Response Analyses 

1.3.1.5.5.1 Design Spectra

The design-basis ground motions proposed by the applicant for the surface facilities are an 

RG 1.60 spectra (NRC, 1973) anchored at 0.20g PGA, which is the same spectra used for the 

design of the nearby Vogtle Nuclear Power Plant (licensed under 10 CFR Part 50). More 

recently, regulations at 10 CFR 100.23, “Geologic and Seismic Siting Criteria,” for nuclear 

power plants have been updated to include the application of probabilistic methods to the 

assessment of seismic hazards. RG 1.60 provides general guidance for determining the 

safe-shutdown earthquake for new nuclear reactors based on a PSHA, consistent with the 

regulatory requirements of 10 CFR 100.23. RG 1.60 recommends a reference median annual 

probability of exceedance of 1×10!5

. As shown by a similar DOE analysis (DOE, 2002, 

Appendix C), a median annual probability of exceedance of 1×10!5

 corresponds approximately 

to a mean annual probability of exceedance of 1×10!4

. 

The applicant performed evaluations in the safety analysis report that show that the 0.20g 

RG 1.60 spectra have mean annual exceedance probabilities that range between 1.6×10!4 and 

4.5×10!5

 (or equivalent return periods that range between 6,300 and 22,000 years (see DCS, 

2001b, Enclosure B, Table 1). For frequencies between 2 and 10 Hz, the mean annual 

probabilities of exceedance are equal to or less than 1×10!4

 (or equivalent return periods 

greater than 10,000 years). For higher frequencies up to the PGAs, the mean annual 

probabilities of exceedance are equal to or slightly greater than 1×10!4

. These mean annual 

exceedance probabilities are based on ground motions from the averaged EPRI (EPRI, 1989) 

and LLNL (NRC, 1994) seismic hazard results for the eastern United States. 

The applicant selected RG 1.60 spectra (NRC, 1973) anchored at 0.20g because these were 

deemed to be conservative with respect to currently available site-specific information. The 

applicant has shown that this seismic design spectrum lies between the SRS-wide DOE PC-3 

and PC-4 spectra. The current PC-3 and PC-4 sitewide spectra are based on ground motion 

spectra developed by Westinghouse SRC (1997) for the entire SRS. The PC-3 and PC-4 

spectra were developed following seismic design and evaluation criteria in DOE (1996) and 

DOE (2002), as discussed in more detail in Section 1.3.1.5.4 of this SER. 

To ensure safe operation of the structures, systems, and components (SSCs) beyond the 

design ground motions, DOE (1996) and DOE (2002) developed performance goals associated 

with each performance category. The performance goals are defined in terms of the ability of 

the SSCs to perform essential safety functions during and after the natural hazard phenomena 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 22 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

(in this case, an earthquake). The acceptable behavior limit for normal-use SSCs, such as 

buildings, is major damage, but the damage is limited in extent such that the occupants can 

safely exit the building. For more critical SSCs, such as nuclear containment structures, 

damage at the performance goal should be limited such that the containment is not 

compromised. In DOE (1996) and DOE (2002), the seismic ground motion performance goals 

for PC-3 and PC-4 SSCs were established with a mean annual probability of exceedance of 

1×10!4

 and 1×10!5, respectively. 

In DCS (2001a), the applicant indicated that the desired performance goal probability is based 

on the approach recommended in DOE (1996) and DOE (2002). That assertion is supported by 

performance calculations (DCS, 2002, Enclosure B) showing that many of the SSCs performed 

their safety functions to ground motion levels with a mean annual probability of exceedance of 

1×10!5

 or less. These calculations support the conclusion that the design criteria—RG 1.60 

(NRC, 1973) spectra anchored to the 0.20g PGA, which is significantly greater than the 

site-wide PC-3 spectra—are adequate to ensure the safe design of the facility. 

The applicant also showed that the design spectra envelop the deterministic spectra for a repeat 

of the Charleston-type earthquake. This deterministic check analysis follows the requirements 

of DOE (1995) using the largest historic earthquakes within 121 km (75 mi) having a moment 

magnitude greater than 6. In this analysis, the deterministic median bedrock and soil spectra 

were generated for the 1886 Charleston earthquake using median source parameters, a 

source-to-site distance of 200 km (124 mi), and other parameters used in generating response 

spectra based on uniform hazards. The applicant evaluated the vertical-to-horizontal seismic 

spectral ratios for the facility (MOX, 2006a). The results show that the vertical-to-horizontal 

spectral ratios could exceed the standard generally used at the SRS (normally the vertical is 

assumed to be two-thirds of the horizontal), particularly for frequencies greater than 

approximately 3 Hz. Thus, the applicant has agreed to use both the horizontal and vertical 

spectra in RG-1.60 anchored at 0.20g PGA. 

1.3.1.5.5.2 Site Response Analyses

The applicant indicated that the sitewide response spectra are intended for simple response 

analysis and are not appropriate for soil-structure interaction and soil stability analyses. It 

further indicated that the sitewide response spectra represent a surface response—not an 

embedded response. For soil stability and soil-structure interaction analyses, the applicant 

established a one-dimensional, free-field site response analysis procedure (DCS, 2001a). The 

control ground motions for site response analyses include the modified PC-3 motion and the 

1886 Charleston motion. The modified PC-3 motion is the SRS-wide PC-3 rock response 

spectrum increased by a factor of 1.25 (PC-3+ rock spectrum) to yield a bedrock PGA of 0.14g. 

This modified motion would result in a design surface PGA of 0.20g at the facility through site 

response analyses. The 1886 Charleston motion is the 50th percentile attenuated rock motion 

at the actinide packaging and storage facility site. The applicant used it to evaluate the 

liquefaction potential associated with large, distant earthquakes. Westinghouse SRC developed 

the spectrum-compatible acceleration time histories for both of these design motions. 

Site response analyses were conducted using PROSHAKE, a Windows version of SHAKE91 

(Idriss and Sun, 1992). The design motion time histories were applied at the base of the soil 

column. Properties for the soil column were developed from geotechnical studies specific to the 

facility (Westinghouse SRC, 2000b; DCS, 2003 and 2001b). Soil conditions characterized in the 

most recent study of the site geotechnical properties (DCS, 2003) are consistent with 

subsurface conditions reported in the previous geotechnical reports of the site. The cyclic 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 23 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

stress ratios computed from the site-response analyses were input into the dynamic 

soil-structure interaction analyses of the critical structures and into the liquefaction analyses. 

Results from site response analyses show that the PC-3+ bedrock time history produces a 

surface PGA of 0.20g and a surface spectrum that correlates well with the RG 1.60 (NRC, 1973) 

surface spectrum anchored at 0.20g PGA. Thus, the applicant concluded that the PC-3+ 

bedrock spectrum satisfies the requirement for a bedrock time history that can be used for 

dynamic analysis at the facility. 

Staff Review of Site Response and Design Ground Motion

The staff finds it acceptable to use the RG 1.60 spectrum (NRC, 1973) anchored at 0.20g PGA. 

The applicant analyzed several SSCs using the RG 1.60 design spectrum to demonstrate that 

the performance objectives necessary for highly unlikely events with potentially high 

consequences set forth in NUREG-1718 (NRC, 2000) are met. Similarly, the staff finds the 

analysis procedures, input bedrock time histories, and soil column properties for soil stability 

analyses and soil-structure interaction analyses acceptable. The resulting surface response 

spectrum exceeds the DOE PC-3 spectrum and is comparable to the design spectrum. The 

applicant further verified that the SRS-wide PC-3 spectrum is applicable to the design of the 

MFFF through examinations of the soil stratigraphy, soil column thickness, bedrock type, 

velocity profile, and geologic formations at the MFFF site. Use of response spectra that envelop 

the SRS-wide PC-3 spectrum to analyze soil and subsurface stability of the MFFF site is 

therefore conservative. 

1.3.1.5.6 Surface Faulting Hazard 

The LA summarizes the tectonic structures of interest in the SRS and surrounding region, 

including faults, folds, arches, basins, and paleoliquefaction features that resulted from past 

earthquakes. Many of these features are vestiges of the contractional tectonism that 

characterized the Appalachian Orogen from the Late Precambrian through the Late Paleozoic 

(about 1,100 to 245 million years) and rifting and extensional tectonism that characterized the 

break up of Pangea and the opening of the Atlantic Ocean in the Triassic and Early Jurassic 

periods (about 245 to 180 million years). Although reactivation of some of these features has 

been proposed to explain the origin of the Charleston-type earthquake, none of these features 

has an impact on direct-faulting hazards at the SRS. 

Faulting of the Atlantic Coastal Plain sediments is evident from geologic and geophysical data 

(e.g., Prowell and Obermeier, 1991). Most of the faults are moderately to steeply dipping 

reverse faults, although some small normal faults were noted in the Late Cretaceous and Early 

Tertiary strata (100 to 37 million years). Maximum displacements are less than 80 m (250 ft), 

and displacements become progressively smaller in younger sediments, suggesting that faulting 

was coeval with deposition. 

At the SRS, the PB fault has been identified as the primary structural feature of interest to a 

potential faulting hazard. This fault appears to be an upward propagation of the boundary fault 

on the northern side of buried Dunbarton Basin, a Triassic to Early Jurassic rift feature. This 

boundary fault was originally a down-to-the-southeast normal fault, but was reactivated as an 

up-to-the-southeast reverse fault in the Late Cretaceous and Early Tertiary (100 to 37 million 

years). Extensive geological and geophysical evidence summarized in the LA documents that 

the PB fault has not been active in the last 500,000 years and probably was not active in the 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 24 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

Quaternary (last approximately 2 million years). Thus, the PB fault is not deemed capable, 

according to criteria established in Appendix A to 10 CFR Part 100. 

Staff Review of Surface Faulting Hazard

The staff reviewed the information in the LA and finds it acceptable because the potential for 

surface faulting of the site and vicinity has been adequately assessed using historical seismic 

data and analyses. The evidence is sufficient to conclude, with reasonable assurance, that 

surface faulting hazards do not exist at the SRS. 

1.3.1.6 Stability of Subsurface Materials 

The objective of the staff review in this section is to determine, with reasonable assurance, 

whether characterization of the stability of the subsurface materials for the facility is adequate 

for foundation design for the civil structural systems. The staff reviewed the following areas 

concerning subsurface material stability that were applicable to the safety analysis and design 

of the proposed facility: 

• soil liquefaction potential assessment 

• soft zone characterization 

• slope stability assessment 

1.3.1.6.1 Soil Liquefaction Potential Assessment 

Section 1.3.5.3.4.3, “Post-Rift and Cenozoic Structures,” of the LA provides information 

regarding paleoliquefaction at the SRS where the facility is located. The LA indicates that no 

systematic reconnaissance surveys in search of paleoliquefaction evidence within the 

geomorphic and geologic environment of the SRS were performed in the past because of 

limited access, high water table conditions, dense vegetative cover, and few exposures. 

For seismically induced liquefaction to occur and be identified, the following conditions must be 

met (MOX, 2006a): 

• presence of Quaternary-age unconsolidated deposits 

• presence of a shallow ground water table 

• proximity to potential seismogenic features 

• quality and extent of exposure 

According to these conditions, young fluvial terraces at or slightly above the level of the modern 

flood plain and Carolina bays may have the highest potential for generating and recording 

Holocene (last 10,000 years) and Quaternary (last approximately 2 million years) seismically 

induced liquefaction. 

Limited investigation of the exposed young fluvial terraces along the Savannah River adjacent 

to the SRS suggests that most of the exposed deposits were clay and silt and thus have a low 

liquefaction potential. Although local clean sand deposits with a high liquefaction potential exist, 

evidence of seismically induced liquefaction is not observed (MOX, 2006a). In general, these 

young fluvial deposits are historical in age. In historical times, no strong ground motions 

occurred in the SRS area. Consequently, evidence for seismically induced liquefaction in the 

young fluvial deposits may not exist. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 25 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

According to the LA, potential paleoliquefaction for the flood plain deposits at depth is likely. 

Evaluation of postdepositional features associated with the upland areas at the SRS, however, 

suggests that they are not related to seismically induced liquefaction (MOX, 2006a). 

Section 1.3.7.1 of the LA discusses liquefaction susceptibility at the facility. Detailed soil 

geotechnical testing data, as documented in three facility site geotechnical reports (DCS, 2003 

and 2001a and b), support this discussion. The site geotechnical reports present properties of 

soils, including soil classifications, particle-size distributions, water contents, plasticity indices, 

liquid limits, blow counts from standard penetration tests, tip shear resistances from cone 

penetration tests, and shear wave velocities. 

The liquefaction potential of the facility site within the proximity of the MFFF and emergency 

generator buildings was evaluated using the cyclic stress approach described by the National 

Center for Earthquake Engineering Research (1997). This approach is acceptable to the staff 

for a liquefaction potential investigation because it represents the state-of-the-art procedure. 

This procedure can evaluate liquefaction resistance of soils under level to gently sloping ground; 

the surface gradient at the proposed facility is gently sloping (as shown in Figures 1.3.1-1, 

1.3.4-5, and 1.3.7-1 of the LA). 

In the most recent of the geotechnical reports (DCS, 2003), liquefaction potential was evaluated 

for the 95 soil columns from cone penetration tests and 14 soil columns from standard 

penetration tests. Cyclic stress ratio and cyclic resistance ratio are two important parameters 

for assessing liquefaction. The cyclic stress ratios for the aforementioned penetration tests 

were estimated directly using the PROSHAKE computer program with a generalized soil profile. 

The liquefaction potential for 18 of the cone penetration tests was also estimated using the 

test-hole-specific soil profiles to compare with the results using the generalized soil profile. The 

LA assumed that full liquefaction was triggered if the factor of safety (cyclic stress ratio/cyclic 

resistance ratio) was equal to or smaller than 1.1. For factors of safety between 1.1 and 1.4, 

soil settlement may result because of the excessive water pressure buildup that reduces soil 

strength and stiffness. 

The analysis results indicate that the liquefaction potential at the facility site is low. Only a few 

localized areas have been identified to be liquefiable or to have soil settlement potential 

because of excessive pore water pressure. The potentially liquefiable soils identified at the site 

are located in the lower Tertiary (about 65 to 33 million years) Tobacco Road, Dry Branch, and 

Santee formations. The LA indicates that the analysis results are conservative because the 

analysis did not consider the effects of soil aging and the cohesiveness of the soils for the 

cone-penetration-based results. 

Staff Review of Soil Liquefaction Potential Assessment

The staff reviewed the information presented in the LA and finds reasonable assurance that 

paleoliquefaction at the SRS was sufficiently discussed to support the design of the IROFS 

structures of the facility. The staff concurs that the analysis of liquefaction potential in the 

proximity of the MFFF demonstrated a conservative approach and is acceptable. Section 11.1 

of this SER evaluates the review of the effect of the seismically induced settlements caused by 

either liquefaction or excessive water pressure buildup in developing design criteria for the 

facility IROFS structures. 

1.3.1.6.2 Soft Zone Characterization 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 26 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

Soft zones in the soils are unique features of the SRS. Section 1.3.5.1.5.5, “Carolina Bays,” of 

the LA discusses the origin of the soft zones. Section 1.3.7.2, “Evaluation of Soft Zones,” of the 

LA discusses the characterization of the soft zones at the facility and is supported by site 

geotechnical data (DCS, 2003 and 2001a). 

The soft zones are often found in the Tinker/Santee Formation, particularly in the upper third of 

this section. These soft zones consist of weak material zones interspersed in stronger 

carbonate-rich matrix materials. Soft zones may pose a concern for foundation design by 

developing undesirable soil settlement not accounted for in the design. In engineering terms, a 

soft zone is defined as a zone with a cone penetration test corrected tip resistance less than 

1.44 megapascals (209 psi) or blow counts from a standard penetration test less than 5 over a 

continuous interval of at least 0.6 m (2 ft) (DCS, 2001a). In characterizing the soft zones, the 

applicant used these criteria to identify soft material zones not located in the Tinker/Santee 

Formation. The staff considered this approach prudent and acceptable. 

Three site geotechnical reports (DCS, 2003 and 2001a and b) document the results of the site 

exploration program related to identifying soft material zones. The spacing of exploration holes 

in the vicinity of an identified soft zone was generally 27 m (90 ft) or less. The lateral extent of 

soft zones was conveniently estimated to be half of the exploration spacing. The exploration 

program identified soft zones in the vicinity and beneath the MOX fuel fabrication building with 

limited lateral extent. The thickness of these soft zones ranges from 0.91 to 2.13 m (3 to 7 ft). 

Staff Review of Soft Zone Characterization

Based on the review of the soft zone information, the staff concludes that the applicant’s 

exploration program sufficiently characterized the soft zones at the facility to support design of 

the IROFS. Section 11.11 of this SER evaluates the consideration of soft zone effects in 

developing design criteria for the IROFS of the facility. 

1.3.1.6.3 Slope Stability 

Section 1.3.7.3, “Slope Instability Hazard Evaluation,” of the LA does not specifically discuss 

slope stability. In the evaluation of the natural phenomena that may occur at the site, however, 

debris avalanching and landslides were determined not to be applicable, because the site is 

relatively flat and no significant quantities of soil or rock are available in the surrounding area. 

An examination of topographic contours provided in Figures 1.3.4-5 and 1.3.7-1 of the LA 

confirms that the slopes at the facility site are relatively gentle and therefore pose no threat for 

instability or landslide. The staff site visit further confirmed that slope stability is not a safety 

concern at the site. 

1.3.2 Evaluation Findings 

The staff reviewed Chapter 1.3 of the LA and its supplementary information in accordance with 

Section 1.3 of NUREG-1718 (NRC, 2000). The applicant provided the geographic, 

demographic and land use, meteorologic, hydrologic, geologic, and seismic information relevant 

to the MFFF site. This information is current, appropriately referenced, and consistent with 

information in the safety assessments used to support the design bases of the IROFS 

structures. The staff finds that the applicant has accurately described the site so as to properly 

define potential accident conditions. Based on its review of the LA and the relevant 

supplementary information provided by the applicant, the staff further finds that the applicant 

has met the baseline design criteria in 10 CFR 70.64(a)(2) for natural phenomena hazards. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 27 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

Based on the review, the staff concludes that the applicant’s site description meets the 

regulatory requirements in 10 CFR 70.22, “Contents of Application,” for a license to possess 

and use radioactive material. 

REFERENCES 

(Ambraseys, 1988) Ambraseys, N.N., “Engineering Seismology,” Earthquake Engineering and 

Structural Dynamics, Vol. 17, pp. 1–105, 1988. 

(Bollinger, 1992) Bollinger, G.A., “Specification of Source Zones, Recurrence Rates, Focal 

Depths, and Maximum Magnitudes for Earthquakes Affecting the Savannah River Site in South 

Carolina,” U.S. Geological Survey Bulletin 2017, 1992. 

(Boore, 1983) Boore, D.M, “Stochastic Simulation of High-Frequency Ground Motions Based on 

Seismological Models of the Radiated Spectra,” Bulletin of the Seismological Society of 

America, Vol. 73, pp. 1865–1894, 1983. 

(Campbell, 2003) Campbell, K., “Prediction of Strong Ground Motion Using the Hybrid Empirical 

Method and Its Use in the Development of Ground-Motion (Attenuation) Relations in Eastern 

North America,” Bulletin of the Seismological Society of America, Vol. 93, pp. 1012–1033, 2003. 

(Center for Nuclear Waste Regulatory Analyses, 1999) Center for Nuclear Waste Regulatory 

Analyses, “Review of the Probabilistic Seismic Hazard Analyses for the Paducah Gaseous 

Diffusion Plant—Final Report,” San Antonio, TX, 1999. 

(DCS, 2005), Duke, Cogema, Stone & Webster, “Mixed Oxide Fuel Fabrication 

Facility,Construction Authorization Request”, Charlotte, NC, June 2004 

(DCS, 2003) Duke Cogema Stone & Webster, “MFFF Site Geotechnical Report,” 

DCS01-WRS-DS-NTE-G-00005-E (report prepared for DOE, Chicago Operations Office), 

Charlotte, NC, 2003. 

(DCS, 2002) Duke Cogema Stone & Webster, “Letter to NRC, RE: Clarification of Responses 

to NRC Request for Additional Information,” Charlotte, NC, March 8, 2002. 

(DCS, 2001a) Duke Cogema Stone & Webster, “Letter to NRC, RE: MFFF CAR Supplemental 

Information—Site Geotechnical Report,” DCS01-WRS-DS-NTE-G-00005-A, Charlotte, NC, 

April 24, 2001. 

(DCS, 2001b) Duke Cogema Stone & Webster, “Letter to NRC, RE: MFFF Site Geotechnical 

Report,” DCS01-WRS-DS-NTE-G-00005-C, Charlotte, NC, August 10, 2001. 

(DOE, 2002) U.S. Department of Energy, “Natural Phenomena Hazards Design and Evaluation 

Criteria for DOE Facilities,” DOE-STD-1020-2002, Washington, DC, 2002. 

(DOE, 1996) U.S. Department of Energy, “Natural Phenomena Hazards Design and Evaluation 

Criteria for DOE Facilities,” DOE-STD-1020-94, Change Notice No. 1, Washington, DC, 1996. 

(DOE, 1995) U.S. Department of Energy, “Natural Phenomena Hazards Assessment Criteria,” 

DOE-STD-1023-95, Change Notice No. 1, Washington, DC, 1995. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 28 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

(DOE, 1994) U.S. Department of Energy, “Natural Phenomena Hazards Characterization 

Criteria,” DOE-STD-1022-94, Washington, DC, 1994. 

(EPRI, 1989) Electric Power Research Institute, “Probabilistic Seismic Hazard Evaluations at 

Nuclear Power Plants in the Central and Eastern United States: Resolution of the Charleston 

Earthquake Issue,” NP-6395-D, Palo Alto, CA, April 1989. 

(Fledderman, 2002) Fledderman, P.D., “Plutonium Disposition Program (PDP) Preconstruction 

Environmental Monitoring Report,” ESH-EMS-2002-1141, SRS: Westinghouse SRC, 

June 26, 2002. 

(Hanks and McGuire, 1981) Hanks, T.C. and R.K. McGuire, “The Character of High-Frequency 

Strong Ground Motion,” Bulletin of the Seismological Society of America, Vol. 71, pp. 2071–

2095, 1981. 

(Hastings, 2003) Hastings, P., “Letter to NRC, RE: Responses to Open Items/Additional NRC 

Questions on Construction Authorization Request Revision,” Duke Cogema Stone & Webster, 

Charlotte, NC, February 11, 2003. 

(Herrmann, 1986) Herrmann, R.B., “Surface-Wave Studies of Some South Carolina 

Earthquakes,” Bulletin of the Seismological Society of America, Vol. 76, pp. 111–121, 1986. 

(Hu, et al., 2002) Hu, K., S.L. Glassman, and P. Talwani, “Magnitudes of Prehistoric 

Earthquakes in the South Carolina Coastal Plain from Geotechnical Data,” Seismological 

Research Letters, Vol. 73, pp. 979–991, 2002. 

(Idriss and Sun, 1992) Idriss, I.M. and J.I. Sun, “User’s Manual for SHAKE-91: A Computer 

Program for Conducting Equivalent Linear Seismic Response Analysis of Horizontally Layered 

Soil Deposits,” Center for Geotechnical Modeling, Department of Civil and Environmental 

Engineering, University of California, Davis, CA, 1992. 

(Jannick, 1995) Jannik, G.T., “Concentration Guidelines for the Initial Screening of Soil in 

Determining Onsite Soil Concentration Areas,” WSRC-ETS-950155, SRS: Westinghouse SRC, 

1995. 

(Johnston, 1996) Johnston, A.C., “Seismic Moment Assessment of Earthquakes in Stable 

Continental Regions, III, New Madrid 1811–1812, Charleston 1886, and Lisbon 1755,” 

Geophysical Journal International, Vol. 126, pp. 314–344, 1996. 

(Madabhushi and Talwani, 1993) Madabhushi, S. and P. Talwani, “Fault Plane Solutions and 

Relocations of Recent Earthquakes in Middleton Place Summerville Seismic Zone Near 

Charleston, South Carolina,” Bulletin of the Seismological Society of America, Vol. 83, 

pp. 1442–1466, 1993. 

(Marple, 1994) Marple, R.T., “Discovery of a possible seismogenic fault system beneath the 

coastal plain of South and North Carolina from an integration of river morphology and geological 

and geophysical data,” Ph.D. Dissertation, University of South Carolina, Columbia, SC, 1994. 

(Marple and Talwani, 2000) Marple, R.T. and P. Talwani, “Evidence for a Buried Fault System in 

the Coastal Plain of the Carolinas and Virginia—Implications for Neotectonics in the 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 29 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

Southeastern United States,” Geological Society of America Bulletin, Vol. 112, pp. 200–220, 

2000. 

(MOX, 2010a) Shaw AREVA MOX Services, “MFFF—License Application,” Aiken, SC, March 

2010. 

(MOX, 2010b) Shaw AREVA MOX Services, “MFFF—Integrated Safety Analysis Summary,” 

Aiken, SC, March 2010. 

(MOX, 2010c) Shaw AREVA MOX Services, Email from DW Gwyn to David Tiktinsky, “Site 

Description”, Aiken, SC, April 6, 2010 

(National Center for Earthquake Engineering Research, 1997) National Center for Earthquake 

Engineering Research, “Proceedings of the National Center for Earthquake Engineering 

Research (NCEER) Workshop on Evaluation of Liquefaction Resistance of Soils,” Technical 

Report No. NCE ER-97-002, State University of New York at Buffalo, NY, 1997. 

(NRC, 2005) U.S. Nuclear Regulatory Commission, NUREG-1821, “Final Safety Evaluation 

Report on the Construction Authorization Request for the Mixed Oxide Fuel Fabrication Facility 

at the Savannah River Site, South Carolina”, Washington, D.C., March 2005 

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” Washington, 

DC, August 2000. 

(NRC, 1997) U.S. Nuclear Regulatory Commission, RG 1.165, “Identification and 

Characterization of Seismic Sources and Determination of Safe Shutdown Earthquake Ground 

Motion,” Washington, DC, March 1997. 

(NRC, 1994) U.S. Nuclear Regulatory Commission, NUREG-1488, “Revised Livermore Seismic 

Hazard Estimates for Sixty-Nine Nuclear Power Plant Sites East of the Rocky Mountains,” 

Washington, DC, 1994. 

(NRC, 1987) U.S. Nuclear Regulatory Commission, NUREG-0800, “SRP for the Review of 

Safety Analysis Reports for Nuclear Power Plants: LWR Edition,” Washington, DC, 1987. 

(NRC, 1973) U.S. Nuclear Regulatory Commission, RG 1.60, Revision 1, “Design Response 

Spectra for Seismic Design of Nuclear Power Plants,” Washington, DC, December 1973. 

(Prowell and Obermeier, 1991) Prowell, D.C. and S.F. Obermeier, “Evidence of Cenozoic 

Tectonism,” The Geology of the Carolinas, University of Tennessee Press, Knoxville, TN, 1991. 

(Silva, 2001) Silva, W., “Site Dependent Specification of Strong Ground Motion,” Dynamic Soil 

Properties and Site Characterization, Proceedings of the Workshop sponsored by the National 

Science Foundation and EPRI, pp. 6-1 through 6-80, Palo Alto, CA, 1989. 

(Talwani and Schaeffer, 2001) Talwani, P. and W.T. Schaeffer, “Recurrence Rates of Large 

Earthquakes in the South Carolina Coastal Plain Based on Paleoliquefaction Data,” Journal of 

Geophysical Research, Vol. 106, pp. 6621–6642, 2001. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

1 - 30 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

(Tarr et al., 1981) Tarr, A.C., P. Talwani, S. Rhea, D. Carver, and D. Amick, “Results of Recent 

South Carolina Seismological Studies,” Seismological Research Letters, Vol. 71, No. 6, 

pp. 1883–1902, 1981. 

(Tuttle, 2001) Tuttle, M.P., “The Use of Liquefaction Features in Paleoseismology: Lessons 

Learned in the New Madrid Seismic Zone, Central United States,” Journal of Seismology, Vol. 5, 

pp. 361–380, 2001. 

(Weems and Lewis, 2002) Weems, R.E. and W.C. Lewis, “Structural and Tectonic Setting of the 

Charleston, South Carolina, Region: Evidence from the Tertiary Stratigraphic Record,” 

Geological Society of America Bulletin, Vol. 114, pp. 24–42, 2002. 

(Westinghouse SRC, 2000a) Westinghouse Savannah River Company, “Probability of 

Liquefaction for F-Area, SRS,” Report WSRC-TR-2000-00039, Rev. 0, Aiken, SC, 2000. 

(Westinghouse SRC, 2000b) Westinghouse Savannah River Company, “Natural Phenomena 

Hazards (NPH) and Design Criteria and Other Characterization Information for the MFFF at 

SRS (U),” WSRC-TR-2000-00454, Rev. 0, Aiken, SC, 2000. 

(Westinghouse SRC, 1987) Westinghouse Savannah River Company, “SRS Seismic Response 

Analysis and Design Basis Guidelines,” WSRC-TR-97-0085, Rev. 0, Aiken, SC, 1997 

.
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

2 - 1 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

2.0 FINANCIAL QUALIFICATIONS 

2.1 Conduct of Review

This chapter of the safety evaluation report contains the staff’s review of the financial 

qualifications presented by Shaw Areva MOX Services (MOX Services) in Chapter 2 of the 

revised license application (LA) (MOX 2009) and the exemption request entitled “Request for 

Exemption from Indemnity Agreement and Financial Protection Requirements” dated 

September 27, 2006 (DCS 2006). 

MOX Services is the applicant for the license to possess and use byproduct material, source 

material, and special nuclear material (SNM). MOX Services is incorporated in the State of 

South Carolina as a limited liability company (LLC) owned by Shaw Project Services Group, Inc. 

(SPSG), Shaw Environmental & Infrastructure, Inc. (SE&I), and AREVA, Inc. These three 

companies are the equity owners of the LLC (SPSG 40 percent, SE&I 30 percent, and AREVA 

30 percent). MOX Services was formed to provide MOX fuel fabrication and other services to 

support the mission of the U.S. Department of Energy (DOE) for the disposition of U.S.-owned 

surplus weapons-usable plutonium. 

2.1.1 Project Costs 

In September 2000, the United States and the Russian Federation concluded a bilateral 

agreement on plutonium disposition, “Agreement Between the Government of the United States 

of America and the Government of the Russian Federation Concerning the Management and 

Disposition of Plutonium Designated as No Longer Required for Defense Purposes and Related 

Cooperation.” Under the agreement, the United States will dispose of surplus weapons-grade 

plutonium. The mixed oxide fuel fabrication facility (MFFF) is intended to fulfill the U.S. 

obligation for disposition of that plutonium. 

MOX Services operates the MFFF under a contract with DOE. During operations, DOE 

reimburses MOX Services for the full cost of operating the MFFF, minus fuel payments that 

MOX Services receives from the mission reactor utilities, plus possible incentive fees for 

performance. MOX Services does not intend to: (1) finance or rely on the proceeds from debt, 

(2) rely on equity securities, (3) rely on any other source of external financing other than DOE 

funding, and (4) does not rely on any revenue stream to cover such costs (with the exception of 

the revenue stream from the mission reactor utilities as described above). In light of the MFFF’s 

importance to the U.S. obligation and congressional support for this program, the Federal 

Government has a significant continuing incentive to adequately fund the MFFF and to continue 

providing the necessary annual appropriations to support operation of the MFFF. 

2.1.2 Financial Qualifications 

Because the MFFF is a project funded by the U.S. Government, the specific financial resources 

and capabilities of MOX Services and its equity owners are not relevant to the determination of 

adequate financial resources to operate the facility. MOX Services does not intend to rely on its 

financial resources, or those of an equity partner or parent company, to provide financing. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

2 - 2 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

MOX Services is not a publicly held entity, and thus, its financial statements are not publicly 

available. MOX Services previously submitted, under separate cover, proprietary financial 

statements providing information concerning its financial condition. 

The structure of MOX Services reimbursement for the MFFF operation is designed to support 

the MFFF project as a viable business enterprise. Thus, MOX Services is financially qualified to 

safely operate the MFFF, and that financial qualification is supported by the Federal 

Government’s obligation through the DOE-MOX Services contract for the MOX Project. 

2.1.3 Exemption Request 

As stated in Section 1.2.4.2 of the Construction Authorization Request (DCS 2004), DOE has 

agreed to indemnify MOX Services in accordance with the provisions of the Price-Anderson Act 

set forth in Section 170(d) of the Atomic Energy Act of 1954, as amended, 42 U.S.C. 2210(d). 

Based upon the DOE Indemnity Agreement and for the reasons discussed below, MOX 

Services requested an exemption from the NRC's requirements concerning agreements of 

indemnification and related financial protection requirements set forth in 10 CFR §§ 140.20 and 

140.13a. 10 CFR § 140.8 provides that: “The Commission may, upon application of any 

interested person or upon its own initiative, grant such exemptions from the requirements of the 

regulations in this part as it determines are authorized by law and are otherwise in the public 

interest.” 

MOX Services is a DOE contractor and is thus fully covered by DOE’s nuclear liability protection 

under the Price-Anderson Act, as amended. Section 170(d)(1)(A) of the Atomic Energy Act 

provides that the DOE Secretary shall enter into agreements of indemnification with certain 

persons “who may conduct activities under a contract with the Department of Energy that 

involve the risk of public liability and that are not subject to financial protection requirements 

under subsection b. or agreements of indemnification under subsection c. or k.” In accordance 

with this statutory authority, the contract between MOX Services and DOE contains the 

following “Nuclear Hazards Indemnity Agreement” excerpt from DOE Acquisition Regulations 

(DEAR 952.250-70), which fully indemnifies MOX Services and its subcontractors up to the 

statutory limit of liability: 

(d)(1) Indemnification. To the extent that the contractor and other persons 

indemnified are not compensated by any financial protection permitted or 

required by DOE, DOE will indemnify the contractor and other persons 

indemnified against (i) claims for public liability as described in 

subparagraph (d)(2) of this clause; and (ii) such legal costs of the contractor and 

other persons indemnified as are approved by DOE, provided that DOE’s liability, 

including such legal costs, shall not exceed the amount set forth in section 170e 

(1)(B) of the Act in the aggregate for each nuclear incident or precautionary 

evacuation occurring within the U.S. or $100 millions in the aggregate for each 

nuclear incident occurring outside the U.S., irrespective of the number of persons 

indemnified in connection with this contract. 

The public liability referred to in subparagraph (d)(1) of this clause is public liability as defined in 

the Price-Anderson Act, as amended, which “(i) arises out of or in connection with the activities 

under this contract, including transportation; and (ii) arises out of or results from a nuclear 

incident or precautionary evacuation, as those terms are defined in the Act.” The DOE 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

2 - 3 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

indemnity agreement with MOX Services provides full protection and coverage for public liability 

arising from operation of the MFFF. 

The requested exemption from the requirements to enter into an indemnity agreement with the 

NRC and to maintain financial protection is authorized by law because: 

(a) The Price-Anderson Act does not require the NRC to enter into indemnity 

agreements or to impose financial protection requirements in connection with a 

plutonium fuel fabrication facility, and; 

(b) There is no statutory prohibition on granting the exemption. 

Nothing in the Price-Anderson Act, the Atomic Energy Act, or any other statute precludes the 

NRC from granting the requested relief. In SECY-99-177 (Issue 7), the NRC Staff specifically 

stated that "[n]o additional legislation is needed" to support the requested exemption. 

The requested exemption is in the public interest. DOE has entered into an indemnity 

agreement with MOX Services that provides for effective coverage in the event of a nuclear 

incident related to the MOX Facility. If MOX Services were required to enter into an indemnity 

agreement with the NRC and to obtain $200 million in financial protection (presumably via 

private insurance coverage), the cost of the financial protection would be passed through to the 

U.S. Government under the MOX Services-DOE contract. Thus, there would be no benefit, and 

additional costs would be incurred, by imposing the NRC's indemnity agreement and financial 

protection requirements. 

2.2 Evaluation Findings

Based on its review of the exemption request, the staff finds that the requested exemption from 

the indemnity agreement and financial protection requirements of 10 CFR §§ 140.20 and 

140.13a is authorized by law and in the public interest as discussed in Section 2.1.3 of this 

SER. This exemption will be included in the license to possess and use radioactive material 

that may be granted to the applicant after completion of other regulatory requirements in 10 

CFR Part 70. 

REFERENCES 

10 CFR Part 70, “Domestic Licensing of Special Nuclear Material,” 

(DCS 2006) “Request for Exemption from Indemnity Agreement and Financial Protection 

Requirements” Aiken, SC, dated September 27, 2006. 

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” 

Washington, DC, August 2000. 

SECY 99-177, "Current Status of Legislative Issues Related to NRC Licensing a Mixed Oxide 

Fuel Fabrication Facility, Washington DC, July 1999. 

(DCS 2004) Mixed Oxide Fuel Fabrication Facility Construction Authorization Request, Aiken, 

SC, 2004. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

2 - 4 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

(MOX, 2009) Shaw AREVA MOX Services, “MFFF-License Application,” Aiken, SC, 

October 2009 

 

Atomic Energy Act, as amended 1954. 

DOE Acquisition Regulations (DEAR 952.250-70). 

10 CFR Part 140, “Financial Protection Requirements and Indemnity Agreements”. 

Price-Anderson Nuclear Industries Indemnity Act, Washington, DC, 1957. 

Agreement Between the Government of the United States of America and the Government of 

the Russian Federation Concerning the Management and Disposition of Plutonium Designated 

as No Longer Required for Defense Purposes and Related Cooperation.” 2000. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

3 - 1

3.0 PROTECTION OF CLASSIFIED MATTER 

This chapter of the safety evaluation contains the staff’s review to determine, with reasonable 

assurance, whether the applicant has established policies and procedures that meet the 

regulatory requirements for the protection of classified matter against loss or compromise. 

Classified matter includes secret and confidential National Security Information (NSI) and 

Restricted Data (RD) received or developed in conjunction with activities licensed, certified or 

regulated by the NRC. 

3.1 Regulatory Requirements

The regulatory basis for the NRC’s review of an applicant’s protection of classified matter are 

the requirements described in the (10 CFR 70.22) contents of an application, in Title 10 of the 

Code of Federal Regulations (10 CFR) Part 25, “Access Authorization,” and in 10 CFR Part 95, 

“Facility Security Clearance and Safeguarding of National Security Information and Restricted 

Data.” These regulations implement the requirements of the Atomic Energy Act of 1954, as 

amended, and Executive Order 12958, “Classified National Security Information,” as amended, 

for the protection of Restricted Data and classified National Security Information. Chapter 3 of 

NUREG-1718, “Standard Review Plan for the Review of an Application for a Mixed Oxide 

(MOX) Fuel Fabrication Facility” (NRC, 2000), provides the references for this information and 

the guidance for staff review. 

3.2 Regulatory Acceptance Criteria

The acceptance criteria that the U.S. Nuclear Regulatory Commission (NRC) uses for reviews 

of practices and procedures for protecting classified matter are outlined in the NRC’s “Standard 

Practice Procedures Plan Standard Format and Content for the Protection of Classified Matter 

at NRC Licensees, Certificate Holder, or Other Activities as the Commission May Determine” 

(referred to hereafter as the SPPP Standard Format) (NRC, 2006.) The SPPP Standard Format 

provides guidance to the licensee in meeting the regulatory requirements of 10 CFR Part 25 and 

10 CFR Part 95. Where NRC criteria are not specified, the staff may use relevant guidance 

from the U.S. Department of Energy (DOE), Department of Defense, National Security Agency, 

or National Industrial Security Program Operating Manual as a basis for acceptance. The 

criteria for acceptance are also discussed in the Standard Review Plan for the Review of an 

Application for a Mixed Oxide Fuel Fabrication Facility (NRC 2000) 

3.3 Staff Review and Analysis

The licensee prepared a detailed SPPP for the mixed oxide fuel fabrication facility (MFFF). The 

purpose of the MFFF facility security plan is to define and document the security measures 

related to the protection of classified matter.The NRC staff review evaluates the MFFF plan to 

assure compliance with NRC regulations. Federal laws, specified by 10 CFR Part 25 and 

10 CFR Part 95, and applicable orders require that all appropriate access authorization and jobrelated need-to-know personnel assigned to the MFFF protect classified information from 

unauthorized access and disclosure. The MFFF plan establishes the criteria for granting, 

reinstating, extending, transferring, and terminating access authorization to employees, 

contractors, and other agents who may require access to classified information at the MFFF 

site. The MFFF plan also provides details regarding the facility’s physical location and classified 

and unclassified mailing addresses. It also discusses the buildings and security receptacles 

where classified matter will be stored. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

3 - 2

The MFFF Security Department has the responsibility and authority for enforcing security 

requirements governing the safeguarding of classified information and matter. Responsibility for 

plant security is vested in an MFFF Facility Security Officer (FSO). Plans, procedures, post 

orders, and similar documents designate the security responsibilities of all members of the 

MFFF security organization and authorized individuals performing security functions. Security 

matters that cannot be handled through normal procedure will be reported to the FSO or 

designee. 

The FSO and designees are cleared to the level commensurate with the facility clearance. 

Based on need-to-know, other key management officials are granted specific access 

authorizations or will be excluded from classified access. The MFFF plan also addresses the 

types of classified matter that will be handled at the facility. In addition, the plan outlines the 

personnel access authorizations and security clearance required for individuals with the 

requirement for a need-to-know who may have access to classified information and may visit 

classified portions of the facility. 

Classified matter, while unattended, will be stored in security containers or safes approved by 

the General Services Administration (GSA). These containers and safes have changeable 

three-position combination GSA-approved combination locks. Such containers (repositories) 

will be located within assigned and approved locations in the protected area or in other 

restricted areas on the MFFF site. Access to all areas that contain classified information will be 

restricted. 

Classified matter, while in use, will be constantly attended by, or under the direct control of, an 

authorized individual (appropriately cleared and with a need to know) to preclude visual, 

physical, and audio access by persons who do not have the prescribed access authorization. 

Classified matter will be protected in accordance with 10 CFR 95.27, “Protection While in Use,” 

by the markings placed on it, by access control, by the requirement of a need to know, by the 

availability and use of prescribed storage containers (repositories), and by the means of 

prescribed transmission and destruction methods. Classified information may be established 

and controlled anywhere within the confines of restricted area(s) at the MFFF. 

The security education program at the MFFF is developed and maintained by the MFFF 

Training Manager with oversight by the FSO or FSO designee. The security education program 

includes consideration and coverage of personnel access authorization requirements, the 

physical security features of the facility, and the classified nature of the work. 

Designated derivative classifiers at MFFF are authorized to make classification determinations 

to classify NRC documents. The classifiers make such determinations based on issued 

guidance pertinent to the security plan. Information generated or possessed at the MFFF site 

that is believed to contain classified information will be protected and marked appropriately, in 

accordance with the guidelines of 10 CFR 95.37, “Classification and Preparation of Documents,” 

pending the review and signature of a derivative classifier. 

Documents and matter containing classified information received or originated in connection 

with an NRC license or certificate will be transmitted only to NRC-approved security facilities. 

Destruction of classified documents will be accomplished by use of National Security Agency 

approved shredders, which are located in restricted areas. Person(s) having the appropriate 

clearance, and need-to-know, will perform the destruction. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

3 - 3

Any alleged or suspected violation of the Atomic Energy Act, Espionage Act, or other Federal 

statutes related to classified National Security Information (i.e., deliberate disclosure of 

classified information to persons not authorized to receive it and theft of classified information) 

will also be reported in accordance with 10 CFR 95.57, “Reports,” to the NRC Region II 

Regional Administrator. 

Standard Practice Procedure Plan 

The applicant plans to use classified matter in support of operations at the MFFF. The MOX 

project is not considered inherently classified, but because of its work with strategic special 

nuclear material (SSNM), classified information related to the protection of the SSNM and 

limited technical information related to the project will be used. 

3.4. Evaluation Findings

The “specific risk” of a loss or compromise of project-related classified information is the 

theft/diversion or radiological sabotage to the SSNM at the MFFF. There is also a “general risk” 

to the classified technical information associated with the project in that the classified matter will 

be in the form of information related to classified components. As described above, the 

applicant’s submittals provided sufficient information, in accordance with 10 CFR Part 25 and 

10 CFR Part 95, for the staff to determine that classified information will be adequately 

protected. Supporting factors in the staff’s decision also include the licensee’s oversight by 

DOE and the MFFF location within the DOE Savannah River Site. 

REFERENCES 

(DOD, 2006) U.S. Department of Defense, DOD 5229.22M, “National Industrial Security 

Program Operating Manual,” Washington, DC, February 28, 2006. 

(MOX, 2008) Shaw AREVA MOX Services, “Revised MFFF Classified Matter Protection Plan,” 

Aiken, SC, May 21, 2008. 

(NRC, 2006) U.S. Nuclear Regulatory Commission, “Standard Practice Procedures Plan 

Standard Format and Content for the Protection of Classified Matter at NRC Licensees, 

Certificate Holder, or Other Activities as the Commission May Determine,” Washington, DC, 

June 2006. 

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” Washington, 

DC, August 2000. 

10 CFR Part 25, Access Authorization. 

10 CFR Part 95, Facility Security Clearance and Safeguarding of National Security Information 

and Restricted Data. 

Atomic Energy Act of 1954, as amended. 

Executive Order 12958, “Classified National Security Information,” as amended, 1995 

ended, 1995. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

4 - 1

4.0 ORGANIZATION AND ADMINISTRATION 

4.1 Conduct of Review

This chapter of the safety evaluation report reviews the organization and administration 

information presented in Chapter 4 of the revised license application (LA) to possess and use 

radioactive material at the mixed oxide (MOX) fuel fabrication facility (MFFF) (MOX, 2009). The 

staff used Chapter 4 in NUREG-1718, “Standard Review Plan for the Review of an Application 

for a Mixed Oxide (MOX) Fuel Fabrication Facility” (NRC, 2000), as guidance in performing the 

review. The objective of the review is to determine whether organizational and administrative 

functions have been identified that will enable the applicant to plan, implement, and control site 

activities in a manner that adequately ensures the safety of workers and individuals outside the 

controlled area, protect the environment, and meet the requirements of 10 CFR Part 70. This 

review ensures that the qualifications for key management positions are adequate. The 

applicant’s MOX Project quality assurance plan, also presents organizational information. 

4.1.1 Organization 

The applicant proposed a functional organization for facility management, quality assurance, 

production (operation), engineering, environmental safety and health, licensing, and support 

services. Operations, engineering, and environmental safety and health licensing are 

independent functions, allowing each organization to provide objective audits, assessments, 

and reviews. Independence means that none of these organizations reports administratively to 

another. The applicant provided proposed organization charts showing lines of responsibility 

and communications. 

The president of Shaw Areva MOX Services (MOX Services or the Applicant) has overall 

responsibility for health, safety, and environmental matters for the MFFF. Reporting to the 

president are managers responsible for environmental safety and health, licensing, the plant 

manager, the engineering manager, the support services manager, and the quality assurance 

manager. The quality assurance manager has a direct line of communication to the president of 

MOX Services and is independent of responsibilities for costs or schedules. 

The organizational information provided by the applicant describes clear and unambiguous 

controls and communications between organizational groups responsible for designing, 

constructing and operating the facility. Lines of communication, responsibility, and authority are 

clearly delineated in the organization chart. The president has overall responsibility for safety 

and nuclear fuel manufacturing activities at the facility. 

4.1.2 Administration 

The managers responsible for the key management functions are appropriately available to 

perform their duties. When they are absent, their duties may be delegated to other qualified 

personnel, as determined by the responsible manager. While these managers have the 

authority to delegate tasks to other individuals, the responsible manager retains the ultimate 

responsibility and accountability for compliance with applicable requirements. 

MOX Services will utilize procedures to implement health, safety, and environmental functions 

associated with the MFFF and management measures that supplement items relied on for 

safety (IROFS). Plant procedures are formally controlled and approved. If a procedure cannot 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

4 - 2

be adhered to, work is stopped and not resumed until the procedure has been corrected or 

changed. 

4.1.3 Key Management Positions 

The management positions described in Section 4.1.1 above have responsibilities for activities 

involving the proposed facility. The key management functions are (1) facility management, 

(2) quality assurance, (3) production, (4) engineering, (5) environmental safety and health, (6) 

licensing, and (7) support services. The managers of the key functions are responsible for 

IROFS and related activities. The applicant also identified the responsibilities and minimum 

qualifications for each of these positions. 

The scope and number of key management positions are described appropriately for every 

management function involving the proposed facility. The qualification requirements for key 

management positions provide an adequate breadth and level of experience for their respective 

responsibilities and authorities. The staff filling key management positions will be available 

during the operational phases of the project. 

4.2 Evaluation Findings

In accordance with Chapter 4 of NUREG-1718 (NRC, 2000), the staff reviewed the organization 

and administration described in the LA to possess and use radioactive material for the MFFF. 

The staff evaluated the proposed organization for operation; the administration of the project; 

and the responsibilities, qualifications, and authorities of key management positions. The 

proposed organization, administration, and key management position descriptions and 

qualifications are consistent with guidance in NUREG-1718 and meet the regulatory 

requirements for organization and administration in 10 CFR 70.22 and 70.23 and are, therefore, 

acceptable. 

The staff concludes that the applicant’s organization and administration provide reasonable 

assurance that the applicant has an acceptable organization, appropriate administrative 

policies, and qualified key management positions to satisfy the regulatory requirements for a 

license to possess and use radioactive material. 

REFERENCES 

(MOX, 2009) Shaw AREVA MOX Services, “Mixed Oxide Fuel Fabrication Facility—License 

Application,” Aiken, SC, October 2009. 

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide Fuel Fabrication Facility,” Washington, DC, 

August 2000. 

10 CFR Part 70, Domestic Licensing of Special Nuclear Material. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

5 - 1

 5.0 INTEGRATED SAFETY ANALYSIS 

This chapter of the safety evaluation report (SER) contains the U.S. Nuclear Regulatory 

Commission (NRC) staff=s review of the integrated safety analysis (ISA) provided by Shaw 

AREVA MOX Services (MOX Services or the applicant) in Chapter 5 of the license application 

(LA) (MOX, 2010a) and whose results are summarized in the ISA Summary for the Mixed Oxide 

Fuel Fabrication Facility (MFFF) (MOX, 2010b). The staff performed the review using guidance 

from NUREG-1718, “Standard Review Plan for the Review of an Application for a Mixed Oxide 

(MOX) Fuel Fabrication Facility,” issued August 2000 (NRC, 2000) (SRP). The objective of this 

review is to verify whether the applicant has established and committed to an organization and 

procedures related to performing and maintaining an ISA in accordance with the regulatory 

requirements provided in Subpart H, “Additional Requirements for Certain Licensees Authorized 

To Possess a Critical Mass of Special Nuclear Material,” of Title 10 of the Code of Federal 

Regulations (10 CFR) Part 70, “Domestic Licensing of Special Nuclear Material.” The review is 

necessary to verify that (1) commitments for performing and maintaining an ISA, as required by 

the regulations in 10 CFR Part 70, Subpart H, are provided, (2) the MFFF is adequately 

protected against internal and external events, and (3) the items relied on for safety (IROFS) 

identified by the applicant adequately protect against natural phenomena and the consequences 

of potential accidents. The staff evaluated the information provided by the applicant for the ISA 

by reviewing Chapter 5 of the LA, other related sections of the LA as needed, the ISA Summary, 

and supplementary information provided by the applicant. 

5.1 Regulatory Requirements

The staff reviewed how the applicant’s ISA-related information in the LA and ISA Summary 

addressed the following regulations: 

• 10 CFR 70.61, “Performance Requirements” 

• 10 CFR 70.62, “Safety Program and Integrated Safety Analysis” 

• 10 CFR 70.64, “Requirements for New Facilities” 

• 10 CFR 70.65, “Additional Content of Applications” 

• 10 CFR 70.72, “Facility Changes and Change Process” 

More specifically, 10 CFR 70.62(a) requires the applicant to establish and maintain a safety 

program that demonstrates compliance with 10 CFR 70.61. The regulations in 

10 CFR 70.62(a)(2) require that the applicant establish and maintain records that demonstrate 

compliance with the safety program. The requirement to maintain records of IROFS failures is 

in 10 CFR 70.62(a)(3). The regulation in 10 CFR 70.62(b) requires an applicant to maintain 

process safety information (PSI) that supports the performance and maintenance of an ISA. 

The requirement to conduct and maintain an ISA is specified in 10 CFR 70.62(c). In addition, 

10 CFR 70.62(c) specifies the requirements for the tasks comprising the ISA process (i.e., 

identification of radiological, chemical, and facility hazards) and the qualifications of ISA team 

personnel used to ensure the adequacy of the ISA. This regulation further requires the ISA to 

evaluate whether the applicant’s facility, with its listed IROFS, meets the safety performance 

requirements of 10 CFR 70.61. The requirement to establish management measures to ensure 

compliance with the performance requirements of 10 CFR 70.61 is in 10 CFR 70.62(d). The 

regulations in 10 CFR 70.65(a) specify the requirements for having a description of the safety 

program specified by 10 CFR 70.62, while the requirements for the content of an ISA Summary 

can be found in 10 CFR 70.65(b)(1)–(9). The regulations of 10 CFR 70.64 specify design 

criteria requirements for new facilities. Additionally,10 CFR 70.72 provides requirements for 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

5 - 2

keeping the ISA and its supporting documentation current and for determining whether NRC 

preapproval is needed when facility changes are made. SRP Section 5.4.3.2 outlines the 

acceptance criteria for NRC’s review of the applicant’s ISA. 

5.2 Safety Program

Section 5.1 of the LA describes the elements of the safety program for the MFFF. In this 

section, the applicant commits to a safety program that consists of PSI, an ISA that analyzes 

MFFF hazards and potential accident sequences and identifies IROFS, and management 

measures to ensure that those IROFS identified in the ISA Summary are available and reliable 

to perform their safety function when needed. 

The staff review finds that, consistent with the requirements of 10 CFR 70.62(a) to establish and 

maintain a safety program, the requirements of 10 CFR 70.65(a) to include a description of the 

applicant’s safety program, and the guidance in SRP Section 5.4.3.2.A, the applicant’s 

description of the safety program and the content of the program provided in Section 5.1 of the 

LA are acceptable. 

The applicant also committed in Section 5.1.5 of the LA to maintain records of IROFS failures, 

as required by 10 CFR 70.62(a)(3). The applicant provided commitments to ensure that 

deficiencies in IROFS or failures of management measures are addressed in accordance with 

the corrective action program described in the MOX Project Quality Assurance Plan (MPQAP). 

The applicant committed to maintain records of failures so that they are readily retrievable and 

available for inspection by the NRC and to document each discovery that an IROFS or 

management measure has failed to perform its function upon demand or has degraded such 

that the performance requirements of 10 CFR 70.61 are not satisfied. The applicant will 

maintain records that identify the IROFS or management measure that has failed and the safety 

function affected, date of discovery, date of failure, and duration of time that the item was 

unable to perform its function. The records will also contain other affected IROFS or 

management measures and their safety function, affected processes, cause of failure, whether 

the failure was in the context of the performance requirements or upon demand or both, and 

corrective or compensatory action taken. The applicant has committed to record failures at the 

time of discovery and to update the record promptly upon the conclusion of the failure 

investigation. Given the commitments provided by the applicant regarding maintaining records 

of failure and the information included in these records, the staff finds that the requirement in 

10 CFR 70.62(a)(3) has been met. 

5.2.1 Process Safety Information

In Section 5.1.1 of the LA, the applicant committed to compile and maintain current written PSI 

for the MFFF to identify and understand the hazards associated with the processes and to 

update the ISA as required. For the MFFF, the applicant defined PSI to include descriptions of 

the hazards, equipment used in the process, and the technology of the process. 

Consistent with the requirement in 10 CFR 70.62(b) and the guidance in SRP Section 5.4.3.2 to 

maintain PSI to enable the performance and maintenance of an ISA, the staff finds the 

applicant’s commitments for compiling and maintaining PSI, as well as the information included 

in these records, as described in Section 5.1.1 of the LA, to be acceptable. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

5 - 3

5.2.2 Integrated Safety Analysis

The applicant performed an ISA to demonstrate compliance with the performance requirements 

described in 10 CFR 70.61. The ISA identified the plant’s internal and external hazards and 

their potential for initiating events; potential accident sequences and their likelihood and 

consequences; and the structures, systems, and components (SSCs) and activities of personnel 

that are relied on for safety. The ISA supported preparation of the ISA Summary, which 

summarizes the results and conclusions of the ISA process. In Section 5.1.2 of the LA, the 

applicant committed to conduct an ISA with a level of detail commensurate with the complexity 

of the processes and to maintain the ISA during all phases of the facility life cycle. The staff 

finds that, consistent with the requirement in 10 CFR 70.62(c)(1) and the guidance in SRP 

Section 5.4.3.2.A to conduct and maintain an ISA, the applicant’s commitments in the LA to 

conduct and maintain an ISA are acceptable. 

Table 5.1-1 in the LA provides the consequence severity categories for meeting 10 CFR 70.61 

performance requirements; Table 5.1-2 presents the event risk matrix showing when IROFS 

need to be applied to meet 10 CFR 70.61 performance requirements. Table 5.1-3 outlines the 

limits for hazardous chemicals used in the chemical processes at the MFFF. The staff review 

finds that the consequence severity categories provided in Table 5.1-1 and the risk matrix 

provided in Table 5.1-2 of the LA are consistent with the requirements in 10 CFR 70.61(b) and 

10 CFR 70.61(c) and Section 5.4.3.2.B of the SRP; therefore, they are acceptable. Chapter 8 of 

this SER addresses the evaluation of the chemical limits found in Table 5.1-3. 

5.2.3 Management Measures 

The applicant provided the management measure program commitment to implement and 

maintain management measures in Section 5.1.3 of the LA. Management measures are 

applied to IROFS by providing the administrative and programmatic framework for configuration 

management, maintenance, training and qualification, procedures, audits and assessments, 

incident investigation, and records management. The management measure commitments are 

consistent with the requirement in 10 CFR 70.62(d) to establish management measures to 

ensure compliance with the performance requirements of 10 CFR 70.61. The staff review 

determined that these commitments were acceptable for meeting the 10 CFR 70.62(d) 

requirements. The applicant implements and maintains these management measures, as 

described in Chapter 15 of this SER, to ensure the required reliability and availability of the 

IROFS. Section 5.2.5.2.4 of the LA describes the application of management measures to 

IROFS, which the staff has addressed in the review of Chapter 15 of this SER. 

5.3 Areas of Review

5.3.1 Safety Assessment of the Design Bases 

The review performed by the staff for the construction authorization (CA) (see NUREG-1821, 

“Final Safety Evaluation Report on the Construction Authorization Request for the Mixed Oxide 

Fuel Fabrication Facility at the Savannah River Site, South Carolina,” issued March 2005 (NRC, 

2005)), included a review of the description of the plant site and a safety assessment of the 

design bases that demonstrated that the applicant’s principle structures, systems, and 

components (PSSCs) would protect against natural phenomena and the consequences of other 

accidents, in accordance with the performance requirements of 10 CFR 70.61. Following the 

staff’s review, and in accordance with 10 CFR 70.23(b), the Commission granted a construction 

approval allowing the applicant to begin constructing the facility. At that time, the staff also 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

5 - 4

reviewed the methodology used to determine hazards to the facility, the criteria for meeting the 

performance requirements of 10 CFR 70.61, and the definitions of highly unlikely, unlikely, and 

credible provided by the applicant. 

The safety assessment of the design bases used a method that was similar to that used in the 

ISA for the process hazards analyses and demonstration of compliance with the performance 

requirements of 10 CFR 70.61. This assessment also evaluated the acceptability, in terms of 

the consequences, likelihoods, and application of controls, of the external and internal hazards 

of the facility. Although the analysis performed to support the CA was a precursor to the ISA, it 

was not a substitute for the ISA that was submitted with the application for a license to possess 

and use special nuclear material. The safety assessment of the design bases allowed the staff 

to determine that (1) the applicant’s design bases were sufficient to meet the requirements of 

10 CFR 70.23(b) and (2) the applicant, by using the safety assessment of the design bases, 

was building a foundation for the ISA to support the LA. The processes the applicant used to 

develop the safety assessment for the design bases, and which were approved by the staff, 

were analogous to the processes that the applicant used to develop the ISA. However, the 

previous approval of the methods used for the safety assessment of the design basis does not 

ensure that the methods for the ISA have been implemented acceptably, the performance 

requirements can be met, or the PSSCs described in the construction authorization request 

(CAR) represent the complete set of IROFS in the ISA Summary. The staff has reviewed and 

evaluated the ISA-related processes and implementation of the methods used to perform the 

ISA and compliance with the performance requirements of 10 CFR 70.61 in this and other 

technical safety sections of the SER. 

5.3.2 The Integrated Safety Assessment in the License Application 

The staff reviewed the application for a license to possess and use special nuclear material to 

determine the adequacy of the applicant’s commitments associated with performing and 

maintaining an ISA. The areas of review relating to the performance of an ISA are discussed 

below: 

• The applicant described its ISA commitments, which included procedures for the 

following: 

– performing and updating the ISA 

– review responsibility 

– ISA documentation 

– reporting ISA Summary changes 

– maintenance of ISA records 

The configuration management program described in Chapter 15 of this SER will control 

the applicant’s ISA management procedures. 

• The applicant described its commitment to compile and maintain a current and accurate 

set of PSI, including information on the hazardous materials, equipment, and technology 

used in each process. The applicant provided this commitment in Section 5.1.1 of the 

LA, consistent with the requirement in 10 CFR 70.62(b) and Section 5.4.3.2.A of the 

SRP. The staff found that commitment, if implemented as stated, is acceptable. 

• The applicant described its commitments for meeting the requirements of 

10 CFR 70.62(c)(2) and discussed the ISA team makeup and qualifications in 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

5 - 5

Section 5.3 of the LA. The applicant provided the required makeup of the ISA team and 

the technical areas that could be selected depending on the process and associated 

hazards evaluated. The applicant also provided detailed descriptions of the 

responsibilities and qualifications for the ISA team leader, scribe, engineer, and 

discipline experts. The staff finds that the applicant provided sufficient content and detail 

to meet the 10 CFR 70.62(c)(2) requirement and the provisions of SRP Section 5.4.3.2.A 

and therefore is acceptable. Section 5.3.3 of this SER provides additional discussion 

regarding the ISA team in its review of the ISA Summary contents. 

• The applicant described its commitment to ISA methods, the ISA method selection 

criteria, and the specific methods that were and would be used for implementing the ISA 

process for particular classes of process nodes. The review performed by the staff 

evaluated the applicant’s steps for conducting the ISA process as described in Section 

5.2 of the LA. These steps include the following: 

– Identify internal facility hazards, natural phenomena hazards (NPHs), and 

external manmade hazards (EMMHs) that could affect the safety of licensed 

material. 

– Identify radiological hazards related to possessing or processing licensed 

material at the facility. 

– Identify chemical hazards of licensed material and hazardous chemicals 

produced from licensed material. 

– Develop potential events involving the identified hazards. 

– Determine the consequence and the likelihood of potential events and the 

methods used to determine the consequences and likelihoods. 

– Determine IROFS and the characteristics of their preventive, mitigative, or other 

safety function, as well as the assumptions and conditions under which the item 

is relied upon to support compliance with the performance requirements of 

10 CFR 70.61. 

Hazard identification is performed to identify the hazardous materials and hazardous energy 

sources associated with the operations of the MFFF process and auxiliary units. The ISA team 

utilized a checklist of hazardous materials and hazardous energy sources in the hazard 

identification process. The checklist was developed and used in accordance with the Checklist 

Analysis and What-If/Checklist methods found in the American Institute of Chemical Engineers, 

“Guidelines for Hazard Evaluation Procedures—Second Edition—With Worked Examples,” 

(AIChE, 1992). The checklist was tailored for the MFFF and includes hazardous material, 

energy sources, confinement types, and auxiliary systems. A chemical interaction matrix is 

used to identify chemical hazards introduced by the mixing of incompatible chemicals and 

reagents. The matrix is facility specific and includes the chemicals and reagents used at the 

MFFF. 

The ISA process identified NPHs and external manmade hazards. The applicant also used a 

checklist analysis to identify NPHs and external manmade hazards that may affect the MFFF. 

The list was developed through an extensive documentation review of Savannah River Site 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

5 - 6

(SRS) information, including site maps, site visits, and the SRS generic safety analysis report. 

The applicant also used information provided in NRC regulatory requirements, U.S. Department 

of Energy (DOE) guidance documents, DOE orders, and NRC NUREG reports to identify 

potential external events. 

The process hazards analysis (PrHA) is used to develop and evaluate potential events involving 

the identified hazards. The applicant performed PrHAs for each process unit to identify specific 

event scenarios in detail, including causes of the events, and associated prevention and 

mitigation features (IROFS). All modes of operation are considered, including startup, normal 

operation, shutdown, and maintenance. PrHAs are performed in accordance with the guidance 

provided in AICHE (1992) and NUREG-1513, “Integrated Safety Analysis Guidance Document,” 

issued in 1999 (NRC, 1999). 

AICHE (1992) and NUREG-1513 provided guidance on selecting the specific PrHA 

methodologies utilized for each process unit. 

Hazard of Operability Studies (HAZOPs) and What-If/Checklists were the main techniques the 

applicant used to evaluate MFFF events. Supplemental hazard evaluations may have been 

performed in specific instances to support the ISA. These supplemental analyses are 

performed to gain insight into event likelihoods, event sequences, single failure vulnerability, 

and other safety aspects of hazards evaluation and may include such techniques as preliminary 

hazards analysis, failure modes and effects analysis, fault tree analysis, and event tree analysis. 

Selection of techniques is based upon the specific application and the guidance in AICHE 

(1992) and NUREG-1513. 

For each credible accident event sequence determined to potentially result in unacceptable 

consequences, the PrHA identifies the IROFS necessary to demonstrate that the performance 

requirements of 10 CFR 70.61 are satisfied. The PrHAs utilize dose threshold calculations to 

screen event sequences whose consequences are acceptable to all potential receptors. For 

facility workers, dose threshold calculations identified the quantity of material, known as the 

material at risk, which would result in dose consequences from radiation inhalation greater than 

the low consequence category defined in Table 5.1-1 of the LA. Sections 5.2.4 and 5.2.5 of the 

LA discuss the assessment of consequence. 

The staff review evaluated the details of each of the individual steps provided in Sections 5.2.1 

through 5.2.5 of the LA that describe the ISA methodology. Based on a systematic analysis of 

each plant process, the ISA performed identified a set of individual accident sequences or 

process upsets that could result from the hazards. The applicant's ISA methods addressed the 

following: 

• hazard identification 

• Preliminary Hazard analyses (PHA) (accident identification) 

• accident sequence construction and evaluation 

• consequence determination and comparability to 10 CFR 70.61 

• likelihood categorization for determining compliance with 10 CFR 70.61 

The staff finds that the applicant’s ISA method, method selection, and description of the specific 

methods that may be used, as described in the LA, are acceptable and are consistent with the 

provisions of SRP Section 5.4.3.2 and the requirements of 10 CFR 70.62(c)(i–vi) to conduct and 

maintain an ISA for analyzing facility hazards. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

5 - 7

5.3.2.1 Integrated Safety Analysis Change Control 

The staff reviewed the LA to determine that the applicant established and committed to 

maintaining the organization and procedures for a formal system to manage changes to the ISA. 

The staff reviewed the applicant’s commitments in the LA regarding change control for the ISA. 

Section 5.1.4 of the LA addresses control of facility changes that are associated with the ISA. 

The applicant will use the MFFF configuration management processes to maintain the ISA, ISA 

Summary, and LA to ensure that the information supporting the ISA is accurate and up to date. 

The applicant will evaluate changes to the facility and its processes for their impact on the ISA 

and LA and update the LA and ISA Summary, as needed, to ensure their continued accuracy 

and timeliness. The evaluation of the facility and process changes includes identification and 

assessment of the impact of changes to parameters used in the postulated accident sequences 

of the ISA. As described in Chapter 4 of the LA, the manager of the support services function is 

responsible for maintaining and updating the ISA, ISA Summary, and the LA. 

The applicant will address safety-significant vulnerabilities or unacceptable performance 

deficiencies in the evaluation of the proposed facility and process changes. The applicant will 

take prompt and appropriate actions to address identified vulnerabilities. The applicant will 

control facility and process changes in accordance with the following requirements: 

• A change to the facility or its processes is evaluated, as described above, before the 

change is implemented. The evaluation of the change determines, before the change is 

implemented, whether an application for an amendment to the license is required to be 

submitted in accordance with 10 CFR 70.34, “Amendment of Licenses.” 

• Both the LA and the ISA Summary describe the sites, structures, processes, systems, 

equipment, components, computer programs, and activities of personnel. Under 

10 CFR 70.72, the applicant may make changes to these items, as described in the ISA 

Summary, without prior NRC approval, if the following is true: 

– The change does not create new types of accident sequences that, unless 

mitigated or prevented, could exceed the performance requirements of 

10 CFR 70.61, and that have not previously been described in the ISA Summary. 

– The change does not use new processes, technologies, or control systems for 

which the applicant has no prior experience. 

– The change does not remove, without at least an equivalent replacement of the 

safety function, an IROFS that is listed in the ISA Summary. 

– The change does not alter an IROFS listed in the ISA Summary that is the sole 

item preventing or mitigating an accident sequence that exceeds the 

performance requirements of 10 CFR 70.61. 

– The change is not otherwise prohibited by 10 CFR 70.72, license condition, or 

order. 

If a change allowed under 10 CFR 70.72 is made, the applicant has committed to have the 

affected onsite documentation updated promptly, as required by its written procedures. The 

applicant committed to maintain records of changes to its facility consistent with the 

requirements of 10 CFR 70.72. These records include a written evaluation that provides the 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

5 - 8

bases for the determination that the changes do not require prior NRC approval under 

10 CFR 70.72(a) and 10 CFR 70.72(b). The applicant committed to ensure that these records 

are maintained until termination of the license. 

The applicant committed to have changes communicated to the NRC as follows: 

• For changes that require NRC preapproval under 10 CFR 70.72, MOX Services submits 

an amendment request to the NRC, in accordance with 10 CFR 70.34 and 

10 CFR 70.65. 

• For changes that do not require NRC preapproval under 10 CFR 70.72, MOX Services 

submits to the NRC annually, within 30 days after the end of the calendar year during 

which the changes occurred, a brief summary of the changes to the records required by 

to be maintained by 10 CFR 70.62(a)(2). 

• For changes that affect the ISA Summary, MOX Services submits to the NRC annually, 

within 30 days after the end of the calendar year during which the changes occurred, 

revised ISA Summary pages. 

The staff has reviewed the commitments and processes for facility change control associated 

with the ISA and ISA Summary. The applicant has provided the criteria for NRC preapproval of 

changes consistent with current regulations and has committed to provide a description of the 

changes on an annual basis, consistent with the requirements in 10 CFR 70.72(c) and 

10 CFR 70.72(d). The applicant has committed to promptly update onsite documentation, as 

required by 10 CFR 70.72(e). The applicant has also committed to maintain records of changes 

and will maintain these records until termination of the license, as required by 10 CFR 70.72(f). 

The staff finds that the information provided by the applicant in the LA, including the description 

of the processes and commitments relating to ISA change control, is acceptable and is 

consistent with the requirements of 10 CFR 70.72 and the guidance in SRP Section 5.4.3.2.A.ii. 

5.3.3 Integrated Safety Analysis and Integrated Safety Analysis Summary 

The purpose of the staff’s review of the ISA results, primarily as described in the ISA Summary, 

is to establish reasonable assurance that the applicant performed a comprehensive ISA of the 

MFFF and its processes using effective systematic methods and competent staff. The staff 

review verified the applicant’s commitment to identify and evaluate all hazards and credible 

accident sequences in the ISA, which involve process deviations or other events internal to the 

facility, and credible external events, which could result in consequences to the public, workers, 

or the environment of the types specified in 10 CFR 70.61. The review also determined that the 

applicant designated engineered and administrative IROFS and evaluated the set of items for 

each accident sequence which provides reasonable assurance, through preventive or mitigative 

measures, that the safety performance requirements of 10 CFR 70.61 are met. This 

determination, as provided in the SER, reflects a composite of all of the staff’s technical 

evaluations of the results included in the ISA Summary and discussed in this SER in the various 

technical chapters. This chapter will also discuss the overall conclusions regarding the contents 

of the ISA Summary and the associated regulatory requirements of 10 CFR 70.65(1–9). 

5.3.3.1 Integrated Safety Analysis Results and Summary 

The technical staff reviewed the ISA results to determine with reasonable assurance that the 

applicant had performed a systematic evaluation of the hazards and credible accident 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

5 - 9

sequences and had identified IROFS and management measures that satisfy the performance 

requirements of 10 CFR 70.61. To be acceptable, the information in the ISA Summary must 

correspond to the applicant’s ISA methods, consequence, and likelihood definitions, which are 

also described in the submittal. The applicant’s information must also show the basis and the 

results of applying these methods to each process. In addition, the applicant’s information must 

show that the methods have been properly applied in each case. 

The technical review performed by the staff included evaluation of those accidents that resulted 

in a release of radioactive material, a nuclear criticality event, or any other exposure to radiation 

resulting from use of licensed material. In addition, the technical staff reviewed accidents 

involving hazardous chemicals produced from licensed materials; that is, chemicals that are 

licensed materials, or have licensed materials as precursor compounds, or substances that 

physically or chemically interact with licensed materials and that are toxic, explosive, flammable, 

corrosive, or reactive to the extent that they endanger life or health. These include substances 

that are commingled with licensed material or are produced by a reaction with licensed material. 

The staff’s review of the ISA results provided in the ISA Summary includes the evaluation of 

whether the contents of the applicant’s ISA Summary meet the content requirements of 

10 CFR 70.65(b) and are consistent with the discussion in SRP Sections 5.4.3.2.B(i–xii) for ISA 

results and summary. In particular, these contents are described below, with the corresponding 

SRP section noted in the heading. 

Site Description (SRP Section 5.4.3.2.B.i)

As required by 10 CFR 70.65(b)(1), the site description should emphasize those factors that 

could affect safety, such as geography, meteorology (e.g., high winds and flood potential), 

seismology, demography, and nearby industrial facilities and transportation routes. The 

applicant provided a general site description in Chapter 2 of the ISA Summary. That section 

provided an overall description of the MFFF site and its environment, including regional and 

local geography, demography, meteorology, hydrology, geology, seismology, and stability of 

subsurface materials. The section also described public roads and transportation, nearby 

bodies of water, and other geographic features. Chapter 1.3 of this SER provides a detailed 

review of the site. Section 2.2 of the ISA Summary provides sufficient population information, 

based on recent census data, showing population distribution as a function of distance from the 

facility, to permit evaluation of compliance with regulatory requirements, including evaluation of 

the public consequences. Table 2.2-1 of the ISA Summary identifies the cities and towns within 

50 miles of the site and their populations. Section 1.3.1 of this SER provides the staffs analyses 

of the site description. 

The staff concludes that the requirements for a general site description, as required by 

10 CFR 70.65(b)(1) and discussed in Section 5.4.3.2.B.i of the SRP, has been met because the 

applicant provided sufficient site detail in the ISA Summary to evaluate the factors affecting 

safety. 

Facility Description (SRP Section 5.4.3.2.B.ii)

The facility description, as required by 10 CFR 70.65(b)(2), should emphasize the facility 

features that could affect potential accidents and their consequences. These features are 

facility location, facility design information, and the location and arrangement of buildings on the 

facility site. Chapter 3 of the ISA Summary describes the facility. That chapter provides the 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

5 - 10

facility civil/structure design, including the structural systems’ design description and 

requirements. The ISA Summary includes the seismic qualification of SSCs, as well as the 

qualification of process equipment structural components. Section 3.1.2 of the ISA Summary 

provides the location of the buildings, and Section 3.1.3 describes the individual buildings. 

Section 11.11 of this SER includes a detailed review of the facility description provided in the 

ISA Summary. 

The staff therefore concludes that the requirement for a facility description, as detailed by 

10 CFR 70.65(b)(2) and discussed in SRP Section 5.4.3.2.B.ii, has been met because the 

applicant provide sufficient detail in the ISA Summary to evaluate the factors that could affect 

safety regarding the facility. The detailed review of facility description can be found in Section 

11.11 of this SER. 

Processes (SRP Section 5.4.3.2.B.iii)

The description in the ISA Summary of each process analyzed as part of the ISA is required by 

10 CFR 70.65(b)(3). Specific areas reviewed include basic process function and theory, 

functions of major components and their operation, process design and equipment, and process 

operating ranges and limits. The applicant provided the process and system descriptions in 

Chapter 4 of the ISA Summary. This chapter also included design, operational, and other PSI 

to support hazard and accident analyses. The function, description, control concepts, interfaces, 

and applicable codes and standards were provided for each system. Sections 11.1 and 11.2 of 

this SER include a detailed review of the processes at the MFFF. 

The staff therefore concludes that the applicant has met the requirement to provide a 

description in the ISA Summary of each process sufficient to understand the theory of the 

process and the hazards identified for each process, as required by 10 CFR 70.65(b)(3) and 

discussed in SRP Section 5.4.3.2.B.iii. The applicant has provided sufficient detail to 

understand the process and evaluate the factors affecting process safety. The detailed review 

of facility processes can be found in Section 11.1 and 11.2 of this SER. 

Compliance Information (SRP Section 5.4.3.2.B.viii)

As required by 10 CFR 70.65(b)(4), the applicant must provide information that demonstrates 

compliance with the performance requirements of 10 CFR 70.61. In addition, 10 CFR 70.65(b) 

requires the applicant to describe in the ISA Summary how it will demonstrate that the 

10 CFR 70.61 performance requirements are met. Since the requirements of 10 CFR 70.61 are 

expressed in terms of consequences and likelihoods of events, the information should show that 

all events meet the applicant’s definitions of consequences and likelihood. The information 

provided is acceptable if it includes consequence and likelihood information for each accident 

showing that high consequence events are highly unlikely and intermediate consequence 

events are unlikely. The performance review criteria for 10 CFR 70.61 have three elements: 

(1) completeness, (2) consequences, and (3) likelihood. Completeness, as discussed in the 

SRP, refers to the fact that the applicant must address each credible event. The staff evaluates 

the completeness of the ISA Summary contents in the individual technical sections of this SER. 

Consequences refers to the magnitude of the chemical and radiological doses used by the 

applicant to categorize accidents as being of high or intermediate consequence. Likelihood, as 

discussed in the SRP, refers to the fact that 10 CFR 70.61 requires the applicant to demonstrate 

that intermediate consequence events will be unlikely and high consequence events will be 

highly unlikely. The staff also evaluates the consequence and likelihood of each accident 

sequence in the individual technical sections based on the information provided by the applicant 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

5 - 11

in Chapter 5 of the ISA Summary. Section 5.3.2 of the LA provides the accident analysis 

results. These results were separated by event type to include the following: 

• loss of confinement 

• fire 

• load handling 

• explosion 

• criticality 

• natural phenomenon 

• external manmade 

• external radiation exposure 

• chemical release 

The ISA Summary discusses each of these individual event types, including event descriptions, 

the IROFS associated with the event, a risk discussion which demonstrates that the 

performance requirements of 10 CFR 70.61 are met, and a discussion of defense in depth. For 

each event type, the ISA Summary provides tables showing the consequences for each 

accident event; a list of both engineered and administrative IROFS, including the safety function 

of each IROFS; and a summary of the event. Table 5.3-1 identifies where in this SER a 

discussion of individual ISA Summary events can be found. 

Table 5.3-1 Crosswalk to Discussions of ISA Summary Events 

ISAS Event 

Number 

Event description SER discussion 

location 

F-01 Fire in AP Process Cells 7.3.6.1 

F-02, F-04 Fire Involving Gloveboxes in the AP/MP C3 Glovebox 

Areas 

7.3.6.2 

F-03 Fire in the AP Gloveboxes with Vessels Containing 

Solvents 

7.3.6.3 

F-05 Fire in Titanium/Electrolyzer in the AP/MP C3 Glovebox 

Area 

11.2.1.3.4, 7.3.6.4 

F-06 Fire in 3013 Canister in C1 and/or C2 Areas 7.3.6.5 

F-07 Fire Event in the PuO2 Truck Bay Receiving Area 7.3.6.6 

F-08 Fire Involving Fuel Rods/Fuel Assembly 7.3.6.7 

F-09 Fire in MOX Fuel Transport Cask in C1 and/or C2 Areas 7.3.6.8 

F-10 Fires in Waste Container in C1, C2, or C3 Areas 7.3.6.9 

F-11 Fire in Transfer Container in C2 Area 7.3.6.10 

F-12 Fire Involving KWG, POE, and VHD Final HEPA Filters 7.3.6.11 

F-13 Fire outside the BMF Propagating to the inside 7.3.6.12 

F-14 Fire in Facilitywide Systems 7.3.6.13 

F-15 Fire in Facility Propagating from One Fire Area to Another 

Fire Area 

7.3.6.14 

F-16 Fire in Secured Warehouse Building 7.3.6.15 

F-17 Fire Involving Vessels Containing Solvents in C2 

Confinement Areas 

7.3.6.16 

F-18 Fire in UO2 Intermediate Storage Room in C2 Area 7.3.6.17 

F-19 Fire Event Involving Zircaloy Swarf 7.3.6.18 

F-20 Fire Event Potentially Producing Excessive Soot in a Fire 

Area Ventilated by HDE 

7.3.6.19 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

5 - 12

F-21 Fire Event in the Hydraulic Pump Room Ventilated by HDE 7.3.6.20 

LOC-1 Overtemperature 11.3.3.4.1 

LOC-2 Small Breach in Glovebox Boundary/Backflow from 

Glovebox to Utility Line 

11.3.3.4.2 

LOC-3 Leaks from AP Vessels or Pipes within Process Cells 11.7.5.1 

LOC-4 Leaks from AP Vessels or Pipes within Gloveboxes 11.7.5.2 

LOC-5 Backflow from Process Vessels through Utility Lines 11.7.5.3 

LOC-6 Rod-Handling Operations 11.6.5.15 

LOC-7 Breaches in Containers outside a Glovebox (see LH-5, LH10) 11.6.5.5, 11.6.5.10 

LOC-8 Over- or under-pressurization of a Glovebox 11.3.3.4.3 

LOC-9 Excessive Temperature due to Decay Heat from 

Radioactive Materials 

11.3.3.4.4 

LOC-10 Glovebox Dynamic Exhaust Failure 11.3.3.4.5 

LOC-11 Process Fluid Line Leak in a C3 Area outside a Glovebox 11.7.5.4 

LOC-12 Sintering Furnace Confinement Boundary Failure 11.3.3.4.6 

LOC-13 Uncontrolled Release of Nitrogen Tetroxide 11.7.5.5 

LH-01 Process Vessel Breaches as a Result of Maintenance 

Activities in AP Process Cell 

11.6.5.1 

LH-02 Load-Handling Events during Normal Operations within the 

Confinement Capabilities of the Gloveboxes 

11.6.5.2 

LH-03 Powder Jar Falls and Impacts onto the Glovebox 11.6.5.3 

LH-04 Maintenance Operations Cause a Glovebox Breach 11.6.5.4 

LH-05 3013 Container Handling Events outside of Glovebox 11.6.5.5 

LH-06 Handling Shipping Package for the 3013 Container 11.6.5.6 

LH-07 Handling of Fuel Assemblies 11.6.5.7 

LH-08 Handling of MOX Fuel Transport Cask 11.6.5.8 

LH-09 Handling of Waste Container 11.6.5.9 

LH-10 Handling of Transfer Container 11.6.5.10 

LH-11 Load Impacts to Final VHD HEPA Filter 11.6.5.11 

LH-12 Consolidated with LOC-02 11.3.3.4.2 

LH-13 Breaching of Waste Transfer Line outside MFFF Building 11.6.5.12 

LH-14 Heavy Loads or Load-Handling Equipment Damaging 

Principal Structures or Primary Confinement Boundaries of 

the MFFF Building 

11.6.5.13 

LH-15 Load-Handling of Depleted UO2 Container 11.6.5.14 

LH-16 Rod-Handling Operations 11.6.5.15 

EXP01 Hydrogen Explosion 8.1.2.4.1.1 

EXP02 Steam Overpressurization Explosion 11.1.1.2.4 

EXP03 Radiolysis Explosion 8.1.2.4.1.2 

EXP04 HAN Explosion 8.1.2.4.3.1 

EXP05 Hydrogen Peroxide Explosion 8.1.2.4.4 

EXP06 Solvent Explosion 8.1.2.4.2 

EXP07 TBP-Nitrate (Red Oils) Explosion 8.1.2.4.5 

EXP08 AP Vessel Overpressurization Explosion 11.7.6.1 

EXP09 Pressure Vessel Overpressurization Explosion 11.7.6.2 

EXP10 Hydrazoic Acid Explosion 8.1.2.4.3.2 

EXP11 Metal Azide Explosion 8.1.2.4.3.3 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

5 - 13

EXP12 Pu(VI) Oxalate Explosion 8.1.2.4.6 

EXP13 Electrolysis Related Explosion 8.1.2.4.1.3 

EXP14 Laboratory Explosion 11.10.2.1 

EXP15 Outside Explosion (outside the BMF, but on the MFFF site) 11.11.8.1 

EXP16 Miscellaneous Explosions 11.11.8.2 

EXP17 Perchlorate Explosions 8.1.2.4.1.3 

NPH-01 Earthquake Affecting the BMF, BEG/UEF, KWD, Fluid 

Transport System, and Hazardous Material Release 

11.11.6.1 

NPH-02 Tornado at the BMF, BEG/UEF, KWD, Tornado-Driven 

Missiles, and a Wind and Atmospheric Pressure Change of 

150 psf At a Rate of 55 psf/s 

11.11.6.2 

NPH-03 Severe Winds Affecting the BMF, BEG/UEF, Waste 

Transfer Lines, Extreme Winds, and Wind-Driven Missiles 

11.11.6.3 

NPH-04 External Fire Starting from NPH (see F-13) 7.1.6.12 

NPH-05 Rain, Snow, Ice Affecting the BMF, BEG/UEF, and Waste 

Transfer Lines 

11.11.6.4 

EMMH-2 External Explosions 11.11.7.1 

EMMH-3 Loss of Offsite Power 11.4.5 

EMMH-4 External Fire (see F-13) 7.1.6.12 

CRE-1 Events Involving a Release of Hazardous Chemicals Not 

Subject to 10 CFR Part 70 

8.1.2.3.2.1 

CRE-2 Events Involving a Release of Licensed Material or 

Hazardous Material Produced from Licensed Material (see 

NPH-01, NPH-02, F-16, LH-15, LOC-3, LOC-4, LOC-11, 

LOC-13, and explosion events) 

8.1.2.3.2.2 

Criticality Events Related to Criticality 6 

The staff therefore finds that, from a content perspective, the applicant has met the requirement 

in 10 CFR 70.65(b)(4) because MOX Services has demonstrated in the ISA Summary that it has 

met the 10 CFR 70.61 performance requirements for all accident sequences listed in the ISA 

Summary. The staff’s technical evaluations of the individual types of events and its review to 

confirm that the applicant’s demonstrations comply with the performance requirements and that 

the ISA methodology has been acceptably implemented is provided in each of the individual 

technical sections of this SER. 

ISA Team Qualifications (SRP Section 5.4.3.2.B.iv)

The ISA Summary describes the applicant’s ISA team qualifications required by 

10 CFR 70.65(b)(5)). The discussion of the ISA team makeup and qualifications in Section 5.2 

of the ISA Summary includes the following details: 

• The ISA team has a team leader who is formally trained and knowledgeable in the ISA 

methodology chosen for the hazard and accident evaluations. In addition, the team 

leader should have an adequate understanding of all process operations and hazards 

under evaluation, but should not be the cognizant engineer or expert for that process. 

• At least one member of the ISA team has thorough, specific, and detailed experience in 

the process under evaluation. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

5 - 14

• The team represents a variety of process design and safety experiences in those 

particular safety disciplines relevant to hazards that could credibly be present in the 

process, including, if applicable, radiation safety, nuclear criticality safety, fire protection, 

and chemical safety disciplines. 

• A manager provides overall administrative and technical direction for the ISA. 

The staff review finds that the descriptions provided by the applicant regarding the ISA 

team requirements and qualifications are sufficient to meet the 10 CFR 70.65(b)(5) 

requirement and the guidance contained in SRP Section 5.4.3.2.B.iv regarding a 

description of the team and the team qualifications. 

ISA Methods (SRP Section 5.4.3.2.B.v)

The ISA Summary describes the applicant’s ISA methods, as required by 10 CFR 70.65(b)(5). 

The applicant provided a description of the ISA process in Section 5.1 of the ISA Summary. 

Chapter 5 of the LA also provided commitments regarding the ISA methods. To ensure that all 

event sequences with consequences exceeding the low consequence threshold of 

10 CFR 70.61 meet the performance requirements identified in 10 CFR 70.61, the following 

qualitative design criteria and commitments are applied to those events and the associated 

IROFS: 

• the single-failure criterion or double contingency principle (for nuclear criticality) 

• the requirements of Appendix B, “Quality Assurance Criteria for Nuclear Power Plants 

and Fuel Reprocessing Plants,” to 10 CFR Part 50, “Domestic Licensing of Production 

and Utilization Facilities,” and NQA-1 

• industry codes and standards 

• management measures, including surveillance of IROFS (i.e., failure detection and 

repair or process shutdown capability) 

The first design criterion, application of the single-failure criterion or double-contingency 

principle, is the most important attribute in providing adequate risk reduction for event 

sequences and consequently ensuring that each respective event sequence is ultimately 

rendered highly unlikely. This design criterion ensures that even in the unlikely event of a failure 

of a single contingency, another unlikely, independent, and concurrent failure or process change 

is required before the occurrence of the event. This design criterion ensures that means are 

provided to protect against an event that could exceed the requirements of 10 CFR 70.61, 

including an inadvertent nuclear criticality. 

The single-failure criterion for MFFF requires that IROFS be capable of carrying out their 

functions given the failure of any single active component within the system or in an associated 

system that supports its operation. Multiple failures resulting from a single occurrence are 

considered to be a single failure (also referred to as a common-mode or common-cause failure). 

Application of the single-failure criterion is not required for IROFS performing a passive safety 

function (e.g., a glovebox providing confinement). The following hierarchy of controls has been 

established by the applicant regarding the application of IROFS with respect to the single failure 

criterion: 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

5 - 15

• protection by a single passive safety device, functionally tested on a predetermined 

basis 

• protection by independent and redundant active-engineered features, functionally tested 

on a predetermined basis 

• protection by a single hardware system or engineered feature, functionally tested on a 

predetermined basis 

• protection by enhanced administrative controls 

• protection by simple administrative controls 

To ensure adequate implementation of the single failure criterion, the following principles are 

applied by the applicant to the design of IROFS: 

• Redundant equipment or systems—A piece of equipment or a system is redundant if it 

duplicates the operation of another piece of equipment or system to the extent that either 

may perform the required function (either identically or similarly), regardless of the state 

of operation or failure of the other. 

• Diversity—Equipment or systems may satisfy the single-failure criterion by providing 

diverse means of performing an IROFS safety function. This diverse means of 

performing the safety function is equipment that does not duplicate the operation of 

another piece of equipment (redundancy), but still achieves the reliability required for the 

safety function. Each diverse system (e.g., means, paths, trains) or component is not 

required to provide for additional redundancy. 

• Independence—IROFS are designed to ensure that the effects of natural phenomena 

and of normal operating, maintenance, testing, and postulated accident conditions on 

redundant equipment or systems do not result in the loss of their safety function or are 

demonstrated to be acceptable on some other defined basis. 

• Separation—IROFS are separated to the extent that failure of a single system 

component, or failure or removal from service of any IROFS that is common to the other 

systems and the IROFS, leaves intact an IROFS satisfying applicable reliability, 

redundancy, and independence requirements. 

• Fail safe—IROFS are designed to fail into a safe state or into some other nonthreatening 

defined basis if conditions such as disconnection of a system, loss of energy, or loss of 

pressure occur. 

In cases in which a single active system, component, or activity of personnel is the sole IROFS 

preventing or mitigating an accident sequence that exceeds the performance requirements of 

10 CFR 70.61, a descriptive list must be provided to demonstrate that the IROFS is designed to 

perform its safety function in accordance with 10 CFR 70.65(b)(8). This may include a 

discussion of additional management measures (e.g., increased surveillance frequencies), failsafe characteristics, highly reliable components, or the application of noncredited additional 

protection features. Passive structures and components (such as buildings or tanks) are not 

designated as sole IROFS in the event that their design, or the design of any associated IROFS 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

5 - 16

passive structure or component, precludes their failure under all credible natural phenomena 

and process conditions. However, these components, if relied upon, are designated by the 

applicant as IROFS and will be constructed as quality level items. 

The second design criterion, application of the MPQAP, ensures that the requirements for 

IROFS are correctly translated into specifications, drawings, procedures, and instructions. The 

highest level of quality assurance (QL-1) and quality control are applied to all IROFS. This 

ensures a comprehensive application of quality assurance requirements covering all phases of 

the project, including the design process, configuration control; records management; 

procurement; materials control; installation; use of measurement and test equipment; and 

computer software and hardware. 

Within the MPQAP, quality assurance grading can also be used to identify the controls applied 

to IROFS and activities that support the MPQAP based upon an evaluation of the complexity 

and importance of the activity compared to quality, safety, risk, and the environment. Quality 

levels can be used to establish the level of programmatic requirements and procedural controls 

which are applied to SSCs and associated activities. The rigor of quality assurance controls is 

commensurate with, but not limited to, the following criteria: 

• the function or end use of the safety controls 

• the importance and end use of the data collected or analyzed 

• the consequence and likelihood of failure 

• the complexity or uniqueness of the design, fabrication, or implementation 

• the reproducibility of the results 

• the reliability of the process 

• the necessity for special controls or processes 

• the ability to demonstrate functional compliance with applicable regulations 

The extent of quality assurance controls applied to a safety control or activity varies as a 

function of the degree of confidence needed to achieve the desired quality. The grading 

process provides the flexibility to design and implement controls that best suit the facility or 

activity, but is not intended to reduce or in any way degrade compliance with applicable 

requirements. 

The third design criterion, application of recognized industry codes and standards, provides 

confidence in the ability of IROFS to perform their functions. The codes and standards provide 

the foundation for ensuring that IROFS are robust and incorporate lessons learned from the 

nuclear, mechanical, electrical, and instrumentation and control disciplines. They provide an 

effective set of engineering and procedural guidelines used to design, construct, and operate 

the IROFS. Application of codes and standards provides assurance that controls utilized to 

implement the single-failure criterion or double-contingency principle are sufficiently reliable. 

The fourth design criterion, application of management measures, is particularly important in the 

context of IROFS failure detection. IROFS failure detection is meant to include detection of 

IROFS failures and repair of the IROFS or the process is shutdown. As described in the SRP, 

IROFS failure detection can significantly reduce the likelihood of an accident scenario. For an 

accident scenario to proceed to completion, failure of one IROFS must occur, its failure must go 

undetected, and a second IROFS must fail. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

5 - 17

Management measures are applied to the identified IROFS to ensure that they are reliable and 

available on demand. The MPQAP specifically describes the quality assurance requirements, 

implementing procedural controls, and documentation requirements to address management 

measures as described in the SRP. The set of applied management measures consists of 

applicable elements of the following management measures programs: quality assurance, 

configuration management, maintenance, training and qualification of plant personnel, plant 

procedures, audits and assessments, incident investigations, and records management. 

Management measures are assigned based on the following types of IROFS classifications and 

the risk reduction level attributed to that particular IROFS as stated in Chapter 5 of the LA: 

• Passive Engineered Controls—A device that uses only fixed physical design features to 

maintain safe process conditions without any required human action. 

• Active Engineered Controls—A physical device that uses active sensors, electrical 

components, or moving parts to maintain safe process conditions without any required 

human action. 

• Enhanced Administrative Controls—A procedurally required or prohibited human action, 

combined with a physical device that alerts the operator that the action is needed to 

maintain safe process conditions, or otherwise adds substantial assurance of the 

required human performance (i.e., augmented administrative control). 

• Administrative Controls—A procedural human action that is prohibited or required to 

maintain safe process conditions (i.e., a simple administrative control). 

Chapter 15 of the LA provides the specific elements of the various management measure 

programs assigned to each IROFS classification. The MPQAP illustrates how management 

measures are applied to the above IROFS classifications. For the enhanced administrative 

controls, the specific management measures for the physical device are covered under the 

active engineered controls classification. 

Effective application of these well-defined qualitative criteria will ensure that event sequences 

are highly unlikely. The application of the single-failure criterion or double-contingency principle 

and IROFS failure detection ensure that multiple undetected failures are required for an 

accident sequence to proceed to conclusion. Application of appropriate codes and standards 

and an NQA-1 quality assurance program ensure that IROFS will be designed, operated, and 

maintained in a reliable manner. The application of these qualitative design criteria ensures that 

adequate risk reduction is achieved to satisfy the requirements of 10 CFR 70.61. 

In addition to the four qualitative criteria discussed in Section 5.2.6.2, the following IROFS 

characteristics and qualities are defined and documented by the applicant to ensure the 

reliability and availability of the IROFS: 

• Safety function—The credited safety function of each IROFS is stated in the safety 

evaluation in the ISA with a description of the controlled safety parameter. 

• Quality classification—IROFS are classified to the highest level of quality 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

5 - 18

• Operating range and limits—The functional range of the IROFS is ensured to 

encompass both the normal operating range and the safety limit with an acceptable 

sensitivity over this full range. 

• Emergency capabilities—Operational requirements for an IROFS under emergency 

conditions (e.g., loss of power) is identified and demonstrated to be implemented in the 

design. 

• Testing and maintenance requirements—Testing and maintenance requirements are 

specified for each IROFS, including a description of the means to detect failures, if 

available, and the applied management measures. 

• Environmental design factors—Environmental design characteristics necessary to 

ensure that the IROFS remains available and reliable to perform its safety function are 

identified for each IROFS. These characteristics account for both short-term and longterm exposures to environmental conditions potentially detrimental to the operation of an 

IROFS (such as long-term chemical degradation impacts or short-term temperature 

transient impacts). 

• Natural phenomena response—Operational requirements of an IROFS during and after 

NPHs (e.g., earthquakes) are specified. 

• Required instrumentation—Instrumentation necessary to ensure an IROFS operation is 

specified. 

• Applicable codes and standards—The design codes and standards applied to an IROFS 

(e.g., Institute of Electrical and Electronics Engineers, American Society of Mechanical 

Engineers, American Nuclear Society) are identified. 

• Reliability—IROFS are procured under a 10 CFR Part 50, Appendix B, NQA-1 quality 

assurance program. 

• Protection from fires and explosions—Fires and explosions are specifically addressed in 

separate safety evaluations. 

The following system-level parameters are also considered in the safety evaluations and the 

PSI: 

• Safety margin, a comparison of the process parameter under normal conditions with the 

parameter’s safety limit, is described. 

• The type of control—passive, active, enhanced administrative control, or administrative 

control—is noted. 

• Management measures are discussed. 

• Fail-safe position, self-announcing fault, or surveillance measures to limit down time are 

identified. 

• Failure modes, if credited, are described. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

5 - 19

• Demand rate, where specifically credited, is noted. 

• IROFS failure rate is ensured by the implementation of a 10 CFR Part 50, Appendix B, 

NQA-1 quality assurance program and commitments to industry codes and standards 

and provides confidence that IROFS are at least unlikely to fail. 

In addition to the individual qualities of each IROFS listed above, other reliability and availability 

qualities are related to the characteristics of the whole system of IROFS utilized to protect 

against an accident sequence. The following information is also addressed in the ISA safety 

evaluations and the PSI: 

• Defense-in-depth features are described. These features may include normal process 

controls that are nearly identical to IROFS controls, but with lower setpoints, that reduce 

the potential demands on the IROFS. 

• Degree of redundancy is identified. Usually, the degree of redundancy is dual, although 

diverse independent controls are sometimes used. 

• Degree of independence is specified, usually by the use of two independent controls. 

• Diversity is described, when applicable. Often diversity is not practical, in which case 

independent controls are provided. 

• Vulnerability to common-cause failure is assessed and limited by having independent or 

diverse controls. 

The MFFF Operating Limits Manual (OLM) defines IROFS operability. A system, subsystem, 

component, or device is operable or has operability when it is capable of performing its specified 

function and when all necessary support equipment required for the system, subsystem, 

component, or device to perform its specified IROFS function is also capable of performing its 

related support functions. The MFFF OLM defines operational modes, operability requirements, 

limiting conditions for operation (LCOs) and associated completion times, and required 

surveillances and frequencies. The LCO for MFFF IROFS components or systems is defined as 

the lowest functional capability or performance level of the SSCs required for safe operation. 

The MFFF OLM also defines the use of compensatory measures in coordination with the LCOs 

for an IROFS. Compliance with the LCOs ensures that the performance requirements of 

10 CFR 70.61 are met. 

The reliability and availability qualities of IROFS are assessed in the ISA safety evaluations and 

included in the PSI. These safety evaluations ensure that the IROFS are sufficient and capable 

of performing their safety functions, as described in the safety evaluations, with sufficient 

reliability and availability to ensure that each IROFS is at least unlikely to fail, thereby ensuring 

that the performance criteria of 10 CFR 70.61 are satisfied. 

The staff review of the descriptions of the methods used in the ISA finds that the applicant 

provided sufficient detail regarding the implementation of the methods to understand the 

methods applied, as well as clear documentation of the process, so that there is reasonable 

assurance that the method can be implemented in the future. The staff therefore finds that the 

applicant has met the requirements of 10 CFR 70.65(b)(5) and the guidance in SRP 

Section 5.4.3.2.B.v. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

5 - 20

IROFS Description (SRP Section 5.4.3.2.B.xi)

As required by 10 CFR 70.65(b)(6), the applicant must provide a brief list describing each 

IROFS. The ISA Summary provided detailed tables of engineered and administrative IROFS for 

each accident event analyzed by the applicant that required the application of IROFS. These 

tables, provided in Chapter 5 of the ISA Summary, contain all the events for which each IROFS 

was associated with, the safety function of the IROFS, and the applicable process units in which 

the IROFS would be implemented. The staff therefore finds that the applicant has met the 

requirements of 10 CFR 70.65(b)(6) and the guidance in SRP Section 5.4.3.2.B.xi by providing 

a list describing each IROFS in sufficient detail to understand its function in relationship to the 

performance requirements. 

Description of the Proposed Quantitative Standards (SRP Section 5.4.3.2.B.vi)

As required by 10 CFR 70.65(b)(7), the applicant must describe the quantitative standards used 

to assess the consequences to an individual from acute chemical exposure to licensed material 

or chemicals produced from licensed materials which are on-site, or expected to be on-site as 

described in 10 CFR 70.61(b)(4) and (c)(4). The applicant included the standards for chemical 

consequence levels in Chapter 5 of the ISA Summary. Chapter 8 of this SER provides a 

detailed evaluation of the acceptability of those levels. In terms of meeting the requirement to 

include the data in the ISA Summary, as required by 10 CFR 70.65(b)(7) and discussed in SRP 

Section 5.4.3.2.B.vi, the staff finds that the requirement has been acceptably met. 

Sole IROFS (SRP Section 5.4.3.2.B.xii)

The list of all IROFS that are sole IROFS is required by 10 CFR 70.65(b)(8). The applicant 

provided tables of sole IROFS in Section 5.3 of the ISA Summary for the event types that credit 

sole IROFS. The staff therefore finds that the applicant has met the requirements of 

10 CFR 70.65(b)(8) and the guidance in SRP Section 5.4.3.2.B.xii by providing lists of sole 

IROFS for the events that depend on them. 

Definitions of Likelihood (SRP Section 5.4.3.2.B.vii)

The applicant has described its definitions of unlikely, highly unlikely, and credible, as required 

by 10 CFR 70.65(b)(9). Section 5.1.2.5 of the ISA Summary provides the applicant’s definitions 

of unlikely, highly unlikely, and credible. The applicant originally proposed these definitions in 

the CA licensing phase and they were accepted by the staff in the SER for the CAR. The 

applicant used the following definitions: 

• Not Unlikely—Events that may occur during the lifetime of the facility. 

• Unlikely—Events that are not expected to occur during the lifetime of the facility or 

events originally classified as not unlikely to which sufficient IROFS are applied to further 

reduce their likelihood to an acceptable level. 

• Highly Unlikely—Events originally classified as not unlikely or unlikely to which sufficient 

IROFS are applied to further reduce their likelihood to an acceptable level. 

• Credible—Events that do not meet the definition of not credible. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

5 - 21

• Not Credible—The definition includes one of the following: 

– Natural phenomena or external manmade events with an extremely low initiating 

event frequency, conservatively estimated as less than once in a million years. 

– A process deviation that consists of a sequence of many unlikely human actions 

or errors for which there is no reason or motive and no such sequence of events 

can ever have actually happened in any fuel cycle facility. 

– Process upsets for which there is a convincing argument, based on physical 

laws, that are not possible or are unquestionably extremely unlikely. 

The applicant described these likelihood definitions in a manner such that the application of 

these definitions will ensure that the performance requirements of 10 CFR 70.61 are satisfied. 

These definitions and methodology rely on specific identifiable characteristics of the process 

design that may affect the likelihood of an accident sequence, rather than subjective judgments 

of adequacy. In applying the above definitions to address the performance requirements of 

10 CFR 70.61, initiating events are assumed to be not unlikely. Postulated credible 

intermediate or high consequence events are made highly unlikely based on the application of 

IROFS features or controls without crediting the likelihood of the initiating event. 

The staff review finds that the definitions provided in the ISA Summary are consistent with the 

definitions previously approved by the staff and meet the requirements of 10 CFR 70.65(b)(9) 

and the guidance in SRP Section 5.4.3.2.B.vii by inclusion in the ISA Summary. 

5.3.4 Baseline Design Criteria 

The information demonstrating compliance with the baseline design criteria, required by 

10 CFR 70.64(a)(1–5) and 10 CFR 70.64(a)(7–10) for new facilities and by 10 CFR 70.65(b)(4), 

is found in the individual technical sections of the ISA Summary. The technical sections of this 

SER provide the detailed review by the staff of the 10 CFR 70.64 requirements. The applicant 

has committed to evaluate baseline design criteria as described in the ISA methodology 

provided in Chapter 5 of the LA and Chapter 5 of the ISA Summary. The staff review therefore 

finds that the applicant’s commitment to apply baseline design criteria in performing an ISA 

meets the requirement in 10 CFR 70.65(b)(4) and is therefore acceptable. 

5.4 Evaluation Findings

The staff performed a review of the ISA programmatic commitments, as described in the LA, 

and for the ISA results, as described in the ISA Summary. The review was coordinated with 

other technical staff reviewers to ensure consistency between the review conducted in this 

chapter and the review conducted in other chapters. The review was also coordinated with the 

staff reviewing quality assurance and management measures to ensure that the review of the 

MPQAP and the applicant’s proposed management practices are consistent with the material 

submitted in Chapter 15 of the LA. 

The staff conducted its review of the ISA programmatic commitments in the LA and ISA 

Summary for the MFFF to possess and use special nuclear material in accordance with the 

guidance provided in Chapter 5.0 of the SRP. The staff confirmed that the applicant’s LA 

contains appropriate commitments, including commitments to (1) perform and maintain an ISA, 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

5 - 22

(2) compile and maintain PSI, (3) engage personnel with appropriate training to conduct the 

ISA, (4) use appropriate methods to conduct the ISA, and (5) implement appropriate measures 

and procedures to ensure that the ISA stays accurate and up to date. 

The staff has also verified that the applicant performed an ISA to identify and evaluate the 

hazards and potential accidents associated with the facility and to establish engineered and 

administrative controls to ensure that facility operation will be within the bounds of the 

10 CFR 70.61 performance requirements. The staff confirmed that the applicant’s ISA 

Summary (1) identified the hazards at the facility, (2) analyzed for accident sequences through 

the use of process hazards analysis, (3) evaluated and assigned consequences to the accident 

sequences, and (4) evaluated the likelihood of each accident consistent with the guidance in the 

SRP. Moreover, the applicant identified all IROFS, including administrative and engineered 

controls, and provided a listing of these controls, including sole IROFS, in its ISA Summary. As 

a result, the NRC staff has concluded that there is reasonable assurance that the applicant’s 

postulated accidents resulting from the facility hazards that may be anticipated to occur should 

be in compliance with the performance requirements of 10 CFR 70.61. 

The staff further concludes that the identification and evaluation of the hazards and accidents as 

part of the ISA and establishment of controls to maintain safe facility operation from their 

consequences meet the requirements for a license to possess and use special nuclear material 

under 10 CFR Part 70 and provide reasonable assurance that the health and safety of the 

public, the workers, and the environment will be adequately protected. 

REFERENCES 

(MOX, 2010a) Shaw Areva MOX Services, “MFFF—License Application,” Aiken, SC, March 

2010. 

(MOX, 2010b) Shaw Areva MOX Services, “MFFF— Integrated Safety Analysis Summary,” 

Aiken, SC, March 2010. 

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, AStandard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” Washington, 

DC, August 2000. 

(NRC, 2005) U.S. Nuclear Regulatory Commission, NUREG-1821, “Final Safety Evaluation 

Report on the Construction Authorization Request for the Mixed Oxide Fuel Fabrication Facility 

at the Savannah River Site, South Carolina,” Washington, DC, March 2005. 

(NRC, 2009) U.S. Nuclear Regulatory Commission, “Safety Evaluation Report of the MPQAP,” 

Washington DC, April 2010. 

(AICHE 1992) American Institute of Chemical Engineers, Center for Chemical Process Safety, 

“Guidelines for Hazard Evaluation Procedures—Second Edition—With Worked Examples,” 

New York, NY, 1992. 

(NRC, 1999) U.S. Nuclear Regulatory Commission, NUREG-1513, “Integrated Safety Analysis 

Guidance Document,” Washington, DC, 1999. 

10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

5 – 23

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

10 CFR Part 70, Domestic Licensing of Special Nuclear Material.
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

6 – 1

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

6.0 NUCLEAR CRITICALITY SAFETY

6.1 License Application Review

This chapter of the safety evaluation report (SER) contains the U.S. Nuclear Regulatory 

Commission (NRC) staff’s review of the nuclear criticality safety (NCS) program described by 

the applicant, Shaw AREVA MOX Services (MOX Services), in Chapter 6 of the license 

application (LA) (MOX, 2010a), Section 5.3.7 of the Integrated Safety Analysis (ISA) Summary 

(MOX, 2010b), and other supporting documents that the staff evaluated during in-office reviews 

at the applicant’s facilities.

6.1.1 Organization and Administration

Section 6.1 of the LA discusses the nuclear criticality safety organization and administration at 

the Mixed Oxide Fuel Fabrication Facility (MFFF), including the technical qualifications, training, 

and experience of the applicant and its staff to engage in NCS activities. The applicant’s 

organizational commitments include designating organizational functions important to criticality 

safety, assigning responsibility and authority to these positions to carry out NCS functions, and 

stating the requirements for the qualification of NCS personnel. The NCS organization is 

administratively independent of production responsibilities and has the authority and 

responsibility to shut down potentially unsafe MFFF operations. Specific responsibilities of the 

NCS organization and its personnel include the following:

• Establish the NCS Program, including design criteria, procedures, and training.

• Provide NCS support for ISA and configuration control.

• Assess normal and credible abnormal conditions.

• Determine criticality safety limits for controlled parameters.

• Develop and validate methods to support nuclear criticality safety evaluations (NCSEs).

• Perform criticality safety calculations and prepare NCSEs.

• Review and approve proposed changes in process conditions or equipment involving 

fissionable material as part of the MFFF configuration management and design change 

process to determine whether the facility changes require prior NRC approval in 

accordance with the criteria of Title 10 of the Code of Federal Regulations 

(10 CFR) 70.72, “Facility Change Process.”

• Specify NCS control requirements and functionality.

• Review and approve MFFF operations and operating procedures that involve fissionable 

material.

• Support emergency response planning and events.
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 2 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

• Assess the effectiveness of the NCS Program through the audit and assessment 

program. 

• Identify NCS posting requirements that provide administrative controls for operators in 

applicable work areas. 

• Maintain NCS programs for the MFFF in accordance with applicable regulatory guides 

(RGs) and industry standards. 

• Serve as the single point of contact for nuclear criticality issues with internal and external 

groups or agencies, coordinating with and taking direction from the manager of the 

regulatory function. 

The manager of the environmental safety and health (ES&H) licensing function is independent 

of the production function and is directly responsible for the health, safety, and environmental 

functions, including fire safety, radiation protection, chemical safety, criticality safety, nuclear 

safety analysis, and environmental protection. The ES&H licensing manager reports directly to 

the President of MOX Services. The ES&H licensing manager is responsible for maintaining the 

MOX Services special nuclear material (SNM) possession and use license, planning and 

executing licensing and regulatory compliance activities, maintaining licensing-related 

documents, and interfacing with the NRC and other regulatory agencies regarding licensing 

matters. These functions are accomplished by delegating and assigning responsibility to 

qualified personnel. In addition, the manager of the ES&H licensing function has the authority to 

make commitments to the NRC. 

The NCS organization reports to the manager of the ES&H licensing function. The NCS 

organization commits to implement the applicable NCS practices of American National 

Standards Institute/American Nuclear Society (ANSI/ANS)-8.1-1998, “Nuclear Criticality Safety 

in Operations with Fissionable Materials Outside Reactors.” The NCS organization also 

commits to implement the NCS administrative practices, as described in ANSI/ANS-8.19-2005, 

“Administrative Practices for Nuclear Criticality Safety.” 

The manager of the NCS function has the authority and responsibility to assign and direct 

activities associated with the NCS function. Senior NCS engineers have the authority and 

responsibility to conduct activities assigned to the criticality safety function, as directed by the 

manager of the NCS function. NCS engineers have the authority and responsibility to conduct 

activities assigned to the criticality safety function, with the exception of independent verification 

of NCSEs. 

The minimum requirements for the manager of the NCS function are a baccalaureate degree, or 

equivalent, with a science or engineering emphasis and 3 years of nuclear industry experience 

in criticality safety. The manager of the NCS function has appropriate knowledge of NCS and 

its administration. The minimum requirements for a senior NCS engineer are a baccalaureate 

degree, or equivalent, with a science or engineering emphasis and 3 years of nuclear industry 

experience in criticality safety. Senior NCS engineers have the authority and responsibility to 

conduct activities assigned to the criticality safety function, as directed by the manager of the 

NCS function. The minimum requirements for an NCS engineer are a baccalaureate degree, or 

equivalent, with a science or engineering emphasis and 1 year of nuclear industry experience in 

criticality safety. NCS engineers have the authority and responsibility to conduct activities 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 3 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

assigned to the criticality safety function, with the exception of independent verification of 

NCSEs. 

The staff has reviewed the MFFF NCS organizational structure and finds it acceptable because 

the NCS organization is independent of the production staff, education and experience levels for 

NCS staff members are sufficient to provide the requisite skills and knowledge to perform their 

technical duties, and the NCS organization is consistent with the requirements in ANSI/ANS8.19-2005. The staff finds that the commitments in this section are consistent with the guidance 

in Section 6.4.3.1 of NUREG-1718, “Standard Review Plan for the Review of an Application for 

a Mixed Oxide (MOX) Fuel Fabrication Facility,” issued August 2000, and with standard industry 

practice.2

 Therefore, the applicant’s commitments are acceptable to the staff. 

6.1.2 Management Measures 

MFFF maintains several programs, systems, and functions to ensure that all items relied on for 

safety (IROFS) will be available and reliable, will remain available and reliable, and will be under 

surveillance for malfunction detection and appropriate corrective action. These management 

measures include training, audits and assessments, and procedures. 

The applicant commits in Chapter 6 of the LA to implement the training requirements of 

ANSI/ANS-8.19-2005 and ANSI/ANS-8.20-1991 (R1999), “Nuclear Criticality Safety Training,” at 

the MFFF. The training is appropriately tailored to the staff’s function within the MFFF. 

In addition, the MFFF NCS staff develops the following: 

• NCS training that includes facility, materials, operations, methodologies, design 

solutions, work stations, and storage locations that provide operators with knowledge 

and rules to ensure that MFFF maintains the nuclear safety margin. 

• instructions regarding the use of process variables for NCS control, when controls on 

such parameters are credited for NCS (e.g., IROFS) 

• training that includes the policy to identify NCS posting requirements for administrative 

controls that provide operators with references for ensuring conformance and safe 

operation 

• training associated with the operation of plutonium containing systems to prevent 

criticality events 

The applicant conducts program and process assessments to compare established NCS 

standards to MFFF performance. The assessments take the form of program audits and 

compliance inspections. MOX Services commits to meet the requirements of ANSI/ANS-8-19-

2005, as they relate to audits and assessments. 

 

2 In the context of this chapter of the SER, “standard industry practices” refer to historical NCS good practices, 

as described in industry consensus standards (e.g., ANSI/ANS-8.1-1998 and ANSI/ANS-8.19-2005), 

industry-accepted handbooks and safety guides, regulatory guidance, and commitments in fuel facility 

licenses and internal documents. Standard industry practices encompass organization and administration of 

the NCS Program, management measures, and technical practices.
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 4 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

The NCS Program will be evaluated annually by either periodic audits or assessments. At a 

minimum, regularly scheduled internal audits of the NCS functional area quality-affecting 

activities will be performed at least once every 2 years. The frequency for audits of operational 

phase IROFS-related activities will be based on a risk-informed methodology determination 

which will consider the safety significance of the activity and the results of the ISA or 

performance history, or both, so that each area is evaluated annually (assessment or audit) and 

audited at least once every 2 years. Personnel conducting audits will be independent of the 

direct responsibility for performing the work being audited. 

The applicant will conduct and document periodic walkthroughs of all areas or activities 

involving fissile material operations weekly. The frequency for walkthroughs, if less than 

weekly, will be based on a risk-informed methodology determination which will consider the 

safety significance of the activity, results of the ISA, and performance history. The manager of 

the NCS function may utilize a risk-informed methodology determination based upon the 

compliance results of these evaluations to increase or decrease the scheduled frequency of 

these reviews or the scope of the evaluations. The evaluations are documented (e.g., by a 

checklist). Identified weaknesses are incorporated into the MFFF Corrective Action Program 

and are promptly and effectively resolved. 

The applicant established and implemented NCS procedures in accordance with ANSI/ANS8.19-2005 such that the double contingency principle is maintained. NCS posting requirements 

at the MFFF identify administrative controls applicable and appropriate to the activity or area. 

NCS procedures and postings are controlled to ensure that they are maintained current. 

Procedures and their implementation are reviewed periodically, but at least once every 2 years, 

to ascertain that procedures are being followed and that process conditions have not been 

altered to adversely affect NCS requirements or controls. The frequency for procedure reviews, 

if less than annually, will be based on a risk-informed methodology determination which will 

consider the safety significance of the activity, results of the ISA, and performance history. 

MFFF staff knowledgeable in NCS conduct the reviews, in consultation with operating 

personnel. 

The staff has reviewed the applicant’s commitments to NCS management measures and finds 

that they are acceptable because the applicant commits to (1) provide training to personnel, 

(2) conduct activities involving SNM with written and approved procedures, (3) conduct NCS 

walkdowns using a graded approach based on the ISA, (4) conduct NCS audits such that all 

processes and all aspects of the program are audited within 2 years, and (5) evaluate 

procedures to ensure that they consider the double contingency principle. The staff finds that 

the commitments in this section are consistent with the guidance in Section 6.4.3.2 of NUREG1718 and standard industry practice. Therefore, the applicant’s commitments are acceptable to 

the staff. 

6.1.3 Technical Practices 

The technical practices, as described in LA Section 6.4, describe the applicant’s methodology 

for performing NCSEs and their supporting calculations, selecting and controlling the criticality 

controlled parameters (i.e., criticality control modes), and validating calculational techniques 

used to derive subcritical limits on those parameters. Significant aspects of these technical 

practices were used in designing the facility, and the NRC staff examined these practices during 

its review of the construction authorization review (CAR) (DCS, 2005). The following sections 

discuss those aspects unique to the operation of the MFFF. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 5 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

6.1.3.1 Nuclear Criticality Safety Evaluations and Analytical Methodology 

LA Section 6.4.1 discusses the criteria for determining when an NCSE is needed, the process 

for developing NCSEs, and the contents of NCSEs. NCSEs are required whenever a facility 

system or component containing fissile material is designed or modified so as to potentially 

affect credible criticality sequences. Determining whether an NCSE is required will involve an 

evaluation of all changes to a fissile material process to assess whether the potential exists to 

change or create an accident sequence leading to criticality. Changes having no potential 

criticality consequences do not need controls to be established and thus do not require an 

NCSE. 

The described process for developing and approving NCSEs includes performance by qualified 

individuals, peer review, and approval by the NCS manager and affected line organizations. 

The described process is consistent with the guidance in Section 6.4.3.1 of NUREG-1718 and 

standard industry practice and is therefore acceptable to the staff. NCSEs will provide the basis 

for meeting the double contingency principle and ensuring that processes are subcritical under 

normal and credible abnormal conditions (as required by 10 CFR 70.61(d)). The NCSEs will 

also demonstrate that accident sequences leading to criticality will be highly unlikely (as 

required by 10 CFR 70.61(b)). The ISA will designate all criticality controls relied on to meet the 

above requirements as IROFS. (For a detailed discussion of the role that NCSEs play in 

performance of the ISA, see Section 6.2 of this SER.) 

The selection of controls and controlled parameters follows a preferential hierarchy: passive 

controls are preferred over active engineered and engineered controls are preferred over 

administrative controls. The use of geometry control (in some instances in conjunction with 

neutron absorbers) is preferred. Controls are established to maintain parameters within their 

safety limits under normal and credible abnormal conditions. In response to Request for 

Additional Information (RAI) NCS-173

 (NRC, 2008e), the applicant explained that sufficient 

controls and defense in depth will be employed to prevent the loss of controlled parameters. 

The applicant provided a practical example of a failure of the nonsafety control system, which 

could lead the system to attempt to overfill a jar, and even though one of the redundant IROFS 

safety systems could hypothetically fail, the other redundant IROFS would prevent overfilling of 

the jar and exceeding the mass limit. In other words, the two redundant IROFS provide defense 

in depth against exceeding the parameter under normal (typified by the nonsafety system 

failure) or abnormal (typified by the IROFS failure) conditions. In this case, even if the mass 

limit were to be exceeded, a loss of moderation control would also be required before criticality 

could become possible. Thus, the example does not mean that compliance with the double 

contingency principle would be based on a single parameter (which would violate the principle 

of diversity), but that dual controls are established on each parameter to ensure that its loss is 

sufficiently unlikely. For criticality parameters that are not controlled, or were controlled and 

then failed, the evaluation assumed optimum or worst-credible conditions. The applicant 

defined “worst-credible conditions” to mean the most reactive conditions that can reasonably be 

expected to occur without the need for any formal controls. An example would be the assumed 

maximum densities of different reference fissile materials based on experimental and historical 

evidence (e.g., it is not credible that unsintered powder would have densities in excess of 

7 grams per cubic centimeter (g/cc)). The applicant’s use of a preferential hierarchy, defensein-depth practices, and conservative assumptions with regard to controlled parameter values is 

 

3

 The reference section of this chapter of the SER (i.e., Section 6.4) includes the NRC’s RAIs. Criticality 

safety-related RAIs are numbered sequentially and designated by the prefix “NCS.” RAIs NCS-01 through 

NCS-60 are related to the LA review, and RAIs NCS-61 through NCS-96 are related to the ISA Summary 

review.
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 6 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

consistent with the guidance in Section 6.4.3.3.2 of NUREG-1718 and standard industry 

practices. Therefore, the applicant’s approach is acceptable to the staff. 

6.1.3.2 Criticality Controls and Controlled Parameters 

LA Section 6.4.4 reiterates the preferential control hierarchy (adding the preference for 

enhanced over simple administrative controls), lists the 13 criticality parameters, and provides 

some general guidance for their use. LA Sections 6.4.4.1–6.4.4.13 list specific commitments 

applicable to each of the 13 parameters. 

LA Section 6.4.4 states that MOX Services will follow the preferential control hierarchy “to the 

extent practical.” In response to RAI NCS-21, the applicant stated that it meant that it would 

follow the hierarchy whenever practicable, given the nature of the process. As an example, the 

applicant explained that geometry control cannot be used in powder operations for sequences 

involving spills because the initiating event is caused by a loss of equipment geometry. In 

addition, laboratory, waste, and maintenance operations cannot practically be controlled by 

passive or active engineered means. Dual active controls on mass are used to detect powder 

spills, and manual processes are controlled by administrative means. During the CAR review, 

the staff evaluated the applicant’s criticality control strategy (the dominant controlled 

parameters) for each of the major process units and determined that this strategy was 

consistent with standard industry practice for establishing controls for similar operations (as 

documented in Sections 6.1.3.4.1 and 6.1.3.4.2 of NUREG-1821, “Final Safety Evaluation 

Report on the Construction Authorization Request for the Mixed Oxide Fuel Fabrication Facility 

at the Savannah River Site, South Carolina,” issued March 2005 (NRC, 2005a). The staff has 

similarly determined that the detailed facility design, including specifically the choice of 

controlled parameters, the means of controlling them, and the implementation of the double 

contingency principle, complies with the approach outlined in the CAR and is consistent with the 

guidance in Section 6.4.3.3 of NUREG-1718 and standard industry practice (for a more detailed 

discussion, see Section 6.2 of this SER). 

For each of the 13 controlled parameters, tolerances are conservatively taken into account in 

establishing operating limits and controls. The applicant has committed to develop an operating 

limits manual, which will take process variability and uncertainties, including instrument errors, 

into account in accordance with standard industry practices (e.g., industry standards for setpoint 

determination). The staff has determined that correct implementation of these commitments will 

provide reasonable assurance of safety during operations. The NRC staff will verify completion 

of the operating limits manual as part of the verification of the principal structures, systems, and 

components (PSSCs), as required by 10 CFR 70.23(a)(8) and as discussed in Chapter 1 of this 

SER.4

 The applicant performed sensitivity studies to demonstrate that processes will be 

subcritical under all credible conditions. Sections 6.4.4.1–6.4.4.13 of the LA further supports 

this approach, stating that “limits are established in a manner that ensures an adequate margin 

of subcriticality (including margins to protect against uncertainties in process variables and 

against limits being accidentally exceeded).” The staff’s review of criticality calculations, as part 

of the ISA Summary review (see Section 6.2 of this SER), indicated that facility calculations took 

process variability and uncertainty into account and modeled the most reactive combination of 

geometric and material tolerances. This approach is consistent with the guidance in 

 

4

 The relevant PSSC for criticality safety is “criticality control,” which consists of all measures relied on to meet 

the performance requirements of 10 CFR 70.61(b) and 10 CFR 70.61(d) and the double contingency 

principle of 10 CFR 70.64(a)(9) (i.e., all criticality safety-related IROFS). 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 7 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

Sections 6.4.3.3.1 and 6.4.3.3.2 of NUREG 1718 and standard industry practice. Therefore, the 

applicant’s approach is acceptable to the staff. 

LA Sections 6.4.4.1–6.4.4.13 discuss each of the 13 controlled parameters individually. For 

each parameter, the LA specifies the values included in the calculations, as well as the 

acceptance criteria for implementing parameter controls in the field. The staff reviewed these 

criteria against those in Section 6.4.3.3.2 of NUREG-1718 and determined that they were 

consistent with NUREG-1718 and with standard industry practice. Where ANSI/ANS-8 series 

standards endorsed in RG 3.71, Revision 1, “Nuclear Criticality Safety Standards for Fuels and 

Material Facilities,” issued October 2005 (NRC, 2005b), apply to a particular parameter (e.g., 

moderation, neutron absorbers), the applicant has committed to follow all “shall” statements in 

the standard. The NCSEs and the ISA Summary will control the process variables by setting 

limits that can affect the value of controlled parameters. Limits will be derived using validated 

criticality calculational methods, rather than standards or handbooks (with the exception of 

mass—mass limits given in standards and handbooks are typically derived using very 

conservative assumptions including spherical geometry, optimum moderation, and full 

reflection). Specific issues regarding the individual parameters are discussed below. 

The applicant stated in LA Section 6.4.4.4 that “determination of isotopic content is based on 

compliance with the double contingency principle.” The fact that incoming feed material has an 

isotopic composition within certain ranges is a key bounding assumption upon which all of the 

criticality safety analyses and ISA assume. MOX Services explained in its response to 

RAI NCS-28 (NRC, 2009c) that it will verify the isotopic vector by two independent isotopic 

measurements whenever less than the bounding isotopic content is assumed. This approach is 

the same as that used when a criticality accident sequence relies on a single parameter that 

must be administratively controlled (such as reliance on dual concentration or density controls). 

The NRC staff reviewed the implementation of dual sampling for such controls during its ISA 

review (see Section 6.2 of this SER). 

Some parametric limits are properties of the incoming pit disassembly and conversion facility 

(PDCF) or alternate feedstock (AFS) material, and as such, constitute global assumptions that 

apply to numerous processes and accident sequences. These assumptions are not generally 

repeated explicitly for each accident sequence. The main parametric limits of this kind include 

specifications for the isotopic vector (abundance of the various plutonium isotopes, 235U 

enrichment, and the ratio of uranium to plutonium (U/Pu)) and the density, moderation, and level 

of chemical impurities of received feed powder. 

 

 

The staff reviewed the applicant’s approach for ensuring that incoming feed material would be 

within the required specifications, as described in its response to RAI NCS-29 (NRC, 2009c). 

The vendor for the feedstock, the U.S. Department of Energy (DOE), will be required to undergo 

a qualification audit to ensure that its quality assurance plan meets the applicable requirements 

of Appendix B, “Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing 

Plants,” to 10 CFR Part 50, “Domestic Licensing of Production and Utilization Facilities,” and 

nuclear quality assurance (NQA-1), as well as periodic performance evaluations and audits. 

The applicant will perform surveillance testing of the incoming feed material during the first 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 8 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

production run, and again after 6 months. Further surveillance will depend on these initial 

results. An interface control document will specify the requirements for DOE to perform its own 

testing of the product to be supplied to the MFFF and the contents of the documentation 

provided along with the material. The exact details of these requirements, including how 

compliance with the double contingency principle will demonstrated, have not yet been 

determined. The staff will verify completion of the requirements for ensuring that the vendor will 

comply with bounding specifications for the incoming feed material, consistent with the double 

contingency principle, as part of the verification of the PSSCs. 

Besides performing periodic audits of the vendor’s quality assurance program, the applicant will 

also independently confirm certain credited characteristics of the material. Some of the 

aforementioned characteristics—notably the moisture content—cannot be measured before 

opening the cans. Before measurement, the vendor’s quality assurance program will be the 

primary means of ensuring that the material is within specifications. However, the 3013 cans 

are of robust construction and the analysis done in developing the 3013 standard showed the 

cans to be safe (i.e., the cans have been analyzed safe from a criticality perspective) under 

worst-case conditions, so the risk of criticality is negligible until the material is introduced into 

the process (by which time the measurements will have been performed). Nevertheless, the 

applicant stated that it will independently confirm the fissile content of incoming material (which, 

in conjunction with can weight or calorimetric measurements, will provide the plutonium isotopic 

ratio) using gamma spectroscopy. X ray measurements of the level within the cans, in 

conjunction with can weight, will be used to determine the density of unopened cans. The 

impurity level of the material will be determined using nondestructive analysis (NDA) 

measurements, with any weight unaccounted for conservatively assumed to be chemical 

impurities. 

The staff reviewed the results of preliminary tests of the density measurement methodology 

(NRC, 2010a) and finds that there is reasonable assurance that the applicant will be able to 

determine that material is within required specifications. The staff concluded that license 

commitments with regard to measurement of these specifications represented a valid approach. 

However, the applicant stated that it would confirm final acceptability of its measurement 

techniques during startup testing. This includes calibrating the NDA measurements to confirm 

the mass and isotopic characteristic of incoming feed material, which must be verified because 

of the different isotopic characteristics between the MFFF (PDCF and AFS) feed material and 

the reference plant material. The staff will confirm completion of methods for independently 

verifying the acceptability of incoming feed material (including demonstration of the feasibility of 

measurement methods) as part of the verification of the PSSCs. 

With regard to the applicant’s commitments concerning reflection control in LA Section 6.4.4.5, 

the staff asked the applicant to explain the kinds of conditions that constitute a loss of reflection 

control. Statements in the ISA Summary referred to a loss of reflection control as involving “leak 

of a process material achieving an unsafe volume” and “leak of solution that could provide 

additional reflection of fissile bearing process equipment.” In its written response to RAI NCS30 (NRC, 2009c) and subsequent verbal discussions, the applicant clarified that loss of 

reflection control involved only leaks from pipes with nonfissile liquids; leaks of fissile solutions 

would typically involve a loss of geometry control. The applicant also clarified in its responses 

to RAIs NCS-31 and NCS-32 (NRC, 2009c) that “sufficient water reflection” meant that (1) at a 

minimum, a 1-inch (2.5-centimeter) tight-fitting water jacket would be assumed to bound 

transient reflection, such as personnel, when reflection is controlled, and (2) a 12-inch 

(30-centimeter) tight-fitting water jacket would be assumed when reflection was not controlled. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 9 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

These criteria are consistent with the guidance in Section 6.4.3.3.2.5 of NUREG-1718 and 

standard industry practice. Therefore, the applicant’s criteria are acceptable to the staff. 

 

The applicant made statements in LA Section 6.4.4.6 concerning “restrictions placed on the use 

of moderating materials” as fire suppressants and observed that “the effect of credible fire 

events and the consequences associated with the potential use of moderating material in 

mitigating such fires are evaluated.” In its response to RAI NCS-36 (NRC, 2009c), the applicant 

noted that LA Section 7.3.3.1 states, “Due to nuclear criticality safety concerns, hydrogenous 

material (e.g., water) is not used as a suppression agent in process rooms and in areas that 

contain nuclear material.” The applicant clarified that its intent is to prohibit hydrogenous 

material in such areas and provided a cross-reference to LA Section 7.3.3.1 in Section 6.4.4.6 

to further clarify its commitment. 

The applicant stated in LA Section 6.4.4.7 that, “When sampling of the concentration is 

specified, a program based on dual independent sampling and analysis using independent 

verification sampling methods using two people is implemented.” In its response to RAI NCS-39 

(NRC, 2009c), the applicant clarified that these conditions applied when concentration sampling 

alone was relied on to meet the double contingency principle. The review of the ISA Summary 

showed that, when the basis of criticality safety included concentration control, the two legs of 

double contingency were generally redundant sampling controls. Section 6.2 of this SER 

discusses the staff’s review of the applicant’s dual sampling methods. The applicant included a 

reference to its Long-Term Fissile Material Accumulation Program (LTFMAP) as part of its 

response to RAI NCS-40 (NRC, 2009c). This program consists of non-IROFS radiation 

monitoring to detect long-term accumulation that could eventually result in overconcentration in 

process tanks. 

In LA Section 6.4.4.10, the staff noted that single-parameter volume limits are based upon 

worst-case geometry and material composition (unless these parameters are controlled by 

IROFS). The staff noted that, unlike the discussion for other parameters, this section did not 

state that worst-case moderation and conservative reflection conditions would be used. 

However, the staff considers this to be addressed by the general commitment that “optimum or 

worst-credible conditions are assumed for parameters unless they are specifically controlled” 

(LA Section 6.4.4). The discussion of single-parameter limits also does not mention a specific 

percentage of the critical volume to be used, as included in Section 6.4.3.3.2.2 of NUREG-1718. 

However, in its response to RAI NCS-43 (NRC, 2009c), the applicant stated that singleparameter limits will be based on explicit calculations (which are required to be validated). The 

use of critical values from standards and handbooks, with appropriate margin, is one acceptable 

method of ensuring subcriticality; the use of validated calculational methods, with appropriate 

margin, is another. Therefore, the lack of specific margins in the volume limits discussion is 

acceptable, based on the applicant’s commitment to perform explicit calculations that are 

subject to NRC staff review. 

LA Section 6.4.4.10 concerned process variable control for criticality safety. The staff had 

asked the applicant to provide examples of what constituted process variable control. In its 

response to RAI NCS-46 (NRC, 2009c), the applicant stated that it did not currently rely on 

process variable control and therefore could not provide any specific examples. There were 

several cases in the ISA in which parameters other than the standard 13 were controlled for 

criticality safety (e.g., temperature and nitric acid pH for polymerization prevention, furnace 

temperature, reagent addition controls). However, in each case, the process variable was tied 

to one of the standard 13 parameters. The temperature and acidity of plutonyl nitrate was 

credited with maintaining the physicochemical form of the material as a solution. The furnace 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 10 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

temperature was credited with controlling the moderation level in PuO2 or MOX product. 

Reagent addition controls were credited with controlling concentration, physicochemical form, 

and other parameters. Control over those process variables that can affect other controlled 

parameters is essential to ensure that all processes will be subcritical under normal and credible 

abnormal conditions. To this end, the applicant has committed (in each applicable section 

which discusses one of the other controlled parameters) that, when process variables can affect 

one of the other controlled parameters, they are defined and controlled as IROFS in the NCSEs 

and ISA Summary. 

The staff finds that the applicant’s approach to implementing criticality controls and limits on 

controlled parameters is consistent with standard industry practice and the guidance in 

Sections 6.4.3.3.2.0 through 6.4.3.3.2.12 of NUREG-1718. Therefore, the approach is 

acceptable to the staff. 

6.1.3.3 Requirements in 10 CFR 70.24, “Criticality Accident Requirements” 

LA Section 6.3 describes the criticality accident alarm system (CAAS) as a monitoring system 

composed of groups of detectors called monitoring units that will activate audible and visual 

alarms in case of a criticality accident. The evaluation of the effectiveness of CAAS detectors 

(detection criteria and location/spacing) takes into account the effect of existing shielding. 

CAAS detector coverage is determined using three-dimensional radiation transport codes. The 

CAAS is designed to detect both gamma and neutron radiation and to actuate within one-half 

second of detector recognition of a criticality accident. The range and design features of the 

alarm will also follow the guidance provided in ANSI/ANS-8.3-1997 (R2003), “Criticality Accident 

Alarm System.” The applicant maintains a CAAS consistent with the requirements of 

10 CFR 70.24 and ANSI/ANS-8.3-1997 (R2003) (as endorsed by RG 3.71, Revision 1). 

The applicant maintains a CAAS that is designed to remain operational in the event of a seismic 

shock equivalent to the MFFF design-basis earthquake. CAAS components are protected so as 

to reduce the potential for damage in case of fire, explosion, corrosive atmosphere, or other 

probable extreme conditions. The CAAS is designed to reduce the potential of failure, including 

false alarms, and provides a visual or audible warning signal to indicate system malfunction or 

the loss of primary power. 

If the CAAS system becomes unavailable, the allowable number of hours during which CAAS 

system coverage is not available is determined on a process-by-process basis. The MFFF will 

maintain safe operations by immediately implementing compensatory measures (e.g., limit 

personnel access, halt SNM movement or activities) as necessary when the CAAS system is 

unavailable or significantly degraded, as approved by the NCS function. 

The MFFF staff maintains an emergency procedure which covers the entire facility, including 

locations where licensed SNM is handled, used, or stored, to ensure that personnel can be 

withdrawn to a safe area upon the actuation of the CAAS alarm notification. The nuclear 

criticality accident onsite emergency planning and response for the MFFF staff follows the 

guidance in ANSI/ANS-8.23-1997, “Nuclear Criticality Accident Emergency Planning and 

Response.” 

The staff has reviewed the applicant’s commitment to the CAAS requirements identified in 

10 CFR 70.24 and finds it acceptable because MOX Services maintains a CAAS capable of 

energizing a clearly audible alarm signal if accidental criticality occurs. In addition, the applicant 

maintains emergency procedures for each area in which SNM is handled, used, or stored to 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 11 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

ensure prompt personnel evacuation upon sounding of the alarm. Furthermore, the staff finds 

that the commitments in this section are consistent with the guidance in Section 6.4.3.3.3 of 

NUREG-1718 and standard industry practice (especially ANSI/ANS-8.3-1997), as well as with 

the requirements of 10 CFR 70.24(a). Therefore, these commitments are acceptable to the 

staff. 

6.1.3.4 Criticality Methods and Code Validation 

Subcriticality is demonstrated using validated criticality calculational methods. LA 

Section 6.4.5.2 describes the SCALE Monte Carlo code package the applicant used to perform 

the criticality calculations. The staff noted that the spacing limits for hand-carried items in the 

RCA unit were derived using the solid angle technique, a hand calculation method. In its 

response to RAI NCS-48 (NRC, 2009c), the applicant explained that the spacing limits were 

ultimately based on validated computer methods. The solid angle technique is a widely 

accepted method for determining subcriticality, (as documented in Knief, 2000). Because of 

this, the applicant’s use of the solid angle method, as confirmed by validated computer 

methods, is acceptable to the staff. 

The staff reviewed the applicant’s description of its validation methodology and requirements for 

documenting the results in a formal validation report. This information agreed with the 

acceptance criteria in Section 6.4.3.3.4 of NUREG-1718 and with standard industry practice, 

with one exception. The LA does not contain a commitment to describe the validated areas of 

applicability (AOAs) in the validation report. Table 6.4-1 of the LA describes the AOAs; 

therefore, there is no need to duplicate this information in the validation reports themselves. 

Part of defining the code’s AOA involves specifying the code options that were used to analyze 

the critical benchmark experiments. The staff noted that some of the calculations in the KCD 

unit made use of the concrete albedo option, which had not been included in the criticality 

code’s validation. Albedos are a way of representing the effect of external absorbers that can 

shorten running times by avoiding tracking neutrons explicitly in the surrounding material. In 

response to RAI NCS-80 (NRC, 2009c), the applicant stated that it will revise these calculations 

to explicitly track neutrons in the external reflectors rather than using the albedo option. The 

staff will verify completion of criticality calculations to support operation of the MFFF as part of 

the verification of the PSSCs. 

LA Section 6.4.5.4 describes the applicant’s statistical methodology used to determine the bias 

and uncertainty. The staff reviewed this method, as well as the applicant’s validation reports, 

during its evaluation of the CAR (as documented in Section 6.1.3.5.1 of NUREG-1821). The 

applicant has also committed in the LA to include the validation report in its configuration 

management program and to maintain the software in accordance with the MOX Project Quality 

Assurance Plan (MPQAP). The staff will verify the applicant’s development of the procedures 

for maintaining configuration control over calculational methods as part of the verification of the 

PSSCs. 

The staff also reviewed a sample of several of the applicant’s calculations in the ISA review and 

determined that they were within the validated AOAs. The staff finds that the applicant’s 

implementation of validation is consistent with the approach reviewed and approved at the CAR 

stage (in Section 6.1.3.5.1 of NUREG-1821). Therefore, this approach is acceptable to the 

staff. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 12 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

6.1.3.5 Criticality Safety in the Integrated Safety Analysis 

LA Section 6.4.6 describes the process for review and approval of NCSEs, which are 

considered part of the ISA. The NCSEs identify IROFS as controls that are relied on to 

demonstrate that processes are subcritical under normal and abnormal conditions and that 

criticality is highly unlikely. Section 6.2 of this SER includes a detailed discussion of how 

accident sequences are developed in the process hazard analyses (PrHAs), evaluated in the 

NCSEs, and incorporated into the ISA Summary. The accident sequences mainly consist of 

initiating events that result in a loss of one of the controlled parameters, together with two trains 

of preventive IROFS to ensure double contingency protection. The tables in Section 5.3.7 of the 

ISA Summary describe these accident sequences. The commitments in this section are 

consistent with the guidance in Chapter 5 and Section 6.4.3.3.6 of NUREG-1718 and standard 

industry practice and are therefore acceptable to the staff. 

6.1.4 Regulatory Guidance 

The staff reviewed the applicant’s commitment to the ANSI/ANS-8 series consensus standards 

related to criticality safety, as described in LA Section 6.5. The applicant commits to using the 

ANSI/ANS-8 series standards endorsed in RG 3.71 in the design of the facility. LA Section 6.5 

commits, in general, to “comply with the guidance (shall statements) and implement the 

recommendations (should statements)” of applicable standards, but identified several 

clarifications to specific commitments within certain of the standards. Clarifications to specific 

commitments to follow these standards are summarized below: 

• ANSI/ANS-8.1-1998: The applicant commits to comply with the guidance (i.e., the 

“shall” statements) of ANSI/ANS-8.1-1998 and implement the recommendations (i.e., the 

“should” statements), with clarification of three provisions in Sections 4.2.2, 4.2.3, and 

4.3.2 of the ANSI standard. For Section 4.2.2, the applicant commits to follow the 

double contingency principle, which requires that at least two unlikely, independent, and 

concurrent changes in process conditions must occur before criticality is possible. For 

the purposes of meeting this commitment, “unlikely” is defined as “events or event 

sequences that are not expected during the facility lifetime, but are considered credible.” 

Compliance with the double contingency principle will be demonstrated for those 

processes and areas in which criticality is determined to be credible during the 

performance of the ISA. The staff notes that a definition of “unlikely” that is qualitatively 

consistent with a probability of failure on the order of 10-2 per year is considered to be 

acceptable, in accordance with the definitions in Section 6.8 of NUREG-1718. The staff 

evaluated this definition and found it to be acceptable during its review of the CAR (see 

Section 6.1.4.2 of NUREG-1821). Therefore, the staff finds the applicant’s approach to 

be acceptable. 

For Section 4.2.3 of the ANSI standard, the applicant commits to follow the standard (which lists 

several different types of control methods, including engineered and administrative controls), 

but commits to relying on engineered features whenever practical and to justify the use of 

administrative controls. This is consistent with the preferred design approach (i.e., passive 

controls are preferred to active; engineered controls are preferred to administrative) and is 

therefore acceptable to the staff. Also in terms of Section 4.3.2 of the ANSI standard, the 

applicant committed that, where an extension to the AOAs is required, the calculational 

method will be supplemented by other calculational methods to provide a better estimate of 

bias in the extended areas or through an increase in the margin of subcriticality. In making 

the extension, trends in the bias and any additional uncertainty must be considered in 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 13 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

determining the appropriate amount of margin. Section 4.3.2 of the ANSI standard states 

that the AOA may be extended by making use of trends in the bias, and Section 4.3.3 states 

that the uncertainty in the bias shall contain allowances for extensions to the AOA. These 

commitments are consistent with the standard. The NRC has endorsed this standard; thus, 

the process is acceptable to the staff. This allowance could be construed as permitting the 

applicant’s AOA to be broadened beyond the point described in the NRC-reviewed 

validation reports. However, because Table 6.4-1 of the LA describes the AOAs, they 

cannot be changed without using the applicant’s change process which may require NRC 

review and approval. 

With regard to the subcritical limits in ANSI/ANS-8.1-1998, the staff considers the use of 

subcritical limits from the standard in lieu of explicit calculation to be an acceptable 

practice. RG 3.71 has endorsed these results, and as single parameter limits, the NRC 

finds that they are conservative. 

• ANSI/ANS-8.3-1997 (R2003): The applicant commits to comply with the guidance of the 

standard and implement the recommendations, as modified by RG-3.71. The staff finds 

this approach acceptable. 

• ANSI/ANS-8.5-1996, “Use of Borosilicate-Glass Raschig Rings as a Neutron Absorber in 

Solutions of Fissile Material”: The applicant does not consider this standard to be part of 

the design basis of the facility. In addition, the applicant stated that it does not envision 

using raschig rings for criticality control in facility operations, but will instead rely only on 

fixed neutron absorbers in accordance with ANSI/ANS-8.21-1995 (R2001), “Use of Fixed 

Neutron Absorbers in Nuclear Facilities Outside Reactors.” The staff concurs that 

commitment to this standard is not applicable to the design of the facility and, therefore, 

is not part of the design basis of the facility. 

• ANSI/ANS-8.6-1989, “Safety in Conducting Subcritical Neutron-Multiplication 

Measurements In Situ”: The applicant does not consider ANSI/ANS-8.6-1989 to be part 

of the design basis of the facility. The applicant does not intend to conduct subcritical 

neutron multiplication measurements at the facility. The staff concurs that commitment 

to this standard is not applicable to the design of the facility and, therefore, is not part of 

the design basis of the facility. 

• ANSI/ANS-8.7-1998, “Guide for Nuclear Criticality Safety in the Storage of Fissile 

Materials”: The applicant does not consider ANSI/ANS-8.7-1975 to be part of the design 

basis of the facility. The general commitment to ANSI/ANS-8.1-1998 and technical 

practices, as described in LA Sections 6.3 and 6.4.4, are sufficient to ensure that 

criticality safety is appropriately provided for fissile material storage areas. The staff 

concurs that commitment to this standard is not applicable to the design of the facility 

and, therefore, is not part of the design basis of the facility. 

 

• ANSI/ANS-8.9-1975 (R1995), “Guide for Nuclear Criticality Safety for Steel-Pipe 

Intersections Containing Aqueous Solutions of Fissile Materials”: The applicant states 

that ANSI/ANS-8.9-1975 has been withdrawn by the ANS-8 working group and will not 

be used in the design of the facility. The applicant will evaluate piping configurations 

containing aqueous solutions of fissile material by calculation, in accordance with 

ANSI/ANS-8.1-1998. Because using validated methods to determine subcritical limits is 

an acceptable methodology, the staff determined that this approach was acceptable. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 14 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

• ANSI/ANS-8.10-1983 (R2005), “Criteria for Nuclear Criticality Safety Controls in 

Operations with Shielding and Confinement”: The applicant does not consider 

ANSI/ANS-8.10-1983 to be part of the design basis of the facility. The facility’s approach 

is to prevent criticality in accordance with the double contingency principle, rather than to 

rely on shielding and confinement for dose mitigation. Because shielding will not be 

credited in this way (it must still be considered for detector coverage), the staff considers 

it appropriate to exclude ANSI/ANS-8.10-1983 as a design basis for the facility. 

• ANSI/ANS-8.12-1987 (R2002), “Nuclear Criticality Control and Safety of PlutoniumUranium Fuel Mixtures Outside Reactors”: The applicant does not consider ANSI/ANS8.12-1987 to be part of the design basis of the facility. The staff notes that this standard 

does not contain any administrative requirements to which the applicant should commit. 

This standard only contains subcritical limits for certain plutonium-uranium mixtures. In 

the absence of a commitment to this standard, the commitment to ANSI/ANS-8.1-1998 

ensures the use of validated methods in computer calculations to demonstrate 

subcriticality. Therefore, the staff considers it appropriate to exclude ANSI/ANS-8.12-

1987 as a design basis for the facility. 

• ANSI/ANS-8.15-1981 (R1995), “Nuclear Criticality Control of Special Actinide Elements”: 

The applicant does not consider ANSI/ANS-8.15-1981 to be part of the design basis of 

the facility. Criticality control of special actinide nuclides will be explicitly evaluated by 

calculation in accordance with ANSI/ANS-8.1-1998. Because using validated methods 

to determine subcritical limits is an acceptable methodology, the staff determined that 

this approach was acceptable. 

• ANSI/ANS-8.17-2004, “Criticality Safety Criteria for the Handling, Storage, and 

Transportation of LWR Fuel Outside Reactors”: The applicant commits to comply with 

the guidance (i.e., the “shall” statements) of ANSI/ANS-8.17-2004 and implement the 

recommendations (i.e., the “should” statements), with clarification of two provisions in 

Sections 4.11 and 5.1 of the standard. For Section 4.11, the applicant commits to use of 

the double contingency principle for the handling, storage, and transportation of fuel 

units and rods. As required by 10 CFR 70.64(a)(9), the facility must comply with the 

double contingency principle; thus, this commitment is acceptable to the staff. For 

Section 5.1 of the standard, the applicant committed that when an extension to the AOA 

is required, the calculational method will be supplemented by other calculational 

methods to provide a better estimate of bias in the extended area, or through an 

increase in the margin of subcriticality. This is consistent with the endorsed standard 

and is, therefore, acceptable to the staff. MOX Services intends to adhere to the 

exception noted in RG 3.71, which states that licensees and applicants may take credit 

for fuel bum up only when the amount of burnup is confirmed by physical measurements 

that are appropriate for each type of fuel assembly in the environment in which it is to be 

stored. MOX Services has stated that fresh fuel isotopics will be used throughout the 

facility, and therefore commitments related to burnup credit are not applicable. 

• ANSI/ANS-8.19-2005, “Administrative Practices for Nuclear Criticality Safety”, The 

applicant commits to comply with the guidance of ANSI/ANS-8.19-2005 and implement 

the recommendations, with the exception that no commitments are made related to 

Section 10 of the standard regarding emergency response to criticality accidents. The 

staff notes that the applicant has committed to ANSI/ANS-8.23-1997, which contains 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 15 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

many of the same requirements as specified in Section 10; the staff finds this 

acceptable. 

• ANSI/ANS-8.20-1991 (R1999). “Nuclear Criticality Safety Training”, The applicant 

commits to comply with the guidance of ANSI/ANS-8.20-1991 (R1999) and implement 

the recommendations (i.e., the “should” statements) without exception or clarification. 

The staff finds this acceptable. 

• ANSI/ANS-8.21-1995 (R2001), “Use of Fixed Neutron Absorbers in Nuclear Facilities 

Outside Reactors”: The applicant commits to comply with the guidance of ANSI/ANS8.21-1995 (this standard contains no recommendations) without exception or 

clarification. The staff finds this acceptable. 

• ANSI/ANS-8.22-1997, “Nuclear Criticality Safety Based on Limiting and Controlling 

Moderators”: The applicant commits to comply with the guidance and implement the 

recommendations (i.e., the “should” statements) of ANSI/ANS-8.22-1997 without 

exception or clarification. The staff finds this acceptable. 

• ANSI/ANS-8.23-1997: The applicant commits to comply with the guidance (i.e. the 

“shall” statements) and implement the recommendations of ANSI/ANS-8.23-1997 

without exception or clarification. The staff finds this acceptable. 

ANSI is developing and revising its standards continually. ANSI published several new 

standards during the lifetime of the review, but they were not used in the design of the MFFF. 

The above list includes all applicable NRC-endorsed standards. 

In summary, the design basis of the facility includes the following NRC-endorsed standards, in 

whole or in part: ANSI/ANS-8.1-1998, ANSI/ANS-8.3-1997 (R2003), ANSI/ANS-8.17-2004, 

ANSI/ANS-8.19-2005, ANSI/ANS-8.20-1991 (R1999), ANSI/ANS-8.21-1995 (R2001), and 

ANSI/ANS-8.22-1997; the applicant has also committed to ANSI/ANS-8.23-1997. The other 

standards were either not applicable to the design of the facility or adequately covered by other 

commitments. The staff considers this list to represent an acceptable set of design bases of the 

facility. However, nothing precludes the use of any other standards endorsed in RG 3.71. As 

stated in the discussions of each applicable ANSI/ANS standard above, the staff finds that the 

applicant’s commitments are consistent with the guidance in Section 6.4.2 of NUREG-1718. 

6.2 ISA Summary Review

The staff reviewed selected portions of the MFFF ISA Summary and supporting ISA process 

safety documentation (e.g., NCSEs, nuclear safety evaluations (NSEs), criticality calculations, 

equipment drawings, piping and instrumentation diagrams (P&IDs)) to determine whether the 

applicant had met the criticality hazard requirements for licensing related to performance of the 

ISA (as listed in 10 CFR 70.66(a)). Specifically, the staff reviewed the aforementioned ISA 

documentation to determine whether the applicant had (1) identified all credible accident 

sequences leading to inadvertent criticality, (2) established sufficient engineered and 

administrative IROFS to ensure that those sequences will be highly unlikely, (3) ensured that all 

processes will be subcritical under both normal and credible abnormal conditions, and 

(4) complied with the double contingency principle. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 16 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

The applicant divided the MFFF into 53 different process units for ease in performing the 

criticality analysis. Many of these contained similar hazards or repetitive controls. Thus, the 

staff primarily reviewed those process units judged to have the highest potential risk of 

inadvertent criticality, as well as some selected process units posing lower risk. This approach 

enabled the staff to review the applicant’s implementation of its ISA methodology across a wide 

spectrum of systems having different fissile material compositions, physical characteristics, and 

criticality controls. 

The staff performed a risk-informed review of the ISA; that is, the staff reviewed first, and in 

greatest depth, those areas that pose the highest unprevented risk (risk based on the type and 

quantity of material present, without taking into account risk reduction produced by IROFS). 

The basis for this ranking is the known physical and neutronic properties of fissionable 

materials, as well as experience with the types and quantities of materials in accidents that have 

occurred (Los Alamos, 2000). 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 17 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

Besides the unprevented risk, the staff used several other factors to decide in what areas to 

concentrate its review. These factors included complexity of the controls (e.g., an active 

engineered interlock is much more complicated than a passive geometry control), diversity, 

redundancy, significance for downstream units, and safety margin. The staff spent more time 

reviewing complex IROFS, such as active interlocks and enhanced or multistep administrative 

controls, than simple controls for which it is relatively easy to assess adequacy. Since 

numerous accident sequences have similar control strategies (e.g., passive geometry with drip 

trays, mass limits based on IROFS scales in conjunction with moderation), once the staff 

reviewed and obtained a reasonable assurance of safety with a given control strategy, it 

focused its review on other types of control strategies. This approach allowed the staff to review 

a diverse cross-section of passive engineered, active engineered, and administrative controls. 

Those systems relying on redundant IROFS, especially redundant administrative IROFS, also 

received added attention because of their susceptibility to common-mode failure. Some IROFS 

(e.g., controls maintaining the correct isotopic blend of MOX powder) received in-depth review 

because failures would propagate to many process units downstream. Lastly, those control 

systems having a small safety margin (especially for administrative IROFS) received more indepth review. These criteria were based on lessons learned during the staff’s ISA reviews for 

other licensees and applicants and historical events at fuel facilities. Finally, following its visit to 

the reference facilities in France, the staff focused its review on the processes and control 

systems that differed from those at the reference facilities, because differences between the 

reference facilities and the MFFF represent areas without an extensive track record of historical 

experience and thus greater uncertainty. 

Once the most risk-significant portions of the facility and types of controls most likely to fail were 

identified, the staff performed its review in the following manner—several in-office reviews were 

conducted, starting with the main aqueous polishing processes. Within each area, the staff 

reviewed the applicable NCSE to identify the controlled parameters, controls, and limits used to 

ensure criticality safety. The staff reviewed accident sequences in the double contingency 

discussion to ensure that they met the double contingency principle; the staff also reviewed 

calculations to determine that all normal and credible abnormal conditions were demonstrated to 

be safely subcritical. The staff selectively reviewed the IROFS tables in the NCSE to determine 

that the IROFS met the four required criteria for being highly unlikely (single-failure criterion or 

double contingency principle, application of Appendix B to 10 CFR Part 50 and NQA-1, industry 

codes and standards, and management measures including failure detection) and reviewed the 

applicant’s basis for classifying the sequence as a Category A, B, or C highly unlikely event. 

After review of the NCSE and supporting documents and calculations, the staff selectively 

sampled the flowdown of hazards from the PrHAs into the NCSE to determine whether 

sequences screened out as incredible had been properly evaluated. Following its review of the 

applicant’s ISA documentation, the staff reviewed the ISA Summary description of the process 

area, accident sequences, and IROFS to ensure that it accurately reflected the process’s safety 

basis and met all applicable regulatory requirements. The staff reviewed all process areas, with 

the exception of those that were essentially duplicates of another process area using a similar 

control strategy. 

The staff documented its review of the units discussed in the following sections in a series of 

in-office review summaries, as listed below (NRC, 2008a; NRC, 2010a). The staff reviewed the 

following units and issues on the dates indicated: 

• KDB, NDP, LCT (April 17–19, 2007) 

• NBX/NBY, NDS, KPA (July 9–13, 2007) 

• KPA, NDP, KCD (August 14–16, 2007) 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 18 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

• KDB, KCA, KPB, KPC, KWD, KWS, KWG, KPG (September 25–27, 2007) 

• KPB, KCA, KDA/KDM, KDD, KCD (November 6–8, 2007) 

• KDA/KDM, PFE/PFF, PRE/PRF (December 4–6, 2007) 

• NCR, PSE/PSF/PSI/PSJ, PML, DCM, STK, SMK, VDR, TAS (January 8–10, 2008) 

• DCE, NDD, VDQ, VDT (January 22–24, 2008) 

• NXR, RCA (February 5–6, 2008) 

• Cracked Concrete Issue (September 23, 2008) 

• KPA, KDB, KCA, RCA (December 16–17, 2008) 

• KPA, KPB, KCA, KDA/KDM, PRE/PRF, VDQ, VDT (December 15–16, 2009) 

The vertical slice reviews consisted of (1) reviewing selected process unit NCSEs and 

calculation documents to assess the adequacy of criticality parameters, controls, and limits to 

meet the double contingency principle; (2) reviewing NCSEs and PrHA documents to assess 

the completeness and adequacy of accident sequences and IROFS to meet the performance 

requirements; (3) reviewing other supporting safety documentation to assess the applicant’s 

ability to implement criticality controls, limits, and management measures in the plant’s safety 

program; and (4) reviewing the applicant’s ISA Summary to ensure the correct flowdown of 

information (i.e., the contents required by 10 CFR 70.65(b)(1)–(9) flow from these documents 

into the ISA Summary). 

In addition to the in-office document reviews listed above, the staff also visited the two reference 

plant facilities in Marcoule and La Hague, France, and documented its review of operations at 

these two facilities (NRC, 2008c). There the staff observed ongoing processes similar to those 

designed for the MFFF, reviewed several additional technical documents, and discussed 

technical issues with the facilities’ criticality safety and operations staff. Part of this review 

consisted of discussing the facilities’ operational history, including observed failure rates of 

safety controls and reportable events. Based on its review of documents and operations in the 

above vertical slice reviews, the staff has reasonable assurance that the regulatory 

requirements of Subpart H, “Additional Requirements for Certain Licensees Authorized To 

Possess a Critical Mass of Special Nuclear Material,” of 10 CFR Part 70, “Domestic Licensing of 

Special Nuclear Material,” will be met for criticality safety at the MFFF, as discussed below. 

6.2.1 Programmatic Aspects of Review 

As stated in 10 CFR 70.66(a), an LA will be approved if the applicant has complied with the 

requirements of 10 CFR 70.21, “Filing”; 10 CFR 70.22, “Contents of Application”; 10 CFR 70.23, 

“Requirements for the Approval of Applications”; and 10 CFR 70.60, “Applicability,” through 

10 CFR 70.65, “Additional Content of Applications.” This section only discusses the staff’s 

review of the ISA and ISA Summary, addressing the requirements of Subpart H (10 CFR 70.60 

through 10 CFR 70.65), as applied to preventing criticality hazards. Other chapters of the SER 

address the application of Subpart H requirements to other types of hazards. 

The applicant performed its ISA for all hazards at the MFFF in accordance with the methodology 

discussed in Chapter 5 of this SER; thus, aspects of the methodology common to all safety 

disciplines will not be discussed further. Several unique considerations, which apply only to 

criticality hazards, are discussed in greater detail below. These aspects of the methodology are 

in large part the result of discipline-specific considerations and regulatory requirements. 

10 CFR 70.61(b), 10 CFR 70.61(d), and 10 CFR 70.64(a)(9)
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 19 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

Throughout the nuclear industry, a criticality accident is generally presumed to be a highconsequence event because the potential for radiological doses to workers exceeding the 

threshold of 10 CFR 70.61(b)(1) cannot be discounted. At the MFFF, a criticality is also defined 

to be a high-consequence event. Neither the LA nor the ISA Summary explicitly states that 

criticality is a high-consequence event. However, the applicant’s methodology requires that 

criticality accidents be demonstrated to be highly unlikely, so the applicant is effectively treating 

criticality as a high-consequence event. Consequence determination therefore is trivial and 

demonstrating compliance with the performance requirements consists only in determining the 

likelihood for all credible accident sequences leading to criticality. Because of this, criticalityrelated IROFS can only be preventive and not mitigative in nature; no credit is taken for 

shielding or other natural or design features that could reduce the consequences to less than 

the threshold of 10 CFR 70.61(b)(1). This is consistent with the requirement of 

10 CFR 70.61(b)(1), as well as that of 10 CFR 70.61(d), which states that all nuclear processes 

must be shown to be subcritical (regardless of whether there is a dose) under both normal and 

credible abnormal conditions and that criticality control must rely on primarily preventive means. 

To satisfy the requirement that all nuclear processes be subcritical, including use of an 

approved margin of subcriticality for safety, the applicant used a minimum margin of 

subcriticality of 0.05. The staff reviewed the basis for this at length in the review of the CAR, as 

documented in that SER (Section 6.1.3.5.2 of NUREG-1821). Margin was also provided in 

making use of conservative calculational assumptions and technical practices, as discussed in 

Section 6.1.3 of this SER. During the ISA review, the staff verified that calculations were within 

the AOAs that were reviewed and approved in the CAR review. The staff also verified that the 

calculations were consistent with technical practices specified in the LA. In some calculations, 

particularly with regard to the inclusion of certain neutron poisons, conditions were slightly 

outside the approved AOA. The staff noted that relevant NCSEs provided the justification, 

which generally relied on the fact that the calculated keff was substantially subcritical or that the 

worth of the absorber was sufficiently small that even a gross error in the absorption crosssections would not be sufficient to render the system critical. The staff found these arguments 

to be sound. 

The staff did note, however, that in some cases calculations assumed parameter values 

identical to so-called “nominal” design values, without any apparent margin. Although the exact 

dimensions of fixed equipment have been largely determined, several limits (e.g., drip tray level 

setpoints, radiation trip points) have yet to be determined, so the margins associated with these 

controls are not yet known. In its responses to RAIs NCS-61 and NCS-62, the applicant 

committed to developing operating limits manual to ensure adequate margin and provide details 

as to how it will determine applicable safety limits, analytical limits, instrument setpoints, and 

operating limits in its responses (NRC, 2009c). The staff determined that the methodology 

described in the applicant’s RAI responses was consistent with standard industry practice (as 

described in RG 1.105, “Setpoints for Safety-Related Instrumentation,” and American National 

Standards Institute/International Society for Automation (ANSI/ISA) S67.04.01-2000, 

“Methodologies for the Determination of Setpoints for Nuclear Safety-Related Instrumentation”). 

Therefore, the staff finds the applicant’s methodology to be acceptable. The staff will confirm 

that MOX Services has developed an operating limits manual to establish sufficient margin to 

meet the performance requirements during the verification of the PSSCs, as discussed in 

Section 6.1.3.2 of this SER. 

In addition, because the MFFF is a new facility, the design must comply with the double 

contingency principle, in accordance with 10 CFR 70.64(a)(9). To do this, MOX Services 

established at least two independent IROFS on each credible accident sequence leading to 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 20 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

criticality, supported by an analysis (a NCSE) to demonstrate that at least two unlikely, 

independent, and concurrent changes in process conditions would be required before criticality 

is possible. 

Ensuring that high-consequence events are highly unlikely is based on the following four 

qualitative criteria: 

(1) application of the single-failure criterion (double contingency principle for criticality) 

(2) application of the MPQAP, which meets the requirements of Appendix B to 

10 CFR Part 50 and NQA-1 

(3) application of industry codes and standards 

(4) management measures, including surveillance of IROFS 

These criteria apply to accident sequences in all safety disciplines, but because of the more 

stringent regulatory requirements related to criticality hazards, the applicant provided the 

following additional criteria in LA Section 5.2.2.7.2. For some accident sequences relying on 

robust passive controls, the following is sufficient to demonstrate that the sequence is inherently 

highly unlikely: 

For robust passive features with no credible failure leading to criticality, the 

equipment must be specified as an IROFS, must be evaluated and shown to be 

subcritical under all credible process conditions, and must be under the facility’s 

configuration management program. 

For all other systems that have credible accident sequences leading to criticality, the following 

criteria will apply: 

• application of at least two independent, robust (unlikely to fail) controls 

• active or passive engineered controls, which are unlikely to fail, based on consideration 

of all applicable “available and reliable” qualities, in accordance with NUREG-1718, and 

which must be classified as quality level QL-1 

• administrative controls which are robust and unlikely to fail, based on consideration of all 

applicable “available and reliable” qualities, in accordance with NUREG-1718, and which 

must be simple and unambiguous 

These criteria, which are discussed further in Chapter 5 of this SER, are often referred to as the 

“four pillars” that support the determination that an accident sequence is “highly unlikely,” for all 

facility hazards. In addition, criticality hazards must be supported by one additional pillar, which 

requires additional failure detection, subcritical margin, or other comparable assurance that 

controls are robust enough to be used as the basis for meeting the double contingency principle 

(which, together with the subcriticality requirement of 10 CFR 70.61(d), is unique to criticality). 

All credible criticality accident sequences are therefore classified into one of three “highly 

unlikely categories,” defined as follows: 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 21 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

• Category A events have the means to detect failure of the control within a specified 

period of time. 

• Category B events include a safety margin that demonstrates that multiple (i.e., three or 

more) failures of each independent robust control will not result in a loss of subcriticality. 

• Category C events possess some other means, with justification, which provide 

comparable assurance to Categories A or B above. 

The staff reviewed and approved these criticality-specific portions of the applicant’s ISA 

methodology during the CAR review (see Section 6.1.4.2 of NUREG-1821), consistent with the 

guidance contained in Section 6.4.3.3.6 and Chapter 5 of NUREG-1718. The staff’s review of 

the ISA and ISA Summary focused on whether the applicant had implemented its methodology 

adequately, so as to demonstrate compliance with the performance requirements and double 

contingency principle. 

10 CFR 70.62(a–d)

As required by 10 CFR 70.62(a), each applicant must establish and maintain a safety program 

demonstrating compliance with the provisions of 10 CFR 70.61, “Performance Requirements.” 

For criticality safety, the safety program meeting this is the applicant’s NCS Program, discussed 

earlier in Section 6.1 of this SER. In addition, 10 CFR 70.62(b) requires each applicant to 

maintain process safety information, and 10 CFR 70.62(c) requires each applicant to conduct 

and maintain an ISA. Furthermore, 10 CFR 70.62(d) requires each applicant to establish 

management measures to ensure compliance with 10 CFR 70.61. Chapter 5 of this SER 

discusses the overall review of these three elements of the safety program (i.e., process safety 

information, ISA, and management measures). The staff confirmed the adequacy of the 

implementation of these elements to criticality safety hazards during its in-office licensing 

reviews, as discussed below. 

10 CFR 70.65(b)(1)–(9)

The provisions of 10 CFR 70.65(b)(1)–(9) specify the required contents of the applicant’s ISA 

Summary. The staff determined, based on its review of commitments in the LA and its review of 

the ISA Summary, including the vertical slice review, that the applicant had met the 

requirements specified in 10 CFR 70.65(b)(1)–(9) with regard to criticality hazards, as 

summarized below. 

The regulation at 10 CFR 70.65(b)(1) requires a general description of the site, with an 

emphasis on the factors that could affect safety. The regulation at 10 CFR 70.65(b)(2) requires 

a general description of the facility, with an emphasis on the areas that could affect safety. This 

information, which is contained in Chapters 2 and 3 of the ISA Summary, is general in nature 

and not specific to criticality safety. See Section 1.3 of this SER for more specific information. 

The provisions of 10 CFR 70.65(b)(3) require a description of each process analyzed in 

sufficient detail to understand the theory of operation, the hazards, and a general description of 

the types of accident sequences. Chapter 4 of the ISA Summary includes detailed process 

descriptions, including detailed schematics. Section 5.3.7 of the ISA Summary discusses the 

parameters which are controlled for criticality safety, as well as the major process features that 

control them. The staff reviewed this information along with information available on site in the 

NCSEs, system description documents, criticality calculation documents, mechanical drawings, 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 22 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

P&IDs, and other related documents. Based on its review of this information, the staff 

concludes that there is sufficient detail to understand the process and its theory of operation. 

The PrHA document describes the process hazards and other initiating events postulated to 

lead to an inadvertent criticality for the various process units. Not all scenarios considered were 

determined, upon further evaluation, to credibly lead to criticality. Some scenarios considered in 

the PrHAs were determined to not be credible or to lead to conditions subsequently shown to be 

subcritical. The tables in the ISA Summary did not explicitly include those scenarios that were 

not credible, or which did not lead to criticality. The tables also did not include those scenarios 

determined to be “inherently highly unlikely,” as described above. However, the controlled 

parameter discussion in Section 5.3.7 of the ISA Summary did discuss the corresponding 

scenarios and identified the IROFS limiting those parameters by underscoring them. For all 

other events, the tables in Section 5.3.7 of the ISA Summary explicitly included highly unlikely 

and double contingency demonstrations. For each of these accident sequences, the initiating 

event, postulated causes, and the sequence of subsequent events that could credibly lead to 

criticality were described in one table. Another table described in detail the two preventive 

barriers (each consisting of one or more IROFS) constituting the two legs of double 

contingency. 

During the various in-office reviews, the staff performed a vertical slice from the PrHA to the 

NCSEs to the ISA Summary. The PrHA is first performed as part of the ISA process, and 

events that could credibly lead to criticality are carried forward into the NCSE. Those scenarios 

that can credibly lead to criticality are summarized in the controlled parameter discussion or in 

accident sequence tables in the ISA Summary. The staff performed a detailed review of 

selected sequences and determined that only those PrHA events that were not screened out as 

incredible or not leading to a critical configuration were treated further in the NCSE and carried 

forward into the NCSE. Those that were screened out were discussed in summary fashion in 

NCSE tables. In many cases, several individual PrHA events involving the same parameter 

were grouped together as a single bounding accident sequence, which constituted one of the 

“general types of accident sequences” discussed above. In all cases, the staff determined that 

the description of the process, the hazards, and the general types of accident sequences was 

appropriate. 

The regulation at 10 CFR 70.65(b)(4) requires information demonstrating the applicant’s 

compliance with the performance requirements of 10 CFR 70.61, including a description of 

management measures, criticality monitoring, and alarms, as required in 10 CFR 70.24, and, if 

applicable, the requirements in 10 CFR 70.64, “Requirements for New Facilities or New 

Processes at Existing Facilities.” The aforementioned accident sequence tables in the ISA 

Summary contain information demonstrating that all credible accident sequences leading to 

criticality are highly unlikely. The information in these tables includes a brief discussion as to 

why the event is highly unlikely, including categorization as either a Category A, B, or C event. 

The discussion of Category A events states that the IROFS will be subject to periodic failure 

detection. For Category B events, the discussion states that there is sufficient margin so that at 

least three failures are required before criticality is possible. The discussion for Category C 

events is more varied, but must show “comparable assurance” to that provided by failure 

detection and margin. Because this is a new facility handling more than a critical mass of 

fissionable material, the requirements of 10 CFR 70.64 also apply. The design provides for 

criticality safety by the use of controlled parameters and IROFS. Double contingency is ensured 

by having two preventive control barriers, which are independent and unlikely to fail. The ISA 

tables in Section 5.3.7 justify their likelihood based on “consideration of all applicable ‘available 

and reliable’ qualities per NUREG-1718.” The NCSEs expand upon these discussions, which 

describe the monthly failure detection, calculational basis for the safety margin, and other 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 23 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

considerations relied on to place the event in one of the three highly unlikely categories. The 

staff observed that most of the events fell into Category A or Category C. 

The staff reviewed the acceptability of the applicant’s highly unlikely determination by 

independently confirming whether a selected sample of accident sequences exhibited adequate 

failure detection, margin, or other valid justification that provided comparable assurance to 

failure detection or margin. The staff reviewed the applicant’s documented justification and 

technical references (especially calculations for the margin justification) to determine whether 

adequate controls and management measures had been provided to ensure that accident 

sequences were highly unlikely. As an additional check, the staff independently assessed the 

selected accident sequences against the criteria in Appendix A to NUREG-1520, “Standard 

Review Plan for the Review of a License Application for a Fuel Cycle Facility,” to determine 

whether the factors credited in the highly unlikely demonstration would have produced a 

numerical likelihood index corresponding to “highly unlikely.” 

Category A events were mainly those that relied on active engineered or administrative controls. 

Those Category A events relying on active engineered controls were generally justified by 

requiring at least monthly failure detection on the active components. The applicant based its 

justification of a majority of the Category A events relying on administrative controls on 

supervisory oversight of required operator actions. The applicant also justified some events 

based on the “continuous monitoring” of plant operations by control room personnel (which the 

staff observed directly at the reference facilities). This approach is consistent with the index 

scoring technique of NUREG-1718, Appendix A. Using this technique, two active or 

administrative IROFS combined with at least monthly failure detection (providing a duration 

index in NUREG-1718 of -1) would generally produce a numerical likelihood index 

corresponding to “highly unlikely.” 

Based on the above sampling of Category A criticality accident sequences, the staff has 

reasonable assurance that these accident sequences meet the requirement of 10 CFR 70.61(b). 

The applicant justified a majority of Category C events by establishing at least two passive 

engineered controls, each of which was “more than unlikely” to fail. This approach is consistent 

with the index scoring technique of NUREG-1718, Appendix A. Using this technique, the 

combination of two passive IROFS would generally produce a numerical likelihood index 

corresponding to “highly unlikely.” The staff also reviewed other examples of Category C events 

during the in-office licensing reviews and determined that they provided assurance comparable 

to monthly failure detection or safety margin. (The applicant stated that it is reducing the 

number of such events by recategorizing them as either Category A or B, as its likelihood 

arguments become more refined.) 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 24 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

Based on the above sampling of Category C criticality accident sequences, the staff has 

reasonable assurance that these accident sequences meet the requirement of 10 CFR 70.61(b). 

There were also a small number of Category B events. These events were mainly those 

occurring in operations relying on mass or moderator control, in which there was a large margin 

of safety in the controlled parameter. The applicant justified a majority of Category B events on 

the basis of calculations demonstrating that many successive failures of either mass or 

moderation control (or sometimes both) would be needed before criticality would be possible. 

This approach is consistent with the index-scoring technique of Appendix A to NUREG-1718. 

Using this technique, the occurrence of three independent administrative failures (the most likely 

type and the type generally involved in mass or moderator control) would generally produce a 

numerical likelihood index corresponding to “highly unlikely.” 

 

Based on the above sampling of Category B criticality accident sequences, the staff has 

reasonable assurance that these accident sequences meet the requirement of 10 CFR 70.61(b). 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 25 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

The IROFs tables in the NCSEs describe the specific management measures, codes and 

standards, and available and reliable qualities (e.g., redundancy, diversity, safety margin, failure 

detection, and surveillance) relied on to make the double contingency demonstration. Specific 

details about implementation of these management measures (e.g., surveillance frequencies, 

maintenance, and functional test procedures) are to be determined. The staff will verify the 

determination of specific management measures to be applied to ensure the reliability and 

availability of IROFS as part of the verification of the PSSCs. The staff determined, during the 

in-office licensing reviews, that the information in the NCSE IROFS tables was sufficient to 

demonstrate that (1) criticality would be highly unlikely, (2) all nuclear processes would be 

subcritical under both normal and credible abnormal conditions, and (3) double contingency 

would be met, provided that suitable management measures are established. The applicant 

stated, in its response to RAI NCS-71 (NRC, 2009c), that it did not expect active engineered 

instrumentation to be adversely affected by environmental conditions, such as vibration, 

humidity, high temperature, and radiation. However, it will environmentally qualify such 

electronic instrumentation in accordance with applicable industry standards. The staff will verify 

implementation of environmental qualification to ensure that the reliability and availability of 

IROFS will be verified as part of the verification of the PSSCs. 

With regard to the use of a CAAS, the staff reviewed the adequacy of the alarm system as part 

of the LA review. The staff determined that the applicant’s license commitments were sufficient 

to meet the requirements of 10 CFR 70.24, as discussed in Section 6.1.3.3 of this SER. 

The provisions of 10 CFR 70.65(b)(5) require a description of the team, qualifications, and 

methods used to perform the ISA. As stated above, Chapter 5 of this SER discusses the 

aspects of the ISA methodology applicable to all safety disciplines. Aspects specific to criticality 

safety are discussed above. The ISA team included qualified criticality safety personnel, as 

appropriate, to ensure adequate treatment of criticality hazards, as mentioned in Section 5.2 of 

the ISA Summary. 

As required by 10 CFR 70.65(b)(6), the applicant must provide a list briefly describing each 

IROFS in sufficient detail to understand its function in relation to the performance requirements 

of 10 CFR 70.61. The accident sequence tables in Section 5.3.7 of the ISA Summary briefly 

describe each IROFS in terms of its basic safety function (e.g., to limit a certain parameter). 

Tables 5.3.7-105 and 5.3.7-106 provide a more detailed description of engineered and 

administrative IROFS, respectively. In addition, the NCSEs include tables for each IROFS that 

describe the safety function, individual components, management measures, and other relevant 

features (e.g., available and reliable qualities) in greater detail. 

 While the level of IROFS description is at the functional 

rather than the component level in the ISA Summary, the individual components are identified in 

the IROFS tables in the NCSEs, the PrHAs, and other safety documentation such as P&IDs and 

drawings. The staff determined that this information is sufficient to understand how the IROFS 

meet the requirements of 10 CFR 70.61. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 26 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

The regulation at 10 CFR 70.65(b)(7) requires a description of the proposed quantitative 

standards used to assess the consequences from acute chemical exposures. This is not 

applicable to the criticality safety review. See Chapter 8 of this SER for more information. 

As required by 10 CFR 70.65(b)(8), the applicant must provide a descriptive list identifying all 

sole IROFS. While criticality sequences must comply with the double contingency principle, this 

does not preclude the use of sole IROFS so long as no single change in process conditions can 

lead to criticality. For all credible accident sequences leading to criticality that were included in 

the ISA Summary, the sequences rely on two preventive control barriers, which are independent 

and each are unlikely to fail. (Sequences that do not credibly lead to criticality or are inherently 

highly unlikely were not explicitly developed in the ISA Summary and therefore the applicant 

need not explicitly demonstrate that they comply with the double contingency principle. A 

sequence in which there is no credible failure that can lead to criticality is presumed to meet the 

double contingency principle without the need for specifying two separate control barriers.) The 

applicant provided a list of “sole IROFS” for criticality in its ISA Summary. The staff determined 

that when the applicant referred to a “sole IROFS,” it meant a component shared between both 

preventive barriers for the same sequence, so that the barriers could not be considered totally 

independent. (Most of these are composed of active engineered controls, the various parts of 

which the applicant has chosen to call separate IROFS, instead of grouping them as a single 

IROFS.) The staff does not consider these components to be true instances of sole IROFS, 

because, in all cases, other components would have to fail before criticality is possible. There 

were no cases in which the “sole IROFS” was the only item protecting against a criticality. The 

staff performed a detailed review of sequences involving these items, not because they were 

labeled sole IROFS, but in order to obtain reasonable assurance that the sequences in question 

met the double contingency principle. The in-office review summaries referenced herein 

discuss these items in detail. 

The provisions of 10 CFR 70.65(b)(9) require a description of the definitions of unlikely, highly 

unlikely, and credible as used in the ISA. The staff reviewed and approved the applicant’s use 

of these terms during its review of the CAR (see Sections 5.1.5 and 6.1.4.2 of NUREG-1821). 

Only the definitions of “highly unlikely” and “credible” are relevant to the criticality review. The 

CAR defined “highly unlikely” as “events originally classified as not unlikely or unlikely to which 

sufficient principal SSCs are applied to further reduce their likelihood to an acceptable level.” 

The staff determined that satisfying the above deterministic criteria constitutes an acceptable 

working definition of a sequence that will be highly unlikely. The CAR defined “not credible” as 

“natural phenomena or external man-made events with extremely low initiating frequency and 

process events that are not possible.” The staff reviewed the applicant’s highly unlikely 

classification of events, and its screening out of events as not credible or inherently highly 

unlikely, during the in-office ISA reviews, as documented in the in-office review summaries and 

summarized in the following section of this SER. In all cases, the staff determined that the 

applicant had correctly categorized or screened the events that it reviewed. (There was one 

exception—the applicant erroneously categorized some sequences in the grinding unit 

(PRE/PRF) NCSE. However, this appeared to be a typographical error that the applicant stated 

it would correct in the next revision of the NCSE which will be confirmed during the staff’s 

verification of PSSCs.) 

The preceding discussion addresses the required ISA Summary contents listed in 10 CFR 70.65 

both programmatically and plantwide. The staff finds that the applicant’s safety program, 

including the NCS Program, and its ISA methodology are sufficient to meet the requirements of 

10 CFR Part 70 with regard to the ISA. The following section addresses the specific 

implementation of these requirements in individual facility processes. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 27 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

6.2.2 Technical Aspects of Review 

The staff reviewed the applicant’s implementation of its ISA methodology for several of the most 

risk-significant process units in the aqueous polishing process, the MOX process, and the 

auxiliary systems. The staff documented these reviews in the in-office review meeting 

summaries and reference plant sites visit summary. The following summary provides an 

overview of the criticality safety control strategy and major issues discussed for each of the 

main process units reviewed. Because of the very large number of criticality accident 

sequences in the MFFF, the SER does not list the specific accident sequences reviewed; a 

more complete discussion can be found in the meeting summaries referenced herein. It should 

be noted that the applicant has analyzed ISA Summary events, which are discussed in this 

section of the SER, from a perspective of determining those that are highly unlikely (and meet 

the double contingency principle) from a criticality perspective. The applicant analyzed some 

aqueous polishing events to determine whether they are highly unlikely from a chemical release 

or radiological dose perspective. Chapters 8 and 11 of this SER discuss events not related to 

the evaluation of criticality. The following summary also discusses those aspects of the facility 

that the staff will verify as part of the required verification of the PSSCs. 

6.2.2.1 Aqueous Polishing Process 

The aqueous polishing process receives PuO2 powder (consisting of both PDCF and AFS 

material); rids it of impurities, such as gallium and americium, through a solvent extraction 

process; precipitates it to plutonium oxalate; and reconverts it to purified PuO2 for fuel 

fabrication in the MOX process. Most of the steps involved in this procedure consist of wet 

chemistry processes, in which the criticality control strategy relies primarily on maintaining 

plutonium solutions within geometrically favorable process equipment (e.g., columns, tanks, 

pipes). (Section 11.2 of this SER provides additional discussion of the aqueous polishing 

process.) 

 The staff therefore focused its review on those operational events that can 

cause either a loss of geometry or a loss of physicochemical control. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 28 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

 The applicant will conduct settling studies to determine detailed 

requirements for representative sampling, and laboratory analysis will be subject to strict quality 

assurance, including redundancy and instrument calibration. The staff will verify the 

development of a sampling plan to ensure that IROFS samples will be reliable and will be 

sufficiently independent to meet the double contingency principle as part of the verification of 

the PSSCs. Solution transfers also are enabled through the use of dual hand switches and turn 

keys in the control room, which are kept under the control of operations supervisors. These will 

be locked out and transfers will not be authorized until automatically analyzed IROFS samples 

have been determined to be within acceptable limits by the computer control system (MMIS). 

The exact features of the control room design to ensure that solution transfer controls—and 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 29 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

other process controls credited for safety—will be sufficiently independent is yet to be 

completed. The staff will verify human factors considerations (Chapter 12 of the SER) to ensure 

that control room operations will comply with the double contingency principle as part of the 

verification of the PSSCs. The staff reviewed the approach to IROFS sampling and solution 

transfer controls (as outlined in the in-office review summary dated August 14–16, 2007 (NRC, 

2010a)) and has reasonable assurance that the applicant will ensure double contingency 

protection for this type of scenario. 

The applicant stated that radiation detectors cannot, in general, accurately measure fissile 

isotope concentrations, but can only indicate a relative change in process conditions that could 

pose a potential problem. For this reason, these devices are not credited as IROFS. While not 

IROFS, they do provide added defense in depth against a loss of geometry control, which 

supports the applicant’s determination that criticality is highly unlikely. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 30 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 31 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

Besides plutonium polymerization, other chemical transformations can change the form of the 

material. Precipitation is not a concern in most of the process, because wherever optimum 

moderation is assumed, any precipitation can only lead to an undermoderated condition. The 

staff also reviewed and agreed with calculations demonstrating that a pure plutonyl nitrate 

solution bounds worst-case plutonium-water-organic mixtures, and possible formation of a “third 

phase” (as discussed in the summary of the meeting held July 10–12, 2007 (NRC, 2010a)). 

For normally dry portions of the aqueous polishing process (before PuO2 dissolution or after 

plutonium oxalate precipitation), the material is handled in individual batches subject to mass 

and moderator control. Mass control is ensured throughout by the use of IROFS scales that 

either ensures that can contents are within analyzed limits or that the difference between two 

successive weight measurements (indicating a potential spill) is within analyzed limits. The 

cans are typically weighed either upon opening or after operations such as milling, transfer of 

the material to another container, or batching to the electrolyzer. Scale measurements are also 

compared to each other so as to provide a continuous functional check, such as before and 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 32 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

after movement into an enclosure or area, when the cans are not opened (so that any mass 

difference is indicative of a measurement error or equipment malfunction). Moderator levels in 

the PuO2 cans at the start of the aqueous polishing process are ensured upstream in the MOX 

process. Moderator levels in the powder leaving the aqueous polishing process are ensured by 

controlling the temperature and residence time (screw speed) in the KCA calcining furnace. 

The Staff reviewers also considered other controlled parameters, including powder density, 

reflection, interaction, and use of neutron absorbers. The applicant has stated that the powder 

density values chosen (e.g., powder batched to the electrolyzers must be less than 7 g/cc) are 

generally considered to be conservative, but they will be verified during startup testing. The 

powder density of oxide from the PDCF will be verified based on vendor (DOE) records and 

subsequently confirmed, while the density of AFS oxide will be verified by methods such as 

nondestructive assay and weight measurements. The staff examined historical density records 

during its onsite review at the MELOX facility and determined that the assumed values were 

conservative. The staff will follow up on the completion of methods for independently verifying 

the acceptability of incoming feed material during the verification of the PSSCs, as discussed in 

Section 6.1.3.2 of this SER. 

Most glovebox and process cell calculations assume nominal (1-inch) tight-fitting reflection 

conditions. The staff determined that this approach was acceptable given the lack of transient 

reflectors (e.g., personnel) because of engineered barriers in these areas and the use of drip 

trays to detect significant accumulations of liquid and limitations on sources of liquids within 

these areas. 

Interaction between units was generally considered in facility calculation documents and 

NCSEs. The staff observed that significant numbers of “small” or “ancillary equipment,” such as 

pipes, safe volume demisters, and pots, were not generally included in calculations. The staff 

reviewed facility plan and elevation drawings, as well as information from the applicant’s threedimensional CAD system, and concurs that this equipment, even if filled with optimal solution, 

will not have a significant effect on the reactivity of the system. The staff reviewed several 

sensitivity calculations that support this conclusion during its in-office reviews (see summary of 

meeting held December 15–16, 2009 (NRC, 2010a)) and found them acceptable. 

Finally, neutron absorbers relied on for criticality safety will be procured and qualified in 

accordance with the facility’s quality assurance program. The staff reviewed several 

procurement specifications for items, such as borated concrete and tanks, which incorporate 

fixed neutron absorbers and determined that they were adequate. 

The aqueous process units reviewed included decanning (KDA) and milling (KDM); dissolution 

(KDB) and dechlorination/dissolution (KDD); purification (KPA); solvent recovery (KPB); 

homogenization, filling, and sampling (KCB); PuO2 canning (KCC); oxalic mother liquor recovery 

(KCD); acid recovery (KPC); offgas treatment (KWG); stripped uranium and high alpha waste 

(KWD); waste organic solvent (KWS); and oxalic precipitation (KCA). The staff selected 

representative accident sequences and IROFS for further review and determined that they were 

adequate to meet both the performance requirements and the double contingency principle. 

6.2.2.2 MOX Process 

The facility receives PuO2 powder in 3013 containers from the PDCF and stores it until it can be 

processed in the aqueous polishing process. Purified PuO2 from the KCA is stored in the buffer 

storage unit (DCE) before being batched into primary dosing (NDP), where it is blended with 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 33 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

depleted UO2 to form primary blend with no more than 22 wt% Pu/(U+Pu). The powder is 

downblended further as final blend with no more than 6 wt% Pu/(U+Pu) and is then milled and 

ultimately homogenized. Throughout this portion of the process, the powder is transferred in 

large J80 or J60 powder “jars.” The powder is then pressed into pellets, sintered to a hard 

ceramic, ground to the proper diameter, inspected, and assembled first into rods and then into 

finished fuel assemblies. Additional units handle off-specification pellets, powder that must be 

recycled into primary dosing, and any waste generated. 

 The supplier (DOE) must certify the feed material to have less than 

0.5 wt% moisture content and be within assumed isotopic limits (i.e., plutonium and uranium 

isotopic abundances and maximum ratio of uranium to plutonium). The applicant’s criticality 

calculations assume bounding isotopic values throughout both the aqueous polishing and the 

MOX processes. The vendor must comply with bounding assumptions about moisture content, 

isotopic composition, and density of the feedstock; the applicant will audit the vendor’s quality 

assurance program to ensure this. (The staff will follow up on the applicant’s audit methods 

during the verification of the PSSCs, as discussed in Section 6.1.3.2 of this SER. In addition, 

the applicant has stated that it will perform nondestructive assay, such as calorimetry and 

gamma spectroscopy, on a sampling basis to confirm the mass and isotopic content). This is 

not specifically credited for meeting the performance requirements and the double contingency 

principle, but these actions will provide defense in depth.) Compliance with the structural 

integrity requirements of DOE-STD-3013-2004 (Stabiilzation, Packaging, and Storage of 

Plutonium-Bearing Materials) (DOE, 2004) will ensure that these limits are maintained through 

storage and handling until the interior cans are opened in the KDA during the aqueous polishing 

process, so that assumptions made in the applicant’s criticality evaluations will remain valid. 

Limits on the moisture content of purified PuO2 reintroduced from the aqueous polishing process 

are ensured by controls on temperature and residence time (screw speed) in the KCA furnace. 

Subsequent to this (until pelletizing and sintering), the moisture content of the powder is limited 

by handling the material within moderation controlled gloveboxes. These gloveboxes rely on 

such standard industry strategies as taking credit for the structural integrity of the gloveboxes, 

limiting the quantity of moderating materials used within the glovebox (such as organic additives 

and equipment lubricants), restricting the use of extraneous moderators, and prohibiting 

solution-bearing process piping. The staff reviewed these approaches to implementing 

moderator control and found them to be consistent with applicable guidance (e.g., ANSI/ANS8.22-1997) and standard industry practice. The applicant stated that it would administratively 

control moderators through development of a Moderator Control Program, which would include 

moderator exclusion training as an important component. This program is yet to be developed. 

The staff will confirm the applicant’s development of the Moderator Control Program, as well as 

the associated moderator exclusion training, as part of the verification of the PSSCs. 

The criticality analyses conservatively assume that the powder can absorb up to 3 wt% moisture 

from humidity in the air, plus another 2 percent to account for organic additives introduced 

during blending. The staff reviewed historical records from the reference facilities concerning 

moisture content and determined that the values assumed in the criticality analysis bounded the 

worst-case historical data. For AFS material, the impurity level must be limited to less than 

30 wt% to ensure that the above assumed uptake from moist air will remain bounding (as 

chemical impurities can change physical properties of the material). Extraneous sources of 

moderator are strictly limited in moderation controlled areas. Total lubrication inside gloveboxes 

is limited to less than 1 kilogram of water-equivalent moisture (and any single component with 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 34 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

more than 100 grams of lubricant must use nonhydrogenous materials). The calculation 

deriving this limit was conservative in that it assumed that all of the fissile material in the 

glovebox was arranged in a spherical configuration and fully reflected by water. 

 The applicant has yet to complete calculations that will 

definitively demonstrate the bounding nature of the 1,000-gram moderation limit over all credible 

arrangements of individual 100-gram items. The staff will confirm the applicant’s completion of 

criticality calculations to support operation of the MFFF as part of the verification of the PSSCs, 

as discussed in Section 6.1.3.4 of this SER. The applicant has also stated that its estimates of 

quantities of lubricants to be used in moderation controlled areas were preliminary and were 

based on representative vendors and equipment. The staff will verify the applicant’s 

implementation of moderation controlled areas as part of the verification of the PSSCs. Other 

sources of moderator will be excluded by facility design (e.g., exclusion of liquid-bearing pipes, 

sill height limitations, floor drains), and by prohibiting the use of moderating (hydrogenous) fire 

suppression agents. 

Following pelletizing, moderation control is much less important, because the moderator cannot 

readily be intimately mixed with the fuel at that point. Upon exit from the sintering furnace, the 

residence time and pellet diameter are recorded to ensure that pellets have been adequately 

sintered (driving off almost all of their internal moisture). The sintered pellets must then pass 

through a “mechanical filter” before passing the grinding wheel in units PRE and PRF. If the 

diameter of the pellet is too large, it will not successfully pass through the aperture of the 

mechanical filter. Sintered and unsintered “green” pellets are segregated by means of barcode 

readers and an observation station where the furnace residence time and diameter records are 

checked before they are placed in storage. The segregation of sintered and unsintered pellets 

is not significant for pellet storage, but is credited for ensuring that pellets still containing 

significant moisture are not scrapped and subsequently recycled as primary blend, which can 

lead to exceeding moderation limits in the recycled powder or new pellets. The staff examined 

all pathways by which areas analyzed subcritical for sintered pellets only could receive 

unsintered pellets by mistake to ensure that such a scenario will be highly unlikely and found the 

pathways acceptable. 

Mass control is ensured primarily through the use of IROFS scales to limit the quantity of oxide 

in individual containers and by tracking the number and identity of such containers entering or 

leaving an enclosure with barcode readers and system programmable logic controllers (SPLCs). 

Scales are generally used to measure the weight of containers before and after filling to ensure 

that they comply with mass limits and to detect any possible spills. The mass limits were 

derived from conservative calculations that (1) assume all of the material is in a spherical 

configuration, (2) the bounding moderation is present in the most reactive heterogeneous 

arrangement, as described above, and (3) the powder spheres are fully reflected by water. The 

amount of material transported even in the large J60 or J80 jars is significantly less than the 

maximum safe mass thus determined. In general, multiple failures of either mass or moderator 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 35 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

(or both) would be needed before criticality is possible. Most of these scenarios have sufficient 

margin to be included in the Category B criterion for being highly unlikely. 

 

The staff reviewed reference facility records and experimental data associated with the powder 

density and determined that the assumed density values for PuO2 and MOX powders are 

conservative (NRC, 2008c). Besides using bounding density values based on historical data 

and experiments, the applicant has stated that it will verify powder density values during startup 

testing, and will measure density at key points in the process thereafter. 

The applicant stated in response to RAI NCS-90 (NRC, 2009c) that it will perform calculations 

showing that the MOX process will be subcritical, even if full density (4.6 g/cc) scrap is 

introduced. The staff will verify completion of criticality calculations to support operation of the 

MFFF as part of the verification of the PSSCs, as discussed in Section 6.1.3.4 of this SER. 

The staff determined that the applicant’s approach to controlling all these parameters is 

consistent with standard industry practice, complies with the double contingency principle, and 

is an acceptable approach to meeting the regulations of 10 CFR Part 70. 

The MOX process units reviewed included PuO2 receiving (DCP), PuO2 3013 storage (DCM), 

PuO2 buffer storage (DCE), can receiving and emptying (DCE), scrap processing (NCR), 

powder auxiliary unit (NXR), jar storage and handling (NTM), pellet storage (PPJ), the sintering 

furnaces (PFE/PFF), grinding (PRE/PRF), pellet handling (PML), rod storage (STK), rod tray 

handling (SMK), filter dismantling (VDR), fuel assembly handling and storage (TAS), acid 

recovery (KPC), stripped uranium and high alpha waste (KWD), waste organic solvent (KWS), 

offgas treatment (KWG), oxalic mother liquor recovery (KCD), and primary dosing (NDP). The 

staff selected representative accident sequences and IROFS for further review and determined 

that they adequately met both the performance requirements and the double contingency 

principle. 

6.2.2.3 Auxiliary Systems 

Auxiliary systems are those that are not directly involved with the fuel manufacturing process 

but are needed to support either the aqueous polishing or the MOX process. They may or may 

not contain fissile material under normal conditions. The auxiliary systems reviewed included 

the MOX process ventilation, pneumatic transfer, and container hand-carry and nonautomated 

transfer (lumped together as the RCA unit); automatic sampling unit (KPG); laboratory liquid 

waste unit (LGF); laboratory units (LLJ, KCA/B/C); and laboratory test line unit (LCT). Also 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 36 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

reviewed were the waste handling processes: the waste storage unit (VDQ) and the waste 

nuclear counting unit (VDT).5

 

The MOX process ventilation does not normally contain fissile material; mass control is 

instituted by means of multiple redundant high-efficiency particulate air filters. These are 

favorable geometry filters, equipped with differential pressure gauges and subject to periodic 

surveillance. These controls and management measures ensure that failure leading to a 

significant accumulation of process powder in ventilation ductwork will be highly unlikely. The 

ductwork itself is mostly favorable geometry, though not specifically credited. Besides mass, 

the ventilation system credits moderation control; processes connected to the ventilation system 

are within moderation controlled gloveboxes. These gloveboxes are under “dynamic 

confinement,” meaning that they are under negative pressure and have a dry atmosphere, 

produced by a constant flow of dry air or nitrogen, to limit the moisture available for 

condensation. However, some wet offgas may be carried over into process ventilation from the 

furnaces. To address this possibility, the applicant performed an analysis to show that 

ventilation piping surfaces will remain above the dewpoint, thereby preventing condensation. 

The applicant has since stated, in response to RAI NCS-90NCS-94, that it will revise the 

applicable NCSE to modify the technical justification as to why the ventilation system will not 

contain liquid water. The staff will confirm the applicant’s implementation of moderation control 

for the process ventilation system as part of the verification of the PSSCs. 

The pneumatic transfer system mostly consists of favorable geometry piping, in which fissile 

material is transferred in sealed, mass-controlled containers. The container and the transfer 

shuttle constitute two layers of containment. The staff reviewed the criticality safety basis for 

the pneumatic transfer system and determined that a very large number of spills would be 

required to constitute a criticality concern. A small accumulation over time would eventually 

result in a mass imbalance in one of the destination gloveboxes, which would be detected. 

Therefore, the risk of a criticality in the pneumatic transfer system is highly unlikely. 

Occasionally, fissile-bearing items may have to be hand-carried from one process area to 

another; the reasons for doing so may include the replacement of defective contaminated 

equipment or the manual transfer of unusual scrap or waste material. Items to be transported 

must be contained inside sealed, watertight containers, two of which must have been shown to 

be subcritical when touching and fully surrounded by water. In addition, containers must be 

separated by 12 inches from all other fissile-bearing items and the concrete floors, ceiling, and 

walls. The applicant will comply with the mass limits for removed contaminated equipment by 

one of two means: either by assuming that the entire volume is filled with fissile material or by 

radiation scanning. The staff will verify calibration and demonstration of the fissile mass 

measurements based on IROFS radiation detectors as part of the verification of the PSSCs, as 

discussed in Section 6.2.2.1 of this SER. 

With regard to the basis for the 12-inch separation distance, MOX Services provided an analysis 

based on the use of the solid angle formula (Knief, 2000). Solid angles were based on spherical 

masses, and individual unit unreflected keff values were determined by using the reactivity 

formula (Lamarsh, 2001). Results showed that the solid angle subtended by the spheres was 

less than 1 steradian, which is the allowable limit for individual units with unreflected keff less 

than 0.8. During an onsite review (see summary of meeting held December 16–17, 2008 (NRC, 

 

5

 While the applicant grouped these units in with the MOX process units, waste processes are not tied directly 

to the main fuel manufacturing process, so the staff will discuss them along with the other auxiliary units. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 37 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

2010a)), the applicant showed the staff new calculations that confirmed the results of the solid 

angle method. 

The waste processing units reviewed consisted of the waste storage unit (VDQ) and the waste 

nuclear counting unit (VDT). The waste drums in these units are expected to consist of lowlevel contaminated industrial waste, but the staff chose these two units for review because they 

rely heavily on simple administrative controls unlike other areas in the MFFF. While drums are 

expected to contain only small quantities of fissile material, they were modeled with very 

conservative assumptions, including the following: (1) each drum was filled up to the maximum 

allowable mass with full-density PuO2, (2) the fissile material was arranged in a spherical 

configuration within the drum, and (3) the fissile material was moderated by water or 

polyethylene. The drums are modeled in an infinite planar array, neglecting the steel bodies of 

the drums so that they may be stored in any arrangement, so long as they are not stacked 

(except as specifically analyzed safe in the storage racks). The nature of these conservative 

assumptions means that, even if a very large number of drums were stacked together, or a 

large number of drums exceeded their mass limits, criticality will still be very unlikely (see 

summary of meeting held December 15–16, 2009 (NRC, 2010a)). 

The staff determined that exceeding the mass limit in a large number of drums is highly unlikely 

because of the margin resulting from the nature of waste streams involved and because the 

drums must have their mass confirmed by two different operators (and one of the 

determinations must be made using either the precounter or neutron counter), with the 

exception of used process filters, whose mass is estimated using differential pressure 

measurements correlated to the mass. The applicant classified these events as Category C 

highly unlikely events. The applicant stated in response to RAI NCS-93 (NRC, 2009c) that it will 

use a combination of passive neutron counting, active neutron interrogation, and gamma 

spectroscopy to determine plutonium masses in drums. The staff will verify the applicant’s 

methods for determining the contents of fissile waste drums as part of the verification of the 

PSSCs. 

 

In the VDT unit, the main concern involves the accuracy of the drum counting process (for 

subcriticality of drum storage), since there are many less drums in this unit than in the VDQ. 

The staff reviewed the scenarios by which an erroneous mass determination could lead to 

criticality concerns in downstream units and determined that they adequately met the double 

contingency principle. (Note that drum assay is initially estimated upstream in the VDQ and 

VDU, with the purpose of the VDT being to obtain a more accurate assay.) Based on this 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 38 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

review, the staff determined that there was reasonable assurance of safety in the handling and 

storage of waste drums in the MFFF. The staff determined that the auxiliary units reviewed 

adequately met both the performance requirements and the double contingency principle. 

6.3 Evaluation Findings

The staff reviewed the description of the applicant’s NCS Program contained in Chapter 6 of the 

LA. Based on the foregoing review, the staff determined that there is reasonable assurance that 

the applicant will establish and maintain a program sufficient to ensure health and safety and 

compliance with all criticality safety regulatory requirements. In particular, the staff has 

reasonable assurance that the applicant will (1) have in place a staff qualified to develop, 

implement, and maintain an NCS Program in accordance with the application’s description of 

facility organization, administration, and management measures; (2) conduct its operations 

based on technical practices sufficient to ensure that licensed material will be possessed, 

stored, and used safely according to the requirements of 10 CFR Part 70; (3) develop, 

implement, and maintain a CAAS in accordance with the requirements of 10 CFR 70.24; and 

(4) establish safety limits and controls sufficient to ensure subcriticality, including an appropriate 

margin of subcriticality for safety, and the baseline design criteria of 10 CFR 70.64. Based on 

this review, the staff has reasonable assurance that the applicant’s NCS Program will meet the 

requirements for a license to possess and use SNM under 10 CFR Part 70 and will ensure 

protection of public health and safety, including workers and the environment. The staff will 

confirm this conclusion during the verification of the PSSCs, as required by 10 CFR 70.23(a)(8) 

and discussed in Chapter 1 of this SER. 

The staff also reviewed selected portions of the applicant’s ISA Summary and supporting onsite 

ISA documents. Based on the foregoing review, the staff determined that there is reasonable 

assurance that the applicant will implement and maintain safety limits and controls sufficient to 

ensure health and safety and compliance with all criticality safety regulatory requirements. In 

particular, the staff has reasonable assurance that the applicant will establish controls on all 

credible accident sequences leading to criticality sufficient to ensure that (1) credible accident 

sequences will be highly unlikely, (2) all processes will be subcritical under normal and credible 

abnormal conditions, and (3) all processes will adhere to the double contingency principle. 

Based on this review, the staff has reasonable assurance that the applicant’s implementation of 

its ISA will meet the applicable requirements of 10 CFR 70.66(a) and will ensure protection of 

public health and safety, including workers and the environment. The staff will verify this 

conclusion during the verification of the PSSCs, as required by 10 CFR 70.23(a)(8) and 

discussed in Chapter 1 of this SER. 

REFERENCES 

In-Office Review Summaries: 

(NRC, 2008a) Tiktinsky, D., U.S. Nuclear Regulatory Commission, Memorandum to 

Margie Kotzalas, “In-Office Review Summary: Mixed Oxide Fuel Fabrication Facility (Criticality 

Review I AND II),” January 14, 2008. 

. 

(NRC, 2008b) Christopher Tripp, U.S. Nuclear Regulatory Commission, Interoffice E-mail to 

K. Morrissey, et. al., “Cracked Concrete Calculations,” September 22, 2008. 

(NRC, 2008c) Morrissey, K., U.S. Nuclear Regulatory Commission, Interoffice E-mail to Foreign 

Travel, “Trip Report (7 day) for France Visits to La Hague and Melox,” April 9, 2008. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 39 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

(NRC, 2009a) David Tiktinsky, U.S. Nuclear Regulatory Commission, E-mail to Dealis W. Gwyn, 

MOX Services, “Follow-up to LA RAI & Site Visit Plan Info for In-office Review on 12/16-17.” 

2009 

(NRC, 2010a) Morrissey, K., U.S. Nuclear Regulatory Commission, Memorandum to 

Eric Oesterle, “In-Office Review Summaries: Mixed Oxide Fuel Fabrication Facility (Criticality 

Reviews Three Through Nine),” February 23, 2010. 

(NRC, 2010b) Christopher Tripp, U.S. Nuclear Regulatory Commission, Interoffice E-mail to 

D. Tiktinsky, et al., MOX Meeting Summary, January 11, 2010. 

Request for Additional Information Submittals

(NRC, 2008d) Tiktinsky, D., U.S. Nuclear Regulatory Commission, Letter to Dealis W. Gwin, 

Shaw AREVA MOX Services, RE: Request for Additional Information Regarding the Review of 

the Criticality Safety Aspects of the Mixed Oxide Fuel Fabrication Facility License Application 

Request, April 30, 2008. 

(NRC, 2009b) U.S. Nuclear Regulatory Commission, Letter to Dealis W. Gwyn, Shaw AREVA 

MOX Services, RE: Request for Additional Information Regarding the Review of the Criticality 

Safety Aspects Related to the Integrated Safety Assessment Summary for the Mixed Oxide Fuel 

Fabrication Facility License Application Request. 2009 

Requests for Additional Information Responses

(NRC, 2008e) Stinson, D., Shaw AREVA MOX Services to USNRC Document Desk, “Submittal 

of Responses to Request for Additional Information Regarding the Review of the Criticality 

Safety Aspects of the Mixed Oxide Fuel Fabrication Facility License Application Request,” 

August 22, 2008. 

(NRC, 2009c) Stinson, D., Shaw AREVA MOX Services to USNRC Document Desk, 

“Responses to Request for Additional Information Regarding the Review of the Criticality Safety 

Aspects Related to the Integrated Safety Assessment Summary for the Mixed Oxide Fuel 

Fabrication Facility License Application Request,” October 5, 2009. 

American National Standards Institute Standards

American National Standards Institute/American Nuclear Society, ANSI/ANS-8.1-1998, “Nuclear 

Criticality Safety in Operations with Fissionable Materials Outside Reactors,” ANS, La Grange 

Park, IL. 

— — — ANSI/ANS-8.3-1997 (R2003), “Criticality Accident Alarm System,” ANS, La Grange 

Park, IL. 

— — — ANSI/ANS-8.5-1996, “Use of Borosilicate-Glass Raschig Rings as a Neutron Absorber 

in Solutions of Fissile Material,” ANS, La Grange Park, IL. 

— — — ANSI/ANS-8.6-1989, “Safety in Conducting Subcritical Neutron-Multiplication 

Measurements In Situ,” ANS, La Grange Park, IL. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 40 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

— — — ANSI/ANS-8.7-1998, “Guide for Nuclear Criticality Safety in the Storage of Fissile 

Materials,” ANS, La Grange Park, IL. 

— — — ANSI/ANS-8.9-1975 (R1995), “Guide for Nuclear Criticality Safety for Steel-Pipe 

Intersections Containing Aqueous Solutions of Fissile Materials,” ANS, La Grange Park, IL. 

— — — ANSI/ANS-8.10-1983 (R2005), “Criteria for Nuclear Criticality Safety Controls in 

Operations with Shielding and Confinement,” ANS, La Grange Park, IL. 

— — — ANSI/ANS-8.12-1987 (R002), “Nuclear Criticality Control and Safety of PlutoniumUranium Fuel Mixtures Outside Reactors,” ANS, La Grange Park, IL. 

— — — ANSI/ANS-8.15-1981 (R1995), “Nuclear Criticality Control of Special Actinide 

Elements,” ANS, La Grange Park, IL. 

— — — ANSI/ANS-8.17-2004, “Criticality Safety Criteria for the Handling, Storage, and 

Transportation of LWR Fuel Outside Reactors,” ANS, La Grange Park, IL. 

— — — ANSI/ANS-8.19-2005, “Administrative Practices for Nuclear Criticality Safety,” ANS, La 

Grange Park, IL. 

— — — ANSI/ANS-8.20-1991 (R1999), “Nuclear Criticality Safety Training,” ANS, La Grange 

Park, IL. 

— — — ANSI/ANS-8.21-1995, “Use of Fixed Neutron Absorbers in Nuclear Facilities Outside 

Reactors,” ANS, La Grange Park, IL. 

— — — ANSI/ANS-8.22-1997, “Nuclear Criticality Safety Based on Limiting and Controlling 

Moderators,” ANS, La Grange Park, IL. 

— — — ANSI/ANS-8.23-1997, “Nuclear Criticality Accident Emergency Planning and 

Response,” ANS, La Grange Park, IL. 

— — — ANSI/ISA S67.04.01-2000, “Setpoints for Nuclear Safety Related Instrumentation, 

ANS, La Grange Park, IL 

MOX Services Submittals

(DCS, 2005) Duke Cogema, Stone and Webster, “Mixed Oxide Fuel Fabrication Facility 

Construction Authorization Request,” Charlotte, NC, March 2005. 

(MOX, 2010a) Shaw AREVA MOX Services, “Mixed Oxide Fuel Fabrication Facility—License 

Application,” Aiken, SC, March 2010. 

(MOX, 2010b) Shaw AREVA MOX Services, “Mixed Oxide Fuel Fabrication Facility—Integrated 

Safety Analysis Summary,” March 2010. 

NUREGs
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 6 - 41 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” Washington, 

DC, August 2000. 

(NRC, 2005a) U.S. Nuclear Regulatory Commission, NUREG-1821, “Final Safety Evaluation 

Report on the Construction Authorization Request for the Mixed Oxide Fuel Fabrication Facility 

at the Savannah River Site, South Carolina,” Washington, DC, March 2005. 

Other References

(DOE, 2004) U.S. Department of Energy, DOE-STD-3013-2004, “Stabiilzation, Packaging, and 

Storage of Plutonium-Bearing Materials”, Washington, DC, , April 2004 

(NRC, 2005b) U.S. Nuclear Regulatory Commission, RG 3.71, Revision 1, “Nuclear Criticality 

Safety Standards for Fuels and Material Facilities,” Washington, DC, October 2005. 

(Kneif, 2000) Kneif, Ronald A., “Nuclear Criticality Safety: Theory and Practice,” American 

Nuclear Society, LaGrange Park, IL, 2000. 

(Lamarsh, 2001) Lamarsh, John R., “Introduction to Nuclear Engineering,” Third Edition, 

Prentice Hall, NJ, 2001. 

(Los Alamos, 2000) McLaughlin, Thomas P., et al., LA-13638, “A Review of Criticality Accidents: 

2000 Revision.” 

(NRC, 1999) Regulatory Guide 1.105, Setpoints for Safety-Related Instrumentation 

10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities 

10 CFR Part 70, Domestic Licensing of Special Nuclear Material 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 1 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7.0 FIRE PROTECTION

This chapter of the safety evaluation report (SER) contains the staff’s review of fire protection 

described by the applicant in Chapter 7 of the license application (LA) (MOX, 2010a). The 

objective of this review is to verify whether the applicant’s commitments and goals related to fire 

protection are adequate to meet or exceed the regulatory acceptance criteria referenced below. 

The review is necessary to verify that the Mixed Oxide Fuel Fabrication Facility (MFFF) is 

adequately protected against external and internal fires and that the items relied on for safety 

(IROFS) identified by the applicant adequately protect against natural phenomena and the 

consequences of potential accidents. 

The staff evaluated the information provided by the applicant for fire protection by reviewing 

Chapter 7 of the LA, other sections of the LA, the Integrated Safety Analysis (ISA) Summary 

(MOX, 2010b), and supplementary information provided by the applicant. The staff coordinated 

its review of fire protection with the review of explosion protection aspects (see Chapter 8 of this 

SER), and the review of other plant systems (see Chapter 11 of this SER). 

7.1 Regulatory Requirements

The staff reviewed the fire protection information in the LA with respect to compliance with the 

following regulations: 

• Title 10 of the Code of Federal Regulations (10 CFR) 70.22(a)(7) states that the 

applicant must describe the equipment and facilities to protect health and minimize 

danger to life and property 

• 10 CFR 70.23(a)(3) states that, for approval of an LA, the Commission must determine 

that the applicant’s proposed equipment and facilities are adequate to protect health and 

minimize danger to life or property. 

• 10 CFR 70.61, “Performance Requirements,” states that the applicant shall evaluate in 

the ISA its compliance with the performance requirements. 

• 10 CFR 70.64, “Requirements for New Facilities or New Processes at Existing 

Facilities,” requires that the design of new facilities incorporate the baseline design 

criteria and defense-in-depth practices. With respect to fire protection, 

10 CFR 70.64(a)(3) requires that the MFFF design Aprovide for adequate protection 

against fires.@

7.2 Regulatory Acceptance Criteria

Sections 7.4.3 and 7.5 of NUREG-1718, “Standard Review Plan for the Review of an 

Application for a Mixed Oxide (MOX) Fuel Fabrication Facility” (NRC, 2000), outlines the 

acceptance criteria for the U.S. Nuclear Regulatory Commission (NRC) review of the applicant’s 

fire safety program and equipment. Sections of NUREG-1718 that are no longer applicable to 

the review Chapter 7 of this SER, based on the current design, are: Section 7.4.3.2.I 

concerning design of the ventilation system (the facility ventilation system is evaluated in 

Sections 11.3 and 7.3.2.6 of this SER), Section 7.4.3.2.O concerning hydrogen use and storage 

(Hydrogen gas is not used in the current design), Section 7.4.3.2.Z concerning flammable and 

combustible solvents (storage and handling of materials in the facility are discussed in Section 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 2 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

7.3.1.2 of this SER), Section 7.4.3.2.AA concerning inert gas purge and vent systems (the 

systems mentioned in the SRP are not in the current design), and Section 7.4.3.2.BB 

concerning incinerators, boilers, and furnace (the systems mentioned in the SRP section are not 

in the current design). In addition, Sections 7.4.3.3.A–E concerning requirements for a site fire 

brigade were not considered applicable because the Savannah River Site (SRS) fire department 

will perform all manual firefighting operations (see Section 7.3.3 of this SER). 

 

7.3 Staff Review and Analysis

Sections 7.3.1 through 7.3.4 of this SER provide the staff’s evaluation of how the applicant 

addressed the fire protection acceptance criteria in NUREG-1718. SER Section 7.3.5 is the 

staff’s evaluation of the IROFS, and SER Section 7.3.6 gives the staff’s evaluation of the 

applicant’s event sequences for the regulatory requirements on fire safety. 

7.3.1 Organization and Conduct of Operations

The organization and conduct of operations are the management measures that ensure that fire 

safety is administered appropriately at a licensed facility. Section 7.1 of the LA (MOX, 2010a) 

describes the applicant’s commitment to ensure that IROFS as identified in the ISA Summary 

(MOX, 2010b) are available and reliable; fire protection organizational responsibilities are 

defined; transient ignition sources and combustibles are controlled; and the facility maintains a 

readiness to extinguish or limit the consequences of a fire. The applicant has developed a fire 

protection program with administrative controls in order to meet the organizational and 

operational guidance of NUREG-1718 (NRC, 2000). The fire protection program and 

associated administrative controls meet the regulatory acceptance criteria and fire protection 

baseline design criteria of 10 CFR 70.64(a)(3) and are, therefore, acceptable. The following 

sections provide more details on the applicant’s plans for a fire protection program and 

administrative controls. 

7.3.1.1 Fire Protection Program 

In Chapter 7 of the LA, the applicant described the fire protection program developed for the 

MFFF. The program establishes defense-in-depth practices for IROFS and the procedures, 

equipment, and personnel required to implement the program. The program is designed to do 

the following: 

• Prevent fires from starting. 

• Detect fires rapidly and determine their location. 

• Inform MFFF workers of fires. 

• Inform the SRS Operations Center of fires. 

• Control and limit the spread of fires. 

• Promptly extinguish fires. 

• Maintain safe egress paths for plant personnel in the event of fire. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 3 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

• Protect IROFS when a fire is not promptly extinguished by the fire protection features 

and systems, so that neither an uncontrolled release of radioactive material or a 

hazardous chemical nor a criticality event occurs. 

The fire protection program defines organizational responsibilities, lines of communication, and 

personnel qualification requirements. Specific management responsibilities are as follows: 

• The manager of the plant has overall responsibility for formulation, implementation, 

 effectiveness, and assessment of the MFFF fire protection program. 

• The manager of the production function is responsible for implementing periodic 

inspections to minimize the amount of combustibles in areas with IROFS and for 

determining the effectiveness of housekeeping practices. The position is also 

responsible for ensuring the availability and acceptable condition of fire protection 

systems and equipment and fire stops and fire-rated penetration seals, and for ensuring 

that prompt and effective corrective actions are taken to remedy conditions adverse to 

fire protection. 

• The manager of the maintenance function is responsible for periodic inspections and 

testing of fire protection systems and equipment in accordance with established 

procedures. 

• The manager of the quality assurance function is responsible for ensuring the effective 

implementation of the quality-affecting aspects of the fire protection program by planned 

inspections and scheduled audits. 

• The individual responsible for the fire protection function has at least 5 years of 

experience as a fire protection engineer. This position is responsible for reviews and 

evaluations of proposed work activities to identify potential transient fire loads and to 

periodically assess the effectiveness of the fire protection program, including through fire 

drills and training. The individual responsible for fire protection reports to the manager of 

the regulatory function. 

• The manager of the training function is responsible for providing MFFF-specific training 

to the SRS fire department. The position is also responsible for implementing a program 

for training MFFF personnel in administrative procedures that implement the fire 

protection program and emergency procedures relative to fire protection. 

Consistent with the guidance in Section 7.4.3.1.A of NUREG-1718 (NRC, 2000), the fire 

protection program establishes the policy for the protection of IROFS at the plant and the 

procedures, equipment, and personnel required to implement the program at the plant site and 

is, therefore, acceptable. 

7.3.1.2 Administrative Controls 

Administrative controls establish procedures for the following: 

• fire prevention 

• surveillance procedures 

• control of flammable and combustible materials 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 4 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

• control of ignition sources 

• testing, inspection, and maintenance 

• impairments 

• fire response planning 

• prefire plans 

Fire prevention includes controls on operational activities, design features such as sparkresistant electrical components, and restrictions on the use of combustible materials. 

Surveillance procedures include inspections of combustible loading, fire protection equipment 

and systems, general housekeeping, and transient combustibles. 

Control of flammable and combustible materials includes the following: 

• The applicant has limits on the bulk storage of combustible materials inside or adjacent 

to buildings or systems containing IROFS. This meets the guidance in 

Section 7.4.3.1.B.(i) in NUREG-1718 (NRC, 2000) and is, therefore, acceptable. 

• The applicant has controls on the storage and handling of ordinary combustible 

materials, combustible and flammable gases and liquids, combustible high-efficiency 

particulate air (HEPA) and charcoal filters, dry ion exchange resins, pyrophoric 

materials, and other combustible supplies in areas containing IROFS. Flammable and 

combustible liquids are handled in accordance with National Fire Protection Association 

(NFPA) 30, “Flammable and Combustible Liquids Code” (NFPA, 1996d). This meets the 

guidance in Section 7.4.3.1.B.(ii) in NUREG-1718 (NRC, 2000) and is, therefore, 

acceptable. 

• The applicant will ensure that the storage and handling of pyrophoric metals is in 

accordance with methods in the applicable codes and industry standards. Combustible 

loading in areas containing IROFS is in accordance with applicable guidance in NFPA 

801, Standard for Fire Protection for Facilities Handling Radioactive Materials, 1998 

edition (NFPA, 1998d). The applicant commits to storing, handling, and using 

flammable and combustible liquids in accordance with applicable sections of NFPA 30, 

Flammable and Combustible Liquids Code, 1996 edition (NFPA, 1996d). The applicant 

will store, handle, and use flammable and combustible gases in accordance with 

applicable portions of NFPA 50A, Standard for Gaseous Hydrogen Systems at 

Consumer Sites, 1999 edition (NFPA, 1999a) and NFPA 55, Standard for the Storage, 

Use, and Handling of Compressed and Liquefied Gases in Portable Cylinders, 1998 

edition (NFPA, 1998c). Where appropriate, explosion prevention measures are 

implemented by the applicant in accordance with applicable sections of NFPA 69, 

Standard on Explosion Prevention Systems, (NFPA, 1997a). This meets the guidance in 

Section 7.4.3.1.B.(i) and (ii) in NUREG-1718 (NRC, 2000) and is, therefore, acceptable. 

• The applicant has procedures for handling transient fire loads, such as combustible and 

flammable liquids, wood and plastic products, or other combustible materials, in 

buildings containing IROFS during the phases of operation and especially during 

maintenance or modification activities. This meets the guidance in Section 7.4.3.1.B.(iii) 

in NUREG-1718 (NRC, 2000) and is, therefore, acceptable. 

• The applicant will ensure that the use of wood is permitted only when noncombustible 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 5 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

products are not practical from a process consideration. Where used, wood is treated 

with a flame retardant. This meets the guidance in Section 7.4.3.1.B.(iii) in NUREG1718 (NRC, 2000) and is, therefore, acceptable. 

• The applicant will ensure that transient combustible materials are unpacked outside of 

MFFF production areas as much as practical. When necessary, transient combustible 

packing materials may be unpacked inside MFFF production areas; however, the 

materials are removed from the area following unpacking. Loose combustible packing 

material, such as wood or paper excelsior or polyethylene sheeting, is placed in metal 

containers with tight-fitting, self-closing metal covers if the material remains in production 

areas. This meets the guidance in Section 7.4.3.1.B.(v) in NUREG-1718 (NRC, 2000) 

and is, therefore, acceptable. 

• The applicant will ensure that work-generated combustible waste is removed from 

buildings containing IROFS following completion of the activity or at the end of the shift, 

whichever comes first. This meets the guidance in Section 7.4.3.1.B.(v) in NUREG-1718 

(NRC, 2000) and is, therefore, acceptable. 

The IROFS, combustible material loading controls (SER Section 7.3.5.1) and ignition source 

controls (SER Section 7.3.5.19), also ensure the control of flammable and combustible material. 

The applicant also provides for periodic housekeeping inspections. This meets the guidance in 

Section 7.4.3.1.B.(vii) and is, therefore, acceptable. 

Ignition sources are controlled by design, such as the selection of appropriate electrical 

equipment in gloveboxes where combustible material is present and the absence of electrical 

equipment in process cells. The following national codes and standards are used for the 

selection of electrical equipment in gloveboxes to minimize the risk of electricity as an ignition 

source: 

• NFPA 70, “National Electrical Code” (NFPA, 1999c) 

• 29 CFR 1910, “Occupational Safety and Health Standards” (OSHA, 2004) 

• Underwriters Laboratories (UL) 508, “Industrial Control Equipment” (UL, 1993) 

• Institute of Electrical and Electronics Engineers (IEEE) 383, “Standard for Qualifying 

Class 1E Electric Cables and Field Splices for Nuclear Power Generating Stations” 

(IEEE, 1992) 

Ignition sources are also controlled by work control procedures requiring the following: 

• The applicant requires permits to control welding, grinding, flamecutting, brazing, or 

soldering operations; separate permits for each area where work is to be performed; and 

an allowable duration for the validity of permits. This meets the guidance in 

Section 7.4.3.1.B.(iv) in NUREG-1718 (NRC, 2000) and is, therefore, acceptable. 

• The applicant requires the conduct of welding and grinding in accordance with applicable 

portions of NFPA 51B, “Standard for Fire Prevention During Welding, Cutting, and Other 

Hot Work” (NFPA, 1999b). This meets the guidance in Section 7.4.3.1.B.(iv) in NUREG1718 (NRC, 2000) and is, therefore, acceptable. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 6 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

• The applicant prohibits the use of open flames or combustion-generated smoke for leak 

testing. This meets the guidance in Section 7.4.3.1.B.(vi) in NUREG-1718 (NRC, 2000) 

and is, therefore, acceptable. 

• Smoking is restricted to designated areas outside of the MFFF buildings. 

• Written procedures document testing, inspection, and maintenance, and the results and 

followup actions are recorded. Water-based MFFF fire protection systems and 

equipment are inspected, tested, and maintained in accordance with applicable portions 

of NFPA 25, “Standard for the Inspection, Testing, and Maintenance of Water-Based 

Fire Protection Systems” (NFPA, 1998a). Other MFFF fire protection systems are 

inspected, tested, and maintained in accordance with the applicable NFPA codes, 

manufacturer’s guidelines, and operating experience. This meets the guidance in 

Section 7.4.3.2.S in NUREG-1718 (NRC, 2000) and is, therefore, acceptable. 

• A test plan lists the responsible personnel positions in connection with routine tests and 

inspections of the fire detection and protection systems. The test plan contains the 

types, frequency, and identification of the testing procedures. This meets the guidance 

in Section 7.4.3.1.B.(ix) in NUREG-1718 (NRC, 2000) and is, therefore, acceptable. 

• A penetration seal tracking program records pertinent information regarding the 

installation and modification of fire-rated penetration seals that are IROFS and that are 

installed and maintained in accordance with UL 1479, “Fire Tests of Through Penetration 

Fire Stops” (UL, 1994). This meets the guidance in Section 7.4.3.1.B.(xiii) in NUREG1718 (NRC, 2000) and is, therefore, acceptable. 

• Emergency lighting and communications systems are inspected, tested, and maintained 

 in accordance with vendor recommendations. This meets the guidance in 

 Section 7.4.3.1.B.(ix) in NUREG-1718 (NRC, 2000) and is, therefore, acceptable. 

• Onsite and offsite emergency communications systems are tested periodically in 

 accordance with the site emergency preparedness program. 

To achieve continuity in fire protection during periods when a fire protection system is impaired 

or being maintained, written procedures address impairment of MFFF fire protection systems. 

Disarming of the MFFF fire detection or fire suppression systems is controlled by a permit 

system that includes the following: 

• identification and tracking of impaired equipment 

• identification of personnel to be notified 

• determination of needed compensatory fire protection and fire prevention measures 

This meets the guidance in Section 7.4.3.1.B.(viii) in NUREG-1718 (NRC, 2000) and is, 

therefore, acceptable. 

If impairment of the protection system is planned, the necessary parts and personnel are 

assembled before removing the system from service. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 7 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

Compensatory measures (e.g., fire watches, additional combustible controls) are implemented 

as appropriate in accordance with procedures when IROFS fire protection features and systems 

are not operable. This meets the guidance in Section 7.4.3.1.B.(viii) in NUREG-1718 (NRC, 

2000) and is, therefore, acceptable. 

Testing and maintenance procedures for fire protection systems that are IROFS are contained 

in the management measures specified for those IROFS. Acceptable outage times are 

specified in work control procedures for fire protection system impairments. The applicant 

stated in the LA that exceeding the acceptable outage times for IROFS fire protection systems 

requires additional compensatory measures, including shutdown of processes in affected areas. 

This meets the guidance in Section 7.4.3.1.B.(ix) in NUREG-1718 (NRC, 2000) and is, 

therefore, acceptable. 

 

Procedures specify the actions to be taken by individuals discovering a fire, including guidance 

for notifying appropriate personnel, and means and methods that may be used by MFFF staff to 

extinguish a fire. This meets the guidance in Sections 7.4.3.1.B.(x) and (xi) in NUREG-1718 

(NRC, 2000) and is, therefore, acceptable. 

The SRS fire department developed prefire plans. These plans define the strategies that are 

used at the MFFF for fighting fires in areas containing IROFS or that present hazards to IROFS. 

These prefire plans designate all the items specified in NUREG-1718, Section 7.4.3.1.B.(xii), 

items a–I and meet the guidance in Section A.4.8.1 of NFPA 801, “Standards for Facilities 

Handling Radioactive Material” (NFPA, 1998d), and are, therefore, acceptable. 

Consistent with the guidance in Section 7.4.3.1.B of NUREG-1718 (NRC, 2000), the 

administrative controls program establishes the policy for the protection of IROFS at the plant 

and the procedures, equipment, and personnel required to implement the program at the plant 

site and is, therefore, acceptable. 

7.3.2 Features and Systems

Plant fire protection features and systems include building construction, fire area determination, 

electrical installation, ventilation, detection and alarm, and suppression. Section 7.4 of NUREG1718 (NRC, 2000) provides acceptance criteria for fire protection features and systems. The 

following provides an evaluation of how the applicant addressed these acceptance criteria at the 

MFFF site. 

7.3.2.1 Construction 

Buildings where radioactive materials are used, handled, or stored at the MFFF are of 

NFPA 220, “Standard on Types of Building Construction” (NFPA, 1995b), Type I or Type II 

construction (NRC, 2007a). Thus, the structural members, including walls, columns, beams, 

girders, trusses, arches, floors, and roofs, are of approved noncombustible or limitedcombustible materials and will have fire resistance ratings as specified by NFPA 220 (NFPA, 

1995b). Buildings that contain IROFS are Type I construction and have exterior bearing walls 

rated at least 3 hours and interior bearing walls, trusses, beams, girders and columns rated at 

least 2 hours. In addition, buildings are protected from exterior fires by observing the fire safety 

criteria recommended in NFPA 80A, “Recommended Practice for Protection of Buildings from 

Exterior Fire Exposures” (NFPA, 1996g). 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 8 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

As described in Section 1.1.2.1.3.1 of the LA (MOX, 2010a), the mixed oxide (MOX) fuel 

fabrication building (BMF) is a multistory, reinforced concrete structure. The BMF consists of 

reinforced concrete shear walls, floors, and a roof slab. 

 The staff finds that the preliminary construction features at the 

MFFF are adequate to meet the baseline design criteria of 10 CFR 70.64(a)(3) for fire safety 

and meet the guidance in Section 7.4.3.2.A–C in NUREG-1718 (NRC, 2000) and are, therefore, 

acceptable. 

7.3.2.2 Interior Surface 

Section 7.3.4.1 of the LA indicates that exposed interior walls or ceilings and any factoryinstalled facing material have a Factory Mutual Research Corporation-approved or UL-listed 

flame-spread rating of 25 or less, and a smoke-developed rating of 50 or less in accordance 

with American Society for Testing and Materials (ASTM) E84, “Standard Test Method for 

Surface Burning Characteristics of Building Materials” (ASTM, 1998). This meets the guidance 

in Section 7.4.3.2.D in NUREG-1718 (NRC, 2000) and is, therefore, acceptable. 

Carpets and rugs are not currently planned for use in the BMF. If it is determined later that they 

will be installed, the carpets and rugs will be tested in accordance with NFPA 253, “Standard 

Method of Test for Critical Radiant Flux of Floor Covering Systems Using a Radiant Heat 

Energy Source” (NFPA, 2006). This meets the guidance in Section 7.4.3.2 E in NUREG-1718 

(NRC, 2000) and is, therefore, acceptable. 

Protective coatings for floors will be fire resistant with a flame-spread rating of 25 or less, and a 

smoke-developed rating of 50 or less in accordance with ASTM E84 (ASTM, 1998). 

7.3.2.3 Storage Racks 

Section 7.3.4.1 of the LA states that racks for the storage of plutonium oxide, uranium oxide, or 

MOX in powder, pellet, or rod form are noncombustible. The applicant provides combustible 

loading controls to prevent the buildup of combustibles in areas where storage racks are 

located. Section 7.2.3 of the LA discusses combustible loading controls. Limiting combustible 

materials in areas where special nuclear material is stored reduces the intensity of potential fires 

if they occur. This meets the guidance in Section 7.4.3.1.B.(xiii) in NUREG-1718 (NRC, 2000) 

and is, therefore, acceptable. 

7.3.2.4 Electrical Considerations 

Section 11.4 of the LA discussed the electrical systems at the MFFF. To prevent fires from 

initiating and adversely affecting critical systems, the electrical systems at the MFFF are 

designed with redundant Class 1E circuits and equipment and are located in Quality Level 1 

structures. Within these structures, redundant Class 1E circuits and equipment are separated 

by Quality Level 1 structures, barriers, distance, or a combination, with the preference being 

separation by Quality Level 1 structures. IEEE 384, “Standard Criteria for Independence of 

Class 1E Equipment and Circuits” (IEEE, 1992b), is used as the basis for minimum separation 

distances except in gloveboxes, where separation is maintained to the extent practical. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 9 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

• Electrical cable used in gloveboxes is IEEE-383 (IEEE, 1992a) qualified (i.e., ignition 

resistant and self-extinguishing). 

• IROFS power cables from emergency buses are installed in conduit. 

• The design of electrical distribution equipment within gloveboxes is in accordance with 

NFPA 70, “National Electric Code” (NFPA, 1999c). 

These considerations also protect electrical systems from the effects of smoke and fire that 

initiate outside the electrical systems. Section 11.4 of this SER evaluates the electrical systems 

at the MFFF. The staff finds that electrical systems are robust and meet the performance 

requirements of 10 CFR 70.61. The applicant’s electrical analyses provided reasonable 

assurance that the electrical IROFS protect against the consequences of potential accidents 

and natural phenomena. The applicant’s electrical design meets the guidance in 

Section 7.4.3.2.G in NUREG-1718 (NRC, 2000) and is, therefore, acceptable. 

 

7.3.2.5 Lightning Protection 

Section 11.4 of the LA (MOX, 2010a) states that each MFFF building and structure has a 

grounding grid. The various grounding grids are interconnected to form the grounding grid 

system. The MFFF grounding system complies with the requirements of NFPA 70 (NFPA, 

1999c) and certain other applicable grounding codes and standards. The portions of the MFFF 

grounding system that serve lightning protection functions also comply with the requirements of 

NFPA 780, “Lightning Protection Code” (NFPA, 1997d). This meets the guidance in 

Section 7.4.3.2.H in NUREG-1718 (NRC, 2000) and is, therefore, acceptable. 

7.3.2.6 Ventilation System 

Pressure gradients between the confinement zones ensure that leakage air flows from the 

zones of lowest contamination risk to zones of increasing contamination risk. During a fire, the 

main objective is to maintain differential pressure between the room of fire origin and the 

surrounding areas. Depending on whether gloveboxes or dispersible materials are present, the 

heating, ventilation, and air conditioning (HVAC) dampers in process rooms and process cells 

are operated to ensure that combustion products flow through the exhaust stacks of the 

gloveboxes, the process rooms, or the process cells. 

The ductwork in the ventilation systems incorporates manual and automatic dampers and 

controls to distribute and regulate the movement of air. The ductwork is welded stainless steel or 

welded galvanized pipe. As discussed in Section 7.3.1 of the LA, closure devices with fire 

resistance ratings are provided where ventilation ductwork penetrates fire barriers. These 

devices have fire resistance ratings that are consistent with the designated fire resistance ratings 

of the fire barriers penetrated. The four different HVAC systems have the following fire damper 

configurations: 

• In C2 ventilation areas (for example, process rooms containing rods or assemblies and 

corridors around C3 areas), automatic fire dampers are provided in the medium 

depressurization exhaust (MDE) system supply and exhaust ductwork. 

• In process rooms and other C3 ventilation areas (process rooms) with dispersible 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 10 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

radioactive material, the high depressurization exhaust (HDE) system exhaust fire 

dampers have manual controls (chain wheel operator or electric motor). The room 

supply fire dampers for these areas are automatic. 

• For the process cell exhaust (POE) system, room exhaust fire dampers are manually 

operated (chain wheel operator). The room supply fire dampers for these areas are 

automatic. 

• In C4 ventilation areas (gloveboxes), fire isolation valves in the very high 

depressurization exhaust (VHD) headers are manually controlled. This meets the 

guidance in Section 7.4.3.2.X in NUREG-1718 (NRC, 2000) and is, therefore, 

acceptable. 

 

All chain wheel operators are accessible from the corridor outside of the affected process 

rooms. This meets the guidance in Section 7.4.3.2.J in NUREG-1718 (NRC, 2000) and is, 

therefore, acceptable.

The BMF building design incorporates airlocks that offer access to the process rooms. Fire 

barriers separate the airlocks from the process rooms and an independent ventilation system 

ventilates the airlocks. The airlocks maintain a negative pressure with respect to the areas 

adjacent to the process room, thereby reducing the spread of combustion products from the 

process room. In addition, the deliberate pressure cascade from the safe havens to the 

stairwells ensures that the smoke infiltration is minimized during a fire in the MOX processing or 

aqueous polishing (AP) areas. The force required to open all doors is within the limits of the 

guidance of NFPA 101, “Life Safety Code” (NFPA, 1997b). 

SER Section 11.3 provides the staff’s evaluation of the MFFF HVAC and confinement systems. 

7.3.2.6.1 Fire Detection in the Ventilation System 

Section 7.3.2 of the LA states that smoke and heat detectors are located in the HVAC supply 

ventilation intake header. Heat detectors are provided upstream of the HVAC final filters. 

Smoke detectors are also installed in the ventilation exhaust ducts of the process cells, which 

are inaccessible during plant operation. Installation of smoke and heat detectors is in 

accordance with NFPA 72, “National Fire Alarm Code” (NFPA, 1996f). Where necessary, 

NFPA 72 testing and surveillance requirements will be satisfied through replacement. 

7.3.2.6.2 Filter Design and Protection 

At the BMF, HEPA filters are used to prevent the release of radioactive materials from the three 

dynamic confinement systems. HEPA filters meet the requirements of American Society of 

Mechanical Engineers (ASME) AG-1, “Code on Nuclear Air and Gas Treatment” (ASME, 2003). 

Air stream dilution and the use of spark arresters provide fire protection for the BMF final HEPA 

filter system. Roughing filters (spark arresters) and prefilters are located upstream of the HEPA 

filter exhaust plenums. Spark arresters prevent hot particles from impacting the final filters. The 

assemblies are designed and fabricated to the same temperature ratings as the duct materials 

in which they are installed. 

 

7.3.2.6.3 Detection and Suppression Protection in the Ventilation Systems 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 11 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

Temperature detectors are provided in the ductwork upstream of each final filtration unit. 

Detectors alarm in the event of high temperatures in the ductwork. 

Automatic suppression is not provided in the final filter plenums, although Appendix E to 

NUREG-1718 (NRC, 2000) recommends it. According to Section 11.3 of the LA, spark 

arresters and dilution of high temperature exhaust streams will provide fire protection to the final 

HEPA filter systems to prevent prolonged exposure to temperatures above 204 degrees Celsius 

(C) (400 degrees Fahrenheit (F)), the maximum filter service temperature. The applicant’s 

analyses determined that mixed airflows to the filters would not exceed 204 degrees C 

(400 degrees F) under a maximum room temperature condition of 615 degrees C 

(1,140 degrees F). The applicant determined this maximum temperature condition assuming 

that the suppression system was inoperable. The staff reviewed the applicant’s temperature 

calculations and found them to be acceptable (NRC, 2008a). 

7.3.2.7 Means of Egress Protection 

The facility layout complies with the 1997 version of NFPA 101 with exceptions. According to 

Section 7.6.2 of the LA, security door locks and barriers installed along the means of egress 

prevent the required free escape of occupants from inside the building as required by NFPA 101 

(NFPA, 1997b). Security concerns for special nuclear material require that building occupants 

are not allowed free access to the outside of the facility, even during an emergency situation. 

This meets the guidance in Section 7.4.3.2.K in NUREG-1718 (NRC, 2000) and is, therefore, 

acceptable. 

The means of egress are arranged and maintained to provide free and unobstructed lighted 

egress from all parts of the facility. Buildings at the MFFF are designed to provide means of 

egress that are adequate in number, location, and capacity for emergencies. In general, 

impediments to egress such as door locks are not installed. Corridors lead to strategically 

located 2-hour fire-rated exit stairs and exit passageways that lead to protected safe havens. 

Exit stairs are designed to prevent smoke infiltration during a fire. 

Because of safeguards and security concerns, the BMF is equipped with five safe havens for 

emergency egress. Personnel leaving the BMF enter the safe havens and are not allowed to 

exit the safe haven buildings (BSH) until security forces monitor them. Sprinkler suppression 

systems, separate ventilation systems, and emergency lighting protect the safe havens. An 

outer security barrier with a minimum fire resistance rating of 3 hours structurally separates the 

safe havens from the BMF. The staff finds that the availability and protection of the means of 

egress will result in a safe path of escape during a fire. 

Emergency lighting is provided for means of egress and for critical operations areas where 

manual operations must be performed during a power outage of normal alternating current 

power sources. Standby generators support the emergency egress lighting. There are two 

standby generators; each can operate continuously for 24 hours. The staff finds that the 

preliminary emergency lighting provisions provide the necessary illumination in the event power 

to normal lighting is interrupted. 

7.3.2.8 Fire Areas and Barriers 

For facility design and operational purposes, the BMF is subdivided into fire areas. The 

applicant used guidance from NFPA 801 (NFPA, 1998d) to determine fire area boundaries. 

Section 7.3.1 of the LA indicates that fire areas separate IROFS and areas that contain SNM, 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 12 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

from areas that contain fire hazards. Noncombustible walls with a minimum 2-hour fire rating 

separate fire areas from other fire areas. 

The function of fire barriers is to separate fire areas from one another and to confine fires to 

their area of origin. Fire barriers are constructed of noncombustible material and meet the 

criteria set forth by ASTM E119, “Standard Test Methods for Fire Test of Building Construction 

and Materials” (ASTM, 2000a). Three-hour and four-hour fire barriers separate some 

hazardous areas. Peak fire temperature modeling was performed for certain fire areas located 

within the MFFF. Areas chosen for fire modeling are areas where the fire loading exceeded 

80 percent of the minimum fire loading equivalent to the fire resistance rating of the fire area 

barriers. The worst case simulations were found to have insignificant excursions over the 

ASTM E119 (ASTM, 2000a) curve for the fire duration ratings of the barriers. Evaluations 

performed for these worst cases identified no adverse effects on the barriers. 

Fire barriers in the MFFF include the following: 

• passive concrete structural barriers (walls, floors, ceilings, protected openings, etc.) 

• removable panel 2-hour and 3-hour fire-rated barriers 

• fire-rated removable plugs 

• penetration seals 

• fire propagation barriers and fire wrap 

• active fire doors 

• active pellet handling fire doors 

• active rod process area fire doors 

•

Passive concrete structural barriers (walls, floors, ceilings, protected openings, etc.) will be 

constructed and designed in accordance with the applicable requirements of NFPA 220 (NFPA, 

1995b) and NFPA 221, “Standard for Fire Walls and Fire Barrier Walls” (NFPA, 1997c). The 

concrete structural barriers are of seismic Category I design. 

Removable panels are designed for the design-basis earthquake and have a 3-hour fire rating. 

The panels are also designed for a combined room pressure and a clean agent discharge 

pressure of 7 inches of water. The removable panels are also designed for the design-basis 

earthquake. 

A few applications use fire-rated removable plugs in locations where they will ease expected 

maintenance during the life of the MFFF. They will have a fire resistance rating of 2 hours. 

Penetration seals are fire barrier assemblies that allow the passage of system components 

through walls without compromising the integrity of the fire barrier rating. The penetration seal 

assembly designs are capable of providing a 2- or 3-hour fire rating and meet the specifications 

of ASTM E814, “Fire Tests of Through-Penetration Fire Stops” (ASTM, 2000b), and UL 1479 

(UL, 1994). The designs are, therefore, in compliance with NFPA 801(NFPA, 1998d) and 

NFPA 221 (NFPA, 1997c). The panels are also designed for a combined room pressure and a 

clean agent discharge pressure of 7 inches of water. 

Fire propagation barriers are ductwork and duct-mounted components that are credited in place 

of a fire damper in a specified location where ductwork penetrates a 2-hour fire barrier. Fire 

propagation barriers prevent the passage of flames and hot gases. Fire wrap insulation is 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 13 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

installed on the outside of ductwork to extend the 3-hour rating between fire walls. Fire wrap 

insulation on the duct extends the fire area from which the duct is routed and removes it from 

the fire area through which it is passing. Fire propagation barriers and fire wrap are used to 

eliminate the need for a fire damper in specified locations where ductwork penetrates a fire 

barrier. 

Active fire doors are used to protect openings in fire-resistive walls at the MFFF. Fire doors 

used in fire barriers are installed in accordance with the applicable requirements of NFPA 80, 

“Standard for Fire Doors and Fire Windows” (NFPA, 1999d). 

The active pellet handling (PML conveyor) system transfers fuel pellets to and from different fire 

areas. Special automatic doors are installed in the fire area boundaries that the PML conveyor 

passes through. These doors are normally closed and are opened only during transfers, with 

their position monitored and controlled by surveillance. A fire propagation analysis performed 

by the applicant determined that fire will not propagate through the closed doors. The NRC 

reviewed the analysis (DCS01-ASI-DS-NTE-R-10353) and found it to be acceptable such that a 

fire will not be able to propagate through the closed doors (NRC, 2008a). 

Active rod process area fire doors allow the passage of fuel rods and trays and are normally 

controlled by the Rod Tray Handling (SMK) Programmable Logic Controller (PLC). The control 

switches over to the fire safety controller upon fire detection. Mechanical sensors that are not 

IROFS (defense in depth) control the opening and closing motors of the fire doors and protect 

against closing fire doors on fuel rods. If a fire door is blocked by a rod tray, an operator will be 

dispatched to manually move the rod tray and close the fire door. During a 24-hour period, the 

doors are open only 5 to10 percent of the time (MOX, 2008). 

 

 The automatic fire dampers in the air supply ductwork are either activated by 

electrical controls or resettable “fuse” link. Otherwise, operators control supply-side dampers as 

a defense-in-depth measure. HDE exhaust fire dampers are manually operated with a chain 

wheel operator, or, in some cases, they are manually operated by a remote push button. 

Manual operation of the fire dampers in the HDE exhaust ductwork is a defense-in-depth 

measure. Air-operated fire isolation valves are installed in the VHD exhaust line outside the 

process room fire barriers. These valves can be operated by a local hand switch, by a remote 

hand switch at the normal PLC monitor, or by using a manual chain wheel. Manual operation of 

the IROFS fire isolation valves is a defense-in-depth measure. The fire dampers and isolation 

valves are seismic Category I. 

The applicant’s fire rated barriers meet the guidance in Section 7.4.3.2.L in NUREG-1718 (NRC, 

2000) and are, therefore, acceptable. 

7.3.2.9 Storage of Flammable and Combustible Liquids and Floor Drainage 

The handling and use of combustible and flammable liquids are controlled by design and limited 

by procedures in areas containing IROFS. Flammable and combustible liquids are stored, 

handled, and used in accordance with applicable sections of NFPA 30 (NFPA, 1996d). 

Drainage in areas handling radioactive materials is sized to accommodate a spill of the largest 

single container of any flammable or combustible liquid in the area. Floor drainage from areas 

containing flammable or combustible liquids is trapped to prevent the spread of burning liquid 

beyond the area. The MFFF design specifies that firewater is drained and collected. The 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 14 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

applicant’s design meets the guidance in Sections 7.4.3.2.M and 7.4.3.2.DD in NUREG-1718 

(NRC, 2000) and is, therefore, acceptable. 

7.3.2.10 Flammable Gas Storage 

Flammable and combustible liquids are stored, handled, and used in accordance with applicable 

portions of NFPA 50A (NFPA, 1999a) and NFPA 55 (NFPA, 1998c). Where appropriate, 

explosion prevention measures are implemented in accordance with applicable sections of 

NFPA 69 (NFPA, 1997a). This meets the guidance in Section 7.4.3.2.N in NUREG-1718 (NRC, 

2000) and is, therefore, acceptable. 

7.3.2.11 Fire Alarm and Detection Systems 

Section 7.3.2 of the LA states that the fire alarm systems are designed according to NFPA 72 

(NFPA, 1996f). Fire detection and alarm communication devices include the proprietary 

supervising workstation (PSW), annunciator panels, local fire alarm panels, the fire alarm panel 

data network, the digital alarm communications transmitter, and firefighter telephones. The fire 

detection and alarm system PSW is located in the polishing and utilities control room. The PSW 

sends fire alarm information to workstations in each process control room. The PSW also 

transmits fire detection system alarm signals to fire annunciator panels in the central and 

secondary alarm stations. Additional fire annunciator panels are provided in the emergency 

control rooms, the operations support center, and the utilities control room for use during 

emergency situations. The PSW also includes an integral digital alarm communications 

transmitter, which retransmits these signals to the SRS Operations Center. 

Upon detection of a fire, audible and visual alarms are provided in the affected parts of the 

MFFF. The alarm systems are capable of annunciating and differentiating fire conditions, 

supervisory indicators, or trouble signals. Alarm signals are transmitted to the monitored alarm 

center at the SRS fire department and the aqueous polishing (AP) control room. From an inoffice review of fire detection design documents (NRC, 2008a), the staff determined that 

initiating circuits are capable of transmitting an alarm under circuit fault conditions of single 

ground, open, or both. This meets the guidance in Section 7.4.3.2.P in NUREG-1718 (NRC, 

2000) and is, therefore, acceptable. 

Heat and smoke detectors supplement or can actuate fire extinguishing systems, fire dampers, 

and door closure devices. Detection systems are located throughout the MFFF in accordance 

with the principles of NFPA 72 (NFPA, 1996f) and based on the specific needs of the individual 

fire areas. Smoke or heat detectors or both are located inside gloveboxes and in the HVAC 

supply air ventilation intake header. Heat detectors are provided upstream of HVAC final filters. 

Smoke detectors are also installed in the ventilation exhaust ducts, which are inaccessible 

during plant operation. 

Each glovebox is provided with a minimum of two detectors. Heat detectors are installed in 

gloveboxes prone to dusty conditions. Smoke detectors are deployed in gloveboxes where 

process operations generate little dust. NFPA 72 requirements will be met through redundancy 

and replacement (NRC, 2007a). 

 

The primary power supply for the fire detection/alarm system is the normal power system, which 

has two sources of offsite alternating current power. In the event that both sources of normal 

power are lost, the detection/alarm system can be powered by the standby alternating current 

power systems, and then by the emergency power systems. The emergency power systems 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 15 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

are IROFS. SER Section 11.5 contains the staff’s evaluation of the electrical power supply 

systems. 

7.3.2.12 Water Supply and Drainage 

The MFFF design incorporates a water supply system in accordance with NFPA 801 (NFPA, 

1998d) requirements. Section 7.3.4 of the LA (MOX, 2010a) describes the fire protection water 

supply system as consisting of an underground loop around the MFFF site, fire hydrants, and 

valves. 

 The F-Area at SRS supplies the fire 

water. The licensee provided curves for the three F-Area fire pumps (one electric, two diesel), 

showing that each pump alone could meet the MFFF fire demand. 

The staff determined that the MFFF water supply system accommodates the requirements for 

automatic and manual suppression activities at the MFFF. This meets the guidance in 

Section 7.4.3.2.Q in NUREG-1718 (NRC, 2000) and is, therefore, acceptable. 

7.3.2.13 Automatic Fire Suppression 

A combination of automatic suppression systems, fire hose stations, exterior hydrants, and 

portable extinguishers provide suppression at the MFFF. Automatic suppression is provided in 

areas where potentially significant fire loading is present. 

 

Preaction systems are used to avoid possible ingress of water into areas where fissile material 

is handled. Preaction systems are used in the MOX processing, shipping and receiving, and AP 

areas and in the emergency and standby generator buildings. Preaction systems reduce the 

chance of accidental discharge by requiring independent actions for water discharge such as 

smoke detector and sprinkler head actuation. Wet-pipe sprinkler systems (discharge water 

when elevated temperatures are detected) protect the administration, technical support, secured 

warehouse, and reagent processing buildings. Sprinklers are designed according to NFPA 13, 

“Standard for the Installation of Sprinkler Systems” (NFPA, 1996a). The emergency fuel 

storage vault (UEF) and the truck bay areas in the shipping and receiving building are equipped 

with automatic deluge systems. A deluge system uses open sprinklers or spray nozzles and is 

designed in accordance with NFPA 15, “Standard for Water Spray Fixed Systems for Fire 

Protection” (NFPA, 1996c). All water-based systems will be periodically inspected, tested, and 

maintained in accordance with NFPA 25 (NFPA, 1998a). This meets the guidance in 

Section 7.4.3.2.S in NUREG-1718 (NRC, 2000) and is, therefore, acceptable. 

The clean agent fire suppression systems provide fire suppression in areas where water-based 

suppression is undesirable. Clean agent systems are divided into halogenated and 

nonhalogenated systems. The halogenated systems are not used in process rooms. Both 

types of clean agent supply are provided by high-pressure storage cylinders that are located in 

cylinder storage rooms and in various discrete locations near the rooms that they are protecting. 

A reserve quantity of each type of clean agent is provided equal to the largest demand from the 

largest clean agent storage location. A typical clean agent delivery system consists of agent 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 16 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

stored in a bank of cylinders, a cylinder manifold, a distribution manifold, a pressure-reducing 

orifice and selector valve for each fire area, distribution piping to each fire area, and a network 

of distribution piping and discharge nozzles for each room or protected space within the fire 

area. 

Following the injection of nonhalogenated clean agent, the fire detection alarm and control 

system automatically closes the supply ventilation dampers to the rooms. The exhaust 

ventilation system for the room is automatically closed after the injection of nonhalogenated 

clean agent, except in rooms containing dispersible radioactive material. In such rooms, the 

design includes a specified quantity of clean agent for extended discharge to account for the 

loss of suppressant through the exhaust ducting. This ensures that the concentration in the 

room will not drop below the design concentrations. 

The design and installation of nonhalogenated clean agent systems and agent quantity 

requirements comply with the applicable requirements of NFPA 2001, “Standard on Clean 

Agent Extinguishing Systems” (NFPA, 2004), with the following exceptions: 

• Extended discharges are used in rooms containing gloveboxes. The extended 

discharge of nonhalogenated clean agent uses dedicated clean agent cylinders. 

• The minimum clean agent concentration is 20 percent more than the design 

concentrations provided in NFPA 2001 (NFPA, 2004). 

• The soak time has been increased from 10 to 20 minutes. 

To confirm the effectiveness of the minimum design concentrations provided in NFPA 2001 to 

extinguish a fire when the agent is released over an extended period, the clean agent was 

tested in accordance with Section 36 of UL 2127, “Inert Gas Clean Agent Extinguishing System 

Units” (UL, 2001). The results of the tests indicated that the minimum design concentrations 

must be 20 percent greater than those values provided in NFPA 2001 (NFPA, 2004) for the 

materials tested. For conservatism, the concentration of clean agent is maintained for 

20 minutes (NRC, 2008b). This “soak time” of 20 minutes will cover the SRS fire department 

response time of 15 minutes.

 

Not all fire areas in the MFFF are provided with automatic suppression. Suppression is not 

provided in some airlocks, solvent cells, plenums, chases, and areas that are not normally 

occupied, have low combustible loading, or that have no ignition sources. 

 

Based on the variety and redundancy of suppression features, the applicant does not place total 

reliance on a single fire suppression feature at the BMF. As described in SER Section 7.3.3, 

standpipe and hose systems provide backup fire suppression to the automatic suppression 

systems. Early fire suppression capability is also provided by the specially configured portable 

carbon dioxide (CO2) extinguishers with quick disconnect fittings used for glovebox fires. 

Based on information provided to date, the staff finds that the fire suppression strategy provides 

diversity and defense in depth. Automatic and manual fire suppression controls the spread of 

fire, reducing the challenge to fire barriers. The staff finds that the provisions for suppression 

are acceptable because they satisfy the baseline design criteria of 10 CFR 70.64(a)(3) and 

because they provide defense in depth. This meets the guidance in Section 7.4.3.2.J in 

NUREG-1718 (NRC, 2000) and is, therefore, acceptable. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 17 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

7.3.2.14 Combustible and Pyrophoric Metals 

When plutonium oxide is fully oxidized, it is not pyrophoric. Uranium oxide does not oxidize in 

an inert atmosphere, and it oxidizes very slowly in air under process temperature conditions. 

Section 11.1.33 of the LA (MOX, 2010a) describes the safety procedures to be used in handling 

zircaloy swarf. The applicant intends to use titanium for the electrolyzer circuit and associated 

equipment that could be exposed to silver (II) ions; the staff evaluates this practice in SER 

Section 11.2.1.3.4. SER Section 11.1.1.2.1 discusses the potential for uranium dioxide (UO2) 

pyrophoricity and burnback. Based on the evaluations in SER Sections 11.2.1.3.4 and 

11.1.1.2.1, the handling of pyrophoric material meets the guidance in Sections 7.4.3.2.U and V 

in NUREG-1718 (NRC, 2000) and is, therefore, acceptable. 

7.3.2.15 Glovebox Protection 

Gloveboxes, described in Section 11.3.9.1 of the LA, provide physical and visual access to 

internal equipment, processes, and material. A typical glovebox is a large, stainless steel, 

enclosure mounted box on a structural stainless steel stand. Glovebox windows consist of 

rectangular fire-resistant polycarbonate panels that fit into frames in the glovebox walls and 

ceilings. Lead glass panels overlay windows where radiation shielding is required to reduce 

operator exposures. 

Light fixtures are generally installed outside of the gloveboxes. They provide illumination for the 

interior spaces through windows located in glovebox ceilings. 

The applicant’s use of polycarbonate windows is not in compliance with NFPA 801 (NFPA, 

1998d) guidance. However, the applicant has demonstrated that an equivalent level of fire 

protection is achievable with the use of fire-resistive polycarbonate (DCS, 2000). Compared to 

other plastic glovebox materials, polycarbonate is relatively difficult to ignite and will not sustain 

combustion without an external heat flux. The applicant stated that under seismic inertia 

loading and seismic deflection, polycarbonate is superior to noncombustible materials that are 

allowed by the code, such as glass. This meets the guidance in Section 7.4.3.2.W of NUREG1718 (NRC, 2000) and is, therefore, acceptable. 

SER Section 11.3 evaluates other aspects of glovebox fire protection as related to the MFFF 

ventilation system. The discussion of design features of C4 confinement systems (Table 11.3-1 

of the LA) lists adequate features to demonstrate that the facility meets the guidance in 

Sections 7.4.3.2.X and 7.4.3.2.Y of NUREG-1718 (NRC, 2000) and is, therefore, acceptable. 

 

7.3.2.16 Flammable and Combustible Liquids and Gases 

Section 7.2.3 of the LA states that flammable and combustible liquids are stored and handled in 

accordance with NFPA 30 (NFPA, 1996d). Most vessels containing flammable or combustible 

liquids are located in process cells. 

Flammable and combustible gases are stored 

and handled in accordance with NFPA 50A (NFPA, 1999a) and NFPA 55 (NFPA, 1998c). The 

discussion of various explosion events in SER Chapter 8 contains a detailed safety evaluation 

of flammable and combustible liquids and gases. 

7.3.2.17 Special Hazards 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 18 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

BMF emergency battery rooms are located in the MFFF shipping and receiving building and are 

separated from other areas by 3-hour fire walls and provisions for ventilation and hydrogen gas 

detection. The provisions limit hydrogen gas accumulation to less than 2 percent by volume 

(50 percent lower flammable limit). The fire protection features are adequate by the standards 

in IEEE 484, “Recommended Practice for Installation Design and Installation of Vented-Led Acid 

Batteries for Stationary Applications” (IEEE, 1996). 

 

The BMF has several laboratories that are used for physical and chemical analyses of samples 

from the AP or MOX Processing (MP) processes. Fire protection for laboratories is designed to 

meet NFPA 45 “Standard for Fire protection for Laboratories Using Chemicals” (NFPA, 1996e). 

The isolation of these special hazards reduces the potential fire damage, while escape routes 

are safeguarded. This meets the guidance in Section 7.4.3.2.CC in NUREG-1718 (NRC, 2000) 

and is, therefore, acceptable. 

7.3.3 Manual Firefighting Capability

The standpipe and hose systems allow manual firefighting capabilities throughout the MFFF. 

Because of criticality concerns, the MP, Shipping and Receiving (SR), and AP areas have a dry 

standpipe system instead of the normally pressurized wet standpipe system. The standpipe 

systems are designed for use by the SRS fire department. For normally dry standpipes, 

operation of the system requires the opening of an isolation valve. After the fire is extinguished, 

the standpipe water supply is secured and the standpipe is drained. 

Portable fire extinguishers are provided throughout the BMF and inside all buildings at the 

MFFF so occupants can extinguish small fires. Extinguishers are selected and located 

according to fire hazards and to their effectiveness. A combination of multipurpose dry 

chemical, metal use, and CO2 extinguishers are provided. Portable extinguishers are provided 

according to NFPA 10, “Standard for Portable Fire Extinguishers” (NFPA, 1998b). Specially 

configured portable CO2 bottles are provided in rooms with gloveboxes. These extinguishers 

can be quickly disconnected and attached to the glovebox to suppress fires within the glovebox 

without overpressurization. 

MFFF manual fire fighting capability consists of the SRS FD. The SRS FD is a full time 

professional fire department sufficiently trained and qualified to fight MFFF fires. Manual fire 

fighting needs assessments conducted by the SRS FD and Shaw AREVA MOX Services, LLC 

determined that minimum onsite fire fighting capabilities are met by the SRS FD. The staff 

agrees with this conclusion because the SRS FD meets all appropriate NFPA Standards for fire 

suppression activities including NFPA 1500 “Standard on Fire Department Occupational Safety 

and Health Program” (NFPA, 1997e). NFPA 1500 covers requirements for training; fire 

apparatus and equipment; protective clothing and equipment; and emergency operations. The 

NFPA 1500 requirements meet and/or exceed the requirements of NFPA 600 “Standard on 

Industrial Fire Brigades” (NFPA, 1996h) which is referred to in NUREG-1718 (NRC, 2000) as 

guidance for manual firefighting capability. The MFFF fire protection baseline needs 

assessment also provided the maximum arrival time for the SRS FD after an alarm signal, 

determined to be 15 minutes (Tiktinsky to Kotzalas, June 2008) (NRC, 2008a). 

This meets the guidance in Section 7.4.3.3 in NUREG-1718 (NRC, 2000) and is, therefore, 

acceptable. 

 

7.3.4 Fire Hazard Analysis
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 19 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

The fire hazard analysis (FHA) documents the specific fire hazards, the fire protection features 

proposed to control those hazards, and the adequacy of MFFF fire safety. The FHA provides 

information for each fire area and describes operational concerns that can affect fire safety in 

the MFFF. 

To prepare an FHA, the applicant divided the MFFF into fire areas and evaluated the fire safety 

of each fire area and the MFFF as a whole. Next, the applicant identified the fire barriers that 

surround each fire area and analyzed each fire area to determine the types of combustibles and 

ignition sources expected to be present. The facility includes IROFS as needed to satisfy the 

safety function that is specified by the ISA for each fire area. The applicant also determined the 

planned fire protection systems (detection, suppression, and barriers) for each fire area, as well 

as the codes and standards to be used in the design of the fire protection systems. 

 

The applicant incorporated information from the FHA into the nuclear safety evaluations for fire 

events as reviewed by the staff in June 2007 (NRC, 2007a). As a supporting document, the 

FHA accomplishes the following: 

• demonstrates that the multiple levels of fire protection provided ensure adequate 

protection of the MFFF from fires 

• analyzes the potential fires at MFFF, including areas where measures have been taken 

to prevent fires from occurring and areas where fires can occur but measures have been 

taken to mitigate their effects 

• identifies the fire areas throughout the MFFF for limiting fire spread, protecting 

personnel, and limiting consequential damage 

• demonstrates the adequacy of fire barrier walls, floors, and ceilings in concert with 

HVAC systems to confine the design-basis fires 

In Section 7.5 of the LA, the applicant committed to reviewing and periodically updating the FHA 

at defined intervals and as necessary following changes and modifications to the facility, 

processes, or inventories in accordance with MOX Services’ configuration management 

processes. 

The staff reviewed the FHA (NRC, 2007a) and concludes that the FHA meets the guidance in 

Appendix D to NUREG-1718 (NRC, 2000) and is, therefore, acceptable. 

7.3.5 Fire Protection Items Relied on for Safety 

As described in Section 7.3.4.3 of the ISA Summary, (MOX 2010b), the applicant’s safety 

assessment demonstrates that the MFFF IROFS provide protection against hazards in 

accordance with the requirements of 10 CFR 70.61. The IROFS described in this section 

ensure that adequate protection is provided against fires. 

7.3.5.1 Combustible Material Loading Controls 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 20 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 21 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 22 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 23 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 24 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 25 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

7.3.6 MOX Fire Scenarios

The MOX ISA organized fire events into 21 separate groups: 

• F-01—Fire in AP Process Cells 

• F-02, 04—Fire Involving Gloveboxes in the AP/MP C3 Glovebox Areas 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 26 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

• F-03—Fire in the AP Gloveboxes with Vessels Containing Solvents 

• F-05—Fire in Titanium/Electrolyzer in the AP/MP C3 Glovebox Area 

• F-06—Fire in 3013 Canister in C1 and/or C2 Areas 

• F-07—Fire in 3013 Transport Cask in C1 and/or C2 Areas 

• F-08—Fire in Fuel Assembly and Inspection Area 

• F-09—Fire in MOX Fuel Transport Cask in C1 and/or C2 Area 

• F-10—Fires in Waste Container in C1 and/or C2 Areas 

• F-11—Fire in Transfer Container in C1 and/or C2 Areas 

• F-12—Fire in Final C4 HEPA Filter C1 and/or C2 Areas 

• F-13—Fire Outside the BMF Propagating to the Inside 

• F-14—Fire in Facilitywide Systems (Pneumatic Transfer) 

• F-15—Fire in Facility Propagating from One Fire Area to Another 

• F-16—Fire in Secured Warehouse 

• F-17—Fire Involving Vessels Containing Solvents in C2 Confinement Areas 

• F-18—Fire in UO2 Intermediate Storage Room in C2 Area 

• F-19—Fire Event Involving Zircaloy Swarf 

• F- 20—Fire Event Potentially Producing Excessive Soot in a Fire Area Ventilated by 

HDE 

• F -21—Fire Event in the Hydraulic Pump Room Ventilated by HDE 

7.3.6.1 Fire in the Aqueous Polishing Process Cells (F-01) 

AP process cells are rooms that contain process equipment such as vessels and piping that 

require no routine maintenance or inspection. Process cells contain no known ignition sources 

and electrical equipment, wiring, or lighting. The only combustibles in a process cell are 

solutions contained within some process equipment that is constructed of titanium, stainless 

steel, or carbon steel and welded together. Process cell walls are generally of 

concrete and structural steel. During maintenance activities, hazardous materials are removed 

from the cells. In evaluating the potential for fire in the process cell, five different scenarios 

were considered by the applicant: 

(1) fire originating within a process vessel 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 27 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

(2) fire originating outside a process vessel but within a process cell 

(3) fire resulting from or occurring after a process vessel leak 

(4) fire originating external to a process cell 

(5) fire during a maintenance activity 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 28 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

• 

 

 

 

The NRC staff finds that use of the designated IROFS is acceptable to comply with the single 

failure criterion for this event. The single failure criterion, in combination with management 

measures (as described in Chapter 15 of the LA), quality assurance requirements (as described 

in the MOX Project Qualify Assurance Program (MPQAP)), and the use of codes and standards 

for engineered IROFS, gives the NRC staff reasonable assurance that this high-consequence 

event is highly unlikely. Therefore, the proposed safety strategy and IROFS comply with the 

performance requirements of 10 CFR 70.61 in the event of a fire in the AP process cells. 

7.3.6.2 Fire Involving Gloveboxes (F-02 and F-04) 

Gloveboxes confine radioactive materials and are located within process rooms (C3 

confinement zone) that are ventilated by the HDE system. The C4 confinement barriers and the 

VHD exhaust system maintain a negative differential pressure between the gloveboxes and the 

interior of the process rooms. Combustible materials within process rooms include plastic and 

wire insulation in instrumentation and detectors, electrical cable insulation, transient 

combustibles, bag port sleeves, and electric process motor wire insulation. Combustibles 

associated with the glovebox include window seals, window shielding, glove ring plugs, gloves, 

and polycarbonate windows. 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 29 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

•

The NRC staff finds that use of the designated IROFS is acceptable to comply with the single 

failure criterion for this event. The single failure criterion, in combination with management 

measures (as described in Chapter 15 of the LA), quality assurance requirements (as described 

in the MPQAP), and the use of codes and standards for engineered IROFS, gives the NRC staff 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 30 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

reasonable assurance that this high-consequence event is highly unlikely. Therefore, the 

proposed safety strategy and IROFS comply with the performance requirements of 

10 CFR 70.61 in the event of a fire involving gloveboxes. 

7.3.6.3 Fire in Aqueous Polishing Gloveboxes with Vessels Containing Solvents or Other 

Explosion Materials (F-03) 

SER Section 8.1.2.4.2 evaluates solvent fires and explosions. 

7.3.6.4 Fire in the Titanium Electrolyzer in the Aqueous Polishing Glovebox Areas (F-05) 

SER Section 11.2.1.3.4 evaluates a fire in the titanium electrolyzer. 

7.3.6.5 Fire Event Involving a 3013 Container, C1 and/or C2 Areas (F-06) 

Fires that could affect 3013 containers of PuO2 were postulated to occur in the C1 and C2 

areas. Estimates of fire temperature were determined in the B-156 pallet preparation room and 

the B-155 density measurement room, with the density measurement room having the higher 

heat flux and longer fire duration. 

 

7.3.6.6 Fire Event in the Plutonium Dioxide Truck Bay Receiving Area (F-07) 

A fire in the PuO truck bay receiving area is postulated to begin in the cask handling room, D102. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 31 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

The NRC staff finds that use of the designated IROFS is acceptable to comply with the single 

failure criterion for this event. The single failure criterion, in combination with management 

measures (as described in Chapter 15 of the LA), quality assurance requirements (as described 

in the MPQAP), and the use of codes and standards for engineered IROFS, gives the NRC staff 

reasonable assurance that this high-consequence event is highly unlikely. Therefore, the 

proposed safety strategy and IROFS comply with the performance requirements of 

10 CFR 70.61 in the event of a fire in the PuO2 truck bay receiving area. 

7.3.6.7 Fire Event Involving Fuel Rods/Fuel Assembly (F-08) 

A fire event may be postulated to occur in the fuel assembly and inspection area (B-174), 

mockup loading area (B-174a), assembly storage area (B-183), handling area (B-185), egress 

air lock (B-189), and plenum (B-199). The rod storage and handling area (B-186) is a second 

fire area of concern. 

For the zircaloy swarf fire, the applicant determined the maximum temperature of the rod 

directly in front of the fire at a radial distance of 1.03 meters to be 654 degrees F. This 

temperature was also found to be insufficient to cause damage. 

The staff reviewed the justification for the quantities of hydraulic fluid and zircaloy swarf 

assumed in the analyses in calculation DCS01-ASI-DS-CAL-R-10110-A and were found to be 

acceptable based on the facility design and expected quantities of these materials (NRC, 

2008a). 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 32 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

The NRC staff finds that use of the designated IROFS is acceptable to comply with the single 

failure criterion for this event. The single failure criterion, in combination with management 

measures (as described in Chapter 15 of the LA), quality assurance requirements (as described 

in the MPQAP), and the use of codes and standards for engineered IROFS, gives the NRC staff 

reasonable assurance that this high-consequence event is highly unlikely. Therefore, the 

proposed safety strategy and IROFS comply with the performance requirements of 

10 CFR 70.61 in the event of a fire involving fuel rods or a fuel assembly. 

7.3.6.8 Fire Event in MOX Fuel Transport Cask in C1 or C2 Areas (F-09) 

A diesel fuel fire can be postulated in the fuel truck bay that could affect new fuel in a fuel 

transport cask. 

 

The NRC staff finds that use of the designated IROFS is acceptable to comply with the single 

failure criterion for this event. The single failure criterion, in combination with management 

measures (as described in Chapter 15 of the LA), quality assurance requirements (as described 

in the MPQAP), and the use of codes and standards for engineered IROFS, gives the NRC staff 

reasonable assurance that this high-consequence event is highly unlikely. Therefore, the 

proposed safety strategy and IROFS comply with the performance requirements of 

10 CFR 70.61 in the event of a fire involving a MOX fuel transport cask in C1 or C2 areas. 

7.3.6.9 Fire Event in a MOX Waste Container in C1, C2, or C3 Areas (F-10) 

Waste containers are stored in room B-254, which is a C3 area. 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 33 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

The NRC staff finds that use of the designated IROFS is acceptable to comply with the single 

failure criterion for this event. The single failure criterion, in combination with management 

measures (as described in Chapter 15 of the LA), quality assurance requirements (as described 

in the MPQAP), and the use of codes and standards for engineered IROFS, gives the NRC staff 

reasonable assurance that this high-consequence event is highly unlikely. Therefore, the 

proposed safety strategy and IROFS comply with the performance requirements of 

10 CFR 70.61 in the event of a fire involving a MOX waste container in C1, C2, or C3 areas. 

7.3.6.10 Fire Event in a Transfer Container in C2 Area (F-11) 

A fire event is postulated to occur in a personnel and material corridor, to grow, and eventually 

to impact a transfer container. 

The NRC staff finds that use of the designated IROFS is acceptable to comply with the single 

failure criterion for this event. The single failure criterion, in combination with management 

measures (as described in Chapter 15 of the LA), quality assurance requirements (as described 

in the MPQAP), and the use of codes and standards, gives the NRC staff reasonable assurance 

that this high-consequence event is highly unlikely. Therefore, the proposed safety strategy and 

IROFS comply with the performance requirements of 10 CFR 70.61 in the event of a fire 

impacting a transfer container in a C2 area.

7.3.6.11 Fire Event Involving KWG, Process Cell Exhaust, and Very High Depressurization 

Exhaust Final High-Efficiency Particulate Air Filters (F-12) 

A fire is postulated to occur in fire areas that contain fans and final HEPA filter assemblies 

(e.g., rooms B-389, B-390, and B-397a/b, C2 areas for VHD final HEPA filters, rooms C-416 

and C-429, and C3b area for KWG final HEPA filters; and rooms B-213 and B-388, C2 area for 

POE final HEPA filters). 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 34 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

 

 

 

 

 

 

 

The NRC staff finds that use of the designated IROFS is acceptable to comply with the single 

failure criterion for this event. The single failure criterion, in combination with management 

measures (as described in Chapter 15 of the LA), quality assurance requirements (as described 

in the MPQAP), and the use of codes and standards, gives the NRC staff reasonable assurance 

that this high-consequence event is highly unlikely. Therefore, the proposed safety strategy and 

IROFS comply with the performance requirements of 10 CFR 70.61 in the event of a fire 

involving the KWG, POE, and VHD final HEPA filters. 

7.3.6.12 Fire Event Outside the MOX Fuel Fabrication Building (F-13, NPH-04, and EMMH-4) 

Fires are postulated to occur external to the BMF, the BEG, and associated UEF and the waste 

transfer line. An external fire affecting the BMF has the potential to result in radiological and 

chemical consequences to all potential receptors. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 35 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

The NRC staff finds that use of the designated IROFS is acceptable to comply with the single 

failure criterion for this event. The single failure criterion, in combination with management 

measures (as described in Chapter 15 of the LA), quality assurance requirements (as described 

in the MPQAP), and the use of codes and standards for engineered IROFS, gives the NRC staff 

reasonable assurance that this high-consequence event is highly unlikely. Therefore, the 

proposed safety strategy and IROFS comply with the performance requirements of 

10 CFR 70.61 in the event of a fire outside the BMF. 

7.3.6.13 Fire Event Involving Facilitywide Systems (F-14) 

Facilitywide systems that can be affected by fire include the HVAC systems, the electrical 

systems, and the pneumatic transfer systems. Other sections of this SER evaluate fire events 

that could affect the HVAC system. SER Section 7.3.6.1 addresses a fire event in the AP 

process cell, SER Section 7.3.6.2 discusses a fire event involving gloveboxes, and SER 

Section 7.3.6.12 considers a fire event outside the BMF. 

The electrical systems are facilitywide systems that can be affected by fire. SER 

Section 7.3.2.4 discusses protection of the electrical systems from the effects of fires. 

The pneumatic transfer system consists of the NTP PuO2 (133 millimeter) can pneumatic 

transfer system, the LTP (76 millimeter) sample pneumatic transfer systems, and the LLP 

(33 millimeter) laboratory pneumatic transfer system. 

 

 

 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 36 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

The NRC staff finds that use of the designated IROFS is acceptable to comply with the single 

failure criterion for this event. The single failure criterion, in combination with management 

measures (as described in Chapter 15 of the LA), quality assurance requirements (as described 

in the MPQAP), and the use of codes and standards for engineered IROFS, gives the NRC staff 

reasonable assurance that this high-consequence event is highly unlikely. Therefore, the 

proposed safety strategy and IROFS comply with the performance requirements of 

10 CFR 70.61 in the event of a fire involving facilitywide systems. 

7.3.6.14 Fire Propagation from One Fire Area to Another Fire Area (F-15) 

The event postulated is a fire propagating from one fire area to another fire area within the 

facility through an opening in a fire barrier. The second fire area is assumed to be a C3b 

glovebox room containing radioactive material. 

 

 

 

 

 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 37 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

• 

 

 

 

 

 

 

The NRC staff finds that use of the designated IROFS is acceptable to comply with the single 

failure criterion for this event. The single failure criterion, in combination with management 

measures (as described in Chapter 15 of the LA), quality assurance requirements (as described 

in the MPQAP), and the use of codes and standards for engineered IROFS, gives the NRC staff 

reasonable assurance that this high-consequence event is highly unlikely. Therefore, the 

proposed safety strategy and IROFS comply with the performance requirements of 

10 CFR 70.61 in the event of fire propagation from one fire area to another fire area. 

7.3.6.15 Fire Event in Secured Warehouse Building (F-16) 

A fire has been postulated to occur in the secured warehouse building (BSW) involving UO2

powder stored in drums. Potential ignition sources for this fire are electrical circuit failures, 

mechanical failures of equipment, or maintenance activities. The fire is assumed to result in 

overpressurization and rupture of UO2 powder storage drums. 

 

 

 

 

 

 

 

 

The NRC staff finds that use of the designated IROFS is acceptable to comply with the single 

failure criterion for this event. The single failure criterion, in combination with management 

measures (as described in Chapter 15 of the LA), quality assurance requirements (as described 

in the MPQAP), and the use of codes and standards for engineered IROFS, gives the NRC staff 

reasonable assurance that this high-consequence event is highly unlikely. Therefore, the 

proposed safety strategy and IROFS comply with the performance requirements of 

10 CFR 70.61 in the event of a fire in the secured warehouse. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 38 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

7.3.6.16 Fire Event Involving Vessels Containing Solvents in C2 Confinement Areas (F-17) 

 

SER Chapter 8 includes an evaluation of solvent fires and explosions in the discussion of 

explosion events. 

7.3.6.17 Fire in UO2 Intermediate Storage Room in C2 Area (F-18) 

A fire event was postulated to occur in the UO2 intermediate storage room, which contains 

drums of UO as a staging area before the addition of dosing units. 

 

 

 

 

 

The NRC staff finds that use of the designated IROFS is acceptable to comply with the single 

failure criterion for this event. The single failure criterion, in combination with management 

measures (as described in Chapter 15 of the LA), quality assurance requirements (as described 

in the MPQAP), and the use of codes and standards for engineered IROFS, gives the NRC staff 

reasonable assurance that this high-consequence event is highly unlikely. Therefore, the 

proposed safety strategy and IROFS comply with the performance requirements of 

10 CFR 70.61 in the event of a fire in a C2 confinement area involving drums of depleted 

uranium oxide powder. 

7.3.6.18 Fire Event Involving Zircaloy Swarf (F-19) 

Section 5.3.4.2.18 of the ISA Summary evaluated a fire event involving zircaloy filings or swarf 

or both as a generic fire event. Section 5.3.4.2.7 of the ISA Summary evaluated a fire caused 

by zircaloy chips as a possible fire source for fuel rods and fuel assemblies. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 39 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

 

The NRC staff finds that use of the designated IROFS is acceptable to comply with the single 

failure criterion for this event. The single failure criterion, in combination with management 

measures (as described in Chapter 15 of the LA), quality assurance requirements (as described 

in the MPQAP), and the use of codes and standards for engineered IROFS, gives the NRC staff 

reasonable assurance that this high-consequence event is highly unlikely. Therefore, the 

proposed safety strategy and IROFS comply with the performance requirements of 

10 CFR 70.61 in the event of a fire involving zircaloy swarf. 

7.3.6.19 Fire Event Potentially Producing Excessive Soot in a Fire Area Ventilated by HDE (F20) 

 

This fire event is postulated to involve all fire areas ventilated by the HDE system, including 

those that do not contain dispersible radioactive material. 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 40 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

The NRC staff finds that use of the designated IROFS is acceptable to comply with the single 

failure criterion for this event. The single failure criterion, in combination with management 

measures (as described in Chapter 15 of the LA), quality assurance requirements (as described 

in the MPQAP), and the use of codes and standards for engineered IROFS, gives the NRC staff 

reasonable assurance that this high-consequence event is highly unlikely. Therefore, the 

proposed safety strategy and IROFS comply with the performance requirements of 

10 CFR 70.61 in the event of a fire potentially producing excessive soot in a fire area ventilated 

by HDE. 

7.3.6.20 Fire Event in the Hydraulic Pump Room Ventilated by HDE (F-21) 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 41 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

The NRC staff finds that use of the designated IROFS is acceptable to comply with the single 

failure criterion for this event. The single failure criterion, in combination with management 

measures (as described in Chapter 15 of the LA), quality assurance requirements (as described 

in the MPQAP), and the use of codes and standards for engineered IROFS, gives the NRC staff 

reasonable assurance that this high-consequence event is highly unlikely. Therefore, the 

proposed safety strategy and IROFS comply with the performance requirements of 

10 CFR 70.61 in the event of a fire in the hydraulic pump room ventilated by the HDE system.

7.4 Evaluation Findings

7.4.1 Compliance with 10 CFR 70.22 and 10 CFR 70.23 

The staff reviewed the LA for a license to possess and use special nuclear material for the 

MFFF according to Chapter 7 of NUREG-1718. The staff evaluated the organization and 

conduct of operations, facility fire protection features and systems, manual firefighting capability, 

and the FHA and concludes that the applicant’s proposed equipment and facilities are 

adequately described and will protect health and minimize danger to life or property. 

7.4.2 Compliance with the 10 CFR 70.61 Performance Requirements 

The staff reviewed the applicant’s fire accident analyses, including the reliability and applicability 

of selected IROFS to the postulated initiators and fire area hazards. The staff concludes that 

the applicant’s proposed equipment, facilities, and procedures provide a reasonable level of 

assurance that adequate fire protection will be provided and maintained for those IROFS 

needed to meet the safety performance requirements and the baseline design criteria of 

10 CFR 70.61. 

7.4.3 Baseline Design Criteria 

The staff reviewed the design bases for fire protection systems, fire-related administrative 

controls, and buildings as described in the LA and ISA Summary. The staff concludes that fire 

protection-related IROFS and defense-in-depth controls will be designed, constructed, and used 

consistent with good engineering practice, which dictates that certain minimum requirements be 

applied as design and safety considerations for any new nuclear process or facility. The 

applicant meets these minimum requirements through its use of NFPA 801 (1998d) and other 

applicable, nationally accepted fire protection codes and standards. The staff concludes that 

the facility meets the requirements of 10 CFR 70.64(a)(3) with respect to fire protection. 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 42 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

REFERENCES 

(ASME, 2003) American Society of Mechanical Engineers, ASME-AG-1, “Code on Nuclear Air 

and Gas Treatment,” New York, NY, 2003. 

(ASTM, 1998) American Society for Testing and Materials, ASTM E84, “Standard Test Method 

for Surface Burning Characteristics of Building Materials,” West Conshohocken, PA, 1998. 

(ASTM, 2000a) American Society for Testing and Materials, ASTM E119, “Standard Test 

Methods for Fire Test of Building Construction and Materials,” West Conshohocken, PA, 2000. 

 

(ASTM, 2000b) American Society for Testing and Materials, ASTM E814, “Fire Tests of 

Through-Penetration Fire Stops,” West Conshohocken, PA, 2000. 

(DCS, 2000) Duke, Cogema, Stone & Webster, Letter to NRC, RE: Choice of MFFF Process 

Glovebox Window Material (DCS-NRC-000030),” Charlotte, NC, December 15, 2000. 

(DOE, 2004) U.S. Department of Energy, DOE-STD-3013-2004, “Stabilization, Packaging, and 

Storage of Plutonium-Bearing Materials,@ Washington, DC, April 2004. 

(IEEE, 1992a) Institute of Electrical and Electronics Engineers, Standard 383, “Standard for 

Qualifying Class 1E Electric Cables and Field Splices for Nuclear Power Generating Stations,” 

New York, NY, 1992. 

(IEEE, 1992b) Institute of Electrical and Electronics Engineers, Standard 384-92, “Standard 

Criteria for Independence of Class 1E Equipment and Circuits,” New York, NY, 1992. 

(IEEE, 1996) Institute of Electrical and Electronics Engineers, Standard 484-1996, 

“Recommended Practice for Installation Design and Installation of Vented-Led Acid Batteries for 

Stationary Applications,” New York, NY, 1996. 

(MOX, 2008) Shaw AREVA MOX Services, “Letter to NRC, RE: Responses to Fire Safety and 

Confinement Systems Requests for Additional Information,” DCS-NRC-000227, Aiken, SC, 

December 11, 2008. 

(MOX, 2010a) Shaw AREVA MOX Services, “MFFF—License Application,” Aiken, SC, March 

2010. 

(MOX, 2010b) Shaw AREVA MOX Services, “MFFF—Integrated Safety Analysis Summary,” 

Aiken, SC, March 2010. 

(NFPA, 1995a) National Fire Protection Association, NFPA 24, “Standard for the Installation of 

Private Service Mains and Their Appurtenances,” Quincy, MA, 1995. 

(NFPA, 1995b) National Fire Protection Association, NFPA 220, “Standard on Types of Building 

Construction,” Quincy, MA, 1995. 

(NFPA, 1996a) National Fire Protection Association, NFPA 13, “Standard for the Installation of 

Sprinkler Systems,” Quincy, MA, 1996. 

(NFPA, 1996b) National Fire Protection Association, NFPA 14, “Standard for the Installation of 

Standpipes and Hose Systems,” Quincy, MA, 1996. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 43 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

(NFPA, 1996c) National Fire Protection Association, NFPA 15, “Standard for Water Spray Fixed 

Systems for Fire Protection,” Quincy, MA, 1996. 

(NFPA, 1996d) National Fire Protection Association, NFPA 30, “Flammable and Combustible 

Liquids Code,” Quincy, MA, 1996. 

(NFPA, 1996e) National Fire Protection Association, NFPA 45, “Standard for Fire Protection for 

Laboratories Using Chemicals,” Quincy, MA, 1996. 

(NFPA, 1996f) National Fire Protection Association, NFPA 72, “National Fire Alarm Code,” 

Quincy, MA, 1996. 

(NFPA, 1996g) National Fire Protection Association, NFPA 80A, “Recommended Practice for 

Protection of Buildings from Exterior Fire Exposures,” Quincy, MA, 1996. 

(NFPA, 1996h) National Fire Protection Association, Inc, NFPA 600, “Standard on Industrial Fire 

Brigades”, Quincy, MA, 1996 

(NFPA, 1997a) National Fire Protection Association, NFPA 69, “Standard on Explosion 

Prevention Systems,” Quincy, MA, 1997. 

(NFPA, 1997b) National Fire Protection Association, NFPA 101, “Life Safety Code,” Quincy, 

MA, 1997. 

(NFPA, 1997c) National Fire Protection Association, NFPA 221, “Standard for Fire Walls and 

Fire Barrier Walls,” Quincy, MA, 1997. 

(NFPA, 1997d) National Fire Protection Association, NFPA 780, “Lightning Protection Code,” 

Quincy, MA, 1997. 

(NFPA, 1997e) National Fire Protection Association, Inc. NFPA 1500, “Standard on Fire 

Department Occupational Safety and Health Program”, Quincy, MA, 1997. 

(NFPA, 1998a) National Fire Protection Association, NFPA 25, “Standard for the Inspection, 

Testing, and Maintenance of Water-Based Fire Protection Systems,” Quincy, MA, 1998. 

(NFPA, 1998b) National Fire Protection Association, NFPA 10, “Standard for Portable Fire 

Extinguishers,” Quincy, MA, 1998. 

(NFPA,1998c) National Fire Protection Association, NFPA 55, “Standard for Compressed and 

Liquefied Gases in Portable Cylinders,” Quincy, MA, 1998. 

(NFPA, 1998d) National Fire Protection Association, NFPA 801, “Standards for Facilities 

Handling Radioactive Material,” Quincy, MA, 1998. 

(NFPA, 1999a) National Fire Protection Association, NFPA 50A, “Standard for Gaseous 

Hydrogen Systems at Consumer Sites,” Quincy, MA, 1999. 

(NFPA, 1999b) National Fire Protection Association, NFPA 51B, “Standard for Fire Prevention 

During Welding, Cutting, and Other Hot Work,” Quincy, MA, 1999. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 7 - 44 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

(NFPA, 1999c) National Fire Protection Association, NFPA 70, “National Electric Code,” Quincy, 

MA, 1999. 

(NFPA, 1999d) National Fire Protection Association, NFPA 80, “Standard for Fire Doors and 

Fire Windows,” Quincy, MA, 1999. 

(NFPA, 2004) National Fire Protection Association, NFPA 2001, “Standard on Clean Agent 

Extinguishing Systems,” Quincy, MA, 2004. 

(NFPA, 2006) National Fire Protection Association, NFPA 253, “Standard Method of Test for 

Critical Radiant Flux of Floor Covering Systems Using a Radiant Heat Energy Source,” Quincy, 

MA, 2006. 

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” Washington, 

DC, August 2000. 

(NRC, 2007a) U.S. Nuclear Regulatory Commission, Memorandum from Tiktinsky to Kotzalas, 

“In-Office Review Summary: Mixed Oxide Fuel Fabrication Facility (Fire Safety Review),” 

Washington, DC, August 13, 2007. 

(NRC, 2007b) U.S. Nuclear Regulatory Commission, Memorandum from Tiktinsky to Kotzalas, 

“In-Office Review Summary: Mixed Oxide Fuel Fabrication Facility (Fire Protection II),” 

Washington, DC, September 24, 2007. 

(NRC, 2008a) U.S. Nuclear Regulatory Commission, Memorandum from Tiktinsky to Kotzalas, 

“In-Office Review Summary: Mixed Oxide Fuel Fabrication Facility (Fire Safety),” Washington, 

DC, June 24, 2008. 

(NRC, 2008b) U.S. Nuclear Regulatory Commission, Memorandum from Tiktinsky to Kotzalas, 

“In-Office Review Summary: Mixed Oxide Fuel Fabrication Facility (Fire Safety),” Washington, 

DC, November 13, 2008. 

(UL, 1993) Underwriters Laboratories, Inc., Standard 508, “Industrial Control Equipment,” 

Camas, WA, 1993. 

(UL, 1994) Underwriters Laboratories, Inc., Standard 1479, “Fire Test of Through Penetration 

Fire Stops,” Camas, WA, 1994. 

(UL, 1995) Underwriters Laboratories, Inc., Standard 555, “Standard for Fire Dampers and 

Ceiling Dampers,” Camas, WA, 1995. 

(UL, 1997) Underwriters Laboratories, Inc., Standard 790, “Standard Test Methods for Fire 

Tests of Roof Coverings,” Camas, WA, 1997. 

(UL, 2001) Underwriters Laboratories, Inc., Standard 2127, “Inert Gas Clean Agent 

Extinguishing System Units,” Camas, WA, 2001. 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 1

8.0 CHEMICAL SAFETY 

8.1 Conduct of Review

 

This chapter of the safety evaluation report (SER) contains the U.S. Nuclear Regulatory 

Commission (NRC) staff’s review of chemical and process safety described by the applicant, 

Shaw AREVA MOX Services (MOX Services), in Chapter 8 of the license application (LA) 

(MOX, 2009a), with supporting process safety information from Chapters 5 and 11 of the LA. 

The purpose of the NRC’s review of the MOX Services chemical safety program and the design 

of the facility is to evaluate whether the applicant will adequately protect workers, the public, and 

the environment during normal operations against chemical hazards of licensed material and its 

byproducts. The chemical safety program and the facility’s design must also protect against 

facility conditions or operator actions or both that can affect the safety of licensed materials and 

thus present an increased chemical risk. 

Regulatory Requirements

The regulatory bases for the review are the general and additional contents of an application 

that address chemical process safety, as required by Title 10 of the Code of Federal 

Regulations (10 CFR) 70.22, “Contents of Applications,” and 10 CFR 70.65, “Additional Content 

of Applications.” In addition, the staff reviewed chemical process safety information in the LA 

and the Integrated Safety Analysis (ISA) Summary (MOX, 2009b) and supporting information to 

provide reasonable assurance of compliance with 10 CFR 70.61, “Performance Requirements,” 

10 CFR 70.62, “Safety Program and Integrated Safety Analysis,” and 10 CFR 70.64, 

“Requirements for New Facilities or New Processes at Existing Facilities.” 

Regulatory Guidance and Acceptance Criteria

The review of the LA (MOX, 2009a) and ISA Summary (MOX, 2009b) focused on the design 

bases of chemical process safety systems and components. For each chemical process safety 

system, the staff reviewed information provided by the applicant concerning the safety function, 

system description, and safety analysis. The review also included design-basis considerations, 

such as redundancy, independence, reliability, and quality. Chapter 8 of NUREG-1718, 

“Standard Review Plan for the Review of an Application for a Mixed Oxide (MOX) Fuel 

Fabrication Facility” (NRC, 2000), contains the guidance applicable to the NRC’s review of 

chemical process safety for the proposed facility. This chapter is applicable in its entirety. The 

staff also used NUREG-1601, “Chemical Process Safety at Fuel Cycle Facilities” (NRC, 1997), 

and NUREG-1513, “Integrated Safety Analysis Guidance Document” (NRC, 2001), as guidance 

documents for this review. Section 8.4.3 of NUREG-1718 (NRC, 2000) identifies the 

acceptance criteria applicable to this review. 

8.1.1 Background 

As stated in the memorandum of understanding (MOU) between the NRC and the Occupational 

Safety and Health Administration (OSHA) entitled, “Worker Protection at NRC-licensed 

Facilities” (Volume 53, Number 210, of the Federal Register, dated October 31, 1998, 

pages 43950–43951), the NRC oversees chemical safety issues related to (1) radiation risk 

produced by radioactive materials, (2) chemical risk produced by radioactive materials, and 

(3) plant conditions that affect the safety and safe handling of radioactive materials. These 

types of chemical safety issues represent an increased radiation risk to the workers. However, 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 2

the NRC does not oversee facility conditions that result in an occupational risk but do not affect 

the safe use of licensed material. The NRC has codified the MOU provisions applicable to the 

Mixed Oxide Fuel Fabrication Facility (MFFF) in 10 CFR 70.64(a)(5). 

 

The NRC staff reviewed the LA (MOX, 2009a) and the ISA Summary (MOX, 2009b) submitted 

by the applicant and considered the following areas: 

• chemical process description 

• list of hazardous chemicals affecting licensed materials 

• chemical accident sequences 

• chemical accident consequences 

• chemical process items relied on for safety (IROFS) 

• management measures 

• chemical process safety interfaces 

• baseline design criteria (BDC) 

The staff reviewed the applicant’s responses to requests for additional information and ISA 

documents, as necessary, to better understand the process and safety requirements. The staff 

evaluated the information to determine whether the facility’s design complied with the BDC and 

defense-in-depth requirements specified in 10 CFR 70.64(a) and 10 CFR 70.64(b), respectively. 

Chapter 5 of this SER discusses compliance with these regulations in more detail. The 

following sections summarize general information about the MFFF processes and the NRC 

staff’s evaluation. 

8.1.2 Areas of Review and Evaluation Findings 

 

8.1.2.1 Chemical Processes

8.1.2.1.1 Aqueous Polishing Process 

The overall function of the aqueous polishing (AP) process is to remove impurities from the feed 

plutonium for use in the mixed oxide (MOX) processing (MP) area. The MFFF will receive 

plutonium feedstock as plutonium dioxide (PuO2). The U.S. Department of Energy’s (DOE) Pit 

Disassembly and Conversion Facility (PDCF) located nearby will disassemble plutonium pits 

from weapons and convert the material to PuO2 for use as MFFF feedstock, utilizing advanced 

recovery and integrated extraction system (ARIES) technology. A smaller amount of plutonium 

from other DOE sources will also be utilized as MFFF feedstock (referred to as alternate 

feedstock (AFS)). The PuO2 received at the MFFF contains small amounts of impurities that 

have to be removed before the MOX fuel can be used in reactors. For PDCF/ARIES feeds, 

these impurities are primarily gallium, americium, and highly enriched uranium. For AFS feeds, 

the number of impurities and the impurity concentrations are higher. The AP process consists 

of the following 17 process units or systems (unit designators are indicated in parentheses): 

(1) decanning (KDA) unit 

(2) milling (KDM) unit 

(3) recanning (KDR) unit 

(4) dissolution (KDB) unit 

(5) dechlorination and dissolution (KDD) unit 

(6) purification cycle (KPA) unit 

(7) solvent recovery (KPB) unit 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 3

(8) oxalic precipitation, filtration, and oxidation (KCA) unit 

(9) homogenization (KCB) unit 

(10) canning (KCC) unit 

(11) oxalic mother liquor recovery (KCD) unit 

(12) acid recovery (KPC) unit 

(13) process off-gas treatment (KWG) unit 

(14) aqueous waste reception (KWD) unit 

(15) solvent waste reception (KWS) unit 

(16) automatic sampling (KPG) unit 

(17) laboratory liquid waste receipt (LGF) unit 

The AP process involves three major steps: dissolution, purification, and conversion. These 

steps may be preceded by an optional pretreatment step, depending upon the impurities of the 

feedstock. Figure 8.1-1 is a block diagram of the AP process. 

8.1.2.1.2 MOX Process 

The MP area receives polished PuO2 from the AP process, uranium dioxide (UO2) depleted in 

the uranium-235 (235U) isotope, and the required components for assembling light-water reactor 

MOX fuel assemblies. The process mixes the plutonium and uranium oxides to form MOX fuel 

pellets. The pellets are loaded into fuel rods, which are then assembled into MOX fuel 

assemblies for use in commercial reactors. The MP area is designed to process up to 87 metric 

tons of heavy metal (uranium and plutonium) annually. 

The MFFF uses the advanced MIcronized Master Blend (A-MIMAS) process for the 

manufacture of MOX fuel assemblies. A-MIMAS represents the latest evolution of the 

successive MIMAS fabrication processes, adopted by BELGONUCLEAIRE and COGEMA, to 

produce MOX fuel pellets. A-MIMAS uses a two-step mixing process. In the first step, the PuO2
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 4

powder is mixed with depleted UO2 and recycled scrap powder to form a primary blend (master 

blend), with a nominal PuO2 content of 20 percent of the total mass. This mix is then 

micronized. In the second step, the primary blend is forced through a sieve and poured into a 

jar and mixed with depleted UO2 and scrap powder to obtain the final blend, which will have the 

specified plutonium content. The maximum PuO2 content in the final blend is nominally 6 

percent of the total mass. The two-step mixing process is used to ensure a consistent product. 

8.1.2.1.3 Laboratory 

The MFFF laboratory is located in the MP area. The main portion of the laboratory is located on 

the third floor of the MP building (BMP). The other portion is located on the intermediate level of 

the BMP. The three major sections of the laboratory comprise the following: 

(1) the MFFF laboratory 

(2) the test line (LCT) 

(3) the 33-millimeter (mm) pneumatic transfer system (LLP) 

The MFFF laboratory is primarily used to perform chemical and physical analyses of samples 

coming from the MP production units, AP production units, and the test line (LCT). Analyses 

are performed in the laboratory for the following purposes: 

• manufacturing control (process control) 

• material control & accountability 

• product quality control (specification analyses) 

• criticality safety 

• process safety 

• subsequent waste disposition at the Savannah River Site (SRS) 

The following operations are also performed in the laboratory: 

• laboratory liquid and solid waste management 

• preparation of reagents used in the MFFF laboratory 

• analysis of depleted uranyl nitrate samples 

• temporary storage of scrap materials from the MFFF laboratory 

• dissolution tests of AFS PuO2 powders 

• dissolution operations occasionally performed for dissolution (KDB) and dissolution of 

chlorination feed (KDD) bag prefilter residues (less than 40 grams of plutonium) 

• calibration 

• document storage 

Samples are transferred from the MP and AP areas to the MFFF laboratory in vials. Samples 

are transferred between the different analytical units of the laboratory in aliquot containers, 

where an aliquot is a measured portion of a sample taken for analysis. Vials and aliquot 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 5

containers specific to liquid and solid samples are not reusable. Transfers are either manual or 

pneumatic. However, most transfers are pneumatic via the LLP or the 76-mm pneumatic 

transfer system (LTP). Additional discussion of the laboratory can be found in Section 11.11 of 

this SER. 

8.1.2.1.4 Chemical Reagents 

The AP and MP processes at the MFFF use a wide variety of chemicals, a significant number of 

which are hazardous. Table 8.1-1 lists the hazardous characteristics and incompatibilities 

associated with these chemicals. Of the chemicals used in the AP and MP processes, at least 

20 exhibit one of the following hazardous characteristics: 

• corrosivity 

• flammability 

• explosivity 

• chemical burn 

• toxicity 

Tables 8.1-1 and 8.1-2 list the process chemicals used in the AP and MP processes, including 

the chemical formula, chemical state, and central abstract system registry number (CASRN). 

Tables 8.1-1 and 8.1-2 also list two chemicals (uranyl nitrate and UO2), respectively, which are 

stored in the secured warehouse building (BSW). 

The AP process uses numerous reagents. The applicant has designed these reagent systems 

to maintain segregation or separation of vessels and components from incompatible chemicals 

in order to prevent chemical explosions under normal, off-normal, and accident conditions, 

including earthquakes. Control of the chemical makeup of the reagents introduced into the cells 

or AP reagent rooms prevents explosions caused by chemical reactions. The applicant has 

committed to labeling chemicals, piping, tanks, and other components to prevent reagent 

preparation errors. The applicant has also indicated that it will perform reagent handling in 

accordance with material safety data sheet requirements (Section 11.8 of this SER discusses 

these systems in greater detail). 

The following reagents support the AP process functions: 

• nitric acid 

• tributyl phosphate (TBP) 

• hydroxylamine nitrate (HAN) 

• hydrazine 

• sodium hydroxide 

• oxalic acid 

• hydrogenated polypropylene tetramer (diluent) 

• sodium carbonate 

• hydrogen peroxide 

• manganese nitrate 

• aluminum nitrate 

• zirconium nitrate 

• silver nitrate 

• sodium sulfite 

• sodium nitrite 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 6

• uranyl nitrate 

Table 8.1-3 provides a list of these reagents (some are listed more than once if they used in 

differing concentrations), along with the downstream transfer unit and the normal operating 

range. 

In addition, the following reagents will be used in either the MP process or as oxygen 

scavengers in the steam and condensate system (SPS): 

• zinc stearate 

• azodicarbonamide 

• carbohydrazide 

• morpholine 

Zinc stearate is a lubricant used in the MP process. It is packed in small, ready-to-use plastic 

bags that will be manually introduced into the relevant powder process glovebox to be mixed 

with powders in process. The bags will be introduced into the gloveboxes via a glove port using 

a “bag-in bag-out” procedure. 

Azodicarbonamide is a pore-former used in the MP process. It will also be packed in small, 

ready-to-use plastic bags that are manually introduced into the relevant powder process 

glovebox to be mixed with powders in process. The bags are introduced into the gloveboxes via 

a glove port using a bag-in bag-out procedure. 

Carbohydrazide and morpholine are used as oxygen scavengers in the steam and condensate 

(SPS) system. Carbohydrazide will be purchased as a solid, while morpholine will be delivered 

as a liquid. 

Table 8.1-1 Summary of Process Chemicals in the Aqueous Polishing Building 

CHEMICAL

Name Formula CASRN State

Aluminum Nitrate Al(NO3)3*9H2O 13473-90-0 Liquid 

Butanol (Note 3) C4H10O 71-36-3 Liquid 

Butyl Nitrate (Note 3) C4H9 NO3 928-45-0 Liquid 

Chlorine Cl2 7782-50-5 Gas 

Dibutyl Phosphate (Note 3) C8H19 PO4 107-66-4 Liquid 

Dilutent, HPT (C10-C13 Isoalkanes) C12H26 (mixture) 68551-17-7 Liquid 

Hydrazine (0.2 N) N2H4 302-01-2 Liquid 

Hydrazine Nitrate N2H4 NO3 13464-97-6 Liquid 

Hydrazoic Acid HN3 7782-79-8 Liquid 

Hydrogen Peroxide H2O2 7722-84-1 Liquid 

Hydroxylamine Nitrate NH2OH-NO3 13465-08-2 Liquid 

Manganese Nitrate Mn(NO3)2 10377-66-9 Solid/Liquid 

Nitric Acid HNO3 7697-37-2 Liquid 

Nitric Oxide (Note 1) NO 10102-43-9 Gas 

Nitrogen N2 7727-37-2 Gas 

Nitrogen Dioxide NO2 10102-44-0 Gas 

Nitrogen Oxides (Note 1) NOX N/A Gas 

Oxalic Acid H2C2O4 144-62-7 Liquid 

Oxygen O2 N/A Gas 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 7

Plutonium Dioxide PuO2 N/A Solid 

Plutonium Oxalate (Note 2) Pu(C2O4)2 N/A Solid/Liquid 

Plutonium Nitrate (Note 2) Pu(NO3)4 N/A Liquid 

Silver Nitrate AgNO3 7761-88-8 Solid/Liquid 

Sodium Carbonate Na2CO3 497-19-8 Liquid 

Sodium Hydroxide NaOH 1310-73-2 Liquid 

Sodium Nitrate NaNO3 7632-00-0 Liquid 

Sodium Sulfite Na2SO3 7757-83-7 Liquid 

Tributyl Phosphate (C4H9)3PO4 126-73-8 Liquid 

Uranyl Nitrate UO2(NO3)2 36478-76-9 Liquid 

Zirconium Nitrate Zr(NO3)2*5H2O 13746-89-9 Liquid 

Notes: 

1. Chlorine and nitrogen oxides are byproducts of AP processing. 

2. Plutonium oxalate and plutonium nitrate are intermediate products of AP processing.

3. Butanol, dibutyl phosphate, monobutyl phosphate, and butyl nitrate are byproducts of 

TBP degradation.

Table 8.1-2 Summary of Process Chemicals in the MOX Processing Building 

CHEMICAL

Name Formula CASRN State

Argon-Hydrogen 95% Ar, 5% H N/A Gas 

Azodicarbonamide (pore-former) H2NCONNCONH2 123-77-3 Solid 

Carbohydrazide CH6N4O 497-18-7 Solid 

Helium He 7440-59-7 Gas 

Isopropanol C3H7OH 67-63-0 Liquid 

Morphaline Borane C4H12BNO 4856-95-5 Solid 

Nitrogen N2 7727-37-9 Gas 

Plutonium Dioxide PuO2 N/A Solid 

Uranium Dioxide UO2 1344-57-6 Solid 

Zinc Stearate Zn(C18H35O2)2 557-05-1 Solid 

8.1.2.1.5 Chemical Process Inventories 

The applicant provided chemical inventory information in Chapters 8 and 11 of the LA (MOX, 

2009a). Table 8.1-3 summarizes the maximum chemical inventories per vessel used by the 

applicant for chemical consequence analyses at the MFFF. 

Table 8.1-3 Summary of Maximum Chemical Inventories per Vessel Used for 

Chemical Consequence Analyses at MFFF 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 8
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 9

Notes: 

1. S (Solid); L (Liquid) 

2. Evaluated for operating (elevated) temperature releases. These are the only process 

chemicals that were exposed to temperatures higher than room temperature and were 

deemed capable of exceeding the temporary emergency exposure limits (TEELs) because 

of their relatively low vapor pressures compared to the other process chemicals handled in 

the facility. 

The applicant provided unit-specific chemical inventory information for each unit within the AP 

and MP processing areas within the individual unit descriptions provided in Chapter 11 of the LA 

(MOX, 2009a) and Chapter 4 of the ISA Summary (MOX, 2009b). The applicant also provided 

Unit- and vessel-specific expected radionuclide information in Chapter 11 of the LA (MOX, 

2009a) and Chapter 4 of the ISA Summary (MOX, 2009b). 

The staff reviewed the list of chemicals, radionuclides, and the associated inventory information 

provided by the applicant. The chemical listing appears sufficiently complete, and the quantities 

appear consistent with the proposed activities and the amount necessary for safety 

assessments. The staff finds that this information is consistent with the guidance provided in 

Acceptance Criterion 8.4.3.1-E of NUREG-1718 (NRC, 2000); therefore, the information is 

adequate and acceptable. 

8.1.2.1.6 Chemical Process Ranges 

According to guidance provided in NUREG-1718 (NRC, 2000), the description of the range of 

chemicals should include the approximate input, in-process, and output ranges of chemical and 

radioisotope concentrations, mass flow rates, and other properties. 

The applicant provided unit-specific chemical process information for each unit within the AP 

and MP processing areas within the individual unit descriptions provided in Chapter 11 of the LA 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 10

(MOX, 2009a) and Chapter 4 of the ISA Summary (MOX, 2009b). These descriptions provided 

information such as maximum equipment volumes in a particular unit under PDCF/ARIES and 

AFS feed conditions, organic-to-aqueous (O/A) phase flow ratios, and nominal temperatures. 

This information, together with the information on chemical inventories and chemical process 

limits described in Sections 8.1.2.1.5 and 8.1.2.1.7 of this SER, provide an overview of the 

ranges of process operations expected in the MFFF. 

The NRC staff has reviewed this information and finds that it appears sufficiently complete, and 

the quantities appear consistent with the proposed activities and the amounts necessary for 

safety assessments. The staff finds that this information is consistent with the guidance 

provided in Acceptance Criterion 8.4.3.1-F of NUREG-1718 (NRC, 2000); therefore, the 

information is adequate and acceptable. 

8.1.2.1.7 Chemical Process Limits 

The applicant provided information on chemical process limits in Section 5.2.5.4 of the LA 

(MOX, 2009a) and Section 5.1.2.7.3 of the ISA Summary (MOX, 2009b). 

The applicant performed a determination of setpoints for IROFS in accordance with the 

provisions of International Society of Automation (ISA) Standard S67.04.01-2000 (ISA, 2000) 

and NRC Regulatory Guide 1.105, “Setpoints for Safety Related Instrumentation,” issued 

December 1999 (NRC, 1999). 

The applicant indicated that safety limits for engineered and administrative IROFS were 

established in safety documents, such as nuclear safety evaluations (NSEs). From these safety 

limits, analytical limits were established to account for process system dynamics and transient 

behaviors. The analytical limits provide for a margin between the safety limits and the process 

response following activation of a protective response. From the analytical limits, the setpoints 

were established by analysis to account for effects of the measurement and response systems. 

The setpoints provide for an additional margin between the analytical limits and the protective 

response and include consideration of instrumentation drift and uncertainty. 

The applicant established operating limits to provide for a sufficient margin between the 

established setpoints and normal process conditions. The applicant also developed operating 

procedures to implement operating limits and control operations to ensure that safety limits are 

not exceeded. 

The applicant’s definitions of the related setpoint terms follow. Figure 8.1.2.1.7-1 illustrates the 

relationship of these terms to one another. 

Safety Limit: Safety limits were chosen to maintain the integrity of the physical barriers that 

protect against events that could cause the performance criteria of 10 CFR 70.61 to be 

exceeded, which include criteria for radiological and chemical releases and protection against 

criticality events. These limits can be defined in terms of directly measured process variables or 

in terms of a calculated variable involving two or more measured process variables. The 

applicant lists safety limits in Section 5 of the ISA Summary (MOX, 2009b). The safety limits 

were established in safety documents, such as NSEs. 

Analytical Limit: The analytical limit is a limit of a measured or calculated variable established 

by the safety analysis to ensure that a safety limit is not exceeded. The safety analysis 

established an analytical limit in terms of a measured or calculated variable and a specific time 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 11

after that value is reached to begin protective action. The analysis accounted for the dynamic or 

transient nature of certain process variables and ensures that these variables do not exceed the 

safety limit as a result of this transient behavior. 

Trip Setpoint: The setpoint is a predetermined value for actuation of the final setpoint device to 

initiate a protective action. An allowance is provided between the setpoint and the analytical 

limit to ensure an actuation before the analytical limit is reached. This allowance was used to 

account for instrument uncertainties and response times not accounted for in the analytical limit. 

For its determination of setpoints for IROFS, MOX Services committed to complying with the 

provisions of ISA Standard S67.04.01-2000 (ISA, 2000) and Regulatory Guide 1.105 (NRC, 

1999). 

Operating Limits: The operating limit is a limiting value (or range of values) for a process 

parameter within which plant operators normally operate the facility. This value was established 

to minimize challenges to IROFS. The operating limit determines the threshold for operability 

for a system of the facility. Operating limits were based on experience at the reference plants 

(i.e., the La Hague and MELOX facilities in France) and were produced in collaboration with 

system engineers, safety engineers, instrument and control engineers, and plant operations 

staff. 

Figure 8.1.2.1.7-1 Relationships of process limits and setpoints 

The applicant provided safety and operating limits for controlled process parameters in 

Table 5.3.6-9 of the ISA Summary (MOX, 2009b). The staff reviewed these limits and found 

them to be consistent with the methodology described above. The staff finds the applicant’s 

description to be consistent with guidance provided in Acceptance Criterion 8.4.3.1-G in 

NUREG-1718 (NRC, 2000); thus, the description is acceptable. 

 

8.1.2.2 Hazardous Chemicals and Potential Interactions

This section discusses the evaluation of potential chemical interactions to identify those 

chemicals that cannot be mixed under specified conditions and those mixtures that could create 

a safety hazard (e.g., a fire or explosion) and a release of radioactive material. Potential 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 12

adverse reactions between the reagents used in the AP and MP processes were examined. In 

addition, interactions between the reagents and plutonium and uranium were examined to 

identify possible hazards related to colloids formation, polymerization of plutonium, precipitate 

formation, or explosion. Furthermore, interaction between the reagents and water was 

assessed. Finally, interactions between the reagents used in the AP process and those used in 

the MP process or as oxygen scavengers was investigated for possible hazards. 

8.1.2.2.1 Chemicals 

Sections 11.1 and 11.2 of this SER describe the chemical processes that take place as a part of 

normal operations at the MFFF. 

The applicant generated chemical interaction matrices for AP and MP reagents (MOX Services, 

2009a) to evaluate possible chemical interactions and the appropriate controls required on 

process parameters to ensure that hazardous interactions are prevented or mitigated. The 

applicant postulated that these chemicals are mixed either by failure of operations or equipment 

within the AP process itself or result from an inadvertent mixing by a technician in the reagent 

processing building (BRP) or MP area laboratories. The next section of this SER describes 

chemical interactions in more detail. 

8.1.2.2.2 Chemical Interactions 

Human error or equipment malfunction may result in inadvertent chemical interactions and 

initiate hazardous reactions. The applicant identified hazardous chemical characteristics and 

incompatibilities with the associated materials or process conditions, which are summarized in 

Tables 8.2-1 through 8.2-4 of the LA (MOX, 2009a) and Tables 5.1.3-4 through 5.1.3-7 of the 

ISA Summary (MOX, 2009b). The staff concluded that this list was consistent with standard 

interaction tables used by AICHE (AICHE, 2008). The applicant conducted hazard and 

operability analyses as part of the ISA during the detailed design phase and has submitted a 

complete chemical interaction matrix as part of the LA. The applicant has committed to 

controlling chemical preparation in accordance with operating procedures by using trained 

personnel to minimize the potential for unexpected interactions. To minimize the risk associated 

with inadvertent chemical interactions, the applicant will prepare most chemical reagents for the 

AP process in the BRP (a nonradiological building), with subsequent distribution to the AP area. 

Sections 8.4.3.2(A), (B), and (C) of NUREG-1718 (NRC, 2000) list the acceptance criteria for 

potential chemical interactions. The staff notes that the applicant (1) identified hazardous 

chemicals expected to be used or produced at the facility, (2) identified general precautions and 

multiple specific hazards associated with the interaction of chemicals, and (3) considered 

radiolysis effects. Specific hazards include red oil (solvent) reactions, HAN/hydrazine 

autocatalytic reactions, azides decomposition, Pu (VI) oxalate explosions, and hydrogen 

deflagrations and explosions. The staff finds that the overall description of hazardous chemicals 

and potential interactions is consistent with guidance provided in Sections 8.4.3.2(A), (B), and 

(C) of NUREG-1718 (NRC, 2000), and is generally adequate and acceptable. SER 

Sections 8.1.2.4, 11.1, and 11.2 discuss further the significant specific chemical-related risks. 

The applicant’s ISA included an analysis of the potential for explosions and the IROFS that are 

required to prevent these events. In addition, the applicant identified events involving chemical 

releases, alone or in combination with radioactive releases. The applicant also identified IROFS 

to protect against these chemical risks at the MFFF. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 13

Normal process conditions do allow for interactions of some chemicals identified as 

incompatible, provided that process parameters are controlled to allow safe operating 

conditions. For chemicals identified as incompatible that are mixed under normal process 

conditions, the applicant identified the following conditions that are controlled as necessary to 

maintain safe operating conditions: 

• Aluminum nitrate—The low concentrations of aluminum nitrate (1 gram per liter (g/L)) 

used in the AP process are compatible with nitric acid. 

• Diluent—For the chemical incompatibility between the diluent and oxygen, 

Section 8.3.3.6 of the LA (MOX, 2009a) discusses IROFS controls to ensure that either 

(1) all vapor compositions in the AP process are maintained at or below 60 percent of 

the lower flammability limit (LFL) or (2) by application of purge gas, effluent gas remains 

out of the flammability range throughout the system being protected. 

• Dinitrogen tetroxide (equivalent entry for nitrogen dioxide)—Concentration and nitreous 

(NOx) flow controls in KPA*CLMN6000 allow controlled (i.e., intentional) HAN and 

hydrazine destruction by NOx, with adequate venting capacity provided for off-gases that 

are generated. 

• Hydrazine monohydrate—Concentration and temperature controls ([N2H4] < 0.14 moles 

per liter (M); [HNO3] < 1.75 normal (N); temperature < 55 degrees Celsius (C) or 

50.6 degrees C ensure that hydrazine and nitric acid can coexist with minimal reactivity 

such that safe operating conditions are maintained. 

• Hydrogen peroxide—Concentration controls ([H2O2] < 10 weight percent (wt%); [HNO3] < 

8 N) in KDD/KDB*TK3000 allow for the safe use of hydrogen peroxide to reduce Ag (II) 

to Ag (I) and Pu (VI) to Pu (IV) in the presence of nitric acid. 

• HAN—Concentration and temperature controls ([HAN] < 0.8 M; [HNO3] < 1.75 N; 

temperature < 55 degrees C or 50.6 degrees C) are employed to limit the depletion of 

HAN by nitric acid to prevent a HAN autocatalytic reaction. 

• Nitric acid—The concentration of degradation products from reactions of organic 

compounds such as TBP and hydrogenated polypropylene tetramer (HPT or diluent) by 

nitric acid is limited to safe levels during normal process conditions by processing spent 

solvent through the solvent recovery unit, which removes solvent degradation 

compounds from the AP process. 

• Oxalic acid—Manganese nitrate is used to catalyze the destruction of oxalic acid by 

nitric acid in the oxalic mother liquor recovery (KCD) unit. 

• Silver nitrate—Silver nitrate is stable in acidic solutions in the absence of strong reducing 

agents, which are not used in AP process vessels that contain silver nitrate. The 

reduction of silver nitrate to silver metal by hydrogen peroxide is extremely slow and 

poses no safety hazard in KDB*TK3000, KDD*TK3000, and KDD*TK4000. 

• Sodium carbonate—Adequate vent capacity for vessels KPB*MIXS1000 and 

KWD*TK4015 allow for safe neutralization reactions with nitric acid. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 14

• Sodium hydroxide—Adequate vent capacity for vessels KPB*MIXS1000 and 

KWD*TK4015 allow for safe neutralization reactions with nitric acid. 

• Sodium nitrite—Flow controls of nitric acid into KWD*TK4015, combined with adequate 

vent capacity for this vessel, allows for safe acidification of sodium nitrite into nitrous 

acid for the purpose of azide destruction. 

• Sodium sulfite—Flow control of sodium sulfite allows for controlled reduction of chlorine 

(Cl2) in KDD*CLMN7000/8000. 

• TBP—The hydrolytic degradation of TBP in alkaline solutions used for solvent washing 

in the solvent recovery (KPB) unit is mitigated by the separation of TBP from the alkaline 

stream (i.e., contact between TBP and sodium hydroxide is limited by solvent 

separation). 

In Section 8.2 of the LA (MOX, 2009a) and Section 5.3 of the ISA Summary (MOX, 2009b), the 

applicant provided chemical interaction matrices describing potential interactions between 

chemical reagents present in the AP and MP processes, interactions between chemical 

reagents present in the AP process and actinides and water, chemical interactions between 

species (mainly oxidizing) that may be generated in situ within the AP process, and chemical 

interactions between chemicals used in the MP process and steam supply unit. 

The staff has reviewed this information and finds that it appears sufficiently complete and is 

consistent with the proposed activities and adequate for safety assessments. The staff finds 

that the information provided is consistent with guidance in Section 8.4.3.2(B) of NUREG-1718 

(NRC, 2000) and follows AICHE standards and; therefore, the staff finds that this information is 

adequate and acceptable. 

8.1.2.2.3 Unusual and Unexpected Reactions 

The applicant stated that, in the chemical conditions encountered in the plutonium-uranium 

extraction (PUREX)-based process at the reference La Hague facility, chemical incompatibilities 

between the reagents have been mitigated or prevented through the control of process 

parameters. Tables 8.2-1 through 8.2-4 of the LA (MOX, 2009a) and Tables 5.1.3-4 through 

5.1.3-7 of the ISA Summary (MOX, 2009b) present chemical interaction matrices created as a 

part of the applicant’s ISA to assess the chemical compatibility or incompatibility of the reagents 

that are postulated to be mixed either by failure of operations or equipment within the AP 

process itself or as a result of an inadvertent mixing by a technician in the BRP or BMP 

laboratories. 

Some AP operations produce additional chemical compounds. The applicant stated that the 

behavior of these mixtures is well understood from experience at the La Hague facility in France 

and is included in the chemical process safety evaluation. 

In general, for vapor and gaseous species, AP chemical interactions produce nitrogen oxides, 

carbon dioxide, carbon monoxide, and hydrogen, as well as possible plutonium, americium, and 

uranium mixtures entrained in nitric acid vapors. These chemicals will be generated in tanks 

and equipment and will be collected by the off-gas treatment system (KWG). Solvent-diluent 

vapors will also be collected in a separate stream and treated by the off-gas system before 

being released to the stack. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 15

The staff has reviewed the information provided for unusual and unexpected reactions and finds 

that it appears sufficiently complete and is consistent with the proposed activities and adequate 

for safety assessments. The staff finds that the information provided is consistent with guidance 

in Section 8.4.3.2(C) of NUREG-1718 (NRC, 2000); therefore, the staff finds that this 

information is adequate and acceptable. 

SER Section 8.1.2.4 discusses process safety information and specific concerns in more detail, 

and SER Sections 11.1 and 11.2 discuss specific chemical concerns by process unit. The staff 

findings are presented in those sections. 

8.1.2.3 Chemical Accident Sequences 

The applicant provided information on chemical-related events in Sections 5.5 and 8.3 of the LA 

(MOX, 2009a) and Section 5.3 of the ISA Summary (MOX, 2009b). 

This section presents the staff’s assessment of accident sequence bases, unmitigated 

sequences, estimated concentrations, and concentration limits for chemical safety. This section 

also provides the methodology and results for the evaluation of chemical consequences that 

may be associated with a release of radiochemical materials. 

As reflected in 10 CFR 70.64(a)(5), the design must provide adequate protection from the 

following: 

$ chemical risks produced from licensed radioactive material 

$ facility conditions which affect the safety of licensed material 

$ hazardous chemicals produced from licensed materials 

According to guidance provided in NUREG-1718 (NRC, 2000), the description of the foregoing 

chemical accident sequences should identify unmitigated accident sequences that could result 

in high or intermediate consequences to an individual. The applicant should also identify the 

standards used to establish the concentration limits and the methods used to assess the 

severity level of the accident sequence. 

Subsequent sections present staff evaluations and conclusions. 

8.1.2.3.1 Chemical Consequence Limits 

Concentrations Limits

As required by 10 CFR 70.65, the applicant must provide a description of the proposed 

quantitative standards used to assess the consequences to an individual from acute chemical 

exposure to licensed material or chemicals produced from license materials. The applicant has 

adopted Revision 18 of the Temporary Emergency Exposure Limits (TEELs) to categorize 

exposures in accordance with the qualitative criteria established in 10 CFR 70.61. The following 

are the TEEL definitions: 

• TEEL-1 is the maximum concentration in air below which it is believed nearly all 

individuals could be exposed without experiencing other than mild transient adverse 

health effects or perceiving a clearly defined objectionable odor. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 16

• TEEL-2 is the maximum concentration in air below which it is believed nearly all 

individuals could be exposed without experiencing or developing irreversible or other 

serious health effects or symptoms that could impair their abilities to take protective 

action. 

• TEEL-3 is the maximum concentration in air below which it is believed nearly all 

individuals could be exposed without experiencing or developing life-threatening health 

effects. 

The DOE Subcommittee on Consequence Assessment and Protective Action (SCAPA) 

developed the TEELs because acute exposure guideline levels (AEGLs) and emergency 

response planning guidelines (ERPGs) exist only for a limited number of chemicals. SCAPA 

created TEELs so that DOE facilities, the U.S. Department of Defense, and some other 

Government agencies could conduct appropriate emergency preparedness hazard analysis and 

perform consequence assessments for the thousands of chemicals lacking AEGLs and ERPGs. 

TEELs are considered temporary; they are approximations of potential values and are subject to 

change whenever new or better information becomes available. 

AEGLs and ERPGs are available for chlorine, hydrazine, nitric acid, and nitrogen dioxide, which 

are chemicals of concern in the AP process.6

 Since TEELs are considered temporary and 

NUREG-1718 (NRC, 2000) recommends the use of AEGLs or ERPGs to establish the chemical 

concentration limits,7

 the staff compared AEGLs and ERPGs values to the corresponding 

TEELs for the chemicals of concern in the AP process. The staff notes that TEEL values for 

those chemicals are comparable to corresponding AEGL and ERPG values. 

The NRC does not promulgate its own chemical consequence limits, but relies on published 

standards developed by other Government agencies (e.g., OSHA, National Institute for 

Occupational Safety & Health (NIOSH)). Since the TEELs are standards developed by DOE for 

emergency preparedness, and given that they are comparable to AEGLs and ERPGs, the staff 

finds the use of TEELs to assess chemical consequences acceptable. The information provided 

is consistent with guidance in Section 8.4.3.3(D) of NUREG-1718 (NRC, 2000); therefore, the 

staff finds that this information is adequate and acceptable. 

Consequences Categorization

Based on the provision of 10 CFR 70.61, three severity levels, High (H), Intermediate (I), and 

Low (L), are used to define the chemical concentration limits. Table 8.1.2.3.1-1 identifies the 

chemical consequence categories used to define the level of risk. Note that for uranium 

accidents, intakes are used, instead of concentration-based TEELs, to establish consequence 

categories. In most cases, events involving an airborne release of plutonium or americium are 

considered to have high consequences to the facility worker and IROFS are applied by the 

applicant to reduce their likelihood. 

Table 8.1.2.3.1-1 Application of Chemical Limits to Qualitative 

Chemical Consequence Categories 

 

6

 The applicant chose the chemicals of concern in the AP process based on maximum inventory, location, 

TEEL/ERPG values, and chemical properties. 

7

 The NRC does not promulgate its own chemical consequences limits but relies on values from other 

Government agencies and organizations that have a clear toxicological and regulatory basis. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 17

Consequence 

Category Worker (100 m) IOC (160 m) 

High Concentration > TEEL-3 

Concentration > TEEL-2 

Soluble uranium intake > 30 mg 

Insoluble uranium respirable intake > 30 mg 

Intermediate 

TEEL-3 > Concentration > TEEL-2 

Soluble uranium intake > 30 mg 

Insoluble uranium respirable intake >

30 mg 

TEEL-2 > Concentration > TEEL-1 

30 mg > Soluble uranium intake > 1 mg 

30 mg > insoluble uranium respirable intake > 10 mg 

Low 

TEEL-2 > Concentration 

30 mg > Soluble uranium intake > 

1 mg 

30 mg > insoluble uranium respirable 

intake > 10 mg 

TEEL-1 > Concentration 

Soluble uranium intake < 10 mg 

Insoluble uranium respirable intake < 10 mg 

The staff concludes that the use of TEELs to establish chemical consequence categories is 

acceptable for addressing the applicable 10 CFR 70.61 performance requirements for chemical 

protection. Furthermore, the information provided is consistent with guidance in 

Section 5.4.3.2(vi) of NUREG-1718 (NRC, 2000); therefore, the staff finds that this information 

is adequate and acceptable. 

Techniques, Assumptions, and Models

The applicant’s hazard analysis considered many different types of events that could cause an 

adverse human health or environmental effect as a result of accidental exposure to chemical 

sources. These types of accidents are categorized into the major events of fires, explosions, 

loss of confinement, load drops, and nuclear criticality. Chapters 5 and 8 of this SER provide 

the staff’s evaluation of the applicant’s hazard assessment. 

The applicant calculated a bounding consequence for each identified event in the hazard 

evaluation. For the analysis, the facility worker is considered to be inside the MFFF, close to 

the potential accident, whereas the site worker is considered to be 100 meters from the release 

point. The individual outside the control area (IOC), as defined in the ISA, is the maximally 

exposed individual outside the controlled area boundary, either 68 meters (for BSW releases) or 

160 meters (for MFFF building stack releases) from the release point. The applicant determined 

the consequences for the IOC and the facility worker based on the material released, the 

release mechanism, and the location of the worker relative to the release. MOX Services 

considered a range of initial conditions, as well as the failure modes of storage containers and 

associated systems. The following release mechanisms are stated in the reviewed LA (MOX, 

2009a): 

• leaks and ruptures involving equipment vessels and piping 

• evaporating pools formed by spills and tank failures 

• flashing and evaporating liquefied gases from pressurized storage 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 18

For the chemical consequences analysis, the applicant assumed the largest credible 

unmitigated spill or loss of containment accident. That is, the applicant modeled releases using 

the total material at risk from the largest single tank or container. No credit was taken for 

process equipment installed to scrub and remove gases and vapors of the potentially released 

chemicals before release from the MFFF. 

The applicant used the largest evaporation rate calculated from two models as input to the 

Atmospheric Relative Concentrations in Building Wakes (ARCON) 96 computer code. The 

models are the following: 

E AK

MW P

R T M

M V =⋅ ⋅ ⋅

⋅ (8.1.2.3.1-1)8

Where: 

E = evaporation rate (kilogram per second (kg/s)) 

A = area of the evaporation puddle (square meter (m2

)) 

KM = mass transfer coefficient (meter per second (m/s))= 0.0048ּU7/9ּZ-1/9ּSc-2/3

U = wind speed (m/s) 

Z = pool diameter in the along-wind direction (meter (m)) 

Sc = laminar Schmidt number (dimensionless) 

MWM = molecular weight of the material of interest (kilogram per kilomole (kg/kmol)) 

PV = vapor pressure (pascal (Pa)) 

R = gas constant (8.314 joule per mole kelvin (J/mol-K)) 

T = ambient temperature (kelvin (K)) 

Q AK

MW P

R T P g

M V

P

0 = ⋅⋅ ⋅

⋅ (8.1.2.3.1-2) (NRC, 1998) 

Where: 

Q0 = evaporation rate (kg/s) 

AP = area of the pool (m2

) 

Kg = mass transfer coefficient (m/s)= DmּNsh/d 

Dm = molecular diffusivity of the vapor in air (m2

/s) 

d = effective diameter of the pool (m) 

Nsh = Sherwood number (dimensionless) 

TP = temperature of the pool (K) 

For the unmitigated releases, the applicant assumed to occur outdoors, with an air speed of 2.2 

m/s. This is consistent with 95-percent “worst case” meteorological conditions at SRS and are 

conservative assumptions. 

To validate the methods used by the applicant, the staff performed independent calculations to 

estimate chemical exposures to the site workers and IOC in case of a release. Using the 

evaporation rate model in NUREG/CR-6410, “Nuclear Fuel Cycle Facility Accident Analysis 

Handbook,” issued March 1998 (NRC, 1998), the staff calculated the evaporation rate for some 

of the chemicals used in the AP process. The calculated evaporation rate was input into the 

Areal Locations of Hazardous Atmospheres (ALOHA) code to model chemical releases in the 

AP process. ALOHA is an atmospheric dispersion model maintained by the Hazardous Material 

 

8

 Kawamura, P.I., and D. Mackay, “The Evaporation of Volatile Liquids,” Journal of Hazardous 

Materials, 15:343–364, 1987. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 19

Division of the National Oceanic and Atmospheric Administration and the U.S. Environmental 

Protection Agency. This model is used primarily for the evaluation of the consequences of 

atmospheric releases of chemical species. ALOHA is widely used by the public, Government 

agencies (e.g., DOE), and the private sector. The staff assumed release of the entire inventory 

for the calculation. Since the applicant’s assumptions are conservative, the staff used the same 

assumptions for the analysis. For the chemicals of concern within NRCs jurisdiction, the staff 

noticed that concentrations exceeding the TEEL-1 at 160 meters or the TEEL-2 at 100 meters 

will not result given the aforementioned assumptions. Based on its confirmatory analysis, the 

staff accepts the applicant’s methods. 

Health effects on the facility worker from chemical exposure resulting from releases of licensed 

materials containing plutonium and americium are assumed to be dominated by the radioactive 

dose; thus, prevention or mitigation of the radioactive consequences would also prevent or 

mitigate the chemical exposure. 

The staff found that the techniques, assumptions, and models utilized by the applicant to 

estimate hazardous chemical concentrations are generally consistent with industry practice and 

generally follow the guidance on atmospheric and consequence modeling found in 

NUREG/CR-6410 (NRC, 1998). Consequently, the staff finds them to be acceptable. 

8.1.2.3.2 Chemical Release Events 

This section discusses chemical releases that could result in events that exceed low 

consequence criteria under 10 CFR 70.61. The two broad categories of these events include 

the following: 

• CRE-1—Chemical releases that result in acute chemical exposures to an individual from 

licensed materials or hazardous chemicals produced from licensed materials. 

 

• CRE-2—Chemical releases that may interfere with operator performance of a NRC 

required safety function or serve as an initiator to an event by disabling an operator. 

8.1.2.3.2.1 CRE-1—Chemical Releases That Result in Acute Chemical Exposures to an 

Individual from Licensed Materials or Hazardous Chemicals Produced from 

Licensed Materials

The applicant evaluated chemical consequences resulting from a release of hazardous 

chemicals directly produced from the processing of licensed material and releases of licensed 

material under 10 CFR 70.61. Events identified as potentially resulting in intermediate or high 

chemical consequences are discussed as part of the event descriptions related to NPH-1 (SER 

Section 11.11.6.1), NPH-2 (SER Section 11.11.6.2), F-16 (SER Section 7.1.6.15), LH-15 (SER 

Section 11.6.5.14), LOC-3 (SER Section 11.7.5.1), LOC-4 (SER Section 11.7.5.2), LOC-11 

(SER Section 11.7.5.4), LOC-13 (SER Section 11.7.5.5), and explosion events (SER 

Chapters 8 and 11). 

8.1.2.3.2.2 CRE-2—Chemical Releases That May Interfere with Operator Performance of a 

NRC Required Safety Function or Serve as an Initiator to an Event by Disabling an 

Operator

The applicant evaluated those events that could result in a release of hazardous chemicals not 

subject to 10 CFR Part 70, “Domestic Licensing of Special Nuclear Material,” that may interfere 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 20

with operator performance of a NRC required safety function. The applicant identified no events 

in which operator performance of a NRC required safety function to preclude a release of 

licensed material could be impaired by an exposure to a chemical not subject to 10 CFR Part 70 

or in which disabling of an operator by a chemical exposure could initiate a release of licensed 

material. Therefore, no IROFS are necessary for a release of hazardous chemicals not subject 

to 10 CFR Part 70. 

Based on the staff’s review of the LA (MOX, 2009a) and ISA Summary (MOX, 2009b), the staff 

agrees with this finding and concludes that chemical releases that may interfere with operator 

performance of a required safety function or serve as an initiator to an event by disabling an 

operator cannot cause consequences in excess of low as defined by 10 CFR 70.61. 

Furthermore, the staff finds that the provisions of 10 CFR 70.61 are met for this event. 

8.1.2.4 Process Safety Controls 

8.1.2.4.1 Safety Strategies for Events Involving Hydrogen (EXP01 and EXP03) 

8.1.2.4.1.1 Argon-Hydrogen Mixture in Sintering Furnace and Hydrogen Storage (EXP01)

Sintering furnace hydrogen explosions (EXP01) are considered credible in the pellets 

processing area where hydrogen explosions may occur in the high temperatures of the furnaces 

that sinter MOX fuel pellets. The applicant identified five explosion scenarios involving 

hydrogen in the sintering furnaces which could lead to a release of radioactive material. The 

applicant’s safety strategy to prevent hydrogen explosions in the sintering furnaces is the 

application of IROFS to meet the performance criteria of 10 CFR 70.61. 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 21

Staff Evaluation and Findings

The NRC staff finds that the proposed IROFS are adequate to comply with the single-failure 

criterion because each active engineered IROFS is redundant and fail-safe. Also, the applicant 

committed to provide adequate IROFS separation and to design the IROFS necessary to safely 

shut down the sintering furnace to be available during and after a seismic event. The singlefailure criterion, in combination with management measures (as described in Chapter 15 of the 

LA), quality assurance requirements (described in the MPQAP), and the use of codes and 

standards for engineered IROFS give the NRC staff reasonable assurance that these high 

consequence scenarios are highly unlikely. Therefore, the proposed safety strategy and IROFS 

comply with the performance requirements of 10 CFR 70.61. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 22

8.1.2.4.1.2 Radiolytic Hydrogen Production (EXP03)

Event Description

Radiolysis is the dissociation of molecules that can lead to gas generation. It occurs when 

organic and aqueous fluids are irradiated, as in the case of the MFFF, by plutonium and 

americium. Since the organic and aqueous fluids are hydrogenous substances, the generated 

gas of concern is hydrogen. Hydrogen gas can build up in the vapor spaces of tanks and 

vessels. If an overpressurization occurs or if the concentration of the flammable gas exceeds 

the LFL, there is a risk for a radiolysis-induced explosion which can result in the release of 

licensed material. There is also a risk of radiolysis in the waste-handling system because of the 

confinement of radioactive material. 

For the analysis of this explosion event, the applicant assumed hydrogen to be the only gas 

generated from radiolysis. The applicant has relied on National Fire Protection Association 

(NFPA) 69, “Standard on Explosion Prevention Systems” (NFPA, 2008), to set the bounding 

values for hydrogen concentrations. According to NFPA 69, in the absence of automatic 

controls, the maximum hydrogen concentration allowed must not exceed 25 percent of its LFL, 

which corresponds to a value of 1 percent for this analyzed event. The hydrogen LFL is 4 

percent. The 1-percent maximum hydrogen concentration provides an adequate safety margin 

between the hydrogen explosive limit and the maximum amount of hydrogen allowed in any 

tank or vessel since it meets NFPA 69. 

Safety Strategy

The safety strategy for this event is prevention in both the AP process, and the waste-handling 

system. The applicant’s approach for prevention in the AP process equipment involves the 

dilution or inerting of the vapor space, the monitoring and control of material at risk (MAR), the 

control of the vapor space, and the detection and recovery from a loss of instrument air before 

reaching an explosive limit. The prevention safety strategy in the waste-handling system 

requires the containers to be designed such that hydrogen buildup in excess of the explosion 

limits does not occur, while providing appropriate confinement of radioactive material. 

Within the AP process, the applicant identified two types of vessels for this explosion event. In 

the first type of vessel, dilution (or scavenging) air is continuously provided; in the other type of 

vessel, dilution air is not provided. Dilution air is not provided to a vessel if the hydrogen 

concentration will not reach 1 percent in the vapor space within 11 days without instrument air 

being supplied. Otherwise, all other tanks and vessels, in which a hydrogen concentration of 

1 percent or more could be reached within 11 days, are supplied continuously with dilution air. 

Items Relied on for Safety
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 23
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 24

Staff Evaluation and Findings

The NRC staff evaluated the applicant’s calculation for determining the minimum and actual 

dilution airflows to the vessels in which the hydrogen concentration will reach 1 percent or 

greater within 11 days. The applicant’s calculation is based on the type of solution present (i.e., 

organic or aqueous) and the maximum credible MAR amount in the vessel of interest. After 

determining the minimum dilution airflow, the applicant rounded this value to the nearest 

50 NL/h and then multiplied the resulting value by a factor of 1.25. The NRC staff finds that this 

calculation provides reasonable assurance of safety based on the added safety margins the 

applicant put in place to determine the actual dilution airflow. 

The credited IROFS for each of the types of vessels discussed above provide a diverse method 

to control each of the parameters that have an effect in the generation and accumulation of 

hydrogen. In addition, the applicant has committed to have fail-safe and redundant active 

engineered IROFS (i.e., radiation detectors and isolation valves) and use them in combination 

with passive engineered IROFS (i.e., vessel overflows and material of waste containers) and 

administrative IROFS (i.e., sampling and detection of and recovery from loss of instrument air). 

The NRC staff finds that this is an acceptable approach to complying with the single-failure 

criterion. The single-failure criterion, in combination with the experience in La Hague, 

management measures (as described in Chapter 15 of the LA), quality assurance requirements 

(as described in the MPQAP), and the use of codes and standards for engineered IROFS, give 

the NRC staff reasonable assurance that this high consequence event is highly unlikely. 

Therefore, the proposed safety strategy and IROFS comply with the performance requirements 

of 10 CFR 70.61. 

The applicant also uses features to reduce the challenge to IROFS where practical. 

 The NRC 

staff finds that these features comply with the defense-in-depth requirements of 

10 CFR 70.64(b). 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 25

8.1.2.4.1.3 Electrolysis-Related Explosions (EXP13 and EXP17)

Electrolytically Generated Hydrogen Explosions (EXP13)

Electrolysis-related explosions are postulated to occur from hydrogen (H2) that may be 

generated electrochemically at the cathode of the electrolyzer. The applicant’s safety strategy 

for electrolysis-related explosions involves the application of IROFS to meet the performance 

criteria of 10 CFR 70.61. 

Event Description

 

 

 

 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 26

The applicant’s safety strategy for this event is to control the normality of the catholyte side of 

the electrolyzer during electrolysis and to verify flow through the electrolysis cell to ensure that 

the normality determined is representative of the solution in the cell. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 27

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 28

 

Staff Evaluation and Findings

The credited IROFS discussed above provide a diverse method to control each of the 

parameters that have an effect on the generation and potential ignition of hydrogen in the 

electrolyzers. The applicant has also committed to have fail-safe and redundant active 

engineered IROFS (e.g., normality controllers, process-level controls, and catholyte flow 

monitoring) and use them in combination with passive engineered IROFS (e.g., process vessels 

(membrane) and pipes). 

The NRC staff finds that this is an acceptable approach to complying with the single-failure 

criterion. The single-failure criterion, in combination with management measures (as described 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 29

in Chapter 15 of the LA), quality assurance requirements (described in the MPQAP), and the 

use of codes and standards for engineered IROFS give the NRC staff reasonable assurance 

that these high consequence scenarios are highly unlikely. Therefore, the proposed safety 

strategy and IROFS comply with the performance requirements of 10 CFR 70.61. 

The applicant also uses defense-in-depth features to reduce the challenge to IROFS, where 

practical. 

 The NRC staff finds 

that these features comply with the defense-in-depth requirements of 10 CFR 70.64(b). 

Perchlorate Explosions (EXP16h and EXP17)

Explosion in KDD Scrubbing Columns Caused by Higher Oxides of Chlorine (EXP16h) 

Chlorine removal from the electrolyzer is provided by the oxidation of chloride ions (Cl-

) at the 

anode to form molecular chlorine (Cl2, a gas which is swept through a series of filters and 

injected through the Venturi injector scrubber into the recirculating tank. At this stage, Cl2 is 

reverted to chloride ion using a 0.5 M sodium sulfite (Na2SO3) scrubbing solution that is 

continuously recirculated through the packed scrubbing column to ensure maximum contact 

with the off-gases, and maintained at a high pH with sodium hydroxide (NaOH) to prevent 

corrosion and optimize sulfite reduction of chlorine. An inline sulfite analyzer indicates when 

scrubbing is complete; the spent solution is then transferred to the first KDD chlorine waste tank 

and on to the second KDD chlorine waste tank for sampling and dilution before transfer to the 

low-level liquid waste unit (KWD). Residual unreacted chlorine is scavenged through a demister 

before being discharged to the VHD unit. 

However, alkaline conditions (pH 12) in the scrubber are also potentially favorable for chlorine to 

oxidize to higher oxidized species. These higher oxides of chlorine are strong oxidants that can 

react exothermically or explosively. Although these reactions do not generate gaseous 

products, and organic solvents are not present in the scrubber, energy releases from 

uncontrolled reactions could lead to pressurization of chlorine gas. This explosion would not 

directly involve any radioactive material that could exceed the performance requirements of 

10 CFR 70.61. However, the explosion event could damage nearby IROFS components in the 

vicinity of the electrolyser and may indirectly create radiological and chemical consequences to 

the facility, radiological consequences to site workers and the IOC, a release to the environment 

that would exceed the performance requirements of 10 CFR 70.61, or some combination of 

these consequences based on the damage from an explosion. 

Event Description

In the scrubber, chlorine gas is reduced by sulfite ion according to the oxidation-reduction 

(redox) reaction: 

2 OH-

 + SO3

2- + Cl2 → SO4

2- + 2 Cl-

 + H2O (8.1.2.4.1.3-5) 

However, in the alkaline conditions (pH 12) of the scrubber, chlorine can undergo a competing 

disproportionation redox reaction (that does not involve sulfite), through direct hydrolysis with 

hydroxide ion: 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 30

2 OH-

 + Cl2 → OCl- + Cl- + H2O (8.1.2.4.1.3-6) 

The hypochlorite ion (OCl-

) formed in this reaction is an unstable species that is prone to 

subsequent disproportionation redox reactions leading to the formation of higher oxides of 

chlorine, namely chlorate (ClO3

-

) and perchlorate (ClO4

-

): 

3 OCl- → 2 Cl-

 + ClO3

-

 (8.1.2.4.1.3-7) 

4 ClO3

- → 3 Cl-

 + ClO4

-

 (8.1.2.4.1.3-8) 

However, the hypochlorite ion is also readily and quickly reduced by sulfite (Fogelman, et al.,

1989): 

OCl-

 + SO3

2- → Cl-

 + SO4

2- (8.1.2.4.1.3-9) 

Thus, the fate of any hypochlorite ion formed from equation (8.1.2.4.1.3-6) is determined by 

competing equations (8.1.2.4.1.3-7) and (8.1.2.4.1.3-9). In the absence of the sulfite ion, 

equation (8.1.2.4.1.3-7) eventually leads to the formation of chlorate and perchlorate ions. 

These higher oxidized species are strong oxidizing agents that undergo exothermic reactions 

with reducing agents such as sulfite. 

To minimize the potential for explosive conditions in the scrubber, the applicant’s safety strategy 

is to prevent the formation of higher oxides of chlorine in this equipment. 

Items Relied on for Safety
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 31
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 32

 

Staff Evaluation and Findings

The staff finds that the applicant sufficiently demonstrated that no IROFS are necessary for this 

event scenario and that the defense-in-depth measures to be implemented by the applicant 

provide additional assurance that interactions with IROFS during this accident event are 

reasonably prevented. . 

The NRC staff finds that this approach is reasonable and acceptable. Furthermore, the staff 

finds that these features comply with the defense-in-depth requirements of 10 CFR 70.64(b). 

Electrolyzer-Related Perchlorate Explosion (EXP17) 

Perchlorate explosions are postulated to occur from the oxidation of chlorine in the electrolyzer 

which is an IROFS. The applicant’s safety strategy for explosions from perchlorate or other 

higher oxides of chlorine involves the application of IROFS to meet the performance criteria of 

10 CFR 70.61. 

Event Description

The expected chloride reaction on the anode during dechlorination is as follows: 

2Cl- → Cl2 + 2e-

 (8.1.2.4.1.3-10) 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 33

However, other oxidation-reduction (redox) couples are possible at the anode. In the literature, 

standard oxidation potentials for various redox couples for higher oxides of chlorine under acidic 

or basic conditions can be found. Higher oxides of chlorine are a safety concern for two 

reasons: (1) material compatibility—various chlorates are highly corrosive and (2) explosion 

hazard—various forms of perchlorates are explosion hazards (e.g., potassium perchlorate, 

ammonium perchlorate). The couple in the above reaction has the lowest potential and will be 

the thermodynamically preferred reaction. However, the difference between the redox potential 

for this reaction and those of other reactions (e.g., perchlorate) is rather small, and, in the 

absence of kinetic considerations, some of the other redox reactions could occur in the 

electrolyzer. 

Considerable kinetic barriers are associated with these other redox reactions which require a 

large overpotential that precludes the formation of higher oxides of chlorine at the anode. As a 

result, unless a large current density is applied, conditions favorable to formation of higher 

oxides of chlorine are restricted. Under acidic conditions (like those found in the electrolyzer), 

the first step involves the hydrolysis of chlorine (Cl2) leading to a disproportionation redox 

reaction and subsequent formation of hypochlorous acid (HOCl): 

H2O + Cl2 → HOCl + Cl-

 + H+ (8.1.2.4.1.3-11) 

Higher oxides of chlorine such as chlorate (ClO3

-

) and perchlorate (ClO4

-

) can be generated in 

solution from HOCl, and its conjugate base hypochlorite (OCl-

), through a series of 

disproportionation redox reactions: 

2 HOCl + OCl- → 2 Cl-

 + 2 H+ + ClO3

-

 (8.1.2.4.1.3-12) 

4 ClO3

- → 3 Cl-

 + ClO4

-

 (8.1.2.4.1.3-13) 

One process upset condition involves the addition of silver nitrate (AgNO3) before the removal of 

chloride from the process solution. This could occur if the dechlorination step is incomplete or if 

AFS material is introduced to the KDB unit (where a dechlorination step is not performed). The 

addition of Ag+

 to a solution containing Cl- promotes silver chloride (AgCl) precipitation, but this 

is counteracted by an accompanying increase in ionic strength with silver nitrate addition that 

increases the solubility of silver chloride. Overall, this upset condition would result in a small 

amount of soluble chloride that could complicate the subsequent electrolysis of Ag+

 but would 

have little effect on the dynamics with respect to higher oxides of chlorine. 

If higher oxides of chlorine were to reach the KPA unit, exothermic reactions could occur with 

the organic solvent in the extraction pulsed column. These reactions could generate potentially 

explosive gases and raise the solution temperature such that the LFL for the solvent would be 

exceeded. In addition, higher oxides of chlorine continuing downstream to the raffinate tanks 

and to the KPC evaporators could cause an explosion event. 

The safety strategy for this event group is to control the quantity of higher oxides of chlorine that 

can be produced in an electrolyzer. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 34

 

Risk Discussion

The applicant indicated that a number of thermodynamic and kinetic factors constrain the 

formation of higher oxides of chlorine under the conditions encountered in the electrolyzer. 

First, reaction (8.1.2.4.1.3-10) becomes progressively disfavored thermodynamically as the 

acidity is increased, and little HOCl is produced under the highly acidic conditions that are 

nominally present in the electrolyzer. The low solubility of Cl2 in acidic aqueous solutions, which 

is diminished further by the relatively warm operating temperature within the electrolyzer and 

non-IROFS pressure controls that maintain a low pressure in the vapor space above the anolyte 

surface, also limit HOCl production. Additionally, formation of higher oxides of chlorine is largely 

prohibited at this pH by (1) the negligible concentration of hypochlorite (very little of the weak 

acid HOCl is dissociated to its conjugate base OCl-

, where [HOCl]/[OCl-] ~ 108), which is 

required for chlorate formation according to reaction (8.1.2.4.1.3-12) and (2) thermodynamic 

factors that favor the reverse reaction in equation (8.1.2.4.1.3-12). The applicant indicated that 

alternative electrochemical pathways for chlorine, other than that shown in 

equation (8.1.2.4.1.3-10), are suppressed by the operating current density in the electrolyzer. 

Furthermore, a competing anodic reaction reverts HOCl back to chloride with the evolution of 

oxygen gas. Finally, any chlorate that may be generated is highly susceptible to rereduction by 

residual chloride in solution to give (via a chlorine dioxide intermediate) chlorine gas and, 

although further disproportionation of any remaining chlorate towards the formation of 

perchlorate (equation (8.1.2.4.1.3-13)) is thermodynamically favored, a large kinetic barrier 

keeps this reaction sluggish up to 100 degrees C. 

Thus, under normal operating conditions, in which acidic conditions are maintained and the 

pressure at the surface of the anolyte is controlled (thus eliminating chlorine availability in 

solution), the formation of higher oxides of chlorine in a KDD or KDB electrolyzer is negligible. 

Additionally, the addition of hydrogen peroxide would reduce any higher oxides of chlorine into 

chloride and chlorine. 

Items Relied on for Safety

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 35

General Normality Controls

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 36

 

CEA Flowsheet Validation Testing

To validate the dechlorination and dissolution flowsheet in the MFFF AP process, the French 

Atomic Energy Commission, known as Commissariat a l’Energie Atomique (CEA), performed 

laboratory scale radioactive tests with weapons-grade plutonium oxide contaminated with 

chloride and other metallic impurities at the CEA Atalante Facility in Marcoule, France 

(Brossard, et al., 2003). 

The CEA conducted this experimental program to determine any effect on process operations 

caused by the differences between the relatively pure weapons-grade plutonium dioxide (from 

the PDCF) and the lower grade plutonium oxide from the AFS. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 37

The process used to purify the AFS PuO2 is based on a Ag (Il) catalyzed electrolytic dissolution 

followed by plutonium purification by liquid-liquid extraction. 

The Ag (Il) dissolution process for plutonium oxide has reached industrial maturity in France, 

which has led to its implementation for the dissolution of plutonium powders and for the 

treatment of various solid waste at an industrial scale in French facilities. 

The CEA successfully tested a derivative process in the 1980s for the treatment of chlorinated 

ashes and in the 1990s for hydrometallurgical treatment of plutonium salt-bearing salt baths. 

That process included a milling step, a direct electrolytic dechlorination, and an electrolytic 

plutonium oxide dissolution (Brossard, et al., 2003). 

The purification process is based on the purification flowsheets developed for the R4 facility in 

France (UP2 plant at La Hague). The CEA tested the following process operations: 

• milling 

• electrolytic dechlorination 

• silver (II) catalyzed electrolytic dissolution 

• plutonium purification by liquid-liquid extraction. 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 38

 

These CEA tests demonstrated the feasibility of quantitatively dissolving, by electrogenerated 

Ag (Il), plutonium powders obtained from molten chloride salts processing operations, milled 

and calcined for 2 hours at 950 degrees C under air. For all of the tests performed, more than 

99.6 percent of the plutonium which had been previously dechlorinated, with an efficiency 

greater than 99 percent, was dissolved in the nitric acid solution. 

The liquid-liquid extraction tests were successfully conducted leading to a plutonium recovery 

close to 100 percent, with an impurity content below the limits set for the process. 

These tests validated the process flowsheet for the MFFF plant to polish low-grade plutonium 

oxide from AFS. 

Staff Evaluation and Findings

The credited IROFS discussed above provide a method to control each of the parameters that 

have an effect in the generation and accumulation of higher oxides of chlorine. The applicant 

committed to have fail-safe and redundant active engineered IROFS
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 39

The NRC staff finds that this is an acceptable approach for complying with the single-failure 

criterion. The single-failure criterion, in combination with the experience in La Hague, 

experimental results at CEA facilities, management measures (as described in the Chapter15 of 

the LA), quality assurance requirements (as described in the MPQAP), and the use of codes 

and standards for engineered IROFS, give the NRC staff reasonable assurance that this high 

consequence event is highly unlikely. Therefore, the proposed safety strategy and IROFS 

comply with the performance requirements of 10 CFR 70.61. 

The applicant also uses defense-in-depth features to reduce the challenge to IROFS, where 

practical. 

 The NRC staff 

finds that these features comply with the defense-in-depth requirements of 10 CFR 70.64(b). 

8.1.2.4.2 Solvent Explosions (EXP06) 

The purification cycle and the solvent recovery cycle are two units in which solvent and diluent 

are used in processing. The purification cycle uses the solvent-diluent mixture for the extraction 

of plutonium. The solvent recovery cycle regenerates the solvent-diluent mixture by removing 

the degradation products and adjusting the TBP content and stores the treated solvent at a 

slightly acidic condition to prevent degradation by hydrolysis. The aqueous stream leaving the 

pulsed columns and mixer-settlers is washed with the diluent to remove traces of entrained 

solvent. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 40

Event Description

The applicant indicated that this event is a process-related chemical explosion involving solvent 

in AP vessels, tanks, and piping in AP process cells or AP gloveboxes resulting in an breach of 

the AP vessels, tanks, and piping and the potentially a dispersal of radioactive material outside 

of the plutonium confinement zone. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 41

The applicant’s safety strategy for this event is preventive and involves inhibiting the creation of 

flammable or explosive vapors within the vessel headspaces and vessel venting systems as a 

result of HVAC temperature deviations by limiting HVAC supply air temperatures, controlling 

process solution temperatures, and inerting specified vessels under certain conditions. 

Fire Events Affecting TBP or HTP or Both (EXP06c)

Fires external to process equipment have the potential to increase process temperatures such 

that a flammable or explosive mixture could be formed in the gaseous phase. 

Events Involving Separate Phase Solvent (TBP and HTP) (EXP06d)

The separate phase solvent is a layer of solvent over an aqueous solution, separated because 

of a density difference. Since TBP is slightly soluble in the aqueous solution and HTP is 

essentially immiscible in the aqueous solution, the aqueous solution will contain TBP at or near 

its solubility limit when a separate layer of solvent exists. 

Events Involving Separate Phase HTP (EXP06e)

In this event type, separate phase HTP is postulated as entering process vessels operating at 

temperatures in excess of the safety limit. 

Events Involving Soluble TBP (EXP06f)

During the solvent extraction of plutonium in the KPA unit, TBP extracts the plutonium from the 

aqueous phase into the organic phase, necessitating the commingling of the two phases. While 

HTP is essentially insoluble in the dilute aqueous nitric acid phase, TBP is partially soluble. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 42

Events Involving Solvent Degradation Products (EXP06g)

The solvent safety-basis temperature limit, which is established to prevent flammable vapors in 

the headspace of vessels containing solvent, depends upon the effective removal of 

degradation products, which could otherwise require the reduction of the temperature limit. 

Safety Strategy

The applicant’s safety strategy for solvent explosions involves the application of IROFS to meet 

the performance criteria of 10 CFR 70.61. 

The applicant’s safety strategy for this event is preventive and involves utilization of 

administrative controls to limit the accumulation of solvent degradation products that could 

otherwise cause the reduction of the flashpoint of solvent that has been permitted to remain in 

situ in the presence of plutonium for an extended period of time. 

To ensure that the lower flammability limit is not reached, the applicant has committed to follow 

the guidelines of NFPA 69 (NFPA, 2008) for the processing of flammable liquids. Specifically, 

NFPA 69 requires that the combustible concentration be maintained at or below 25 percent of 

the LFL, except for cases in which automatic instrumentation with safety interlocks is provided. 

In these cases, the combustible concentration is permitted to be maintained at or below 60 

percent of the LFL. 

In addition, the applicant has stated that, in those cases in which automatic instrumentation 

cannot prevent the concentration from exceeding 60 percent of the flammable limit, purge gas at 

the point of use will be applied. NFPA 69 gives the following guidance for point-of-use purge 

gas: 

• Purge gas shall be introduced and exhausted so that the distribution is 

ensured and the desired reduction in oxidant concentration is maintained 

throughout the system being protected. 

• Instrumentation shall be provided to monitor the purge gas supplied to the 

distribution system. 

• The oxygen concentration shall be checked on a regularly scheduled 

basis. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 43

The equipment and systems which are covered by this event group include those portions of the 

AP process that either normally contain solvent (i.e., KPA, KPB, KWS, and LGF units) or 

abnormally contain solvent (i.e., KWG, KPC, KCA, KCD, and KWD units). 

Process Temperature Events Involving TBP or HTP or Both (EXP06a)
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 44
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 45

Room Temperature Events Involving TBP or HTP or Both (EXP06b)

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 46

 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 47

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 48

 

Events Involving Separate Phase HTP (EXP06e)
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 49

 

 

 

Events Involving Soluble TBP (EXP06f)
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 50

Events Involving Solvent Degradation Products (EXP06g)
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 51

Staff Evaluation and Findings

The credited IROFS discussed above provide a method to control each of the parameters that 

can contribute to solvent explosions in the AP process. The applicant has also committed to 

have fail-safe and redundant active engineered IROFS (e.g., density controllers and 

temperature controllers) and use them in combination with passive engineered IROFS (e.g., 

slab settler and process vessels and pipes) and administrative IROFS (e.g., stationing of 

firewatch and administrative controls to maintain sufficient buffer volume in the KWD HAW unit). 

The NRC staff finds this to be an acceptable approach to complying with the single-failure 

criterion. The single-failure criterion, in combination with management measures (as described 

in Chapter 15 of the LA), quality assurance requirements (described in the MPQAP), and the 

use of codes and standards for engineered IROFS give the NRC staff reasonable assurance 

that these high consequence scenarios are highly unlikely. Therefore, the proposed safety 

strategy and IROFS comply with the performance requirements of 10 CFR 70.61. 

The applicant also committed to use defense-in-depth features to reduce the challenge to 

IROFS, where practical. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 52

 The NRC staff finds that these features comply with the defense-in-depth 

requirements of 10 CFR 70.64(b). 

The staff finds reasonable assurance that the applicant has identified the hazards and accident 

sequences associated with solvent explosions which could result in a release of radioactive 

material and credited IROFS are sufficient to meet the performance requirements of 

10 CFR 70.61, consistent with the acceptance criteria of Sections 7.4 and 8.4 in NUREG-1718. 

8.1.2.4.3 HAN and Hydrazine in Nitrate Media (EXPs 04, 10, and 11) 

DOE has used HAN as a reductant in nuclear materials processing and for decontamination of 

equipment. British and French reprocessing plants have also used HAN as a reductant. In 

addition, the U.S. Army has used HAN as an oxidizer in propellant mixtures (DOE, 1998). 

HAN was incorporated into many nuclear fuel reprocessing plants in the early 1970s for the 

reduction of Pu (IV) to Pu (III) in the plutonium-uranium extraction (PUREX) process. HAN 

generally replaced ferrous sulfamate and hydroxylamine sulfate (HAS) for plutonium reduction 

because it has the proper reduction potential for the Pu (IV) to Pu (III) reduction and its reaction 

products (molecular nitrogen (N2), nitrous oxide (N2O), and water (H2O)) do not contribute to the 

volume of solid waste produced during reprocessing (DOE, 1998). 

In the United States, HAN was the plutonium reductant of choice used at SRS and Hanford in 

various PUREX-type processes to recover plutonium. The British have employed HAN safely in 

the Thermal Oxide Reprocessing Plant (THORP) at Sellafield, where it is used in the main 

plutonium feed to the plutonium purification cycle and two scrub feeds to remove traces of 

plutonium from the uranium purification cycle. HAN was also used safely for over 10 years in 

counter-current flowsheet trials during process development for THORP (DOE, 1998). The 

French reprocessing plant at La Hague has used HAN for reductive stripping of plutonium for 

many years. The chemical is received at 1.9 M and subsequently diluted and mixed with nitric 

acid and hydrazine for use in the process (DOE, 1998). 

Accidents Involving HAN 

Numerous incidents involving uncontrolled HAN reactions have occurred at DOE’s Hanford and 

Savannah River sites. For example, at the Hanford Site, an explosion occurred at the 

Plutonium Reclamation Facility (PRF) on May 14, 1997. A dilute solution of HAN and nitric acid 

was created in a 400-gallon stainless steel tank, in preparation for restart of the facility in 1993. 

However, the restart of the facility was cancelled in December of that year, and the tank was not 

subsequently drained. Over the following 4 years, the contents of the vented tank concentrated 

by a factor of approximately 25 as a result of evaporation (DOE, 1998). The higher 

concentration solution, the effect of iron (Fe) from the metal surfaces of the tank, and an 

increased ambient room temperature contributed to an autocatalytic reaction that resulted in an 

explosion. The explosion destroyed the tank and the chemical makeup room where it was 

located. It breached the facility room and created a toxic chemical release. A fire system pipe 

was ruptured, flooding the PRF and spreading low levels of plutonium contamination to the 

ground outside the facility. No one was injured by the explosion, but some personnel were 

reported to be exposed to the toxic fumes (DOE, 1998). 

Also at Hanford, an exothermic chemical reaction involving HAN, nitric acid, and hydrazine 

occurred in a section of pipe containing 2BX solution at the PUREX plant on December 3, 1989. 

The overpressurization of the piping resulted in the failure of a flange gasket. There was also 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 53

an event at the PRF in the 1970s in which Tank A-109 overpressurized when strong nitric acid 

was added to the tank. It was possible that the tank contained a heel of HAN. 

At SRS, on December 28, 1996, high temperatures in a tank in F-Canyon containing a HANnitric acid solution caused an autocatalytic reaction resulting in the eructation of approximately 

250 gallons of solution (DOE, 1998). A similar eructation event occurred on 

September 26, 1972, when improper startup temperatures in an evaporator caused the 

overconcentration of approximately 6,000 pounds of HAN and nitric acid. 

Other HAN-related incidents prompted DOE to launch a study of the properties of solutions 

containing HAN and nitric acid. The study yielded a technical report entitled, “Technical Report 

on Hydroxylamine Nitrate,” which contains recommendations on the storage and use of HAN 

(DOE, 1998). 

This report (DOE, 1998) states that the margin of safety for the use of HAN is defined by the 

control of chemical concentration and ratio of each reactant, temperature, pressure, and 

presence of catalysts (e.g., iron and plutonium). The report’s recommendations include the 

following: 

• Incorporate conservative safety envelope limits into appropriate safety documents, 

standards, and procedures recognizing the uncertainties in available data. 

• Passivate the surfaces of HAN-nitric acid solution tanks and piping. 

• Store unused HAN in the original, sealed manufacturer’s shipping container. If only 

portions are used, avoid contamination of the material and reseal the container to 

preclude evaporation. 

• Control the chemical makeup and addition system by (1) defining mixing sequences and 

controls, (2) making up only the amount required, (3) eliminating direct addition of 

concentrated acid, (4) maintaining chemicals within specification, (5) controlling heating 

conditions to process specifications, (6) draining and flushing the system to a neutral pH 

and refilling with water for extended downtimes, (7) confirming that tanks assumed 

operationally empty contain no heel and then draining and flushing, and (8) disposing of 

unneeded chemicals. 

• Ensure an effective system pressure relief. 

• Establish and maintain surveillance programs to ensure that the necessary controls 

continue to be in place. 

• Train engineering and operating personnel on the potential hazards along with possible 

off-normal conditions and controls necessary to remain within safety limits. 

• Evaluate the use of alternate reductants. 

8.1.2.4.3.1 HAN Decomposition and Explosions (EXP04)

In the ISA Summary (MOX, 2009b), the applicant postulated a HAN explosion at the MFFF. 

This event is identified as EXP04. This explosion event is caused by an autocatalytic reaction 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 54

between HAN and nitric acid (HNO3) under certain conditions. The autocatalytic reaction can 

quickly produce an excessive amount of gases. If the vessel vents cannot accommodate the 

gas production, it can cause an overpressurization leading to the explosion. 

HAN is used in the AP process to reduce Pu+4 to Pu+3. The plutonium transfer from the organic 

phase to the aqueous phase results from this reduction in the plutonium valence. Additionally, 

HAN reacts with nitrous acid (HNO2) (nitrous acid is always present in HNO3 solutions), which is 

the key intermediate chemical to the initiation of the autocatalytic reaction. The following 

equations characterize the reactions of HAN: 

2NH3OH+

 + 2Pu+4 Æ 2Pu+3 + N2 (g) + 2H2O + 4H+ (8.1.2.4.3.1-1) 

NH3OH+

 + 2HNO3 Æ 3HNO2 + H+ + H2O (8.1.2.4.3.1-2) 

NH3OH+

 + HNO2 Æ N2O (g) + 2H2O + H+ (8.1.2.4.3.1-3) 

equation (8.1.2.4.3.1-1) is the Pu+4 reduction reaction with HAN. By multiplying 

equation (8.1.2.4.3.1-3) by 3 and adding the result to equation (8.1.2.4.3.1-2), the following 

overall autocatalytic reaction between HAN and HNO3 is obtained: 

4NH3OH+

 + 2HNO3 Æ 3N2O(g) + 4H+ + 7H2O (8.1.2.4.3.1-4) 

The applicant uses hydrazine (N2H4) as a defense-in-depth strategy to minimize the reaction 

between HAN and HNO2 (equation (8.1.2.4.3.1-3)), thereby, increasing the HAN available for 

plutonium reduction. Hydrazine can also reduce Pu+4 to Pu+3. The hydrazine concentration has 

to be limited (less than 0.14 M) because of other safety issues (see Section 8.1.2.4.3.2 of this 

SER for more details). 

The staff notes that energetic HAN-HNO3 reactions can occur under the right conditions, as 

evidenced by a DOE investigation of an accident at Hanford (DOE, 1998). As a result of this 

explosion, DOE investigated the situation and concluded that the HAN phenomena involved the 

interdependence between at least the following five parameters (NRC, 2005): 

1. chemical concentration of each reactant 

2. molar ratio of nitric acid to HAN [ ]

[ ] ⎟

⎠

⎞ ⎜

⎝

⎛

HAN

HNO3

3. temperature of the mixture 

4. concentration of metal ions (as catalysts) 

5. pressure of the system (appears to influence the severity of the reactions, but not the 

initial autocatalytic initiation) 

Safety Strategy

During the construction authorization request (CAR) stage, the applicant proposed a HAN safety 

strategy divided into two categories: (1) process vessels containing HAN and hydrazine nitrate 

without nitrous oxide addition and (2) process vessels containing HAN and hydrazine nitrate 

with nitrous oxide addition. Table 8.1.2.4.3.1-1 identifies the principal structures, systems, and 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 55

components (PSSCs) for the first category; Table 8.1.2.4.3.1-2 identifies those for the second 

category. 

Table 8.1.2.4.3.1-1 PSSCs for Process Units with HAN and without 

Nitrous Oxide Addition

PSSC Safety Function Controlled 

Parameter 

Design Basis 

Process 

Safety 

Control 

Subsystem 

Maintain temperature below 

safe limits 

Temperature < 50 °C (122 °F) 

Chemical 

Safety 

Controls 

Maintain maximum nitric acid concentration [HNO3] < 6 M 

Maintain minimum hydrazine concentration [N2H4] ≥ 0.1 M 

Maintain maximum HAN concentration [HAN] < 2.5 M 

Limiting residence time of nitric acid, HAN, 

hydrazine with nitric acid, and plutoniumbearing solution 

Time as low as reasonable 

(probably several 

months) 

Table 8.1.2.4.3.1-2 PSSCs for Process Units with HAN and Nitrous Oxide Addition

PSSC Safety Function Controlled 

Parameter 

Design Basis 

Off-Gas 

Treatment 

System 

Exhaust path for removal of off-gases, 

which provides a means for heat 

transfer/pressure relief for affected 

process vessels 

Heat transfer, 

pressure relief 

Revised CAR Table 11.8-2 

Chemical 

Safety 

Controls 

Limit nitric acid concentration [HNO3] Revised CAR Table 11.8-2 

Limit hydrazine concentration [N2H4] Revised CAR Table 11.8-2 

Limit HAN concentration [HAN] Revised CAR Table 11.8-2 

Limit hydrazoic acid concentration [HN3] Revised CAR Table 11.8-2 

However, a shift from the safety strategy established in the CAR stage was necessary for the 

following two reasons: 

(1) It is difficult to demonstrate the presence of a minimum concentration of hydrazine in the 

process (slow decrease because of radiation producing nitrous acid from nitric acid, 

potential process upset conditions leading to more nitrous acid to the extraction column, 

or loss of stripping solutions). 

(2) There is a small margin between the minimum hydrazine concentration (0.1 M for the 

HAN safety strategy) and the maximum hydrazine concentration (0.14 M for the 

hydrazoic acid safety strategy). 

Therefore, the applicant removed hydrazine from the HAN safety strategy, but it is used as a 

defense-in-depth strategy (as mentioned above) to prevent a HAN explosion event. 

The applicant has subsequently changed the HAN safety strategy to a low acid philosophy. 

According to the DOE report on HAN explosions (DOE, 1998), HAN-HNO3 solutions are more 

stable when the molar ratio of nitric acid to HAN is low (this can be achieved by either low nitric 

acid concentration or high HAN concentration) and when the temperature is low. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 56

The applicant’s general safety strategy is to minimize the threat of HAN explosions by 

monitoring and controlling the parameters that affect HAN reactivity (i.e., HAN concentration, 

nitric acid concentration, plutonium concentration, and temperature) within limits that permit 

applicable vessels within the system to safely vent any gases produced by HAN reactions to 

prevent overpressurizations (EXP-04a). In cases in which solvent may be present, the 

applicant’s safety strategy includes the requirement to maintain process temperatures resulting 

from any exothermic HAN reactions below those established for the bounding event (solvent 

explosion (EXP-06)). When the controlling parameters cannot be assured because of the 

nature of the process (e.g., temperature or HNO3 concentration), HAN will be segregated from 

those parts of the system through the application of transfer protocols based on IROFS 

sampling. Alternatively, HAN destruction will be assured through the application of IROFS 

controls at the KPA recycling tank (EXP-04b). 

The applicant derived the technical bases for process conditions limits from the results of an 

updated kinetic model. This model was developed to determine the behavior of HAN-HNO3

solutions based on existing published kinetic data and rate reactions governing the respective 

reactions. The applicant developed a separate thermal model specifically to analyze the 

thermal response of the stripping column (KPA*PULS3000) to various process upsets that could 

lead to overtemperature conditions. The results of these two models serve as the applicant’s 

basis for establishing limits on the operational parameters that were identified to ensure that 

overpressurization events or explosions from autocatalytic HAN-nitric acid reactions are highly 

unlikely within the AP process. Table 8.1.2.4.3.1-3 lists the limits on the process conditions. 

The updated kinetic model includes the effects of dissolved iron and the reoxidation of Pu+3 in 

the process. These two effects increase the concentration of HNO2 in the process, which 

reduces the decomposition temperature of solutions containing HAN. The model also includes 

additional reaction mechanisms for the autocatalytic decomposition of HAN. Additionally, the 

applicant did not include in the model the reactions of hydrazine (N2H4) and hydrazoic acid 

(HN3) to determine the worst conditions. This is a conservative assumption. 

The applicant proposed the following safety strategies to prevent a HAN explosion in the AP 

process: 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 57

(1) controls applicable where HAN is present to control HAN reactions (EXP04a) 

(2) controls to prevent the introduction of HAN into certain equipment (EXP04b) 

The staff notes that both the Pu+4 reduction reaction with HAN and the reaction between HAN 

and HNO3 are exothermic. The heat released by these reactions can increase the solution 

temperature up to the point (LFL safety limit) of becoming a solvent explosion concern before 

becoming a HAN explosion issue. Therefore, the temperature limit in EXP04a is bounded by 

the solvent explosion event (EXP06). These reactions also produce off-gases that must be 

adequately vented to avoid an overpressurization explosion. 

Controlling HAN Reactions (EXP04a)

In this case, the applicant’s general safety strategy to minimize the threat of HAN explosions is 

to maintain the parameters that affect HAN reactivity (i.e., HAN concentration, nitric acid 

concentration, plutonium concentration, and temperature) within limits that permit the applicable 

vessels within the system to safely vent any ensuing off-gases resulting from HAN reactions to 

prevent overpressurizations. Where solvent may also be present, the applicant’s safety strategy 

includes a requirement to maintain resulting process temperatures ensuing from any exothermic 

HAN reactions below those established for the bounding event (i.e., solvent explosions). 

HAN reactions are controlled in the following equipment and vessels: 

Confining HAN in the Process (EXP04b)

When the controlling parameters cannot be assured out of operational necessity (such as nitric 

acid concentration or process temperature), HAN is either segregated from those parts of the 

system through the application of transfer protocols

Items Relied on for Safety
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 58

KPA Plutonium Stripping Column, KPA Uranium Scrubbing Column, Second KPA Diluent 

Washing Column, and KPA Slab Settler 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 59

 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 60

KPA Oxidation Column and Associated Bottom Tank, KPA Air Stripping Column and

Associated Bottom Tank, KPA Plutonium Reception Tank, and KCA Batch Constitution 

Tanks 

HAN remaining in the aqueous stream from the reduction of Pu (IV) to Pu (III) in the plutonium 

stripping column flows downstream to the oxidation column, where it is eliminated through 

reaction with NOx. 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 61

KPA Recycling Tank 

HAN that may have inadvertently reached the KPA uranium vessel (KPA*TK5300) is routed to 

the recycling tank (KPA*TK9500) for destruction by NOx 

 

 

KPA Plutonium Barrier Mixer-Settler

HAN is introduced to the plutonium barrier mixer-settler (KPA*MIXS4000) from a HAN reagent 

unit (RHN) tank. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 62

KPA Plutonium Rework Tank 

The KPA plutonium rework tank (KPA*TK8500) receives HAN-bearing solutions from draining 

vessels that contain HAN. Because of the number of vessels that drain into this tank, numerous 

combinations of chemical makeup could affect HAN safety. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 63

 

Experience at La Hague Facility

Discussions with the applicant during in-office reviews indicated that the French reprocessing 

plant at La Hague (the facility that serves as the basis for the MFFF AP flowsheet) has used 

HAN for reductive stripping of plutonium for many years without incident. In actuality, the facility 

uses both HAN and uranous (U (IV)) nitrate as reducing agents, depending upon the nature of 

the feed solutions and the separation desired. 

Use of U (IV) nitrate is desirable when uranium concentrations are high relative to the 

concentration of plutonium and high purity plutonium separation is not needed. For example, in 

spent fuel reprocessing at La Hague, the plutonium concentration 

is only about of the uranium concentration in the feed to 

the first extraction cycle. In this cycle, U (IV) nitrate is selected as the reductant because the 

plutonium will not be recovered at high purity until the second and third extraction cycles (known 

as the plutonium purification cycles). In those cycles, when most of the uranium has already 

been separated out and it is not desirable to add more uranium to the process, HAN is selected 

as the reductant. 

Reduction of Pu (IV) with U (IV) nitrate is fast at ambient temperatures. Reaction is possible in 

both the aqueous and organic phases, but the reduction is slower in the organic phase. Also, 

parasitic reoxidation of the U (IV) is possible in the organic phase. For proper partitioning, the 

ratio of U (IV) to plutonium must be greater than 3. Thus, excess reductant is usually required. 

This excess uranium must later be recovered. Therefore, the use of U (IV) as a reductant is 

undesirable if a high purity plutonium separation is the objective. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 64

On the other hand, reduction of Pu (IV) to Pu (III) by the use of HAN is desirable when a high 

purity separation of plutonium is the objective. The reduction does occur at ambient 

temperature, but the kinetics of the reaction are relatively slow. As a result, the temperature is 

usually increased. HAN is not extractable into the organic phase, and reduction by HAN will not 

occur in high acid concentrations. 

Excess HAN is also needed to achieve the plutonium reduction, but unlike U (IV) nitrate, the 

HAN does not have to subsequently be recovered, as it can easily be destroyed by NOx later in 

the process. HAN is also more stable, with respect to reoxidation, than U (IV). 

Table 8.1.2.4.3.1-4 summarizes the relative advantages and disadvantages to using U (IV) 

nitrate and HAN. 

Table 8.1.2.4.3.1-4 Relative Advantages and Disadvantages in the Use of U (IV) Nitrate 

and HAN in the Reduction of Pu (IV) to Pu (III) 

Advantage Disadvantage

U (IV) Nitrate Efficiency (fast reaction at ambient 

temperature) 

Increased uranium concentration. 

Uranium must subsequently be 

recovered, if high purity plutonium 

product is desired. 

HAN Excess reductant is easily destroyed 

and thus does not need to be 

recovered. HAN is also more stable 

with respect to parasitic reoxidation 

of the reductant. 

Low acid concentration must be 

maintained. 

The staff notes that, in both cases at the La Hague facility, hydrazine (in the form of hydrazine 

nitrate, N2H4•HNO3) is employed as a scavenger to prevent reoxidation of Pu (III) by nitrous acid 

(HNO2). 

Staff Evaluation and Findings

Based on the above discussion, the staff finds that HAN (with the associated use hydrazine) is 

an appropriate choice of reductant for use in the KPA stripping column (KPA*PULS3000) of the 

AP process in the MFFF. The objective of the stripping column is to separate plutonium from 

uranium into a relatively pure Pu (III) nitrate stream. The Pu (III) is subsequently reoxidized to 

Pu (IV) in the NOx column (KPA*CLMN6000), where the residual (excess) HAN and hydrazine 

are also destroyed. 

The NRC staff found that the applicant’s safety strategy for the use of HAN is consistent with 

DOE guidance document entitled “Technical Report on Hydroxylamine Nitrate” (DOE, 1998), 

practices employed at DOE facilities, and the practices employed at the La Hague facility in 

France. 

The staff evaluated the MOX Services safety strategy for the use of HAN at the MFFF and finds 

that the applicant has described the facility, equipment, and processes in sufficient detail to 

meet the requirements of 10 CFR 70.22 and 10 CFR 70.65, consistent with the acceptance 

criteria of NUREG-1718, Section 8.4.3. 

The credited IROFS discussed above provide a method to control the parameters that have an 

effect on HAN/nitric acid autocatalytic reactions. The applicant has also committed to have fail-
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 65

safe and redundant active engineered IROFS (e.g., temperature controllers and isolation 

valves) and use them in combination with passive engineered IROFS (e.g., slab settler, flow 

restricting orifices, and process vessels and pipes) and administrative IROFS (i.e., process and 

reagent sampling). 

The NRC staff finds that this is an acceptable approach for complying with the single-failure 

criterion. The single-failure criterion, in combination with experience from DOE facilities, the 

La Hague facility, management measures (as described in Chapter 15 of the LA), quality 

assurance requirements (as described in the MPQAP), and the use of codes and standards for 

engineered IROFS give the NRC staff reasonable assurance that this high consequence event 

is highly unlikely. Therefore, the proposed safety strategy and IROFS comply with the 

performance requirements of 10 CFR 70.61. 

The applicant uses features to reduce the challenge to IROFS, where practical. 

he NRC staff finds that these features comply with the defense-in-depth 

requirements of 10 CFR 70.64(b). 

The staff also finds reasonable assurance that the applicant has identified the hazards and 

accident sequences associated with the use of HAN and has credited IROFS sufficient to meet 

the performance requirements of 10 CFR 70.61, consistent with the acceptance criteria of 

NUREG-1718, Sections 7.4 and 8.4. 

8.1.2.4.3.2 Hydrazine and Hydrazoic Acid Explosions (EXP10)

Event Description

Hydrazoic acid (HN3) is formed in the AP process when hydrazine (N2H4) is oxidized by nitrous 

acid (HNO2) according to the following equation: 

N2H5

+

 + HNO2 Æ HN3 + 2 H2O + H+ (8.1.2.4.3.2-1) 

Nitrous acid is always present in nitric acid (HNO3) solutions. Hydrazine is used in the AP 

process to protect HAN from reacting with nitrous acid. The use of hydrazine reduces the 

potential for a runaway exothermic reaction of HAN with plutonium solutions in nitric acid. 

When hydrazoic acid is formed it partitions mostly to the organic phase with a smaller amount 

going to the aqueous phase. The hydrazoic acid in the aqueous phase reaches a chemical 

equilibrium typical of a weak acid. Undissociated hydrazoic acid vapor can evolve from either 

the organic or aqueous phase according to Henry’s law. 

The hydrazoic acid in the organic phase is treated at the solvent recovery (KPB) unit in the 

solvent washing mixer-settler (KPB*MIXS1000) with sodium carbonate (Na2CO3) and sodium 

hydroxide (NaOH). The treatment removes the hydrazoic acid from the organic phase to the 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 66

aqueous (alkaline) phase as sodium azide (NaN3), according to equations (8.1.2.4.3.2-2) and 

(8.1.2.4.3.2-3). The sodium azide is eventually transferred to the high alpha waste (KWD) unit 

for final destruction of the azide ion (N3

-

). The destruction of azide ions is accomplished by 

adding an excess of sodium nitrite (NaNO2) at the KWD alkaline waste tank (KWD*TK4010) 

followed by acidification of the solution at the KWD neutralization tank (KWD*TK4015). Before 

the solution in KWD*TK4010 is transferred to KWD*TK4015, a process sample is taken to 

ensure that there is an excess of the nitrite ion (NO -

) relative to the azide ion. 

 Equations (8.1.2.4.3.2-4) and (8.1.2.4.3.2-5) show the formation of nitrous acid and the 

reformation of hydrazoic acid, respectively. Nitrous acid and hydrazoic acid react according to 

equation (8.1.2.4.3.2-6) to finally destroy the azide ion which liberates nitrous oxide (N2O) and 

nitrogen (N2) gases. 

2HN3 + Na2CO3 Æ 2NaN3 + H2CO3 (8.1.2.4.3.2-2) 

HN3 + NaOH Æ NaN3 + H2O (8.1.2.4.3.2-3) 

NaNO2 + HNO3 Æ HNO2 + NaNO3 (8.1.2.4.3.2-4) 

NaN3 + HNO3 Æ HN3 + NaNO3 (8.1.2.4.3.2-5) 

HNO2 + HN3 Æ N2O + N2 + H2O (8.1.2.4.3.2-6) 

Safety Strategy

The risk of a hydrazoic acid explosion comes from both the liquid and vapor phases. The 

hydrazoic acid in solution can be explosive if it is excessively concentrated or heated. In 

addition metal azides can be formed if the process solutions containing hydrazoic acid are 

mixed with solutions containing dissolved metals (e.g., aqueous raffinates solutions). Metal 

azides are shock-sensitive explosives if they precipitate and dry out. The applicant treated the 

metal azide explosion as a separate event; see Section 8.1.2.4.3.3 of this SER for the 

description and evaluation of the metal azide explosion event. 

The applicant’s safety strategy to prevent an explosion event related to HN3 comprises the 

following six elements: 

(1) Limit the amount of hydrazoic acid that can form. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 67

(2) Confine the hydrazoic acid in the process by sampling. 

(3) Confine the hydrazoic acid in the process by density controls. 

(4) Limit the process temperature in order not to exceed the explosive partial pressure of 

hydrazoic acid, which corresponds to a temperature of approximately 55 degrees C. 

(5) Ensure hydrazoic acid destruction with NOx gases at the KPA recycling tank 

(KPA*TK9500) and adequate ventilation of this vessel. 

(6) Ensure that azides in alkaline solution do not come into contact with concentrated nitric 

acid. 

Items Relied on for Safety

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 68

Staff Evaluation and Findings

The NRC staff reviewed previous operating experience used to prevent a hydrazoic acid 

explosion in nuclear facilities at DOE (WSRC, 2001). The NRC staff found that the applicant’s 

safety strategy is consistent with the practices used at DOE facilities. DOE, as well as the 

applicant, controls the maximum hydrazine concentration around the same value (0.14 M) to 

limit the amount of hydrazoic acid produced. This ensures that the hydrazoic acid explosive 

concentrations in the liquid phase (approximately 8.4 M) and vapor phase (partial pressure 

approximately 65 torr) are not exceeded. 

For the IROFS that are AEC, the applicant proposed to use a redundant set of the particular 

IROFS. The AEC IROFS are the active portions of the reagent and process sampling controls, 

density controls, process temperature controls, process flow control which ensures the minimum 

NOx flow to KPA*TK9500, the active portion of the process vessel off-gas venting, and processlevel controls. In some cases, the applicant also uses a diverse set of IROFS. 

 The process flow control is a combination of AEC and PEC. The AEC portion of 

the process flow control ensures that the minimum NOx flow exists. If the flow decreases below 

the minimum, it automatically isolates the flow of solutions potentially containing hydrazoic acid 

to KPA*TK9500. The PEC portion of the process flow control uses restricting orifices to ensure 

the maximum flow of solutions potentially containing hydrazoic acid that can be safely treated 

with the NOx flow in KPA*TK9500. In addition, before initiating the NOx flow an administrative 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 69

 

The NRC staff finds that the redundancy and fail-safe condition of the AEC IROFS, the diversity 

of IROFS, the dual sampling and additional activities of the EAC IROFS, and the use of PEC 

IROFS are adequate to comply with the single-failure criterion. In addition, the use of 

management measures (as described in Chapter 15 of the LA) and quality assurance 

requirements (as described in the MPQAP), the use of codes and standards for AEC and PEC 

IROFS, and the consistency of the safety strategy with previous operating experience at DOE 

facilities provide the NRC staff reasonable assurance that this high consequence accident 

scenario is highly unlikely. Therefore, the proposed safety strategy and the credited IROFS 

comply with the performance requirements of 10 CFR 70.61. 

Additionally, the applicant proposed to use features to reduce the challenge to IROFS, where 

practical. For this particular event, these features include 

 The use of these features satisfy the defense-in-depth 

requirements in 10 CFR 70.64(b). 

8.1.2.4.3.3 Hydrazine and Metal Azides Explosions (EXP11)

Event Description
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 70

Metal azides are formed in the AP process when hydrazoic acid (HN3) comes into contact with 

certain metals in nitric acid solution. If metal azides precipitate and dry in a tank or drip tray, 

they may become unstable and explosive. Metals exist in the system as impurities or as part of 

the process. The general reaction for the formation of a metal azide is given by 

equation (8.1.2.4.3.3-1): 

HN3 + [metal+

] Æ [metal]N3 + H+ (8.1.2.4.3.3-1) 

The majority of the metal impurities come from the feed. Most of them do not affect azide 

precipitation because they either do not form insoluble metal azide precipitates (i.e., their ability 

to complex the azide ion is not significant) or their concentrations are low. 

The metals that can complex the azide ion and exist as part of the process are sodium (Na) and 

silver (Ag). Sodium is introduced at KPB*MIXS1000, as sodium carbonate and sodium 

hydroxide, to remove the hydrazoic acid from the solvent. Equations (8.1.2.4.3.2-2) and 

(8.1.2.4.3.2-3) of the previous section of this SER show the removal of hydrazoic acid from the 

solvent into the alkaline (aqueous) solution as sodium azide. Sodium azide solubility increases 

as pH increases. Therefore, sodium azide will remain in solution in an alkaline medium until 

sent to the KWD unit for final destruction. Silver is added to the dissolution (KDB), and 

dechlorination and dissolution (KDD) units as silver nitrate (AgNO3), and it is used to generate 

silver (II) (Ag+2) ions by electrolysis. Silver (II) ions catalyze the dissolution of plutonium oxide 

(PuO ) in nitric acid solution. 

Safety Strategy

The applicant postulated metal azide explosions in the AP process because of the presence of 

hydrazoic acid and metals. The applicant’s safety strategy for the prevention of an explosion 

related to a metal azide is to limit the formation and potential precipitation of metal azides or 

promote downstream destruction of hydrazoic acid. Azide explosions could cause a release of 

radioactive material 

Items Relied on for Safety

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 71

 

Staff Evaluation and Findings

The applicant proposed to use a diverse set of IROFS to prevent explosions related to the 

formation and precipitation of metal azides. Examples of this diversity include 

 The strategy for the leaked solution is 

described above, Section 8.1.2.4.3.2 of this SER describes the strategy for the destruction of 

hydrazoic acid. In addition, all of the AEC IROFS are designed to be redundant and to fail safe, 

and the AP process vessels and pipes (a PEC) are qualified to withstand an earthquake. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 72

The NRC staff finds that this is an acceptable approach for complying with the single-failure 

criterion. The single-failure criterion, in combination with management measures (as described 

in Chapter 15 of the LA), quality assurance requirements (described in the MPQAP), and the 

use of codes and standards for engineered IROFS give the NRC staff reasonable assurance 

that these high consequence scenarios are highly unlikely. Therefore, the proposed safety 

strategy and IROFS comply with the performance requirements of 10 CFR 70.61. 

The applicant also uses features to reduce the challenge to IROFS, where practical. 

 The NRC staff finds that these features comply with the defense-in-depth 

requirements of 10 CFR 70.64(b). 

Furthermore, in the highly unlikely event that a metal azide explosion occurs, the applicant has 

the following features available: 

8.1.2.4.4 Hydrogen Peroxide Explosions (EXP05) 

Hydrogen peroxide (H2

O2) is used in the AP process for plutonium and silver reduction in the 

dissolution (KDB) and dechlorination/dissolution (KDD) units, introducing the possibility of H2O2

explosion events. The applicant determined that the following H2O2 explosion events are 

possible in the KDB and KDD units because H2O2 may be present with substrates that can be 

oxidized or reduced (including electrochemical reactions in the electrolyzer). Explosions related 

to H2

O2 could cause a release of radioactive material: 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 73

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 74

 

The NRC staff finds that these features comply with the defense-in-depth requirements of 

10 CFR 70.64(b). The staff also finds that the applicant has described the facility, equipment, 

and processes in sufficient detail to meet the requirements of 10 CFR 70.22 and 10 CFR 70.65, 

consistent with the acceptance criteria of NUREG-1718, Section 8.4.3. The staff evaluation 

concludes that the applicant’s proposal to use multiple independent administrative and 

engineered controls to prevent the above-mentioned events is acceptable. 

The staff finds reasonable assurance that the applicant has identified the hazards and accident 

sequences associated with hydrogen peroxide explosions and credited IROFS sufficient to meet 

the performance requirements of 10 CFR 70.61, consistent with the acceptance criteria of 

NUREG-1718, Section 8.4. 

8.1.2.4.5 TBP-Nitrate (Red Oil) Explosions (EXP07) 

Event Description

The acid catalyzed hydrolysis of TBP and subsequent oxidations of byproducts introduce the 

risk of thermal “runaway reactions,” leading to an overpressurization event that could cause a 

release of radioactive material with consequences for the facility worker, site worker, and IOC, 

as well as environmental release. 

 

The risk of red oil events affects the following processing units in the MFFF (red oil events in 

any of these units in the MFFF could cause a release of radioactive material): 

• KPA—purification cycle 

• KPB—solvent recovery 

• KPC—nitric acid recovery 

• KCA—oxalic precipitation, filtration, and oxidation 

• KCD—oxalic mother liquor recovery 

• KWD—stripped uranium 

• KWS—waste solvent 

• LGF—laboratory liquid waste receipt 

Energetic red oil reactions can involve TBP, HNO3, Pu–nitrate–TBP adducts, and TBP 

degradation products from chemical reactions and radiolysis. The organic phase in red oil 

reactions can have varying compositions of the aforementioned species; but, at a minimum, 

TBP and HNO3, must be present before a red oil reaction can occur. 

TBP degradation reactions may proceed by the following three mechanisms: 

(1) Acid Catalyzed Hydrolysis: TBP hydrolyzes to form dibutyl phosphoric acid and 

monobutyl phosphoric acid, and ultimately phosphoric acid. Butanol, which is volatile 

and flammable, is produced as a byproduct in these reactions. 

(2) Dealkylation: TBP undergoes dealkylation with nitric acid to butyl nitrate and dibutyl 

phosphoric acid. 

(3) Pyrolysis: At high temperatures, TBP can undergo pyrolysis to butene, which is volatile 

and flammable. Butene generation begins with water at approximately 160 degrees C 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 75

and continues up to approximately 260 degrees C, where the last few percent 

decompose rapidly to butane. This rapid decomposition is not well understood. 

A number of byproduct reactions can also occur. The degree of byproduct oxidation is a 

function of temperature, acidity, and organic phase metal ion concentration. Studies have 

identified almost 100 degradation products (out of more than 150 possible), including 17 nitrated 

solvents. 

 

8.1.2.4.5.1 Applicant’s Proposed Approach for Red Oil

Safety Strategy

The applicant’s safety strategy for TBP-nitrate (red oil) explosions involves the application of 

IROFS to meet the performance criteria of 10 CFR 70.61. Red oil explosions are postulated in 

the AP because of the possible commingling of TBP and nitric acid. The applicant will employ 

one of the following three strategies, depending upon the location and operation associated with 

the equipment and vessels concerned: 

• heat transfer strategy 

• evaporative cooling strategy 

• TBP prevention strategy 

Items Relied on for Safety

Tables 8.1.2.4.5-1 and 8.1.2.4.5-2 (BNL, 2009b) summarize the applicant’s engineered and 

administrative IROFS controls for this event. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 76
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 77

The applicant maintains that the current strategy for preventing red oil explosions in the MFFF is 

consistent with the Defense Nuclear Facilities Safety Board (DNFSB) recommendations stated 

in “Control of Red Oil Explosions in Defense Nuclear Facilities” (DNFSB/TECH-33) (DNFSB, 

2003). The DNFSB document lists the following simultaneous conditions as being necessary 

for a red oil runaway reaction to occur: 

• presence of TBP in the organic phase 

• organic phase in contact with nitric acid greater than 10 M (with diluent present) or 

14.5 M (with no diluent present) 

• solution temperature greater than 130 degrees C 

• insufficient venting area 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 78

It should also be noted that, even with sufficient venting, detonation of gases can occur if other 

control conditions are exceeded. In addition, the presence of diluent or metal ions can 

exacerbate runaway reactions. 

The DNFSB report recommends the following controls, to be used in combination, to prevent a 

red oil runaway reaction: 

• Temperature Control—Maintain temperatures at less than 130 degrees C. 

• Pressure Control—Provide sufficient venting to limit pressure excursions. 

• Mass Control—Remove organics from the process (i.e., prevention). 

• Concentration—Maintain nitric acid concentration to at or below 10 M. 

The applicant’s red oil strategy implements the recommended controls as follows: 

(1) Temperature Control—Maintain temperatures at less than 130 degrees C. 

• The only AP equipment that operates near or above this temperature is 

• A prevention strategy will be employed in 

to augment the temperature controls. In 

temperature control will be maintained by evaporative cooling. 

• Additional temperature controls consist of 

 as well as normal process temperature 

controllers. 

• Other equipment capable of heating solutions containing organic phase 

and normal process temperature controllers. 

(2) Pressure Control—Provide sufficient venting to limit pressure excursions. 

• For the AP process, all vessels are vented. Vents are sized to satisfy the Fauske 

relationship for credible quantities of organic material. Additional IROFS limit 

organic materials to credible quantities. 

• There are no valves in individual vent lines. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 79

(3) Mass Control—Remove organics from the process (i.e., prevention). 

(4) Concentration—Maintain nitric acid concentration at or below 10 M. 

Additional controls include agitation of vessels and supply of “scavenging air.” Also, controls 

are placed on chemical properties of the diluent (e.g., avoid cyclic hydrocarbons in diluent). 

The applicant calculated vent sizes by taking into account all incoming gaseous flows, all 

outgoing gaseous and vapor flows, and gas-producing chemical reactions that could occur 

within the vessel. For vessels employing the red oil heat transfer strategy, where controlled 

conditions significantly limit the heat generated from red-oil-related reactions, this entails venting 

off-gases from TBP-nitric acid and related reactions to prevent overpressurization, as well as 

venting of normal flows from air lifts and other sources. Heat removal via venting is not credited 

for red oil safety of vessels that fall under the heat transfer strategy. The same reaction rates 

that were used for quantifying the heat generated from TBP-nitric acid reactions were also 

applied to develop off-gas rates. These rates are based on the applicant’s experimental data. 

Vents that are intended to provide overpressure protection against red oil events for vessels 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 80

employing the evaporative cooling strategy 

were sized in 

accordance with a correlation between TBP mass and vent size developed by Fauske (Fauske, 

1994). 

In the heat transfer case, the applicant calculated the required vent size by applying a large 

safety factor (greater than a factor of 10) to the off-gas generation rate and including all credible, 

concurrent flows postulated for each vessel. This value was then rounded to the next highest 

standard pipe size and compared to the actual vent size for each vessel. In all cases, the 

existing vent size was at least as large as the required vent size; in most cases, it was at least 

one standard pipe size larger. In the evaporative cooling case, a required vent size was 

calculated (and rounded to the next highest standard pipe size) based on all credible, 

concurrent flows postulated for each vessel minus the requirement for red oil venting. This 

value was then compared to the actual vent size for each vessel, with the excess available 

venting area equated to a mass of TBP that could be safely vented according to the 

aforementioned correlation. In all cases, the existing vent size was adequate for more than the 

maximum credible amount of TBP postulated in each evaporative cooling vessel. In all but one 

case, the vent size was adequate for more than twice the maximum credible amount of TBP. 

The applicant indicated that vent piping is designed to maintain a 5-percent slope and can be 

washed with decontamination fluid. Vent piping will be frequently used, and the applicant 

committed to continuously monitor for flow-related parameters associated with the KWG unit to 

ensure that it is reliable and unlikely to clog. 

The applicant indicated that the process vessel venting control, including the KWG unit, is 

designed to be available 100 percent of the time. To have the required availability, the KWG 

unit design includes three fans. Each fan is designed to exhaust the maximum flow rate. Two 

filters in parallel are implemented. In addition, a bypass completes the KWG exhaust system. 

The applicant stated that the design and technology associated with process vessel venting are 

known to be reliable because they are based on existing proven technologies used for 

numerous years in the La Hague and MELOX facilities. The La Hague and MELOX facilities 

implement the systems with modifications regularly deduced from operating experience. The 

present MFFF design incorporates these modifications. 

The MFFF uses design features and management measures that protect against plugging of 

vent piping and equipment systems. Demisters are designed to be cleaned online and are 

washable. Process equipment is designed to be washed with decontamination fluid at frequent 

intervals or during annual outages, as determined by experience with the La Hague and MELOX 

facilities. 

The applicant expects radiolytic degradation within the AP process to be limited because the 

thermal power of the plutonium to be processed is expected to be relatively low 

and the residence time of organic materials in contact with the plutonium will 

also be limited. 

The applicant described the following three potential mechanisms for transfer of TBP to the 

KCD and KPC units (MOX, 2005): 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 81

 

 The applicant has 

committed to test and optimize the pulsed columns after construction of the MFFF. In these 

tests, the retention rate, which accounts for diluent washing efficiency, will be measured as a 

function of pulse pressure and frequency. These parameters will subsequently be optimized. 

8.1.2.4.5.2 NRC Review of Red Oil

The staff has reviewed the proposed use of evaporators at the MFFF. Contact between TBP 

with aqueous solutions of nitric acid and acidic solutions of metal nitrates is intrinsic to the 

PUREX and similar solvent extraction processes. Evaporator treatment of PUREX streams has 

been performed safely since the 1950s. However, several events have occurred involving a 

range of conditions. 

Significant red oil explosions have occurred at the Hanford Site (United States) in 1953; the 

SRS (United States) in 1953 and 1975; Oak Ridge (United States) in 1959; the Uranium 

Trioxide Plant (Ontario, Canada) in 1980; and the former Soviet Union (Tomsk-7) in 1993 

(Thompson, 2000; IAEA, 1998). Other, less serious incidents have also occurred, such as an 

explosion at the Nuclear Fuel Complex in Hyderabad, India, on November 7, 2002. An 

evaporator used to concentrate a purified uranyl nitrate stream before precipitation experienced 

a red-oil-type explosion that blew the top off of the evaporator vessel. 

The staff notes from its review that these events occurred because of the unanticipated 

presence (either carryover or accumulation) of the TBP, solvent, and degradation products. 

8.1.2.4.5.3 NRC Review of Controls, Limits, and Safety Design Bases Proposed in the 

Literature

Experiences at DOE and Related Facilities and DNFSB Recommendations

In 2003, the DNFSB issued a report (DNFSB/TECH-33), which assessed the potential for a red 

oil explosion in the DOE defense nuclear facilities complex (the complex) for the year 2003. In 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 82

that report, red oil is defined as a substance of varying composition formed when an organic 

solution, typically TBP and its diluent, comes in contact with concentrated nitric acid at a 

temperature above 120 degrees C. Red oil is relatively stable below 130 degrees C, but it can 

decompose explosively when its temperature is raised above 130 degrees C. 

The report describes three red oil events. Two have occurred in the United States—at the 

Hanford Site in 1953 and at SRS in 1953 and 1975. The report also describes a third red oil 

explosion, which occurred in 1993 at the Tomsk-7 site at Seversk, Russia. 

The report states that generic types of equipment capable of producing red oil in the complex 

are categorized as evaporators, acid concentrators, and denitrators. The chemicals necessary 

to produce red oil are, at a minimum, TBP and nitric acid; other, contributory chemicals can 

include diluent (kerosene-like liquid used to dilute TBP) or aqueous phase metal nitrates or 

both. 

The report generally categorizes controls for the prevention or mitigation of a red oil explosion 

as controls for temperature, pressure, mass, and concentration. The report states that 

maintaining a temperature of less than 130 degrees C is generally accepted as a means to 

prevent red oil explosions. 

The report also stated that sufficient venting serves to keep pressure from destroying the 

process vessel, while also providing the means for evaporative cooling to keep red oil from 

reaching the runaway temperature. 

The report described mass controls in the context of utilization of decanters or hydrocyclones to 

remove organics from feedstreams entering process equipment capable of producing red oil. In 

addition, limiting the total available TBP is considered another mass control that mitigates the 

consequence of a red oil explosion by limiting its maximum available explosive energy. 

Finally, the report stated that concentration control can be utilized to keep the nitric acid below 

10 M. 

A significant conclusion of this study is that none of the controls should be used alone; rather, 

they should be used together to provide effective defense in depth for prevention of a red oil 

explosion. 

Three facilities in the DOE complex (operating at the time the DNFSB report was issued) were 

identified as capable of producing a red oil explosion: H-Canyon at SRS, F-Canyon at SRS 

(F-Canyon is currently shut down), and Building 9212 at the Y-12 National Security Complex. 

These facilities contained the necessary process equipment and chemicals to form red oil and 

bring it to the runaway temperature. The MFFF was also identified as having the capability to 

produce red oil, but the report did not discuss this facility further, as it is to be regulated by the 

NRC. 

Major Red Oil Explosion Events

Several, well-documented, explosive incidents have occurred in the United States (SRS in 1953 

and 1975, Hanford Site in 1953). The Hanford and the first Savannah River (1953) event 

involved evaporators undergoing heating with low-pressure steam; temperature control was not 

precise but ranged from 135–140 degrees C. The second Savannah River incident (1975) 

involved a denitrator operating at a temperature higher than 150 degrees C. The pretreatment 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 83

step for the denitrator is an evaporator operated with controls and a design-basis temperature 

that does not exceed 135 degrees C. Thus, the TBP and solvent mixture safely traveled 

through the evaporator before the event in the denitrator. 

The incident at Tomsk did not involve heated equipment. The reactions started in a tank at a 

nominal temperature of 50 degrees C, with an organic layer estimated at 90 degrees C (IAEA, 

1998). Overpressure occurred in a tank containing uranium nitrate solution and caused gases 

to burst through the top of the tank, displacing the cover of the containment cell and leading to a 

forceful explosion. Release of radioactive materials to the local environment took place through 

the large holes in the side walls and roof of the room and through the side wall of the galley. 

There was also a release via a ventilation system through a 150-meter-high stack. The initial 

release of radioactive materials caused contamination near the building over an area of 1500 

m2

. The total beta/gamma activity of material released was said to be 1.5 terabecquerels (IAEA, 

1998). The cause of the accident was most likely a lack of the compressed air needed for 

thorough mixing of the solutions (IAEA, 1998). Compressed air was being used to mix the 

solutions; however, sensor measurements indicated that it was likely that none of this 

compressed air was introduced into the vessel. 

It is not clear whether the absence of compressed air was the result of operator error or plant 

failure, but investigators considered the former to be the more likely. However, it was apparent 

that, at the time the nitric acid was being introduced to adjust the acidity, there was not enough 

air to provide the necessary mixing of the solutions. Under these circumstances, the solutions 

could have settled out into different layers, allowing the oxidation and nitration of the organic 

layer by the nitric acid. It is likely that the reactions occurred with the more concentrated nitric 

acid solution in the upper layer. This assumption is supported to some degree by the lack of 

noticeable pressure rise until approximately 1.5 hours after the nitric acid solution had been 

introduced into the vessel. As the oxidation of organic substances by nitric acid is autocatalytic, 

the rate of gas release would have increased and, because the reaction is also exothermic, 

would have been accompanied by a rise in temperature. Eventually, a point was reached when 

the amount of gas generated was more than could be vented through the stack. Attempts were 

made to depressurize the vessel. These attempts were unsuccessful, and the pressure 

continued to rise until it reached about 5 atmosphere (atm). Within a few minutes, the pressure 

rose very rapidly to about 18 atm and the vessel ruptured. The resulting shock wave was 

sufficient to raise and displace the concrete cell covers, as well as cause damage to the 

equipment room above. Some of the organic material was released in the form of steam and 

small droplets, and some was probably oxidized to form gaseous products. A localized 

explosion of the resulting flammable cloud then occurred either as a result of a spark or 

because of the prevailing high temperature of about 450 degrees C (IAEA, 1998). 

An estimation of the amount of organic solution in the vessel and whether enough of it was 

available to produce a sufficient amount of gas to rupture the vessel proved difficult. 

Experimental data on two-phase systems utilizing the irradiated extractant, uranyl nitrate, in 

organic phase and nitric acid (concentration 10–12 M) in aqueous phase indicate that gas would 

have been released at the temperature prevailing in the vessel. However, without knowledge of 

the quantity of organic material present, no reliable predictions can be made of the resultant 

pressure rise. Calculations have shown that to generate the pressure of 18.0–20.0 atm needed 

to rupture the vessel, the oxidation of 35–40 liters of the organic phase by nitric acid would have 

been required had the vessel been closed, and 3–5 times this amount would have been 

required had the gas been vented (IAEA, 1998). 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 84

The staff notes from its review that these events occurred because of the unanticipated 

presence (either carryover or accumulation) of the TBP, solvent, or degradation products or 

some combination of these materials. The applicant indicated that solvent carryover can be 

considered as an anticipated event in the facility. 

According to the DNFSB report (2003), the following conditions are necessary for a runaway red 

oil reaction to occur: 

• the presence of TBP in organic phase 

• organic phase in contact with nitric acid greater than 10 M 

• solution temperature greater than 130 degrees C 

• insufficient venting area 

All of these conditions must exist simultaneously in order for a runaway red oil reaction to occur. 

Even with sufficient venting, detonation of gases can occur if other above conditions are 

exceeded. 

The DNFSB report (2003) also states that the following controls can be used to prevent a red oil 

event: 

• Temperature: Maintain at less than 130 degrees C. 

• Pressure: Provide a sufficient vent for the process to limit pressure excursions. 

• Mass: Remove organics from the process before reaching an evaporator, acid 

concentrator, or denitrator. 

• Concentration: Maintain nitric acid less than 10 N. 

Independent Review of Risk of a Red Oil Excursion by Brookhaven National Laboratory

The NRC staff tasked Brookhaven National Laboratory (BNL) with undertaking an independent 

analysis of issues related to the risk of a red oil event in the design proposed for the MFFF 

(BNL, 2009). This task was part of a larger program of providing technical assistance to NRC 

staff on risk-informed decisionmaking for fuel cycle facilities regulated by the NRC. The BNL 

study contained insights useful in staff reviews of the MFFF LA (MOX, 2009a). However, the 

BNL study was meant only to offer an independent perspective on risk. 

The BNL study (2009) developed a probabilistic risk assessment (PRA) model that evaluated 

the failure of some of the red oil event safety strategies resulting from internally initiated process 

deviations. In particular, the PRA model focused on (1) the failure of evaporative cooling in 

selected process vessels and (2) the failure of the TBP prevention strategy through events, 

such as emulsification and the formation of a third phase, or a rag layer, which would eventually 

result in a violation of the success criteria for evaporative cooling. BNL considered the PRA to 

be a limited-scope risk assessment for several reasons: 

• The analysis excluded generic risks associated with external hazards, such as seismic 

events, internal fires, or loss of offsite power events, including station blackout. These 

initiating events potentially could lead to other high consequence outcomes, similar to 

red oil explosions. Including these other initiating events would have greatly enlarged 

the scope of the study, which was limited to red oil explosions. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 85

• In analyzing the red oil reaction, the applicant’s characterization of the phenomenon was 

accepted broadly by focusing only on the thermal decomposition reactions. As noted 

above, the impact of radiolytic dissociation on this reaction was not considered because 

it was felt that radiolysis would have a minor impact in the MFFF because the 

concentrations and decay rates of the radionuclides involved are low. 

• The analysis did not consider failures of the heat transfer strategy. This strategy applies 

to the adequacy of passive heat transfer to the room environment from process vessels 

containing solutions at lower temperatures (about 55 degrees C and below); its success 

depends on the proper operation of room cooling (i.e., the facility’s HVAC system). 

However, including failures of the HVAC system would have greatly enlarged the scope 

of the analysis, which was limited to red oil explosions. 

• The semi-empirical model for the TBP-nitrate reactions developed by the applicant to set 

the success criteria for evaporative cooling safety was accepted as the basis to further 

evaluate the phenomenon. The applicant considered this model to be conservative 

because it is based on the heat generated in a pure TBP-nitric acid reaction, rather than 

on the 30% TBP-70% HPT mixture that the MFFF will use. 

The BNL study (2009) initially made a qualitative assessment of the factors that could contribute 

to a possible red oil explosion in the various process units comprising the AP process. There 

are eight process units in the AP process wherein organics and nitric acid could or may come 

into contact during normal operation. These units include the following: 

 Red 

oil explosions could occur in these eight units. The BNL study focused on units (1) through (5); 

the process conditions in these units place them at a higher risk of a red oil explosion as 

compared to units (6) through (8). The evaluation considered the likelihood of a red oil 

explosion for each of these five process units in terms of the equipment employed, the 

sequence of operations, and the conditions (e.g., temperature, pressure) during operations. 

BNL selected four vessels in two process units for more detailed evaluation based on the heat 

sources present, the heat balance, and the potential for TBP transfer, which could potentially 

violate any of the red oil explosion safety strategies outlined earlier. These vessels included: 

Quantitative evaluation was accomplished by delineating accident sequences, presented in the 

form of event trees and fault trees, to gain further insights into possible combinations of failures 

that could lead to a red oil explosion in the process vessels selected after the qualitative 

assessment. Quantification, using the SAPHIRE code, gave the point frequency of a red oil 

explosion and a 5th-percentile and 95th-percentile frequency to show the range of uncertainty. 

The red oil explosion scenario in the first-stage evaporator was modeled under two conditions of 

TBP accumulation: (1) normal accumulation of TBP (i.e., the accumulation of a small amount 

by mechanical entrainment with the aqueous phase) and (2) the upset accumulation of TBP, 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 86

resulting from a severe process malfunction, such as the formation of an emulsion that transfers 

large quantities of solvent. 

Under the first condition, a high solution temperature and failure of the evaporative cooling 

strategy is necessary for a red oil explosion to occur. The initiating event for this scenario is the 

increase in solution temperature that can lead to a red oil explosion should the evaporative 

cooling strategy fail. This initiating event may result from a loss of temperature control or a 

rupture of the heat exchanger tube. The following events in the event tree model the different 

ways in which the various success criteria for evaporative cooling (i.e., maintaining the required 

aqueous to TBP mass ratio and the TBP layer thickness) are violated. The first is the operator’s 

failure to flush the vessel at the end of 6 months, a period assumed conservatively to cause the 

unavailability of evaporative cooling for 6 months until the next scheduled flushing. The second 

can result from a number of failures of equipment needed to maintain control of the TBP level. 

The last event in the tree represents the success or failure of venting to ensure the maintenance 

of the solution’s temperature below a safe level. Venting is provided by a two-train system 

consisting of fans and HEPA filters with an additional standby fan. There are two red oil event 

(ROE) sequences for this scenario; in the first, the level control is successful but venting fails, 

while in the second, sufficient TBP accumulates to violate the criteria for evaporative cooling. 

The dominant contributor in the first sequence is common-cause failure of plugging of the two 

sets of HEPA filters. In the second sequence, the dominant contributor is human error, that is, 

the failure of the operator to carry out the vessel’s 6-monthly flush. 

Under the second condition, multiple failures of the barriers that prevent excessive TBP transfer 

must occur before the violation of the criteria for evaporative cooling. The transfer is assumed 

to begin with a severe process malfunction, such as the formation of an emulsion in the initial 

pulse extraction column in the KPA unit. Following this, the diluent washing pulse columns that 

remove the TBP also could fail to break up the organics entrained in the aqueous phase or in 

inducing a manual termination of TBP transfer. Very limited data formed the basis of assigning 

failure probabilities for these events. Further barriers to the transfer of organics are afforded by 

sampling controls that detect TBP and density controls that detect HPT. Failure of these 

controls was modeled using standard fault tree modeling. The initiating event for this scenario 

again is a loss of temperature control or rupture of a heat exchanger tube engendering a rise in 

solution temperature. The top events in the event trees relate to the success or failure of the 

various pulse columns in breaking up entrained organic material, followed by the success or 

failure of the sampling and density controls. Venting is not modeled, as the amount of TBP 

assumed to be transferred in the upset accumulation condition would violate the criteria for the 

success of evaporative cooling. Dominant contributors to the red oil explosion in this case 

include the ineffectiveness of density controls, common-cause failure of the density transmitter, 

failure of sampling analysis, failures in the diluent wash column, and malfunctions of the pulse 

extraction column. 

The BNL PRA model for a red oil explosion in the concentrates collection tank assumed the 

following: 

(1) Failure to provide cooling flow to the tank’s heat exchanger could heat up the tank and 

initiate evaporative cooling. (Failures of the HVAC system that could also do so were 

not modeled; it was assumed that the facility’s response to HVAC failure would be to 

shutdown the KPC unit). 

(2) Failure of spray mixing inside the tank could create hot spots eventually initiating 

evaporative cooling. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 87

(3) Should the amount of TBP in the tank increase from an inadvertent transfer, then loss of 

cooling or mixing would lead to a red oil explosion because the criteria for evaporative 

cooling would be violated. 

The initiating event is the loss of cooling or mixing. The event related to the transfer of separate 

phase TBP was estimated using the approach developed earlier for the failure of the first-stage 

evaporator caused by the common pathways for transporting separate phase TBP to the 

process vessels in the acid recovery unit. Maintenance of level control addresses the operator’s 

actions needed to provide aqueous makeup to maintain the criteria for success of evaporative 

cooling on the appropriate branches under conditions (1) and (2) above. The last event in the 

tree represents the success or failure of venting to maintain the solution temperature at a safe 

level to prevent a red oil explosion. There are four red oil explosion sequences. Two involve 

the transfer of large amounts of TBP to the tank after malfunctions in the pulsed extraction 

columns and subsequent failures of the sampling and density controls. The sequences are very 

similar to the scenarios under upset accumulation in the first-stage evaporator, and the 

dominant contributors are similar. The dominant contributor in the venting failure sequence is 

common-cause failure of plugging of the HEPA filters. In the remaining sequence, it is the 

failure of the operator to recognize the level alarm and take proper action. 

The PRA model for red oil explosion in the evaporator in the oxalic mother liquor recovery 

(KCD) unit is based on assessing the various pathways by which organics are transferred to this 

vessel. Two scenarios with their respective event trees are modeled. In the first one, the 

initiating event is solvent transfer by mechanical entrainment; in the second one, the initiating 

event is a severe process malfunction leading to the transfer of a large amount of solvent. Both 

event trees consider the following events in sequence: the success of the wash column in 

breaking up and separating the entrained organics, the slab settler’s effectiveness in preventing 

the transfer of any separate phase organics in excess of their solubility limit, and sampling for 

organics in the KCA batch constitution tanks. The second scenario has another top event—

sampling in drip trays—in which samples of leakage are analyzed for their organic content 

before transfer to the KCD unit. Slab settler failures involve failures of the density controls, 

which were modeled by fault trees; operational failures that were taken from a supporting 

document on the slab settler’s operation; density monitor failures, which were analyzed by fault 

trees; and loss of the integrity of the settler’s baffle, estimated from data on corrosion rate. The 

other top events, except failures in the wash column, were modeled by fault tree methods. 

Three red oil explosion sequences resulted; in all, the dominant contributors included 

operational failures of the slab settler, failure of the diluent wash column, and failure of the air lift 

to stop the transfer of process solution to the KCD unit. 

The results of the quantitative assessments showed that the point estimate frequencies of a red 

oil explosion in various process units are low. These low values reflect the robustness and 

defense-in-depth character of the multiple strategies employed in the facility to avert them. 

However, the quantitative estimates must be considered preliminary, as only a limited-scope 

PRA was carried out for the several reasons discussed earlier. 

Overall, however, the BNL study (2009) found that the design proposed for the MFFF appears 

to have incorporated the lessons learned from previous red oil events by including multiple 

safety strategies in different temperature regimes to deal with the risk of red oil explosions. 

Each strategy is implemented through a set of IROFS. The IROFS consist of a combination of 

active engineered systems or controls, PECs, EACs (human action combined with a physical 

device that serves as an alarm to alert the operator), and administrative controls (required or 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 88

prohibited operator actions). Each process or system also encompasses items and features of 

defense in depth. The application of industry codes and standards instills confidence in the 

reliability of the equipment selected as IROFS, along with the project’s quality assurance 

program, which will be implemented in compliance with the requirements of Appendix B, 

“Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants,” to 

10 CFR Part 50, “Domestic Licensing of Production and Utilization Facilities.” Within the 

qualitative definitions of event likelihood set out in 10 CFR Part 70 and NUREG-1718 (NRC, 

2000), a red oil explosion can be considered to be highly unlikely at the proposed MFFF. 

Experience at French Facilities

The modified PUREX process that will be employed at the MFFF is based on the processes 

used at spent fuel reprocessing facilities in France, particularly those currently in operation at 

the spent fuel reprocessing facility at La Hague. The French have extensive experience in 

studying the risks associated with red oil explosions. In a review of the safety analyses of spent 

fuel reprocessing facilities in France, the Institut de Radioprotection et de Surete Nucleaire 

(IRSN) (the French Nuclear Safety Institute) found that the risks of red oil explosions are mainly 

associated with evaporators in the following units (IRSN, 2008): 

• for intercycle concentration which concentrates reextraction solutions of uranium from 

the first extraction cycle,* before their transfer to the second uranium extraction cycle 

• for concentration of fission product solutions from the first extraction cycle 

• for recovery of tritiated and nontritiated acid where aqueous acid solutions of low and 

medium activity are concentrated 

• for treatment of oxalic mother liquors which concentrate mother liquors before recycling 

upstream of the phase of oxalic precipitation of plutonium 

• for treatment of organic effluents by distillation 

* The staff notes that the first extraction cycle at La Hague consists of the coextraction of 

uranium and plutonium, followed by sequential partitioning (stripping) of plutonium and 

then uranium, before the treatment of used solvent. This first cycle is, essentially, the 

entire solvent extraction portion of the AP process in the MFFF. 

As a result, the IRSN recognized the following conditions for the increased risk TBP-nitrate (red 

oil) reactions (IRSN, 2008): 

• a temperature higher than 135 degrees C in the evaporators 

• the presence of significant quantities of TBP (and its degradation products) in the 

aqueous phase to be concentrated 

 

The main safety measures that have been adopted at French reprocessing facilities, as 

sanctioned by the IRSN include the following (IRSN, 2008): 

• To limit the TBP content of aqueous solutions supplying the evaporators, the supply 

vessels of the units concerned are fitted with solvent-flushing devices to separate, by 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 89

decantation, any TBP drawn into these solutions. The various aqueous flows from the 

extraction cycles are washed with diluent in batteries of mixer-decanters or in a 

centrifugal extractor. Feedback from operation of the installations shows that these 

measures allow the TBP content in the aqueous phase to be limited to a maximum of a 

few dozen milligrams per liter. 

• Systematic monitoring is conducted to confirm the absence of significant quantities of 

TBP in the different flows arriving in the evaporators of the units referred to, especially 

for the few flows which are not subject to washing with diluent. 

• When aqueous solutions are transferred to the evaporators, the supply vessels are not 

completely emptied in order to avoid transferring any TBP which may be floating on top 

of the aqueous solutions. 

• Before being received in distillation treatment units, organic effluents are systematically 

treated with carbonate and soda and washed with water in the “solvent treatments” of 

the different extraction cycles, which ensures a relatively low nitrate content in these 

effluents (a maximum of a few dozen milligrams per liter). 

• To limit the temperature well below 135 degrees C in normal operation inside 

“thermosyphon” evaporators (evaporators in intercycle concentration units, acid recovery 

units, and oxalic mother liquor treatment units), the temperature of the coolant fluid is 

kept below that value (the temperatures of heating steam circulating in the boiler and the 

thermosyphon are around 130 degrees C and 110 degrees C, respectively), and the 

heating loop is fitted both with a pressure regulator with a high pressure warning and a 

temperature regulation device with a high temperature warning which, when reached, 

cuts off the units steam supply. This temperature threshold (generally set at between 

145 degrees C and 150 degrees C) allows a temperature below 135 degrees C to be 

guaranteed anywhere in the evaporator. Finally, the vaporiser is protected by two valves 

whose loading limits any pressure increase in the cooling circuit and consequently limits 

the steam temperature. 

For evaporators used in fission product concentration units (boiler type evaporators), the 

design of the cooling circuit in these units (double heating jacket) ensures that in normal 

operation the temperature throughout the liquid content remains below the temperature 

required to trigger the reaction. A complementary study confirmed, through simulation of 

the temperature of the internal wall of this type of equipment, that the maximum 

temperature reached at the bottom of the boiler remained well below 135 degrees C. 

Finally, for evaporators in organic effluent treatment units (liquid film evaporators), the 

cooling circuit is fitted with pressure and temperature regulators with high pressure and 

temperature warning devices. In addition, the operator is warned of any excessively 

high temperature of the “residue” in the evaporator. The solvent temperature is also 

monitored when it leaves the evaporator, with a high temperature warning. These 

measures guarantee that a temperature of 135 degrees C is not exceeded in these 

units. 

The IRSN assessed these safety measures, specifically in degraded situations, when the 

various French spent fuel reprocessing plants were commissioned. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 90

To date, after more than 20 years of operating experience, there have been no incidents related 

to TBP-nitrate (red oil) reactions in the French facilities. 

 

8.1.2.4.5.4 NRC Staff Findings and Conclusions on Red Oil

The NRC staff has considered the input from the independent review conducted by BNL 

personnel, as well as reviewing operating experience at DOE facilities and the La Hague facility 

in France, upon which the MFFF AP flowsheet is based. The staff finds that the applicant’s 

approach to render the occurrence of a red oil explosion event highly unlikely is consistent with 

the experience and guidance available in the literature. 

The applicant’s safety strategy for red oil, which is discussed in the following paragraphs, is 

consistent with recommendations set forth in DNFSB-TECH33 (DNFSB, 2003). 

The only AP process equipment operating near the temperature limit (greater than 

130 degrees C) includes the following: 

The safety strategy for is to prevent TBP from 

reaching them (DNFSB recommended control 3). This is implemented through IROFS sampling 

and through the use of an IROFS slab settler to separate organics from the process stream. 

The safety strategy for is to maintain a temperature less than 122 degrees C 

(DNFSB recommended control 1), provide adequate venting (DNFSB recommended control 2), 

and to limit the quantity of TBP that can enter the evaporator (DNFSB recommended control 3). 

KPC*EV2000 has IROFS temperature controls on the heating solution to protect against a red 

oil event, IROFS sampling controls upstream to limit the accumulation of TBP in the evaporator, 

and venting sized to prevent pressure buildup (in accordance with the TBP mass versus 

overpressure relationship developed by Fauske and Associates (FAI/94-68)). The nominal nitric 

acid concentration in the evaporator is maintained at 9.4 N (DNFSB recommended control 4), 

the nominal process solution temperature is maintained at 65 degrees C, and the evaporator is 

maintained below atmospheric pressure. 

For other equipment (e.g., heat exchangers) capable of heating a solution containing TBP, 

(DNFSB recommended control 1) are put into place to protect 

against a lower safety temperature threshold (solvent flammability) than that for red oil. The 

applicant has also performed an analysis of all vessels operating at or below 50 degrees C that 

may contain TBP to ensure that self-heating from chemical reactions is not credible. This 

analysis was done to address potential self-heating conditions that may have contributed to the 

red oil explosion at Tomsk-7 in 1993. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 91

All of the AP vessels that are postulated to contain TBP are vented (DNFSB recommended 

control 2) to protect against runaway red oil reactions. Two separate criteria are used. Vents 

on vessels in which the process solution temperatures may exceed 50 degrees C are sized to 

satisfy the Fauske relationship for credible quantities of organic that could be present. Vents on 

vessels in which the process solution temperatures do not exceed 50 degrees C are sized to 

prevent overpressurizations considering off-gassing from chemical reactions and other gaseous 

flows into the vessel. Valves are prohibited from individual vent lines to ensure that the 

ventilation paths are not impeded. 

 Lastly, any equipment with the potential to have pressure transients 

(e.g., evaporators) is equipped with pressure monitors and controllers. 

Relative to the nitric acid concentration limit (DNFSB recommended control 4), concentrated 

nitric acid (approximately 13.6 N) exists in only three areas. The first is in the nitric acid reagent 

unit, where neither TBP nor nuclear material is present. The second is in the acid recovery unit 

rectification column and concentrated acid distribution tanks, where TBP is prevented via 

IROFS sampling upstream. The third area is in the oxalic mother liquor recovery unit 

evaporator and concentrates tanks, where TBP is also prevented via IROFS sampling 

upstream. Normal acid concentrations in all other areas of the AP process are less than 10 N; 

and the use of concentrated nitric acid is limited to vessels that operate at temperatures less 

than 60 degrees C. 

The independent review performed by BNL personnel found that the design proposed for the 

MFFF appears to have incorporated the lessons learned from previous red oil events by 

including multiple safety strategies in different temperature regimes to deal with the risk of red 

oil explosions. Each strategy is implemented through a set of IROFS. The IROFS consist of a 

combination of active engineered systems or controls, PECs, EACs, and administrative controls. 

Each process or system also encompasses items and features of defense in depth. The 

application of industry codes and standards instills confidence in the reliability of the equipment 

selected as IROFS, along with the project’s quality assurance program that will be implemented 

in compliance with the requirements of Appendix B to 10 CFR Part 50. Within the qualitative 

definitions of event likelihood set out in 10 CFR Part 70 and NUREG-1718, a red oil explosion 

can be considered by the staff to be highly unlikely at the proposed MFFF. 

The staff also finds that the applicant’s safety strategy for the MFFF is consistent with 

recommendations and current practices documented by IRSN for operations at French 

reprocessing facilities and, in some cases, are more conservative. For example, the IRSN 

noted that risks of red oil explosions are mainly associated with evaporators in the following 

units (IRSN, 2008): 

• for intercycle concentration which concentrates reextraction solutions of uranium from 

the first extraction cycle before their transfer to the second uranium extraction cycle 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 92

• for concentration of fission product solutions from the first extraction cycle 

• for recovery of tritiated and nontritiated acid where aqueous acid solutions of low and 

medium activity are concentrated 

• for treatment of oxalic mother liquors which concentrate mother liquors before recycling 

upstream of the phase of oxalic precipitation of plutonium 

• for treatment of organic effluents by distillation 

The MFFF will employ only three of the five noted unit operations with which the risk of red oil 

explosions is associated. The MFFF flowsheet does not concentrate the plutonium product 

stream by evaporation as is done in reprocessing facilities such as La Hague and THORP in the 

United Kingdom (and as was done with the uranyl nitrate stream at the Hyderabad facility). 

There are no evaporation units in the MFFF flowsheet until after the plutonium product has been 

recovered by oxalate precipitation. Before oxalate precipitation, the plutonium product solution 

is subjected to

 If TBP or any of its degradation products were present in 

detectable amounts, it would be discovered in the sample before transfer to downstream 

equipment, and the transfer would not be allowed. 

Organic effluents (spent solvent) will not be treated by distillation at the MFFF. Solvent will be 

washed in the solvent recovery (KPB) unit. When the solvent has exceeded its useful life, it will 

be disposed of through the SRS, rather than recovered by distillation. 

Among the safety measures that have been adopted at French reprocessing facilities is to limit 

the TBP content of aqueous solutions supplying the evaporators. The supply vessels of the 

units are fitted with solvent-flushing devices to separate, by decantation, any TBP drawn into 

these solutions, and the various aqueous flows from the extraction cycles are washed with 

diluent. Diluent washing of aqueous streams to remove residual entrained solvent is performed 

in the purification unit (aqueous raffinates) and the KPB unit of the MFFF. In addition, the 

plutonium nitrate product stream passes through a slab settler before moving 

downstream to the oxidation columns. The slab settler’s function is to act as a decanter by 

which to remove any solvent that may remain entrained in the aqueous stream. Also, vessels 

subject to the evaporative cooling strategy (i.e., process vessels in the nitric acid recovery 

(KPC) and liquid waste (KWD) units) have IROFS administrative controls that require periodic 

flushing of accumulated solvent from the vessel. The vessels are to be flushed at intervals of 

6 months or 1 year, depending upon the size of the vessel. 

Another safety measure that has been adopted at French reprocessing facilities is to 

systematically monitor for significant quantities of TBP in the different flows arriving in the 

evaporators, especially for the few flows that are not subject to diluent. The MFFF red oil safety 

strategy employs

to ensure the absence of organics (TBP) before allowing transfers to 

vessels that operate at temperatures above the solvent safety-basis temperature limit. 

The French reprocessing facilities also limit the temperature below 135 degrees C in normal 

operation inside thermosyphon evaporators (evaporators in intercycle concentration units, acid 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 93

In addition, equipment with the potential for pressure transients (e.g., the KPC and KCD 

evaporators) is also equipped with normal pressure monitors and controllers. 

The NRC staff found that the applicant’s safety strategy for preventing potential runaway TBPnitric acid (red oil) reactions is consistent with DNFSB guidance documents (DNFSB, 2003), 

practices employed at DOE facilities, and practices employed at the La Hague facility in France. 

The staff finds that the applicant has described the facility, equipment, and processes in 

sufficient detail to meet the requirements of 10 CFR 70.22 and 10 CFR 70.65, consistent with 

the acceptance criteria of NUREG-1718, Section 8.4.3. 

The credited IROFS discussed above provide a diverse method to control each of the 

parameters that can contribute to red oil runaway reactions. The applicant has also committed 

to have fail-safe and redundant active engineered IROFS 

 and use them in combination with passive engineered 

IROFS and administrative IROFS ). 

The NRC staff finds that the applicant’s approach is acceptable for complying with the singlefailure criterion. The single-failure criterion, in combination with consistency with DNFSB 

recommendations, the application of experience from DOE facilities and the La Hague facility, 

management measures (as described in Chapter 15 of the LA), quality assurance requirements 

(as described in the MPQAP), and the use of codes and standards for engineered IROFS, give 

the NRC staff reasonable assurance that this high consequence event is highly unlikely. 

Therefore, the proposed safety strategy and IROFS comply with the performance requirements 

of 10 CFR 70.61. 

The applicant uses features to reduce the challenge to IROFS, where practical. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 94

 The NRC staff finds that these features comply with the 

defense-in-depth requirements of 10 CFR 70.64(b). 

The staff finds with reasonable assurance that the applicant has identified the hazards and 

accident sequences associated with TBP-nitric acid (red oil) reactions and credited IROFS 

sufficient to meet the performance requirements of 10 CFR 70.61, consistent with the 

acceptance criteria of NUREG-1718, Sections 7.4 and 8.4. 

 

8.1.2.4.6 Plutonium (VI) Oxalate Explosion (EXP12) 

Event Description

Plutonium can exist in several different valances in aqueous solutions. The most common 

valances are (III), (IV), and (VI). Pu (VI) is initially created in the dissolution (KDB) and 

dechlorination/dissolution (KDD) units, where it is reduced to Pu (IV), using hydrogen peroxide, 

before entering the purification (KPA) unit. If Pu (VI) is not fully reduced, it may enter the 

purification unit. Pu (VI) may also be introduced to the purification unit from the oxalic mother 

liquid recovery (KCD) unit. The KPA unit is designed to reduce any Pu (VI) to Pu (III) using 

HAN. However, if Pu (VI) is not adequately reduced in the purification unit, or if it is abnormally 

generated in the air stripping column, it may reach the precipitator of the oxalic precipitation, 

filtration, and oxidation (KCA) unit. If Pu (VI) reaches the KCA precipitator, it may be 

precipitated as Pu (VI) oxalate [i.e., PuO2C2O4•3H2O], which would then be introduced to the 

calcining furnace. The temperatures in the calcining furnace can reach up to 600 degrees C. 

Upon heating, Pu (VI) oxalate exhibits an endothermic peak around 142 degrees C because of 

dehydration (it is usually present as the trihydrate) and a subsequent rapid exothermic peak at 

approximately 219 degrees C associated with rapid decomposition of the oxalate. If a sufficient 

quantity of Pu (VI) oxalate is introduced to the calcining furnace, an explosion could occur. 

Safety Strategy

The applicant’s safety strategy for Pu (VI) oxalate explosions involves the application of IROFS 

to meet the performance criteria of 10 CFR 70.61. Pu (VI) oxalate explosions are postulated to 

occur in the KCA calcining furnace if Pu (VI) reaches the KCA unit where oxalic acid is present. 

Staff Evaluation and Findings
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 95

The NRC staff finds that the applicant has adequately evaluated the hazards with the potential 

to lead to this event and that the safety strategy of preventing transfer of process fluids 

containing greater than of Pu (VI) from the KCA batch constitution tanks to the 

precipitators to be acceptable. 

Section 11.2.1.3.12 of this SER discusses the staff evaluation of the process sampling control. 

Based on the determination of reliability and robustness of the identified IROFS sampling, the 

NRC staff finds that this approach is acceptable for complying with the single-failure criterion. 

The single-failure criterion, in combination with management measures (as described in Chapter 

15 of the LA), quality assurance requirements (described in the MPQAP), and the use of codes 

and standards for engineered IROFS give the NRC staff reasonable assurance that these high 

consequence scenarios are highly unlikely. Therefore, the proposed safety strategy and IROFS 

comply with the performance requirements of 10 CFR 70.61. 

8.1.2.5 Habitability Issues 

The purpose of this section is to review the criterion used by the applicant to ensure the 

habitability of the facility during routine operations and during an accident or event. 

In the CAR phase, while no specific required operator action had been identified, MOX Services 

assumed that there would be required operator actions to be performed in the emergency 

control room (ECR) in order to meet 10 CFR 70.61 performance requirements. Based on this 

assumption, the ECR would be required to maintain a habitable environment (i.e., protect the 

operator from radiological or chemical exposures or both). No PSSCs were identified to protect 

the worker from radiological exposure. In determining adequate protection for the workers, 

MOX Services proposed using TEEL-2 limits for protection during an event, while the NRC staff 

believes that TEEL-1 are the appropriate limits. The NRC staff position resulted in the following 

construction authorization condition (NRC, 2005): 

In addition to the safety functions and design bases specified in the revised CAR, 

the facility will be designed so that a safety function of the Emergency Control 

Room (ECR) Air Conditioning System will maintain hazardous chemical 

concentrations in each ECR below CAR Table 8-5 TEEL-1 limits for the duration 

of credible hazardous chemical release events. 

It was recognized that during the performance of the ISA, the applicant would do one of the 

following: 

• Provide acceptable justification that the TEEL-2 limits were appropriate for protection of 

the operators in the ECR from chemical exposure. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 96

• Identify IROFS that protect the operators to TEEL-1 limits. 

• Demonstrate that there are no required operator actions in the ECR to meet 

10 CFR 70.61 (which could only be validated when the ISA was complete). This would 

make the TEEL-1 or TEEL-2 issue moot. 

 

The safety function of the ECR HVAC (HVC) system is to provide cooling to the ECRs, 

emergency electrical rooms, emergency electronics rooms, and emergency battery rooms. The 

system provides these functions during normal and emergency conditions, including postulated 

natural phenomena and external radiological events, as well as leaks and spills of hazardous 

chemicals. The HVC system also provides ventilation to remove hydrogen from the emergency 

battery rooms. 

For releases on the MFFF site, the chemical consequences to outside receptors were bounded 

by calculating the consequences of the largest possible release of each hazardous chemical in 

inventory at the MFFF. Only accident sequences involving those chemicals that could 

potentially cause adverse health effects to the IOC, irreversible health effects to the site worker, 

or concentrations exceeding standards at outside air intakes were evaluated further. As a 

result, the only chemicals requiring further evaluation by the applicant were nitrogen tetroxide, 

hydrazine monohydrate, and uranium (MOX, 2009b). However, the applicant’s ISA did not 

identify any safety function to be performed in the ECR during a radiological or chemical event. 

Thus, the HVC system is not credited with providing a habitable environment. 

The ECR HVC system is equipped with two 100-percent capacity HEPA filter/hazardous gas 

removal filtration units: one for train A and one for train B. Each unit consists of a stainless 

steel housing, an inlet isolation damper, one stage of prefilter, one stage of HEPA filter, two 

stages of hazardous chemical adsorption filter media, a second stage of HEPA filter, and an 

outlet isolation damper. The HEPA filter media is a glass boron silicate microfiber and contains 

a waterproofing binder that increases strength under wet and dry conditions. The HEPA filters 

have a particulate removal efficiency of 99.97 percent for 0.3-micron particles. Injection ports 

are upstream and test ports downstream of the chemical adsorbers to test their removal 

efficiency. The filtration units are seismically qualified. 

The outside air intake for each HVC train is located on a different side of the shipping and 

receiving building (BSR) and is approximately 50 feet above the ground. Multiple sensors 

monitor each supply air inlet for habitability protection. 

Smoke detectors with alarms are also provided in the ductwork downstream from each air 

conditioning unit and inside the emergency battery and electrical rooms. When smoke is 

detected, a signal is sent to the ECR panel. Upon seeing the alarm, the operator can manually 

switch the HVC system to the filtration mode. 

Each emergency battery room is provided with a hydrogen sensor. If an excessive amount of 

hydrogen gas is detected in either battery room, this condition is annunciated in the control 

room and the operator takes appropriate action. 

The HVC system is operated in either an automatic or manual control mode. In the automatic 

mode, which is the normal mode of operation, the control logic is automatically implemented 

through hardwired connections between sensors and actuators. The HVC system does not use 

programmable logic controllers. The manual control mode is used at the operator’s discretion to 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 97

contend with emergencies and when maintenance operations are performed on the HVC 

system. 

When the HVC system is in the automatic control mode, both the train A and train B subsystems 

are in operation to maintain the temperature and positive pressure of their respective 

emergency designated rooms and are independent of other MFFF ventilation systems. This 

helps ensure the availability of the ECRs when the main control room is unavailable. The 

pressurizing fans are continuously run, maintaining a positive pressure differential in the ECRs. 

The pressurizing fans are operated at a fixed speed, and the room dampers are periodically 

manually adjusted to maintain the proper pressure differential. The emergency battery rooms 

are separately exhausted to prevent the buildup of potentially flammable concentrations of 

hydrogen gas. 

Under normal conditions, the airflow bypasses the HEPA filter/hazardous gas removal filtration 

units. The four air conditioning units load and unload as necessary to maintain the ECRs and 

the emergency electrical rooms at the desired temperature. When necessary, the duct-mounted 

electric heaters automatically cycle to maintain temperatures in these rooms at the desired 

setpoint. 

Each ECR air intake is continuously monitored for radiation, smoke, and hazardous chemicals. 

Upon detection of radiation, smoke, or a hazardous chemical above allowable limits in the 

intake air, the HVC system will automatically switch to the filtration mode. An alarm is 

transmitted to the ECR, the isolation damper in the outside air intake ductwork closes, the 

isolation damper in the corridor air supply ductwork opens, the pressurizing fan suction to the 

building corridor opens, and the flow is routed through the HEPA filter/hazardous gas removal 

filtration units. 

The applicant stated that the allowable limits in the intake air to the ECRs for radiation, smoke, 

and hazardous chemicals are as follows: 

• Radiation: Sampling for airborne radiation in the inlet to the HVC system is in 

accordance with American National Standards Institute (ANSI) 13.1-1999, “Guide to 

Sampling Airborne Radioactive Materials in Nuclear Facilities” and modified for 

permissible thresholds for air inlets and not exhausts. The allowable limit on intake is in 

accordance with Table 1 of Appendix B, “Annual Limits on Intake (ALIs) and Derived Air 

Concentrations (DACs) of Radionuclides for Occupational Exposure; Effluent 

Concentrations; Concentrations for Release to Sewerage,” to 10 CFR Part 20, 

“Standards for Protection against Radiation.” 

• Smoke: Standard duct smoke detector, NFPA 72 (National Fire Alarm and Signaling 

Code), duct size, airflow rate, background, smoke from wildfires, contaminants (e.g., 

dust). 

• Hazardous Chemicals (based on NIOSH, 2005): Hydrazine and dinitrogen tetroxide 

limits will be maintained below TEEL-2 concentrations, as shown in Table 8.3-4 of the 

LA (MOX, 2009a). For hydrazine monohydrate, this limit corresponds to 0.06 milligrams 

per cubic meter (mg/m3

); for dinitrogen tetroxide, the TEEL-2 limit is 15 mg/m3. It is 

noted that the TEEL values for hydrazine are based on ERPG concentrations. 

Staff Conclusions on Habitability
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 98

Upon completion of the ISA, the applicant did not identify a credible event that required operator 

actions in the ECR in order to meet 10 CFR 70.61 performance requirements. As a result, the 

applicant did not identify any IROFS function to maintain control room habitability for the ECR 

air conditioning system. Therefore, the HVC system is not credited with providing a habitable 

environment during a chemical release event. The staff finds that the applicant’s ISA result and 

subsequent conclusion that there are no credible events that require ECR operator action to 

meet the performance requirements of 10 CFR 70.61 and satisfy the intent of the construction 

authorization condition stated above. 

The staff reviewed the applicant’s assessment of ECR habitability and agrees that there is no 

identified accident sequence in which action of an ECR operator is a safety control to prevent or 

mitigate the consequences of that accident sequence. As a result, ECR habitability is not relied 

on for safety and thus does not need to be IROFS. 

8.1.2.6 Baseline Design Criteria

Chapters 8 and 11 of this SER discuss the design bases of the AP process associated with 

chemical processing. 

The applicant stated that the BDC, as described in 10 CFR 70.64, were applied from the outset 

of the MFFF design work and were primarily focused on physical design and facility features, 

with the intent to achieve a conservatively designed facility tolerant of both process upsets and 

human errors (Section 12.0 of the LA (MOX, 2009a)). The applicant stated that information 

demonstrating compliance with these criteria is provided in the applicable chapters of the LA 

(MOX, 2009a). 

To ensure that all event sequences with consequences exceeding the low consequence 

threshold of 10 CFR 70.61 meet the performance requirements identified in 10 CFR 70.61, the 

applicant applied the following qualitative design criteria and commitments to those events and 

the associated IROFS: 

• application of the single-failure criteria or double contingency (for nuclear criticality) 

• application of the provisions of 10 CFR Part 50, Appendix B, and NQA-1 

• application of industry codes and standards 

• management measures, including surveillance of IROFS (i.e., failure detection and 

repair, or process shutdown capability) 

For those credible events in which the single-failure criterion or double contingency are not 

applicable (i.e., sole IROFS or passive IROFS feature), IROFS features are identified and the 

commitments for IROFS listed above are applied. 

Chapter 8 of NUREG-1718 (NRC, 2000) contains guidance and references to other peerreviewed work on the subject of chemical safety. The applicant indicated that reagents are 

stored and chemical mixtures are prepared in the reagent processing building and the reagent 

storage part of the AP area. They are generally separated from each other and radioactive 

materials. The applicant will avoid mixing incompatible materials by using appropriate designs, 

controls, and procedures. The AP and MP facilities are broken down into process functional 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 99

units, which are made up of one or more subassemblies performing consistent and elementary 

tasks. The applicant stated that the breakdown into control functional units allows each entity to 

be operated relatively independently in the given operating mode. The staff review notes that 

this separation and independence is consistent with accepted industry practices for safe 

operations. 

The applicant will control process storage and operation conditions to prevent exothermic and 

potential autocatalytic reactions in the reagent processing building and the AP and MP areas. 

Autocatalytic and exothermic reactions of chemicals will be prevented through the application of 

IROFS and defense-in-depth features, which prevent the challenge to IROFS functions. The 

applicant has adequately identified these controls, along with management measures and 

applicable codes and standards to ensure that the IROFS are available and reliable to perform 

their safety function when needed. 

The applicant has demonstrated that there is reasonable assurance that the IROFS will be 

sufficiently reliable and available. This assurance is further reinforced through the use of 

standard nuclear industry engineering practices (e.g., reasonably and generally accepted good 

engineering practices). These practices are incorporated into the facility general design 

philosophy, design bases, system design, and commitments to applicable management 

measures. These practices ensure that applicable industry codes and standards are utilized, 

adequate safety margins are provided, engineering features are utilized to the extent 

practicable, the defense-in-depth philosophy is incorporated into the design, and the IROFS will 

be appropriately maintained. 

The staff’s review, as summarized above, finds that the applicant has provided sufficient 

information to meet the requirements of 10 CFR 70.64(a)(3) and 10 CFR 70.64(a)(5). 

8.1.3 Chemical Process Safety Interfaces 

Interfaces with Programmatic Areas

The MFFF is a relatively highly automated facility based in large part on the design and 

operating experience of existing facilities (the La Hague and MELOX facilities in France). The 

highly automated nature of the facility limits the number of personnel activities designated 

IROFS. Chapter 12 of the LA (MOX, 2009a) describes the application of human factors 

engineering to MFFF IROFS in detail. 

Interfaces with Management Measures

Management measures supplement MFFF IROFS by providing the administrative and 

programmatic framework for configuration management, maintenance, training and qualification, 

procedures, audits and assessments, incident investigation, and records management. The 

MPQAP describes the quality assurance program and Chapter 15 of the LA discusses 

management measures. 

Personnel responsible for performing activities involving chemical safety will be qualified and 

trained in accordance with the MFFF training and qualification program; specifically, applicable 

training for IROFS associated with chemical hazards will be provided. 

Activities associated with IROFS will be conducted in accordance with approved procedures. 

MFFF plant procedures govern operations, maintenance, and administrative actions to ensure 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 100

that IROFS are operated in a manner consistent with the results of the ISA. Plant procedures 

associated with IROFS will take into account chemical hazards, as well as radiological and 

criticality hazards, as appropriate for the activity. 

Audits and assessments will be used to determine the effectiveness of management measures, 

including those associated with chemical safety. Audit and assessment attributes (e.g., 

independence of auditors from personnel responsible for the chemical safety activities being 

audited, reports to management) will be consistent with those for other MFFF IROFS. 

Incident investigation activities identify corrective actions for, and root causes of, incidents that 

involve MFFF IROFS, including those related to chemical safety. Chapter 15 of the LA provides 

a general discussion of the applicant’s incident investigation and corrective action 

implementation process. 

The applicant will control chemical safety records in accordance with configuration management 

processes, the requirements of the MPQAP, and the records management program. Chemical 

safety records are processed and retained in the same manner as records associated with other 

IROFS and related programs. 

The staff finds that the applicant has established controls against risks as described in 10 CFR 

70.64(a)(5) in a manner consistent with those established for other areas, such as radiological 

safety and criticality, along with the associated management measures. Therefore, the staff 

finds that the applicant’s safety program, as it pertains to chemical safety, is acceptable. 

8.2 Evaluation Findings

The staff reviewed the LA (MOX, 2009a) for the MFFF to possess and use special nuclear 

material according to Chapter 8 of NUREG-1718 (NRC, 2000). The staff evaluated information 

provided by the applicant in the LA, ISA Summary (MOX, 2009b), nuclear safety evaluations, 

various technical reports, and responses to requests for additional information. The staff found 

that the applicant’s facility and system design and facility layout pertaining to chemical safety 

are based on defense-in-depth practices. The staff also found that the applicant’s facility design 

and IROFS provide adequate protection against chemical risks produced from licensed material, 

events which affect the safety of licensed material, and hazardous chemical produced from 

licensed material at the facility for routine operations, off-normal conditions, and potential 

accidents. Based on the review of the LA, the staff concluded that the applicant adequately 

described and assessed accident consequences having potentially significant consequences 

and effects that could result from the handling, storage, or processing of licensed materials. 

The LA and ISA Summary identified chemical process hazards and potential accidents that 

affect the safety of licensed material and established safety controls to ensure safe facility 

operation. To ensure that the performance requirements in 10 CFR Part 70 are met, the 

applicant will maintain the availability and reliability of these controls. The staff reviewed these 

safety controls and the applicant’s plan for managing chemical process safety and its potential 

effects on licensed radioactive materials and finds them acceptable. 

The staff concludes that the applicant’s plan for managing chemical process safety and the 

chemical process safety controls meet the requirements to possess and use special nuclear 

materials in accordance with 10 CFR Part 70. 

REFERENCES
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 101

(Adam, et al., 1992) Adam, L.C., I. Fabian, K. Suzuki, and G. Gordon, “Hypochlorous Acid 

Decomposition in the pH 5–8 Region,” Inorganic Chemistry, Vol. 31, pp. 3534-3541, 1992. 

(AICHE, 2008) American Institute of Chemical Engineers, “Guidelines for Hazard Evaluation 

Procedures”, NY, NY, 2008. 

(ANSI,1999) American National Standards Institute, N13.1, “Guide to Sampling Airborne 

Radioactive Materials in Nuclear Facilities, 1999. 

(BNL, 2009) Brookhaven National Laboratory, “Red Oil Excursions in the Mixed Oxide Fuel 

Fabrication Facility—Overview and Summary Report,” August 2009. 

(Brossard, et al., 2003) Brossard, M.P., J.M. Belmont, P. Baron, P. Blanc, J.Y. Chapelet, 

G. Bourges, and C. Leloup, “Dechlorination, Dissolution, and Purification of Weapon Grade 

Plutonium Oxide Contaminated with Chlorides: Tests Performed in the CEA Atalante Facility for 

the Aqueous Polishing Part of MOX Fuel Fabrication Facility,” Global 2003, New Orleans, LA, 

November 2003. 

(DOE, 1998) U.S. Department of Energy, “Technical Report on Hydroxylamine Nitrate,” 

(DOE/EH-0555), Washington, DC, February 1998. 

(DOE, 2004) U.S. Department of Energy, DOE Standard 3013, :Stabilization, Packaging, and 

Storage of Plutonium Bearing Materials:, Washington, D.C, 2004 

(DNFSB, 2003) Defense Nuclear Facilities Safety Board, “Control of Red Oil Explosions in 

Defense Nuclear Facilities,” (DNFSB/TECH-33), Washington, DC, November 2003. 

(Fauske, 2004) Fauske and Associates, Inc., “Calorimetry Data on the Tributyl Phosphate Nitric 

Acid Reaction,” (FAI/04-14), August 2004. 

(Fogelman, et al., 1989) Fogelman, K.D., D.M. Walker, and D.W. Margerum, “Non-Metal Redox 

Kinetics: Hypochlorite and Hypochlorous Acid Reactions with Sulfite,” Inorganic Chemistry, 

Vol. 28, pp. 986—993, 1989. 

(IAEA, 1998) International Atomic Energy Agency, “The Radiological Accident in the 

Reprocessing Plant at Tomsk,” October 1998. 

(IRSN, 2008) Institut de Radioprotection et de Surete Nucleaire, “Technical Note—Risks of 

Explosion Associated with “Red Oils’ in Reprocessing Plants,” June 2008. 

(ISA, 2000) International Society of Automation, “Methodologies for the Determination of 

Setpoints for Nuclear Safety-Related Instrumentation,” (ANSI/ISA-S67.04.01-2000), 

February 2000. 

Kawamura, P.I., and D. Mackay, “The Evaporation of Volatile Liquids,” Journal of Hazardous 

Materials, 15:343–364, 1987 

(MOX, 2009a) Shaw AREVA MOX Services, “MFFF—License Application,” Aiken, SC, 

October 2009. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 102

(MOX, 2009b) Shaw AREVA MOX Services, “MFFF—Integrated Safety Analysis Summary,” 

Aiken, SC, October 2009. 

(MOX, 2009c) Shaw AREVA MOX Services, “Shaw AREVA MOX Services Responses to 

Request for Additional Information Regarding the Review of the Chemical Process Safety 

Aspects of the License Application and Integrated Safety Analysis Summary,” (DCS-NRC000253), Aiken, SC, October 2009. 

(MOX, 2005) Shaw AREVA MOX Services, “Prevention of TBP Transfer from Unit KPA to Units 

KCA, KCD, and KPC,” (DCS01-KKJ-CG-NTE-F-08183-0), Aiken, SC, May 2005. 

(NFPA, 2008) National Fire Protection Association, “NFPA 69: Standard on Explosion 

Prevention Systems,” 2008. 

(NFPA, 2002) National Fire Protection Association, “NFPA 72: National Fire Alarm and 

Signaling Code”, 2002. 

(NFPA 1997) National Fire Protection Association, :NFPA 497: Recommended Practice for the 

Classification of Flammable Liquids, Gases, or Vapors and of Hazardous (Classified) Locations 

for Electrical Installations in Chemical Process Areas,” 1997. 

(NIOSH, 2005) National Institute for Occupational Safety and Health, “NIOSH Pocket Guide to 

Chemical Hazards,” Washington, DC, September 2005. 

 

(NRC, 2005) U.S. Nuclear Regulatory Commission, NUREG-1821, “Final Safety Evaluation 

Report on the Construction Authorization Request for the Mixed Oxide Fuel Fabrication Facility 

at the Savannah River Site, South Carolina,” Washington, DC, 2005. 

(NRC, 2001) U.S. Nuclear Regulatory Commission, NUREG-1513, “Integrated Safety Analysis 

Guidance Document,” Washington, DC, May 2001. 

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” Washington, 

DC, August 2000. 

(NRC, 1999) U.S. Nuclear Regulatory Commission, Regulatory Guide 1.105, “Setpoints for 

Safety Related Instrumentation,” Washington, DC, December 1999. 

(NRC, 1998) U.S. Nuclear Regulatory Commission, NUREG/CR-6410, “Nuclear Fuel Cycle 

Accident Analysis Handbook,” Washington, DC, March 1998. 

(NRC, 1997) U.S. Nuclear Regulatory Commission, NUREG-1601, “Chemical Process Safety at 

Fuel Cycle Facilities,” Washington, DC, August 1997. 

(Thompson, 2000) Thompson, G., “Hazard Potential of the La Hague Site: An Initial Review,” 

Institute for Resource and Security Studies, May 2000. 

(WSRC, 2001) Hallman, D.F., “Hydrazoic Acid Controls and Risks When Processing Plutonium 

Solutions in HB-Line Phase II,” WSRC-TR-2000-00443, Westinghouse Savannah River 

Company, Aiken, SC, January 31, 2001. 

10 CFR Part 20, Standards for Protection Against Radiation. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

8 - 103

10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities. 

10 CFR Part 70, Domestic Licensing of Special Nuclear Material. 

49 CFR Part 178, Specifications for Packagings. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

9 - 1

9.0 RADIATION SAFETY 

In Section 9 of the “Mixed Oxide Fuel Fabrication Facility—License Application” (MOX, 2010a), 

Shaw AREVA MOX Services (the applicant) described the proposed radiation protection (RP) 

program for the mixed oxide fuel fabrication facility (MFFF). The program addresses both 

radiation safety design and implementation of the RP program. In performing its review, the 

staff used the review guidance in NUREG-1718, “Standard Review Plan for the Review of an 

Application for a Mixed Oxide (MOX) Fuel Fabrication Facility” (also referred to as the SRP) 

(NRC, 2000). The SRP addresses design and implementation separately but with similar 

requirements for each topic. To avoid duplication in this chapter of the safety evaluation report, 

the U.S. Nuclear Regulatory Commission (NRC) staff first addresses in general terms the 

design features applied to each topic in Section 9.1 of the SRP, “Radiation Protection Program,” 

including the principle of as low as reasonably achievable (ALARA), facility design features, 

source identification, ventilation, and the Integrated Safety Analysis (ISA) Summary (MOX 

2010b). Next, the staff presents its review of the RP program as it covers in depth each topic in 

Section 9.2 of the SRP, including ALARA, procedures, training, air sampling, contamination 

control, exposure, respiratory protection, and instrumentation. The application includes the 

commitment to implementing design features throughout the facility, which is evident in the RP 

program. 

9.1 Regulatory Requirements

The staff reviewed how the information in the license application (LA) (MOX, 2010a) addresses 

the regulatory requirements of Title 10 of the Code of Federal Regulations (10 CFR) Part 20, 

“Standards for Protection against Radiation,” and 10 CFR Part 70, “Domestic Licensing of 

Special Nuclear Material.” Chapter 9 of the SRP states the specific regulatory references 

(NRC, 2000). 

9.2 Facility Design Features

9.2.1 As Low as Reasonably Achievable 

The ALARA principle involves keeping radiation exposures as far below the regulatory limits as 

is reasonably achievable. ALARA is evident in the design features as demonstrated through the 

use of automated and remote controlled systems, isolation of the processes, monitoring, and 

shielding. The containment systems include gloveboxes, process cells, and ventilation which 

keep the radioactive material out of work areas. The confinement systems are designed to 

minimize buildup of contamination and simplify cleaning through features such as smooth 

surfaces, rounded corners, and automatic removal of radioactive material. The separation 

between personnel and radioactive material is the primary design feature used throughout the 

MFFF to implement ALARA. 

The applicant’s design staff is trained and qualified to identify and minimize radiation hazards. 

These individuals, with assistance from the radiation protection manager (RPM), regularly 

review operations to ensure that issues arising from criticality control, exposures, shielding, and 

other areas are resolved and iteratively incorporated into the design. ALARA principles are 

incorporated into the design in the following ways: confinement of radioactive material within 

process equipment and in gloveboxes, multiple-zone ventilation that sweeps air from low to high 

potential contamination zones, continuous remote monitoring with local and remote readout and 

alarms, automated and remotely operated equipment, removal of radioactive material before 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

9 - 2

maintenance, shielding that is commensurate with the penetrating power of the radiation, 

equipment designed to require a minimum of maintenance or repair, facility layout to keep 

administrative activities away from radiation areas, and personnel and area radiation monitoring. 

These characteristics demonstrate that ALARA is incorporated into the facility design features 

and meets the guidance in Section 9.1.4.1 of the SRP. 

9.2.2 Facility Design Features 

The site drawings and descriptions depict the radiation protection provided by the facility design 

features. The design incorporates documentation of features including scaled drawings of the 

facility superimposed with radiation zones based on expected worker occupancy; radiation 

shielding calculations for each zone; definitions of the radiation sources and features relied on 

to reduce doses ALARA; location of radiation protection equipment; general requirements for 

radiation detectors and alarm systems; locations of permanent shielding and confinement 

design; locations and access control points for radiation areas, controlled areas, and restricted 

areas; and location of change rooms. The RP principles are also incorporated by design into 

the facility procedures. These procedures, developed by the RPM, are audited regularly to 

ensure that they remain accurate and include ALARA principles. Radiation work permits 

(RWPs) are implemented for nonroutine tasks that do not have standard existing procedures. 

These RWPs require the design to be approved by the RPM or his or her representative. These 

commitments demonstrate that RP principles are incorporated into the design features through 

written procedures and documentation and meets the guidance in Section 9.1.4.2 of the SRP. 

9.2.3 Source Identification 

Internal exposure to special nuclear material (SNM) has the largest potential to result in 

radiation doses at the MOX facility. Therefore, the design relies on containment of the material 

through the use of confinement vessels, gloveboxes, sealed containers, and ventilation 

throughout the facility to prevent internal exposure. Direct radiation is the second source of 

exposure. Therefore, the confinement vessels incorporate design features, such as borated 

concrete and lead glass, for shielding to attenuate ionizing radiation. Automation and remote 

controls are used to limit exposure times and maximize distance between the source and the 

individual. The design incorporates routine monitoring of both airborne and direct radiation in 

work zones to detect contamination and provide estimates of actual exposure. The design 

incorporates consideration of sources of radiation for implementation of RP principles and 

meets the guidance in Section 9.1.4.3 of the SRP. 

9.2.4 Ventilation Systems and Glovebox Design 

The MFFF ventilation design incorporates radiation protection principles throughout the facility. 

The ventilation is divided into zones that move air from less contaminated areas to more 

contaminated areas. Within each zone, clean air enters the work area from the head level and 

travels towards the foot level to reduce inhalation of contamination. The design also minimizes 

the spread of contamination by maintaining a negative pressure gradient between zones. Air 

monitors and pressure differential monitors ensure that any degradation in containment barriers 

is rapidly identified so corrective action can be implemented. The design incorporates airlocks 

between zones to minimize migration of airborne contaminants. Redundant power and heating, 

ventilation, and air conditioning systems ensure that the ventilation system remains operable. 

These ventilation system design features throughout the facility maintain internal exposures 

ALARA and meets the guidance in Section 9.1.4.4 of the SRP. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

9 - 3

9.2.5 Shielding 

The development of the design features drew extensively on experience from the MELOX and 

La Hague facilities, which are operated by AREVA in France. MELOX and La Hague operating 

experience influenced the design throughout the MFFF facility (e.g., the occupancy rates, 

proximity to radiation sources, stay times, shielding, zoning). Incorporation of hands-on 

experience in the design of facility features improves the radiation protection of the facility. 

Design drawings and descriptions of the shielding for high and very high radiation areas clearly 

identify the penetrations, shield doors, and labyrinths incorporated to meet the shielding design 

criteria. Radiation shielding analyses were used by the applicant to verify the shielding for each 

process room, including the dose rates for each position workers are required to take to perform 

routine and non-routine maintenance. A radiation shielding test program will be implemented 

prior to the start of operations for protection of personnel from high radiation dose rates. 

The applicant used several industry standard computer codes in the shielding calculations (e.g, 

SCALE, MCNP, and SNID). The shielding design complies with 10 CFR §20.1406 

requirements for the minimization of contamination and uses the reference facilities’ design 

experience for guidance. The shielding design features are sufficient to minimize external and 

internal doses and meets the guidance in Section 9.1.4.5 of the SRP. 

9.2.6 Integrated Safety Analysis Summary 

As indicated above, passive (e.g., vessels, gloveboxes, containers) and active (e.g., ventilation, 

negative pressure, direction of airflow) confinement barriers provide the primary design features 

to prevent or minimize internal exposures. The effectiveness of these features is verified 

through the use of air monitors. Shielding, minimizing the time spent in radiation work zones, 

and distance from the source material (e.g., through automation, remote control, work zones) 

are the primary design features to minimize external exposures. The ISA identifies accident 

scenarios, including loss of confinement events that could result in internal and external 

exposures. Items relied on for safety and management measures are incorporated into the 

design to comply with the performance requirements and meets the guidance in Section 9.1.4.6 

of the SRP. 

9.2.7 Evaluation 

The staff followed the guidance in Section 9.1.6 of NUREG-1718 (NRC, 2000) in reviewing the 

LA for the MFFF to possess and use SNM. Based on its evaluation of the LA and the ISA, the 

staff finds that radiation protection principles are incorporated throughout the facility design. 

The applicant supplied information on the radiation safety design features and design process 

that demonstrates, with reasonable assurance, that radiation doses will be within the limits of 

10 CFR Part 20 and will be ALARA. The applicant considered contamination control, 

decommissioning facilitation, and waste minimization in developing the design features of the 

facility, as required by 10 CFR § 20.1406, “Minimization of contamination.” The applicant also 

incorporated radiation safety design features resulting from its radiation safety design review 

and from radiation dose experience gained during the operation of AREVA’s French facilities, 

MELOX and La Hague. 

The NRC staff concludes that there is reasonable assurance that the applicant’s radiation safety 

design process and design features are adequate and, in concert with an effective RP program 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

9 - 4

as outlined in SRP Section 9.1 (NRC, 2000), satisfy the requirements of 10 CFR Part 20 and 

10 CFR Part 70. 

9.3 Radiation Protection Program Implementation

In Section 9 of the LA (MOX, 2010a), the applicant described the proposed RP program for the 

MFFF. MOX Services committed to implementing a quality RP program consistent with 

Regulatory Guide (RG) 8.8, “Information Relevant to Ensuring That Occupational Radiation 

Exposures at Nuclear Power Stations Will Be as Low as Is Reasonably Achievable,” 

Positions C.1.a and b (NRC, 1978). This portion of the RG describes criteria for establishment 

of an ALARA program, including management oversight, an effective measurement system, 

regular audits, approved procedures, and application of sufficient resources. The RP program 

is developed, documented, and will be implemented commensurate with the risk posed by 

processing MOX fuels such that operations will meet the requirements of 10 CFR Part 20. 

The RP program is designed, monitored, and maintained by the RP function and overseen by 

an RPM with support throughout operations from the engineering function. Section 9.2.2 of the 

LA (MOX, 2010a) outlines the RP program’s organizational structure and the responsibilities of 

key program personnel. The plant manager is responsible for ensuring the health and safety of 

the public and workers and protection of the environment. This includes compliance with 

applicable NRC regulations and the facility license. With the support of the RP function, the 

RPM is responsible for implementing the RP program. The RPM and staff, including 

contractors, will also be responsible for the following: 

• establishing the RP program 

• ensuring adherence to the RP program in operations 

• establishing and maintaining the ALARA program 

• ensuring that ALARA principles are incorporated in training and practiced by all 

personnel 

• adequately staffing the RP function with individuals qualified to conduct their assigned 

responsibilities 

• reviewing and auditing the efficacy of the program in complying with NRC and other 

governmental regulations and applicable RGs 

• modifying the program, based on experience and facility history 

• generating and maintaining procedures associated with the program 

• establishing and maintaining a radiation safety training program for personnel working in 

restricted areas 

• ensuring that adequate surveys are conducted to maintain cleanliness and maintain 

exposures ALARA 

 

• monitoring and documenting worker doses, both internal and external 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

9 - 5

• establishing and maintaining a respirator usage program 

• proper handling of radioactive wastes when disposal is needed 

• proper ventilation system with filtration to minimize contamination 

• establishing and maintaining the radiological environmental monitoring program 

• calibrating and conducting quality assurance activities for all radiological instrumentation, 

including verification of required lower limits of detection or alarm levels 

• posting the restricted areas and, within these areas, posting Radiation, Airborne 

Radioactivity, High Radiation, and Contaminated Areas, as appropriate, and developing 

occupancy guidelines for these areas as needed 

The staff reviewed these topics and summarized them in the remainder of this chapter of the 

safety evaluation report in accordance with the acceptance criteria in NUREG-1718, 

Chapter 9.2 (NRC, 2000). The staff conducted an item-by-item evaluation against this SRP to 

ensure that each topic was addressed. Details of the staff evaluation follow. 

9.3.1 ALARA Program 

The RP program uses written policies and procedures to ensure that occupational radiation 

exposures are maintained ALARA and that such exposures are consistent with the 

requirements of 10 CFR § 20.1101, “Radiation protection programs.” All design reviews 

include ALARA considerations. The applicants’ staff tracks to completion any recommendations 

resulting from the review. 

The goals of the ALARA program include maintaining occupational exposures, as well as 

environmental releases, as far below regulatory limits as is reasonably achievable. The design 

of facility systems plays a large role in achieving these goals. For example, inhalation 

exposures are minimized by confining radioactive material within sealed process areas, 

separated by barriers from personnel access areas. Key ALARA elements of time, distance, 

and shielding are implemented through automation, remote control, and permanent shielding. 

These characteristics are designed into the facility wherever feasible. Access is restricted to 

process rooms through properly ventilated gloveboxes. When direct access to process areas is 

required for maintenance or other reasons, radiation sources are removed from the work area. 

All tiers of the MFFF staff and management structure support ALARA principles. For example, 

MFFF management ensures that ALARA is emphasized throughout the facility by 

communicating expectations to the staff through policy statements, regular audits, and 

empowerment of the RP function to intervene if operations are determined to be unsafe. 

Management receives periodic reports from the RPM, who is responsible for reviewing key 

program such as training, maintenance, and operating procedures for consistency with ALARA 

principles. 

The RP function conducts periodic audits to verify that ALARA is incorporated into the facility 

programs. These audit results are communicated to management for review and input to the 

staff. The RP function is delegated authority to intervene in any practice that is determined to 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

9 - 6

be unsafe. Management ensures that ALARA principles are incorporated throughout the MFFF 

and that the RP function has sufficient authority to ensure implementation. 

The facility has a well-staffed ALARA Committee, with members including line management and 

operations management personnel and the RPM. The Committee is responsible for overseeing 

the review and improvement of the RP program. It reviews the audits of the RP program at 

least annually and evaluates major design activities, operations activities, and plant 

modifications that could affect ALARA goals. It also conducts trending analysis to ensure that 

the goals are accomplished. The Committee meets frequently, in accordance with internal 

procedures, and more often during activities with the potential for unusual exposures. 

Recommendations made by the Committee are tracked to completion. Reports on the status of 

the meetings are provided to management at least annually. 

The ALARA program is implemented throughout the facility with oversight from the RP function 

and the ALARA Committee. Progress is monitored through regular audits and trending. This 

NRC staff finds that the applicants’ program provides reasonable assurance of compliance with 

10 CFR 20.1101(b) and the acceptance criteria in NUREG-1718, Section 9.2.4.1 (NRC, 2000). 

9.3.2 Organizational Relationships and Personnel Qualifications 

The RP function operates under the Health, Safety, and Environment function (ES&H), which 

conducts licensing and regulatory compliance as described in LA Section 4.2.5. The RPM, who 

reports to the ES&H Licensing Manager, oversees the RP function. The RPM’s role includes 

ensuring adherence to the RP program, establishing RP policy, administering the RP program, 

reviewing facility modifications, and managing RP staff. The RPM has direct access to senior 

management regarding all matters involving RP, is skilled in the interpretation of RP data and 

regulations, and is familiar with the operation of the facility and RP concerns at the site. 

The RPM receives support from senior health physicists and senior staff who are empowered to 

substitute for the RPM when needed. The RP technicians work under the supervision of these 

senior staff and conduct the day-to-day responsibilities including surveys, dosimetry, bioassay, 

independent oversight of exposures, and calibration of instrumentation. Section 9.2.2 of the LA 

(MOX, 2010a) describes the training of the RPM, senior staff, and technicians for their 

respective tasks. 

The members of the RP function must be qualified commensurate with their responsibilities. The 

RPM has, as a minimum, a bachelor’s degree (or equivalent) in health physics, engineering, or 

a scientific field and at least 4 years of experience in radiological protection. Certification by the 

American Board of Health Physics or an additional 4 years of experience may be substituted for 

the degree requirements. Senior RP staff will have 4-year degrees in science or engineering 

with at least 1 year of experience at a nuclear facility. Management may waive specific 

qualifications for the RPM on a case-by-case basis, provided that supporting staff have 

equivalent qualifications. The RP technicians must have a high school diploma or equivalent 

and work under the direction of a senior technician or supervisor. 

The applicant provides sufficient resources in terms of staffing and equipment to implement an 

effective RP program for all shifts at the facility. The RP program is independent of the facility’s 

routine operations and is focused on implementing sound RP principles necessary to achieve 

ALARA goals. The NRC staff finds that the applicant’s organization and staffing of the RP 

function provide reasonable assurance of compliance with 10 CFR 70.23(a)(2) and the 

acceptance criteria in NUREG-1718, Section 9.2.4.2 (NRC, 2000). 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

9 - 7

9.3.3 Radiation Safety Procedures and Radiation Work Permits 

Written procedures are used for all operations involving licensed materials as described in the 

MOX Project Quality Assurance Plan. The staff is trained to adhere to the written procedures 

unless an unplanned or unsafe condition arises. Under these conditions, the staff is trained and 

given authority to stop work and report the conditions to management. Procedures throughout 

the facility are maintained in accordance with the MOX Project Quality Assurance Plan. In 

addition to the NRC-approved quality assurance program, the facility also conducts a 5-year 

overall review of RP procedures, respiratory protection procedures, and operating and 

maintenance procedures to ensure their continued applicability and accuracy. 

Before working in a radiologically controlled area, individuals are required to read, understand, 

and follow RWPs. RWPs may be general for routine activities, such as daily operations, or may 

consist of specific instructions for nonroutine activities. RWPs for specific activities are 

distributed in maintenance packages, which the assigned crew is required to read before 

undertaking the work. 

Various groups throughout the facility may issue RWPs on an as-needed basis, but the RP 

function specifies the radiological conditions for the work area, stay times, protective clothing 

requirements, shielding (if required), dosimetry requirements, and any other relevant 

information. The RPM reviews and approves the RWPs before their implementation. The RP 

function takes the additional precaution of reviewing new RWPs with the group developing the 

document to ensure that the appropriate information is incorporated and understood. 

The RWPs have a predetermined period of validity, with a specified expiration or termination 

time listed on the document. RWPs that are used often or for extended periods of time are 

periodically reviewed for possible improvements in worker protection. Records of RWPs are 

kept in accordance with the facility document management program as described in Section 15 

of the LA. Sufficient information is retained so that auditors can reconstruct the circumstances 

necessitating the RWP. 

The applicant commits to the use of written procedures and RWPs for activities involving 

exposure to licensed material. Qualified facility staff will maintain and implement these 

procedures, which demonstrate reasonable assurance of compliance with 10 CFR § 

70.23(a)(4), “Requirements for the approval of applications,” and the acceptance criteria in 

NUREG-1718, Section 9.2.4.2 (NRC, 2000). 

9.3.4 Training 

The radiation safety training program is designed and implemented to provide a tiered level of 

knowledge to all personnel who enter radiation-controlled areas. Visitors receive site-specific 

safety information and must be accompanied throughout the radiation-controlled area by 

qualified personnel. An individual’s level of training is based on the potential radiological health 

risks associated with his or her assigned responsibilities. All employees are trained 

commensurate with the provisions of 10 CFR § 19.12, “Instruction to workers,” as outlined in 

Section 9.2.4 of the LA (MOX, 2010a). 

Individuals must pass a written exam to demonstrate satisfactory completion of classroom 

training. This training includes such topics as risks of exposure, regulatory and administrative 

limits, RP concepts, facility-specific emergency actions, event response, and individual 

responsibilities including ALARA. The training also includes practical demonstrations of 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

9 - 8

donning personal protective equipment, conducting self-monitoring with survey instruments, and 

methods for decontamination. Individuals who are required to wear respiratory protection 

receive specialized training and a medical evaluation. 

Refresher training is conducted annually, and as necessary, to address changes in policies, 

procedures, requirements, and the facility ISA. The training program is regularly updated with 

lessons learned from operational experience and as needed for new material. In addition, the 

RPM conducts a formal review of the training program at least every 3 years, to ensure that the 

program is current and adequate. 

Line management is fully responsible for ensuring that personnel are properly trained. The 

personnel are required to acknowledge in writing that they have received and understand the 

material. The training records are maintained in accordance with internal procedures. 

The applicant has developed a comprehensive tiered program to train staff with various levels of 

responsibility. Personnel receive regular refresher training, and the course materials are 

regularly updated to incorporate lessons learned from operations. The staff finds that the 

provisions demonstrate reasonable assurance of compliance with the training requirements in 

10 CFR § 19.12 and 10 CFR § 70.23(a)(2) and the acceptance criteria in NUREG-1718, 

Section 9.2.4.4 (NRC, 2000). 

9.3.5 Air Sampling 

The air sampling program uses portable air samplers, fixed air samplers, and continuous air 

monitors (CAMs) to detect airborne contamination throughout the facility. The type and 

frequency of sampling are based on the potential for exposure and implemented based on 

ALARA goals. The combination of these sampling methods provides comprehensive monitoring 

of the facility’s airborne contamination. 

The CAMs are used extensively throughout the facility, such as at work stations, area monitors, 

ducts, and stack exhaust, to provide a baseline measure and rapid detection of contamination. 

The number and location of CAMs are determined by the type of operations and the potential for 

uptake. The CAMs provide early warning of contamination to personnel by providing dual alarm 

setpoints. The first alarm setpoint warns individuals that contamination is nearing an 

administrative limit and corrective actions are necessary. The second alarm setpoint warns 

individuals to take immediate protective actions. The CAMs also send readouts to the control 

room and the RP function so the readouts can be recorded for trending purposes and to 

facilitate the RP response. 

Personnel are trained on the procedures they should follow after a CAM alarm. These 

procedures define the followup actions, which include investigating the cause, determining the 

level of contamination, implementing corrective actions, and in some cases, conducting a 

bioassay dose evaluation. The CAMs are also used to collect an air sample, which is 

processed by the RP function, to monitor the gross activity and the isotopes of concern. 

Fixed and portable air samples are used to verify that CAMs are calibrated and operating 

correctly. They are also used to monitor areas where workers could receive an annual intake of 

2 percent or more of the specified annual limit on intake during normal operations. Portable air 

samplers, such as lapel samplers, are used when individuals work directly with radioactive 

materials or when a system boundary is opened for maintenance. These samples are analyzed 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

9 - 9

at the conclusion of each shift. The readouts from the CAM and the air samples are analyzed to 

calculate an individual’s internal exposure. 

Internal monitoring equipment is maintained in calibration by the RP function in accordance with 

internal procedures. Operational checks are routinely conducted using check sources. 

The airborne sampling program allows for the early detection and appropriate mitigation of 

airborne contamination. The CAMs provide real-time monitoring and tracking of contamination 

augmented by air sampling as needed. The NRC staff finds that the applicant’s air sampling 

program meets the acceptance criteria in NUREG-1718, Section 9.2.4.2 (NRC, 2000). 

9.3.6 Contamination Control 

The contamination control program seeks to prevent the spread of radioactive material through 

monitoring and decontamination of personnel, equipment, and controlled areas throughout the 

facility. Multiple measures are implemented to prevent the spread of contamination, including a 

survey program, access to controlled areas, and personal protective equipment. 

Surveys are conducted in process areas on a graded approach. Access and egress areas are 

surveyed daily, radiological controlled areas with high occupancy are surveyed weekly, and 

areas located outside the radiological controlled areas are surveyed quarterly. If surveys 

identify contamination areas or high contamination areas, as defined by Table 9.2-1 of the LA, 

the RP function posts and restricts access until the area is decontaminated below established 

limits. 

Surveys are used to verify ALARA and guide the development of radiological protection 

requirements, such as postings, access controls, and personal protective equipment (PPE) 

requirements. The survey program is conducted in accordance with written procedures 

maintained by the RP function. Contamination surveys are conducted using portable survey 

instruments, swipes, and large-area wipes to detect both removable and fixed contamination. 

These are in addition to the CAMs and air samples used to detect airborne contamination 

throughout the MFFF radiation-controlled area and associated ventilation systems. Survey 

results are documented and reviewed by the RP function for possible trends and to identify 

potential areas for corrective actions. Corrective actions are implemented to isolate 

contaminated areas, notify personnel, and clean up the contamination as soon as practical. 

The applicant will adjust survey frequencies and survey procedures based on localized 

conditions and historical data. Survey frequencies will be modified only annually, at most, and 

require at least 10 routine, consecutive surveys that reveal negligible contamination. 

Surveys are used to identify areas that should be posted in accordance with 10 CFR Part 20, 

Subpart J, “Precautionary Procedures.” These areas include controlled areas, radiological 

control areas, contamination areas, restricted areas, airborne contamination areas, among 

others. Internal MOX Services procedures are established to define the frequency of surveys 

and monitoring appropriate for each area. An access control program ensures that signs, 

labels, and other access controls are properly posted and operative. 

Transition areas between contaminated and uncontaminated areas are established where 

individuals can remove PPE, survey themselves, and conduct decontamination as necessary. If 

contamination is detected, the event is recorded for tracking purposes, and members of the RP 

function are summoned to assist in decontamination. Personnel are surveyed when they leave 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

9 - 10

a contamination controlled area to ensure that they comply with the administrative limits in 

Table 9.2-1 of the LA (MOX, 2010a). Protective coveralls or a lab coat is required in most areas 

of the facility, with additional PPE requirements based on local conditions. The RP function 

establishes the PPE requirements. Used PPE is bagged, surveyed, and placed in drums before 

being laundered. 

Contamination is limited by processing material within containment barriers and gloveboxes. 

The ventilation system maintains these process areas at a negative pressure to prevent 

migration of material through any breach. Materials and equipment released from controlled 

areas to uncontrolled areas are considered contaminated until they are surveyed and released. 

The material remains controlled until surveys confirm that the contamination is below the limits 

in Table 9.2-1 of the LA (MOX, 2010a). 

 

The RP function is responsible for overseeing the control and accountability of sources. Sealed 

sources are surveyed for leaks at least annually in accordance with internal procedures. Highradiation sources are kept in locked cabinets with access controlled by the RPM. 

The contamination control program includes a regular schedule of surveys to identify, isolate 

and remove contamination. Additional features such as controlled areas, transition zones, 

ventilation, and PPE further contribute to contamination control. The program relies on surveys 

and predefined administrative limits to identify areas used to isolate and remove radioactive 

material. The NRC staff finds that the applicant’s contamination control program provides 

reasonable assurance of compliance with 10 CFR Part 20.1406 and the acceptance criteria in 

NUREG-1718, Section 9.2.4.6 (NRC, 2006). 

9.3.7 External Exposure 

Sound ALARA practices such as remote systems operations, confinement systems, and 

radiation shielding are the primary methods of limiting external exposure. A monitoring program 

has been established for MFFF personnel, since most individuals are exposed to both photon 

and neutron radiation. Thermoluminescent dosimeters (TLDs), which are sensitive to beta, 

gamma, and neutron radiation, are used to monitor doses. Only dosimeters with the 

appropriate range and sensitivity are used at the facility. Everyone likely to receive an annual 

dose of 50 millirem (mrem) for visitors or 100 mrem for workers is required to wear a dosimeter. 

Individuals likely to receive a neutron radiation dose in excess of 1 millisieverts (100 mrem) 

annually receive neutron dosimetry. 

A vendor accredited by the National Voluntary Laboratory Accreditation Program evaluates 

dosimetry quarterly. In addition to a TLD, personnel within the MFFF process areas wear an 

electronic pocket dosimeter to provide rapid warning of excessive exposure. The RP function 

uses routine surveys to identify areas that require heightened monitoring of external exposure. 

The applicant has established an annual administrative limit for total effective dose equivalent of 

5 millisieverts (mSv) (500 mrem). When an individual’s dose approaches the administrative 

limit, the individual is considered for temporary reassignment. The RPM, in conjunction with the 

ES&H vice president, may grant special permission for individuals to exceed the administrative 

dose limit. An investigation and corrective actions are required when administrative limits are 

exceeded. 

External exposures are minimized by implementing ALARA principles and by monitoring 

exposures with electronic and TLD dosimetry. In addition, the established administrative limits 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

9 - 11

require corrective actions when doses approach or exceed the limit. The NRC staff finds that 

the applicant’s external exposure program provides reasonable assurance of compliance with 

external exposure limits in10 CFR Part 20 and the acceptance criteria in NUREG-1718, 

Section 9.2.4.7 (NRC, 2000). 

9.3.8 Internal Exposure 

As with external exposure, ALARA principles such as remote operations, containment, and 

monitoring are key to minimizing internal exposures. For mixed oxides, internal exposure 

exceeds the radiological health risks for external exposures. For this reason, individuals are 

physically separated from powdered material by gloveboxes and negative pressure barriers. 

CAMs are used to monitor exposure continually and are augmented by air samplers, which are 

used to estimate internal dose, based on the individual’s stay time. The CAMs have established 

setpoints with associated alarms, which notify personnel of a need to take protective actions. 

Confirmatory air samples are monitored at the conclusion of each shift. 

Bioassay sampling is also used to verify internal uptakes and determine the quantity of 

radioactive material. All personnel who have the potential to receive 10 percent of the annual 

limit on intake are subject to routine (at least annual) bioassay monitoring. Bioassays are also 

required for all personnel who have observed facial or nasal contamination, or when a CAM or 

air sampler indicates a potential uptake. The bioassay program includes urinalysis, fecal 

sampling, and whole body scans, as determined by the RP function. The bioassay program is 

conducted according to the criteria of American National Standards Institute/Health Physics 

Society (ANSI/HPS) Standard N13.22, “Bioassay Programs for Uranium” (ANSI/HPS, 1995). 

Bioassay minimum detection levels will be established in accordance with ANSI/HPS 

Standard N13.30, 1996, “Performance Criteria for Radiobioassay” (ANSI/HPS, 1996), and 

documented in accordance with internal procedures. 

The internal exposure controls are based on limiting exposure to airborne radioactive material 

through ALARA principles. The amount of exposure is thrice monitored using CAMs, air 

samples, and bioassay measurements. The NRC staff finds that the applicant’s program 

provides reasonable assurance of compliance with 10 CFR Part 20 and the acceptance criteria 

in NUREG-1718, Section 9.2.4.8 (NRC, 2000). 

9.3.9 Summing Internal and External Exposure 

The applicant has established a procedure to sum the internal and external exposure values in 

accordance with 10 CFR 20.1202, “Compliance with requirements for summation of external 

and internal doses,” as stated in Section 9.2.9 of the LA (MOX, 2010a). Radiation exposures 

will be recorded and reported in accordance with internal RP procedures, which will be based 

on RG 8.7, Revision 2, “Instructions for Recording and Reporting Occupational Radiation Dose 

Data” (NRC, 2005), and RG 8.34, “Monitoring Criteria and Methods To Calculate Occupational 

Radiation Doses” (NRC, 1992). 

The applicant has developed a radiation survey and monitoring program, which incorporates 

external exposure, air sampling, bioassay, and contamination control. This program provides 

reasonable assurance of compliance with 10 CFR §20.1202 and the acceptance criteria in 

NUREG-1718, Section 9.2.4.9 (NRC, 2000). 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

9 - 12

9.3.10 Respiratory Protection 

The respiratory protection program will be implemented in accordance with written procedures 

that cover individual qualifications, maintenance, and recordkeeping. In general, the MFFF 

seeks to minimize the need for respiratory protection by limiting airborne contamination in the 

work area. However, respiratory protection is used when air sample analysis indicates that 

concentrations equal or exceed 20 percent of the derived air concentrations listed in 

10 CFR Part 20, Appendix B, “Annual Limits on Intake (ALIs) and Derived Air Concentrations 

(DACs) of Radionuclides for Occupational Exposure; Effluent Concentrations; Concentrations 

for Release to Sewerage.” 

Before becoming qualified for respiratory equipment, individuals must undergo a medical 

evaluation, receive a fit test, and pass specialized training. The level of respiratory protection is 

determined by the derived air concentration in the area air and the respirator’s protection factor. 

The RP function will ensure that the equipment has sufficient visibility, communication 

capability, and skin protection for the assigned task. The licensee will maintain records of the 

individuals’ training and use of respiratory protection equipment. 

9.3.11 Respiratory Protection and Ventilation

The MFFF incorporates a ventilation system in its design to minimize exposure and the 

operation of this ventilation system will assist in determining the need for respiratory protection. 

The ventilation design incorporates air zone flow with well-defined pressure gradients between 

zones, so that air flows from areas with lesser to greater contamination potential. In addition, 

room airflow enters at the head level and exits near the floor to further reduce the likelihood of 

inhalation contaminants. Dust pots are used as pre-filters for dust removal so that licensed 

material can be recycled. 

Ventilation is exhausted through high-efficiency particulate air (HEPA) filters before being 

exhausted to the plant stack. Redundant critical ventilation systems such as fans, dampers, 

and filters are provided to ensure continuous operation of the system. Air monitoring and 

warning systems are designed with a standby power supply to remain operable during a loss of 

power event. Differential pressure is monitored across HEPA filters to ensure that contaminated 

exhaust systems are identified and serviced in a timely manner. In addition, redundant HEPA 

filters are employed to ensure that ventilation systems remain functional. CAMs and pressure 

measurements are used to detect abnormal leaks in containment barriers. After filtration, 

exhaust air is emitted through the plant stack after undergoing a confirmatory air purity 

measurement. 

Containment is maintained by handling material in process vessels, gloveboxes, and sealed 

containers. The material is manipulated remotely or through gloveboxes, which are maintained 

under a partial vacuum. This ensures that leaks do not result in a release of radioactive 

material into work areas. Airflow velocities are monitored at system openings (gloveboxes, 

exhausted enclosures, or ventilation systems serving these barriers) and are designed to 

remain at a minimum of 0.64± 0.03 meters per second (125±5 feet per minute), even under 

abnormal conditions. The airflow rate is sufficient to preclude movement of airborne plutonium 

or uranium between zones and to minimize the potential for worker intake. 

The respiratory protection program combines with the ventilation system to minimize exposures 

to airborne contaminants. The ventilation localizes and removes airborne contamination from 

the work environment. When these combined methods are insufficient, qualified personnel use 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

9 - 13

respiratory protection equipment to maintain doses ALARA. The staff finds that together, these 

programs provide reasonable assurance of compliance with 10 CFR Part 20, Subpart H, 

“Respiratory Protection and Controls To Restrict Internal Exposure in Restricted Areas,” and the 

acceptance criteria in NUREG-1718, Section 9.2.4.10 (NRC, 2000). 

9.3.12 Instrumentation 

The MFFF utilizes multiple types of instrumentation to monitor radiation exposures. These 

include survey equipment, air samplers and CAMs, personal dosimetry, and bioassay 

equipment. The RP function oversees the selection and maintenance of radiological 

measurement instrumentation. It ensures the selection of instruments that will be operable and 

capable of measuring, at or below the required level, the types of radiation that could be 

encountered. 

The RP function maintains a calibration program in accordance with the guidelines in ANSI/ANS 

Standard N323, “Radiation Protection Instrumentation Test and Calibration” (ANSI/ANS, 1978). 

Instruments are calibrated regularly in accordance with manufacturers’ specifications and are 

tagged to indicate the date the calibration expires. Internal procedures require personnel to 

notify the RP function of any instrument that appears to be out of calibration. Calibration 

sources are traceable to the National Institute of Standards and Technology. 

The RP function has multiple areas throughout the facility that are reserved to store equipment 

and conduct RP tasks. The RP function has assigned laboratories and storage rooms for 

evaluating surveys, conducting isotopic analysis, storing equipment, and keeping records. 

Real-time monitoring of the facility is maintained at these locations through visual displays of 

alarms and readouts of radiation sensors throughout the facility. Near the egress point for the 

radiological control area is a room designated for decontamination, which contains monitors, 

shower and sinks, and first aid equipment. In addition, a technical support building contains the 

respiratory protection equipment, clean PPE, and a locker room storage area. 

The instrumentation program contains a wide variety of sensors and equipment, which are 

maintained by the RP function in accordance with written procedures and applicable standards. 

The MFFF reserves space and resources for the RP function to conduct its responsibilities. The 

NRC staff finds that the applicant’s instrumentation program provides reasonable assurance of 

compliance with 10 CFR § 20.1501, “General,” and the acceptance criteria in NUREG-1718, 

Section 9.2.4.11 (NRC, 2000). 

9.3.13 Additional Program Commitments 

MOX Services has a records program for tracking key aspects of the RP program such as, 

radiation surveys, results of corrective action program referrals, RWPs, and planned special 

exposures. These records will be maintained in accordance with the facility’s document control 

program, described in Section 15 of the LA (MOX, 2010a). 

The facility’s corrective action program is implemented when an individual’s exposure or uptake 

exceeds the administrative limits. An internal report is initiated in accordance with procedures 

to ensure that the cause of the exposure is identified and corrective actions are properly 

implemented. Also, when a CAM setpoint is exceeded, the alarms are recorded remotely so 

that the process can be terminated and corrective actions implemented. Contamination 

surveys, investigations, corrective actions, and reviews (along with deficiencies) are 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

9 - 14

documented. The RP organization reviews this documentation for possible trends and to 

ensure proper implementation of the corrective actions. 

The applicant will report to the NRC any event that results in an occupational exposure to 

radiation exceeding the dose limits in 10 CFR Part 20, within the time specified in 10 CFR § 

20.2202, 10 CFR § 30.50, 10 CFR § 40.60, and 10 CFR § 70.74. The applicant will prepare 

and submit to the NRC an annual report of the results of individual monitoring, as required by 

10 CFR § 20.2206(b). The applicant will refer to the facility’s corrective action program any 

radiation incident that results in an occupational exposure that exceeds the dose limits in 

10 CFR Part 20, Appendix B, or that is required to be reported by 10 CFR § 30.50, 10 CFR § 

40.60, and 10 CFR § 70.74, and will report to the NRC both the corrective actions taken (or 

planned) to protect against a recurrence and the proposed schedule to achieve compliance. 

The NRC staff finds that the applicant’s records retention and reporting program provides 

reasonable assurance of compliance with 10 CFR Part 20, Subpart L, “Records,” and 

Subpart M, “Reports,” and the acceptance criteria in NUREG-1718, Section 9.2.4.12 (NRC, 

2000). 

9.4 Evaluation Findings

The staff reviewed the LA for the MFFF to possess and use SNM in accordance with Section 9 

of NUREG-1718 (NRC, 2000). 

The applicant’s RP program includes the following: 

• an effective, documented program to ensure that occupational radiological exposures 

are ALARA 

• an organization with adequate qualification requirements for the radiation safety 

personnel 

• approved written radiation protection procedures or RWPs for radiation protection 

activities 

• radiation safety training for all personnel who have access to restricted areas 

• requirements for an air sampling program 

• control of radiological contamination within the facility 

• a respiratory protection program 

• requirements for radiological measurement instrumentation 

• a program for monitoring the external and internal radiation exposure of personnel 

Conformance to this program should ensure safe operation and provide early detection of 

unfavorable trends to allow prompt corrective action. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

9 - 15

The NRC staff concludes, with reasonable assurance, that the applicant’s RP program is 

adequate and that the applicant has the necessary technical staff to administer an effective RP 

program that meets the requirements of 10 CFR Parts 19, 20, and 70 for a license to possess 

and use SNM. 

9.5 Exemption Request for Radiation Labeling

The applicant requested an exemption from the labeling requirements of 10 CFR § 20.1904(a) 

(DCS, 2006). 

The regulation in 10 CFR 20.1904(a) requires that each individual container of licensed material 

bear a label indicating that it contains radioactive material and identifying certain specific 

information about the contents to enable individuals handling or using the containers, or working 

in their vicinity, to take precautions to avoid or minimize exposures. 

In certain circumstances, it would be impractical for the applicant to mark individual containers 

to meet the labeling requirements (e.g., pellet boats in the sintering furnace). In lieu of labeling 

each container, the applicant stated that it would post, in restricted areas that house or store 

radioactive material, signs that incorporate the radiation symbol with the warning “Caution 

Radioactive Material: Any Container in This Area May Contain Radioactive Material.” The 

applicant would also post signs at each entrance to a restricted area in which radioactive 

materials are used or stored. 

The posting of areas with containers of radioactive material, coupled with plant personnel who 

are appropriately trained in radiation protection requirements, provides ample protection to 

personnel working at the MFFF and should result in no undue hazard to life or property. The 

NRC has granted similar exemptions to other fuel cycle facilities. 

The regulations in 10 CFR § 20.2301, “Applications for exemptions,” authorizes the NRC to 

grant exemptions from the requirements of 10 CFR Part 20. The requested exemption is 

authorized by law and will not result in undue hazard to life or property. Because of the 

impracticality of labeling each container at the MFFF and because of the appropriate training of 

personnel in radiation protection requirements, the staff agrees to the applicant’s proposal in 

lieu of labeling each container. If granted to the applicant after completion of other regulatory 

requirements in 10 CFR Part 70, the license to possess and use radioactive material will include 

this exemption. 

REFERENCES 

(ANSI/ANS, 1978) American National Standards Institute/American Nuclear Society, 

Standard N323, “Radiation Protection Instrumentation Test and Calibration,” 1978. 

(ANSI/HPS, 1996) American National Standards Institute/Health Physics Society, 

Standard N13.22, “Performance Criteria for Radiobioassay,” 1996. 

(ANSI/HPS, 1995) American National Standards Institute/Health Physics Society, 

Standard N13.22, “Bioassay Programs for Uranium,” 1995. 

(DCS, 2006) Duke Cogema Stone & Webster, “Request for Exemption from Radiation Labeling 

Requirements,” Letter from David Stinson (DCS) to Document Control Desk, Aiken, SC, 

September 27, 2006. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

9 - 16

(MOX, 2010a) Shaw AREVA MOX Services, “Mixed Oxide Fuel Fabrication Facility—License 

Application,” Aiken, SC, March 2010. 

(MOX, 2010b) Shaw AREVA MOX Services (MOX Services). “Mixed Oxide Fuel Fabrication 

Facility Integrated Safety Analysis Summary,” March 2010. 

(NRC, 2005) U.S. Nuclear Regulatory Commission, Regulatory Guide 8.7, Revision 2, 

“Instructions for Recording and Reporting Occupational Radiation Dose Data,” Washington, DC, 

November 2005. 

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” Washington, 

DC, August 2000. 

(NRC, 1992) U.S. Nuclear Regulatory Commission, Regulatory Guide 8.34, “Monitoring Criteria 

and Methods To Calculate Occupational Radiation Doses,” Washington, DC, July 1992. 

(NRC, 1978) U.S. Nuclear Regulatory Commission, Regulatory Guide 8.8, Revision 3, 

“Information Relevant to Ensuring That Occupational Radiation Exposures at Nuclear Power 

Stations Will Be as Low as Is Reasonably Achievable,” Washington, DC, June 1978 

10 CFR Part 19, Notices, Instructions, and Reports to Workers: Inspection and Investigation 

10 CFR Part 20, Standards for Protection Against Radiation 

, 

10 CFR Part 30, Rules of General Applicability to Domestic Licensing of Byproduct Material 

10 CFR Part 40, Domestic Licensing of Source Material 

10 CFR Part 70, Domestic Licensing of Special Nuclear Material 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

10 - 1

10.0 ENVIRONMENTAL PROTECTION 

10.1 Regulatory Requirements

This chapter of the safety evaluation report (SER) contains the U.S. Nuclear Regulatory 

Commission (NRC) staff’s review of environmental protection measures described by the 

applicant in Chapter 10 of its March 2010 revision of its mixed oxide (MOX) fuel fabrication 

facility (MFFF) license application (LA) (MOX, 2010a) to possess and use radioactive material. 

As noted in Chapter 1 of this SER, the MFFF is located in the F-Area of the U.S. Department of 

Energy’s (DOE’s) Savannah River Site (SRS). The staff evaluated the information provided by 

the applicant for environmental protection by reviewing Chapter 10 and other sections of the LA 

and supplementary information provided by the applicant. In some cases, the staff also 

performed independent calculations. 

To be considered acceptable, the applicant must satisfy the following regulatory 

requirements regarding environmental protection: 

• Title 10 of the Code of Federal Regulations (10 CFR) Section 20.1101(b), “Radiation 

protection program,, states that “the licensee shall use, to the extent practical, 

procedures and engineering controls based on sound radiation protection principles 

to achieve occupational doses and doses to members of the public that are as low as 

reasonably achievable (ALARA). 

• 10 CFR § 20.1301(b), “Dose limits for individual members of the public.” states that, if 

the licensee permits members of the public to have access to controlled areas, the 

limits for members of the public continue to apply to those individuals. 

• 10 CFR § 20.1302(c), “Compliance with dose limits for individual members of the public,” 

states that, upon approval from the Commission, the licensee may adjust the effluent 

concentration values in Appendix B, “Annual Limits on Intake (ALIs) and Derived Air 

Concentrations (DACs) of Radionuclides for Occupational Exposure; Effluent 

Concentrations; Concentrations for Release to Sewerage,” to 10 CFR Part 20, 

“Standards for Protection Against Radiation,” Table 2, for members of the public, to take 

into account the actual physical and chemical characteristics of the effluents 

(e.g., aerosol size and distribution, solubility, density, radioactive decay equilibrium, 

chemical form). 

 

• 10 CFR § 70.61(b)(2), “Performance requirements” states, in part, that the risk of 

credible high-consequence events must be limited by engineered or administrative 

controls or both. Under that section, high-consequence events are those internally or 

externally initiated events that result in an acute dose of 0.25 sieverts (Sv) (25 rem) or 

greater total effective dose equivalent (TEDE) to any individual located outside the 

controlled area. The controls shall be applied to reduce the likelihood of occurrence of 

the event, so that the event is highly unlikely or its consequences are less severe than 

the acute TEDE stated above. 

• 10 CFR § 70.61(c)(2) states, in part, that the risk of credible intermediate-consequence 

events must be limited by engineered or administrative controls or both. Under this 

regulation, intermediate-consequence events are those internally or externally 

generated events that result in an acute TEDE of 0.05 Sv (5 rem) or greater to any 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

10 - 2

individual outside the controlled area. The controls shall be applied to reduce the 

likelihood of occurrence of the event, so that the event is unlikely or its consequences 

are less severe than the acute TEDE stated above. 

• 10 CFR § 70.61(c)(3) also states, in part, that the risk of credible intermediateconsequence events must be limited by engineered or administrative controls or both. 

Under this regulation, intermediate-consequence events are those internally or 

externally generated events that result in a 24-hour averaged release of radioactive 

material outside the restricted area in concentrations exceeding 5,000 times the values 

in Table 2 of Appendix B to 10 CFR Part 20. The controls shall be applied to reduce the 

likelihood of occurrence of the event, so that the event is unlikely or its consequences 

are less severe than the concentration values stated above. 

10.2 Regulatory Acceptance Criteria

Section 10.4 of NUREG-1718, “Standard Review Plan for the Review of an Application for a 

Mixed Oxide (MOX) Fuel Fabrication Facility” (NRC, 2000), provides the acceptance criteria for 

the NRC’s review of the applicant’s environmental protection program and was used as 

guidance for the staff’s review. 

10.3 Staff Review and Analysis

In its LA, the applicant described its commitment to environmental protection in three areas: 

(1) radiation safety goals (ALARA) for effluent control and waste minimization, (2) design of 

effluent and environmental monitoring for normal and off-normal operations, and 

(3) environmental surveillances to monitor the environmental impact from operations during 

normal and off-normal operations. The staff evaluated information provided by the applicant on 

ALARA goals and effluent, environmental monitoring programs, and environmental 

surveillances. 

10.3.1 Radiation Safety 

The staff evaluated the applicant’s radiation safety measures for environmental protection, 

including the applicant’s goals and controls to maintain public doses ALARA, in accordance 

with 10 CFR § 20.1101, “Radiation protection programs,” as well as the applicant’s practices 

to minimize not only the contamination of the facility and the environment but also the 

generation of radioactive waste. As noted in Chapter 9 of this SER, the goals of the ALARA 

program include maintaining occupational exposures, as well as environmental releases, as 

far below regulatory limits as is reasonably achievable. This is to ensure the health and 

safety of workers and the public located outside the restricted area boundary (RAB) and to 

protect the environment. 

10.3.1.1 ALARA Design Goals for Effluent Control 

Gas Effluent ALARA Goals

The applicant defined ALARA design goals for effluent control in Section 10.1.1 of its LA. The 

first goal is for airborne radioactive effluents released from the MFFF. This goal is not to exceed 

20 percent of the effluent concentration limits in 10 CFR Part 20, Appendix B, Table 2, 

Column 1, as determined at the MFFF RAB. This fraction is consistent with staff expectations 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

10 - 3

that an initial goal of 10 to 20 percent or less of the values in Appendix B to 10 CFR Part 20 can 

be achieved by almost all materials facility licensees, as stated in Regulatory Guide 8.37, 

“ALARA Levels for Effluents from Materials Facilities,” (NRC, 1993). 

The applicant has also committed to a dose limit for an individual member of the public in the 

unrestricted area likely to receive the highest dose from the facility. This goal is 0.01 

millisieverts (1 millirem (mrem)) per year TEDE, which is well below the 10-mrem constraint on 

air emissions specified in 10 CFR § 20.1101(d). This fraction is consistent with staff 

expectations for an initial goal of 10 to 20 percent of the 10 CFR Part 20 constraint described 

in NUREG-1718, Section 10.4.3, and, therefore, is acceptable to the staff. 

Liquid Effluent ALARA Goals

The applicant has not defined liquid effluent ALARA goals, because the MFFF will not discharge 

liquid effluent directly to the environment. This is acceptable because the applicant’s proposal 

is to transfer low-level waste containing NRC-licensed material from the MFFF to DOE at the 

SRS in a manner consistent with the SRS waste acceptance criteria (WAC). DOE will take 

possession of the liquid waste before it reaches the RAB and is responsible for moving it safely. 

DOE will perform additional treatment before discharging this material. Therefore, DOE would 

manage any discharges of liquid effluent and would subject them to its ALARA considerations. 

10.3.1.2 Air Effluent Controls to Maintain Public Doses ALARA 

The heating, ventilation, and air conditioning (HVAC) system and the off-gas treatment 

ventilation system remove radionuclides and hazardous materials and thus control airborne 

emissions. Airborne waste from MFFF processes is routed through the HVAC system, which 

is designed to handle the expected volume of potentially radioactive waste, compartmentalize 

airborne waste, provide safe shutdown, and achieve an acceptable decontamination factor 

for each radionuclide. Several design features of the HVAC system, which include items 

relied on for safety (IROFS), provide confinement of radioactive materials. Ventilation 

exhaust is passed through multiple banks of filters, including high-efficiency particulate air 

filters. Airborne emissions are monitored and controlled to maintain doses outside the RAB 

ALARA. 

The applicant’s design bases for these systems rely for guidance on NRC Regulatory 

Guide 3.12, “General Design Guide for Ventilation Systems of Plutonium Processing and Fuel 

Fabrication Plants,” issued 1973 (NRC, 1973b), and the American Society of Heating, 

Refrigerating and Air-Conditioning Engineers document, “Design Guide for Department of 

Energy Nuclear Facilities,” issued 1993 (DOE, 1993). 

The staff concludes that the applicant’s commitment to regulatory guides and standards, 

together with the process controls and procedures that augment engineered controls as part 

of its ALARA program, ensures that engineered effluent controls will meet the regulatory 

requirements for capacity, compartmentalization, safe shutdown, and efficiency required 

during normal and likely facility conditions to maintain public doses ALARA; therefore, it is 

consistent with the acceptance criteria in Section 10.4 of NUREG-1718 and is acceptable to 

the staff. 

10.3.1.3 Liquid Effluent Controls to Maintain Public Doses ALARA 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

10 - 4

As noted in Section 10.1.2.2 of the applicant’s LA, the MFFF would not have liquid effluents 

that discharge directly to the environment. Separate systems that have do not interconnect 

collect and manage liquid radioactive and nonradioactive wastes. Radioactive process fluids 

are transferred using gravity flow, air jets, and steam jets, where practical. Drains within the 

radiation control area are routed to the liquid waste system. Liquid radioactive wastes are 

collected in the aqueous liquid waste system or in the solvent liquid waste system and will be 

transferred to DOE facilities on the SRS in a manner consistent with the SRS WAC for 

appropriate storage and disposition by DOE. The staff concludes with reasonable assurance 

that the applicant’s procedures and controls will maintain public doses ALARA, and, therefore, 

are consistent with the acceptance criteria in Section 10.4 of NUREG-1718 and are acceptable 

to the staff. 

10.3.1.4 ALARA Review and Reports to Management 

Sections 9.2.1 and 10.1.3 of the applicant’s LA describe the ALARA program and management 

involvement. MOX Services management receives reports summarizing the ALARA program, 

including trending information, so that it can compare the analytical results to ALARA goals. 

The applicant has committed to a program of measuring trends in environmental monitoring 

and surveillance data against the effluent ALARA goals on a quarterly basis. Abnormal 

increases in the trend of analytical results are reported to MOX Services management as soon 

as practical. ALARA goals are evaluated annually, and new goals are established for the 

following year, as appropriate. In addition, recommendations are made to MOX Services 

senior management, as needed, for changes in facilities and procedures to achieve ALARA 

goals. The staff concludes that the applicant’s review and reporting program is likely to 

maintain ALARA goals and, therefore, is consistent with the acceptance criteria in Section 10.4 

of NUREG-1718 and is acceptable to the staff. 

10.3.1.5 Waste Minimization 

Waste minimization reduces worker and public exposure to radiation and to radioactive and 

hazardous materials. The applicant has provided an overview of its commitment to waste 

minimization practices in Sections 9.1.2.3.3 and 10.1.4 of its LA. The applicant’s proposal for 

incorporating waste minimization practices into the design process focuses on recycling and 

reuse of materials, as well as minimizing the introduction of materials that can become 

contaminated. During operations, the applicant proposes to rely on waste management 

procedures to separate and segregate solid and liquid wastes and remove packaging and 

shipping materials before they enter contaminated areas. 

The applicant will use active and passive confinement systems and vacuum systems inside 

gloveboxes. These systems are designed to allow recycling of materials from the secondary 

waste streams in the aqueous polishing (AP) process and MOX process scraps back to the 

main processes. Specific AP process waste minimization steps include acid recovery, silver 

recovery, and solvent regeneration. Liquid waste is minimized in the AP process by use of 

recycling to the extent practical. For example, nitric acid is recovered by evaporation from 

the process and is partly reused as a reagent feedstock for the plutonium dissolution 

process. 

Waste minimization documentation includes a statement of senior management support and 

identification of management, employees, and organizational responsibilities for waste 

minimization. Waste minimization goals, which are reevaluated annually, will be established 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

10 - 5

based on operational data. Management is informed quarterly of the trends measured against 

waste minimization goals. New goals are established for the upcoming year, as appropriate. 

Recommendations are made to MOX Services senior management, as needed, for changes in 

facilities and procedures to achieve waste minimization goals. The staff concludes that the 

applicant’s waste minimization program is likely to maintain ALARA goals and, therefore, is 

consistent with the acceptance criteria in Section 10.4 of NUREG-1718 and is acceptable to the 

staff. 

10.3.2 Effluent and Environmental Monitoring 

10.3.2.1 Concentrations of Radionuclides in Air Effluents and Public Doses 

In its environmental report, the applicant provided an estimate of maximum radionuclide 

concentrations in the controlled area based on annual releases, a 50-percent atmospheric 

dispersion parameter value (X/Q) of 2.5×10-4 seconds per cubic meter, a distance to a receptor 

from the plant stack of 52 meters (171 feet) , and the assumption that releases occur from 

ground level. This calculation demonstrates that the average concentration in the controlled 

area immediately outside the restricted area would be less than 40 percent of its ALARA goal. 

The staff performed an independent calculation using the methodology described in Report 123, 

“Screening Models for Releases of Radionuclides to Atmosphere, Surface Water and Ground, 

Recommendations of the National Council on Radiation Protection and Measurements of the 

National Council on Radiation Protection and Measurements,” dated January 22, 1996 (NCR, 

1996), as described in NUREG-1718. In its calculation, the staff assumed a 28-meter (92 feet) 

stack height, no plume rise, a site-specific 3.6 meter per second annual average windspeed, 

and a wind direction toward an individual member of the public 100 percent of the time. The 

staff’s estimate of the X/Q is 5×10-5 seconds per cubic meter at a distance of 400 meters (1312 

feet). The staff’s calculation demonstrates that the concentration in the controlled area would 

be less than 10 percent of the applicant’s ALARA goal. 

The applicant’s estimate of the maximum potential dose to an individual member of the public in 

the unrestricted area is 4.1×10-6 millesieverts (4.1×10-4 mrem) per year. The staff performed 

independent analyses using GENII, the Hanford Environmental Radiation Dosimetry software 

system. The staff’s result is 2.5×10-6 millisieverts (2.5×10-4 mrem) per year, which closely 

agrees with the applicant’s value, well below the design ALARA goal. Both the applicant’s and 

the staff’s dose estimates to the public are less than a .01 microsieverts (1 microrem) per year. 

Based on the staff’s independent calculation, the known or expected concentrations of 

radioactive material in airborne effluents from the MFFF would be well below the limits in 

10 CFR Part 20, Appendix B, Table 2, and, therefore, are consistent with the acceptance criteria 

in Section 10.4 of NUREG-1718 and are acceptable to the staff. 

10.3.2.2 Physical and Chemical Characteristics of Radionuclides in Discharges 

With regard to the provisions of 10 CFR § 20.1302(c), the applicant does not propose to adjust 

the effluent concentration values that appear in 10 CFR Part 20, Appendix B, Table 2, for 

members of the public, by taking into account the actual physical and chemical characteristics of 

the effluents (e.g., aerosol size distribution, solubility, density, radioactive decay equilibrium, 

chemical form). This is because the applicant demonstrated compliance with the annual dose 

limit of 10 CFR § 20.1301, “Dose Limits for Individual Members of the Public,” by using the dose 

methodology in 10 CFR § 20.1302(b)(1), and not by using the concentration-based 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

10 - 6

methodology in 10 CFR § 20.1302(b)(2). The applicant’s approach is consistent with the 

requirements of 10 CFR Part 20 and, therefore, is acceptable to the staff. 

10.3.2.3 Air Effluent Discharge Location and Effluent Monitoring 

In Section 10.2.1 of its LA, the applicant identified the facility stack located on the roof of the 

MOX process building as the discharge location for radioactive air effluents from the MFFF. 

This stack is 28 meters (92 feet) tall and would discharge up to approximately 5,720 Cubic 

meters (202,000) cubic feet per minute of air during normal operations. The applicant has 

committed in the LA to the use of two redundant continuous air monitors and two fixed samplers 

of airborne particulate matter to monitor MFFF air effluent. The applicant has also committed in 

the LA to separately quantify the contributions from the AP and MOX processes, using two 

additional continuous air monitors, before the two streams are commingled and discharged from 

the single stack. The applicant will also sample air effluent contributions from areas not used for 

processing special nuclear material. 

Based on Regulatory Guide 4.16, “Monitoring and Reporting Radioactivity in Releases of 

Radioactive Materials in Liquid and Gaseous Effluents from Nuclear Fuel Processing and 

Fabrication Plants and Uranium Hexafluoride Production Plants,” Revision 1, issued 

December 1985 (NRC, 1985), particulate effluent from the stack would be collected 

continuously during operations to determine quantities and average concentrations of 

principal radionuclides that would be released. Table 10.2-2 of the applicant’s LA identifies 

the analytical methodologies used to characterize airborne emissions (e.g., liquid scintillation, 

alpha spectrometer). 

The staff finds that these commitments are consistent with the regulatory requirements for 

10 CFR § 20.1302(a) and the staff’s review guidance in Section 10.4 of NUREG-1718 and, 

therefore, are acceptable to the staff. 

10.3.2.4 Liquid Effluent Discharge Location and Effluent Monitoring 

The MFFF does not discharge radioactive liquid to the environment during normal or 

off-normal operations. The aqueous or solvent liquid waste systems collect the liquid 

radioactive waste and transfer it to the DOE SRS for disposition. Tanks used for storage of 

radioactive material are located inside the MFFF buildings and are equipped with drip pans 

and leak detection. 

10.3.2.5 Environmental Monitoring Program 

Preoperational and operational environmental monitoring activities determine baseline 

values and assess the environmental impact of licensed activities of the MFFF. As 

noted above, the MFFF would not discharge radioactive nuclides directly to the aquatic 

environment. Thus, environmental surveillances will focus on potential airborne 

radiological releases. 

Preoperational Environmental Monitoring Program

The MFFF preoperational monitoring program, which begins 2 years before facility operations 

start, is based on the data collected over several years at the SRS and additional data collected 

by the applicant. The objectives of the environmental preoperational monitoring program are to 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

10 - 7

establish a baseline of existing radiological and biological conditions at or near the MFFF site; 

evaluate procedures, equipment, and techniques used in the collection and analysis of 

environmental data; and train personnel in their use. 

The applicant will take direct radiation measurements and samples of air, soil, and vegetation 

with analyses for uranium and plutonium and other radionuclides of interest. These activities 

will establish a baseline for isotopic composition and concentrations that will then be compared 

to results from operational environmental surveillances. The applicant’s LA Table 10.3-1 

identifies preoperational airborne monitoring locations, frequency of sampling, collection 

methodology, and radionuclide analyses. 

The applicant’s LA Table 10.3-2 contains an analysis of the lower limits of detection for various 

radionuclides. Sufficient volumes of samples (e.g., rainwater) are to be collected to ensure the 

attainment of lower limit of detection thresholds in the analysis. 

Preoperational terrestrial sampling and analysis will provide a comprehensive baseline of 

radiological conditions related to the deposition of airborne emissions in the environs (including 

water bodies and sediment) of the MFFF. 

Operational Environmental Monitoring Program

The applicant’s operational monitoring program will be similar to its preoperational monitoring 

program. However, locations and sampling frequency for air, water, and terrestrial sampling 

and analysis may be altered, based on results from preoperational or operational emissions 

monitoring. 

To ensure that the regulatory limits for doses to the public found in 10 CFR § 20.1301 are not 

exceeded, MOX Services has established administrative limits and action levels, as shown in 

Table 10.3-9 of the LA. If an action level is exceeded for sampling, the applicant would 

investigate to determine the source of elevated activity. As noted above, emissions data are 

trended as an analytical tool. Based on the operating history and trending analyses of the 

facility and operating data, the applicant would adjust operational data and sampling and 

analysis programs, as necessary. 

Quality Control

Analytical quality control, addressed by the applicant in Section 10.3.7 of its LA, is described in 

laboratory procedures and is consistent with Chapter 15 of the LA. Analytical procedures are 

consistent with national or international consensus standards, or their performance is equivalent 

or superior to such methods. Analytical instrumentation is standardized and calibrated in 

accordance with the manufacturers’ recommendations. Calibration standards are traceable to 

the National Institute of Standards and Technology. 

The applicant’s preoperational and operational environmental surveillance programs are 

consistent with applicable regulatory criteria and the staff’s review guidance in Section 10.4.3 

of NUREG-1718 and, therefore, are acceptable to the staff. 

10.3.2.6 Consequence Assessment Methodologies 

In its safety assessment, the applicant calculated committed doses to individuals outside the 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

10 - 8

controlled area (i.e., the public) and concentrations of radioactive material in the environment 

outside the restricted area from each postulated accident to demonstrate that risks from event 

consequences were reduced to acceptable levels. The consequence assessment methodology 

used by the applicant for dose consequences at the controlled area boundary is the same 

methodology used for the site worker, as described in Chapter 9.0 of this SER, with the 

exception of the value of the atmospheric dispersion factor. The atmospheric dispersion factor 

that the applicant derived for the distance from the MFFF to the controlled area boundary is 

3.7×10-6 seconds per cubic meter. The staff confirmed this value using MACCS2 and sitespecific meteorological data and found it acceptable. 

The RAB is approximately 52 meters (171 feet) from the MFFF discharge stack. The 

atmospheric dispersion factor that the applicant derived for this location is 8.39×10-4 seconds 

per cubic meter. The applicant also derived an atmospheric dispersion factor for the secured 

warehouse, which contains stocks of depleted uranium. This value is 2.71×10-3 seconds per 

cubic meter, based on a distance from the warehouse to the RAB of approximately 28 meters. 

As a result, the equation used to calculate environmental consequences is 

[EC]x

 = {[Source Term/RF] × [X/Q]RA × [f]x}/(3600 s hr-1 × 24 hr), 

where source term is the same as described in Chapter 9.0 of this SER, RF is the respirable 

fraction (which is divided back into the source term to negate the reduction applied for 

consequence source terms), the value for “f” is the specific activity and the fraction of the total 

quantity of the material at risk; that is, the radionuclide X, and [X/Q]RA is the value of the 

atmospheric dispersion factor for either the MFFF stack or the secured warehouse, as 

described above. 

The use of this equation is consistent with the staff’s guidance in NUREG/CR-6410, “Nuclear 

Fuel Cycle Facility Accident Analysis Handbook,” issued March 1998 (NRC, 1998), and the 

regulations in 10 CFR § 70.61(c)(3) and, therefore, is acceptable to the staff. 

10.3.3 Integrated Safety Analysis Summary 

In its Integrated Safety Analysis (ISA) Summary (MOX, 2010b), the applicant identified various 

sequences for radiological and nonradiological accidents, which were then evaluated to ensure 

adequate protection of worker health and safety. Protecting the worker by ensuring that all 

credible high-consequence events within the controlled area are rendered highly unlikely and 

that all the intermediate-consequence events within the controlled are rendered unlikely would 

also ensure that the environmental performance requirements in 10 CFR § 70.61(c)(3) for the 

area outside the controlled area would be met. The staff determined that adverse 

environmental consequences could occur only if unmitigated intermediate- or high-consequence 

events were also present. Because all such events were mitigated, the staff did not identify any 

accident sequences that would fail to meet the environmental performance requirements. 

In Chapter 5 of the LA, the applicant presents the mitigated bounding-event consequences for 

the five major categories of events: fire, explosion, loss of confinement, load-handling events, 

and criticality. In Chapter 5 of this SER, the staff evaluates the applicant’s ISA Summary and 

documents its conclusion that the ISA Summary is complete, provides reasonable estimates of 

the likelihood and consequences of each accident sequence, and provides sufficient information 

to determine whether the applicant identified adequate engineering or administrative controls for 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

10 - 9

each accident sequence. In its review of Chapter 15 of the LA, the staff evaluated the 

management measures used to ensure that the IROFS would adequately perform their intended 

safety functions. The applicant mitigated each event by employing various IROFS, which can 

be in the form of active or passive engineered controls or administrative controls. After it 

employed the IROFS to mitigate the consequences of the bounding events, the applicant 

determined that the occurrence of each bounding event was highly unlikely or unlikely, as 

required. This, in turn, resulted in a determination, under 10 CFR 70.61(c)(3), that the 

environmental performance requirements would be met. Thus, there would be no significant 

adverse environmental impact beyond the controlled area from the bounding events identified 

above. 

Based on the use of IROFS, the implementation of management measures, and quality 

assurance, the staff finds that the applicant’s methodology of public consequence analysis and 

environmental consequence determination is acceptable. 

10.4 Evaluation Findings

The NRC staff issued a final environmental impact statement in January 2005 for this licensing 

action, as required by 10 CFR § 51.20, “Criteria for and Identification of Licensing and 

Regulatory Actions Requiring Environmental Impact Statements.” After weighing the 

environmental impacts of the proposed operation of the MFFF, the NRC staff recommended, in 

the final environmental impact statement, that, unless safety issues mandated otherwise, the 

proposed license be issued to MOX Services. 

The applicant has developed a program to implement adequate environmental protection 

measures during operation. These measures include (1) environmental and effluent monitoring 

and (2) effluent controls to maintain doses to the public ALARA as part of the radiation 

protection program. The NRC staff concludes that the applicant’s program, as described in its 

application and environmental report, is adequate to protect the environment and the health and 

safety of the public and complies with regulatory requirements imposed by the Commission in 

10 CFR Part 20; “Standards for Protection Against Radiation”, 10 CFR Part 30, “Rules of 

General Applicability to Domestic Licensing of Byproduct Material”; 10 CFR Part 40, “Domestic 

Licensing of Source Material”; 10 CFR Part 51, “Environmental Protection Regulations for 

Domestic Licensing and Related Regulatory Functions”; and 10 CFR Part 70, “Domestic 

Licensing of Special Nuclear Material.” 

REFERENCES 

(DOE, 1993) American Society of Heating, Refrigerating and Air-Conditioning Engineers, 

“Design Guide for Department of Energy Nuclear Facilities,” U.S. Department of Energy, 

Washington, DC, 1993. 

(NCRP 1996) National Council on Radiation Protection and Measurements, Report No. 123, 

“Screening Models for Releases of Radionuclides to Atmosphere, Surface Water and Ground, 

Recommendations of the National Council on Radiation Protection and Measurements,” 

Bethesda, MD, January 22, 1996. 

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan 

for the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” 

Washington, DC, August 2000. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

10 - 10

(NRC, 2005) U.S. Nuclear Regulatory Commission, NUREG-1767, “Environmental Impact 

Statement for Construction and Operation of a Proposed Mixed Oxide Fuel Fabrication Facility 

at the Savannah River Site, South Carolina,” Washington, DC, January 2005. 

(NRC, 1990) U.S. Nuclear Regulatory Commission, NUREG/CR-4691, “MELCOR 

Accident Consequence Code System (MACCS),” Washington, DC, February 1990. 

(NRC, 1998) U.S. Nuclear Regulatory Commission, NUREG/CR-6410, “Nuclear Fuel Cycle 

Facility Accident Analysis Handbook,” Washington, DC, March 1998. 

(NRC, 1973a) U.S. Nuclear Regulatory Commission, Regulatory Guide 3.12, “General Design 

Guide for Ventilation Systems of Plutonium Processing and Fuel Fabrication Plants,” 

Washington, DC, 1973. 

(NRC, 1985) U.S. Nuclear Regulatory Commission, Regulatory Guide 4.16, “Monitoring and 

Reporting Radioactivity in Releases of Radioactive Materials in Liquid and Gaseous Effluents 

from Nuclear Fuel Processing and Fabrication Plants and Uranium Hexafluoride Production 

Plants,” Revision 1, Washington DC, December 1985. 

(NRC, 1973b) U.S. Nuclear Regulatory Commission, Regulatory Guide 8.37, “ALARA Levels for 

Effluents from Materials Facilities,” Washington, DC, 1973. 

(MOX, 2010a) Shaw AREVA MOX Services, “Mixed Oxide Fuel Fabrication Facility License 

Application,” Aiken, SC, March 2010. 

(MOX, 2010b) Shaw AREVA MOX Services, “Mixed Oxide Fuel Fabrication Facility Integrated 

Safety Analysis Summary,” Aiken, SC, March 2010. 

10 CFR Part 20; Standards for Protection Against Radiation. 

10 CFR Part 30, “Rules of General Applicability to Domestic Licensing of Byproduct Material”. 

10 CFR Part 40, “Domestic Licensing of Source Material”. 

10 CFR Part 51, “Environmental Protection Regulations for Domestic Licensing and Related 

Regulatory Functions”. 

10 CFR Part 70, “Domestic Licensing of Special Nuclear Material”. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 1

11.0 PLANT SYSTEMS

11.1 Mixed Oxide Process Description

The mixed oxide (MOX) fuel fabrication process consists of four major steps: (1) powder master 

blend and final blend production, (2) pellet production, (3) fuel rod production, and (4) fuel 

assembly production. The first operation is the production of the powder master blend. 

Polished plutonium dioxide (PuO2) is mixed with depleted uranium dioxide (DUO2) and recycled 

powder/pellet material to produce an initial mixture that is approximately 20 percent plutonium. 

This mixture is subjected to micronization in a ball mill and mixed with additional DUO2 and 

recycled material to produce a final blend with the required plutonium content (typically between 

2 and 6 percent). This final blend is further homogenized to meet plutonium distribution 

requirements. During the final homogenizing steps, a lubricant and pore-former are added to 

control density. The final homogenized powder blend is pressed to form green pellets, which 

are then sintered to obtain the required ceramic qualities. The sintering step removes organic 

products dispersed in the pellets and the previously introduced pore-former. The sintered 

pellets are ground to a specified diameter in centerless grinding machines and sorted. Powder 

recovered from grinding and discarded pellets are recycled through a ball mill and reused in the 

powder processing. 

Fuel rods are loaded to an adjusted pellet column length, pressurized with helium, welded, and 

then decontaminated. The decontaminated rods are removed from the gloveboxes and placed 

on racks for inspection and assembly. Fuel rods are inserted into the fuel assembly skeleton, 

and the fuel assembly construction is completed. Each fuel assembly is subjected to a final 

inspection before shipment in a U.S. Department of Energy (DOE) fresh fuel shipping cask. 

11.1.1 Conduct of Review 

This section of the safety evaluation report (SER) contains the U.S. Nuclear Regulatory 

Commission (NRC) staff’s review of the applicant’s (i.e., MOX Services) description of the safety 

of the MOX process (MP), which is contained in Section 11.1 of the license application (LA) 

(MOX, 2010a), with supporting process safety information from Chapters 5, 8, and 11 of the LA 

and Section 4.1 of the Integrated Safety Analysis (ISA) Summary (MOX, 2010b). The objective 

of this review is to determine whether the chemical process items relied on for safety (IROFS) 

and their design bases provide reasonable assurance of protection against natural phenomena 

and the consequences of potential accidents. The staff coordinated its review of MP safety 

design bases and strategies with the review of the radiation and chemical safety aspects of 

accident sequences described in the safety assessment of the design bases (see Chapter 5 of 

this SER), the review of fire safety aspects (see Chapter 7 of this SER), and the review of plant 

systems (see Chapter 11 of this SER). 

The staff evaluated the MP process and chemistry information in the LA and ISA Summary 

against Title 10 of the Code of Federal Regulations (10 CFR) 70.64, “Requirements for New 

Facilities or New Processes at Existing Facilities,” which requires that the design of new 

facilities or new processes at existing facilities incorporate baseline design criteria (BDC) and 

defense-in-depth practices. With respect to chemical protection, 10 CFR 70.64(a)(5) requires 

that the MOX fuel fabrication facility (MFFF) design provide for adequate protection against 

chemical risks produced from licensed material, facility conditions which affect the safety of 

licensed material, and hazardous chemicals produced from licensed material. Related to 

chemical protection, 10 CFR 70.64(a)(3) requires that the facility design provide for adequate 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 2

protection against fires and explosions, such as those that could be initiated by or involve 

chemicals at the facility. 

The review of the LA and ISA Summary focused on the design basis of chemical process 

IROFS, their components, and other related information. For each IROFS, the staff reviewed 

information provided by the applicant for the safety function, system description, and safety 

analysis. The review also included other design-basis considerations, such as redundancy, 

independence, reliability, and quality. The staff used Chapters 7.0 and 8.0 of NUREG-1718, 

“Standard Review Plan for the Review of an Application for a Mixed Oxide (MOX) Fuel 

Fabrication Facility,” issued August 2000 (NRC, 2000), as guidance in performing the review. 

As stated in the memorandum of understanding (MOU) between the NRC and the Occupational 

Safety and Health Administration entitled, “Worker Protection at NRC-Licensed Facilities” 

(Volume 53, Number 210, of the Federal Register dated October 31, 1998, pages 43950–

43951), the NRC oversees chemical safety issues related to (1) radiation risk produced by 

radioactive materials, (2) chemical risk produced by radioactive materials, and (3) plant 

conditions that affect the safety and safe handling of radioactive materials. These types of 

chemical safety issues represent an increased radiation risk to the workers. However, the NRC 

does not oversee facility conditions that result in an occupational risk but do not affect the safe 

use of licensed material. The NRC has codified the MOU provisions applicable to the MFFF in 

10 CFR 70.64(a)(5). 

The NRC staff reviewed the following areas of the LA and ISA Summary applicable to process 

safety: 

• MP description 

• hazardous chemicals and potential interactions affecting licensed materials 

• MP accident sequences 

• MP chemical accident consequences 

• MP safety controls 

The staff also reviewed, as necessary, additional documentation from the applicant, responses 

to requests for additional information, and the open literature to understand the process and 

safety requirements. The following sections present the staff’s detailed evaluation of the MP. 

11.1.1.1 System Description of the MOX Process 

This section provides a description and overview of the MP, which includes design, operational, 

and process flow information. 

The MP area receives polished PuO2 from the aqueous polishing (AP) process, DUO2, and the 

required components for assembling light-water reactor MOX fuel assemblies. The process 

mixes the plutonium and uranium oxides to form MOX fuel pellets. The pellets are loaded into 

fuel rods, which are then assembled into MOX fuel assemblies for use in commercial reactors. 

The MP area is designed to process up to 87 metric tons of heavy metal (uranium and 

plutonium) annually. 

The MFFF uses the Advanced Micronized Master blend (A-MIMAS) process for manufacturing 

MOX fuel assemblies. A-MIMAS represents the latest evolution of the successive MIMAS 

fabrication processes, adopted by BELGONUCLEAIRE and COGEMA, to produce MOX fuel 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 3

pellets. A-MIMAS uses a two-step mixing process. In the first step, the PuO2 powder is mixed 

with DUO2 and recycled scrap powder (from pellets that were out of dimensional specifications) 

to form a primary blend (master blend) with a nominal PuO2 content of 20 percent of the total 

mass. This mix is then micronized. In the second step, the primary blend is forced through a 

sieve and poured into a jar and mixed with DUO2 and recycled scrap powder to obtain the final 

blend with the specified plutonium content. The maximum PuO2 content in the final blend is 

nominally 6 percent of the total mass. The two-step mixing process is used to ensure a 

consistent product. 

The MP consists of five process areas divided into individual process units or systems. This 

section of the SER also describes the associated waste process units and the canning and 

sample pneumatic transfer systems used to move materials between process units. 

Primary

Dosing

Ball milling

Final

Dosing

Homogeneizing

Pelletizing

Sintering

Grinding

Pellet

Sorting &

Inspection

Rod

Cladding

Scrap

Processing

Rod

Inspection

Assembly

Inspection

MOX FA's

Recycled PuO scrap UO2 2

Master Mix

(20% Pu)

Final Mix

(2.3 - 6 % Pu)

UO2

POWDER AREA PELLET AREA ROD / ASSEMBLY AREA

Assembly

Mounting

Packaging

Figure 11.1-1 MP process overview 

Receiving Area

This area includes truck unloading, PuO2 container handling, counting, and storage before and 

after transfer to the AP line. The function of the receiving area is to receive, unload, and store 

PuO2 and UO2 powder. The receiving area comprises the following units: 

• UO2 receiving and storage unit 

• UO2 drum emptying unit 

• PuO2 receiving unit 

• PuO2 3013 storage unit 

• PuO2 buffer storage unit 

Powder Area
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 4

This area has equipment for dosing and milling MOX powder at the specified plutonium content 

and properties, final blend homogenizing, and pelletizing. The powder area receives UO2 and 

PuO2 powders and produces a mixture of specific plutonium content suitable for the production 

of MOX fuel pellets. The powder area comprises the following units: 

• PuO2 can receiving and emptying unit 

• primary dosing unit 

• primary blend ball milling unit 

• final dosing unit 

• homogenization and pelletizing units 

• scrap processing unit 

• scrap ball milling unit 

• powder auxiliary unit 

• jar storage and handling unit 

• additives preparation unit 

Pellet Process Area

In this area, MOX pellets are sintered, ground, and sorted. The function of the pellet process 

area is to receive, store, process, and handle fuel pellets. The pellet process area comprises 

the following units: 

• green pellet storage unit 

• sintering units 

• sintered pellet storage unit 

• grinding units 

• ground and sorted pellet storage unit 

• pellet inspection and sorting units 

• quality control and manual sorting unit 

• scrap box loading unit 

• pellet repackaging unit 

• scrap pellet storage unit 

• pellet handing unit 

Fuel Rod Process Area

In this area, pellets are loaded into rods and the rods are inspected. The function of the fuel rod 

process area is to assemble, inspect, and store fuel rods. The fuel rod process area comprises 

the following units: 

• rod cladding and decontamination unit 

• rod tray loading unit 

• rod storage unit 

• rod tray handling unit 

• helium leak test unit 

• x-ray inspection unit 

• rod scanning unit 

• rod inspection and sorting unit 

• rod decladding unit 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 5

Assembly Area

In this area, rods are loaded into assemblies and the assemblies are inspected and stored. The 

functions of the assembly area are to receive fuel rods and the required fuel assembly 

components and to assemble, inspect, and store completed MOX fuel assemblies. The 

assembly area comprises the following units: 

• assembly mockup loading unit 

• assembly mounting unit 

• assembly dry cleaning unit 

• assembly dimensional inspection unit 

• assembly final inspection unit 

• assembly handling and storage unit 

• reserve pit unit 

• assembly packaging unit 

Waste Area

In this area, solid radioactive waste generated during the MP is processed, stored, and 

packaged for shipment. The waste area comprises the following units: 

• filter dismantling unit 

• maintenance and mechanical dismantling unit 

• waste storage unit 

• waste nuclear counting unit 

Pneumatic Transfer Systems

The MP design includes pneumatic transfer systems to move materials between certain 

processing units and between process units and the laboratory. A pneumatic transfer system is 

also provided within the laboratory. The pneumatic transfer systems include the following: 

• can pneumatic transfer system 

• sample pneumatic transfer system 

Section 11.1 of the LA (MOX, 2010a) and Section 4.1 of the ISA Summary (MOX, 2010b) 

provide a detailed description of the main units. 

11.1.1.2 Staff Review of MOX Process Safety 

11.1.1.2.1 Potential Depleted Uranium Dioxide Pyrophoricity and Burnback Concerns 

The MP will blend the DUO2 powder with the PuO2 to form the matrix for the MOX fuel. Other 

nuclear fuel fabrication facilities handle UO2 powder. The staff review noted a potential concern 

regarding the pyrophoric nature (sometimes referred to as burnback) of some fine UO2 powders 

that can result in oxidation, damage to equipment (essentially a thermal oxidation and heating 

effect), and a potential release path resulting from the damage of confinement and filter systems 

(NRC, 1992). This is a known hazard; such rapid oxidations have occurred in NRC-licensed 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 6

facilities. Those events involved burnback reactions that started in process equipment, causing 

localized damage, and then spread through the ventilation system. After those events, relatively 

large quantities of UO2 powders were found on the damaged filters and equipment, including 

polycarbonate barriers and filters (prefilters and primary high-efficiency particulate air (HEPA) 

filters). The ventilation system carried the hot UO2 particles to the filters, where a combination 

of the hot particles and continued oxidation reactions damaged the HEPA filters. The health 

consequences of those events were low because of rapid response by personnel and the low 

(relative to plutonium) radiological hazard of uranium. 

The fuel fabrication process generates several oxides of uranium. According to information 

provided in NRC Information Notice 92-14, “Uranium Oxide Fires at Fuel Cycle Facilities,” 

issued February 1992 (NRC, 1992), the final and most stable oxide in the process is UO2. The 

oxidation reactions can be complex, with their rates, heat evolution, and final products 

dependent on several parameters, the most important of which are the fineness of the powder 

and the temperature. According to sources cited in NRC Information Notice 92-14 (NRC, 1992), 

normally stable UO2 may be pyrophoric or oxidize rapidly even at room temperatures when in 

very fine powder form (i.e., when specific surface area is greater than 10 square meters per 

gram (m2

/g)). Coarser powders, which are more common, may require elevated temperatures 

(i.e., greater than 300 degrees Celsius) to oxidize. 

The following equation characterizes the typical burnback (oxidation) reaction: 

3UO2 + O2 → U3O8 (11.1.1.2.1-1) 

The staff notes that a number of laboratory studies of uranium ignition have been conducted 

under well-defined boundary conditions. These studies determined that the primary factor 

influencing uranium ignition was the specific surface area of the sample (Stakebake, 1994). 

Based on these studies, a specific surface area equal to 10 m2

/g (which is a condition for 

spontaneous burnback at ambient temperatures) represents a relatively small particle size. The 

applicant indicated that the DUO2 feed to the MP is expected to have a cumulative particle size 

distribution that includes 95 percent of the particles smaller than 100 microns (μm) in diameter 

and the remaining 5 percent between 100 μm and 400 μm in diameter. The applicant further 

indicated that, after ball milling in the MP, the PuO2/DUO2 mix is expected to have a particle size 

distribution between 2 and 10 μm in diameter. As a result, and consistent with previous staff 

positions, the staff assumes that only the DUO2, which has been ball milled which have the 

smaller particle size, are at risk for burnback (NRC, 2005). 

The NRC information notice recognizes that, by the very nature of the fuel manufacturing 

process, unstable uranium powder must be handled, and it recommends that certain preventive 

measures be taken to reduce the potential for fires at licensed facilities. These preventive 

measures include the following: 

• Limit the type of feed to stable powder whenever possible. 

• Store unstable powder in closed metal containers. 

• Replace the combustible components of powder transfer lines and equipment with 

components made of noncombustible materials, to the extent practicable. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 7

• Require an operator to be present when a process is under way and improve visibility 

around vulnerable equipment. 

• Incorporate fire safety of vulnerable equipment into the operator training program, 

including use of portable fire extinguishers. 

• Implement a preventive maintenance program for vulnerable equipment. Periodic 

inspection may alert the operator to telltale signs of overheating. 

The staff reviewed the applicant’s documentation and found the following: 

• The DUO2 is delivered from offsite sources to the secured warehouse building by truck in 

palletized 55-gallon drums. 

•

• Most of the fuel fabrication process operations are conducted within an inert atmosphere 

to eliminate the adverse effects of atmospheric oxygen on the process or fuel. The 

nitrogen system provides a nitrogen atmosphere and ventilation within the gloveboxes 

and UO2 receiving hoppers in the units that handle UO2 powder. 

• During normal operating conditions, most of the MP operations are fully automatic 

(although there are some manual operations) and all are supervised by an operator. 

• Automatic control actions related to prevention of adverse incidents (e.g., accidental 

criticality, load drop, loss of confinement) are implemented through dual, redundant 

safety programmable logic controllers. 

• The fire detection system monitors the units by means of smoke detectors, temperature 

detectors, or both that are located in the processing gloveboxes. Fire detectors are also 

provided external to the gloveboxes in the process rooms. 

• A carbon dioxide fire suppression system provides fire suppression capability in the 

gloveboxes. An automatic, non-halogenated clean agent system protects the process 

rooms. 

• Combustible materials are controlled based on a procedure. 

The staff concludes that a potential pyrophoric reaction or burnback of UO2 cannot be dismissed 

because such a reaction has occurred previously during fine UO2 fuel powder processing. Its 

potential effects upon confinement, such as the entrainment of the potentially hot powder into 

the ventilation system, deposition on filters, and damage to the filters by the hot powder 

particles and continuing oxidation reactions, could potentially impact several units in the MP 

area that handle fine UO2 powder by itself or blended with PuO2. Such a burnback event could 

result in damage to the final HEPA filters and loss of confinement, the release of large quantities 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 8

of uranium oxides (a chemical toxicity concern), the release of plutonium powders from the 

commingled blend, the initiation of other loss of confinement events, such as fires, or some 

combination of these effects. 

However, the applicant indicated that gloveboxes will remain under normal supply ventilation 

(nitrogen for MP gloveboxes). The glovebox very high depressurization (VHD) exhaust HEPA 

filters, the common VHD intermediate filter (high-strength stainless steel roughing filter and 

HEPA filter), and the VHD final filter (roughing filter, high-strength stainless steel or glass fiber 

prefilter, and two HEPA filters) will capture soot generated during the initial stages of the fire. 

The applicant analyzed the effects of elevated temperature on VHD and high-depressurization 

exhaust (HDE) final HEPA filters. The final filter assemblies for the VHD and HDE systems are 

provided with a roughing filter, a high-strength stainless steel or glass fiber prefilter, and two 

stages of HEPA filters. The VHD system is split into the main VHD exhaust and the laboratory 

VHD exhaust. Because significant mixing of the airflow before it enters the final filters results in 

exhaust gas dilution, the inlet temperature to the final HEPA filters of the main VHD exhaust 

system and the laboratory VHD exhaust system must remain within the HEPA filter temperature 

limit of 400 degrees Fahrenheit. 

The staff finds the design-basis information associated with the ventilation system and final 

filtration units to be sufficient to address the potential burnback phenomena associated with the 

pyrophoric nature of some UO2 powders. The applicant’s proposed operating modes and 

controls are consistent with guidance provided in NRC Information Notice 92-14 (NRC, 1992). 

11.1.1.2.2 Potential Plutonium Dioxide Heating Effects 

The staff has reviewed the plutonium handling areas for potential chemical safety concerns. 

The staff’s review during the construction authorization request stage noted concerns related to 

the potential heat generation by the PuO2 (NRC, 2005). 

The power output of reactor-produced 239Pu metal is usually in the range of 2 to 10 watts per 

kilogram (W/kg) (DOE, 1994). 

Section 4.2 of the ISA Summary (MOX, 2010b) provides information on isotopic distribution in 

the alternate feedstock (AFS) and pit disassembly and conversion facility/advanced recovery 

and integrated extraction system (PDCF/ARIES) feeds to the AP process. 

 

 

The applicant identified the specific heat loads for plutonium as follows: 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 9

Using values from the literature (DOE, 1994), the staff estimates heat loads of , 

based on unpolished PuO2 feed material, depending on the isotopic ranges used. Heat loads 

would be less for polished PuO2 because the americium would have been removed. These 

values generally overlap the applicant’s heat load estimates. Thus, the staff finds the 

applicant’s values to be reasonable. 

The HDE system provides ventilation to the plutonium storage areas to maintain the 

environmental conditions in the rooms at acceptable levels. 

The HDE system consists of ductwork, dampers, fans, and filters that are required to exhaust air 

from the C3 and certain C2 confinement zones in both the AP and MP buildings. The C3 

confinement zones consist primarily of process rooms containing gloveboxes. The C2 zones 

served by the HDE system are those that require reliable ventilation for heat removal and 

include the following: 

• PuO2 (3013 container) storage rooms 

• trains A and B emergency electrical equipment rooms, which include variable frequency 

drives that provide electric power to the VHD, HDE, and process cells depressurization 

exhaust (POE) fans 

• rooms that contain the VHD fans and final filter units 

• HDE exhaust fan rooms 

• POE exhaust fan rooms 

Additional discussions of the confinement system can be found in Section 11.3 of this SER. 

The staff notes that these design bases and approaches are consistent with accepted practice 

for steels (e.g., American Society of Mechanical Engineers), concrete (e.g., American Concrete 

Institute), and most plastics (e.g., Perry, 1997) and finds this approach to be acceptable. 

11.1.1.2.3 Potential Plutonium Dioxide Pyrophoricity and Burnback Concerns 

According to a DOE handbook on pyrophoricity and spontaneous heating (DOE, 1994), large 

pieces of plutonium metal react slowly with the oxygen in air at room temperature to form 

plutonium oxides. The rate of oxidation depends on a number of factors, including 

(1) temperature, (2) surface area of the reacting metal, (3) oxygen concentration, 

(4) concentration of moisture and other vapors in the air, (5) the type and extent of alloying, and 

(6) the presence of a protective oxide layer on the metal surface. The rate of oxidation 

increases with increases in the first four factors and decreases with the last. Alloying can either 

increase or decrease the oxidation rate, depending on the alloying metal. Of all these factors, 

moisture has a large effect on the oxidation rate and is especially significant in evaluating 

conditions for storing plutonium metal and oxide. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 10

Several plutonium oxides can be formed from oxidation of metal or decomposition of plutonium 

compounds. Oxide phases corresponding to sesquioxide (Pu2O3) and dioxide (PuO2) 

compositions have been identified and are well characterized. Pu2O3 is pyrophoric in air and 

rapidly forms PuO2 while releasing heat. The dioxide (PuO2) is unreactive in air, but reportedly 

will heat slowly with water vapor at elevated temperatures. Because of its chemical stability and 

relative inertness, PuO2 is the preferred form for shipping and storing plutonium at the present 

time (DOE, 1998). 

Plutonium oxide powder from the oxalic precipitation, filtration, and oxidation unit is 

homogenized (mixed) and sampled in the homogenization, filling, and sampling (KCB) unit. 

After receiving the sample vial from the sample pneumatic transfer glovebox, the operator mixes 

the powder in a homogenizer. From the 27 grams of powder contained in the sampling vial, the 

operator prepares three different kinds of samples using a vibrating funnel. About 4 grams are 

used for moisture and plutonium content analysis. The 4 grams are divided into two samples in 

dishes. These samples are used for determining the moisture content and for 

thermogravimetric analysis, which is used to determine the plutonium content in the PuO2

powder. About 11 grams of the powder is packaged into a number of specimens (usually about 

five) that are used for different analyses (e.g., plutonium isotopic composition, impurities 

determination) performed in the laboratory. About 13.5 grams of powder are kept in the 

sampling vial and manually transferred to the sample storage glovebox for use as a spare 

sample for further analyses or backcheck of the product specification. If the spare sample is 

used, it will be fractionated into specimens in the same way as a normal sampling vial and then 

transferred to the laboratory. 

The staff evaluation concluded that PuO2 is the most stable form of plutonium oxide, and it is not 

subject to pyrophoric (burnback) oxidation. The applicant has indicated that it will sample and 

analyze plutonium oxide powder produced in the AP process for purity and product specification 

in the KCB unit before transfer to the MP. As a result, the staff has reasonable assurance that 

plutonium pyrophoricity events will be highly unlikely in the MP area. 

11.1.1.2.4 Sintering Furnace Concerns (EXP01 and EXP02) 

Hydrogen Explosions (EXP01)

Sintering furnace hydrogen explosions (EXP01) are considered by the applicant in the pellets 

processing area where hydrogen explosions may occur in the high temperatures of the furnaces 

that sinter MOX fuel pellets. Section 8.1.2.4.1.1 of this SER discusses this event. 

Steam Explosions (EXP02)

Steam explosions or overpressurizations (EXP02) are hypothesized to occur within the sintering 

furnace because of overfill of the humidifier system (i.e., the high level in the argon-hydrogen 

(Ar-H) humidifier results in water carryover) or within the humidifier itself because of the 

introduction of water onto a hot humidifier heater (i.e., bubbler heaters are energized before 

introduction of cold water), causing steam generation. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 11

The applicant’s safety strategy for this event is preventive and involves restricting the flow of 

demineralized water to the sintering furnace and isolating the Ar-H supply upon detection of a 

high water level in the humidifier mixer drain tank. 

The staff finds that the credited IROFS discussed above provide a diverse method to ensure 

that the flow of demineralized water to the sintering furnace is restricted and that the Ar-H 

supply is isolated upon detection of a high water level in the humidifier mixer drain tank. In 

addition, the applicant committed to have fail-safe and redundant active engineered IROFS 

 and use them in combination with passive engineered IROFS 

 and administrative IROFS 

The staff finds this an acceptable approach to comply with the single failure criterion. The single 

failure criterion, management measures (as described in Chapter 15 of this SER), quality 

assurance requirements (as described in the MOX Project Quality Assurance Plan (MPQAP)), 

and the use of codes and standards for engineered IROFS give the staff reasonable assurance 

that this high consequence event is highly unlikely. Therefore, the proposed safety strategy and 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 12

IROFS comply with the performance requirements of 10 CFR 70.61, “Performance 

Requirements.” 

In addition, the applicant will use features to reduce the challenge to IROFS where it is practical. 

For example, to minimize the ignition sources, the applicant will ground pipes, vessels, and 

gloveboxes. The staff finds that these features comply with the defense-in-depth requirements 

of 10 CFR 70.64(b). 

11.1.1.2.5 Design-Basis and Applicable Baseline Design Criteria 

Sections 11.1.1.2.1 through 11.1.1.2.4 of this SER discussed the design bases of the MP that 

are associated with chemical processing. 

The applicant stated that it applied the BDC, as described in 10 CFR 70.64, from the outset of 

MFFF design work and that these criteria were primarily focused on the physical design and 

facility features, so as to achieve a conservatively designed facility tolerant of both process 

upsets and human errors (see Section 12.0 of the LA (MOX, 2010a)). The applicant stated that 

applicable chapters of the LA (MOX, 2010a) provided information demonstrating compliance 

with these criteria. 

To ensure that all event sequences with consequences with medium or high consequences as 

stated in 10 CFR 70.61 (b) and (c) meet the performance requirements identified in 

10 CFR 70.61, the applicant applied the following qualitative design criteria and commitments to 

those events and the associated IROFS: 

• application of the single failure criteria or double contingency (for nuclear criticality) 

• application of Appendix B, “Quality Assurance Criteria for Nuclear Power Plants and 

Fuel Reprocessing Plants,” to 10 CFR Part 50, “Domestic Licensing of Production and 

Utilization Facilities,” and nuclear quality assurance (NQA-1) 

• application of industry codes and standards 

• management measures, including surveillance of IROFS (i.e., failure detection and 

repair or process shutdown capability) 

For those credible events in which the single failure criteria or double contingency are not 

applicable (i.e., sole IROFS or passive IROFS feature), IROFS features are identified and the 

commitments for IROFS listed above are applied. 

In terms of chemical protection, 10 CFR 70.64(a)(5) states the following: 

Chemical protection. The design must provide for adequate protection against 

chemical risks produced from licensed material, facility conditions which affect 

the safety of licensed material, and hazardous chemicals produced from licensed 

material. 

The regulations in 10 CFR 70.64(a) require that the design of new facilities and processes 

address certain BDC. The following sections describe these BDC as they apply to the MFFF. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 13

Quality Standards and Records

The applicant developed and implemented the MFFF design in accordance with the MFFF 

MPQAP. The MPQAP specifies the applicant’s conformance to the quality assurance 

requirements found in Appendix B to 10 CFR Part 50, including quality standards and records 

and other programmatic management measures. 

Natural Phenomena Hazards

The applicant evaluated the MFFF design for applicable natural phenomena hazards as part of 

the ISA and considered the design-basis natural phenomena hazards. The ISA evaluates the 

impact of these hazards on the MFFF design (including identification of IROFS). 

Fire Protection

The MFFF design provides for fire protection features and systems. The ISA evaluates the fire 

and explosion hazards and their impact on facility operation (including identification of IROFS). 

Environmental and Dynamic Effects

The MFFF design provides adequate protection from applicable environmental conditions and 

dynamic effects that could lead to a loss of safety function for IROFS. The ISA hazard 

evaluation includes the identification of applicable environmental considerations (e.g., corrosion) 

and dynamic effects (e.g., seismic performance) and considers their impacts on the ability of an 

IROFS to perform a required safety function. 

Chemical Protection

The MFFF design provides protection from chemical risks from licensed material, facility 

conditions that affect the safety of licensed material, and hazardous chemicals produced from 

licensed material. The ISA evaluates the chemical and explosion hazards and their impact on 

facility operation (including identification of IROFS). 

Emergency Capability

The MFFF design provides instrumentation and control (I&C) systems and other IROFS (e.g., 

heating, ventilation, and air-conditioning and confinement systems) which are credited for 

maintaining control of licensed material and hazardous chemicals produced from licensed 

material during emergency events. The individual event analyses of the ISA identify the 

relevant IROFS. 

Onsite facilities (e.g., safe havens) are provided for employee egress during certain upset 

conditions. The safe havens are not relied on for safety to meet the performance requirements 

of 10 CFR 70.61. 

Communication systems are provided for use by facility response personnel and to 

communicate with facility workers during upset conditions. These capabilities are not relied on 

for safety to meet the performance requirements of 10 CFR 70.61. 

Fire-fighting capabilities are not relied on for safety to meet the performance requirements of 

10 CFR 70.61. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 14

Nuclear incident monitoring systems are provided to reduce risk to personnel and provide 

prompt warning and notification of an inadvertent criticality. These capabilities are not relied on 

for safety to meet the performance requirements of 10 CFR 70.61. 

Utility Services

The MFFF design provides continued operation of necessary utility services. The emergency 

power system provides electrical power to those systems required to operate during loss of 

offsite electrical power events. The individual event analyses of the ISA identify those IROFS 

which must function during loss of offsite power events. 

Inspection, Testing, and Maintenance

The applicant developed and implemented the MFFF design in accordance with the MFFF 

MPQAP. The MPQAP specifies the applicant’s conformance to the quality assurance 

requirements found in Appendix B to 10 CFR Part 50, including the requirements for inspection, 

testing, and maintenance for IROFS to ensure their availability and reliability to perform their 

function when needed. 

Criticality Control

The MFFF design provides protection from inadvertent criticality risks. Criticality safety includes 

adherence to the double contingency principle. The ISA evaluates criticality hazards and their 

prevention during facility operations (including identification of IROFS). 

Instrumentation and Controls

The MFFF design provides I&C systems for both normal and emergency operations. The I&C 

system monitors and provides control capability of IROFS. The individual event analyses of the 

ISA identify IROFS, including I&C systems and components. 

The MP facilities are broken down into process functional units, which are made up of one or 

more subassemblies performing consistent and elementary tasks. The applicant stated that the 

breakdown into control functional units allows each entity to operate relatively independently in 

the given mode. The staff notes that this separation and independence are consistent with 

accepted practices for safe operations. 

With respect to chemical protection, the applicant will control process storage and operation 

conditions to prevent exothermic reactions in the MP area. Exothermic reactions of chemicals 

will be prevented through the control of the process parameters (e.g., reactant concentration, 

temperature, inert atmosphere) that affect the reactions. 

The applicant demonstrated that there is reasonable assurance that IROFS controls will be 

sufficiently reliable and available based on the use of standard nuclear industry engineering 

practices. The applicant has incorporated these practices into the facility general design 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 15

philosophy, design bases, system design, and commitments to applicable management 

measures. These practices ensure that applicable industry codes and standards are utilized, 

adequate safety margins are provided, engineering features are utilized to the extent 

practicable, the defense-in-depth philosophy is incorporated into the design, and IROFS will be 

appropriately maintained. 

The staff review finds that the applicant has provided sufficient information to meet the 

requirements of 10 CFR 70.64(a)(5). Using the guidance provided in NUREG-1718 (NRC, 

2000), the staff concludes that the applicant has satisfied this BDC. 

 

Related to chemical protection, 10 CFR 70.64(a)(3) includes the explosion protection BDC as 

part of the fire protection BDC as follows: 

Fire protection. The design must provide for adequate protection against fires 

and explosions. 

The applicant stated that there is reasonable assurance that the IROFS will be sufficiently 

reliable and available based on the use of standard nuclear industry engineering practices. The 

applicant has incorporated these practices into the facility general design philosophy, design 

bases, system design, and commitments to applicable management measures. These 

practices ensure that applicable industry codes and standards are utilized, adequate safety 

margins are provided, engineering features are utilized to the extent practicable, the defense-indepth philosophy is incorporated into the design, and IROFS will be appropriately maintained. 

The staff review finds that the applicant has provided sufficient information to meet the 

requirements of 10 CFR 70.64(a)(3). Using the guidance provided in NUREG-1718 (NRC, 

2000), the staff concludes that the applicant has satisfied this BDC. 

11.1.2 Evaluation Findings

In Section 11.1 of the LA (MOX, 2010a) and Section 4.1 of the ISA Summary (MOX, 2010b), the 

applicant provided design-basis information for the MP and identified IROFS for the facility. 

Based on its review of the LA (MOX, 2010a) and ISA Summary (MOX, 2010b), as well as 

supporting information provided by the applicant relevant to the MP, the staff finds that, for the 

reasons discussed above, the applicant has met the BDC set forth in 10 CFR 70.64(a)(3) for 

explosions and 10 CFR 70.64(a)(5) for chemical safety. 

The staff finds that the credited IROFS provide diverse methods to ensure that the IROFS are 

available and reliable to perform their safety functions when needed. Also, the applicant has 

committed to have fail-safe and redundant active engineered IROFS and to use them in 

combination with passive engineered IROFS and administrative IROFS. 

The NRC staff finds that the applicant’s approaches to the accident sequences described above 

are acceptable and comply with the single failure criterion. The single failure criterion, 

management measures (as described in Chapter 15 of this SER), quality assurance 

requirements (as described in the MPQAP), and the use of codes and standards for engineered 

IROFS give the NRC staff reasonable assurance that these high consequence events are highly 

unlikely. Therefore, the proposed safety strategies and IROFS comply with the performance 

requirements of 10 CFR 70.61. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 16

The applicant will also use features to reduce the challenge to IROFS, to the extent practicable. 

For example, to minimize the ignition sources, the applicant will ground pipes, vessels, and 

gloveboxes. The NRC staff finds that these features comply with the defense-in-depth 

requirements of 10 CFR 70.64(b). 

REFERENCES 

(DOE, 1994) U.S. Department of Energy, “Primer on Spontaneous Heating and Pyrophoricity,” 

DOE-HDBK-1081-94, December 1994. 

(MOX, 2010a) Shaw AREVA MOX Services, “MFFF—License Application,” Aiken, SC, March 

2010. 

(MOX, 2010b) Shaw AREVA MOX Services, “MFFF—Integrated Safety Analysis Summary,” 

Aiken, SC, March 2010. 

(NRC, 2005) U.S. Nuclear Regulatory Commission, NUREG-1821, “Final Safety Evaluation 

Report on the Construction Authorization Request for the Mixed Oxide Fuel Fabrication Facility 

at the Savannah River Site, South Carolina,” March 2005. 

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” August 2000. 

(NRC, 1992) U.S. Nuclear Regulatory Commission, NRC Information Notice 92-14, “Uranium 

Oxide Fires at Fuel Cycle Facilities,” February 1992. 

(Perry, 1997) Perry, R.H., Green, D.W, “Perry’s Chemical Engineering Handbook (7th Edition), 

McGraw-Hill, 1997. 

(Stakebake, 1994) Stakebake,J.L., “The Ignitability Potential of Uranium Roaster Oxide,” 1994. 

10 CFR 70, Domestic Licensing of Special Nuclear Material. 

10 CFR 50, Domestic Licensing of Production and Utilization Facilities. 

11.2 Aqueous Polishing Process and Chemistry

 

11.2.1 Conduct of Review 

This section of the safety evaluation report (SER) contains the staff’s review of aqueous 

polishing (AP) process described by the applicant in Section 11.2 of the license application (LA) 

(MOX, 2010a), with supporting process safety information from Chapters 5, 8, and 11 of the LA, 

Section 4.2 of the Integrated Safety Analysis (ISA) Summary (MOX, 2010b), and supplemental 

information provided by the applicant. The staff also reviewed technical literature, as 

necessary, to understand the process and safety requirements. The objective of this review is 

to determine whether the AP process safety items relied on for safety (IROFS) and their design 

bases provide reasonable assurance of protection against natural phenomena and the 

consequences of potential accidents. The staff coordinated the review of AP safety design 

bases and strategies with the review of radiation and chemical safety aspects of accident 

sequences described in the safety assessment of the design bases (see Chapter 5 of this SER), 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 17

the review of fire safety aspects (see Chapter 7 of this SER), and the review of plant systems 

(see Chapter 11 of this SER). 

The staff evaluated the AP process and chemistry information in the LA and ISA Summary 

against the following regulations: 

• Title 10 of the Code of Federal Regulations (10 CFR) 70.64, “Requirements for New 

Facilities or New Processes at Existing Facilities,” requires that baseline design criteria 

and defense-in-depth practices be incorporated into the design of new facilities or new 

processes at existing facilities. 

• With respect to chemical protection,10 CFR 70.64(a)(5) requires that the Mixed Oxide 

Fuel Fabrication Facility (MFFF) design provide for adequate protection against 

chemical risks produced from licensed material, facility conditions that affect the safety 

of licensed material, and hazardous chemicals produced from licensed material. 

• Related to chemical protection, 10 CFR 70.64(a)(3) requires that the facility design 

provide for adequate protection against fires and explosions, such as those that could 

be initiated by or involve chemicals at the facility. 

The review of the LA and ISA Summary focused on the design basis of chemical process 

IROFS, their components, and other related information. For each IROFS, the staff reviewed 

information provided by the applicant for the safety function, system description, and safety 

analysis. The review also included other design-basis considerations such as redundancy, 

independence, reliability, and quality. The staff used NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility” (NRC 2000), 

as guidance in performing the review. 

As stated in the Memorandum of Understanding between the U.S. Nuclear Regulatory 

Commission (NRC) and the Occupational Safety and Health Administration, “Worker Protection 

at NRC-Licensed Facilities” (Volume 53 of the Federal Register, p. 43950; October 31, 1998), 

the NRC oversees chemical safety issues related to (1) radiation risk produced by radioactive 

materials, (2) chemical risk produced by radioactive materials, and (3) plant conditions that 

affect the safety and safe handling of radioactive materials. These types of chemical safety 

issues represent an increased radiation risk to the workers. However, the NRC does not 

oversee facility conditions that result in an occupational risk but do not affect the safe use of 

licensed material. The NRC has codified the provisions in the memorandum applicable to the 

MFFF in 10 CFR 70.64(a)(5). 

The NRC staff reviewed the following areas of the LA and ISA Summary applicable to process 

safety: 

• AP description 

• Potential interactions between hazardous chemicals affecting licensed materials 

• AP accident sequences 

• AP chemical accident consequences 

• AP safety controls 

The staff also reviewed additional documentation from the applicant, responses to requests for 

additional information, and the open literature, as necessary, to understand the process and 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 18

safety requirements. The sections that follow present the staff’s detailed evaluation of the AP 

process. 

 

11.2.1.1 System Description of the Aqueous Polishing Process

This section provides a description and overview of the AP process flowsheet, including design, 

operational, and process flow information. Section 11.2.1.2 summarizes the major components 

and their functions. 

The MFFF is designed to purify plutonium oxide (PuO2) and then blend it with depleted uranium 

oxide (DUO2) to produce completed mixed oxide (MOX) fuel assemblies for use in nuclear 

power reactors. The MFFF has two major process operations: (1) an AP process, which serves 

primarily to remove americium, gallium, and other impurities from the plutonium, and (2) the 

MOX fuel fabrication (MP) process, which processes the oxides into pellets and manufactures 

the MOX fuel assemblies. These processes are designed and integrated so that waste and 

discarded powder/pellet material streams are recycled to the extent practical. The AP process 

will receive weapons-grade PuO2 from a planned pit disassembly and conversion facility (PDCF) 

and alternative feedstock (AFS) which are owned by the U.S. Department of Energy (DOE). 

The AP process has the following major steps: 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 19

11.2.1.2 Major Components and Functions

The AP process can be subdivided into the following four operational areas (unit symbols are 

provided in parentheses): 

(1) The plutonium purification process includes the following units: decanning (KDA); milling 

(KDM); canning (KCC); recanning (KDR); dissolution (KDB); dechlorination and 

dissolution (KDD); purification cycle (KPA); oxalic precipitation, filtration, and oxidation 

(KCA); and homogenization (KCB). 

(2) The recovery processes include the solvent recovery (KPB) unit, oxalic mother liquor 

recovery (KCD) unit, and acid recovery (KPC) unit. 

(3) Waste storage includes the liquid waste reception (KWD) unit and waste organic solvent 

(KWS) unit. 

(4) Off-gas treatment includes the off-gas treatment (KWG) unit. 

11.2.1.2.1 Decanning Unit (KDA) 

The decanning unit receives PDCF PuO2 powder from the storage unit. It receives AFS powder 

from the vault storage area (DCM), as well. The powder received from both of these units is 

packaged in DOE Standard 3013 containers. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 20

 

11.2.1.2.2 Milling Unit (KDM) 

The milling (KDM) unit mills AFS PuO2 powder, samples AFS powder, and feeds powder to the 

KDD electrolyzers. 

 

 

 

 

11.2.1.2.3 Recanning Unit (KDR) 

The recanning (KDR) unit receives reusable cans containing discarded AFS material from the 

KDM unit if, after milling and sampling, the material has been determined to be outside of the 

AP processing limits. Periodically, the KDR unit will also receive food cans from the KDA food 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 21

can opening glovebox, whose contents exceed the AP salt percentage or mass limits. These 

food cans are manually introduced into the KDR convenience can packaging glovebox. The 

KDR unit repackages the powder from reusable cans into convenience cans and subsequently 

packages the convenience cans into approved containers; it also repackages the unopened 

food cans into approved containers. The containers are then stored in a vault storage area 

(DCM) for either transfer out of the MFFF or future treatment. 

11.2.1.2.4 Dissolution Unit (KDB) 

The dissolution (KDB) unit dissolves the plutonium oxide powder into a nitric acid solution for 

further processing in the KPA unit. The PuO2 processed in this unit comes from either the 

PDCF or the AFS. 

The first process step includes feeding nitric acid and silver nitrate into the electrolyzer along 

 

 

11.2.1.2.5 Dechlorination and Dissolution (KDD) 

The dechlorination and dissolution (KDD) unit removes the chlorine from chlorinated PuO2

coming from the milling (KDM) unit. The KDD unit can process either chlorinated or 

nonchlorinated powder, but chlorinated powder can only be processed in the KDD unit. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 22

 

 

 

 

11.2.1.2.6 Purification Cycle (KPA) 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 23

 

 

 

 

 

 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 24

11.2.1.2.7 Solvent Recovery Cycle (KPB) 

The solvent recovery (KPB) unit continuously cleans and recycles solvent for reuse in the 

purification cycle (KPA) unit. Additionally, the KPB unit transfers alkaline waste to the highalpha liquid waste (HAW) (KWD) unit and solvent waste to the waste solvent reception (KWS) 

unit. The major steps performed by the KPB unit include reception and cleaning of solvent, 

diluent washing of alkaline waste, solvent content adjustment and sampling, and solvent 

distribution. 

 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 25

11.2.1.2.8 Oxalic Precipitation and Oxidation Unit (KCA) 

 

The KCA unit includes equipment installed in gloveboxes and various process cells in the BAP. 

The gloveboxes are the precipitation glovebox, the rotating filter glovebox, and the furnace 

glovebox. The major processing steps performed by the KCA unit are plutonium nitrate solution 

reception and feed preparation, oxalate precipitation, filtration, and drying and calcination. 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 26

 

 

11.2.1.2.9 Homogenization Area (KCB) 

 

 

 

11.2.1.2.10 Canning Unit (KCC) 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 27

11.2.1.2.11 Oxalic Mother Liquor Recovery Unit (KCD) 

The KCD unit receives feed from the KCA unit, transfers distillates to the acid recovery (KPC) 

unit, and transfers plutonium nitrate solutions to the purification cycle (KPA) unit. The KCD unit 

is designed to process oxalic mother liquor from the oxalic precipitation and oxidation (KCA) unit 

in order to remove oxalate ions and concentrate the plutonium nitrate solution before recycling it 

to the KPA unit. 

 

Concentration of Mother Liquors and Destruction of Oxalic Ions
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 28

 

 

 

 

 

 

 

 

 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 29

 

11.2.1.2.12 Acid Recovery Unit (KPC) 

Process operations conducted within the KPC unit involve (1) the batch receipt of effluents from 

the purification cycle (KPA) unit, the oxalic mother liquor recovery process (KCD) unit, and the 

waste storage (KWD) unit; the dechlorination and dissolution (KDD) unit; and the batch or 

continuous receipt of effluents from the off-gas treatment (KWG) unit, (2) the concentration and 

transfer of the soluble effluent salts (i.e., impurities and radioactive activity) to the KWD unit, and 

(3) the recovery of nitric acid (13.6 N) and distillates (0.02 N nitric acid) for recycling. The 

recovered nitric acid is recycled to the AP process, while the distillates are recycled to the KPA 

and KWG units. 

Receipt of Effluents
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 30

 

 

 

 

 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 31

 

11.2.1.2.13 Off-Gas Treatment Unit (KWG) 

 

The off-gas treatment (KWG) unit is designed to remove hazardous materials and trace 

amounts of plutonium from all off-gas from each AP unit. 

 

11.2.1.2.14 Liquid Waste Reception Unit (KWD) 

 

The aqueous waste reception (KWD) unit receives and manages three types of waste: lowlevel liquid waste (LLW), americium-rich HAW, and stripped uranium liquid waste (SUW). This 

unit only processes solution that does not contain organic waste. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 32

 

High-Alpha Liquid Waste

The HAW portion of the KWD system collects, stores, and transfers potentially contaminated 

radioactive aqueous wastes containing americium and other impurities extracted from the AP 

process plutonium streams. It also collects alkaline waste and treats any azides contained in 

those streams. The HAW consists of the following waste streams combined in the KWD unit: 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 33

 

Stripped Uranium Liquid Waste

This portion of the KWD system collects, stores, and transfers liquid waste generated by the 

stripping process in the KPA unit. 

11.2.1.2.15 Waste Organic Solvent Unit (KWS) 

The waste organic solvent (KWS) unit collects waste organic solvent generated in various AP 

process units or systems for sampling and transfers it to the reagent processing building (BRP). 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 34

 

11.2.1.2.16 Sampling System 

 

The automatic sampling unit (KPG) automatically collects liquid samples from AP process units 

for laboratory analysis. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 35

 

11.2.1.2.17 Laboratory Waste Receipt Unit 

The laboratory liquid waste receipt (LGF) unit receives and manages the liquid wastes 

generated by the MFFF laboratory for subsequent recycling in the KDB unit and for transfer to 

either the LLW or HAW KWD unit or KWS unit. 

 

 

 

 

11.2.1.3 Staff Review of Aqueous Polishing Process Systems 

The following section discusses the staff’s technical review of AP systems with respect to 

accident events identified by the applicant in the ISAS. Each of these sections refers to 

additional discussions of ISA Summary events related to the AP. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 36

11.2.1.3.1 Chloride Concentration of Alternative Feedstock Powder (KDD) 

The staff evaluated the risk to the site worker and the individual outside the controlled area 

(IOC) from chlorine emissions from AP processes into the environment. AFS PuO2 powder that 

contains greater than 500 parts per million (ppm) total chloride salts would be processed in the 

dechlorination (KDD) electrolyzers. The applicant expects the maximum content of chloride 

salts in a can of AFS feed to be 1 kilogram (kg). Chloride is the main impurity, from 1 to 

25 percent of the total can weight. Under normal conditions, high-chloride AFS feed would be 

processed in KDD electrolyzers. The applicant’s chemical consequence analysis (MOX, 2009d) 

indicated that the anticipated production of chlorine gas from the dechlorination of AFS feeds in 

KDD electrolyzers is 0–1kg/hour (h). The KDD unit was sized for a maximum chloride content 

of 15 percent because only a small number cans actually contain 25 percent (by weight) 

chloride. The applicant anticipates that as few as six cans in the AFS feed campaign will 

contain up to 25 percent (by weight) chloride. The dechlorination process will proceed batch by 

batch, Each dissolution batch will have 

one can for high chloride AFS feed, and the dissolution of one batch is expected to last 12 

hours. The applicant expects that most of the chlorine gas will be released in the first hour of 

the dissolution process. If all of the chlorine were released in 15 minutes during an accident, 

the release rate would be If a can containing high chloride were 

inadvertently directed to a KDB (normal, nondechlorination) dissolution electrolyzer, the 

consequence calculations for the KDD unit would also bound the release from an inadvertent 

addition of chlorinated feed to the KDB unit. Thus, a total of up to 1 kg of chlorine gas could be 

liberated. 

The staff has analyzed this event and has concluded that some chloride that enters the KDB 

electrolyzer would react with the silver nitrate already present in solution to form silver chloride 

that would subsequently precipitate in the electrolyzer. The applicant’s analysis indicates that 

1 kg is the maximum chloride content in a can to be added to a KDB electrolyzer. This mass is 

equal to 28.6 moles of chloride, and one mole of chloride will react with one mole of silver for 

each mole of silver available until all of the silver is consumed. The silver nitrate solution is 

expected to be 0.07 M in silver nitrate, and thus 0.07 M in silver ion (Ag+

). With a 51-L working 

volume in the electrolyzer, 0.07 M in Ag+

 implies that 3.57 moles of Ag+ are available to react 

with any chloride inadvertently added to solution. Thus, 3.57 moles of Cl-

 would be consumed, 

leaving approximately 25 moles of chloride available to be released as chlorine gas. This 

means approximately 125 g of chloride can be consumed, leaving approximately 875 g for 

release as chlorine gas. 

 

 

 

 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 37

 

The NRC staff finds that the applicant used a known and accepted model to calculate chlorine 

concentrations and finds the applicant’s approach to be acceptable. Furthermore, the staff 

agrees with the applicant’s conclusion that a chlorine release would be a low-consequence 

event because, as discussed in the paragraph above, the chlorine concentration that would be 

encountered outside the MFFF is less than the TEEL-1 value for chlorine gas. 

11.2.1.3.2 Electrolyzers (KDB and KDD) 

Electrolysis-related explosions are postulated to occur from hydrogen (H2) that may be 

generated electrochemically at the cathode of the electrolyzer. The safety strategy for 

electrolysis-related explosions involves the application of IROFS to meet the performance 

criteria of 10 CFR 70.61, “Performance Requirements.” Sections 8.1.2.4.1.3 and 11.2.1.3.3 of 

this SER describe the staff’s evaluation of this hazard in more detail. 

 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 38

 

11.2.1.3.3 Hydrogen Production (KDB, KDD, KPA, KCA, KWG, and KWD) 

Hydrogen Generated by Electrolysis within the Dissolution Process (KDB and KDD)

The catholyte well of each electrolyzer is initially fed with 13.6 N nitric acid from the catholyte 

storage tank associated with the given electrolyzer in the KDB or KDD unit. During electrolysis, 

the solution is continuously circulated between the catholyte storage tank and the catholyte well 

of the electrolyzer, as its acidity decreases as a result of electrolytic dissolution of plutonium. 

As the normality of the catholyte decreases, hydrogen ion (H+

) will begin to be adsorbed on the 

cathode surface and react to form hydrogen gas (H2), which is subsequently released from 

solution into the vapor space. 

The fraction of hydrogen in the evolved gases from electrolysis is a function of the normality of 

the nitric acid and the current density of the tantalum cathode. The relevant limits for this event 

are the lower flammability limit (LFL) of hydrogen (4 percent H2) and 25 percent of the LFL 

(1 percent H2, the safety limit). The applicant indicated that 25 percent of the LFL is exceeded 

when the catholyte normality falls below a value of approximately 7.8 M. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 39

Section 8.1.2.4.1.3 of this SER describes the applicant’s proposed IROFS for this explosion 

event and the staff’s evaluation of it. 

Hydrogen Generated by Radiolysis (KPA, KCA, KWG, and KWD)

Radiolysis is the dissociation of molecules that can lead to gas generation. It occurs when 

organic and aqueous fluids are irradiated, in the case of the MFFF, by plutonium and 

americium. Since the organic and aqueous fluids are hydrogenous substances, the generated 

gas of concern is hydrogen. Hydrogen gas can build up in the vapor spaces of tanks and 

vessels. If an overpressurization occurs or if the concentration of the flammable gas exceeds 

the LFL, there is a risk for a radiolysis-induced explosion (EXP-03), which can result in the 

release of licensed material. There is also a risk of radiolysis in the waste handling system 

because of the confinement of radioactive material. 

Section 8.1.2.4.1.2 of this SER discusses the applicant’s safety strategy and proposed IROFS 

and the staff’s evaluation for this event. 

11.2.1.3.4 Titanium Reactions (KDB and KDD) and Discussion of Fire Event 5, Fire in the 

Titanium Electrolyzer in the Aqueous Polishing Glovebox Areas 

The staff’s evaluation found that the applicant’s proposed AP process employs oxidationreduction chemistry, based on the silver (I) to silver (II) couple, to facilitate the dissolution of 

PuO2 in the electrolyzers. Silver (II) is corrosive, and special alloys are necessary for 

electrolyzer equipment that may be exposed to silver (II). The applicant stated that the anode 

compartment and cathode cover of the electrolysis pot will be constructed of titanium (MOX, 

2010b). The applicant will destroy silver (II) by converting it back to silver (I) before electrolyzer 

solutions contact other equipment (fabricated out of 300-series stainless steels) in the process. 

The destruction of silver (II) will be accomplished by the addition of hydrogen peroxide, which 

reduces silver (II) back to silver (I). 

The staff notes that the applicant has committed to employ American Society of Testing and 

Materials (ASTM) Grade 2 titanium alloy to provide adequate corrosion resistance in the 

presence of the harsh chemical conditions anticipated in the electrolyzer pots. However, 

titanium can be a reactive metal. Under certain conditions, titanium and its alloys are known to 

be capable of ignition and combustion. Furthermore, each electrolyzer is expected to operate at 

30 volts (V) direct current (dc) (50 V maximum) and a current of 400-ampere dc (450 ampere 

maximum), which could potentially serve as an ignition source for the titanium. The NRC staff 

notes that laboratory tests have shown that sheets of commercially pure titanium and several of 

its alloys can be ignited in air using an oxyacetylene torch and heating the materials to their 

melting temperatures (approximately 3,000 degrees F) (DMIC, 1964). An electrical arc, as a 

result of welding or a breakdown of insulation, could cause localized heating of titanium, 

resulting in ignition. However, the NRC staff also recognizes that bulk titanium components are 

generally considered noncombustible and will only burn under extreme conditions. Experience 

has shown that, generally, in the absence of molten iron oxide, massive titanium (i.e., not finely 

divided powders or mill tailings) cannot be ignited in an ordinary air atmosphere without the 

application of an external source of heat or flame, and even with the application of heat or 

flame, metal temperatures approaching the melting point of the metal are necessary to achieve 

ignition (DMIC, 1964). Furthermore, the applicant indicated that, once ignited, titanium 

combustion will continue until the titanium is depleted, the air pressure falls below a critical 

value, or the ignition energy source (i.e., the electrical energy in this case) is removed (MOX, 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 40

2010b). The NRC staff notes that the main body and key components of the electrolysis pots of 

the electrolyzers will be fabricated from solid blocks of titanium alloy. 

The applicant described its safety approach for titanium events in the ISA Summary (MOX, 

2010b) and supporting documents (MOX Services, 2009c). 

The applicant’s safety strategy is to prevent titanium fire events during normal operations, 

abnormal operations, shutdown, and maintenance of the electrolyzers. During shutdown and 

maintenance, the applicant will use administrative controls associated with the isolation of 

power to the electolyzers when they are drained (e.g., removal of fissile material from the 

electrolyzer, connecting pipes, or receiving tanks to the extent that is appropriate or practical 

before performing the maintenance, and the power supply to the electrolyzer will be locked out 

when the electrolyzer is drained). For normal and abnormal operations, the applicant will 

employ a combination of active and passive engineered features to prevent the titanium fire 

event. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 41

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 42

 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 43

 

The applicant initially identified the silicon nitride barrier as a principal structure, system or 

component (PSSC) in the revised containment air recirculation (Construction Authorization 

Request) (DCS, 2002). However, subsequent analysis (MOX, 2009c) determined that the 

barrier was not necessary to prevent electrical arcing and the resulting titanium fire event. The 

other IROFS listed above would be sufficient to render the event highly unlikely. The analysis 

found that the silicon nitride barrier is not necessary as an IROFS because the barrier plays no 

role in providing electrical insulation. It functions only to physically separate anode and cathode 

solutions. Ions can still conduct through the barrier. Therefore, rupture of the barrier would 

constitute no loss of insulation. Furthermore, a well rupture would not cause a temperature 

increase in an electrolyzer because heat released into the electrolyzer after the rupture is less 

than the heat released during normal operations. The electrolyzer cooling system will ensure 

proper cooling of the electrolyzer body. 

The NRC staff further notes that, although silver deposition at the cathode in the MFFF 

electrolyzers is an unwanted event, the UCD plant at the La Hague facility in France has an 

operating silver recovery electrolyzer for which such deposition is the normal process outcome. 

The silver recovery electrolyzer operates without a separator (i.e., there is no barrier between 

anode and cathode) under normal operations. The distance between the anode and cathode in 

this unit is similar to that in the MFFF electrolyzers, the electrolyzer body is also made of 

titanium, and the absence of the barrier does not cause abnormal electrical behavior (MOX, 

2009c). 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 44

The NRC staff review finds that the overall strategy of prevention is appropriate given the 

postulated consequences. The staff has reviewed the applicant’s assumptions and the 

evaluation of the affected accident sequences and agrees with the applicant’s determination 

that the analysis is complete and adequately addresses the issues related to potential titanium 

fires in KDB and KDD electrolyzers. 

The NRC staff finds that this approach is acceptable to comply with the single-failure criterion. 

The single-failure criterion and experience at the La Hague facility, management measures (as 

described in Chapter 15 of this SER), quality assurance requirements (as described in the MOX 

Project Quality Assurance Plan (MPQAP)), and the use of codes and standards for engineered 

IROFS give the NRC staff reasonable assurance that this high-consequence event is highly 

unlikely. Therefore, the proposed safety strategy and IROFS comply with the performance 

requirements of 10 CFR 70.61. 

11.2.1.3.5 Loss of Confinement of Process Solutions 

The applicant discussed the control strategy for leaks and loss of confinement of process 

solutions in process cells and outside gloveboxes in Section 8.3.1.2 of the LA (MOX, 2010a) 

and Sections 5.3.3 and 5.3.11 of the ISA Summary (MOX, 2010b). The applicant postulated 

that these loss of confinement events would occur in the process cells in the BAP because of 

leaks from process vessels or pipes. The identified causes for these leaks include corrosion 

and mechanical stresses. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 45
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 46

The staff’s review finds that this approach relies upon practices and codes and standards 

typically used in the nuclear and chemical process industries to control similar hazards. By 

analogy, the approach should have the ability to address the potential concerns and is 

acceptable to the staff. 

11.2.1.3.6 Oxalic Precipitation Concerns 

The function of the oxalic precipitation, filtration, and oxidation (KCA) unit is to convert the 

plutonium nitrate solution received from the purification cycle (KPA) unit into plutonium oxide 

(PuO2) powder. The major processing steps performed by the KCA unit are plutonium nitrate 

solution reception and conversion feed preparation, oxalate precipitation, filtration, and drying 

and calcination. 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 47

 

 

 

11.2.1.3.7 Oxalic Mother Liquor Recovery 

The function of the oxalic mother liquor recovery (KCD) unit is to receive and process mother 

liquor and washing solutions from the oxalic precipitation, filtration, and oxidation (KCA) unit. 

The KCD unit destroys excess oxalic acid, concentrates and recycles plutonium nitrate solutions 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 48

to the purification cycle unit (KPA), and recycles evaporator distillates to nitric acid recovery 

(KPC). 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 49

Based on the above, the staff finds that the applicant’s proposed control strategy is acceptable. 

The staff review finds that the overall preventive strategy is appropriate given the postulated 

consequences. The staff has reviewed the applicant’s assumptions and the evaluation of the 

affected accident sequences and agrees with the applicant’s determination that the analysis is 

complete and adequately addresses the issues related to potential explosions and criticality 

events in the oxalic mother liquor recovery evaporator. 

11.2.1.3.8 Acid Recovery Unit 

The acid recovery (KPC) unit recovers and recycles nitric acid in the AP process effluents. 

Section 11.2.1.2.12 of this SER discusses the primary processes. 

 

 

Based on the above, the staff finds that the applicant’s operational strategy for the nitric acid 

recovery evaporators is appropriate given the postulated consequences. The staff has 

reviewed the applicant’s assumptions and the evaluation of the affected accident sequences 

and agrees with the applicant’s determination that the analysis is complete and adequately 

addresses the issues related to potential explosions in the nitric acid recovery evaporator. 

11.2.1.3.9 Off-Gas Treatment Unit (KWG) 

The off-gas treatment (KWG) unit ventilation system treats off-gases generated in AP process 

systems by removing radionuclides, nitrous fumes, and other hazardous materials before their 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 50

release to the environment through the plant stack. The KWG unit also provides a confinement 

barrier by maintaining negative pressure in connected process equipment. The KWG unit 

consists of scrubbing columns with buffer tanks, demisters, a condenser, electric heaters, HEPA 

filter trains, exhaust systems, and a common stack. 

 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 51

 

Based on the above, the staff concludes that the applicant has provided design bases that 

sufficiently address the safety concerns regarding the off-gas treatment system. The staff has 

reviewed the applicant’s assumptions and the evaluation of the off-gas treatment system and 

agrees with the applicant’s determination that the analysis is complete and adequately 

addresses the issues related to operation of the off-gas treatment system. 

11.2.1.3.10 Corrosion Control (KDB and KDD) 

The staff’s evaluation found that the applicant’s proposed AP process employs oxidationreduction chemistry, based on the silver (I) to silver (II) couple, to facilitate the dissolution of 

PuO2 in the electrolyzers. Silver (II) is corrosive, and special alloys are necessary for 

electrolyzer equipment that may be exposed to silver (II). The applicant stated that the anode 

compartment and cathode cover of the electrolysis pot will be constructed of titanium (MOX, 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 52

2010b and MOX, 2009c). The applicant will destroy silver (II) by converting it back to silver (I) 

before electrolyzer solutions contact other process equipment that is fabricated out of 300-

series stainless steels. 

The staff notes that the applicant will employ ASTM Grade 2 titanium alloy to provide adequate 

corrosion resistance in the presence of the harsh chemical conditions anticipated in the 

electrolyzer pots. With respect to the KDB and KDD electrolyzer construction, titanium was 

specifically chosen as the material of construction for the electrolyzer bodies for its corrosionresistance properties in the presence of Ag++ ions. The electrolyzer anode, cathode, and body 

assembly parts are insulated from one another through the use of corrosion-resistant, highdielectric materials (i.e., PTFE and PVDF). 

The insulating and strength properties of these materials are stable over long periods of time, as 

evidenced through their use in similar applications for more than 15 years of operating 

experience at the La Hague facility in France (MOX, 2009c). Furthermore, the applicant has 

committed that the electrolyzer components will be routinely checked and inspected in 

accordance with an established surveillance schedule, to eliminate corrosion-induced wear as a 

source of failure. 

The staff has reviewed the applicant’s assumptions and the evaluation of the affected accident 

sequences and agrees with the applicant’s determination that the analysis is complete and 

adequately addresses the issues related to corrosion in the KDB and KDD electrolyzers. The 

staff reviewed the applicant’s evaluation of the affected accident sequences and determined 

that the credited IROFS provide adequate protection for these sequences consistent with the 

requirements of 10 CFR 70.61 (see the discussion of EXP-17 in SER Section 8.1.2.4.1.3 and of 

F-05 in SER Section 7.1.6.4). 

11.2.1.3.11 Liquid Waste (KWD) 

In Section 11.2.2 of the LA (MOX, 2010a), the applicant stated that the aqueous liquid waste 

system or the solvent liquid waste system collects liquid radioactive waste and transfers it to 

SRS for disposition. The MFFF will not discharge radioactive liquid to the environment during 

normal and off-normal operations. Section 11.2.14 of the LA states that the aqueous waste 

reception (KWD) unit receives and manages LLW, americium-rich HAW, and SUW generated 

by the AP process units for subsequent transfer to the WSB. 

Furthermore, the applicant stated that the AP process will use recycling to the maximum extent 

practical to minimize liquid waste. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 53

 

The NRC staff reviewed the applicant’s safety evaluation to evaluate whether the applicant will 

adequately protect workers, the public, and the environment during a postulated inability to 

transfer HAW from the MFFF. The programs that support chemical safety and the facility 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 54

design must also protect against facility conditions, operator actions, or both that can affect the 

safety of licensed materials and present an increase in risk. 

Process Description 

Within the AP system, the KWD HAW unit collects contaminated radioactive aqueous wastes 

containing americium and other impurities extracted from the plutonium stream. The unit also 

collects alkaline waste and destroys any azides in it. The KWD HAW unit collects, processes, 

and stores these wastes before discharge. These effluents are then batch transferred from the 

MFFF to DOE’s WSB via a dedicated double-walled underground pipeline. Figure 11.2-1 shows 

the process diagram for the KWD HAW unit. 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 55

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 56

Chemical Process Inventories in KWD 

The applicant expects to operate the MFFF 42 weeks per year, with 10 weeks of outage time 

planned for maintenance, repair, and other activities such as periodic testing of equipment. The 

MFFF will accept feedstock either from DOE’s PDCF or AFS provided by DOE. The PDCF 

feedstock is the limiting volume in that it generates the higher volume of liquid waste raffinates. 

The maximum expected annual volume of liquid HAW is approximately 39,000 L based on an 

annual (42 weeks of operation) throughput of 3.5 metric tons of plutonium when processing 

PDCF material through the MFFF. The maximum expected annual volume of HAW generated 

during processing of AFS is about 34,000 L. The applicant’s analysis uses the more limiting 

condition of PDCF feed material (39,000 L). 

The applicant anticipates five planned HAW batch transfers per year between the MFFF and the 

WSB, with a nominal batch size of approximately 7,700 L. This batch volume represents 

approximately 73 percent of the capacity of 10,500-L KWD*TK4050, with more than 25 percent 

of that tank’s capacity (per batch) remaining as buffer. 

The storage tanks KWD*TK4020, KWD*TK4030, KWD*TK4040, and KWD*TK4050 have a 

combined capacity of over 29,000 L. Although the applicant does not expect to use the 

combined volume of these four vessels during normal operations (since periodic discharges of 

HAW are planned), the HAW storage capacity of these four vessels represents the expected 

volume of HAW generated in more than 29 weeks of normal AP operations. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 57

 

Accident Sequences 

The ISA Summary (MOX, 2010b) includes potential accident sequences and identifies selected 

controls that either prevent or mitigate the consequences of these accident sequences to an 

acceptable level. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 58

 

 

 

The staff has reviewed the information provided by the applicant and evaluated the applicant’s 

analyses for these sequences. 

Review of Selected Accident Sequences 

The staff reviewed the applicant’s evaluation of the selected accident sequences potentially 

affected by the postulated inability to transfer HAW, as well as the proposed controls to mitigate 

these effects. The staff evaluated accident sequences identified by the applicant and concludes 

that the applicant’s evaluation of accident scenarios is complete and appropriate and that the 

new IROFS (in addition to the IROFS already included) are necessary and provide protection 

against these affected sequences and meet the performance requirements of 10 CFR 70.61. 

The staff has reviewed the applicant’s assumptions and the evaluation of the affected accident 

sequences and agrees with the applicant’s determination that the analysis is complete and 

adequately addresses the issues related to the inability to transfer HAW. The staff reviewed the 

applicant’s evaluation of the affected accident sequences and determined that the credited 

IROFS provide adequate protection for the affected accident sequences consistent with the 

requirements of 10 CFR 70.61. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 59

Accident Sequences Conclusion 

 

 

 

The staff concludes that the applicant has appropriately identified potential accident sequences 

resulting from a postulated inability to transfer liquid HAW from the MFFF identified in the safety 

evaluation document. The information provided by the applicant meets the accident sequence 

and likelihood guidance in Section 8.4.3 of NUREG-1718 (NRC, 2000), and the staff finds this 

information acceptable. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 60

Accident Consequences

The staff finds that the applicant has identified the consequences of analyzed chemical accident 

sequences and estimated them conservatively. Based on its review of the safety evaluation and 

the affected accident sequences, the staff concludes that the applicant has adequately identified 

the consequences of the affected accident sequences involving the chemical hazards of 

licensed materials and hazardous chemicals produced from licensed material. The information 

provided by the applicant, as described above, meets the guidance in Section 8.4.3 of NUREG1718 (NRC, 2000) and is, therefore, acceptable. 

 

 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 61

 

 

 

The staff reviewed the credited IROFS for affected accident sequences and concludes that the 

applicant has adequately identified IROFS to prevent or mitigate the consequences of the 

affected accident sequences involving the chemical hazards of licensed materials and 

hazardous chemicals produced from licensed material. 

Management Measures 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 62

 

The staff finds that the applicant has sufficiently identified management measures to maintain 

IROFS controls available and reliable to perform their safety functions when needed, as 

required under 10 CFR 70.62, “Safety Program and Integrated Safety Analysis.” 

Staff Conclusions

The staff reviewed the applicant’s evaluation of the liquid HAW storage capacity of the MFFF 

and the ability of the applicant to bring the MFFF to a safe configuration in the event that the 

ability to transfer liquid HAW from the facility is interrupted in the short, intermediate and long 

term, using the criteria previously listed. Based upon its review of this evaluation, the staff finds 

that the applicant has described the facility, equipment, and processes in sufficient detail to 

meet the requirements of 10 CFR 70.22, “Contents of Applications,” and 10 CFR 70.65, 

“Additional Content of Applications,” consistent with the acceptance criteria of Section 8.4.3 of 

NUREG-1718 (NRC, 2000). The staff also finds that the 800-L operating limit, supporting the 

400-L IROFS safety limit, satisfies the applicant’s setpoint commitment, as described in 

Section 11.2.1.3.11 (p. 11-48) of NUREG-1821 (NRC, 2005). 

Lastly, the staff also has reasonable assurance that the applicant has identified hazards and 

accident sequences and credited IROFS sufficient to meet the performance requirements of 

10 CFR 70.61, consistent with the acceptance criteria of Sections 6.4 and 8.4 of NUREG-1718 

(NRC, 2000). 

11.2.1.3.12 Sampling Systems 

The safety function of IROFS sampling is to ensure that: (1) proper concentrations of reagents 

are introduced into the process, (2) process solutions remain within the correct composition, and 

(3) the contents of drip trays are identified (as necessary) and appropriately recovered. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 63

The staff reviewed the use of IROFS sampling as an enhanced administrative control for the 

prevention of explosion, loss of confinement, and criticality events and concludes that the 

applicant has adequately identified these IROFS to prevent or mitigate the consequences of the 

affected accident sequences involving the chemical hazards of licensed materials and 

hazardous chemicals produced from licensed material. 

11.2.1.4 Design Basis of the Items Relied Upon for Safety and Applicable Baseline Design 

Criteria 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 64

The requirements of 10 CFR 70.64(a)(5), related to chemical protection, states that the facility 

design must provide for adequate protection against chemical risks produced from licensed 

material, facility conditions that affect the safety of licensed material, and hazardous chemicals 

produced from licensed material. The staff finds that the applicant has included sufficient 

information to demonstrate that the MFFF design provides protection from chemical risks from 

licensed material, facility conditions that affect the safety of licensed material, and hazardous 

chemicals produced from licensed material. Chapter 8 of the LA (MOX, 2010a) describes 

chemical safety. The applicant has adequately evaluated chemical and explosion hazards and 

their impact on the facility operation (including identification of IROFS) as described in the ISA 

Summary (MOX, 2010b) to meet the requirements of 10 CFR 70.64(a)(5) (see SER Section 8). 

Related to chemical protection, the fire protection baseline design criterion in 

10 CFR 70.64(a)(3) includes the criterion for explosion protection: 

Fire protection. The design must provide for adequate protection against fires 

and explosions. 

The staff finds that the MFFF design provides for fire protection features and systems as 

described in Chapter 7 of the LA (MOX, 2010a) and Section 4 of the ISA Summary (MOX, 

2010b), and evaluated in Chapter 7 of this SER. Furthermore, the staff finds that the applicant 

has adequately evaluated fire and explosion hazards, and their impacts on facility operation 

(including identification of IROFS), as described in the ISA Summary. Therefore, the staff finds 

that the applicant has provided sufficient information to meet the requirements of 10 CFR 

70.64(a)(3). 

The applicant stated that there is reasonable assurance that the IROFS will be sufficiently 

reliable and available based on the use of standard nuclear industry engineering practices. The 

facility general design philosophy, design bases, system design, and commitments to applicable 

management measures incorporate these practices. These practices ensure that applicable 

industry codes and standards are used, adequate safety margins are provided, engineering 

features are used to the extent practicable, the defense-in-depth philosophy is incorporated into 

the design, and IROFS will be appropriately maintained. 

11.2.2 Evaluation Findings

In Section 11.2 and Chapter 5 of the LA (MOX, 2010a), the applicant provided design-basis 

information for chemical process safety IROFS identified for the MFFF. Based on the staff’s 

review of the chapters and supporting information provided by the applicant that are relevant to 

AP and chemical process safety, the staff finds that, for the reasons discussed above, MOX 

Services has met the baseline design criteria set forth in 10 CFR 70.64(a)(3) for explosions and 

in 10 CFR 70.64(a)(5) for chemical safety. Furthermore, the staff concludes, pursuant to 

10 CFR 70.23(b), that the design bases of the IROFS identified by the applicant will provide 

reasonable assurance of protection against natural phenomena and the consequences of 

potential accidents. 

 REFERENCES

(DMIC, 1964) Defense Metals Information Center, Battelle Memorial Institute, “Fire Hazards 

Associated with the Use of Titanium in Aircraft,” DMIC Technical Note AD609342, Columbus, 

OH, June, 1964. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 65

(MOX, 2010a) Shaw AREVA MOX Services, “Mixed Oxide Fuel Fabrication Facility License 

Application,” Aiken, SC, March 2010. 

(MOX, 2010b) Shaw AREVA MOX Services, “Mixed Oxide Fuel Fabrication Facility Integrated 

Safety Analysis Summary,” Aiken, SC, March 2010. 

(MOX, 2009a) Shaw AREVA MOX Services, “Safety Evaluation of the Postulated Inability to 

Transfer High Alpha Waste from the MOX Fuel Fabrication Facility and the Short, Intermediate, 

and Long-term Storage of High Alpha Waste in the KWD Unit, DCS01-RRJ-DS-ANS-H-38426-

2,” Aiken, SC, 2009. 

(MOX, 2009b) Shaw AREVA MOX Services, “Calculation of the Volume Sent to KWD High 

Alpha Tanks During a Pu Flushout in KPA,” DCS01-KWD-DS-CAL-F-12160-2, Aiken, SC, 2009. 

(MOX, 2009c) Shaw AREVA MOX Services, “Analysis of the Potential for a Short Circuit of 

Arcing in an Electrolyzer due to Failure of the Sintered Silicon Nitride Barrier,” DCS01-AAS-DSANS-H-38440-0, Aiken, SC, 2009. 

(MOX, 2009d) Shaw AREVA MOX Services, “Chemical Consequences for Potential Chemical 

Hazard Events,” DCS01-KKJ-DS-CAL-H-35604-2, Aiken, SC, 2009. 

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” Washington, 

DC, August 2000. 

(NRC, 2005) U.S. Nuclear Regulatory Commission, NUREG-1821, “Final Safety Evaluation 

Report on the Construction Authorization Request for the Mixed Oxide Fuel Fabrication Facility 

at the Savannah River Site, South Carolina,” Washington, DC, March 2005. 

(ANSI/ASME, 1996) American Society of Mechanical Engineers, B31.3-1996, Process Piping, 

including 1998 Addenda. 

11.3 Ventilation and Confinement Systems

The purpose of this review is to determine, with reasonable assurance, whether the applicant’s 

ventilation and confinement systems will adequately protect workers, the public, and the 

environment under normal and accident conditions. The review is also to determine whether 

the ventilation and confinement systems, as well as their subcomponents, identified as items 

relied on for safety (IROFS) pursuant to Title 10 of the Code of Federal Regulations (10 CFR) 

Part 70, “Domestic Licensing of Special Nuclear Material,” and encompassed by the hazard and 

accident analysis of the Integrated Safety Analysis (ISA) Summary (MOX, 2009a), will be 

available and reliable to perform their intended safety function when needed. 

The staff evaluated the information provided by the applicant for ventilation and confinement 

systems by reviewing Section 11.3 of the license application (LA) (MOX, 2009b), other sections 

of the LA, and supplementary information provided by the applicant. The staff closely 

coordinated the review of ventilation and confinement systems and operating strategies with the 

review of the ISA Summary (MOX, 2009a) (see Chapter 5 of this safety evaluation report (SER)) 

and the review of other plant systems. The staff used the guidance in NUREG-1718 (NRC, 

2000) to prepare its review. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 66

11.3.1 Regulatory Requirements

For the LA to be considered acceptable, the applicant must satisfy the following regulatory 

requirements applicable to ventilation and confinement systems: 

• 10 CFR 70.22, “Contents of Applications,” specifically relating to the requirement that the 

applicant is to provide a description of the equipment and facilities and propose 

procedures to protect health and minimize danger to life and property 

• 10 CFR 70.23, “Requirements for the Approval of Applications,” specifically relating to 

the requirement that the Commission determine that the proposed equipment, facilities, 

and procedures are adequate to protect health and minimize danger to life and property 

• 10 CFR 70.61(e), specifically relating to the requirement that each engineered or 

administrative control or control system that is needed to meet the performance 

requirements be designated as an IROFS and relating to the safety program that 

ensures that each IROFS will be available and reliable to perform its intended function 

when needed 

• 10 CFR 70.62, “Safety Program and Integrated Safety Analysis,” specifically relating to 

the establishment and maintenance of a safety program and to the performance of an 

ISA 

• 10 CFR 70.64, “Requirements for New Facilities or New Processes at Existing 

Facilities,” specifically relating to the application of baseline design criteria (BDC) and 

defense-in-depth practices to new facilities or new processes at existing facilities 

11.3.2 Regulatory Acceptance Criteria

Sections 11.4.5.1 and 11.4.5.2 of NUREG-1718, “Standard Review Plan for the Review of an 

Application for a Mixed Oxide (MOX) Fuel Fabrication Facility” (NRC, 2000), provide the 

acceptance criteria for the U.S. Nuclear Regulatory Commission’s (NRC’s) review of the 

applicant’s ventilation and confinement systems. 

11.3.3 Staff Review and Analysis

11.3.3.1 System Description 

In the LA, the applicant proposed a ventilation and confinement system to confine radioactive 

materials within process areas and gloveboxes and to ensure minimum dispersal of radioactive 

materials during routine operations and under accident conditions. The applicant’s design uses 

ventilation zones that are operated at pressure differentials designed such that air leakage 

moves from areas of low radiation hazard into areas with greater radiation hazard (see 

Figure 11.3-1). Static barriers, such as process vessels, gloveboxes, and room walls, bound 

these zones. Separate ventilation systems that operate at different negative pressures provide 

the proper differential pressures between confinement zones. 

The C4 confinement zone or primary confinement zone consists of static and dynamic systems. 

Static systems consist of gloveboxes, process vessels, and equipment containing radioactive 

material where the hazards are the greatest. Dynamic systems include the very high 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 67

depressurization (VHD) exhaust system, which maintains glovebox differential pressures to 

minimize the spread of radioactive contamination. Airflows in the VHD system pass through 

high-efficiency particulate air (HEPA) filters located at the glovebox, intermediate filter 

assemblies consisting of a prefilter and HEPA filter at the fire area boundary, and final filtration 

assemblies consisting of a roughing filter, a prefilter, and two banks of HEPA filters before 

exhausting to the facility stack. HEPA filtration is also provided in glovebox supply air systems. 

Section 11.3.1 of the LA presents details of the C4 confinement system. 

The C3 confinement zone or secondary confinement zone consists of process rooms that 

contain gloveboxes and process vessels where contamination risks are lower than in the C4 

zone. Static barriers consist of room walls. The high depressurization exhaust (HDE) system 

maintains differential pressures in the C3 zones. The HDE system consists of intermediate filter 

boxes containing prefilters and HEPA filters and final filtration assemblies consisting of roughing 

filters, prefilters, and two stages of HEPA filtration before exhausting to the facility stack. HEPA 

filtration is also provided in supply air systems for C3 zones. Section 11.3.2 of the LA presents 

details of the C3 confinement system. 

The process cell zones consist of rooms containing process vessels not enclosed by 

gloveboxes. These zones have a low risk of contamination but, under accident conditions, the 

contamination could be high. The process cell exhaust system maintains differential pressures 

in the process cell zones. The final filtration assembly for this ventilation system consists of 

roughing filters, prefilters, and two stages of HEPA filtration before exhausting to the facility 

stack. HEPA filtration is also provided in process cell supply air systems. Section 11.3.3 of the 

LA presents details of the process cell confinement system. 

The C2 confinement zone or tertiary confinement zone consists of process rooms containing 

sealed plutonium containers, sealed fuel rods or assemblies, corridors surrounding the process 

cell and C3 zones, and general areas where plutonium is not present. These zones have a very 

low risk of contamination. The medium depressurization exhaust (MDE) system maintains 

differential pressures in the C2 zone. The MDE system consists of final filtration assemblies 

that include roughing filters, prefilters, and two stages of HEPA filtration before exhausting to the 

facility stack. HEPA filtration is also provided in supply air systems for the C2 zone. Section 

11.3.4 of the LA presents details of the C3 confinement system. 

C1 confinement zones are areas that open to the outside of buildings and have an extremely 

low risk of contamination. These areas are at atmospheric pressure. 

In addition to the above static and dynamic systems, the facility also has a supply air system, 

which filters incoming airflows through prefilters and HEPA filters. Section 11.3.5 of the LA 

presents details of the supply air system. Emergency control rooms, the emergency generator 

building, the truck bay, the shipping and receiving area, safe havens, the reagents processing 

building, and entry control areas also have ventilation systems. Sections 11.3.6, 11.3.7, and 

11.3.8 of the LA present the details of these systems. 

 

11.3.3.1.1 Functions and Major Components 

In the LA, the applicant proposed a ventilation and confinement system to confine radioactive 

materials within process areas and gloveboxes and to ensure minimum dispersal of radioactive 

materials during routine operations and under accident conditions (MOX, 2009b). The proposed 

system meets the recommendations in Regulatory Guide 3.12, “General Design Guide for 

Ventilation Systems of Plutonium Processing and Fuel Fabrication Plants” (NRC, 1973), and is, 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 68

therefore, consistent with the staff’s acceptance criteria in Sections 11.4.5.1 and 11.4.5.2 of 

NUREG-1718 (NRC, 2000). In addition, the ventilation and confinement systems consist of the 

following: 

 

(1) Ventilation zones are operated at pressure differentials designed such that air leakage 

occurs from areas of low radiation hazard into areas with greater radiation hazard (LA 

Section 11.3, Figure 11.3-1). Static barriers, such as process vessels, gloveboxes, and 

room walls, bound these zones. Control devices to maintain proper differential 

pressures are provided and alarmed. This follows the guidance in Sections 11.4.5.1 and 

11.4.5.2.A.i–ii of NUREG-1718 and is, therefore, acceptable. 

(2) Controls are also in place to isolate systems, if necessary, and to maintain confinement 

zone differential pressures. Monitoring instrumentation, alarms, and controls ensure that 

pressure differentials in confinement zones are maintained, alternative power supplies 

are actuated when needed, and the consequences of accidents are mitigated 

(Sections 11.3.1.3, 11.3.2.3, 11.3.3.3, 11.3.4.3, 11.3.5.3, and 11.3.6.3 of the LA). This 

follows the guidance in Section 11.4.5.2.A.iii of NUREG-1718 and is, therefore, 

acceptable. 

(3) The supply air system controls are interlocked with exhaust fan controllers to prevent 

supply fan operation unless the exhaust fans are operational and to prevent 

overpressurization of confinement zones. Section 11.3.5.3 of the LA discusses supply 

air system controls. This follows the guidance in Section 11.4.5.2.A.iv of NUREG-1718 

and is, therefore, acceptable. 

(4) A system of final filter assemblies is in accordance with American Society of Mechanical 

Engineers (ASME) standard ASME AG-1, “Code on Nuclear Air and Gas Treatment” 

(ASME, 1997), and ANSI/ASME N509, “Nuclear Power Plant Air-Cleaning Units and 

Components” (ASME, 1996), consisting of HEPA filters, stainless steel/glass fiber 

prefilters, and stainless steel roughing filters intended to remove radioactive materials 

from process areas and occupied areas during routine operations and under accident 

conditions. The stainless steel/glass fiber prefilters and stainless steel roughing filters 

are designed to remove hot embers and a large percentage of the soot to protect the 

final HEPA filters from fire damage and excessive soot plugging (Sections 11.3.1.2, 

11.3.2.2, 11.3.3.2, and 11.3.4.2 of the LA). This follows the guidance in Section 11.4.5.1 

of NUREG-1718 and is, therefore, acceptable. 

Figure 11.3-1 Ventilation confinement zones 

(5) The design is in accordance with ASME AG-1 (ASME, 1997) and ASME N510, “Testing 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 69

of Nuclear Air Treatment Systems” (ASME, 1995), to allow in-place filter testing and 

in-service surveillance of HEPA filters to ensure operability and required functional 

performance (Sections 11.3, 11.3.1.2, 11.3.2.2, 11.3.10.1.1, 11.3.10.1.2, 11.3.10.1.3, 

and 11.3.10.1.6 of the LA). The systems are designed also to allow operability and 

performance testing of fans, filters, and other safety-related components 

(Sections 11.3.1.2, 11.3.2.2, 11.3.3.2, and 11.3.4.2 of the LA). This follows the guidance 

in Sections 11.4.5.2.B.i–ii of NUREG-1718 and is, therefore, acceptable. 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 70

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 71

(14) Gloveboxes consist of welded stainless steel enclosures with windows, alone and in 

interconnected groups, which act as a primary barrier to confine hazardous (radioactive, 

toxic, or flammable) materials and to provide structural support capable of protecting 

process equipment during a postulated seismic event. The mixed oxide fuel fabrication 

facility (MFFF) personnel’s access to equipment inside the gloveboxes is provided 

through access holes in the glovebox windows fitted with gloves that maintain the 

confinement boundary. 

 Glovebox window panels, viewing ports, or video cameras give visual access to the 

gloveboxes. Light fixtures provide illumination and are generally located outside the 

glovebox. The windows are clear rectangular panels that fit into gasketed frames that 

cover specifically designed openings in the glovebox shell. The windows proposed by 

the applicant are polycarbonate (Lexan®), which may have lead-glass panels to provide 

additional radiation protection. The polycarbonate windows are qualified to withstand 

structural and accident loads and maintain their integrity. 

 Gloveboxes have pass-through connectors in glovebox shells that are used to bring 

processes and utilities (e.g., air, electricity, and water) inside the glovebox. These 

connectors are designed and tested to ensure that glovebox pressure integrity stays 

within the maximum leakage criteria. Primary process equipment contains mixed oxide 

(MOX) product in various forms (i.e., powder, pellets, trays, and rods). These MOX 

forms are manufactured, transferred, stored, and maintained inside of gloveboxes 

(Section 11.3.9.1 of the LA). Gloveboxes are designed to maintain the confinement 

boundary and structural integrity during and following a design-basis seismic event. 

 Gloveboxes are designed, fabricated, installed, operated, and maintained in accordance 

with practices used at the MELOX and La Hague facilities and national codes and 

standards (Sections 11.3.9 and 11.3.10.2 of the LA). Fabrication and welding codes 

include ANSI Standard ANSI N690, “Specification for the Design, Fabrication, and 

Erection of Safety Related Steel Structures for Nuclear Facilities” (ANSI, 1994), and 

American Welding Society (AWS) Standard D1.1, “Structural Welding Code” (AWS, 

1998). Gloveboxes are tested in accordance with American Glovebox Society (AGS) 

Standard AGS-G001, “Guideline for Gloveboxes” (AGS, 1998), or American Society for 

Testing and Materials (ASTM) Standard E499, “Standard Test Methods for Leaks Using 

the Mass Spectrometer Leak Detector in the Detector Probe Mode 1, 2” (ASTM, 2000). 

This follows the guidance in Section 11.4.5.2.K.i of NUREG-1718 and is, therefore, 

acceptable. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 72

 

(18) The glovebox system is designed to prevent physical interaction with confinement 

boundary elements under worst-case loading conditions associated with normal, 

off-normal, accident, and design-basis events in accordance with ANSI N690 

(ANSI, 1994) (Section 11.3.10.2 of the LA). 

(19) Ductwork is designed, fabricated, and tested in accordance with ASME B31.3, “Process 

Piping” (ASME, 1998), and U.S. Energy Research and Development Administration 

(ERDA) 76-21, “Nuclear Air Cleaning Handbook” (ERDA, 1976) (Section 11.3.10.1 of the 

LA). 

11.3.3.1.2 Control Concepts 

As described in Sections 11.3.1.3, 11.3.2.3, 11.3.4.3, 11.3.5.3, 11.3.6.3, 11.3.7.3, and 11.3.8.3 

of the LA (MOX Services, 2009b), the ventilation and confinement system provides for 

instrumentation and control (I&C) systems to monitor and control the ventilation and 

confinement components. Section 11.6 of this SER discusses the I&C systems. These I&C 

systems include the following: 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 73

11.3.3.1.3 System Interfaces 

Individual confinement zone ventilation systems are interconnected to ensure that the proper 

negative pressures are maintained within confinement zones. Interlocks are provided to ensure 

that air from zones of higher radiation hazard cannot flow to zones of lower radiation hazard. 

The ventilation and confinement system also interfaces with the normal, standby, emergency, 

and uninterruptible power supplies so that systems can function properly in the event of power 

loss. Gloveboxes have functional and physical interfaces with ventilation systems; electrical 

systems; air, gas, chilled water, and demineralized water systems; chemical processing 

systems; and fire suppression systems (Sections 11.3.1, 11.3.1.4, 11.3.2, 11.3.2.4, 11.3.3, 

11.3.3.4, 11.3.4, 11.3.4.4, 11.3.5, 11.3.5.4, 11.3.6, 11.3.6.4, 11.3.7, 11.3.7.4, 11.3.8, and 

11.3.8.4 of the LA (MOX, 2009b)). 

11.3.3.2 Baseline Design Criteria 

Sections 11.3.1, 11.3.2, 11.3.3, 11.3.4, 11.3.5, 11.3.7, and 11.3.10 of the LA discuss the design 

bases for the ventilation and confinement system IROFS (MOX, 2009b). 

The staff reviewed the design bases for the ventilation and confinement system IROFS to 

ensure that there is reasonable assurance of protection against natural phenomena and the 

consequences of potential accidents. The design bases in accordance with Regulatory 

Guide 3.12 (NRC, 1973) and other industry air cleaning standards such as ASME N510 

(ASME, 1995) and ASME AG-1 (ASME, 1997). The staff also reviewed the design bases 

against the BDC in 10 CFR 70.64. The following discusses how the applicant meets the BDC. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 74

The staff reviewed the LA to ensure that the design bases would meet the quality standards and 

that management measures would be appropriately applied so that there is reasonable 

assurance that IROFS will be available and reliable to perform their intended function when 

needed. The MOX Quality Assurance Program Plan discusses the application of quality 

standards and Chapter 15 of the LA discusses management measures. This meets the 

regulatory requirements in 10 CFR 70.64(a)(1) and is, therefore, acceptable. 

For potential accidents involving fires, consistent with Chapter 7 of the LA, the staff reviewed the 

proposed design bases and the ISA Summary (MOX, 2009a), which describe the analyses and 

design features pertinent to fire protection. Design features of the ventilation and confinement 

system for fire protection include filter assembly redundancy, use of air dilution to mitigate the 

high-temperature effects of a fire, use of stainless steel roughing filters and stainless steel/glass 

fiber prefilters to prevent hot particles larger than 1 micron from contacting and starting fires on 

filters, and use of two redundant banks of HEPA filters in each filter assembly having a 

temperature rating of 204 degrees C (400 degrees F) and meeting the standards set by ASME 

AG-1 (ASME, 1997). 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 75

 

Therefore, based on the review of the applicant’s analyses, the staff finds that the filtration 

assemblies can perform their intended function under conditions of fire and that use of a 

removal efficiency of 99.99 percent is acceptable. 

Based on the above considerations, the staff finds that the fire protection design meets the 

regulatory requirements in 10 CFR 70.64(a)(3) and is, therefore, acceptable. 

The staff reviewed the design bases of the ventilation and containment system IROFS to ensure 

that they can withstand the effects of environmental conditions and the dynamic effects 

associated with normal operations, maintenance, testing, and postulated accidents. The 

ventilation and confinement system IROFS are designed to withstand fire and chemical effects. 

In-place testing and maintenance of HEPA filters are performed in accordance with ASME AG-1 

(ASME, 1997) and ASME N510 (ASME, 1995). HEPA filters are designed to withstand 

applicable pressure transients considering filter loadings and fan suction pressures. Filter 

replacement will be performed using bag-in/bag-out procedures to reduce the possibility of 

spreading contamination. This meets the regulatory requirements in 10 CFR 70.64(a)(4) and is, 

therefore, acceptable. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 76

The staff reviewed the design bases of the ventilation and confinement system to ensure that 

the system provides adequate protection against chemical risks produced from licensed 

material and facility conditions that affect the safety of licensed material and hazardous 

chemicals produced from licensed material. Gloveboxes are constructed of welded stainless 

steel to resist the corrosive effects of chemicals used in aqueous polishing and the MOX fuel 

fabrication processes. In addition, ductwork and filter assemblies upstream of the final filters 

are stainless steel, and filter materials will be designed to withstand the chemical effects 

resulting from normal operations. Chapter 8 of the LA discusses chemical safety (MOX, 2009b). 

This meets the regulatory requirements in 10 CFR 70.64(a)(5) and is, therefore, acceptable. 

The staff reviewed the design bases of the ventilation and confinement system to ensure that it 

provides for emergency capability to control the release of licensed material during normal 

operations and under postulated accident conditions. Release of licensed material is controlled 

by the use of redundant HEPA filter banks in redundant filter assemblies. Individual HEPA 

filters are tested to ensure that they are capable of removing at least 99.97 percent of 

0.3-micron particles. Following installation, IROFS HEPA filters are tested in place in 

accordance with ASME AG-1 (ASME, 1997) and ASME N510 (ASME, 1995) to ensure that 

leakage around filter banks is less than 0.05 percent (Section 11.3 of the LA (MOX, 2009b)). 

This meets the regulatory requirements in 10 CFR 70.64(a)(6) and is, therefore, acceptable. 

The staff reviewed the design bases of the ventilation and confinement system with respect to 

the electrical power supply. The C4 confinement system is supplied by normal, standby, 

emergency, and uninterruptible power supplies. The C3 exhaust system, process cell exhaust 

system, the emergency control room, and emergency diesel generator systems are supplied by 

normal, standby, and emergency power supplies. The C2 confinement system and the supply 

air system are supplied by normal and standby power supplies. These diverse power supply 

systems will ensure the continued operation of ventilation and confinement system IROFS. 

(Section 11.5 of this SER presents the staff’s review of the electrical systems.) This meets the 

regulatory requirements in 10 CFR 70.64(a)(7) and is, therefore, acceptable. 

The staff reviewed the proposed design bases of ventilation and confinement system IROFS to 

ensure that they provide for adequate inspection, testing, and maintenance to ensure availability 

and reliability to perform their function when needed. Redundant filter assemblies are provided 

so that single filter assemblies can be taken off line for maintenance, testing, and filter 

replacement. Dampers can be used to isolate individual filter assemblies and fans. The filter 

assembly design includes provisions for in-place testing of HEPA filters in accordance with 

ASME AG-1 (ASME, 1997) and ASME N510 (ASME, 1995). Filter assemblies use 

bag-in/bag-out designs for filter replacement to minimize the possibility of spreading 

contamination. This meets the regulatory requirements in 10 CFR 70.64(a)(8) and is, therefore, 

acceptable. 

The staff reviewed the proposed design bases of the ventilation and confinement system to 

ensure that the system provides for criticality control and adherence to the double-contingency 

principle. Based on experience from the MELOX site, the applicant assumed that up to 

3 kilograms (kg) (6.6 pounds (lb)) of plutonium dioxide (PuO2) could exist in the glovebox HEPA 

filter located in the pellet grinding glovebox, where material becomes airborne at a rate of 

0.3 grams per hour (0.01 ounces per hour), assuming that the HEPA filters are replaced at 

450-day intervals. This amount would be subcritical, as a quantity of 3 kg (6.6 lb) of PuO2 is 

substantially less than the minimum critical mass. The American National Standards 

Institute/American Nuclear Society (ANSI/ANS) Standard 8.1, “Nuclear Criticality Safety in 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 77

Operations with Fissionable Materials Outside Reactors” (ANSI/ANS, 1988), contains 

single-parameter (i.e., always safe) subcritical limits for 239PuO2 containing not more than 

1.5 weight percent (wt%) water. At full density, the subcritical limit is 10.2 kg (22.5 lb); at half 

density, the subcritical limit is 27 kg (59.5 lb). This would bound the worst-case conditions that 

could be found in the HEPA filters, because the ANSI limits conservatively assume that all of the 

plutonium is 239Pu (MOX plutonium will have at least 4 wt% 240Pu), and the maximum density for 

unsintered PuO2 powder (DCS 2004, Table 6-2) falls within the density range covered by the 

limits in ANSI/ANS 8.1. 

The staff reviewed the proposed design bases of the ventilation and confinement system to 

ensure that it provides for I&C systems to monitor and control the ventilation and confinement 

IROFS. These I&Cs include (1) pressure I&Cs to maintain proper negative pressures in each of 

the separate confinement zones, (2) manual and automatic damper controls to regulate air and 

gas flows within gloveboxes and confinement zones, (3) controls for the transfer of alternate 

power supplies, (4) instrumentation to measure differential pressures across filter banks, (5) 

variable-speed controls for fan operation, (6) air temperature and airflow instrumentation, and 

(7) nitrogen and dry air supply controls. Section 11.6 of this SER presents the staff’s review of 

I&C systems. This meets the regulatory requirements in 10 CFR 70.64(a)(10) and is, therefore, 

acceptable. 

11.3.3.3 Items Relied on for Safety 

Section 5.5.3 of the ISA Summary (MOX, 2009a) identifies IROFS associated with the 

confinement and ventilation systems. 

11.3.3.4 Accident Analyses 

The following loss-of-confinement (LOC) accident sequences are applicable to the confinement 

systems addressed in this SER chapter: 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 78

LOC-1 Overtemperature (glovebox dump valves, differential pressure switches, and the 

VHD and HDE ventilation systems) 

LOC-2 Small breach in glovebox boundary 

LOC-8 Overpressurization or underpressurization of the glovebox 

LOC-9 Excessive temperature in a glovebox 

LOC-10 Glovebox dynamic exhaust failure 

LOC-12 Sintering furnace confinement boundary failure 

 

11.3.3.4.1 Overtemperature (LOC-1) 

In this accident scenario, glovebox confinement is lost as the result of high-temperature 

conditions caused by equipment malfunctions that result in excessive heat generation (see 

Section 5.3.3.2.1 of the ISA Summary (MOX, 2009a)). 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 79

Based on the above discussion and a combination of the proposed IROFS, the staff agrees with 

the applicant that an overtemperature event that has a consequence exceeding the 

10 CFR 70.61 performance requirements is highly unlikely. The staff concludes with reasonable 

assurance that the applicant has demonstrated that the facility will be in compliance with the 

performance requirements of 10 CFR 70.61 if an overtemperature event occurs. 

 

11.3.3.4.2 Small Breach in Glovebox Boundary (LOC-2) 

In this accident scenario, glovebox confinement is lost as the result of equipment malfunctions 

caused by glove failures, bagport failures, inadvertent opening of manual room air supply 

valves, insufficient oil in hydraulic valves, vacuum breaker failures, glovebox seal failures, and 

breaches on the pneumatic transfer system (see Section 5.3.3.2.2 of the ISA Summary (MOX, 

2009b)). 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 80

Based on the above discussion and a combination of the proposed IROFS, the staff agrees with 

the applicant that a small breach in the glovebox event that has a consequence exceeding the 

10 CFR 70.61 performance requirements is highly unlikely. The staff concludes with reasonable 

assurance that the applicant has demonstrated that the facility will be in compliance with the 

performance requirements of 10 CFR 70.61 if a small breach of the glovebox event occurs. 

11.3.3.4.3 Overpressurization or Underpressurization of the Glovebox (LOC-8) 

In this accident scenario, glovebox confinement is lost as the result of a loss of structural 

integrity of the glovebox due to excessive positive or negative pressures. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 81

Based on the above discussion and a combination of the proposed IROFS, the staff agrees with 

the applicant that an underpressurization or overpressurization in the glovebox that has a 

consequence exceeding the 10 CFR 70.61 performance requirements is highly unlikely. The 

staff concludes with reasonable assurance that the applicant has demonstrated that the facility 

will be in compliance with the performance requirements of 10 CFR 70.61 if an 

underpressurization or overpressurization in the glovebox event occurs. 

11.3.3.4.4 Overtemperature in Glovebox Due to Radioactive Decay (LOC-9) 

In this accident scenario, confinement is lost as the result of high temperature conditions caused 

by excessive heat generation from the radioactive decay of stored radioactive materials (see 

Section 5.3.3.2.11 of the ISA Summary (MOX, 2009a)). 

Based on the above discussion and a combination of the proposed IROFS, the staff agrees with 

the applicant that an overtemperature in the glovebox due to radioactive decay that has a 

consequence exceeding the 10 CFR 70.61 performance requirements is highly unlikely. The 

staff concludes with reasonable assurance that the applicant has demonstrated that the facility 

will be in compliance with the performance requirements of 10 CFR 70.61 if an overtemperature 

in glovebox due to radioactive decay event occurs. 

11.3.3.4.5 Glovebox Dynamic Exhaust Failure (LOC-10) 

In this accident scenario, the glovebox and VHD ventilation system fails, resulting in a loss of 

negative pressure in a glovebox or group of gloveboxes (see Sections 5.3.3.2.11.1, 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 82

5.3.3.2.11.2, and 5.3.3.2.11.3 of the ISA Summary (MOX, 2009b)). 

Based on the above discussion and a combination of the proposed IROFS, the staff agrees with 

the applicant that a glovebox dynamic exhaust failure event that has a consequence exceeding 

the 10 CFR 70.61 performance requirements is highly unlikely. The staff concludes with 

reasonable assurance that the applicant has demonstrated that the facility will be in compliance 

with the performance requirements of 10 CFR 70.61 if a glovebox dynamic exhaust failure event 

occurs. 

11.3.3.4.6 Sintering Furnace Confinement Boundary Failure (LOC-12) 

In this accident scenario, the sintering furnace confinement boundary fails, resulting in a release 

of radioactive material directly to the process room (see Section 5.3.3.2.13 of the ISA Summary 

(MOX, 2009a)). 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 83

Based on the above discussion and a combination of the proposed IROFS, the staff agrees with 

the applicant that a sintering furnace confinement boundary failure event that has a 

consequence exceeding the 10 CFR 70.61 performance requirements is highly unlikely. The 

staff concludes with reasonable assurance that the applicant has demonstrated that the facility 

will be in compliance with the performance requirements of 10 CFR 70.61 if a sintering furnace 

confinement boundary failure event occurs. 

11.3.2 Evaluation Findings 

In Section 11.3 of the revised LA and Section 4.3 of the ISA Summary, the applicant provided 

information for the ventilation and confinement systems that it identified as IROFS for the 

proposed MFFF. The staff evaluated the above information and based on the review of this 

information and relevant supporting information provided by the applicant, the staff concluded 

that the applicant’s ventilation and confinement system designs and operations satisfy the staff’s 

acceptance criteria in NUREG-1718 and the systems are adequately available and reliable to 

perform their intended functions when needed. The staff finds that the applicant has 

satisfactorily complied with the applicable regulatory requirements, including the performance 

requirements, the baseline design criteria, and the defense-in-depth practices contained in 

10 CFR Part 70. 

REFERENCES 

(AGS, 1998) American Glovebox Society, Standard AGS-G001, “Guideline for Gloveboxes,” 

Santa Rosa, CA, 1998. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 84

(ANSI, 1994) American National Standards Institute, Standard ANSI N690, “Specification for the 

Design, Fabrication, and Erection of Safety Related Steel Structures for Nuclear Facilities,” New 

York, 1994. 

(ANSI, 1988) American National Standards Institute/American Nuclear Society, Standard 

ANSI/ANS 8.1, “Nuclear Criticality Safety in Operations with Fissionable Materials Outside 

Reactors,” New York, 1988. 

(ANSI/ANS, 1988) American National Standards Institute/American Nuclear Society, 

Standard 8.1, “Nuclear Criticality Safety in Operations with Fissionable Materials Outside 

Reactors,” New York, 1988. 

(ANSI/ASHRAE, 1999) American National Standards Institute/American Society of Heating, 

Refrigeration, and Air Conditioning Engineers, Standard ANSI/ASHRAE 52.2, “Method of 

Testing General Ventilation Air Cleaning Devices for Removal Efficiency by Particle Size,” New 

York, 1999. 

(ANSI/ASHRAE, 1992) American National Standards Institute/American Society of Heating, 

Refrigeration, and Air Conditioning Engineers, Standard ANSI/ASHRAE 52.1, “Gravimetric and 

Dust Spot Procedures for Testing Air Cleaning Devices Used in General Ventilation for 

Removing Particulate Matter,” New York, 1992. 

(ASME, 1998) American Society of Mechanical Engineers, Standard ASME B31.3, “Process 

Piping,” New York, 1998. 

(ASME, 1997) American Society of Mechanical Engineers, Standard ASME AG-1, “Code on 

Nuclear Air and Gas Treatment,” New York, 1991. 

(ASME, 1996) American Society of Mechanical Engineers, Standard ANSI/ASME N509, 

“Nuclear Power Plant Air-Cleaning Units and Components,” New York, 1996. 

(ASME, 1995) American Society of Mechanical Engineers, Standard ANSI/ASME N510, 

“Testing of Nuclear Air-Cleaning Systems,” New York, 1980. 

(ASTM, 2000) American Society for Testing and Materials, Standard E499, “Standard Test 

Methods for Leaks Using Mass Spectrometer Leak Detector in the Detector Probe Mode 1, 2,” 

West Conshohocken, PA, 2000. 

(AWS, 1998) American Welding Society, Standard AWS D1.1, “Structural Welding Code,” 

Miami, FL, 1998. 

(DCS 2004) Construction Authorization Request for a Mixed Oxide (MOX) Fuel Fabrication 

Facility, Aiken, SC, 2004. 

(ERDA, 1976) U.S. Energy Research and Development Administration, ERDA 76-21, “Nuclear 

Air Cleaning Handbook,” Oak Ridge, TN, 1976. 

(NFPA 1996) National Fire Protection Association 72, National Fire Alarm and Signaling Code, 

1996 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 85

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” Washington, 

DC, August 2000. 

(NRC, 1998) U.S. Nuclear Regulatory Commission, NUREG/CR-6410, “Nuclear Fuel Cycle 

Facility Accident Analysis Handbook,” Washington, DC, March 1998. 

(NRC, 1988) U.S. Nuclear Regulatory Commission, Regulatory Guide 1.100, Revision 2, 

“Seismic Qualification of Electric and Mechanical Equipment for Nuclear Power Plants,” 

Washington, DC, June 1988. 

 

(NRC, 1973) U.S. Nuclear Regulatory Commission, Regulatory Guide 3.12, “General Design. 

Guide for Ventilation Systems of Plutonium Processing and Fuel Fabrication Plants,” 

Washington, DC, August 1973. 

(MOX Services, 2009a) Shaw AREVA MOX Services, “Integrated Safety Analysis Summary,” 

Aiken, SC, October 2009. 

(MOX Services, 2009b) Shaw AREVA MOX Services, “License Application,” Aiken, SC, 

October 2009. 

11.4 Electrical Systems

This section of the safety evaluation report (SER) summarizes the U.S. Nuclear Regulatory 

Commission (NRC) staff’s review and evaluation of the electrical power systems for the Mixed 

Oxide Fuel Fabrication Facility (MFFF). To conduct this review, the NRC staff evaluated the 

adequacy of the design and intended operations of these systems, as reflected in the 

applicant’s commitments and goals with respect to that design. Shaw AREVA MOX Services 

(MOX Services or the applicant) described these commitments in the license application (LA) 

(MOX, 2010a) and the Integrated Safety Analysis (ISA) Summary (MOX, 2010b) for the Mixed 

Oxide (MOX) Fuel Fabrication Facility (MFFF). 

The purpose of the staff’s evaluation is to determine whether the design and intended 

operations of the MFFF electrical power systems are adequate to ensure that items designated 

as items relied upon for safety (IROFS) which require electrical power to complete their 

protective actions will be available and reliable to perform their intended safety function during 

normal operations, upset conditions, accidents, and natural phenomena events. The NRC staff 

makes this determination by evaluating the applicant’s commitments for completing the design 

of the MFFF electrical power systems in a manner that addresses specific regulatory 

acceptance criteria, identified in Section 11.4.1 of this SER. In addition to evaluating the 

description of the electrical design that is contained in the LA and ISA Summary, the NRC staff 

conducted “vertical slice” reviews of key accident sequence events described in other sections 

of the LA and ISA Summary based on risk significance. The NRC staff also reviewed 

supplementary information the applicant provided, based on RAIs. 

The staff performed this review of the MFFF electrical systems design by evaluating the 

descriptions provided by the applicant in the LA and ISA Summary, along with an evaluation of 

project design criteria, electrical and site layout drawings, equipment specifications, logic 

diagrams, procurement documents, and other documents made available to the NRC staff 

during in-office reviews. In addition to this broad review of the electrical design aspects of the 

MFFF, the staff performed its review in conjunction with the review of interfacing MFFF 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 86

instrumentation and control systems and a “vertical slice” review of the expected performance of 

other facility systems in response to accident sequences described in the applicant’s ISA 

Summary. In particular, the staff evaluated accident sequences resulting in the release of 

radiological materials. The purpose of this evaluation was to provide a basis for understanding 

how the conditions under which the facility dynamic confinement systems (which require the use 

of continuous electrical power following a release event) will respond. 

11.4.1 Regulatory Requirements 

The following regulations are applicable to the electrical power systems: 

• Title 10 of the Code of Federal Regulations (10 CFR) 70.22, “Contents of Applications,” 

which specifically relates to the requirement that the applicant describe the equipment 

and facilities and proposed procedures to protect health and minimize danger to life and 

property 

• 10 CFR 70.23, “Requirements for the Approval of Applications,” which specifically 

relates to the requirement that the Commission determine that the proposed equipment, 

facilities, and procedures are adequate to protect health and minimize danger to life and 

property 

• 10 CFR 70.61(e), which specifically relates to the requirement that each engineered or 

administrative control or control system that is needed to meet the performance 

requirements be designated as an IROFS and that the safety program must ensure that 

each IROFS will be available and reliable to perform its intended function when needed 

• 10 CFR 70.62, “Safety Program and Integrated Safety Analysis,” which specifically 

relates to the establishment and maintenance of a safety program and to the 

performance of an ISA 

• 10 CFR 70.64, “Requirements for New Facilities or New Processes at Existing 

Facilities,” which specifically relates to the application of baseline design criteria and 

defense-in-depth practices to new facilities or new processes at existing facilities 

11.4.2 Regulatory Acceptance Criteria 

The NRC staff’s evaluation focused on the design bases of the electrical power systems and 

other related information. The staff reviewed and evaluated the information provided by the 

applicant for the safety function, system description, and safety analysis for IROFS that require 

the use of electrical power to perform their safety actions. The review also encompassed the 

applicant’s adherence to proposed design-basis considerations, such as redundancy, 

independence, reliability, and quality. 

Section 11.4.2.2 of NUREG-1718, “Standard Review Plan for the Review of an Application for a 

Mixed Oxide (MOX) Fuel Fabrication Facility,” issued August 2000 (NRC, 2000), provides the 

acceptance criteria related to plant systems, including the electrical power systems. These 

criteria reflect the need to ensure that the baseline design criteria of 10 CFR 70.64 are achieved 

and that the concept of defense in depth has been applied to the design of the electrical power 

systems. In addition, the electrical systems’ design and operation should fulfill the functional 

requirements determined from the ISA, and the electrical systems should be available and 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 87

reliable to perform their intended safety functions when needed. No code requirements define 

the specific design criteria that are to be used in the design of the electrical power systems. 

However, specific design considerations for electrical systems would include the use of a 

minimum of two physically independent offsite power sources with redundant and independent 

onsite alternating current (ac) and direct current (dc) power subsystems designed in accordance 

with the following seven criteria: 

(1) provisions so that components of the electrical systems can be tested periodically for 

operability and required functional performance 

(2) electrical and physical separation to ensure that any required independence is 

maintained 

(3) no single-failure vulnerability 

(4) sufficient capacity and capability to ensure that the IROFS supported by the electrical 

systems perform their intended functions 

(5) adequate protective relaying and breaker control to ensure required functional 

performance and adequate response to electrical fault and overload conditions 

(6) status monitoring of the behavior of the systems and components that are identified as 

IROFS 

(7) system capability to maintain functionality when subjected to tornadoes, tornado 

missiles, earthquakes, floods, and any other appropriate severe natural phenomena as 

established in the ISA 

11.4.3 Electrical Power Systems Description

11.4.3.1 Overview of Electrical Power Systems and Their Safety Functions 

In Section 11.4 of the LA and Section 4.4 of the ISA Summary, the applicant described the 

proposed design of the MFFF electrical power supply system. The primary safety function of 

the electrical power system is to provide a reliable source of ac and dc power for facility IROFS 

under the full range of conditions expected to be present such that the performance objectives 

of 10 CFR Part 70, “Domestic Licensing of Special Nuclear Material,” will be met. The proposed 

design of the electrical power systems for the MFFF consists of several ac and dc subsystems, 

which together provide a reliable source of power to ensure the continued availability and 

operation of facility IROFS under normal, abnormal, design-basis accident, and loss of offsite 

power conditions. The design of the MFFF electrical power supply system addresses the 

principle of defense-in-depth. The primary facility IROFS requiring such reliable sources of 

power are the (high depressurization exhaust) HDE, (very high depressurization exhaust) VHD, 

and process cell depressurization exhaust (POE) fans. These are all needed to ensure that the 

MFFF heating, ventilation, and air conditioning (HVAC) confinement capability is maintained to 

allow the facility to meet the performance objectives of 10 CFR Part 70, as well as the controls 

and control systems supporting the numerous IROFS which must be continually available and 

reliable to accomplish their intended safety functions under all normal, upset, and emergency 

conditions. These control systems are provided with a supply of electrical power that has been 

designated as a system of IROFS. Hence, these control systems are required to be designed, 

implemented, and maintained in a manner that ensures the availability and reliability of electrical 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 88

power when needed. In addition, some facility IROFS are designed to place MFFF processes 

into a safe state upon the loss of electrical power. For these IROFS, reliable non-IROFS power 

subsystems are provided. These non-IROFS power subsystems are neither designated as 

quality level (QL)-1 items nor designed to meet the same quality requirements as the IROFS 

power supplies. 

The design of the MFFF electric power supply system incorporates the defense-in-depth 

concept through the implementation of a normal power system, a standby power system, and 

an emergency power system. Under normal operating conditions, a reliable (non-IROFS) power 

system (i.e., the normal power system) provides electrical energy to accomplish all the normal 

production, safety, and life-safety functions required by the facility. Two separate and 

independent incoming offsite power feeders supply the ultimate source of electrical power for 

the normal power system. Facility loads, including the emergency buses that supply power to 

ensure that IROFS are available to perform facility safety functions, are normally fed from either 

one of two normally isolated main MFFF buses, each of which is powered from one of these two 

independent sources of incoming offsite power. In the event that electrical power from one of 

the two independent sources of incoming offsite power is lost for any reason, the main bus 

experiencing the loss will be automatically connected, after a brief delay, to the bus being 

supplied by the remaining source of incoming offsite power. In a response to a request for 

additional information, the applicant stated that, in the past 35 years, the Savannah River Site, 

where the MFFF is located, has experienced only one loss of offsite power event, with a 

duration of approximately 12 hours (MOX, 2009). 

In the rare event of a total loss of all incoming power to the facility, a non-IROFS standby power 

system (the standby power system), with electrical power developed by two independent 

standby diesel generator subsystems, each sized to carry all IROFS loads, life-safety loads, and 

loads important to facility production, will automatically start and continue the supply of electrical 

power to facility loads. Those loads, which cannot tolerate the brief interruption of power that 

can occur before the standby diesel generator systems are started and loaded, are equipped 

with batteries or uninterruptible power supplies (UPSs) backed by batteries, as described in 

further detail below. The design of the standby power system is such that a single standby 

diesel generator subsystem can supply sufficient power to enable the continued operation of all 

IROFS loads, life-safety loads, and loads important for facility production for a period of 

24 hours without refueling. Although each diesel generator can supply the power needs for the 

facility for 24 hours, they are also capable of being operated in parallel with one another. 

In the very rare event that a total loss of all incoming power occurs and both standby diesel 

generator systems fail to start and load properly, an independent and redundant Class 1E 

emergency power system (the emergency power system) has been provided to continue the 

delivery of electrical power to those IROFS that are needed to ensure that the performance 

objectives of 10 CFR Part 70 will be met. The emergency power system has been designed to 

ensure that no single failure can occur that would result in the loss of a facility protective 

function. The emergency power system consists of two redundant and independent emergency 

diesel generator systems and Class 1E switchgear and distribution systems, each of which has 

been sized to carry all IROFS loads for its assigned train for an extended period of time until 

either the normal or standby power system can be restored. The emergency power system is 

designed such that either of the two redundant and independent power trains can supply the 

power needed to accomplish facility safety functions. The emergency power system is qualified 

to survive the MFFF design-basis earthquake. All emergency power system components are 

located in QL-1 structures, and all Class 1E circuits and equipment are separated and protected 

in accordance with nuclear industry codes and design standards, as described below. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 89

The following sections describe the design bases and design features of each of these electrical 

power subsystems in further detail. 

11.4.3.2 Non-IROFS Normal Power System 

The normal power system, which is a non-IROFS power supply system, provides the main 

source of electrical power to service all IROFS under normal operating conditions. The nonIROFS normal power system consists of the normal ac power subsystem and the normal dc 

power subsystem. Since the normal power supply provides an important role in furnishing 

electrical power for IROFS loads whenever offsite power is available to the MFFF, the 

subsystems of the normal power supply are described briefly below. 

11.4.3.2.1 Normal Alternating Current Power Subsystem 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 90

Provisions are made to facilitate testing and maintenance of the normal ac power subsystem 

under normal operating conditions. 

 

11.4.3.2.2 Normal Direct Current Power Subsystem 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 91

11.4.3.2.3 Normal Direct Current Power Supply Feed for the 208/120-VAC Essential Power 

Supply System 

 

11.4.3.2.4 Facility Grounding System 

11.4.3.3 Non-IROFS Standby Power System 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 92

 

Non-IROFS integrated standby diesel generator PLCs control the starting, synchronizing, and 

connection of the standby diesel generators to the paralleling bus operations. The normal utility 

control system PLC sheds noncritical loads from the 4.16-kV normal power switchgear buses 

and then automatically sequences the application of loads to the standby power system in two 

sequence groups. Load group 1 (highest priority) includes the emergency distribution systems, 

including the IROFS ventilation confinement system loads and other IROFS requiring electrical 

power to perform their required safety functions. Load group 2 includes nonemergency loads, 

including certain normal process loads and non-IROFS ventilation system loads. In the event 

that only one standby diesel generator is available, the normal utility control system PLC 

connects only load group 1 to the 4.16-kV normal power system switchgear buses. 

11.4.3.4 Emergency Power System (IROFS) 

 

11.4.3.4.1 Emergency Alternating Current Power System 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 93

 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 94

 

 

 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 95

 

 

 

 

11.4.4 Design Bases for Electrical Power Systems and Applicable Baseline Design 

Criteria
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 96

The electrical power systems designated as IROFS are required to be available and to provide 

reliable electrical power to MFFF IROFS for normal operations, to provide safe-shutdown 

capability, and to support monitoring during and following credible external events. The 

electrical systems and equipment required to accomplish these functions must remain 

operational when subjected to natural phenomena hazards (10 CFR 70.64(a)(2)). They must be 

adequately protected from fires and explosions (10 CFR 70.64(a)(3)), and they must provide for 

adequate protection from environmental and dynamic effects associated with normal operations, 

maintenance, testing, and postulated accidents that could lead to a loss of safety functions 

(10 CFR 70.64(a)(4)). The design must provide for continued operation of essential utility 

services (10 CFR 70.64(a)(7)) and adequate inspection, testing, and maintenance to ensure 

their availability to perform their function when needed (10 CFR 70.64(a)(8)). The design must 

provide for inclusion of instrumentation and control systems to monitor and control the behavior 

of IROFS (10 CFR 70.64(a)(10)). Finally, the system design must be based on defense-indepth practices and incorporate, to the extent practicable, a preference for selection of 

engineered controls over administrative controls to increase overall system reliability 

(10 CFR 70.64(b)). 

To ensure that the design-basis requirements and applicable baseline design criteria are met, 

the applicant has committed to complete the design, construction, startup testing, maintenance, 

and periodic functional and operability testing in accordance with specific industry standards 

and NRC guidance documents as described in the following sections. 

11.4.4.1 Design Criteria Applied to the Emergency Alternating Current and Direct Current 

Power Systems 

As described in the applicant’s LA and ISA Summary, the emergency ac and dc power systems 

are designed to provide reliable power to redundant IROFS to enable the MFFF to meet its 

performance objectives in the event of loss of offsite power. As described above, the 

emergency ac power buses within the MFFF receive normal power from two independent 

sources of offsite power generation. In the event that a loss of offsite power is experienced from 

one feed, the alternate source of power is made available to both emergency ac power buses. 

In the event that both sources of offsite power are lost, the standby diesel generators will 

automatically start and provide power to the emergency ac power buses. The emergency ac 

and dc power system designs utilize redundant, independent, physically separated, seismically 

qualified trains of power equipment, with adequate capacity, capability, and protective relaying 

to ensure the performance of its safety functions and maintain qualification for natural 

phenomena and environmental and dynamic effects. All emergency ac and dc power system 

components are designated as Class 1E. The equipment is protected by being located in 

structures that are designed to withstand tornados, earthquakes, and other natural external 

hazards. The equipment is located within areas of the MFFF where the expected environmental 

variations are within the normal design capabilities of the equipment. In the few instances in 

which any emergency ac and dc power system equipment or components are expected to be 

operated outside of normal manufacturer design environmental ranges, the equipment will be 

qualified for the expected environment. Furthermore, cables carrying power and control signals 

associated with the emergency ac and dc power system will be supported by raceways and 

cable trays that are seismically supported. Cables exposed to building areas in cable trays are 

designed to be flame retardant. Power cables to IROFS are routed to them in enclosed conduit 

to minimize the likelihood of interaction between divisional cables and between divisional cables 

and non-divisional cables. Where these electrical conductors cannot be separated to the extent 

identified within the MFFF electrical design criteria (e.g., where they enter small gloveboxes), 

redundant cables are separated from one another to the maximum extent practicable. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 97

To implement the design criteria described above, the emergency ac and dc power systems 

have been designed using guidance from the following industry standards: 

• Overall AC and DC Power System Design 

IEEE Standard 308-1991 (IEEE, 1991a) 

• Overall DC Power Systems Design 

IEEE Std 946-1992, “IEEE Recommended Practice for the Design of Safety Related DC 

Auxiliary Power Systems for Nuclear Power Plants” (IEEE, 1992b) 

• Equipment Seismic Qualification 

IEEE Std 344-1987, “IEEE Recommended Practices for Seismic Qualification of 

Class 1E Equipment for Nuclear Generating Stations” (IEEE, 1987a) 

• Equipment Environmental Qualification: 

IEEE Std 323-1983, “IEEE Standard for Qualifying Class 1E Equipment for Nuclear 

Power Generating Stations” (IEEE, 1983) 

• Preoperational and Periodic Surveillance Testing 

IEEE Std 308-1991 (IEEE, 1991a) 

IEEE Std 387-1995, “IEEE Standard Criteria for Diesel Generator Units Applied as 

Standby Power Supplies for Nuclear Power Generating Stations” (IEEE, 1995a) 

IEEE Std 338-1992, “IEEE Standard Criteria for the Periodic Surveillance Testing of 

Nuclear Power Generating Station Safety Systems” (IEEE, 1992c) 

Regulatory Guide (RG) 1.118, Revision 3, “Periodic Testing of Electric Power and 

Protection Systems” (NRC, 1995) 

• Single-Failure Design 

IEEE Std 379-1994, “IEEE Standard Application of the Single Failure Criterion to 

Nuclear Power Generating Station Safety Systems” (IEEE, 1994a) 

IEEE Std 603-1998, “IEEE Standard Criteria for Safety Systems for Nuclear Power 

Generating Stations” (IEEE, 1998) 

• Qualification and Fire Protection of Cables Installed in Open Cable Trays 

IEEE Std 383-1992, “IEEE Standard for Type Test of Class 1E Electric Cables, Field 

Splices and Connections for Nuclear Power Generating Stations” (IEEE, 1992d) 

• Protection of Emergency Power Systems Equipment from Explosions Resulting from 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 98

Hydrogen Accumulation 

National Fire Protection Association (NFPA, 1996) Standard 111-1996, “Standard on 

Stored Electrical Energy Emergency and Standby Power Systems” (NFPA, 1996) 

IEEE Std 484-1996, “IEEE Recommended Practice for Installation Design and 

Installation of Vented Lead-Acid Batteries for Stationary Applications” (IEEE, 1996a) 

• Electrical Independence and Separation 

IEEE Std 384-1992 (IEEE, 1992a), except where circuit breakers and fuses are used as 

isolation devices, in which case, two will be placed in series 

• Electrical Equipment Protection 

IEEE Std 741-1997, “IEEE Standard Criteria for the Protection of Class 1E Power 

Systems and Equipment in Nuclear Power Generating Stations” (IEEE, 1997a) 

IEEE Std 242-1986, “IEEE Recommended Practice for Protection and Coordination of 

Industrial and Commercial Power Systems” (IEEE, 1986a) 

• Design, Capacity Sizing, Installation, Testing, and Maintenance of Lead-Acid Batteries 

IEEE Std 484-1996 (IEEE, 1996a) 

IEEE Std 485-1997, “IEEE Recommended Practice for Sizing Lead-Acid Batteries for 

Stationary Applications” (IEEE, 1997b) 

IEEE Std 450-1995, “IEEE Recommended Practice for Maintenance, Testing, and 

Replacement of Vented Lead-Acid Batteries for Stationary Applications” (IEEE, 1995b) 

IEEE Std 1184-1994, “IEEE Guide for the Selection and Sizing of Batteries for 

Uninterruptible Power Systems” (IEEE, 1994b) 

• Design and Installation of Class 1E Transformers 

IEEE Std 638-1992, “IEEE Standard for Qualification of Class 1E Transformers for 

Nuclear Power Generating Stations” (IEEE, 1992e) 

• Design and Installation of Cable Systems and Class 1E Raceway Systems 

IEEE Std 690-1984, “IEEE Standard for Design and Installation of Cable Systems for 

Nuclear Power Generating Stations” (IEEE, 1984) 

IEEE Std 628-1987, “IEEE Standard Criteria for the Design, Installation, and 

Qualification of Raceway Systems for Class 1E Circuits for Nuclear Power Generating 

Stations” (IEEE, 1987b) 

• Design and Installation of Battery Chargers, Inverters, and Uninterruptible Power 

Supplies 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 99

IEEE Std 650-1990, “IEEE Standard for Qualification of Class 1E Static Battery 

Chargers and Inverters for Nuclear Power Generating Stations” (IEEE, 1990) 

IEEE Std 944-1986, “IEEE Recommended Practice for the Application and Testing of 

Uninterruptible Power Supplies for Power Generating Stations” (IEEE, 1986b) 

• Design, Installation, Testing, and Maintenance of Diesel Generator Systems and Diesel 

Generator Fuel Oil Systems 

IEEE Std 387-1995 (IEEE, 1995a) 

IEEE Std 446-1995, “IEEE Recommended Practice for Emergency and Standby Power 

Systems for Industrial and Commercial Applications” (IEEE, 1995c) 

American National Standards Institute/American Nuclear Society (ANSI/ANS) 59.51-

1997, “Fuel Oil Systems for Safety-Related Emergency Diesel Generators” (ANSI/ANS, 

1997) 

NFPA 30-1996, “Flammable and Combustible Liquids Code” (NFPA, 1996) 

NFPA 37-1998, “Standards for the Installation and Use of Stationary Combustion 

Engines and Gas Turbines” (NFPA, 1998) 

• Design, Installation, Measurement, and Testing of Grounding Systems 

IEEE Std 142-1991, “Recommended Practice for Grounding of Industrial and 

Commercial Power Systems” (IEEE, 1991b) 

NFPA 70-1999, “National Electrical Code” (NFPA, 1999) 

IEEE Std 80-1986, “IEEE Guide for Safety in Substations Grounding” (IEEE, 1986c) 

IEEE Std 81.2-1991, “IEEE Guide for Measurement of Impedance and Safety 

Characteristics of Large, Extended, or Interconnected Grounding Systems” (IEEE, 

1991c) 

IEEE Std 665-1995, “Guide for Generating Station Grounding” (IEEE, 1995d) 

IEEE Std 1050-1996, “Guide for Instrumentation and Control Equipment Grounding in 

Generating Stations” (IEEE, 1996b) 

IEEE Std 1100-1992, “Recommended Practice for Powering and Grounding Sensitive 

Electronic Equipment” (IEEE, 1992f) 

11.4.4.2 Preference for Automatic Engineered Controls 

The applicant has stated that the design of the emergency ac and dc power systems makes use 

of automatic, hardwired controls to detect loss of offsite power conditions, start standby or 

emergency diesel generators, and shed or connect (or both) loads to the buses, where possible. 

These measures will ensure timely restoration and delivery of power when needed by facility 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 100

IROFS, indicating that the emergency ac and dc power systems have been designed with a 

preference for automatic engineered controls over administrative controls (10 CFR 70.64(b)). 

11.4.4.3 Adherence to Defense-in-Depth Practices 

The design of the electrical systems at the MFFF makes use of the practice of defense-in-depth 

to a significant degree (see footnote to 10 CFR 70.64). First, the emergency ac and dc power 

systems make use of independent, redundant, and physically separated trains of equipment, 

such that no single credible failure can occur within one train that would render both trains 

inoperable, thereby preventing the MFFF from meeting the performance objectives of 

10 CFR Part 70. Further, the emergency ac and dc power systems are designed such that 

there are no fewer than four sources of normal or standby electrical power—two independent 

alternate sources of offsite power and two standby diesel generators—each of which has 

sufficient capacity to power the emergency power supply buses for an extended period. In the 

event that all of these sources of power are unavailable, each train of the emergency ac power 

system is equipped with its own Class 1E emergency diesel generator that will enable the safety 

functions of the MFFF IROFS to complete their protective actions. The provision of a minimum 

of two, independent offsite power sources for the MFFF is consistent with the requirements of 

IEEE 765-1995, “IEEE Standard for Preferred Power Supply for Nuclear Power Generating 

Stations,” (IEEE, 1995) which requires the use of two separate and independent sources of 

power. The standby power system diesel generator systems are designed to meet NFPA 110, 

“Standard for Emergency and Standby Power Systems” (NFPA, 1999b) and IEEE 446-1995 

(IEEE, 1995c). 

11.4.5 External Manmade Hazard Event Sequences 

Section 5.3.9 of the ISA Summary discusses the results of the applicant’s evaluation of external 

manmade hazard (EMMH) events. The following EMMH event group is related to the electrical 

design: EMMH-3, “Loss of Offsite Power.” The Savannah River Site electrical 

transmission/distribution system is supplied by multiple offsite feeds. The location of these 

feeds provides a reliable power supply in the event of manmade or natural phenomena hazards. 

The applicant postulated that EMMHs caused an accidental loss of offsite power for the MFFF 

site. A loss of offsite power was postulated to occur from a number of possible events, including 

power generation problems and transportation accidents. This event includes loss of feed from 

the Savannah River Site. The safety strategy for this event is to mitigate the consequences 

from a loss of offsite power for the MFFF site by providing emergency power, and the IROFS for 

this event is the emergency power system. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 101

With respect to the discussions in Section 11.4.4, the staff concludes with reasonable 

assurance that the applicant has demonstrated that the facility will be in compliance with the 

performance requirements of 10 CFR 70.61, “Performance Requirements,” in the event of a loss 

of offsite power. 

11.4.6 Evaluation Findings 

The NRC staff has evaluated the information provided by the applicant for electrical systems in 

the LA and the ISA Summary. For the reasons outlined in Section 11.4.4 of this SER, the staff 

concludes that the baseline design criteria of 10 CFR 70.64 have been achieved and that the 

concept of defense-in-depth has been applied to the design of the electrical power systems. In 

addition, there is reasonable assurance that the electrical systems’ design and operation will 

fulfill the functional requirements of providing reliable power to enable the MFFF IROFS to 

perform their required safety actions. In addition, the applicant provided reasonable assurance 

that the electrical systems will be available and reliable to perform their intended safety 

functions when needed. Further, the design of the MFFF incorporates the specific design 

considerations outlined in the regulatory acceptance criteria in Section 11.4.3 of this SER. 

These criteria include the use of a minimum of two physically independent offsite power sources 

with redundant and independent onsite ac and dc power subsystems designed in accordance 

with the following seven criteria as listed in Section 11.4.2.2 of NUREG-1718.: 

(1) provisions so that components of the electrical systems can be tested periodically for 

operability and required functional performance 

(2) electrical and physical separation to ensure that any required independence is 

maintained 

(3) no single-failure vulnerability 

(4) sufficient capacity and capability to ensure that IROFS supported by the electrical 

systems perform their intended functions 

(5) adequate protective relaying and breaker control to ensure required functional 

performance and adequate response to electrical fault and overload conditions 

(6) status monitoring of the behavior of the systems and components that are identified as 

IROFS 

(7) system capability to maintain functionality when subjected to tornadoes, tornado 

missiles, earthquakes, floods, and any other appropriate severe natural phenomena as 

established in the ISA 

The staff concludes that, with the proposed IROFS, the adherence to designated codes and 

industry standards, the application of management measures, and application of the MOX 

project Quality Assurance Plan (MPQAP), the baseline design requirements for the applicant’s 

proposed electrical systems, equipment, controls, and procedures have been achieved. The 

staff further concludes that there is reasonable assurance that the electrical power systems will 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 102

be sufficiently reliable and available to enable the MFFF IROFS to perform their required safety 

functions when needed. 

REFERENCES

(ANSI/ANS, 1997) American National Standards Institute/American Nuclear Society, ANSI/ANS 

59.51-1997, “Fuel Oil Systems for Safety-Related Emergency Diesel Generators,” 1997. 

(IEEE, 1998) Institute of Electrical and Electronics Engineers, Std 603-1998, “IEEE Standard 

Criteria for Safety Systems for Nuclear Power Generating Stations,” New York, NY, 1998. 

(IEEE, 1997a) Institute of Electrical and Electronics Engineers, IEEE Std 741-1997, “IEEE 

Standard Criteria for the Protection of Class 1E Power Systems and Equipment in Nuclear 

Power Generating Stations,” New York, NY, 1997. 

(IEEE, 1997b) Institute of Electrical and Electronics Engineers, IEEE Std 485-1997, “IEEE 

Recommended Practice for Sizing Lead-Acid Batteries for Stationary Applications,” New York, 

NY, 1997. 

(IEEE, 1996a) Institute of Electrical and Electronics Engineers, IEEE Std 484-1996, “IEEE 

Recommended Practice for Installation Design and Installation of Vented Lead-Acid Batteries 

for Stationary Applications,” New York, NY, 1996. 

(IEEE, 1996b) Institute of Electrical and Electronics Engineers, IEEE Std 1050-1996, “Guide for 

Instrumentation and Control Equipment Grounding in Generating Stations,” New York, NY, 

1996. 

(IEEE, 1995a) Institute of Electrical and Electronics Engineers, IEEE Std 387-1995, “IEEE 

Standard Criteria for Diesel Generator Units Applied as Standby Power Supplies for Nuclear 

Power Generating Stations,” New York, NY, 1995. 

(IEEE, 1995b) Institute of Electrical and Electronics Engineers, IEEE Std 450-1995, “IEEE 

Recommended Practice for Maintenance, Testing, and Replacement of Vented Lead-Acid 

Batteries for Stationary Applications,” New York, NY, 1995. 

(IEEE, 1995c) Institute of Electrical and Electronics Engineers, IEEE Std 446-1995, “IEEE 

Recommended Practice for Emergency and Standby Power Systems for Industrial and 

Commercial Applications,” New York, NY, 1995. 

(IEEE, 1995d) Institute of Electrical and Electronics Engineers, IEEE Std 665-1995, “Guide for 

Generating Station Grounding,” New York, NY, 1995. 

(IEEE, 1994a) Institute of Electrical and Electronics Engineers, IEEE Std 379-1994, “IEEE 

Standard Application of the Single Failure Criterion to Nuclear Power Generating Station Safety 

Systems,” New York, NY, 1994. 

(IEEE, 1994b) Institute of Electrical and Electronics Engineers, IEEE Std 1184-1994, “IEEE 

Guide for the Selection and Sizing of Batteries for Uninterruptible Power Systems,” New York, 

NY, 1994. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 103

(IEEE, 1992a) Institute of Electrical and Electronics Engineers, IEEE Std 384-1992, “IEEE 

Standard Criteria for Independence of Class 1E Equipment and Circuits,” New York, NY, 1992. 

(IEEE, 1992b) Institute of Electrical and Electronics Engineers, IEEE Std 946-1992, “IEEE 

Recommended Practice for the Design of Safety Related DC Auxiliary Power Systems for 

Nuclear Power Plants,” New York, NY, 1992. 

(IEEE, 1992c) Institute of Electrical and Electronics Engineers, IEEE Std 338-1992, “IEEE 

Standard Criteria for the Periodic Surveillance Testing of Nuclear Power Generating Station 

Safety Systems,” New York, NY, 1992. 

 

(IEEE, 1992d) Institute of Electrical and Electronics Engineers, IEEE Std 383-1992, “IEEE 

Standard for Type Test of Class 1E Electric Cables, Field Splices and Connections for Nuclear 

Power Generating Stations,” New York, NY, 1992. 

(IEEE, 1992e) Institute of Electrical and Electronics Engineers, IEEE Std 638-1992, “IEEE 

Standard for Qualification of Class 1E Transformers for Nuclear Power Generating Stations,” 

New York, NY, 1992. 

(IEEE, 1992f) Institute of Electrical and Electronics Engineers, IEEE Std 1100-1992, 

“Recommended Practice for Powering and Grounding Sensitive Electronic Equipment,” New 

York, NY, 1992. 

(IEEE, 1991a) Institute of Electrical and Electronics Engineers, IEEE Std 308-1991, “IEEE 

Standard Criteria for Class 1E Power Systems for Nuclear Generating Stations,” New York, NY, 

1991. 

 

(IEEE, 1991b) Institute of Electrical and Electronics Engineers, IEEE Std 142-1991, 

“Recommended Practice for Grounding of Industrial and Commercial Power Systems,” New 

York, NY, 1991. 

(IEEE, 1991c) Institute of Electrical and Electronics Engineers, IEEE Std 81.2-1991, “IEEE 

Guide for Measurement of Impedance and Safety Characteristics of Large, Extended, or 

Interconnected Grounding Systems,” New York, NY, 1991. 

(IEEE, 1990) Institute of Electrical and Electronics Engineers, IEEE Std 650-1990, “IEEE 

Standard for Qualification of Class 1E Static Battery Chargers and Inverters for Nuclear Power 

Generating Stations,” New York, NY, 1990. 

(IEEE, 1987a) Institute of Electrical and Electronics Engineers, IEEE Std 344-1987, “IEEE 

Recommended Practices for Seismic Qualification of Class 1E Equipment for Nuclear Power 

Generating Stations,” New York, NY, 1987. 

(IEEE, 1987b) Institute of Electrical and Electronics Engineers, IEEE Std 628-1987, “IEEE 

Standard Criteria for the Design, Installation, and Qualification of Raceway Systems for 

Class 1E Circuits for Nuclear Power Generating Stations,” New York, NY, 1987. 

(IEEE, 1986a) Institute of Electrical and Electronics Engineers, IEEE Std 242-1986, “IEEE 

Recommended Practice for Protection and Coordination of Industrial and Commercial Power 

Systems,” New York, NY, 1986. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 104

(IEEE, 1986b) Institute of Electrical and Electronics Engineers, IEEE Std 944-1986, “IEEE 

Recommended Practice for the Application and Testing of Uninterruptible Power Supplies for 

Power Generating Stations,” New York, NY, 1986. 

(IEEE, 1986c) Institute of Electrical and Electronics Engineers, IEEE Std 80-1986, “IEEE Guide 

for Safety in Substations Grounding,” New York, NY, 1986. 

(IEEE, 1984) Institute of Electrical and Electronics Engineers, IEEE Std 690-1984, “IEEE 

Standard for Design and Installation of Cable Systems for Nuclear Power Generating Stations,” 

New York, NY, 1984. 

(IEEE, 1983) Institute of Electrical and Electronics Engineers, IEEE Std 323-1983, “IEEE 

Standard for Qualifying Class 1E Equipment for Nuclear Power Generating Stations,” New York, 

NY, 1983. 

(IEEE, 1995) Institute of Electrical and Electronics Engineers, IEEE Std 765-1995, “IEEE 

Standard for Preferred Power Generating Stations”, New York, 1995 

(MOX, 2010a) Shaw AREVA MOX Services, “MFFF—License Application,” Aiken, SC, March 

2010. 

(MOX, 2010b) Shaw AREVA MOX Services, “MFFF—Integrated Safety Analysis Summary,” 

Aiken, SC, March 2010. 

(MOX, 2009) Stinson, D., Shaw AREVA MOX Services, Letter to U.S. Nuclear Regulatory 

Commission, RE: Shaw AREVA MOX Services Response to a Request for Additional 

Information (DCS-NRC-000251), October 5, 2009. 

(NFPA, 1996) National Fire Protection Association, NFPA 111-1996, “Stored Electrical 

Emergency and Standby Power Systems”, Quincy, MA 1996 

(NFPA, 1999a) National Fire Protection Association, NFPA 70-1999, “National Electrical Code,” 

Quincy, MA, 1999. 

(NFPA, 1999b) National Fire Protection Association, NFPA 110, “Standard for Emergency and 

Standby Power Systems,” Quincy, MA, 1999. 

(NFPA, 1998) National Fire Protection Association, NFPA 37-1998, “Standards for the 

Installation and Use of Stationary Combustion Engines and Gas Turbines,” Quincy, MA, 1998. 

(NFPA, 1996) National Fire Protection Association, NFPA 30-1996, “Flammable and 

Combustible Liquids Code,” Quincy, MA, 1996. 

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” Washington, 

DC, August 2000. 

(NRC, 1995) U.S. Nuclear Regulatory Commission, RG 1.118, Rev. 3, “Periodic Testing of 

Electric Power and Protection Systems,” April 1995. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 105

11.5 Instrumentation and Control Systems

This section of the safety evaluation report (SER) summarizes the U.S. Nuclear Regulatory 

Commission (NRC) staff=s review and evaluation of the instrumentation and control (I&C) 

systems for the Mixed Oxide (MOX) Fuel Fabrication Facility (MFFF). The objective of this 

review is to determine whether the aspects of the design of the I&C systems that are relied on 

for safety, in accordance with Title 10 of the Code of Federal Regulations (10 CFR) Part 70, 

“Domestic Licensing of Special Nuclear Material,” and encompassed by the hazard and 

accident analyses of the integrated safety analysis (ISA) will be available and reliable to perform 

their intended function when needed. To conduct this review, the NRC staff evaluated the 

adequacy of the design and intended operations of these systems, as reflected in the 

commitments and goals with respect to that design made by Shaw AREVA MOX Services 

(MOX Services or the applicant). The applicant described these commitments and goals in the 

license application (LA) (MOX, 2010a) and the ISA Summary (MOX, 2010b). 

The purpose of the staff’s evaluation is to determine whether the design and intended 

operations of the I&C systems for the MFFF are adequate to ensure that I&C items designated 

as items relied upon for safety (IROFS) will be available and reliable to perform their intended 

safety function during normal operations, upset conditions, accidents, and natural phenomena 

events. The NRC staff makes this determination by evaluating the applicant’s commitments in 

the LA for completing the design of the MFFF I&C systems in a manner that addresses the 

regulatory acceptance criteria, identified in Section 11.5.1 of this SER below. In addition to 

evaluating the description of the I&C design that is contained in the LA and ISA Summary, the 

NRC staff conducted “vertical slice” reviews of key accident sequence events described in other 

sections of the LA and ISA Summary, as well as reviews of supplementary information provided 

by the applicant. 

The staff performed the review of the MFFF I&C systems design by evaluating the descriptions 

provided by the applicant in the LA and ISA Summary, along with an evaluation of project 

design criteria, piping and instrument diagrams, electrical/I&C schematic diagrams, logic 

diagrams, nuclear safety evaluations, nuclear criticality safety evaluations, system descriptions, 

and other documents made available to the NRC staff during in-office reviews. In addition to 

this broad review of the I&C design aspects of the MFFF, the staff performed its review in 

conjunction with the review of interfacing MFFF electrical power systems and a detailed review 

of the expected performance of selected higher risk facility systems in response to accident 

sequences described in the applicant’s ISA Summary. In particular, the staff evaluated accident 

sequences resulting in the release of radiological materials within gloveboxes and process cells 

to provide a basis for understanding the conditions under which I&C IROFS performing or 

supporting safety actions of the facility dynamic confinement systems will be required to 

respond. The staff also assessed the adequacy of the applicant’s process for the development 

life cycle of software for MFFF digital control systems used as IROFS to determine whether 

there is reasonable assurance that such IROFS will be available and reliable when needed by 

minimizing the potential for common-cause software errors. 

11.5.1 Regulatory Requirements 

The following regulations are applicable to the I&C systems: 

• 10 CFR 70.22, “Contents of Applications,” which specifically relates to the requirement 

that the applicant describe the equipment and facilities and proposed procedures to 

protect health and minimize danger to life and property 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 106

• 10 CFR 70.23, “Requirements for Approval of Applications,” which specifically relates to 

the requirement that the Commission determine that the proposed equipment, facilities, 

and procedures are adequate to protect health and minimize danger to life and property 

• 10 CFR 70.61(e), “Performance Requirements”, which specifically relates to the 

requirement that each engineered or administrative control or control system that is 

needed to meet the performance requirements be designated as an IROFS and that the 

safety program must ensure each IROFS will be available and reliable to perform its 

intended function when needed 

• 10 CFR 70.62, “Safety Program and Integrated Safety Analysis,” which specifically 

relates to the establishment and maintenance of a safety program and to the 

performance of an ISA 

• 10 CFR 70.64, “Requirements for New Facilities or New Processes at Existing 

Facilities,” which specifically relates to the application of baseline design criteria and 

defense-in-depth practices to new facilities or new processes at existing facilities 

11.5.2 Regulatory Acceptance Criteria 

The NRC staff’s evaluation focused on the design bases of the I&C systems and other related 

information. The staff reviewed and evaluated the information provided by the applicant for the 

safety function, system description, and safety analysis for IROFS that require use of the I&C 

systems and equipment to perform their safety actions. The review also encompassed the 

applicant’s adherence to proposed design-basis considerations, such as redundancy, 

independence, reliability, and quality. 

Section 11.4.3.2 of NUREG-1718, “Standard Review Plan for the Review of an Application for a 

Mixed Oxide (MOX) Fuel Fabrication Facility,” issued August 2000 (NRC, 2000a), provides the 

acceptance criteria related to plant systems, including the I&C systems. These criteria reflect 

the need to ensure that the baseline design criteria of 10 CFR 70.64 are achieved and that the 

concept of defense in depth has been applied to the design of the I&C systems. In addition, the 

I&C systems’ design and operation should fulfill the functional requirements determined from the 

ISA, and the I&C systems should be available and reliable to perform their intended safety 

functions when needed. No code requirements define the specific design criteria that are to be 

used in the design of the I&C systems. However, specific design considerations for I&C 

systems include the use of redundant and diverse safety instrument channels with coincident 

logic providing automatic actuation with additional manual operation capability. The I&C safety 

systems should be designed in accordance with the following seven criteria from NUREG-1718, 

Section 11.4.3.2.: 

(1) provisions so that I&C system components can be tested periodically for operability and 

required functional performance 

(2) electrical, physical, and control/separation to ensure that any required redundancy and 

independence are maintained 

(3) no single-failure vulnerability 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 107

(4) adequate instrument spans, setpoints, and control ranges to ensure proper monitoring 

and control of IROFS 

(5) provisions so that I&C system components fail in a safe failure mode 

(6) status monitoring of the behavior of the systems and components that are identified as 

IROFS 

(7) system capability to maintain functionality when subjected to tornadoes, tornado 

missiles, earthquakes, floods, and any other appropriate severe natural phenomena as 

established in the ISA 

11.5.3 Instrumentation and Control Systems Description

11.5.3.1 Overview of Instrumentation and Control Systems and Their Safety Functions 

In Section 11.5 of the LA and Section 4.5 of the ISA Summary, the applicant described the 

proposed design of the major MFFF I&C systems and devices in detail. The MFFF I&C design 

includes both safety and non-safety applications of I&C. The safety functions of the I&C 

systems and equipment serving as IROFS are designed to reduce the risk of high and medium 

consequence events and to limit the risk of nuclear criticality under all normal and credible 

abnormal conditions. Some of these safety functions are designed to prevent the occurrence of 

accident sequences within the MFFF process units, while others are designed to ensure the 

continued availability of electrical and confinement heating, ventilation, and air conditioning 

(HVAC) systems needed to limit the release of radioactive materials to the environment. The 

control systems for these electrical and HVAC confinement processes are designed using 

defense-in-depth principles, as described below. 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 108

 

 

11.5.3.2 Normal Process Control Systems (Non-IROFS) 

 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 109

 

 

 

11.5.3.2.2 Control Rooms and Control Areas 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 110

 

11.5.3.2.3 Personnel and Equipment Protection Controls 

 

11.5.3.3 Utility Control Systems (Non-IROFS) 

 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 111

11.5.3.4 Emergency Control Systems and the Seismic Monitoring and Trip System (IROFS) 

 

 

11.5.3.5 Safety Control System (IROFS) 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 112

 

The safety controls are treated as Class 1E equipment and are designed with redundancy, 

independence, separation, capabilities for periodic testability, provision of system status 

information, control of access, reliability, appropriate equipment qualification, and continued 

maintenance of the facility within acceptable limits in the presence of a common-cause software 

failure. The safety controllers have been designed to address the applicable guidance in 

Regulatory Guide (RG) 1.153, Revision 1, “Criteria for Safety Systems,” and the applicable 

portions of IEEE Std 603-1998, “IEEE Standard Criteria for Safety Systems for Nuclear Power 

Generating Stations” (IEEE, 1998a), and IEEE Std 7-4.3.2-1993, “IEEE Standard Criteria for 

Digital Computers in Safety Systems of Nuclear Power Generating Stations” (IEEE, 1993). 

To ensure that the software for the redundant safety controllers has been developed using high 

quality systems development processes consistent with the quality assurance commitments for 

the facility and to minimize the potential for a common-cause software failure simultaneously 

rendering both safety controllers inoperable, the applicant has committed to develop software 

for these systems following the guidance contained in RG 1.168, “Verification, Validation, 

Reviews, and Audits for Digital Computer Software Used in Safety Systems of Nuclear Power 

Plants” (NRC, 1997a), with clarifications regarding the applicability of IEEE Std 1028-1997, 

“IEEE Standard for Software Reviews” (IEEE, 1997a); RG 1.169, “Configuration Management 

Plans for Digital Computer Software Used in Safety Systems of Nuclear Power Plants” (NRC, 

1997b); RG 1.170, “Software Test Documentation for Digital Computer Software Used in Safety 

Systems of Nuclear Power Plants” (NRC, 1997h); RG 1.171, “Software Unit Testing for Digital 

Computer Software Used in Safety Systems of Nuclear Power Plants” (NRC 1997i); RG 1.172, 

“Software Requirements Specifications for Digital Computer Software Used in Safety Systems 

of Nuclear Power Plants” (NRC, 1997c), including the exceptions noted with respect to IEEE Std 

830-1998 (IEEE, 1998b); and RG 1.173, “Developing Software Life Cycle Processes for Digital 

Computer Software Used in Safety Systems of Nuclear Power Plants” (NRC, 1997d) 

11.5.4 Design Bases for Instrumentation and Control Systems and Applicable Baseline 

Design Criteria

The I&C systems designated as IROFS are required to be available and reliable for all normal 

operations and upset conditions, provide for safe-shutdown capability, and support monitoring 

during and following identified event sequences and credible external events. The I&C systems 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 113

and equipment required to accomplish these functions must remain operational when subjected 

to natural phenomena hazards (10 CFR 70.64(a)(2)). They must be adequately protected from 

fires and explosions (10 CFR 70.64(a)(3)). They must provide for adequate protection from 

environmental and dynamic effects associated with normal operations, maintenance, testing, 

and postulated accidents that could lead to a loss of safety functions (10 CFR 70.64(a)(4)). The 

I&C design must provide for the support of continued operation of essential utility services 

(10 CFR 70.64(a)(7)). The design must provide for adequate inspection, testing, and 

maintenance of the I&C systems to ensure their availability to perform their function when 

needed (10 CFR 70.64(a)(8)). The design must also provide for inclusion of I&C systems to 

monitor and control the behavior of IROFS (10 CFR 70.64(a)(10)). Finally, the system design 

must be based on defense-in-depth practices and incorporate, to the extent practicable, a 

preference for selection of engineered controls over administrative controls to increase overall 

system reliability (10 CFR 70.64(b)). 

To ensure that the design-basis requirements and applicable baseline design criteria are met, 

the applicant has committed in the LA to complete the design, safety requirements specification, 

software development, validation and verification testing, startup testing, maintenance, and 

periodic functional and operability testing of the I&C systems in accordance with specific 

industry standards and NRC guidance documents as described in the sections below. 

11.5.4.1 Design Criteria Applied to the MFFF Instrumentation and Control Systems 

As described in the applicant’s LA and ISA Summary, the MFFF I&C systems are designed to 

be available and reliable to support normal, upset, and accident conditions to allow the MFFF to 

meet its performance objectives while sustaining credible single active failures. The equipment 

is protected by its location in structures designed to withstand tornados, earthquakes, and other 

natural external hazards. As described above, the I&C systems and equipment serving as 

IROFS are designated as Class 1E and are composed of QL-1 components. The emergency 

control system is composed of hardwired equipment dedicated for use with the electrical 

equipment and HVAC systems needed to support the radiological material confinement 

function. The emergency control system is designed with two redundant and independent 

systems in a train A/train B arrangement, capable of functioning during and following dynamic 

effects resulting from the occurrence of a design-basis earthquake or a postulated accident 

sequence. 

The applicant has committed to using a software development process for the Class 1E, 

redundant digital safety PLCs that minimizes the likelihood of common-mode failures rendering 

both redundant PLCs simultaneously inoperable. The applicant will complete the software 

development process in accordance with the recommendations and guidance of a set of 

generally accepted industry standards which promote high functional reliability and design 

quality in software used in safety systems, as well as the RGs that describe acceptable methods 

for designing such systems using these standards. 

The equipment is located within areas of the MFFF where the expected environmental 

variations are within the normal design capabilities of the equipment. Notwithstanding, the 

applicant has committed to qualify all equipment with the potential for exposure to elevated 

environmental conditions in accordance with applicable nuclear industry standards for 

equipment environmental qualification. Cables carrying instrument power and control signals 

will be installed in conduit that is seismically supported. Cables exposed to building areas in 

cable trays are designed to be flame retardant. Cables for instrument sensor and actuation 

devices associated with IROFS are routed in enclosed conduit to minimize the likelihood of 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 114

interaction between divisional cables and between divisional cables and nondivisional cables. 

Where these electrical conductors cannot be separated to the extent identified within the MFFF 

electrical design criteria (e.g., where they enter small gloveboxes), redundant cables are 

separated from one another to the maximum extent practicable. 

To implement the design criteria described above, the applicant has committed to complete the 

design of the MFFF I&C systems in accordance with the recommendations and guidance from 

the following nuclear industry standards and NRC guidance: 

• Overall I&C Safety System Design (Including the Seismic Monitoring and Trip System) 

IEEE Std 603-1998 (IEEE, 1998a) 

RG 1.153, Revision 1 (NRC, 1991) 

• Single Failure Design 

IEEE Std 379-1994, “IEEE Standard Application of the Single Failure Criterion to 

Nuclear Power Generating Station Safety Systems” (IEEE, 1994a), supplemented by the 

following: 

– Branch Technical Position HICB-17, “Guidance on Self-Test and Surveillance 

Test Provisions” (NRC, 1997e) 

– IEEE Std 603-1998 (IEEE, 1998a) 

– RG 1.153, Revision 1 (NRC, 1991) 

• Software Programmable Electronic Systems 

IEEE Std 7-4.3.2-1993 (IEEE, 1993) 

IEEE Std 730-1998, “Software Quality Assurance Plans” (IEEE,1998c) 

IEEE Std 828-1998, “IEEE Standard for Software Configuration Management Plans” 

(IEEE, 1998d) 

IEEE Std 830-1998 (IEEE, 1998b) 

IEEE Std 1012-1998, “IEEE Standard for the Software Verification and Validation” 

(IEEE, 1998e) 

IEEE Std 1028-1997, “IEEE Standard for Software Reviews” (IEEE, 1997a) 

IEEE Guide 1042-1987, “Software Configuration Management” (IEEE, 1987a) 

IEEE Std 1074-1997, “IEEE Standard for Developing Software Life Cycle Processes” 

(IEEE, 1997b) 

IEEE Std 1228-1994, “IEEE Standard for Software Safety Plans” (IEEE, 1994b) 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 115

RG 1.152, Revision 1, “Criteria for Digital Computers in Safety Systems of Nuclear 

Power Plants” (NRC, 1996b) 

RG 1.153, Revision 1 (NRC, 1991) 

RG 1.168 (NRC, 1997a) 

RG 1.169 (NRC, 1997b) 

RG 1.170 (NRC, 1997h) 

RG 1.171 (NRC, 1997i) 

RG 1.172 (NRC, 1997c) 

RG 1.173 (NRC, 1997d) 

Electric Power Research Institute, TR-106439, “Guideline on Evaluation and Acceptance 

of Commercial Grade Digital Equipment for Nuclear Safety Applications” (EPRI, 1996) 

NRC Safety Evaluation, “EPRI Topical Report TR-106439” (NRC, 1997f) 

International Electrotechnical Commission, 61131-3 (1993-03), “Programmable 

Controllers—Part 3: Programming Languages” (IEC, 1993) 

NUREG/CR-6090, “The Programmable Logic Controller and Its Application in Nuclear 

Reactor Systems” (NRC, 1993) 

NUREG/CR-6463, “Review Guidelines for Software Languages for Use in Nuclear 

Power Plant Safety Systems: Final Report” (NRC, 1996a) 

• Electrical Independence, Separation, and Qualification of Isolation Devices 

IEEE Std 384-1992, “IEEE Standard Criteria for Independence of Class 1E Equipment 

and Circuits (IEEE, 1992a) 

NUREG-0800, Standard Review Plan, Branch Technical Position HICB-11, “Guidance 

on the Application and Qualification of Isolation Devices” (NRC, 1997g) 

RG 1.75, Revision 2, “Physical Independence of Electric Systems” (NRC, 1978) 

• Seismic Qualification of Equipment 

IEEE Std 344-1987, “IEEE Recommended Practices for Seismic Qualification of Class 

1E Equipment for Nuclear Generating Stations” (IEEE, 1987b) 

RG 1.100, Revision 2, “Seismic Qualification of Electric and Mechanical Equipment for 

Nuclear Power Plants” (NRC, 1988) 

• Environmental Qualification of Safety Equipment 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 116

IEEE Std 323-1983, “IEEE Standard for Qualifying Class 1E Equipment for Nuclear 

Power Generating Stations” (IEEE, 1983) 

• Establishment of Process Instrument Setpoints 

ANSI/ISA-67.04.01-2000, “Setpoints for Nuclear Safety Related Instrumentation” 

(ANSI/ISA, 2000) 

RG 1.105, Revision 3, “Setpoints for Safety-Related Instrumentation” (NRC, 1999) 

• Evaluation of Human-System Interfaces 

IEEE Std 1023-1988, “IEEE Guide for the Application of Human Factors Engineering to 

Systems, Equipment, and Facilities of Nuclear Power Generating Stations” (IEEE, 1988) 

NUREG-0700, Revision 2, “Human System Design Review Guidelines” (NRC, 2002) 

• Design of the Seismic Monitoring and Trip System (Recording Function 

RG 3.17-1974, “Earthquake Instrumentation for Fuel Reprocessing Plants” (NRC, 1974) 

• Periodic Testing 

IEEE Std 338-1992, “IEEE Standard Criteria for the Periodic Surveillance Testing of 

Nuclear Power Generating Station Safety Systems” (IEEE, 1992b) 

NUREG-0800, Standard Review Plan, Branch Technical Position HICB-17 (NRC, 

1997e) 

RG 1.118, Revision 3, “Periodic Testing of Electric Power and Protection Systems” 

(NRC, 1995) 

• Reduction of Electromagnetic and Radiofrequency Interference and Proper Grounding 

IEEE Std 518-1982, “IEEE Guide for the Installation of Electrical Equipment to Minimize 

Electrical Noise Inputs to Controllers from External Sources” (IEEE, 1982) 

IEEE Std 1050-1996, “Guide for Instrumentation and Control Equipment Grounding in 

Generating Stations” (IEEE, 1996) 

RG 1.180, “Guidelines for Evaluating Electromagnetic and Radio-Frequency Interference 

in Safety-Related Instrumentation and Control Systems” (NRC, 2000b) 

• Design of Data Communications Networks 

ANSI/IEEE 802.3 Standards Series, “IEEE Standards for Local Area Networks: Carrier 

Sense Multiple Access with Collision Detection (CSMA/CD) Access Method and 

Physical Layer Specifications” (ANSI/IEEE, 2000) 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 117

• Evaluation of Commercial-Grade Equipment Dedicated for Use in Safety Applications 

NUREG/CR-6421, “Guideline on the Evaluation and Acceptance of Commercial Grade 

Digital Equipment for Nuclear Safety Applications” (NRC, 1996) 

11.5.4.2 Preference for Automatic Engineered Controls 

The applicant has described its plans for the automatic actuation of safety functions by the 

facility’s safety I&C digital control systems and the hardwired emergency control system, which 

serve as IROFS to support the safety actions of the facility. The applicant also indicated that 

the system has been designed with a preference for automatic engineered controls over 

administrative controls (see 10 CFR 70.64(b)). 

11.5.4.3 Adherence to Defense-in-Depth Practices 

The design of the I&C systems at the MFFF makes use of the practice of defense in depth to a 

significant degree (see footnote to 10 CFR 70.64). The safety control system and the 

emergency control system make use of independent, redundant, and physically separated trains 

of equipment in a manner such that no single credible failure can occur within one train that 

would render both trains inoperable, thereby preventing the MFFF from meeting its licensed 

performance objectives. 

11.5.5 Evaluation Findings 

The NRC staff has evaluated the information provided by the applicant for I&C systems in the 

LA and the ISA Summary. The staff has determined that the design guidance and 

recommendations contained in the RGs, industry codes and standards, and licensing review 

guidance documents to which the applicant has committed to use in completing the design of 

the MFFF will provide reasonable assurance that the design criteria identified in the Section 

11.5.1 of this SER will be adequately addressed. For the reasons outlined above, the staff 

concludes that the baseline design criteria of 10 CFR 70.64 have been achieved and that the 

concept of defense in depth has been applied to the design of these systems. In addition, there 

is reasonable assurance that the I&C systems design and operation will be available and 

reliable to enable the MFFF IROFS to perform their required safety actions when needed. 

Further, the I&C systems design has incorporated the specific design considerations outlined in 

the regulatory acceptance criteria in Section 11.5.3 of this SER. These considerations include 

the use of redundant or diverse safety instrument channels, or both, with coincident logic 

providing automatic actuation with additional manual operation capability. The I&C safety 

systems are designed in accordance with the following seven criteria as specified in Section 

11.4.3.2 of NUREG-1718: 

(1) provisions so that I&C system components can be tested periodically for operability and 

required functional performance 

(2) electrical, physical, and control/separation to ensure that any required redundancy and 

independence are maintained 

(3) no single failure vulnerability 

(4) adequate instrument spans, setpoints, and control ranges to ensure proper monitoring 

and control of IROFS 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 118

(5) provisions so that I&C system components fail in a safe failure mode 

(6) status monitoring of the behavior of the systems and components that are identified as 

IROFS 

(7) system capability to maintain functionality when subjected to tornadoes, tornado 

missiles, earthquakes, floods, and any other appropriate severe natural phenomena as 

established in the ISA 

As outlined in the discussions above, the staff concludes that, with adherence to designated 

codes and industry standards, the application of management measures, and the application of 

the MFFF quality assurance program, the baseline design requirements for the applicant’s 

proposed I&C systems and procedures have been achieved. The staff further concludes that 

there is reasonable assurance that the I&C systems will be sufficiently reliable and available to 

enable the MFFF IROFS to perform their required safety functions when needed. 

REFERENCES 

(ANSI/ISA, 2000) American National Standards Institute/Instrument Society of America, 

ANSI//ISA-67.04.01-2000, “Setpoints for Nuclear Safety-Related Instrumentation,” Research 

Triangle Park, NC, 2000. 

(ANSI/IEEE, 2000) American National Standards Institute/Institute of Electrical and Electronics 

Engineers, 802.3 Standards Series, “IEEE Standards for Local Area Networks: Carrier Sense 

Multiple Access with Collision Detection (CSMA/CD) Access Method and Physical Layer 

Specifications,” New York, NY, 2000. 

(EPRI, 1996) Electric Power Research Institute, TR-106439, “Guideline on Evaluation and 

Acceptance of Commercial Grade Digital Equipment for Nuclear Safety Applications,” Palo Alto, 

CA, October 1996. 

(IEC, 1993) International Electrotechnical Commission, 61131-3 (1993-03), “Programmable 

Controllers—Part 3: Programming Languages,” Geneva, Switzerland, 1993. 

(IEEE, 1998a) Institute of Electrical and Electronics Engineers, Std 603-1998, “IEEE Standard 

Criteria for Safety Systems for Nuclear Power Generating Stations,” New York, NY, 1998. 

(IEEE, 1998b) Institute of Electrical and Electronics Engineers, Std 830-1998, “IEEE Standard 

Recommended Practice for Software Requirements Specifications,” New York, NY, 1998. 

(IEEE, 1998c) Institute of Electrical and Electronics Engineers, Std 730-1998, “Software Quality 

Assurance Plans,” New York, NY, 1998. 

(IEEE, 1998d) Institute of Electrical and Electronics Engineers, Std 828-1998, “IEEE Standard 

for Software Configuration Management Plans,” New York, NY, 1998. 

(IEEE, 1998e) Institute of Electrical and Electronics Engineers, Std 1012-1998, “IEEE Standard 

for the Software Verification and Validation,” New York, NY, 1998. 

(IEEE, 1997a) Institute of Electrical and Electronics Engineers, Std 1028-1997, “IEEE Standard 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 119

for Software Reviews,” New York, NY, 1997. 

(IEEE, 1997b) Institute of Electrical and Electronics Engineers, Std 1074-1997, “IEEE Standard 

for Developing Software Life Cycle Processes.” New York, NY, 1997. 

(IEEE, 1996) Institute of Electrical and Electronics Engineers, Std 1050-1996, “Guide for 

Instrumentation and Control Equipment Grounding in Generating Stations,” New York, NY, 

1996. 

(IEEE, 1994a) Institute of Electrical and Electronics Engineers, Std 379-1994, “IEEE Standard 

Application of the Single Failure Criterion to Nuclear Power Generating Station Safety Systems,” 

New York, NY, 1994. 

(IEEE, 1994b) Institute of Electrical and Electronics Engineers, Std 1228-1994, “IEEE Standard 

for Software Safety Plans,” New York, NY, 1994. 

(IEEE, 1993) Institute of Electrical and Electronics Engineers, Std 7-4.3.2-1993, “IEEE 

Standard Criteria for Digital Computers in Safety Systems of Nuclear Power Generating 

Stations,” New York, NY, 1993. 

(IEEE, 1992a) Institute of Electrical and Electronics Engineers, Std 384-1992, “IEEE Standard 

Criteria for Independence of Class 1E Equipment and Circuits,” New York, NY, 1992. 

(IEEE, 1992b) Institute of Electrical and Electronics Engineers, Std 338-1992, “IEEE Standard 

Criteria for the Periodic Surveillance Testing of Nuclear Power Generating Station Safety 

Systems,” New York, NY, 1992. 

(IEEE, 1987a) Institute of Electrical and Electronics Engineers, Std 338-1987, “IEEE Standard 

Criteria for Periodic Testing of Nuclear Power Generating Station Class 1E Power and 

Protection Systems,” New York, NY, 1987. 

(IEEE, 1987a) Institute of Electrical and Electronics Engineers, Guide 1042-1987, “Software 

Configuration Management,” New York, NY, 1987. 

(IEEE, 1987b) Institute of Electrical and Electronics Engineers, Std 344-1987, “IEEE 

Recommended Practices for Seismic Qualification of Class 1E Equipment for Nuclear 

Generating Stations,” New York, NY, 1987. 

(IEEE, 1988) Institute of Electrical and Electronics Engineers, Std 1023-1988, “IEEE Guide for 

the Application of Human Factors Engineering to Systems, Equipment, and Facilities of Nuclear 

Power Generating Stations,” New York, NY, 1998. 

(IEEE, 1983) Institute of Electrical and Electronics Engineers, Std 323-1983, “IEEE Standard for 

Qualifying Class 1E Equipment for Nuclear Power Generating Stations,” New York, NY, 1983. 

(IEEE, 1982) Institute of Electrical and Electronics Engineers, Std 518-1982, “IEEE Guide for 

the Installation of Electrical Equipment to Minimize Electrical Noise Inputs to Controllers from 

External Sources,” New York, NY, 1982. 

(MOX, 2010a) Shaw AREVA MOX Services, “MFFF—License Application,” Aiken, SC, October 

2009. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 120

(MOX, 2010b) Shaw AREVA MOX Services, “MFFF—Integrated Safety Analysis Summary,” 

Aiken, SC, October 2009. 

 

(NRC, 2002) U.S. Nuclear Regulatory Commission, NUREG-0700, Rev. 2, “Human System 

Design Review Guidelines,” Washington, DC, May 2002. 

(NRC, 2000a) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” Washington, 

DC, August 2000. 

(NRC, 2000b) U.S. Nuclear Regulatory Commission, RG 1.180, “Guidelines for 

Evaluating Electromagnetic and Radio-Frequency Interference in Safety-Related 

Instrumentation and Control Systems,” Washington, DC, January 2000. 

(NRC, 1993) U.S. Nuclear Regulatory Commission, NUREG/CR-6090, “The Programmable 

Logic Controller and Its Application in Nuclear Power Plants,” Washington, DC, September 

1993. 

(NRC, 1996) U.S. Nuclear Regulatory Commission, NUREG/CR-6421, “Guideline on the 

Evaluation and Acceptance of Commercial Grade Digital Equipment for Nuclear Safety 

Applications”, Washington DC, March 1996. 

(NRC, 1999b) U.S. Nuclear Regulatory Commission, RG 1.105, Rev. 3, 

“Setpoints for Safety-Related Instrumentation,” Washington, DC, December 1999. 

(NRC, 1997a) U.S. Nuclear Regulatory Commission, RG 1.168, “Verification, 

Validation, Reviews, and Audits for Digital Computer Software Used in Safety Systems of 

Nuclear Power Plants,” Washington, DC, September 1997. 

(NRC, 1997b) U.S. Nuclear Regulatory Commission, RG 1.169, “Configuration 

Management Plans for Digital Computer Software Used in Safety Systems of Nuclear Power 

Plants,” Washington, DC, September 1997. 

(NRC, 1997c) U.S. Nuclear Regulatory Commission, RG 1.172, “Software 

Requirements Specifications for Digital Computer Software Used in Safety Systems of Nuclear 

Power Plants,” Washington, DC, September 1997. 

(NRC, 1997d) U.S. Nuclear Regulatory Commission, RG 1.173, “Developing 

Software Life Cycle Processes for Digital Computer Software Used in Safety Systems of 

Nuclear Power Plants,” Washington, DC, September 1997. 

(NRC, 1997e) U.S. Nuclear Regulatory Commission, NUREG-0800, Standard Review Plan, 

Branch Technical Position HICB-17, “Guidance on Self-Test and Surveillance Test Provisions,” 

Washington, DC, 1997. 

(NRC, 1997f) U.S. Nuclear Regulatory Commission, Safety Evaluation prepared by the Office of 

Nuclear Reactor Regulation, “EPRI Topical Report TR-106439,” Washington, DC, May 1997. 

(NRC, 1997g) U.S. Nuclear Regulatory Commission, NUREG-0800, Standard Review Plan, 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 121

Branch Technical Position HICB-11, “Guidance on the Application and Qualification of Isolation 

Devices,” Washington, DC, 1997. 

 

(NRC, 1997h) U.S. Nuclear Regulatory Commission, RG 1.170, “Software Test Documentation 

for Digital Computer Software used in Safety Systems of Nuclear Power Plant, Washington, DC, 

September 1997. 

(NRC 1997i) U.S. Nuclear Regulatory Commission, RG 1.171, “Software Unit Testing for Digital 

Computer Software Used in Safety Systems of Nuclear Power Plants, Washington, DC, 

September 1997”. 

(NRC, 1996a) U.S. Nuclear Regulatory Commission, NUREG/CR-6463, “Review Guidelines on 

Software Languages for Use in Nuclear Power Plant Safety Systems: Final Report,” 

Washington, DC, June 1996. 

(NRC, 1996b) U.S. Nuclear Regulatory Commission, RG 1.152, Revision 1, “Criteria for Digital 

Computers in Safety Systems of Nuclear Power Plants”, Washington, DC, January 1996. 

(NRC, 1995) U.S. Nuclear Regulatory Commission, RG 1.118, Rev. 3, “Periodic 

Testing of Electric Power and Protection Systems,” Washington, DC, April 1995. 

(NRC, 1991) U.S. Nuclear Regulatory Commission, RG 1.153, “Criteria for Safety Systems”. 

(NRC, 1988) U.S. Nuclear Regulatory Commission, RG 1.100, Rev. 2, 

“Seismic Qualification of Electric and Mechanical Equipment for Nuclear Power Plants,” 

Washington, DC, June 1988. 

(NRC, 1978) U.S. Nuclear Regulatory Commission, RG 1.75, Rev. 2, “Physical 

Independence of Electric Systems,” Washington, DC, September 1978. 

(NRC, 1974) U.S. Nuclear Regulatory Commission, RG 3.17-1974, “Earthquake 

Instrumentation for Fuel Reprocessing Plants,” Washington, DC, 1974. 

10 CFR Part 70, Domestic Licensing of Special Nuclear Material. 

11.6 Material-Handling Systems

This section of the safety evaluation report (SER) contains the staff’s review of the design and 

operation of material-handling systems, as described in Section 11.6 of the license application 

(LA) provided by Shaw AREVA MOX Services (the applicant) (MOX, 2010a) and the 

corresponding sections of the Integrated Safety Analysis (ISA) Summary (MOX, 2010b). The 

primary purpose of this review is to determine whether the proposed material-handling 

equipment, including items designated as items relied on for safety (IROFS), will be available 

and reliable to perform their intended safety function during normal operations, upset conditions, 

accidents, and natural phenomena events. This review evaluated whether the applicant 

provided reasonable assurance that workers, the public, and the environment will be protected 

from the radiological consequences of an accident in accordance with the applicable 

regulations. 

For this review, the staff evaluated the information provided by the applicant for materialhandling equipment and controls in Section 11.6 and other applicable sections of the LA. The 

review of the design and operation of the material-handling systems was closely coordinated 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 122

with the review of applicable portions of Chapters 4 and 5 of the ISA Summary, which discusses 

the material-handling operations and potential load-handling events. 

11.6.1 Regulatory Requirements 

The following regulations are applicable to material-handling equipment and controls: 

• 10 CFR 70.61(e), specifically relating to the requirement that each engineered or 

administrative control or control system that is needed to meet the performance 

requirements be designated as an item relied on for safety and relating to the safety 

program that ensures each item relied on for safety will be available and reliable to 

perform its intended function when needed 

• 10 CFR 70.64, “Requirements for New Facilities or New Processes at Existing 

Facilities,” specifically relating to the application of baseline design criteria and defensein-depth practices to new facilities or new processes at existing facilities 

11.6.2 Regulatory Acceptance Criteria 

The review focused on the design bases of material-handling components and other related 

information. For material-handling systems, the staff reviewed and evaluated the information 

provided by the applicant for the safety function, system description, and safety analysis. The 

review also encompassed proposed design-basis considerations, such as redundancy, 

independence, reliability, and quality. 

Section 11.4 of NUREG-1718, “Standard Review Plan for the Review of an Application for a 

Mixed Oxide (MOX) Fuel Fabrication Facility,” issued August 2000 (NRC, 2000), identifies the 

acceptance criteria related to plant systems. No section in NUREG-1718 specifically addresses 

Section 11.6 in the LA and Chapter 5.3.5 in the ISA Summary. However, the function, 

description, control concepts, and system interfaces pertaining to each material-handling 

system are addressed in the staff review guidance in Section 11.4 of NUREG-1718. 

11.6.3 Material-Handling Equipment Description 

Section 11.1, “MOX Process Description,” of the LA describes the individual process units and 

associated equipment. Section 1.1.2 of the LA describes the general methodology and 

requirements for determining the seismic response of process equipment, systems, and 

components. Section 1.1.2 also provides the general design bases, functional requirements, 

and acceptance criteria for qualifying the process material-handling equipment under all 

conditions, including normal operation, credible accidents, and design-basis natural phenomena 

events in accordance with 10 CFR 70.61, “Performance Requirements.” 

Material-handling equipment classified as QL-1 is designed and qualified to perform one or 

more of the following functions: (1) prevent a criticality by maintaining the structural integrity of 

material-handling equipment relied upon to control the geometry and configuration of fissile 

material or (2) protect QL-1 structures, systems, and components (SSCs) from physical 

interaction as a result of a seismic or material handling. 

The functions assigned to material-handling system elements include the following: 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 123

• Transfer mixed oxide (MOX) fuel material and components from one point in the process 

to another in accordance with process throughput, positioning tolerance, mechanism 

reliability, and radiological shielding requirements. 

• Prevent component impact or overtravel that could potentially damage a container. 

• Maintain structural integrity and control of process containers to ensure that the 

confinement boundary is not breached. 

• Maintain structural integrity and control of process containers to ensure that criticality 

control functions are performed. 

• Limit the applied gripping force where excessive force could potentially damage a 

container. 

• Detect the successful receipt or release of a container by measuring weight or detecting 

the physical presence of a container. 

• Detect the successful alignment of the container and handling device before engaging 

the gripping device. 

• Work with fire barriers to transfer material across process atmosphere or fire area 

boundaries, as necessary. 

• Transfer tooling and equipment spare parts from point to point inside the glovebox 

system during maintenance operations. 

The following sections describe the major equipment associated with material-handling 

equipment. 

Powder-Handling Equipment 

Fuel production powder materials handled in the aqueous polishing (AP) and MOX processing 

(MP) areas include the plutonium oxide and depleted uranium oxide feed materials, material 

additives, and recovered dust. Plutonium oxide powders are received at the facility packed in 

qualified shipping packages. Each shipping package holds a single container designed to meet 

the requirements of the U.S. Department of Energy’s (DOE) standard DOE-STD-3013, 

“Stabilization, Packaging, and Storage of Plutonium-Bearing Materials,” issued September 2000 

(DOE, 2000). 

Equipment used to handle palletized shipping packages includes turntables and bridge cranes. 

Individual shipping packages are transported by forklifts equipped with drum grips and roller 

conveyor systems. Automated pick-and-place cranes and robots, slide tables, or roller 

conveyors handle the 3010 containers outside of the gloveboxes. Powder materials are 

transported inside of convenience cans, reusable cans, dust pots, sample vials, or in one of a 

series of powder jars inside glovebox enclosures. Convenience cans, reusable cans, and 

sample vials are loaded into shuttles that are transferred pneumatically from one glovebox to 

another. Powder jars and dust pots are transferred between gloveboxes inside of shielded 

transfer casks along sections of live roller conveyors. Elevators and rotary tilters are used to 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 124

raise, lower, or dump jars as required for emptying, filling, and weighing. Powder is also 

transported in bulk form over short distances by a gravity-fed, vibrating conveyor. 

Material-handling equipment designed to carry powder containers and pallets includes roller 

conveyors, ball-screw elevators, pick-and-place robots equipped with gripping manipulators, 

and pneumatic transfer (LTP) systems. Roller conveyor and elevator systems installed inside of 

glovebox enclosures are equipped with positive stops and guide rails to prevent interactions 

between the load and the walls or the floor of the glovebox confinement boundary. Confinement 

for powder materials handled outside of the glovebox enclosure is provided by the container, 

which is qualified for a drop from a height greater than the maximum handling height. 

Confinement for powder materials handled inside the glovebox enclosures is provided by the 

enclosure. 

Pellet-Handling Equipment 

Rod-Handling Equipment 

Assembly-Handling Equipment 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 125

Waste-Handling Equipment 

Liquid Process Area Material-Handling Containers 

AP process liquids are contained in sample vials used for transfer of liquid samples from AP 

process units to the laboratory and for use inside the laboratory. The liquid sample vial is 

composed of a polyethylene bottle and a polyethylene screwed plug. The liquid sample vials 

are designed to be transferred through the LPT system. 

. 

Powder Process Area Material-Handling Containers 

Pellet Process Area Material-Handling Containers 

Rod Process Area Material-Handling Containers 

Waste Areas Material-Handling Containers 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 126

11.6.4 Design Bases for Material-Handling Items Relied on for Safety 

Material-handling systems that are designated as IROFS are designed and qualified to perform 

their safety functions during normal operations, upset conditions, and design-basis events. 

Material-handling equipment and support structural members are designed to prevent physical 

interaction with confinement boundary elements or IROFS under worst-case loading 

assumptions associated with normal, upset, and design-basis events. The design principles 

applied to prevent physical interactions include: (1) maintenance of clearance between the 

equipment and the confinement barrier, (2) equipment that uses actuating mechanisms to grip 

payloads capable of breaching confinement and are designed to retain their payload under all 

conditions, and (3) equipment used to hoist loads that could impact confinement boundary 

elements and is designed and qualified with appropriate margins of safety. Section 11.6.3 of 

the LA provides the codes and standards used to qualify material transport IROFS. 

11.6.5 Load-Handling Accident Sequences 

The mixed oxide fuel fabrication facility (MFFF) handles plutonium in the form of solutions, 

powders, pellets, fuel rods, and fuel assemblies. Depleted uranium dioxide (UO2) is also 

handled. A load-handling event could occur when a lifted load is dropped or when either the 

lifted load or the loading equipment impacts other nearby SSCs, causing a breach of 

confinement and dispersal of radioactive or hazardous material into the workplace or the 

environment. Load-handling events are hypothesized to occur throughout the MFFF facility. 

Locations considered for these events include the following: 

• operations inside of a glovebox 

• areas surrounding the glovebox and external impacts to the glovebox 

• material-handling and transfer events in the MFFF hallways, operational, and storage 

areas 

• events occurring in AP process cells 

• events external to the MFFF 

• events involving the waste transfer line 

The load-handling analysis centered around those events in which the primary confinement 

barrier is breached (e.g., glovebox window is broken; container, fuel rod, or the waste transfer 

line is breached). These types of events may result in the dispersal of radioactive or hazardous 

material. 

The MFFF ISA Summary evaluated the following load-handling event groups: 

LH-01 Process vessel breaches as a result of maintenance activities in AP process cell 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 127

LH-02 Load-handling events during normal operations within the confinement 

capabilities of the gloveboxes 

LH-03 Powder jar falls from a conveyor and impacts a glovebox window 

LH-04 Maintenance operations cause a glovebox breach 

LH-05/ 

LOC-7 3013 Container-handling events outside of the gloveboxes 

LH-06 Handling of shipping package for the 3013 container 

LH-07 Handling of fuel assemblies 

LH-08 Handling of MOX fuel transport cask 

LH-09 Handling of waste container 

LH-10/ 

LOC-7 Handling of transfer container 

LH-11 Load impacts to final very high depressurization (VHD) high-efficiency particulate 

air (HEPA) filter 

LH-12 Consolidated with LH-02 

LH-13 Breaching of waste transfer line outside MFFF building 

LH-14 Heavy loads or load-handling equipment damaging principal structures or 

primary confinement boundaries of MFFF building 

LH-15 Load handling of depleted of UO2 container 

LH-16/ 

LOC-6 Rod-handling operations 

11.6.5.1 LH-01 Process Vessel Breaches as a Result of Maintenance Activities in Aqueous 

Polishing Process Cell 

In this event, process vessel breaches are postulated to occur as a result of maintenance 

activities. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 128

The staff agrees with the applicant that the combination of process cell entry controls and the 

process cell exhaust system prevents the receptors from receiving radiation doses in excess of 

the limits defined in 10 CFR Part 70, “Domestic Licensing of Special Nuclear Material.” The 

staff concludes with reasonable assurance that the applicant has demonstrated that the facility 

will be in compliance with the performance requirements of 10 CFR 70.61 in the event of 

process cell breaches resulting from maintenance activities in AP process cells. 

11.6.5.2 LH-02 Load-Handling Events during Normal Operations within the Confinement 

Capabilities of the Gloveboxes 

These load-handling events involve impact energies within the confinement capability of the 

gloveboxes during normal operations and can result from a variety of factors, including 

mechanical failures, control system errors, or operator errors. 

 

The gloveboxes are robustly designed, and the staff agrees with the applicant that credible loadhandling events will not breach the glovebox. The staff concludes with reasonable assurance 

that the applicant has demonstrated that the facility will be in compliance with the performance 

requirements of 10 CFR 70.61 with respect to load handling during normal operations. 

11.6.5.3 LH-03 Powder Jar Falls from a Conveyer and Impacts the Glovebox Window 

These load-handling events consider the impacts of powder jar falls on the glovebox windows, 

walls, and floors. These events could be related to jar mispositioning on the jar lift or other 

mechanical failures. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 129

 

 The gloveboxes are also robustly designed, and the 

staff agrees with the applicant that credible load-handling events will not breach the glovebox. 

The staff concludes with reasonable assurance that the applicant has demonstrated that the 

facility will be in compliance with the performance requirements of 10 CFR 70.61 with respect to 

powder jar falls and their impact on the gloveboxes based on the robust glovebox design and 

the combination of IROFS to protect against the event. 

11.6.5.4 LH-04 Maintenance Operations Cause a Glovebox Breach 

These load-handling events relate to maintenance operations in the powder auxiliary (NXR) 

system that could cause a glovebox breach and radioactive material release. 

 The staff concludes with reasonable assurance that the 

applicant has demonstrated that the facility will be in compliance with the performance 

requirements of 10 CFR 70.61 with respect to glovebox breaches during maintenance 

operations based on the IROFS to protect against the event, the robust design of the glovebox, 

and the administrative control to remove radioactive material during maintenance. 

11.6.5.5 LH-05/LOC-7 3013 Container-Handling Events outside of the Gloveboxes 

These load-handling events relate to the handling of 3013 containers by automated pick-andplace cranes and robots, slide tables, and roller conveyors that occur outside of the gloveboxes. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 130

The staff concludes with reasonable assurance that the applicant has demonstrated that the 

facility will be in compliance with the performance requirements of 10 CFR 70.61 with respect to 

the handling of 3013 containers. 

11.6.5.6 LH-06 Handling of Shipping Package for the 3013 Container 

The PuO2 Receiving (DCP) unit consists of the material-handling equipment necessary to 

transfer the 9975 shipping packages from the loading dock in the truck bay to the shipping 

package unpackaging station. 

The staff concludes with reasonable assurance that the applicant has demonstrated that the 

facility will be in compliance with the performance requirements of 10 CFR 70.61 with respect to 

handling 3013 shipping packages. 

11.6.5.7 LH-07 Handling of Fuel Assemblies 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 131

 

 

The staff concludes with reasonable assurance that the applicant has demonstrated that the 

facility will be in compliance with the performance requirements of 10 CFR 70.61 with respect to 

the handling of fuel assemblies based on IROFS administrative controls and the design of the 

materials handling equipment which limits the potential for load handling events. 

11.6.5.8 LH-08 Handling of MOX Fuel Transport Cask 

The assembly packaging (TXE) unit consists of the material-handling equipment necessary to 

load and unload MFFPs from the shipping dock in the truck bay. 

The staff concludes with reasonable assurance that the applicant has demonstrated that the 

facility will be in compliance with the performance requirements of 10 CFR 70.61 with respect to 

MFFP shipping packages. 

11.6.5.9 LH-09 Handling of Waste Container 

Load-handling events for this event group consist of dropping a waste container during 

handling. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 132

The staff concludes with reasonable assurance that the applicant has demonstrated that the 

facility will be in compliance with the performance requirements of 10 CFR 70.61 with respect to 

handling of waste containers. 

11.6.5.10 LH-10/LOC-7 Handling of Transfer Container 

This event relates to transfer container or SS double door docking system (DDDS) loadhandling events which are postulated to occur within the MFFF HDE area. 

Based on the design of the IROFS for this event and the IROFS administrative controls to 

prevent use of either the incorrect bin or multiple bins, the staff concludes with reasonable 

assurance that the applicant has demonstrated that the facility will be in compliance with the 

performance requirements of 10 CFR 70.61 with respect to the handling of a transfer container. 

11.6.5.11 LH-11 Load Impacts to Final Very High Depressurization High-Efficiency Particulate 

Air Filter 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 133

This event involves load impacts to the final C4/KWG confinement HEPA filters that breach the 

HEPA filter housing and allow material from the HEPA filters to pass directly to the stack. 

 

The staff concludes with reasonable assurance that the applicant has demonstrated that the 

facility will be in compliance with the performance requirements of 10 CFR 70.61 with respect to 

load impacts to the final VHD HEPA filter because of IROFS administrative controls limiting 

material handling near the final HEPA filters. 

11.6.5.12 LH-13 Breaching of Waste Transfer Line outside Mixed Oxide Fuel Fabrication 

Facility Building 

This event involves breaching the waste transfer line that runs between the MFFF and the 

waste solidification building, which releases radioactive liquid waste. 

The staff concludes with reasonable assurance that the applicant has demonstrated that the 

facility will be in compliance with the performance requirements of 10 CFR 70.61 with respect to 

load impacts resulting from a breach in the waste transfer line outside the MFFF building based 

on the depth of burial of the waste transfer line and administrative controls to prevent damage 

from trucks or excavation activity near the pipe. 

11.6.5.13 LH-14 Heavy Loads or Load-Handling Equipment Damaging Principal Structures or 

Primary Confinement Boundaries of Mixed Oxide Fuel Fabrication Facility Building 

This event involves heavy loads or load-handling equipment that damages the principal 

structures or primary confinement boundaries of the MFFF building. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 134

 

 

The staff concludes with reasonable assurance that the applicant has demonstrated that the 

facility will be in compliance with the performance requirements of 10 CFR 70.61 with respect to 

heavy loads or load-handling equipment damaging the principle structures or primary 

confinement boundaries of the MFFF building based on the robust MFFF building structure that 

would not be damaged by a load handling event and the administrative controls for material 

handling.. 

11.6.5.14 LH-15 Load-Handling of Depleted Uranium Dioxide Container 

This event group relates to load-handling events that may result in releasing depleted UO2. The 

potential causes for the releases can be attributed to, but are not limited to, operator error or 

mechanical failure or malfunction during UO2 container-handling operations using a drum lift 

truck, monorail, hoist, or similar transport means. 

The staff concludes with reasonable assurance that the applicant has demonstrated that the 

facility will be in compliance with the performance requirements of 10 CFR 70.61 with respect to 

load handling of UO2 containers. 

11.6.5.15 LH-16/LOC-6 Rod-Handling Operations 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 135

 

The staff concludes with reasonable assurance that the applicant has demonstrated that the 

facility will be in compliance with the performance requirements of 10 CFR 70.61 with respect to 

rod-handling operations. 

11.6.5 Codes and Standards 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 136

Process material-handling cranes and hoists are designed, qualified, and tested to perform the 

required safety functions, as well as to perform normal operating and maintenance lifts, in 

accordance the general design codes listed in Section 11.6.5 of the LA. 

Process material-handling equipment used to transfer payloads employing fixed geometry 

devices are designed and qualified to perform required safety functions. The equipment also 

transfers payloads during normal operation and maintenance in accordance with the general 

codes and standards listed in Section 11.6.5 of the LA. 

11.6.6 Evaluation 

The staff evaluated the information provided by the applicant for material-handling equipment 

and controls in Section 11.6 and other applicable sections of the LA. The review of the design 

and operation of the material-handling systems was also closely coordinated with the review of 

applicable portions of Chapters 4 and 5 of the ISA Summary, which discusses the materialhandling operations and potential load-handling events. 

The staff concluded that the applicant’s proposed equipment, facilities, and procedures provide 

a reasonable level of assurance that load-handling events that cause a release of radioactive 

material or radiation exposures in excess of the performance requirements of 10 CFR 70.61 are 

highly unlikely, given the use of the designated IROFS, codes and standards, and management 

measures, as well as the quality assurance program. The staff further concludes that the 

baseline design requirements of 10 CFR 70.64 are satisfied. 

REFERENCES 

(MOX, 2010a) Shaw AREVA MOX Services, “MFFF-License Application,” Aiken, SC, 

October 2009. 

(MOX, 2010b) Shaw AREVA MOX Services, “MFFF-Integrated Safety Analysis Summary,” 

Aiken, SC, October 2009. 

(DOE, 2000) U.S. Department of Energy, “Stabilization, Packaging, and Storage of 

Plutonium-Bearing Materials,” DOE-STD-3013, Washington, DC, September 2000. 

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” 

Washington, DC, August 2000. 

10 CFR Part 70, Domestic Licensing of Special Nuclear Material 

10 CFR Part 71, Packaging and Transportation of Radioactive Material 

Part 178.350, Specification 7A, general packaging, Type A 

11.7 Fluid Transport Systems

This chapter of the safety evaluation report (SER) contains the staff’s review of the fluid 

transport systems described by the applicant in Section 11.7 of the license application (LA) 

(MOX, 2010a) and Section 4.7 of the Integrated Safety Analysis (ISA) Summary (MOX, 2010b). 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 137

The objective of this review is to determine whether the fluid transport systems’ items relied on 

for safety (IROFS) and their design bases identified by the applicant provide reasonable 

assurance of protection against natural phenomena and the consequences of potential 

accidents. The staff evaluated the information provided by the applicant for fluid transport 

systems by reviewing Section 11.7 and other sections of the LA (MOX, 2010a), Section 4.7 of 

the ISA Summary (MOX, 2010b), supplementary information provided by the applicant, 

applicable fluid transport systems codes and standards, and relevant documents available at 

the applicant’s offices which were not submitted by the applicant. The staff closely coordinated 

its review of the fluid transport systems’ design bases and strategies with the review of other 

sections in this SER (e.g., the ISA in Chapter 5, fire protection in Chapter 7, and chemical safety 

in Chapter 8). 

11.7.1 Regulatory Requirements 

The staff reviewed how the information in the LA (MOX, 2010a) and the ISA Summary (MOX, 

2010b) addressed the following regulations: 

• Title 10 of the Code of Federal Regulations (10 CFR) § 70.61(e), “Performance 

requirements” stipulates that each engineered or administrative control or control system 

that is needed to meet the performance requirements be designated as an IROFS and 

the safety program that ensures that each IROFS will be available and reliable to 

perform its intended function when needed 

• 10 CFR § 70.64, “Requirements for New Facilities or New Processes at Existing 

Facilities,” stipulates requirements of baseline design criteria and defense-in-depth 

practices to new facilities or new processes at existing facilities 

11.7.2 Regulatory Acceptance Criteria 

The review focused on the design bases of fluid transport systems. The staff reviewed and 

evaluated the information provided by the applicant for the safety function, system description, 

and safety analysis. The review also encompassed design-basis considerations, such as 

redundancy, independence, reliability, and quality. The staff also performed its review in 

accordance with Section 11.4.7.2 in NUREG-1718, “Standard Review Plan for the Review of an 

Application for a Mixed Oxide (MOX) Fuel Fabrication Facility” (NRC, 2000). Section 11.4.7.2 

lists the following regulatory acceptance criteria for fluid transport systems (referred to as 

“material transport system (pumps and valves)” in NUREG-1718): 

• Capacity is adequate to handle the expected volume of radioactive material during 

normal operating and accident conditions. 

• Redundancy or diversity of components prevents the release of radioactive materials to 

the environment or contributes to the safe operation of the fluid transport systems. 

• The fluid transport system can be safely shut down during normal and accident 

conditions. Provisions for emergency power are included for critical process 

components. 

• Tank and piping systems are of welded construction to the fullest extent possible. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 138

• Tank and piping systems are designed to take advantage of gravity flow to reduce the 

potential for contamination associated with pumping and pressurization. 

• Criticality will not occur under normal and credible accident conditions. 

• All system components expected to be in contact with strong acids or caustics are 

corrosion resistant. 

• Piping is designed to minimize entrapment and buildup of solids in the system. 

• The systems are evaluated to determine the need for hoods, gloveboxes, and shielding 

for personnel protection. Generally, wet processing operations involving gram quantities 

of plutonium and any operations involving 50 micrograms of respirable plutonium are 

conducted in a glovebox. 

• Surface finishes of materials in the work areas have satisfactory decontamination 

characteristics for their particular application. 

• Fluid transport systems maintain functionality when subjected to tornadoes, tornado 

missiles, earthquakes, floods, and any other natural phenomena deemed to be credible 

as established in the ISA. 

11.7.3 Fluid Transport System Description 

The primary function of the fluid transport systems is to safely and reliably handle the process 

and utility fluids during the aqueous polishing (AP), mixed oxide process (MP), and utility 

processes. Section 11.8 of this SER discusses other fluid-containing support systems. 

11.7.3.1 Description 

The Mixed Oxide Fuel Fabrication Facility (MFFF) fluid transportation system consists of 

vessels, standardized equipment (e.g., demisters, leak detectors), process columns, heat 

exchangers, pumps, filters, piping, valves, and some additional miscellaneous equipment. The 

applicant has identified the following features or components as IROFS: 

• system overpressurization controls 

• double-wall pipe 

• seismic isolation valves 

Section 11.8.4.1 of this SER also analyzes seismic isolation valves. 

The major components of the fluid transport systems are part of the primary process and are 

located in the AP area of the facility. In addition to piping and valves, the major components of 

the fluid transport systems include the following: 

• Welded process equipment, which includes vessels, tanks, process columns, and heat 

exchangers. In general, fully welded process equipment is located in process cells. 

Storage tanks vary in design at different stages of the primary process. Storage tanks 

include annular tanks, stab tanks, and conventional tanks. These tanks are fabricated 

using fully welded construction. Other welded process equipment includes various small 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 139

tanks used in the AP process, such as separating pots, leak detection pots, barometric 

seal pots, pulse column pots, drip pots, condensate pots, and demisters. The AP 

process columns and various AP process heat exchangers used in radiological service 

are also of a fully welded construction. 

• Partially welded process equipment and prime movers, which includes filters, mixing 

tanks, and precipitators. Other process prime movers include pumps, low-pressure 

airlifts, ejectors, and siphons. Pump types include centrifugal and positive displacement 

dosing pumps. 

Process fluid transport systems are classified as one of the following fluid transport system 

categories based on the nature of the fluid contained: 

• FTS Category 1—Fluid systems that contain process fluids with significant quantities of 

plutonium or americium. 

• FTS Category 2—Fluid systems that contain process fluids which potentially include 

trace quantities of plutonium or americium. 

• FTS Category 3—Fluid systems that contain radioactive waste fluids which potentially 

include trace quantities of plutonium or americium. 

• FTS Category 4—Fluid systems that contain nonprocess fluids which include no 

plutonium or americium. 

Process fluid transport systems that contain FTS Category 1 or 2 fluids and their structural 

support elements are designed and qualified to perform the following general safety functions: 

• Prevent criticality by maintaining the pressure boundary integrity of fluid transport system 

components as required to control the geometry of fissile material. 

• Confine radioactive or toxic material as required to meet the performance requirements 

of 10 CFR § 70.61, “Performance Requirements.” 

• Prevent interaction between confinement boundary or criticality prevention elements and 

non IROFS safety systems and equipment which could process fluid transport systems. 

The MFFF Fluid transport components are designed to efficiently move fluid with a low head 

and small flow rates. Systems are laid out so as to minimize fluid traps, dead spots, and other 

volumes that cannot be completely drained (with the exception of loop seals). Radiological 

fluids are maintained within at least two levels of confinement. Vessels that contain radiological 

fluids are mounted over drip trays to collect any leakage. Each drip tray is sized to hold the 

contents of the largest vessel in a critically safe configuration where appropriate. Radiological 

fluids are transferred using static transfer means, such as gravity flow, airlifts, air jets, and 

steam jets when practical. Systems that contain hazardous fluids are either contained within 

trenches, rooms, or double-walled piping. These systems could also be accessible for 

inspection and have fully welded construction. Fluid-bearing components located within 

process cells are specified with corrosion allowances, and the welding joints are radiographed, 

as appropriate. Each process cell is lined with a drip tray and a sump. The sump is monitored 

for leakage. The components located in the process cell are not normally accessible. However, 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 140

the cell can be accessed for maintenance, if required. The process fluid can be isolated from 

the cell, and decontamination fluid can be used to flush equipment and piping. While many 

such components contain plutonium in excess of gram quantities, process cell and welded 

equipment confinement for liquid containing systems provides for adequate protection of 

personnel since there is no direct contact with the materials. 

11.7.4 Fluid Transport System Evaluation 

11.7.4.1 Capacity 

The fluid transport system is designed to handle the expected volume of radioactive material 

during normal operating and accident conditions. Table 4.7-2 of the ISA Summary (MOX, 

2010b) lists the design pressure, temperature, and flow and volume for the fluid transport 

system components. This chart lists the additional safety factors, over and above code and 

standard requirements, that are applied to the design. These safety factors provide an 

additional level of safety. Vessels that contain radiological fluids are mounted over drip trays. 

These trays are sized to contain the contents from the largest vessel in the cell. 

Based on the information on fluid system capacity and the additional safety factors over and 

above the code and standard requirements, the staff finds that the fluid system capacity is 

acceptable and consistent with the guidance in Section 11.4.7.2 (A) of NUREG 1718. 

11.7.4.2 Redundancy and Diversity 

The fluid transport system is designed for redundancy and diversity of components that will 

prevent the release of radioactive materials to the environment or needed for the safe operation 

of the material transport system. The fluid transport system is designed with multiple layers of 

confinement and is supplemented by administrative programs designed to monitor the integrity 

of these systems. Radiological fluids are maintained within at least two layers of confinement. 

Piping systems are double walled, with leak detection systems if they are not located in process 

cells or gloveboxes. Drip trays with sump monitors are designed to detect leakage. Levels 

inside the tanks are remotely monitored using level instrumentation. Redundancy and diversity 

in the design are the result of the various safety factors and types of equipment provided in the 

design and the layering of active and passive controls that protect the fluid transport system. 

The staff has reviewed the description of the fluid transport system components and finds these 

systems to be diverse and redundant and is consistent with the guidance in Section 11.4.7.2 (B) 

of NUREG-1718. 

11.7.4.3 Shutdown and Emergency Power 

The fluid transport system can be safely shut down during normal and accident conditions. 

Provisions for emergency power are included for critical process components. The AP process 

control system, the electrical power system, and basic system design criteria primarily control 

the ability of the proposed systems to shut down safely. All fluid transport systems containing 

radioactive material are designed for the design-basis earthquake. In the event of containment 

breach, liquid is collected in a drip tray in the process cell or glovebox. This fluid is then 

recycled through the waste treatment management units. Pipes containing radioactive material 

outside of a process cell or glovebox are double walled. Seismically qualified IROFS are 

designed to withstand the design-basis seismic event. All IROFS are designed for normal, offnormal, and design-basis accident environmental conditions. (See Section 11.5 of this SER for 

additional detail on instrumentation and control system safety.) Emergency uninterrupted power 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 141

supplies those electrical loads requiring power for safe shutdown. (See the discussion of 

electrical system safety in Section 11.4 of this SER for more detail.) Based on the information 

provided by the applicant and the discussions on emergency power systems in Section 11.4 of 

this SER, the staff finds that the material transport system can be shutdown consistent with the 

guidance in Section 11.4.7.2 (C) of NUREG-1718. 

11.7.4.4 Welded Construction 

The welded equipment and piping components handling radiological fluids are fully welded 

construction and are located in the process cell confinement. Radiological fluid bearing 

components that do not permit fully welded construction are installed in a glovebox. The design 

of the fluid transport system components is specified with appropriate corrosion allowances. 

The welded joints are radiographed, as appropriate, to ensure conformance with construction 

codes that were committed to by the applicant in the LA. 

Radiological fluids are contained within at least two levels of confinement and are transferred 

using static transfer means, such as gravity flow, airlifts, air jets, and steam jets when practical. 

Piping components carrying radiological fluids are either fully welded with double-wall 

construction between two confinements or installed in gloveboxes or process cells. 

Material used for the construction of this equipment is specified in accordance with ASME and 

American Society for Testing and Materials (ASTM) codes and material specifications. ASTM 

materials are also used for the fabrication of other components. In general, design of 

equipment to these standards means that the components are designed for the most severe 

service conditions. Included in the severe service conditions are pressure, temperature, 

material compatibility, and corrosion. The staff has reviewed the design basis for welding and 

finds it acceptable, based on the information submitted and references to the codes and 

standards for the design and construction of the fluid transport system. The information is 

consistent with the guidance on welded construction in Section 11.4.7.2 (D). 

11.7.4.5 Gravity Flow 

The fluid transport system’s tank and piping systems are designed to take advantage of gravity 

flow to reduce the potential for contamination associated with pumping and pressurization. 

Radiological fluids are transferred using gravity flow, airlifts, air jets, and steam jets when 

practicable. 

Hydraulic seals are used to prevent backflow of process fluid to auxiliary systems during 

reagent addition. The liquid seal or plug is maintained by the piping configuration. The seal is 

implemented by a “U” bend in piping or by hydraulic seal pots. The hydraulic seal design 

ensures that the seal remains filled with liquid at all times, the seal withstands internal pressure 

differences between connected vessels, and siphon action does not occur. 

Check valves are used only in the process fluid pressure boundary. The check valve design is 

based on effective pressure drop, type of seating material, pressure and flow reversal response 

time, mounting requirements, and reliability and maintainability. Redundant isolation valves that 

are IROFS are used to automatically isolate utility and reagent fluids in the process area when 

earthquake conditions are detected. These IROFS isolation valves close in the event of valve 

or actuator failure. Isolation valve selection is based on process hydraulics, control system 

characteristics, mounting requirements, and other valve specifications. The valves will be 

specified for service after consideration of the chemical characteristics of the fluid, piping 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 142

material of construction, and operating conditions. The valves will be designed and constructed 

consistent with good engineering practices and in accordance with ASME and American 

Petroleum Institute (API) codes stated in the LA (MOX, 2010a). 

The valves and their supports will also be designed to withstand and remain operable during the 

design-basis earthquake, as they are intended to prevent uncontrolled flooding of the MFFF 

building as a result of a seismic event. The safety function of the isolation valves is to maintain 

safe isolation between controlled areas and uncontrolled areas that may contain radioactive 

materials. Based on the proposed design and use of industry practices, the staff finds that the 

redundancy and diversity of the fluid transport systems adequately prevent the release of 

radioactive materials to the environment. 

Separator or knockout pots are specified for piping in which fluid transfer is made by air or 

vacuum lift. The separated fluid is allowed to flow by gravity into the desired component, while 

the airflow vents at the top of the pot. This design prevents backflow siphoning. Steam jet lift 

transfer system piping is terminated in the receiving vessel vent space to provide an air gap that 

prevents backflow siphoning. Siphons are used to initiate gravity transfer of fluids in 

applications in which flow rate is not critical. The siphon transfers liquid from the higher 

upstream tank to the lower downstream tank. The elevation difference between tanks prevents 

backflow. Knockout pots, steam jet lifts, and elevation differences between tanks are passive 

features that help to prevent cross contamination. 

The staff has reviewed the facility’s design basis and, based on the commitments to appropriate 

nuclear industry codes and standards and the design which incorporates gravity flow, 

concludes that the design is acceptable and consistent with the guidance in Section 11.4.7.2 (E) 

of NUREG-1718. 

11.7.4.6 Criticality 

The fluid transport system is designed so that criticality will not occur under normal and credible 

accident conditions. Drip trays in process cells are sized to contain the contents from the 

largest vessel in the cell and shaped to maintain the leaked fluid in a geometry that is criticality 

safe. Chapter 6 of this SER evaluates nuclear criticality safety. 

11.7.4.7 Corrosion 

The fluid transport system components expected to be in contact with strong acids or caustics 

are corrosion resistant. The construction materials of the facility’s fluid transport systems are 

selected based on compatibility with the physical and chemical characteristics of the process 

fluids. In general, FTS Category 1 components use Type 304L or 316L stainless steel and 

alloys of titanium and zirconium. Components of FTS Category 2 and 3 that handle acidic or 

alkaline fluids are generally constructed from Type 304L or 316L stainless steel. Material used 

for the construction of this equipment is specified in accordance with ASME and ASTM material 

specifications. In general, design of equipment to these standards means that the components 

are designed for the most severe service conditions. Included in the severe service conditions 

are pressure, temperature, stress, and corrosion. The corrosion allowance for the construction 

materials is specified for each component in accordance with industry practices and from 

experience at the La Hague facility. On the basis of the applicant’s commitment to design the 

system to be resistant to corrosion and its commitment to use material maintenance and 

surveillance programs to detect and limit the damage from corrosion, the staff finds this design 

to be acceptable and consistent with the guidance in Section 11.4.7.2 (G) of NUREG-1718. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 143

11.7.4.8 Entrapment and Buildup of Solids 

The fluid transport system piping is designed to minimize entrapment and buildup of solids in 

the system. To minimize or eliminate the buildup of solids within the AP liquid process units, the 

following measures are taken: (1) the process technology does not involve suspension of the 

solid particles in liquid past the dissolution stage (before precipitation); (2) undissolved particles 

in the dissolution unit are removed through multiple stages of filters; (3) the liquid solutions used 

in the processes are not saturated solutions; (4) air spargers are provided as necessary to keep 

solutions well mixed; (5) decontamination fluid is supplied throughout the AP process units to 

remove potential buildup; (6) piping layout is designed with an adequate slope, without sharp 

directional change, and without low point traps; (7) demisters are cleaned periodically with 

decontamination solution; and (8) freeze jackets and fluid thermal cycling are used to prevent 

clogging of piping. 

The following means are provided to minimize buildup of solids in the powder-handling 

processes: (1) the dry process environment minimizes ingress of moisture, (2) process 

equipment is stacked vertically, (3) the surface finish provides non-sticking tendencies, and 

(4) vibrators maintain free-fall gravity feed at selected locations. 

The staff has reviewed the design bases for minimizing entrapment and buildup of solids and 

finds the design to be acceptable based on the systems and components that are to be used to 

reduce buildup of solid materials and is consistent with the guidance in Section 11.4.7.2 (H) of 

NUREG-1718. 

11.7.4.9 Containment 

The fluid transport system hoods, gloveboxes, and shielding for personnel protection are 

generally required for wet processing operations involving more than gram quantities of 

plutonium or general operations involving 50 micrograms or more of plutonium in respirable 

form. Process cells contain equipment that handles radioactive materials in chemical solutions 

that is fully welded and does not require routine maintenance. Equipment that cannot be fully 

welded is installed in gloveboxes. Welded equipment is designed in accordance with good 

engineering and industrial practices, codes and standards, and any other supplemental 

requirements. Equipment containing radioactive materials in the powder process (MP) is 

contained in gloveboxes in process rooms that provide confinement equivalent to fully welded 

equipment in process cells. The staff has reviewed the list of equipment and agrees that the 

equipment involving more than gram quantities of plutonium or general operations involving 50 

micrograms or more of plutonium in respirable form are properly contained in either gloveboxes 

or fully welded process equipment. Therefore, because the facility design follows the guidelines 

of Section 11.4.7.2 (I) of NUREG-1718, the staff finds the design basis to be acceptable. 

11.7.4.10 Surface Finishes 

The fluid transport system surface finishes of materials in the work areas have satisfactory 

decontamination characteristics for their particular application. The surface finish in the powderhandling process area possesses nonsticking tendencies. Valves have smooth interior surfaces 

to present little surface area for particulate matter to plate out. The staff finds these features 

acceptable. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 144

Inside glovesboxes, material-handling devices are most commonly made of stainless steel, 

which allows for decontamination. Use of components requiring painting is minimized. 

Components are designed to be easily accessible and readily dismantled for decontamination. 

Lubrication is limited to the extent practical. Internal welds are continuous and ground smooth, 

and reentrant corners have large radii. 

The staff has reviewed the design bases related to surface finishes and finds the design to be 

acceptable based on the materials used in the design and is consistent with the guidance in 

Section 11.4.7.2 (J) of NUREG-1718. 

11.7.4.11 Natural Phenomena 

Fluid transport systems maintain functionality when subjected to tornadoes, tornado missiles, 

earthquakes, floods, and any other natural phenomena deemed to be credible, as further 

established in the ISA performed by the applicant. Radiological fluids are maintained within at 

least two levels of confinement. All piping components designated as IROFS are designed to 

withstand the design-basis earthquake loads. 

Fluid transport systems are designed and qualified according to national codes and standards 

enabling them to perform their safety function during normal operations, upset conditions, and 

design-basis events. Section 11.7 of the LA lists these codes and standards for the IROFS. 

The design basis of the seismic monitoring system ensures that it provides sufficient data to 

evaluate the response of the confinement structure and other IROFS to a seismic event and to 

initiate a shutdown of process systems in the event of a high seismic event. Section 11.11 of 

this SER further discusses seismic qualifications and natural phenomena accidents. 

11.7.5 Loss of Confinement Event Sequences 

Section 5.3.3 of the ISA Summary (MOX, 2010b) discusses the results of the evaluation of loss 

of confinement events. The following loss of confinement event groups are related to the fluidhandling system and are evaluated in the MFFF ISA: 

• LOC-3—Leaks from AP vessels or pipes within process cells 

• LOC-4—Leaks from AP vessels or pipes within gloveboxes 

• LOC-5—Backflow from process vessels through utility lines 

• LOC-11—Process fluid line leak in a C3 area outside a glovebox 

• LOC-13—Uncontrolled release of nitrogen tetroxide 

11.7.5.1 LOC-3—Leaks from Aqueous Polishing Vessels or Pipes within Process Cells 

LOC events are postulated to occur in the process cells in the Aqueous Polishing Area (BAP) as 

a result of leaks from process vessels or pipes or both. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 145

With respect to the discussions in Sections 11.7.4.7 and 11.7.4.9 of this SER, the staff 

concludes with reasonable assurance that the applicant has demonstrated that the facility will 

comply with the performance requirements of 10 CFR § 70.61 (b) and (c) in the event of leaks 

from AP vessels or pipes within process cells. The staff also agrees with the applicant that the 

event group is highly unlikely, given the use of the designated IROFS, codes and standards, 

management measures, and quality assurance program. 

11.7.5.2 LOC-4—Leaks from Aqueous Polishing Vessels or Pipes within Gloveboxes 

Process cells are not accessible during normal operations. AP process equipment that requires 

frequent operation or maintenance or has electrical connections is placed within gloveboxes 

outside of the process cells. Such equipment includes valves, pumps, filters, piping, vessels, 

and associated instrumentation. Unlike equipment in the process cells, AP equipment 

contained in gloveboxes may not be fully welded; therefore, leaks from valve packing, pump 

seals, and instrument penetrations may occur. To confine leakage, this equipment is placed in 

gloveboxes equipped to collect and drain the leakage. This event group addresses a leak of 

process solution from AP process equipment in a glovebox. 

With respect to the discussions in Sections 11.7.4.4, 11.7.4.7, 11.7.4.8, and 11.7.4.9 of this 

SER, the staff concludes, with reasonable assurance, that the applicant has demonstrated that 

the facility will comply with the performance requirements of 10 CFR § 70.61 in the event of 

leaks from AP vessels or pipes within gloveboxes. The staff also agrees with the applicant that 

the event group is highly unlikely, given the use of the designated IROFS, codes and standards, 

management measures, and quality assurance program. 

11.7.5.3 LOC-5—Backflow from Process Vessels through Utility Lines 

This event involves the backflow of AP process vessel solutions into interfacing reagent 

systems and utilities, causing a potential chemical incompatibility (explosion or unplanned 

evolution and release of chemicals) or radiation and chemical exposure to facility workers in 

process areas normally expected to be devoid of significant quantities of radiological material. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 146

With respect to the discussions in Sections 11.7.4.4, 11.7.4.5, 11.7.4.7, 11.7.4.8, and 11.7.4.9 

of this SER, the staff concludes, with reasonable assurance, that the applicant has 

demonstrated that the facility will comply with the performance requirements of 10 CFR § 70.61 

(b) and (c) related to backflows from process vessels through utility lines. The staff also agrees 

with the applicant that the event group is highly unlikely, given the use of the designated IROFS, 

codes and standards, management measures, and quality assurance program. 

11.7.5.4 LOC-11—Process Fluid Line Leak in a C3 Area outside a Glovebox 

Loss of confinement events are postulated to occur because of a leak from a line carrying a 

process fluid or an off-gas in a C3 confinement zone area outside of a glovebox in the BAP. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 147

With respect to the discussions in Sections 11.7.4.4, 11.7.4.7, and 11.7.4.8 of this SER, the staff 

concludes, with reasonable assurance, that the applicant has demonstrated that the facility will 

comply with the performance requirements of 10 CFR § 70.61 as they relate to a process fluid 

line leak in a C3 area outside a glovebox. The staff also agrees with the applicant that the event 

group is highly unlikely, given the use of the designated IROFS, codes and standards, 

management measures, and quality assurance program. . 

11.7.5.5 LOC-13—Uncontrolled Release of Nitrogen Tetroxide 

 

 

With respect to the discussions in Sections 11.7.4.4, 11.7.4.7, and 11.7.4.8 of this SER, the staff 

concludes, with reasonable assurance, that the applicant has demonstrated that the facility will 

comply with the performance requirements of 10 CFR § 70.61 as they relate to an uncontrolled 

release of nitrogen tetroxide. Additionally, the administrative process cell entry control and the 

process cell exhaust system contribute to the reduction of the likelihood of chemical exposures 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 148

to the workers. The staff also agrees with the applicant that the event group is highly unlikely, 

given the use of the designated IROFS, codes and standards, management measures, and 

quality assurance program. 

11.7.6 Explosion Event Sequences 

Section 5.3.6 of the ISA Summary (MOX, 2010b) discusses the results of the evaluation of 

explosion events. The following explosion event groups are related to the fluid-handling system 

and were evaluated in the MFFF ISA: 

• EXP-08—AP vessel overpressure explosion 

• EXP-09—Pressure vessel overpressurization explosion 

11.7.6.1 EXP-08—Aqueous Polishing Vessel Overpressure Explosion 

The AP process of the MFFF uses many vessels throughout the process to remove impurities 

from the incoming plutonium oxide powder. These vessels receive and pass on process 

solutions, receive reagents, receive utilities, and have various combinations of vents, overflows, 

and drains. There are multiple chemical reactions that take place in these vessels during the 

dissolution of the powders, purification of the process solution, and conversion back to the 

powder form. Some of these chemical reactions sometimes produce off-gases that could 

potentially overpressure a vessel. 

An overpressure explosion is generally described as a sudden release of energy either by a 

sudden increase in either volume, temperature, or pressure or any combination of these. As 

examples, energy release can be propagated by pressure waves, the kinetic energy of 

fragmented vessels and vessel contents, or thermal radiation. Combustion or other chemicalreaction-generated explosions with pressure waves are categorized as deflagrations, if these 

waves are subsonic, and detonations if they are supersonic (shock waves). An overpressure 

event remaining below 50.9 pounds per square inch gauge (psig) (0.35 megapascal gauge 

(MPa-g)) is not considered an explosion because of the lower pressure involved, but is 

considered a leak or an overpressure breach. Consequences for this type of overpressure 

event are bounded by those of explosions at 50.9 psig. An overpressure event is an event 

which results in the normal operating pressure range within a container being exceeded, while 

pressure is maintained below the lower limit of 50.9 psig (0.35 MPa-g) for events involving 

liquids confined in a vessel or container and vented above the surface of the liquid after a slow 

buildup of pressure. 

The events covered by this section are process-related overpressures involving reagents or 

utilities or both in AP vessels, tanks, and piping in AP process cells or gloveboxes that result in 

an energetic breach of the AP vessels, tanks, and piping and the potentially energetic dispersal 

of radioactive materials. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 149

With respect to the discussions in Sections 11.7.4.4, 11.7.4.7, and 11.7.4.8 of this SER, the staff 

concludes, with reasonable assurance, that the applicant has demonstrated that the facility will 

comply with the performance requirements of 10 CFR § 70.61(c) as they relate to AP vessel 

overpressure explosions. The staff also agrees with the applicant that the event group is highly 

unlikely, given the use of the designated IROFS, codes and standards, management measures, 

and quality assurance program. 

11.7.6.2 EXP-09—Pressure Vessel Overpressurization Explosion 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 150

 

Based on the robustness of the process cell walls and the lack of sufficient energy from the 

potential pressure failure to damage IROFS, the staff finds, with reasonable assurance, that the 

performance requirements of 10 CFR § 70.61 are met with respect to pressure vessel 

overpressurization explosions. The staff also agrees with the applicant that the event group is 

highly unlikely, given the use of the designated IROFS, codes and standards, management 

measures, and quality assurance program. 

11.7.7 Codes and Standards 

The design, engineering, and construction of IROFS are guided by the codes, standards, and 

practices defined in FTS Categories 1 and 2 in Tables 11.7-1 and 11.7-2 of the LA (MOX, 

2010a). The fluid transport systems that consist of vessels, pumps, piping, and valves are 

classified as FTS-1 and FTS-2 and are designed accordingly. 

Section 11.7.3 of the LA (MOX, 2010a) identifies other design-basis codes and standards for 

the fluid transport system. 

11.7.8 Evaluation 

The staff evaluated the information provided by the applicant for fluid transport equipment and 

controls in Section 11.7 and other applicable sections of the LA (MOX, 2010a). The staff 

concluded that the applicant’s proposed equipment, controls, and procedures provide a 

reasonable level of assurance that events related to the fluid transport systems that could cause 

a release of radioactive material or radiation exposures in excess of the performance 

requirements in 10 CFR 70.61 are highly unlikely, given the use of the designated IROFS, 

codes and standards, management measures, and quality assurance program. 

REFERENCES 

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” Washington, 

DC, August 2000. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 151

(MOX, 2010a) Shaw AREVA MOX Services, “MFFF—License Application,” Aiken, SC, March 

2010. 

(MOX, 2010b) Shaw AREVA MOX Services, “MFFF—Integrated Safety Analysis Summary,” 

Aiken, SC, March 2010. 

10 CFR Part 70, Domestic Licensing of Special Nuclear Material. 

11.8 Fluid Systems

This chapter of the safety evaluation report (SER) contains the U.S. Nuclear Regulatory 

Commission (NRC) staff’s review of the fluid systems described by the applicant in Section 11.8 

of the license application (LA) (MOX, 2010a) and Section 4.8 of the Integrated Safety Analysis 

(ISA) Summary (MOX, 2010b). The objective of this review is to determine whether the fluid 

systems’ items relied on for safety (IROFS) and their design bases identified by the applicant 

provide reasonable assurance of protection against natural phenomena and the consequences 

of potential accidents. The staff evaluated the information provided by the applicant for fluid 

systems by reviewing Section 11.8 and other sections of the LA, Section 4.8 of the ISA 

Summary, supplementary information provided by the applicant, applicable codes and 

standards, and relevant documents available at the applicant’s offices but not submitted by the 

applicant. The staff closely coordinated its review of fluid systems’ design bases and strategies 

with the review of other chapters in this SER (e.g., ISA in Chapter 5, fire protection in Chapter 7, 

and chemical safety in Chapter 8). 

11.8.1 Regulatory Requirements 

The staff reviewed how the LA (MOX, 2010a) and ISA Summary (MOX, 2010b) address the 

following regulations: 

• Title 10 of the Code of Federal Regulations (10 CFR) 70.61(e), as it specifically relates 

to the requirement that each engineered or administrative control or control system that 

is needed to meet the performance requirements be designated as an IROFS and as it 

relates to the safety program that ensures that each IROFS will be available and reliable 

to perform its intended function when needed 

• 10 CFR 70.64, “Requirements for New Facilities or New Processes at Existing 

Facilities,” which requires that baseline design criteria and defense-in-depth practices be 

incorporated into new facility design 

• 10 CFR 70.64(a)(2), which requires that new facility designs adequately protect against 

natural phenomena hazards and consider the most severe documented historical events 

for the site 

11.8.2 Regulatory Acceptance Criteria 

The review focused on the design bases of fluid systems, their components, and other related 

information. For fluid systems, the staff reviewed and evaluated the information provided by the 

applicant for the safety function, system description, and safety analysis. The review also 

encompassed proposed design-basis considerations, such as redundancy, independence, 

reliability, and quality. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 152

Section 11.4 of NUREG-1718, “Standard Review Plan for the Review of an Application for a 

Mixed Oxide (MOX) Fuel Fabrication Facility” (NRC, 2000) outlines the acceptance criteria 

related to plant systems. No section in NUREG-1718 is specifically designated to address all of 

the items discussed in Section 11.8 of the LA and Section 4.8 in the ISA Summary, with the 

exception of the cooling water system which Section 11.4.4 of NUREG-1718 describes. 

However, the function, description, control concepts, and system interfaces pertaining to each 

fluid system are addressed by the regulatory requirements identified in the review guidance in 

Section 11.4 of NUREG-1718. 

11.8.3 Staff Review and Analysis 

11.8.3.1 Fluid Systems Description 

The Mixed Oxide Fuel Fabrication Facility (MFFF) fluid systems consist of mechanical utility 

fluids, bulk gases, and chemical reagents designed to support the MFFF. The applicant has 

identified the following IROFS in fluid systems: 

• instrumentation and controls (I&C) 

• sampling systems 

• double-walled piping 

• relay lock outs for transfer pumps 

• isolation valves 

• seismic isolation valves 

• emergency diesel generator fuel oil system (EDGFOS) 

• emergency scavenging air system (ESAS) 

• moisture and temperature sensors 

• hydrogen analyzer 

• signal for shut down of transfer pump 

Non-IROFS systems may contain IROFS components, such as seismic isolation valves. 

Section 11.8.4 of this SER evaluates seismic isolation valves, EDGFOS, and ESAS IROFS. 

11.8.3.2 Mechanical Utility Systems 

The mechanical utility systems comprise the following: 

• heating, ventilation, and air conditioning (HVAC) chilled water 

• process chilled water 

• demineralized water (DMW) 

• process hot water 

• process steam 

• building services 

• EDGFOS 

• standby diesel generator fuel oil 

• service air 

• instrument air 

• decontamination 

• breathing air 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 153

• vacuum radiation monitoring 

Most of these systems are non-IROFS but contain components, such as seismic isolation 

valves, that are IROFS. 

11.8.3.2.1 HVAC Chilled Water System 

The HVAC chilled water system supplies chilled water and cooling water for the MFFF HVAC 

during normal operation. This system consists of an external cooling loop and an internal 

cooling loop. The heat will be transferred between the two loops via a heat exchanger. The 

external loop will be maintained at a higher pressure relative to the internal loop. This design 

reduces the risk of radiological or chemical material being dispersed from inside the MFFF to 

the environment. 

The HVAC chilled water system is not an IROFS, but the system uses redundant and 

independent seismic isolation valves for IROFS. Section 11.8.4.1 of this SER evaluates seismic 

isolation valves. 

11.8.3.2.2 Process Chilled Water System 

The process chilled water system supplies chilled water and cooling water to the MFFF during 

normal operation. This system consists of an external cooling loop and an internal cooling loop. 

The heat will be transferred between the two loops via a heat exchanger. The external loop will 

be maintained at a higher pressure relative to the internal loop. This design reduces the risk of 

radiological or chemical material being dispersed from inside the MFFF to the environment. 

Leakage from either loop will be constantly monitored by pressure sensors, as well as a low 

pressure monitor on the expansion tank. Radiation monitors are used to detect any in-leakage 

of radioactive material. 

The process chilled water system is not an IROFS, but the system uses redundant and 

independent seismic isolation valves, sampling, and double-walled piping for IROFS. IROFS 

sampling will be performed in some of the closed cooling water loops to ensure that no water 

has leaked from the process chilled water system into other units. Double-walled pipe will be 

used in each moderator controlled room to prevent the release of water. 

11.8.3.2.3 Demineralized Water System 

The DMW system receives, stores, and transfers pressurized and gravity-fed demineralized 

water to process equipment and utility systems. The DMW system produces, stores, and 

transfers pressurized and gravity-fed (i.e., unpressurized) demineralized water to process 

equipment and utility systems for use in reagent preparation, solution dilution, initial loop filling, 

humidification of sintering gas, general laboratory functions, sintering furnace cooling, and 

miscellaneous process purposes. This system is not an IROFS, but contains redundant and 

independent seismic isolation valves that are IROFS. 

11.8.3.2.4 Process Hot Water System 

The process hot water system supplies electrically heated demineralized water to various parts 

of the aqueous polishing (AP) process. This system comprises pumps, expansion tanks, 

valves, piping, electrical heaters, and heat exchangers. This system transfers heat via heat 

exchangers to process equipment. Radiation detectors will constantly monitor leakage from 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 154

either loop. This system is not an IROFS. However, IROFS pressure transmitters are provided 

on the heating loops to ensure that the pressure in the hot water system is always greater than 

that of the process fluid. 

11.8.3.2.5 Process Steam System 

The process steam system supplies and regulates steam to various AP process units. The 

condensate return will provide makeup water for the steam generator. The steam generator 

equipment consists of electric boilers, deaerator, pumps, chemical feed equipment, blowdown 

tank, condensate tanks, valves, I&C, and piping. Samples from the system will be periodically 

analyzed for chemical additives and corrosion inhabitation. Radiation monitors will constantly 

monitor leakage into the system. 

The process steam system is not an IROFS, but the system uses redundant and independent 

seismic isolation valves, as well as isolation valves in the supply lines to steam jets in the AP 

process. These valves are IROFS and are used to prevent the transfer of unanalyzed material 

into the AP process. 

11.8.3.2.6 Building Services System 

The building services system supplies potable water and drainage for personnel 

decontamination. This system consists of a shower, toilet, and sink. The waste water will be 

sampled and analyzed to determine the appropriate disposal method. The Savannah River Site 

will supply the potable water system. This system is not an IROFS, but contains redundant and 

independent seismic isolation valves that are IROFS. 

11.8.3.2.7 Emergency Diesel Generator Fuel Oil System 

 

The applicant has committed to design the EDGFOS to comply with American National 

Standards Institute/American Nuclear Society (ANSI/ANS) 59.51-1997, “Fuel Oil Systems for 

Safety-Related Emergency Diesel Generators” (ANSI/ANS, 1997), and to meet the 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 155

requirements of National Fire Protection Association (NFPA) 30, “Flammable and Combustible 

Liquids Code” (NFPA, 1996), and NFPA 37, “Standard for the Installation and Use of Stationary 

Combustion Engines and Gas Turbines” (NFPA, 1998a). This is in addition to the applicant’s 

commitment to meet Institute of Electrical and Electronics Engineers (IEEE) 387-1995, “IEEE 

Standard Criteria for Diesel Generator Units Applied as Standby Power Supplies for Nuclear 

Power Generating Stations,” and the codes and standards for piping, tanks, and valves shown 

in Table 11.7.1 of the LA. 

11.8.3.2.8 Standby Diesel Generator Fuel Oil System 

The standby diesel generator fuel oil system receives, samples, stores, and supplies fuel oil to 

the standby diesel generators. The standby diesel generators are used to provide power in the 

event of a loss of primary offsite power. This system consists of a common tank, transfer pump, 

filters, valves, controls, and piping. The common tank will be stored in a belowground concrete 

vault. This system and the components contained in the system are not IROFS. 

11.8.3.2.9 Service Air System 

The service air system pressurizes, dries, filters, stores, and supplies pressurized air to the 

facility service air headers for maintenance and utility. This system will be supplied on a skid 

that contains an inlet filter, aftercooler, moisture separator, and trim cooler. This system is 

designed to minimize moisture by using air dryers after the air has passed by the water 

aftercooler. A coalescing filter will be the final step that removes contaminant. 

The service air system is not an IROFS, but contains redundant and independent seismic 

isolation valves for IROFS. These valves prevent overpressurization of the AP process 

equipment. Even though the service air system has a variety of uses, such as tank agitation, 

this safety function does not depend on this system; therefore, this system is not an IROFS. 

11.8.3.2.10 Instrument Air System 

The instrument air system (IAS) continuously provides dry, clean, oil-free instrumentation air for 

bubbling air, air-operated valve operation, glovebox ventilation, and process equipment. The 

IAS supplies instrument quality air for the following: (1) instruments with buffered storage for 

control valves, transmitters, ventilation (building) dampers, and inline analyzers; (2) ventilation 

and cooling for gloveboxes and the pelletizing press bellows; (3) normal bubbling and 

scavenging for level measurement and hydrogen dilution during normal operation; 

(4) independent emergency scavenging for plutonium vessels in which radiolysis-related 

hydrogen buildup can occur following an earthquake, loss of normal instrument air, or loss of 

power; and (5) super dry air for ventilation and cooling of the AP powder gloveboxes. 

The IAS is not an IROFS, but the ESAS is a stand-alone independent IROFS subsystem of the 

IAS. The ESAS will prevent radiolysis-related hydrogen buildup in process vessels following a 

loss of normal air supply. The emergency scavenging air supply is automatically activated 

following a loss of a normal instrument air supply by starting the two parallel air compressors 

and dryer skids. Each train of scavenging air contains sufficient air to maintain the hydrogen 

concentration in the vapor spaces of supplied vessels at less than or equal to 1 percent. The 

IAS contains IROFS, which include moisture sensors, temperature sensors, and redundant and 

independent seismic isolation valves. These IROFS are necessary to prevent moisture or hightemperature air from entering criticality controlled rooms. Section 11.8.4.3 of this SER 

evaluates the ESAS. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 156

11.8.3.2.11 Decontamination System 

The decontamination system supplies a 3 normal (N) nitric acid solution for the decontamination 

of certain AP process equipment and lab gloveboxes. The solution will be prepared in a 

preparation tank and then pumped to the end users. 

The decontamination system is not an IROFS, but contains an administrative sampling IROFS. 

The level in the tank will be measured to ensure that no leakage has occurred, which is part of 

the sampling IROFS. The transfer pump will be locked out by redundant and independent 

IROFS instrumentation until the sample is validated. 

11.8.3.2.12 Breathing Air System 

The breathing air system supplies clean, dry breathing air to the MFFF to support periodic 

maintenance and emergency usage. The breathing air system contains six quick-connect 

connections designed to ensure that only breathing equipment can be connected to this system. 

This system contains a high-energy particular air filter, drain valve, compressors, moisture 

separator, coolers, piping, and pressure sensors. This system is not an IROFS, but contains 

redundant and independent seismic isolation valves that are IROFS. 

11.8.3.2.13 Radiation Monitoring Vacuum System 

The radiation monitoring vacuum system provides a vacuum to draw air from specific areas to 

the continuous air monitoring detectors at a minimum of 2 cubic feet per minute. This system 

contains vacuum pumps, filters, nozzles, instrumentation, and piping. This system is designed 

to minimize the potential for radioactive material buildup by having smooth and wide-radii pipe 

bends and by using valves that have smooth interiors. This system is not an IROFS and does 

not contain any IROFS components. 

11.8.3.3 Bulk Gas Systems 

The bulk gas systems comprise the following: 

• nitrogen 

• argon/hydrogen 

• helium 

• oxygen 

• methane/argon 

• nitrogen tetroxide 

Most of these systems are non-IROFS but contain components, such as seismic isolation 

valves, that are IROFS. The following is a discussion of the bulk gas systems. 

11.8.3.3.1 Nitrogen System 

The nitrogen system supplies nitrogen to various gloveboxes and other systems and for use as 

scavenging. Liquid nitrogen can also be used as a backup supply for onsite gaseous liquid 

nitrogen. Nitrogen will be generated in a separator from ambient air. The system consists of a 

supply skid, piping, and valves. For normal operations, the nitrogen system ventilates the BMP 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 157

area gloveboxes, scavenges the sintering furnace airlock, scavenges the calcination furnace, 

and provides scavenging and bubbling air for the hydroxylamine nitrate (HAN) tanks. For 

emergency operations, the nitrogen system serves as backup to dry air for the pelletizing press 

bellows and as backup to the argon/hydrogen system for furnace and airlock scavenging of the 

BMP sintering furnaces. This system is not an IROFS, but contains redundant and independent 

seismic isolation valves that are IROFS. 

11.8.3.3.2 Argon/Hydrogen System 

The argon/hydrogen system supplies an argon/hydrogen mixture for scavenging of the electric 

sintering furnace and furnace airlocks. The major components of this system are the liquid 

argon bulk storage system, the hydrogen tube trailer, the backup argon/hydrogen cylinders, 

inline mixing stations, buffer tanks, pressure transmitters, pressure control valves, alarms, 

piping, and isolation valves. 

There are three levels of backup for the argon/hydrogen system. A multitube trailer of premixed 

argon/hydrogen gas provides primary backup. This is generally used only to continue operation 

while the standby portion of the argon/hydrogen system is adjusted and brought online. 

Secondary backup is provided by 100-percent argon. Tertiary backup is provided by a tie in to 

the nitrogen system. Local bottles of hydrogen and the argon/hydrogen mix are provided for 

laboratory use. In addition, argon bottles for emergency purge of both sintering furnaces are 

provided. 

The argon/hydrogen system is not an IROFS, but contains a hydrogen concentration sensor 

and redundant and independent seismic isolation valves that are IROFS. The hydrogen 

concentration sensors provide an IROFS isolation function if the argon/hydrogen mixture 

exceeds a hydrogen concentration of 5 percent. Redundant IROFS isolation valves work in 

conjunction with hydrogen detectors to isolate the gas mixture in the event of a leak in the room 

or in the furnace entry/exit airlocks. This isolation function has been determined to be IROFS 

based on the need to prevent dispersion of nuclear materials from the furnace area resulting 

from fires or explosions. 

11.8.3.3.3 Helium System 

The helium system supplies helium for gloveboxes and scavenging for fuel rod welding. The 

gas will be supplied from tube trailers located outside in the gas storage area. This system also 

consists of pressure-reducing stations, piping, and valves. This system is not an IROFS, but 

contains redundant and independent seismic isolation valves that are IROFS. 

11.8.3.3.4 Oxygen System 

The oxygen system supplies oxygen to the calcination furnace. This system consists of storage 

cylinders, valves, pressure indicators, switches, and piping. This system is not an IROFS, but 

contains redundant and independent seismic isolation valves that are IROFS. The fire detection 

system also sends an IROFS isolation signal to the seismic isolation valves, which are IROFS, if 

a fire is detected in the furnace room. 

11.8.3.3.5 Methane/Argon System 

The methane/argon system supplies a reference quenching gas for personal radiation monitors 

and friskers in the MOX Fuel Fabrication Building (BMF). This system consists of storage 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 158

cylinders, valves, pressure indicators, and piping. This system will be located in the gas storage 

area and the laboratory. This system is not an IROFS, but contains redundant and independent 

seismic isolation valves that are IROFS. 

11.8.3.3.6 Nitrogen Tetroxide System 

The nitrogen tetroxide (GNO) system supplies nitrous fumes to the AP process for oxidation of 

plutonium nitrate in the purification cycle (KPA) unit. 

This system is not an IROFS. However, the GNO system penetrations into the BMF are 

provided with redundant IROFS seismic isolation valves that are automatically closed upon 

detection of the seismic monitoring system trip point. 

11.8.3.4 Reagent Systems 

The reagent systems comprise the following: 

• nitric acid 

• tributyl phosphate 

• HAN 

• sodium hydroxide 

• oxalic acid 

• diluent 

• sodium carbonate 

• hydrogen peroxide 

• hydrazine 

• manganese nitrate 

• aluminum nitrate 

• zirconium nitrate 

• silver nitrate 

• sodium sulfite 

• sodium nitrite 

• uranyl nitrate 

Most of these systems are non-IROFS but contain components, such as seismic isolation 

valves, that are IROFS. The following is a discussion of the reagent systems. 

11.8.3.4.1 Nitric Acid 

The nitric acid system prepares and delivers three concentrations of nitric acid to multiple areas. 

The nitric acid system provides nitric acid to the AP process units for plutonium dioxide (PuO2) 

dissolution, plutonium stripping, acid scrubbing, acidification, and oxalic mother liquor 

adjustment. This system also provides nitric acid for the preparation of hydrazine, oxalic acid, 

manganese nitrate, zirconium nitrate, HAN, silver nitrate, and decontamination solution, as well 

as various other uses. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 159

This system is not an IROFS, but contains redundant and independent seismic isolation valves 

and an administrative sampling IROFS. The sampling systems for the 6 N nitric acid 

preparation tank and the 1.5 N nitric acid preparation tank have been determined to be IROFS 

to ensure that the proper chemical composition of reagents is sent to the AP process. The level 

in the preparation tanks is monitored after sampling to ensure that no leakage into or out of the 

tank has occurred. If the results of the analysis are acceptable, the batch is validated and the 

tank is declared ready for distribution. The mixture is then transferred to a buffer tank from 

which a circulation pump is used to feed the process users. 

11.8.3.4.2 Tributyl Phosphate 

The tributyl phosphate system supplies tributyl phosphate for solvent extraction in the 

purification cycle of the AP process and solvent washing in the solvent recovery cycle. This 

system’s fluid will be transferred from drums into a tank by an air-operated pump. The tanks 

and pipes are equipped with dip pipes to prevent explosions that could result from static 

electricity. Equipment suitable for use in an explosive environment will be used. These features 

will ensure that no electrical ignition source comes in contact with this system’s fluid. 

The tributyl phosphate system is not an IROFS, but contains redundant and independent 

seismic isolation valves and an administrative sampling IROFS. The level in the tank will be 

measured to ensure that no leakage has occurred, and the chemical composition will be verified 

as part of the sampling IROFS. The fire detection system also sends an IROFS isolation signal 

to the system pumps and isolation valves in the line if a fire is detected in the AP or the reagent 

process room. 

11.8.3.4.3 Hydroxylamine Nitrate 

The HAN system supplies HAN for the stripping of plutonium in the AP purification process. 

This system’s fluid will be transferred from drums into a tank by an air-operated pump. 

Precautions taken to prevent a HAN explosion include (1) hydrogen peroxide scrubbing and 

(2) IROFS sampling. 

This system is not an IROFS, but contains redundant and independent seismic isolation valves 

and an administrative sampling IROFS. The sampling systems for the HAN system have been 

determined to be IROFS to ensure that the proper chemical composition is sent to the AP 

process. The level in the preparation tanks is monitored after sampling to ensure that no 

leakage into or out of the tank has occurred. If the results of the analysis are acceptable, the 

batch is validated and the tank is declared ready for distribution. 

11.8.3.4.4 Sodium Hydroxide 

The sodium hydroxide system supplies sodium hydroxide to various users for solvent recovery 

washing and pH control. The system’s fluid will be prepared, mixed, and then pumped to a 

distribution tank. This system is not an IROFS, but contains redundant and independent 

seismic isolation valves that are IROFS. 

11.8.3.4.5 Oxalic Acid 

The oxalic acid system supplies oxalic acid for converting plutonium nitrate to plutonium oxalate 

in the oxalic precipitation, filtration, and calcination unit. This fluid will be prepared, mixed, and 

then pumped to a distribution tank. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 160

This system is not an IROFS, but contains redundant and independent seismic isolation valves 

and an administrative sampling IROFS. The sampling systems for the oxalic acid preparation 

tanks have been determined to be IROFS to ensure that the proper chemical composition of 

reagents is sent to the AP process. The level in the preparation tanks is monitored after 

sampling to ensure that no leakage into or out of the tank has occurred and that the 

concentration is correct. If the results of the analysis are acceptable, the batch is validated and 

the tank is declared ready for distribution 

11.8.3.4.6 Diluent 

The diluent system supplies a dodecane isomer mix for washing in the purification and solvent 

recovery cycles and diluent for preparation of the 30-percent tributyl phosphate solvent solution. 

An air-operated pump will transfer this fluid from drums into a tank. 

This system is not an IROFS, but contains redundant and independent seismic isolation valves 

and an administrative sampling IROFS. Sampling will be performed to ensure that the 

flashpoint of the fluid is within acceptable parameters. 

11.8.3.4.7 Sodium Carbonate 

The sodium carbonate system supplies a sodium carbonate solution for washing the solvent 

solution. This fluid will be transferred from bags into a tank and mixed with water. 

This system is not an IROFS, but contains redundant and independent seismic isolation valves 

and an administrative sampling IROFS. The level in the preparation tanks is monitored after 

sampling to ensure that no leakage into or out of the tank has occurred and that the 

concentration is correct. If the results of the analysis are acceptable, the batch is validated and 

the tank is declared ready for distribution. 

11.8.3.4.8 Hydrogen Peroxide 

The hydrogen peroxide system supplies hydrogen peroxide to the AP process for valence 

adjustment of the dissolution units. This fluid will be transferred from drums into a tank by a 

pump and then mixed with water. 

This system is not an IROFS, but contains redundant and independent seismic isolation valves 

and an administrative sampling IROFS. The level in the preparation tanks is monitored after 

sampling to ensure that no leakage into or out of the tank has occurred and that the 

concentration is correct. If the results of the analysis are acceptable, the batch is validated and 

the tank is declared ready for distribution 

11.8.3.4.9 Hydrazine 

The hydrazine system supplies a hydrazine nitrate and nitric acid solution for use in the 

purification cycle of the AP process. An air-operated pump will transfer this fluid from drums 

into a tank. Nitrogen blankets are used to prevent formation of explosive mixtures in the vapor 

space from the vessels in the hydrazine system. This system is not an IROFS and does not 

contain any IROFS components. 

11.8.3.4.10 Manganese Nitrate 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 161

The manganese nitrate system supplies manganese nitrate to the oxalic mother liquor recovery 

unit. This fluid will be transferred from bottles into a tank and then mixed with nitric acid. 

This system is not an IROFS, but contains an administrative sampling IROFS. The level in the 

preparation tanks is monitored after sampling to ensure that no leakage into or out of the tank 

has occurred and that the concentration is correct. If the results of the analysis are acceptable, 

the batch is validated and the tank is declared ready for distribution 

11.8.3.4.11 Aluminum Nitrate 

The aluminum nitrate system supplies aluminum nitrate to the purification cycle for solvent 

scrubbing. This system is not an IROFS, but contains an administrative sampling IROFS for 

monitoring concentration. 

11.8.3.4.12 Zirconium Nitrate 

The zirconium nitrate system provides a zirconium nitrate solution to the AP process to avoid 

fluoride corrosion of stainless steel vessels in the purification (KPA) cycle and acid recovery 

(KPC) units by reacting the fluoride with zirconium. This fluid will be pumped from a drum to the 

preparation tank. This system is not an IROFS, but contains redundant and independent 

seismic isolation valves and an administrative sampling IROFS. The level in the preparation 

tanks is monitored after sampling to ensure that no leakage into or out of the tank has occurred 

and that the concentration is correct. The transfer pump will be locked out by redundant and 

independent IROFS instrumentation until the sample is validated. 

11.8.3.4.13 Silver Nitrate 

The silver nitrate system supplies silver nitrate to the electrolyzers in the dechlorination and 

dissolution unit. Solid silver nitrate, demineralized water, and 13.6 N nitric acid are mixed in a 

preparation tank in the reagent processing area and pumped to a distribution tank in the AP 

area. Samples are taken, but they are not IROFS. This system is not an IROFS, but contains 

redundant and independent seismic isolation valves that are IROFS. 

11.8.3.4.14 Sodium Sulfite 

The sodium sulfite system supplies sodium sulfite to the dechlorination and dissolution unit for 

use as a washing solution. This fluid will be mixed with water in a preparation tank and pumped 

to a distribution tank in the AP area. Samples are taken, but they are not IROFS. This system 

is not an IROFS, but contains redundant and independent seismic isolation valves that are 

IROFS. 

11.8.3.4.15 Sodium Nitrite 

The sodium nitrite system supplies sodium nitrite to the AP process for treatment or destruction 

of azides in alkaline waste in the aqueous liquid waste reception unit. This fluid will be pumped 

from a drum to a distribution tank. Samples are performed, but they are not IROFS. This 

system is not an IROFS and does not contain any IROFS components. 

11.8.3.4.16 Uranyl Nitrate 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 162

The uranyl nitrate system supplies depleted uranyl nitrate to the plutonium feed stream and 

uranium waste stream for reducing the isotopic composition of uranium in the plutonium feed 

material. This fluid will be pumped from a drum to a distribution tank in the AP area. This 

system is not an IROFS, but contains an administrative sampling IROFS for concentration. If 

the results of the analysis are acceptable, the batch is validated and the tank is declared ready 

for distribution. 

11.8.4 Evaluation 

11.8.4.1 Seismic Isolation Valves 

11.8.4.1.1 Description 

The primary function of the fluid systems is to provide the safe and reliable handling of the fluids 

utilized during plant operation, including upset and emergency transients, and maintenance 

functions. 

No utility, gas, or reagent supplied from outside the BMF to a process or component inside the 

BMF supports an IROFS safety function and is not required to remain in service after a seismic 

event. A utility, gas, or reagent required to remain in service after a seismic event to support an 

IROFS function is supplied separately from independent, dedicated sources located inside of 

the BMF and is completely independent of the external portion of the system. 

Seismic isolation valves are classified as FTS Category 1 or FTS Category 2 (Section 11.7.3.1 

of this SER discusses FTS categories) and are designed in accordance with the codes and 

standards identified in Table 11.7-1 of the LA (MOX, 2010a). The applicable codes and 

standards for FTS Category 1 valves is American National Standards Institute/American Society 

of Mechanical Engineers (ANSI/ASME) B31.3, “Process Piping” (ANSI/ASME, 1996) (Category 

M restrictions are applicable) and ANSI/AMSE B31.3 for FTS Category 2. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 163

11.8.4.1.2 Evaluation 

The staff reviewed applicable Federal regulations, national codes and standards, NUREG-1718 

(NRC, 2000), other industry and NRC staff guidance, and available operational history. The 

following evaluation discusses the staff’s consideration and use of these documents. 

As discussed previously, redundant isolation valves are provided to automatically isolate the 

fluid lines if earthquake conditions are detected. These valves have been designated as 

IROFS. The valves will be ordered, built, delivered, installed, and used in accordance with the 

quality level appropriate to each application (as defined by the facility’s quality assurance 

program). 

The staff’s evaluation of the design basis for the seismic isolation valves consisted of a review 

of the applicant’s proposed design basis against national codes and standards and industry 

practices. The staff also applied the guidance of NUREG-1718 (NRC, 2000) to the review. 

The isolation valves will be designed to passively return to a closed, or isolated, position in the 

event of a failure of the valve actuator or the air supply or a loss of power. Based on the varying 

sizes, designs, materials of construction, methods of operation, and fail-safe design, the staff 

finds that the seismic isolation valves have the redundancy and diversity of components 

required for isolation and to prevent release of radioactive material. 

The applicant will design fluid systems, including the seismic isolation valves and other 

components, with consideration to the process fluids contained therein and will specify materials 

with the appropriate corrosion resistance. The applicant will also consider proper surface 

finishes and decontamination characteristics for their particular application in a system. Based 

on these considerations and their alignment with the materials and design methodology 

requirements of the ASME Boiler and Pressure Vessel Code, Section VIII (ASME, 1998), the 

staff finds this design basis to be acceptable. 

The seismic isolation valves will be designed and qualified to maintain functionality when 

subjected to severe natural phenomena as established in the ISA Summary (MOX, 2010b). The 

seismic isolation valves will actuate on a seismic event that is one-third of the design-basis 

earthquake ground motion (i.e., one-third of the safe-shutdown earthquake ground motion). 

This design basis meets the requirements for nuclear power generation facilities given in 

paragraph IV(a)(2)(i)(A) of Appendix S, “Earthquake Engineering Criteria for Nuclear Power 

Plants,” to 10 CFR Part 50, “Domestic Licensing of Production and Utilization Facilities.” The 

staff finds this design basis to be acceptable, since the facility design for actuation of the 

seismic isolation valves is based on the ground motion found to be acceptable at nuclear power 

generation facilities. 

11.8.4.2 Emergency Diesel Generator Fuel Oil System 

11.8.4.2.1 Description 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 164

 

11.8.4.2.2 Codes and Standards 

The applicant committed to using ANSI/ANS 59.51-1997 (ANSI/ANS, 1997) (endorsed by 

Regulatory Guide 1.137, “Fuel-Oil Systems for Standby Diesel Generators”). This standard 

addresses mechanical equipment associated with the fuel oil system. The purpose of this 

standard is to define those features of fuel oil systems required to ensure an adequate fuel 

supply to safety-related EDGs and to provide performance and design criteria to ensure that 

sufficient fuel is available for supply to the EDGs under all plant conditions. This standard 

applies to this design system with active components. Performance requirements state that the 

fuel oil system must be designed to maintain its integrity and to remain functional during and 

after all design-basis events. 

The ANSI/ANS 59.51-1997 (ANSI/ANS, 1997) standard also interfaces with ANSI/IEEE 

Standard 387-1995 and the Class 1E Power systems ANSI/IEEE Standard 308, “IEEE Standard 

Criteria for Class 1E Power Systems for Nuclear Power Generating Stations” (IEEE, 1991). 

This standard requires adherence to the single-failure criterion for light-water reactor safetyrelated fluid systems, as stated in ANSI/ANS 59.51-1997. 

The applicant also committed to meet the requirements of NFPA 30 (NFPA, 1996) and NFPA 37 

(NFPA, 1998a). 

11.8.4.2.3 Evaluation 

The staff reviewed applicable Federal regulations, national codes and standards, NUREG-1718 

(NRC, 2000), other industry and NRC staff guidance, and available operational history. The 

following evaluation discusses the staff’s consideration and use of these documents. 

The staff reviewed national codes and standards, such as IEEE Standard 308 (IEEE, 1991), 

NFPA 37 (NFPA, 1998a), and NFPA 110, “Standard for Emergency and Standby Power 

Systems” (NFPA, 1999b). The staff reviewed the seismic design of the EDGs. The staff also 

reviewed the design basis and provisions for maintaining a clean, reliable source of fuel oil for 

the EDGs by comparing the proposed design to standard industry practices and historical diesel 

generator failure information published by the NRC. 

The seismic design of the EDGFOS ensures that these systems will be able to safely shut down 

during normal operations and accident conditions. Based on the description of the system and 

the structures that will contain the system, the EDGFOS is adequately designed to maintain 

functionality when subjected to severe natural phenomena, such as tornadoes, tornado 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 165

missiles, earthquakes, floods, and any other appropriate phenomena as established in the ISA 

Summary (MOX, 2010b). 

 

The staff has reviewed the design and configuration of the EDGFOS system tanks and piping. 

The redundancy and diversity of the system and the seismic design, applied to the design as 

standard industry practices, will ensure a positive flow of fuel oil into the EDGs. This system will 

be designed with materials that will be corrosion resistance. The staff finds the design of the 

system tanks, piping, and pumping systems to be acceptable. 

Section 11.5 of this SER presents the staff’s review of the electrical capacity of the EDGs. 

11.8.4.3 Emergency Scavenging Air System 

11.8.4.3.1 Description 

The ESAS will be an independent IROFS subsystem of the IAS. The purpose of the ESAS will 

be to provide scavenging air for dilution of hydrogen that may be produced by radiolysis. The 

ESAS will be automatically activated following the loss of the normal instrument air supply by 

starting two parallel air compressors or dryer skids. The ESAS will be designed to maintain the 

hydrogen concentration in the vapor space of process vessels at less than or equal to 1 percent. 

Each train of scavenging air contains sufficient air to maintain the hydrogen concentration in the 

vapor spaces of supplied vessels at less than or equal to 1 percent. 

11.8.4.3.2 Codes and Standards 

The applicant provided the design-basis codes and standards for the ESAS in 

Section 11.8.1.1.3 of the LA (MOX, 2010a). That section referenced other portions of the LA 

which provided the codes and standards for system piping and valves, seismic isolation valves, 

dryers, receiving tanks, I&C, and the electrical supply. 

11.8.4.3.3 Evaluation 

The ESAS is an IROFS designed to provide emergency scavenging air for dilution of hydrogen 

that may be produced by radiolysis. The ESAS is designed to prevent the system from 

exceeding a 1-percent hydrogen buildup in the tanks. The ESAS is independent of the IAS. In 

the event of a failure of any of these systems, the ESAS is designed to compensate for the loss 

of the IAS. A loss of instrument air will automatically activate the ESAS. The pressure and flow 

switches will close isolation valves to isolate the air system to prevent backflow. 

The ESAS is designed to provide two trains, each capable of supplying 100 percent of the 

scavenging air requirements for 7 days. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 166

The subsystem does not rely on emergency power and will be designed to operate during 

accident conditions. The staff concludes that, because of the passive nature of the subsystem, 

it can be safely shut down during any normal or accident conditions. In the event that normal 

scavenging air is lost (without a seismic event), the ESAS will start and provide scavenging air 

to the AP process equipment, as necessary, until the normal scavenging air is restored. During 

a seismic event, the normal scavenging air will be isolated. The ESAS will start on a low/no 

airflow indication from the normal scavenging air and provide scavenging air to all applicable AP 

process equipment. 

Based on the provision of two 100-percent capacity trains of emergency scavenging air, as well 

as the design of the system air pressure control to switch supply banks on low system pressure, 

the staff finds that the subsystem has the adequate redundancy and diversity of components 

required to prevent release of radioactive material to the environment and that its design is 

adequate for safe operation of the system. The staff also agrees with the applicant that the 

ESAS is an independent IROFS because it is not physically connected to the normal 

scavenging air supply and has a separate nozzle to supply the vessels. 

The design of the ESAS falls into FTS Category 2, which is defined in Section 11.7 of this SER. 

The staff concludes that these design criteria adequately address equipment design to resist 

corrosion, piping design, and layout. 

Therefore, the staff concludes that the equipment will be made of materials with the proper 

surface finishes and decontamination characteristics for their particular application. 

The NUREG-1718 (NRC, 2000) guidance indicates that equipment is to be adequately designed 

to maintain functionality when subjected to severe natural phenomena as established in the ISA. 

The ESAS will be seismically designed and qualified in accordance with Regulatory Guide 

1.100, Revision 2, “Seismic Qualification of Electric and Mechanical Equipment for Nuclear 

Power Plants” (NRC, 1988), and IEEE Standard 344-1987, “IEEE Recommended Practice for 

Seismic Qualification of Class 1E Equipment for Nuclear Power Generating Stations” (IEEE, 

1987). Because the design conforms to Regulatory Guide 1.100 and the industry standard, the 

staff concludes that the applicant adequately addressed the features that apply to this IROFS. 

11.8.5 Evaluation Finding

The applicant provided design information for the fluid systems that are identified as IROFS. 

Based on the staff’s review of the LA (MOX, 2010a), ISA Summary (MOX, 2010b), and 

supporting information provided by the applicant relevant to the fluid systems, the staff 

concludes that (1) in accordance with 10 CFR 70.61(e), each engineered or administrative 

control or control system needed to meet the performance requirements is designated as an 

IROFS and the applicant’s safety program will ensure that each IROFS will be available and 

reliable to perform its intended function when needed and (2) the design bases of the IROFS 

evaluated in this SER section will provide reasonable assurance of protection against natural 

phenomena and the consequences of potential accidents. 

REFERENCES 

(ANSI/ANS, 1997) American National Standards Institute/American Nuclear Society, ANSI/ANS 

59.51-1997, “Fuel Oil Systems for Safety-Related Emergency Diesel Generators,” 1997. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 167

(ANSI/ASME, 1996) American National Standards Institute/American Society of Mechanical 

Engineers, ANSI/ASME B31.3, “Process Piping,” 1996 including 1998 addenda. 

(ASME, 1998) American Society of Mechanical Engineers, Boiler and Pressure Vessel Code, 

Section VIII, Division 1, “Rules for Construction of Division 1 Pressure Vessels” (Sections UG125 through UG-136), 1998. 

(MOX, 2010a) Shaw AREVA MOX Services, “License Application,” Aiken, SC, March 2010. 

(MOX, 2010b) Shaw AREVA MOX Services, “Integrated Safety Analysis Summary,” Aiken, SC, 

March 2010. 

(IEEE, 1987) Institute of Electrical and Electronics Engineers, Standard 344, “IEEE 

Recommended Practice for Seismic Qualification of Class IE Equipment for Nuclear Power 

Generating Stations,” 1987. 

(ANSI/IEEE, 1991) Institute of Electrical and Electronics Engineers, Standard 308, “IEEE 

Standard Criteria for Class IE Power Systems for Nuclear Power Generating Stations,” 1991. 

(NFPA, 1996) National Fire Protection Association, NFPA 30, “Flammable and Combustible 

Liquids Code,” 1996. 

(NFPA, 1998a) National Fire Protection Association, NFPA 37, “Standard for the Installation and 

Use of Stationary Combustion Engines and Gas Turbines,” 1998. 

(NFPA, 1999b) National Fire Protection Association, NFPA 110, “Standard for Emergency and 

Standby Power Systems,” 1999. 

(NRC, 1988) U.S. Nuclear Regulatory Commission, Regulatory Guide 1.100, Rev. 2, “Seismic 

Qualification of Electric and Mechanical Equipment for Nuclear Power Plants,” Washington, DC, 

1988. 

(NRC, 2000) U.S. Nuclear Regulatory Commission NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” Washington, 

DC, 2000. 

(IEEE, 1995) Institute of Electrical and Electronics Engineers, Standard 387, “Standard Criteria 

for Diesel-Generator Units Applied as Standby Power Supplies for Nuclear Power Generating 

Stations”, 1995. 

10 CFR Part 70, Domestic Licensing of Special Nuclear Material. 

11.9 Heavy Lift Cranes

11.9.1 Conduct of Review 

This chapter of the safety evaluation report contains the staff’s review of the heavy lift cranes for 

the mixed oxide (MOX) fuel fabrication facility (MFFF), as described by the applicant in 

Chapter 11.9 of the license application (LA) (MOX, 2009a). The purpose of this review was to 

determine whether heavy lift cranes are needed to meet the performance requirements and are 

designated as IROFS. The review will also determine whether heavy lift cranes identified as 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 168

items relied on for safety (IROFS) will be available and reliable to perform their required safety 

function(s) when needed (NRC, 2000, Section 11.1). 

For this review, the staff evaluated the information provided by the applicant for heavy lift cranes 

in Chapter 11.0. The staff also reviewed the design and operation of the heavy lift cranes in 

conjunction with the review of applicable portions of Chapters 4 and 5 of the Integrated Safety 

Analysis (ISA) Summary (MOX, 2009b), which discuss the crane operations and potential loadhandling events. 

The staff’s safety evaluation and review of the heavy lift cranes examined the safety function(s) 

they perform; the description of each heavy lifting crane system and its major components; and 

the safety analysis of potential load-handling accidents, including accident prevention and 

mitigation of the resulting consequences. The staff used the guidance in NUREG-1718 (NRC, 

2000) to perform and prepare its review. 

11.9.2 Regulatory Requirements 

The regulations applicable to material handling equipment and controls are as follows: 

• Title 10 of the Code of Federal Regulations (10 CFR) 70.61(e), specifically relating to the 

requirement that each engineered or administrative control or control system that is 

needed to meet the performance requirements be designated as an IROFS and relating 

to the safety program that ensures that each IROFS will be available and reliable to 

perform its intended function when needed 

• 10 CFR 70.64, “Requirements for New Facilities or New Processes at Existing 

Facilities,” specifically relating to the application of baseline design criteria and defensein-depth practices to new facilities or new processes at existing facilities 

11.9.3 Regulatory Acceptance Criteria 

The review focused on the requirements and guidelines for heavy lift cranes identified as IROFS 

and related to the baseline design criteria and defense-in-depth principle. The design and 

operation of heavy lift cranes should fulfill all of the functional requirements determined from the 

ISA, and the heavy lift cranes should be available with adequate reliability to perform all of their 

intended safety functions when needed. 

Section 11.4.8.2 of NUREG-1718 (NRC, 2000) provides the acceptance criteria related to heavy 

lift cranes identified as IROFS. 

11.9.4 System Description 

Heavy lift cranes are defined as those overhead load-handling systems that are designed to lift 

a load greater than the weight of a single fresh fuel assembly and its associated handling tool 

(i.e., greater than 1,800 pounds (lb), in accordance with NUREG-0612, “Control of Heavy Loads 

at Nuclear Power Plants” (NRC, 1980). Heavy loads are divided into critical and non-critical 

categories. Critical loads are defined as those loads whose uncontrolled movement or release 

could result in unacceptable radiological dose consequences to plant workers, the individual 

outside the controlled area, or the environment. Cranes that handle critical loads are 

considered Type I. Other loads are considered noncritical, and the cranes that handle these 

loads are designated as Type II or Type III. Heavy lift cranes in the MFFF that have capacities 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 169

greater than 1,800 lb are discussed in this section. MFFF cranes not defined as heavy lift 

cranes but with loads that, if dropped, could result in breaching a confinement system are also 

evaluated for load-handling events (see Section 11.6 of the SER). 

Permanently installed heavy lift cranes are located within the protected structure of the BMF and 

are protected by the structure from design-basis natural phenomena events, except seismic 

events. These heavy lift cranes within the MFFF are Type II, which are not required to retain 

their load during normal operation, upset conditions, or design-basis natural phenomena events. 

Where heavy lift cranes can move over IROFS equipment, they are qualified to remain 

structurally intact under design-loading conditions, including the design earthquake. During 

process operations, material-handling controls protect against load drops over IROFS 

components. 

Based on the above information, the applicant did not identify any MFFF heavy lift cranes that 

handle critical loads as defined above and stated that no MFFF heavy lift cranes have been 

identified as an IROFS. The MFFF heavy lift cranes and hoists, which are required to maintain 

structural integrity in seismic conditions, are designed and qualified in accordance with 

American Society of Mechanical Engineers (ASME) NUM-1-2000 or ASME NOG-1-1998. 

11.9.5 Accident Sequences and Items Relied on for Safety 

In general, the IROFS are design features, human actions, or other controls credited with 

reducing the likelihood of an event or mitigating the consequences of the event. As previously 

stated, the heavy lift cranes in the MFFF are not identified as IROFS in the ISA Summary and 

do not perform any critical safety functions. 

11.9.6 Evaluation Findings 

In Section 11.9 of the LA, the applicant provided design-basis information for the heavy lift 

cranes in the proposed facility. The applicant stated that “no MFFF heavy lift cranes have been 

identified as an item relied on for safety.” Based on the staff's review of the LA (MOX, 2009a) 

and ISA Summary (MOX, 2009b), the staff agrees with this finding and concludes, pursuant to 

10 CFR 70.61(e), that regarding the heavy lift cranes of the MFFF, the applicant’s proposed 

equipment and facilities are adequate to protect health and minimize danger to life or property. 

REFERENCES 

(MOX, 2009a) Shaw AREVA MOX Services, “Mixed Oxide Fuel Fabrication Facility—License 

Application,” Aiken, SC, October 2009. 

(MOX, 2009b) Shaw AREVA MOX Services, “Mixed Oxide Fuel Fabrication Facility—Integrated 

Safety Analysis Summary,” Aiken, SC, October 2009. 

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” Washington, 

DC, August 2000. 

(NRC, 1980) U.S. Nuclear Regulatory Commission, NUREG-0612, “Control of Heavy Loads at 

Nuclear Power Plants,” Washington, DC, July 1980. 

11.10 Laboratory Description
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 170

The laboratory consists of three major sections: 

(1) mixed oxide fuel fabrication facility (MFFF) laboratory 

(2) test line (LCT) 

(3) 33–millimeter (mm) pneumatic transfer (LLP) system 

11.10.1 Conduct of Review 

This section of the safety evaluation report (SER) contains the staff’s review of the mixed oxide 

(MOX) process (MP) safety analyses described by the applicant in Section 11.10 of the license 

application (LA) (MOX, 2010a), with supporting process safety information from Chapters 5, 8, 

and 11 of the LA, and Section 4.1 of the Integrated Safety Analysis (ISA) Summary (MOX, 

2010b). The objective of this review is to determine whether the chemical process safety items 

relied on for safety (IROFS) and their design bases provide reasonable assurance of protection 

against natural phenomena and the consequences of potential accidents. The staff coordinated 

the review of laboratory design bases and strategies with the review of radiation and chemical 

safety aspects of accident sequences described in the safety assessment of the design bases 

(see Chapter 5 of this SER), the review of fire safety aspects (see Chapter 7 of this SER), and 

the review of other plant systems (see other sections of Chapter 11 of this SER). 

The staff evaluated the laboratory information in the LA and ISA Summary against the following 

regulations: 

• Title 10 of the Code of Federal Regulations (10 CFR) 70.64, “Requirements for New 

Facilities or New Processes at Existing Facilities,” requires that baseline design criteria 

and defense-in-depth practices be incorporated into the design of new facilities or new 

processes at existing facilities. With respect to chemical protection, 10 CFR 70.64(a)(5) 

requires that the MFFF design provide for adequate protection against chemical risks 

produced from licensed material, facility conditions that affect the safety of licensed 

material, and hazardous chemicals produced from licensed material. Related to 

chemical protection, 10 CFR 70.64(a)(3) requires that the facility design provide for 

adequate protection against fires and explosions, such as those that could be initiated by 

or involve chemicals at the facility. 

The review of the LA and ISA Summary focused on the design basis of chemical process 

IROFS, their components, and other related information. For each IROFS, the staff reviewed 

information provided by the applicant for the safety function, system description, and safety 

analysis. The review also included other design-basis considerations such as redundancy, 

independence, reliability, and quality. The staff used Chapter 8.0 of NUREG-1718, “Standard 

Review Plan for the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication 

Facility” (NRC, 2000), as guidance in performing the review. 

As stated in the memorandum of understanding between the U.S. Nuclear Regulatory 

Commission (NRC) and the Occupational Safety and Health Administration, “Worker Protection 

at NRC-Licensed Facilities,” published in the Federal Register, Volume 53, No. 210, dated 

October 31, 1998, pp. 43950–43951, the NRC oversees chemical safety issues related to 

(1) radiation risk produced by radioactive materials, (2) chemical risk produced by radioactive 

materials, and (3) plant conditions that affect the safety and safe handling of radioactive 

materials. These types of chemical safety issues represent an increased radiation risk to the 

workers. However, the NRC does not oversee facility conditions that result in an occupational 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 171

risk but do not affect the safe use of licensed material. The provisions of the memorandum of 

understanding applicable to the MFFF are codified in 10 CFR 70.64(a)(5). 

As described in the following sections, the NRC staff reviewed the following areas of the LA and 

ISA Summary applicable to process safety: 

• MFFF laboratory description 

• hazardous chemicals and potential interactions affecting licensed materials 

• MFFF laboratory accident sequences 

• MFFF laboratory chemical accident consequences 

• MFFF laboratory safety controls 

11.10.1.1 System Description of the MFFF Laboratory 

The MFFF laboratory is primarily used to perform chemical and physical analyses of samples 

coming from the MP production units, aqueous polishing (AP) production units, and the LCT. 

The MFFF laboratory is located in the MP area. The main portion of the laboratory is located on 

the third floor of the MP building; the other portion is located on the intermediate level of the 

same building. 

Analyses in the lab are performed for the following purposes: 

• manufacturing control (process control) 

• material control and accountability 

• product quality control (specification analyses) 

• criticality safety 

• process safety 

• subsequent waste disposition at the Savannah River Site 

The following operations are also performed in the laboratory: 

• laboratory liquid and solid waste management 

• preparation of reagents used in the MFFF laboratory 

• analysis of depleted uranyl nitrate samples 

• temporary storage of scrap materials from the MFFF laboratory 

• dissolution tests of alternate feedstock plutonium dioxide (PuO2) powders 

• dissolution operations occasionally performed for dissolution (KDB) and dissolution of 

chlorination feed bag prefilter residues (more than 40 grams (g) of plutonium) 

• calibration 

• document storage 

Samples are transferred from the MP and AP areas to the MFFF laboratory in vials. Samples 

are transferred between the different analytical units of the laboratory in aliquot containers. An 

aliquot is a measured portion of a sample taken for analysis. Vials and aliquot containers 

specific to liquid and solid samples are not reusable. Transfers are either manual or pneumatic; 

however, most transfers are pneumatic via the LLP or the 76-mm pneumatic transfer system. 

11.10.1.2 Test Line 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 172

The LCT is used to qualify the pellet fabrication process of the MOX process on a small scale, 

from powder preparation to grinding and pellet sorting. 

The LCT is a small reproduction of the main stages of pellet fabrication. It reproduces the 

process equipment of the MP from powder preparation to grinding and pellet sorting. The 

primary processes executed in the LCT are micronizing powder, sieving powder, dosing 

powder, mixing powder, pressing powder into pellets, grinding sintered pellets, sampling and 

manually sorting pellets, and carrying out quality control measurements. The LCT is also used 

to determine physical powder characteristics (i.e., density, grain-size distribution, and 

flowability). 

Powder packaged in vials within bags is transferred into the milling glovebox through a glove 

port. Four types of powder can be milled in this glovebox: primary blend (master blend), final 

blend, scrap powder, and PuO2 powder. Additives (pore-former and lubricant) are also 

introduced into this glovebox. 

Vials are weighed and identified before being emptied into a bowl. The bowl is docked and 

locked onto the ball mill drum. Milling is accomplished by rotating the drum about itself while 

inclining the whole system. The bowl is locked onto the drum during rotation and inclination, 

which facilitates the flow of powder into the drum. The milled powder is collected in a pot and 

transferred through the tunnel from the milling glovebox to the forced sieving glovebox where 

powder is forced through a perforated grid with a swing arm. 

The powder is transferred in a vial through a tunnel to the dosing and mixing glovebox where 

the desired amount of each powder, including additives, is weighed and poured into a vial. The 

vial is attached to the mixer and mechanically shaken. 

Also in the dosing and mixing glovebox, powder grain size distribution is determined by 

mechanical sieving, bulk and tap density are measured, and powder flowability is tested. 

Mixed powder from the dosing and mixing glovebox is transferred to the pelletizing press 

through a tunnel and poured into the press hopper. With the aid of an impactor, the hopper fills 

the press shoe with powder. The powder is pressed into pellets that are manually removed and 

placed into small molybdenum boats. 

The density of the pellets is measured before they are transferred out of the LCT unit to a 

furnace (PFE or PFF unit) for sintering. After sintering, the pellets are returned to the LCT to the 

grinding glovebox. Pellets are manually placed into a vibrating bowl that supplies the centerless 

grinder and then ground. This glovebox is also used for pellet quality control measurements 

and visual checking. 

A pneumatic transfer departure station in this glovebox transports pellet samples to the 

laboratory for analysis. 

The dust collection system uses a vacuum pipe in the protective cover of the grinding wheels 

and the glovebox atmosphere to control dust in the grinding glovebox. 

A shielded cask on a hand-pushed trolley is used to transfer samples and products (pellets and 

powder) between the production stations and the LCT. 

The LCT normal process inventory is 263 g of plutonium. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 173

11.10.1.3 Pneumatic Transfer Line System 

The LLP system transports liquid, pellet, or powder samples between AP liquid automatic and 

manual sampling points, analytical units, and the LCT. 

The LLP system comprises pneumatic transfer tubes with a diameter of 33 mm that connect 

gloveboxes within the same or different units. The primary process executed by the LLP system 

is the transfer of sample vials. The LLP system also provides transport of empty vials to the 

sampling (KPG) unit and laboratory units. 

The LLP is divided into nine separate networks as described in the following paragraphs. Each 

vial that is used in the LLP system has the external shape of a shuttle. Therefore, no shuttle is 

required for vial transfer. For transfer, a vial is inserted in one end of a tube, and the tube is 

closed. Transfer of the vial is enabled by an exhauster, which creates negative pressure within 

the tube between the vial and its destination. Switching devices, as required, direct the vial 

through the correct tube to the destination arrival station. Upon arrival at the destination, after 

the exhauster has been turned off, the vial is removed from the tube. 

Network 1—AP Automatic Liquid Sampling Points to Laboratory 

This network transports liquid samples from the automatic liquid sampling system of the AP 

process KPG gloveboxes to two laboratory analysis lines or to temporary storage. The two 

laboratory analysis lines are (1) high-plutonium content solution analysis and preparation (KLA) 

and low-plutonium content solution analysis and preparation (KLB). The temporary storage is 

AP liquid samples storage (KLG). 

A separate line brings the empty vials from the vial delivery system to the KPG gloveboxes and 

to the room of the inactive local sampling (ILS) and active local sampling (ALS) departure 

stations. 

The KPG departure stations receive sample vials filled by the automatic sample needles. A 

robot takes an empty vial in the arrival station and presents it to the filling head that is 

connected to the sampling needle. Then, the robot brings the vials into the cleaning, rinsing, 

and sending stations (the cleaning station is part of the KPG unit). 

Network 2—AP Manual Liquid Sampling Points to the Laboratory 

This network transports liquid samples from the ALS departure station to laboratory analysis line 

KLA. Network 2 also transports samples from the ILS departure station to the arrival point of 

the ILS unit in the laboratory area. An operator brings empty vials from the vial delivery system 

(Network 1) to the manual ILS sampling points and ALS sampling points. The ILS departure 

and arrival stations are located outside the gloveboxes. 

Networks 3, 4 and 5—MP Laboratory Links 

These networks transport samples between the MP laboratory lines (Networks 3 and 4). 

Network 3 also transports samples from the LCT to the receipt, weighing, and dispatching (LRD) 

unit. Network 3 samples contain MOX pellets, and Network 4 samples contain MOX powder. 

Network 5 transports samples between the MP laboratory stations for AP powder analysis. 

Network 6—Liquid Analysis Laboratory 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 174

This network transports liquid samples between the liquid samples analyses laboratory stations 

and provides links between the MP and AP laboratory stations. 

A manual station supplies two departure stations with empty vacuum-packed vials directly from 

the supplying device. The two departure stations are lines KLA and PuO2 dissolution (KLE). 

In the glovebox, a liquid sample is taken and placed in a vial. The empty, vacuum-packed vial

that will be transferred in the pneumatic transfer system stands in the rotary sender/receiver. 

The filled vial containing the liquid sample is stuck by a double needle with the vacuum-packed 

vial. The pressure differential between the filled vial and the vacuum-packed vial transfers the 

sampled liquid to the vacuum-packed vial. The vacuum-packed vial is then ready for transfer. 

 

Network 7—Spectrometer Supplying 

 

This network supplies the two mass spectrometers in the mass spectrometer (LSR) unit with 

liquid preparations from the AP and MP preparation lines. 

 

Network 8—AFS/PDCF Analysis 

 

This network supplies the analytical units with alternate feedstock (AFS)/pit disassembly and 

conversion facility (PDCF) powders. 

 

 

Network 9—AFS/PDCF Liquid Analysis and Liquid Waste Transfer 

 

This network transfers AFS/PDCF powder solutions from the KLI1 line to the KLI2 line. The 

network also transfers the liquid preparation from the dissolution units (KLI) to the three 

spectrometers in the metallic impurities determination (KLJ) unit. The network transfers liquid 

waste from the KLI units to the powder density measurements and laboratory electrolyzers 

(KLO) unit. A manual station supplies the KLI1 and KLI2 departure stations with empty 

vacuum-packed vials directly from the supplying device. 

In the dissolution enclosures (in the KLI unit), the liquid preparation is placed in a vial. The 

empty, vacuum-packed vial that will be transferred in the pneumatic transfer system stands in 

the rotary sender/receiver departure station. The filled vial is stuck by a double needle with the 

empty vacuum-packed vial. The pressure differential between the filled vial and the 

vacuum-packed vial transfers the sampled liquid to the vacuum-packed vial. The vacuum 

packed vial is then ready for transfer. 

11.10.1.4 Laboratory Liquid Waste Receipt Unit 

The laboratory liquid waste receipt (LGF) unit receives and manages the liquid wastes 

generated by the MFFF laboratory for subsequent recycling in the KDB unit, and for transfer to 

the aqueous liquid waste reception (KWD) unit or solvent liquid waste reception (KWS) unit. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 175

Liquids recycled into the AP process via the KDB unit are not generally classified as liquid 

wastes. However, to facilitate the description of the processes in the LGF unit, they are referred 

to as liquid wastes throughout this section. 

The LGF unit is an ancillary unit located in the AP process area of the MFFF. Electrical power 

and control equipment of the normal control system are installed in separate rooms. 

Process Chemistry
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 176

The addition of reagents (i.e., aluminum nitrate) to the plutonium-receiving tank for fluorides 

complexation and/or 13.6 N nitric acid for acidity adjustment is infrequent and involves only 

small volumes. 

 

 

 

LGF TK 4000 230 

LGF TK 5000 300 

LGF TK 6000 1,500 

LGF TK 7000 1,500 

Table 11.10-2 Chemical Quantities in LGF Unit during PDCF Operations

Item Volume (L) HNO3 (moles) AgNO3 (moles) TBP (L) Diluent (L)

LGF TK 1000 190 522.5 2.9×10-3 

LGF TK 2000 190 522.5 2.9×10-3 

LGF TK 3000 100 22 78 

LGF TK 4000 230 115 

LGF TK 5000 300 150 

LGF TK 6000 1,500 750 

LGF TK 7000 1,500 750 

11.10.2 Staff Review of Laboratory Safety

11.10.2.1 Laboratory Explosion (EXP 14) 

The applicant identified two potential explosion events in the MFFF laboratory. One of the 

explosion events is related to hydrogen, and the other is produced by an unintended chemical 

reaction. 

11.10.2.1.1 LAC Laboratory Explosion (EXP 14a) 

The hydrogen explosion event is related to a test that determines the oxygen-to-metal ratio of 

MOX and LCT pellets. The test is carried on in a tubular electrical furnace in a glovebox of the 

fluorine and chlorine determination and oxygen-to-metal ratio determination (LAC) unit. The 

furnace is heated and fed with argon to perform the test. Once the furnace is at the operating 

temperature, pellet samples undergo oxidation using air as the scavenging gas. The furnace is 

purged with argon, and then fed with an argon-hydrogen (Ar-H) mixture for further reduction to 

obtain normal pellet stoichiometry. The operating temperature in the furnace is high enough to 

support spontaneous ignition of hydrogen in the presence of air. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 177

11.10.2.1.2 General Laboratory Explosion (EXP 14b) 

11.10.3 Evaluation Findings

The NRC staff finds the descriptions of the MFFF laboratory to be adequate to facilitate an 

understanding of the operations and possible hazards. The safety strategy for the explosion 

scenarios satisfies the single-failure criterion. The single-failure criterion, in combination with 

management measures for EACs (as described in Chapter 15 of the LA) the, quality assurance 

requirements (as described in the MOX Project Quality Assurance Plan (MPQAP)), and the use 

of codes and standards for engineered IROFS give the NRC staff reasonable assurance that 

these high-consequence scenarios are highly unlikely. Therefore, the proposed safety strategy 

and IROFS comply with the performance requirements of 10 CFR 70.61, the baseline design 

criteria in 10 CFR 70.64(a)(3) and 10 CFR 70.64(a)(5), and the defense-in-depth practices in 

10 CFR 70.64(b). 

REFERENCES

(MOX, 2010a) Shaw AREVA MOX Services, “Mixed Oxide Fuel Fabrication Facility License 

Application,” Aiken, SC, March 2010. 

(MOX, 2010b) Shaw AREVA MOX Services, “Mixed Oxide Fuel Fabrication Facility Integrated 

Safety Analysis Summary,” Aiken, SC, March 2010. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 178

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” Washington, 

DC, August 2000. 

10 CFR Part 70, Domestic Licensing of Special Nuclear Material. 

Memorandum of Understanding Between the Nuclear Regulatory Commission and the 

Occupational Safety and Health Administration: Worker Protection at NRC-licensed Facilities, 

October 21, 1988, 53 FR 43950. 

11.11 Civil Structural Systems

This section of the safety evaluation report (SER) contains the U.S. Nuclear Regulatory 

Commission (NRC) staff’s review of the civil structural systems for the Mixed Oxide Fuel 

Fabrication Facility (MFFF), as described in Section 1.1.2.1 of the license application (LA) 

(MOX, 2010a). This review will determine whether the design bases and design of the items 

relied on for safety (IROFS) provide reasonable assurance of protection against natural 

phenomena and the consequences of potential accidents. The staff evaluated the information 

the applicant provided for the civil structural systems by reviewing Chapter 1 of the LA, 

supplementary information the applicant provided, and relevant design documents available at 

the applicant’s offices but not submitted by the applicant. The staff closely coordinated its 

review of the design bases and design of the civil structural systems with the review of the civil 

structural aspects of accident sequences described in the safety assessment of the design 

bases (see Chapter 5 of this SER). 

11.11.1 Regulatory Requirements

The staff reviewed how the information in the LA addresses the following regulations: 

• Title 10 of the Code of Federal Regulations (10 CFR) 70.61(e), “Performance 

requirements.“ requires that each engineered or administrative control or control system 

that is needed to comply with 10 CFR 70.61 (b), (c) or (d) be designated as an IROFS 

and requires that the safety program ensuring that each IROFS will be available and 

reliable to perform its intended function when needed. 

• 10 CFR 70.64, “Requirements for New Facilities or New Processes at Existing 

Facilities,” requires that new facility designs incorporate baseline design criteria and 

defense-in-depth practices. With respect to natural phenomena hazards (NPHs), 

10 CFR 70.64(a)(2) requires that new facility designs adequately protect against such 

hazards, considering the most severe documented historical events for the site. 

11.11.2 Regulatory Acceptance Criteria

This LA review focused on the design basis and design of the civil structural systems and other 

related information. For each civil structural system, the staff reviewed information the applicant 

provided for the safety function, system description, and safety analysis. The staff used 

Section 11.4 in NUREG-1718, “Standard Review Plan for the Review of an Application for a 

Mixed Oxide (MOX) Fuel Fabrication Facility” (NRC, 2000), as guidance in performing the 

review. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 179

The staff reviewed the following four general areas of LA Section 1.1.2, “General Facility 

Description:” 

(1) classification of civil structural systems 

(2) codes and standards 

(3) structural design criteria 

(4) structural analysis and design 

11.11.3 System Description 

The civil structural systems for the MFFF include the buildings, support structures, and facilities 

that house, support, confine, or contain various plant systems, components, and equipment 

associated with licensed nuclear materials, or hazardous chemicals associated with licensed 

nuclear materials, as well as support buildings. 

11.11.3.1 Function

As described in LA Section 1.1.2.1.1, the safety functions for the civil structural systems would 

do the following: 

• Support the IROFS during normal, severe, and extreme loading conditions. 

• Provide confinement functions as part of secondary and tertiary confinement systems. 

• Protect IROFS from the effects of normal, severe, and extreme environmental loads. 

• Protect IROFS from the effects of design-basis internal and external fires by providing 

fire barriers. 

11.11.3.2 Major Components

LA Section 1.1.2.1.2 identified the seismic Categories (SCs) I and II or conventional seismic 

(CS) civil structural systems. The major components for each of the seismic categories are as 

follows: 

• SC-I structures include the MFFF (which includes the mixed oxide (MOX) processing 

area, the aqueous polishing area (BAP), and the shipping and receiving area (BSR)), the 

emergency fuel storage vault (UEF), and the emergency diesel generator building 

(BEG). 

• SC-II structures include the safe haven buildings. 

The remaining structures are CS structures. LA Section 1.1.2.1.3 contains a detailed 

description of each major component.. 

11.11.3.3 System Interfaces

Civil structural systems interface with the site and all facility systems because they protect and 

support structures, systems, and components (SSCs). 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 180

11.11.3.4 Classification of Civil Structural Systems 

The classification outlined in LA Section 1.1.2.1.2 consists of three levels: (1) SC-I, (2) SC-II, 

and (3) CS structures. The design loadings considered for the civil structures in each category 

are as follows: 

(1) SC-I—normal, severe, and extreme environmental loads, including the design-basis 

earthquake and tornado 

(2) SC-II—normal, severe, and design-basis earthquake 

(3) CS—normal, severe, and CS loads, as specified by the Uniform Building Code 

11.11.3.5 Design Basis of the SC-I and SC-II Structures

11.11.3.5.1 Codes and Standards 

This section contains a review of LA Section 1.1.2.1.6.3, “Codes and Standards for SC-I 

Structures,” and Section 1.1.2.1.7.7, “Codes and Standards for SC-II Structures,” of the LA. 

The designs of the SC-I civil structural systems and the associated steel and concrete 

components conform to standard engineering practices. LA Section 1.1.2.1.6.3 contains a 

comprehensive list of the applicable codes and standards. The applicant would supplement 

American Concrete Institute (ACI) 349-97, “Code Requirements for Nuclear Safety-Related 

Concrete Structures” (ACI, 1997), and American Institute of Steel Construction 

(AISC) N690-1994, “Specification for the Design, Fabrication, and Erection of Steel SafetyRelated Structures for Nuclear Facilities” (ANSI/AISC, 1994), with specific provisions. 

Section 1.1.2.1.6.2.2 of the LA contains more specific concrete, steel, and foundation structural 

design requirements for SC-I structures. 

In LA Section 1.1.2.1.6.3, the applicant referenced the same codes and standards as those for 

the SC-I structures for the design of the SC-II civil structural systems, except for 

ACI-SP-175-98, “Concrete and Blast Effects” (ACI, 1998); ACI 349-97 (ACI, 1997); 

ACI 349.1R-91, “Reinforced Concrete Design for Thermal Effects on Nuclear Power Plant 

Structures” (ACI, 1996); and AISC N690-1994 (ANSI/AISC, 1994). 

However, the applicant included ACI 318-99, “Building Code Requirements for Structural 

Concrete” (ACI, 1999), for SC-II civil structures. Furthermore, it used older versions of certain 

documents for the SC-II civil structural systems. It used American Society of Civil Engineers 

(ASCE) 8-90, “Specification for the Design of Cold-Formed Stainless Steel Structural Members, 

(ASCE, 1991)” instead of ASCE 8-91 (ASCE 1991), and the 1986 version of the American Iron 

and Steel Institute (AISI), “Specifications for the Design of Cold-Formed Steel Structural 

Members,” instead of that from 1996 (AISI, 1986). 

The staff reviewed the codes and standards for the designs of SC-I and SC-II civil structural 

systems and concluded that the cited codes and standards are consensus standards that 

provide reasonable guidance consistent with the categorization assigned to the buildings and 

are consistent with Section 11.4.6.1 of NUREG-1718 . 

11.11.3.5.2 Structural Design Criteria 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 181

This section reviews the structural design criteria and load combinations for the civil structural 

systems discussed in the LA. 

Section 1.1.2.1.6.4, “Design Values for SC-I Structures,” and Section 1.1.2.1.7.8, “Design 

Values for SC-II Structures,” of the LA discussed the structural design loads for SC-I and SC-II 

structures. The applicant divided the design criteria and loads anticipated for the civil structures 

into three categories: (1) normal loads, (2) severe environmental loads, and (3) extreme 

environmental loads. The normal loads include dead, live, hydrostatic fluid pressure, lateral soil 

pressure, thermal, and component reaction loads. The severe environmental loads include 

wind and flood loads. The extreme environmental loads include seismic, tornado, and explosive 

loads and post-earthquake settlements. The only extreme environmental load considered in the 

design of the SC-II structures was the seismic load. The staff finds that the applicant’s 

evaluation satisfies the requirements of 10 CFR 70.64(a)(2), which states that structures must 

be designed to adequately protect against natural phenomena, considering the most severe 

documented historical events for the site. 

11.11.3.5.2.1 Normal Loads

Dead Loads

Dead loads are gravity loads induced by the mass of the structure, permanent equipment, and 

any permanent hydrostatic loads with constant fluid levels. This definition for dead loads is 

consistent with ASCE 7-98, “Minimum Design Loads for Buildings and Other Structures” (ASCE, 

1998), and is acceptable to the staff. 

Actual equipment loads will be applied to the design of structural systems and components with 

a minimum uniform dead load of 2.4 kilopascal (kPa) (50 pounds per square foot (psf)) applied 

to each wall panel, the underside of elevated floor slabs and roof slabs, and platforms. The LA 

also indicates that the effect of differential settlement is considered in determining dead loads. 

Live Loads

Live loads are loads produced by building use and occupancy. The live loads considered for 

the civil structures of the MFFF include floor, rain, snow and ice, transportation vehicle, and 

heavy floor, as well as crane, monorail, hoist, and elevator loads. 

Floor Live Loads 

The applicant established the minimum uniformly distributed live loads for the civil structures, in 

accordance with ASCE 7-98 (ASCE, 1998). Specifically, the floor live loads identified include 

the following: 

Platform and work area 6.0 kPa (125 psf) 

Light storage 6.0 kPa (125 psf) 

Heavy storage 12.0 kPa (250 psf) 

Heavy operation 12.0 kPa (250 psf) 

Office 4.8 kPa (100 psf) 

Computer room 7.2 kPa (150 psf) 

Dining/meeting rooms 4.8 kPa (100 psf) 

Laboratory 9.6 kPa (200 psf) 

Toilet areas 4.8 kPa (100 psf) 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 182

Mechanical (utility) rooms 7.2 kPa (150 psf) 

Electrical rooms 7.2 kPa (150 psf) 

Stairs, fire escapes, and corridors 4.8 kPa (100 psf) 

Roof 2.4 kPa (50 psf) 

Transportation vehicle loads 14.4 kPa (300 psf) or forklift truck of 

26.7 kilonewton (6 kips) capacity 

The staff reviewed the design-basis floor live loads discussed in Section 1.1.2.1.6.4.1.1 of the 

LA and determined that the floor live loads and the roof loads are acceptable for the design of 

the facility civil structures. 

Rain Loads 

The applicant determined the design-basis rain loads for the civil structures in accordance with 

the requirements of ASCE 7-98 (ASCE, 1998). The design rain load for the roof system of the 

SC-I and SC-II structures is 2.4 kPa (50 psf), which is equivalent to more than 24.4 centimeters 

(cm) (9.6 inches (in.)) of standing water on the roof because of deflection of the roof or blockage 

of the primary roof drains. The LA further states that “parapets or other structures, which could 

potentially contribute to significant ponding, are not used on the roofs of SC-I structures” and 

that the rain load does not combine with the roof live load in the load combinations. The staff 

reviewed the design-basis rain load and determined that it is appropriate and acceptable. 

Snow and Ice Loads 

The applicant determined the design-basis value of snow and ice loads to be 0.48 kPa (10 psf). 

The applicant estimated this value based on the 100-year maximum ground snow and ice loads. 

The importance factor for the value of snow and ice loads is 1.2, found in ASCE 4-98, “Seismic 

Analysis of Safety-Related Nuclear Structures and Commentary” (ASCE, 1999). The staff 

reviewed the applicant’s design-basis value of ground snow and ice loads and found that it was 

based on acceptable methods from the requirements of ASCE. 

Transportation Vehicle Loads and Heavy Floor Loads 

The design-basis load for transportation vehicular truck traffic in designated building areas was 

determined in accordance with the standard loadings defined by the American Association of 

State Highway and Transportation Officials in its document, “Standard Specifications for 

Highway Bridges,” issued in 1996 (AASHTO, 1996). The wheel loading design used the 

minimum truck loading of HS 20-44. The staff reviewed the design-basis transportation vehicle 

loads and heavy floor loads and determined that they are appropriate and acceptable. 

Crane, Monorail, Hoist, and Elevator Loads 

These design loads apply to structural members and components to support permanently 

installed cranes, monorails, hoists, and elevators. Section 1.1.2.1.6.4.1.1 of the LA states that 

the design-basis crane, monorail, hoist, and elevator loads would envelop the full-rated capacity 

of the cranes, monorails, hoists, and elevators, including impact loads and test load 

requirements. The effects of a crane load drop were evaluated in accordance with the guidance 

provided in NUREG-0612, “Control of Heavy Loads at Nuclear Power Plants” (NRC, 1980). The 

staff reviewed the design-basis crane, monorail, hoist, and elevator loads and found that these 

design-basis loads are appropriate and acceptable. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 183

Hydrostatic Fluid Pressure Loads

The LA indicates that hydrostatic fluid pressure loads are limited to containment curbs to contain 

postulated spills from postulated flooding of the pipe tunnel in the reagents processing building 

(BRP). The applicant classified the BRP as a CS structure. The staff reviewed the information 

presented and found that the consideration of hydrostatic fluid pressure loads for the design of 

civil structural systems is acceptable. 

Lateral Soil Pressure Loads

Section 1.1.2.1.6.4.1.1 of the LA indicates that the lateral soil pressure loads on structures, 

elements of structures, or both, because of retaining soil, are determined based on the density 

of the soil and any surcharge load, plus the hydrostatic pressure caused by ground water or soil 

saturation. 

The minimum lateral soil pressure loads on structures or elements of structures resulting from 

retaining soil are in accordance with those defined in ASCE 7-98 (ASCE, 1998). Earthquakeinduced soil pressure on structures or embedded wall design is developed in accordance with 

ASCE 4-98 (ASCE, 1999). No hydrostatic pressure is expected, because the ground water 

table at the site is below the MFFF. 

The staff reviewed the applicant’s approach for determining lateral soil pressure loads and 

found that it is acceptable, because it is based on ASCE national standards. 

Thermal Loads

Thermal loads consist of thermally induced forces and moments on the structural components 

of buildings. These loads would result from operating and environmental conditions. The 

thermally induced loads would be design dependent. Consequently, determination and 

consideration of these thermally induced loads would be an integral part of a design. For the 

design of civil structural systems, the applicant considered the effects of thermal expansion 

loads caused by axial restraint of the structural components, as well as loads resulting from 

thermal gradients. The applicant also indicated that it determined these thermally induced loads 

based on the most critical transient or steady-state condition. The staff reviewed the information 

and found that the applicant’s consideration of thermal expansion loads and thermal gradient 

loads for the design of civil structural systems is consistent with national codes and standards 

and is acceptable. 

Equipment Reaction Loads

The equipment reaction loads included those from pipes; heating, ventilation, and air 

conditioning (HVAC) ducts; conduits; and cable trays. These loads would be design dependent 

and are to be assessed during design. The applicant stated that it would determine the 

equipment reaction loads based on the most critical transient or a steady-state condition. The 

applicant further indicated that it would ensure that the final designs envelop the actual 

equipment reaction loads. The design allowance for the equipment reaction loads is a minimum 

uniform dead load of 2.4 kPa (50 psf) for each wall panel, the underside of elevated floor slabs 

and roof slabs, and platforms. The staff reviewed the information on equipment reaction loads 

in the design and found that the bounding or enveloping approach is acceptable. 

11.11.3.5.2.2 Severe Environmental Loads
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 184

Wind Loads

ASCE 7-98 (ASCE, 1998, Figure 6-1b) identifies a design-basis wind of 161 kilometers per hour 

(km/h) (100 miles per hour (mph)) for the region. Information provided in Table 1.1.2-2 of the 

LA for the Savannah River Site (SRS) identifies a design-basis wind of 209 km/h (130 mph), 

which is higher than the value provided in ASCE 7-98. The LA also indicates that the wind 

loads calculated based on the design-basis wind are determined using the procedures provided 

in ASCE 7-98. The approach for determining the wind loads is acceptable to the staff because 

it is the same or similar to consensus standards the staff has previously approved. 

The applicant also considered windborne missiles in the design of the civil structural systems. 

Table 1.1.2-2 of the LA contains the windborne missile criteria. Considering the effects of 

windborne missiles in the design is consistent with ASCE 7-98, which requires the inclusion of 

windborne debris in areas where the basic windspeed is equal to or greater than 193 km/h 

(120 mph). The inclusion of windborne missiles in the design is acceptable to the staff because 

it meets the guidance provided in ASCE 7-98. 

Flood Loads

The maximum probable flood level for the site is at elevation 68.4 meters (m) (224.5 feet (ft)) 

above mean sea level, and the design-basis flood for the MFFF site for the annual recurrence 

frequency of 1×10!5

 is at a water level of 63.4 m (207.9 ft) above mean sea level. The 

corresponding site grade level is approximately 83 m (272 ft) above mean sea level. Because 

the site grade level is much higher than the maximum probable flood level at the site, the facility 

is a flood-dry site and will be free from the adverse effects of the maximum probable flood. 

Consequently, the design of civil structural systems does not need to consider the loads 

resulting from floodwater. The applicant based its analysis of the maximum probable flood level 

on the surface hydrology of the region and the potential dam failure resulting from seismic 

events given in Section 1.3.4.2, “Floods,” of the LA. 

The staff reviewed the flood load discussion and concluded that the facility design is consistent 

with the design criteria of Regulatory Guide 3.40, “Design Basis Floods for Fuel Reprocessing 

Plants and for Plutonium Processing and Fuel Fabrication Plants,” issued December 1977 

(NRC, 1977). The staff also found that the approach used for conducting the flood analysis is 

consistent with that outlined in Section 5.1.3 of American National Standards Institute/American 

Nuclear Society (ANSI/ANS) 2.8-1992, “Determining Design Basis Flooding at Power Reactor 

Sites” (ANSI/ANS, 1992), which determined design-basis flooding at power reactor sites. The 

use of standards for design basis flooding at power reactors is acceptable to the staff for the 

MFFF. 

11.11.3.5.2.3 Extreme Environmental Loads

Seismic Loads

Table 1.1.2-2 of the LA lists the design-basis earthquake ground motions based on probabilistic 

seismological studies specific to the SRS. The applicant developed its design-basis horizontal 

and vertical response spectra for the facility based on Regulatory Guide 1.60, “Design 

Response Spectra for Seismic Design of Nuclear Power Plants,” issued December 1973 (NRC, 

1973a)—horizontal and vertical spectrum shapes anchored at a peak ground acceleration of 

0.20g. Section 1.3.1.5.5 of this SER contains the applicant’s detailed design spectra. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 185

The applicant determined the design seismic loads for the facility’s SC-I structures by first 

conducting soil-structure interaction analyses using the design-basis earthquake accelerations 

in the three orthogonal directions (two horizontal and one vertical). The analyses of the soilstructure interaction used the Framatome ANP version of the SASSI computer code described 

in the LA. The applicant then calculated the design seismic loads for the various structural 

elements in the three directions through static analyses of three-dimensional finite-element 

structural modeling, using the maximum floor accelerations developed from the threedimensional soil-structure analysis. Subsequently, the applicant determined the resultant 

design seismic loads (forces and moments) on each structural element by combining the design 

seismic loads for the structural element from the static analysis in three directions using the 

100-40-40-percent rule, as described in Section 3.2.7.1.2 of ASCE 4-98 (ASCE, 1999). 

Section 11.1.1.3.3 of this SER contains further details of the soil-structure interaction analyses. 

For other structures, the applicable seismic response was applied to the base of the finite 

element models. The applicant used guidance in Regulatory Guide 1.92, “Combining Modal 

Responses and Spatial Components in Seismic Response Analysis,” issued February 1976 

(NRC, 1976), and ASCE 7-98 (ASCE, 1998) to combine modal responses and collinear 

responses from the individual earthquake components. 

The staff reviewed the approach the applicant used to determine the seismic loads and found 

the approach to be acceptable. Based on the in office review (NRC, 2007a and NRC, 2007b) of 

the method for determining the seismic loads for the MOX fuel fabrication building (BMF), the 

staff found the applicant implemented the ASCE 100-40-40-percent rule appropriately to 

calculate the resultant design seismic loads. 

Tornado Loads for SC-I Structures

Table 1.1.2-2 of the LA provides the design-basis tornado windspeed, atmospheric pressure 

change, and rate of pressure drop. In determining design tornado loads, the applicant used the 

procedure provided in ASCE 7-98 (ASCE, 1998). 

The staff reviewed the applicant’s approach and found it to be acceptable, based on the 

guidance provided in ASCE 7-98. The three types of tornado loads on the facility structures are 

described below. 

Tornado Wind Pressure Loads

Table 1.1.2-2 of the LA defines the tornado windspeed. The applicant used Section 6 of 

ASCE 7-98 (ASCE, 1998) to convert the tornado wind velocity into effective structural pressure 

loads. ASCE 7-98 is an industry consensus standard that the staff has accepted. Therefore, its 

usage for converting the tornado wind velocity is acceptable to the staff. 

Tornado-Created Differential Pressure Loads

Table 1.1.2-2 of the LA contains the definition of the tornado-created differential pressure loads. 

The applicant determined these pressure loads based on guidance provided in Section 3.3.2 of 

NUREG-0800, “Standard Review Plan for the Review of Safety Analysis Reports for Nuclear 

Power Plants” (NRC, 1993), and, therefore, they are acceptable to the staff. 

Tornado-Generated Missile Loads
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 186

Table 1.1.2-2 of the LA presents the design basis for tornado-generated missiles. Consistent 

with NUREG-0800 (NRC, 1993), three objects are postulated in determining design-basis 

tornado-generated missiles: (1) a massive high-kinetic energy missile, which deforms on 

impact, (2) a rigid missile to test penetration resistance, and (3) a small rigid missile of a size 

sufficient to pass through any openings in protective barriers. 

The applicant selected the design-basis tornado-generated missiles based on 

DOE-STD-1020-94, “Natural Phenomena Hazards Design and Evaluation Criteria for 

Department of Energy Facilities” (DOE, 1996a). The applicant used the ASCE Manual and 

Report No. 58, “Seismic Analysis of Safety-Related Nuclear Structures and Commentary” 

(ASCE, 1980), to determine the tornado impact loads on buildings, structures, and facilities. 

The staff reviewed the information provided for the design criteria on tornado-generated missiles 

and found it acceptable. 

Explosive Loads for SC-I Structures

Section 1.1.2.1.6.4.1.3 of the LA indicates that the applicant used the results of SRS facility 

explosions, SRS transportation explosions, MFFF transportation hypothetical explosions, and 

hypothetical explosions of the BRP to determine the impact of the bounding explosion on the 

SC-I structures. The Integrated Safety Analysis (ISA) Summary (MOX, 2010b) identified two 

bounding explosion events: hydrogen and transportation explosions. The staff also reviewed 

the documents related to external explosion analysis and design during an onsite review and 

found that the applicant used the approach suggested in “Explosion Hazards and Evaluation,” 

by Baker, et al. (Baker, 1983) to estimate the effective explosive yield (explosive load). The 

applicant used Technical Manual, TM 5-1300, “Structures To Resist the Effects of Accidental 

Explosions” (DOD, 1969), to assess structural system responses as it committed to do in the 

LA. 

The staff reviewed the information related to explosive loads and found the applicant’s 

determination of these loads and the approach it used to assess structural system responses 

appropriate and acceptable. 

Settlements

Settlements at the site come from two potential sources—(1) compaction of soft soil materials, 

including soft zones, and (2) localized liquefaction. The applicant treated the potential effects of 

the soil compaction as a part of dead loads and considered the settlement effects associated 

with liquefaction in the design as an extreme environmental load. 

The primary settlements estimated by numerical modeling ranged from 5.1–7.1 cm (2.0–2.8 in.) 

from DCS01-WRS-DS-CAL-G-00017-D, “Estimates of Static Settlement of MFFF Structure” 

(DCS, 2005a), and the MFFF LA. Including the secondary consolidation, the total estimated 

settlements of the BMF are approximately 6.4–8.4 cm (2.5–3.3 in.) with the differential 

settlement varying from 0.5–1.8 cm (0.2–0.7 in.) (DCS, 2005a). 

The staff reviewed the information presented regarding the applicant’s settlement analysis and 

determined that the approach for estimating structural settlements is acceptable because it is 

based on current analysis techniques. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 187

The applicant estimated the post-earthquake dynamic settlement of the potentially liquefiable 

soil based on the PC-3+ design-basis ground motion and the 1886 Charleston motion in 

DCS01-WRS-DS-NTE-G-00005-E, “MOX Fuel Fabrication Facility Site Geotechnical Report” 

(DCS, 2003). The settlement ranges from 0.66–3.73 cm (0.26–1.47 in.) for the design-basis 

ground motion and 1.55–5.64 cm (0.61–2.22 in.) for the 1886 Charleston motion. The applicant 

indicated that these dynamic settlements might occur in loose or soft strata below the ground 

water level, at a depth of 18.29 m (60 ft) or more. There are two significantly stiffer soil layers 

more than 12.19 m (40 ft) thick between the potentially liquefiable zones and the foundations. 

These two soil layers would tend to redistribute the estimated dynamic settlement such that no 

significant differential settlement would occur at the foundation level (DCS, 2003). 

The staff reviewed the dynamic settlement information and concurred that the post-earthquakeinduced dynamic settlements resulting from localized liquefaction would not create stability 

problems for the foundations for the SC-I structures. 

Aircraft Crash Hazard

As discussed in Section 1.3.1.1 of this SER, the applicant identified airports within 97 km (60 mi) 

of the SRS and provided the relative distance of these airports to the SRS. 

Section 3.5.1.6 of NUREG-0800 provides guidance for assessing aircraft hazards. This source 

contains proximity criteria that allow excluding consideration of aircraft hazards if the facility 

meets these proximity criteria. The LA referred to these criteria in its Table 5.3.1-9 for aircraft 

hazard screening. Information required to implement these proximity criteria includes (1) the 

distance between the facility and nearby airports, (2) the annual number of operations for each 

airport, (3) military training routes, and (4) the distance of the facility from Federal airways, 

holding patterns, and approach patterns. 

The applicant summarized the aircraft hazard analysis for the MFFF in DCS-NRC-000085, 

“Clarification of Responses to NRC Request for Additional Information” (DCS, 2002), indicating 

that all nearby commercial airports were more than 16 km (10 mi) from the facility. The 

applicant determined that the annual operations for these airports, based on information for 

1999 from the Federal Aviation Administration, were smaller than the proximity criterion 

provided in Section 3.5.1.6 of NUREG-0800. In addition, the nearest edge of a military training 

route was more than 8 km (5 mi) from the facility (DCS, 2002). Consequently, the applicant 

concluded that the risk for the activities associated with the nearby commercial airports and 

military training routes was smaller than the acceptance probability of 10!7

/year and, therefore, 

based on Section 3.5.1.6 of NUREG-0800, this hazard is not a design-basis concern. 

One Federal airway and the edge of a second cross the SRS. The applicant estimated the 

probability of an aircraft crash into the BMF and BEG from these Federal airways, based on the 

flight information compiled by the Federal Aviation Administration, to be 2.74×10!8

 and 

1.38×10!9

, respectively, using the formula given in Section 3.5.1.6 of NUREG-0800. 

The summary of the aircraft hazard analysis also indicated that Wackenhut Services, Inc. 

operates a heliport in B-Area, approximately 4.7 km (2.9 mi) from the MFFF. It uses two 

lightweight, multipurpose helicopters to support the security services at the SRS. The applicant 

calculated the helicopter crash probability using the equations from DOE-STD-3014-96, 

“Accident Analysis for Aircraft Crash into Hazardous Facilities” (DOE, 1996b). This standard 

references the methodology suggested in Section 3.5.1.6 of NUREG-0800. The estimated 

helicopter crash probability, based on the flight activities over a 5-year period, was 8.64×10!7

and 6.54×10!8

 for the BMF and BEG, respectively. The helicopter crash probability for the BMF 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 188

was greater than the 10!7

 annual probability of unacceptable radiological consequences 

indicated in Section 3.5.1.6 of NUREG-0800. To reduce the probability of unacceptable 

radiological consequences to an acceptable level, the analysis included the penetration 

resistance of the hardened exterior design for the BMF. Based on the LA, the exterior walls of 

the BMF are reinforced concrete, and a reinforced concrete security wall will enclose the BMF. 

Gabion stones will be placed in the 0.9-m (3-ft)-wide gap between the BMF’s exterior walls and 

the security wall. Chelapati and Kennedy (NED, 1972) showed that the estimated probability of 

a small aircraft, such as a helicopter, penetrating a 0.3-m (1-ft)-thick concrete wall was 0.003. 

By including this probability, the applicant was able to show that the probability of a helicopter 

crash resulting in unacceptable radiological consequences was 2.6×10!9

. 

The total aircraft crash probability (summation of those from the Federal airways and SRS 

helicopters) was 2.99×10!8

 for the BMF and 6.67×10!8 for the BEG. Both probabilities were 

smaller than the annual probability of unacceptable radiological consequences. Consequently, 

the applicant concluded that aircraft crash hazards at the facility are not a design concern. 

The staff reviewed the aircraft hazard analysis for the BMF and BEG and found that the 

approach used for the analysis was consistent with that suggested in Section 3.5.1.6 of 

NUREG-0800 and that the applicant’s conclusion was acceptable. 

Load Combinations

The load combinations used for the design of both SC-I and SC-II civil structures were 

consistent with those in Section 3.8.4 of NUREG-0800, except that tornado, tornado missile, 

and explosion loads were not considered in the load combinations for the SC-II structures. The 

staff reviewed the various load combinations presented in Section 1.1.2.1.6.4.2, “Structural 

Design Loading Combinations for SC–I Structures,” and Section 1.1.2.1.7.8.2, “Loading 

Combinations for SC-II Structures,” of the LA and determined that these load combinations are 

in accordance with those suggested in NUREG-0800 for the design of structures. Therefore, 

the load combinations are acceptable to the staff. 

11.11.4 Structural Analysis and Design

To facilitate the review of the civil structural design for the MFFF, the staff adopted a vertical 

slice approach, selecting the design and analysis of the BMF for detailed review. The BMF is 

classified as an SC-I structure and an IROFS structure. Furthermore, the design approach the 

applicant used for the BMF is relatively more complicated than other civil structure systems for 

the MFFF. The staff has sufficient confidence that the applicant used acceptable methodologies 

or common practices for the design of other civil structural systems, by following a similar 

process, following the relevant codes and standards, and satisfying the design bases that the 

LA specifies and the related analyses to support the design. 

The selected detailed review included six areas: (1) soil-structure interaction analysis, 

(2) foundation design analysis, (3) tornado missile barrier analysis and design, (4) external 

explosion analysis and design, (5) structural analysis, and (6) structural design of the reinforced 

concrete BMF. 

The detailed review focuses on (1) the appropriateness of the data input used, (2) the 

acceptability of the assumptions made, (3) the acceptability of the methodologies used, and 

(4) the appropriateness of the results used for the design. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 189

11.11.4.1 Soil-Structure Interaction Analysis

To determine the design seismic loads for the BMF to support the design, the applicant 

performed soil-structure interaction analyses discussed in DCS-01-XGA-DS-CAL-B-01069-1, 

“Soil-Structure Interaction Analysis of MOX Fuel Fabrication Building” (DCS, 2004). To support 

these analyses, the applicant generated synthetic time histories for the three components of the 

design-basis ground motion, in accordance with the guidelines in Section 3.7.1 of 

NUREG-0800. For example, the response spectra of the synthetic time histories enveloped the 

design response spectra at 76 predetermined frequencies and met the minimum power spectral 

density requirement at frequencies between 0.3 and 24 hertz (Hz). In addition, no response 

spectrum of the synthetic time history fell below the design response spectrum at more than 

5 frequency points, nor by more than 10 percent. The cross-correlation coefficients between the 

three components of the applicant’s synthetic time histories were smaller than the limit value 

suggested in Section 3.7.1 of NUREG-0800. 

The applicant used a simplified three-dimensional finite-element model that ignored the 

embedment and simulated intact slabs for the soil-structure interaction analyses of the BMF. 

The BMF consists of the MOX processing area, the BAP, and the BSR. The floor of the MOX 

processing area is 0.3 m (1.0 ft) above grade. The floor of the BAP is 5.3 m (17.5 ft) below the 

floor of the MOX processing area, and the floor of the BSR is 4.3 m (14 ft) below the floor of the 

MOX processing area. According to the LA, the embedment in the BAP and BSR is shallow 

compared to the plan dimensions of BMF. Therefore, the soil-structure interaction analyses 

ignored the embedment. Furthermore, in DCS-01-XGA-DS-CAL-B-01069-1 (DCS, 2004), the 

applicant assumed the base slabs for the three areas of the BMF were rigid. Because the 

applicant made these two assumptions based on the guidelines provided in ASCE 4-98 (ASCE, 

1999), they are acceptable to the staff. 

For the BEG, the applicant modeled the structure as a three-dimensional lumped-mass stick 

model in the soil-structure interaction analyses. The applicant developed the soil model for the 

soil-structure interaction analyses using the information from the soil exploration and siteresponse analysis. Three soil conditions (lower, best, and upper bound) accounting for material 

property uncertainties were considered in the soil-structure interaction analyses to develop the 

in-structure response spectra at each direction and for a given structural level. 

The soil model included a sufficient number of idealized soil layers from the ground surface to 

the bedrock. An in-office review of the soil-structure interaction analysis-related documents 

showed that the thickness of each soil layer met the maximum thickness guideline commonly 

accepted in engineering practice (DCS, 2002), thus it is acceptable to the staff. The structural 

damping values used in the analysis were in accordance with Regulatory Guide 1.61, “Damping 

Values for Seismic Design of Nuclear Power Plants,” issued October 1973 (NRC, 1973b), for a 

safe-shutdown earthquake and are acceptable to the staff. 

From the soil-structure interaction analyses, the applicant obtained response spectra at the 

foundation and each floor and roof level to develop acceleration profiles to design IROFS SSCs. 

The structural and floor response spectra resulting from the three soil conditions were 

broadened individually to account for variations in structural material properties and then 

enveloped for use in the structural design of the BMF. Section 1.1.2.1.6.4.1.3, “Extreme 

Environmental Loads,” of the LA discusses specific extents of spectrum-peak broadening. The 

staff found that the extents of spectrum-peak broadening are generally consistent with 

Regulatory Guide 1.122, “Development of Floor Design Response Spectra for Seismic Design 

of Floor-Supported Equipment or Components,” issued February 1978 (NRC, 1978). 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 190

The applicant applied additional spectrum-peak broadening to the structural and floor response 

spectra to account for discrepancies in the structural natural frequencies of a fixed-base 

structure resulting from model differences in the soil-structure interaction analysis and the 

ANSYS structural analysis to design the BMF. The applicant’s soil-structure interaction analysis 

used a simplified three-dimensional model comparable to the three-dimensional model the 

ANSYS analysis used (MOX, 2010a, 2010b; DCS, 2004). 

The applicant determined the out-of-plane seismic responses of the flexible slabs and walls 

(having a fundamental vertical frequency smaller than 33 Hz) in separate analyses. In these 

separate analyses, the applicant modeled the slabs or walls as a one-degree-of-freedom 

system, using the SAP2000 computer code (DCS, 2004). The modeled one-degree-of-freedom 

system was a 12.2×12.2×0.6-m (40×40×2-ft) slab with fixed edges. The applicant subjected this 

one-degree-of-freedom system to the applicable floor motions generated from the results of the 

soil-structure interaction analysis. 

At the conclusion of the soil-structure interaction analyses, the applicant extracted the results of 

the soil-structure interaction analyses of the BMF and presented them in a separate report, 

DCS01-XGA-DS-CAL-B-01072-0, “Seismic Floor Response Spectra for BMF and BEG” (MOX, 

2009a), to facilitate design use. The report included a matrix of floor response spectra for 

design use and seismic movements at each floor elevation for assessing seismic anchor 

movements in the stress analysis of suspended systems. 

The staff made the following determinations: 

• The synthetic time histories used for the soil-structure interaction analyses are 

acceptable because they were developed in accordance with the guidelines provided in 

NUREG-0800. 

• The approach used for the soil-structure interaction analyses for consideration of 

uncertainties associated with structural and soil material properties is acceptable 

because this approach is consistent with the design guidance in Regulatory Guide 1.122 

(NRC, 1978). 

• The assumptions made in the soil-structure interaction analyses regarding modeling the 

foundation are acceptable because these assumptions were developed based on the 

guidelines provided in ASCE 4-98 (ASCE, 1999). 

• The approach used to broaden the spectral peaks of the structural and floor response 

spectra from the soil-structure interaction analyses is acceptable because this approach 

is consistent with Regulatory Guide 1.122. 

11.11.4.1.1 Foundation Design Analysis 

The LA indicated that load combinations used to assess the effects of overturning, sliding, and 

flotation on structural stability were consistent with those recommended in Section 3.8.5 of 

NUREG-0800. A review of Table 1.1.2-3 of the LA confirms that the load combinations and the 

minimum safety factors for each condition listed are consistent with those provided in 

NUREG-0800 and are acceptable to the staff. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 191

The in-office review focused on analyses of sliding stability, torsion, and overturning of the BMF 

during a seismic event. In the sliding stability analysis, only the friction between the foundation 

mat and soil was considered. Lateral resisting forces from the below-grade portion of the BMF 

were not included in the analysis for conservatism. The seismic load input was determined 

using the 100-40-40-percent rule. The horizontal resisting force was calculated based on the 

total weight of the BMF and an uplift resulting from the 40-percent vertical seismic uplift with a 

10-percent margin. 

The torsional and overturning moments were calculated using a static three-dimensional 

lumped-mass stick model. The horizontal forces, based on mass and seismic acceleration 

values, are applied to the stick model to obtain torsional and overturning moments. Torsional 

moment arises from the eccentricity between the mass center and rigidity center of the model. 

A 5-percent offset was added to the stick model by offsetting the mass center to obtain the 

accidental torsion. The overturning moment was calculated from the inertial forces on the mass 

centers and its distance to the edge of the foundation. For calculating resisting overturning 

moment, the mass of the structure was adjusted by the seismic uplift forces using the 

100-40-40-percent rule. The foundation analysis, including assumptions and methodology used 

is consistent with ASCE requirements and is acceptable. 

The lateral displacement of foundation soil, as calculated by the SASSI computer code, is 

acceptable. 

11.11.4.1.2 Tornado Missile Barrier Analysis and Design 

The applicant’s impact analyses considered the following three tornado-generated missiles in 

DCS01-XGA-DS-CAL-B01063-0, “Tornado Missile Barrier Analysis and Design” (DCS, 2005b): 

(1) a 1,361-kilogram (kg) (3,000-pound (lb)) automobile with a 40-km/h (25-mph) horizontal 

impact speed 

(2) a 34-kg (75-lb), 7.6-cm (3-in.) standard steel pipe with a 121-km/h (75-mph) horizontal 

and a 80-km/h (50-mph) vertical impact speed 

(3) a 6.8-kg (15-lb), 5.1 × 10.2-cm (2 × 4-in.) timber plank with a 241-km/h (150-mph) 

horizontal and a 161-km/h (100-mph) vertical impact speed 

These tornado missiles are consistent with the three tornado-generated missile design bases 

discussed in Section 1.1.2.1 of the LA (Table 1.1.2-2). 

The applicant analyzed the local and global effects of these three missiles on the roof and wall 

of the BMF and BEG (DCS, 2005b), using the methodologies specified in Section 6.4 of ASCE 

Manual and Report No. 58 (ASCE, 1980). The analyses did not account for the cushion of 

0.9-m (3-ft) gabion stones between the security barrier and the exterior building walls. In 

addition, the roof and wall panels were fixed on all four sides, with the impact loads acting at the 

center of the panels. With the assumption of fixed ends, the entire energy from the tornadogenerated missiles is transformed into impact energy; the staff considers this assumption to be 

conservative. The applicant also increased the calculated perforation and scabbing thicknesses 

by a factor of 1.2, following the recommendation in the ASCE Manual and Report No. 58 

(ASCE, 1980) to provide sufficient safety margin. The results of the analysis indicate that the 

civil structure systems, as designed, will be able to retain their integrity and functionality after a 

strike from a tornado-generated missile. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 192

The staff reviewed the applicant’s tornado-missile barrier analysis and found it acceptable 

because the applicant used the methods recommended in ASCE Manual and Report No. 58 

(ASCE, 1980) for impact analysis, and the applicant obtained and interpreted the analysis 

results appropriately. 

11.11.4.1.3 External Explosion Analysis and Design 

 

 

The staff reviewed the analyses related to the impact of the external explosion and has 

determined that they followed the acceptable procedures and that the results are acceptable. 

11.11.4.1.4 Structural Analysis of the Mixed Oxide Fuel Fabrication Building 

To account for the effect of static settlement on the BMF, the applicant estimated a set of static 

spring constants at various locations of the base slab, using the computer code FLAC, in 

DCS01-WRS-DS-CAL-G–00017D, “Estimates of Static Settlement of MFFF Structure” (DCS, 

2005a). The applicant calculated the static soil spring constants by dividing the ground 

pressure estimated at a location immediately beneath the base slab with the estimated 

settlement at the same location (DCS, 2005a). Then it verified the developed static soil spring 

constants by applying these constants to the structural (ANSYS) modeling of the BMF to 

approximate the stress-strain response of foundation soils to structural loads in 

DCS01-XGA-DS-CAL-B–01070-0, “Vertical Soil Springs at Base Slabs of MOX Fuel Fabrication 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 193

Building” (DCS, 2005c). The staff found that the approaches for estimating and verifying the 

static soil spring constants for structural design and analysis are reasonable. 

The applicant performed a structural analysis of the BMF using the computer codes ANSYS and 

SASSI. A detailed three-dimensional finite-element model was analyzed using the computer 

code ANSYS. This analysis used the design-bases inputs discussed in the LA site and designspecific parameters and information and soil-structure interaction analysis carried out by the 

SASSI computer code. The applicant used shell elements to model the slabs and walls and 

beam elements to model the interaction between the security shear wall and the exterior shear 

wall. The SASSI soil-structure interaction analysis included all frequencies that significantly 

contribute to the seismic response of the BMF. The staff reviewed the structural analysis of the 

BMF and found the input data, assumptions, and idealizations used for structural and soilstructure interaction analyses consistent with ASCE requirements are acceptable. 

11.11.4.1.5 Structural Design of Reinforced Concrete Mixed Oxide Fuel Fabrication Building 

The structural design reports, design drawings, computer simulation demonstration, and designrelated details examined during the in-office review provided structural design details of the 

reinforced concrete foundations, security shear walls, exterior shear walls, frames, floor slabs, 

roof slabs, and tie-back steel beams, and the connections among these components. The 

applicant based the designs on the member forces calculated by computer codes ANSYS, 

SASSI, SAP2000, and other associated codes. The seismic forces used for the design are 

based on the simplified model of the structure used in the soil-structure interaction analysis. 

The design followed ACI 318-99, ACI-SP-175-98, ACI 349-97, and ACI 349.1R-91 (ACI, 1999, 

1998, 1997, and 1996) for reinforced concrete components and the AISI specifications (AISI, 

1996) for steel structures. The staff reviewed the structural design of the BMF and found the 

assumptions, idealizations, and codes and standards used for the design of the reinforced 

concrete and steel structures are acceptable. 

11.11.5 Seismic Qualification of Civil Structures 

The applicant conducted the seismic qualification for civil structures to demonstrate structural 

integrity under seismic loads through design and analysis. Section 1.1.2.1 of the LA provides 

the related requirements for seismic qualification. Sections 11.11.3.4 of this SER discuss the 

staff review of this section. The staff reviewed the codes and standards for the designs of SC-I 

and SC-II civil structural systems and concluded that the cited codes and standards are 

consensus standards that provide reasonable guidance consistent with the categorization 

assigned to the buildings and are consistent with Section 11.4.6.1 of NUREG-1718.

11.11.6 Natural Phenomena Accident Sequences 

This section discusses the credible natural phenomena that could affect the MFFF during the 

period of facility operation. Natural phenomena could result in either the dispersion of 

radioactive material and hazardous chemicals, or a loss of subcritical conditions. Natural 

phenomena are also considered as initiators of other events, such as explosions or leaks. 

The ISA addresses NPHs up to and including design-basis accidents. The design bases for 

applicable NPHs are based on the site description information. A comprehensive list of NPHs 

was evaluated and screened for applicability to MFFF operations for description. The resultant 

NPHs applicable to the MFFF, with unmitigated consequences that were determined to be not 

low, include the following: 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 194

• earthquake (including liquefaction) 

• tornado (including tornado missiles) 

• severe wind 

• external fire (evaluated in Section 7.3.6.12 of the SER) 

• rain, snow, and ice 

The MFFF ISA evaluated the following NPH event groups: 

• NPH-01, earthquake affecting the BMF, BEG/UEF, liquid waste reception (KWD) unit 

fluid transport system, hazardous material release 

• NPH-02, tornado at the BMF, BEG/UEF, KWD unit, tornado-driven missiles, and a wind 

and atmospheric pressure change of 150 psf at a rate of 55 psf/second) 

• NPH-03, severe winds affecting the BMF, BEG/UEF, waste transfer lines, extreme 

winds, and wind-driven missiles 

• NPH-04, external fire starting from an NPH 

• NPH-05, rain, snow, and ice affecting the BMF, BEG/UEF, and waste transfer lines 

11.11.6.1 NPH-01, Earthquake Affecting the BMF, BEG/UEF, KWD Fluid Transport 

System, Hazardous Material Release 

Earthquakes are postulated to occur as a natural phenomena event. Earthquakes can affect 

many SSCs simultaneously and, if unmitigated, could result in the dispersal of nuclear material 

or in a criticality accident. Thus, multifaceted event evaluations consider the impact of 

earthquakes. Equipment and structures where failure may directly or indirectly lead to an 

unacceptable dispersion of nuclear materials or to a criticality accident as a result of an 

earthquake are designed for the design earthquake (DE). Similarly, SSCs are designed for the 

DE if their failure during an earthquake could damage seismically designed equipment or 

prevent or limit its operation. 

With respect to the discussions in Section 11.11.3.5.2.2, “Severe Environmental Loads”; 

Section 11.11.5, “Seismic Qualification of Civil Structures”; Section 11.7, “Fluid Transport 

Systems”; and Section 11.8, “Fluid Systems,” of this SER, the staff concludes with reasonable 

assurance that the applicant has demonstrated that the facility will be in compliance with the 

performance requirements of 10 CFR 70.61(b) and (c), “Performance Requirements,” should a 

seismic event occur. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 195

11.11.6.2 NPH-02, Tornado at the BMF, BEG/UEF, KWD, Tornado-Driven Missiles, and a 

Wind and Atmospheric Pressure Change of 7.18 KPa (150 psf) at a Rate of 2.63 

KPa.Second (55 psf/second) 

Tornadoes may occur in extreme weather, such as thunderstorms or hurricanes, and are 

postulated to occur on the MFFF site. Tornado loads include loads caused by tornado wind 

pressure, loads created by the tornado-generated differential pressure, and loads resulting from 

tornado-generated missiles. This event involves tornado winds that cause damage to IROFS 

SSCs, resulting in the failure of dynamic confinement systems caused by pressure differential, 

structural damage, or direct damage to SSCs, potentially resulting in radiological and chemical 

consequences to facility workers, site workers, individuals outside controlled areas, and the 

environment. The BMF structure, BEG and associated UEF structures, missile barriers, KWD 

high alpha liquid waste transfer lines, and tornado dampers provide protection to those IROFS 

SSCs from the effects of a tornado. 

With respect to the discussions in Section 11.11.3.5.2.2, the staff concludes with reasonable 

assurance that the applicant has demonstrated that the facility will be in compliance with the 

performance requirements of 10 CFR 70.61, in the event of a tornado. 

11.11.6.3 NPH-03, Severe Winds Affecting the BMF, BEG/UEF, Waste Transfer Lines, 

Extreme Winds and Wind-Driven Missiles

Severe winds associated with thunderstorms or hurricanes are postulated to occur on the MFFF 

site. Severe wind loads include loads from straight wind and wind-driven missiles. This event 

involves severe straight winds that affect the BMF structure, the BEG and associated UEF 

structures, missile barriers, and waste transfer lines; such winds could lead to the failure of 

dynamic confinement systems caused by pressure differential, structural damage, or damage to 

SSCs that could result in radiological and chemical consequences to receptors. 

With respect to the discussions in Section 11.11.3.5.2.2, the staff concludes with reasonable 

assurance that the applicant has demonstrated that the facility will be in compliance with the 

performance requirements of 10 CFR 70.61 in the event of severe winds. 

11.11.6.4 NPH-05, Rain, Snow, Ice Affecting the BMF, BEG/UEF, and Waste Transfer 

Lines

Rain, snow, and ice are postulated to occur at the MFFF site during operation of the facility and 

are discussed below. The MFFF site grading design maintains flood levels, caused by runoff 

generated by locally intense rain, sufficiently below the building floor elevations. In addition, the 

anticipated maximum flood levels that could occur for the Savannah River Basin are well below 

the plateau elevations established for the MFFF project site. 

The potential impacts of rain, snow, and ice are as follows: 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 196

• damage to the structures of the BMF and BEG and associated UEF that result in 

damage to SSCs within the structures 

• direct damage to IROFS SSCs within the BMF and BEG/UEF 

• damage to other SSCs (non-IROFS) within the BMF and BEG/UEF that cause them to 

fail in a manner that prevents IROFS from performing their safety functions 

• damage to the KWD high alpha liquid waste transfer line leading to a radiological release 

The safety strategy for this event is to mitigate the consequences of rain, snow, and ice by 

providing robust structures, in the case of the BMF and BEG/UEF structures, and by sufficiently 

burying waste transfer lines. 

With respect to the discussions in Section 11.11.3.5.2.1, “Normal Loads,” the staff concludes 

with reasonable assurance that the applicant has demonstrated that the facility will be in 

compliance with the performance requirements of 10 CFR 70.61 in the event of rain, snow, or 

ice. 

11.11.7 External Manmade Hazard Events 

External manmade events are those events that are generated by external manmade hazards 

(EMMHs). EMMHs are those hazards that arise outside of the MFFF property boundary from 

the operation of nearby public, private, government, industrial, chemical, nuclear, and military 

facilities and transportation routes that could affect MFFF operations. 

Section 11.11.7.1 discusses the event group EMMH-02, “External Explosion,” which is related to 

the civil structural evaluation. 

11.11.7.1 EMMH-02, External Explosion 

An explosion originating outside the MFFF area at an SRS facility or along an SRS 

transportation route could be caused by a number of events, such as process upsets and 

transportation accidents. 

With respect to the discussions in Section 11.11.3.5.2.3, “Extreme Environmental Loads,” and 

Section 11.11.4.1.3, “External Explosion Analysis and Design,” the staff concludes with 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 197

reasonable assurance that the applicant has demonstrated that the facility will be in compliance 

with the performance requirements of 10 CFR 70.61 in the event of an external explosion. 

11.11.8 Explosion Events 

11.11.8.1 EXP-15, Outside Explosion

Explosion events occurring outside the BMF that could affect MFFF operations or safety support 

systems are postulated to occur on the MFFF site in the following specific areas: 

• BRP 

• MFFF gas storage area (UGS) 

• MFFF site roadways 

With respect to the discussions in Sections 11.11.3.5.1.3 and 11.11.4.1.3, the staff concludes 

with reasonable assurance that the applicant has demonstrated that the facility will be in 

compliance with the performance requirements of 10 CFR 70.61 in the event of an outside 

explosion. 

11.11.8.2 EXP-16, Miscellaneous Explosions

Within the BAP, the MOX processing area, the BEG, and the BSR, there are some potential 

explosion hazards that either do not directly involve radiological material or involve only trace 

quantities of radiological material. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 198

 

 

 

 

 

 

 

 

 

 

The staff concludes with reasonable assurance that the applicant has demonstrated that the 

facility will be in compliance with the performance requirements of 10 CFR 70.61 for 

miscellaneous explosions, since none of the potential events could cause a release of, or 

exposure to, radioactive material that would exceed exposures of low consequence. 

11.11.9 Evaluation Findings 

Section 1.1.2 of the LA provided design-basis and structural design information for civil 

structural systems for the MFFF. Based on the staff review of the LA and supporting 

information that the applicant provided relevant to civil structural systems, the staff finds that the 

applicant has met the baseline design criteria set forth in 10 CFR 70.64(a)(2). In addition, the 

staff concludes, pursuant to 10 CFR 70.23(b), that the design bases of the civil structural 

systems identified by the applicant will provide reasonable assurance of protection against 

natural phenomena and the consequences of potential accidents. Furthermore, based on the 

staff’s in-office design review of a selected civil structure (i.e., BMF), the staff concludes that the 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 199

design of the facility was performed following the codes and standards specified in 

Section 1.1.2.1.6.3 of the LA and the design bases specified in Section 1.1.2.1.6.4 of the LA.

REFERENCES 

(AASHTO, 1996) American Association of State Highway and Transportation Officials. 

“Standard Specifications for Highway Bridges.” 16th Edition. Washington, DC: American 

Association of State Highway and Transportation Officials, 1996. 

(ACI, 1999) American Concrete Institute. “Building Code Requirements for Structural 

Concrete.” ACI 318–99. Detroit, Michigan: American Concrete Institute, 1999. 

(ACI, 1998) American Concrete Institute.. “Concrete and Blast Effects.” ACI–SP–175–98. 

Detroit, Michigan, 1998. 

(ACI, 1997) American Concrete Institute, “Code Requirements for Nuclear Safety-Related 

Concrete Structures.” ACI 349–97. Detroit, Michigan, 1997. 

(ACI, 1996) American Concrete Institute, “Reinforced Concrete Design for Thermal Effects on 

Nuclear Power Plant Structures.” ACI 349.1R–91. Reapproved, 1996. Detroit, Michigan, 1996. 

(AISI 1996) American Iron and Steel Institute. “Specifications for the Design of Cold-Formed 

Steel Structural Members.” Washington, DC, 1996. 

(AISI 1986) American Iron and Steel Institute, “Specifications for the Design of Cold-Formed 

Steel Structural Members.” Washington, DC, 1986. 

(ANSI/AISC 1994) American Institute of Steel Construction. “Specification for the Design, 

Fabrication, and Erection of Steel Safety-Related Structures for Nuclear Facilities.” ANSI/AISC 

N690–1994. American National Standards Institute/American Institute of Steel Construction, 

(ANSI/ANS, 1992), Chicago, Illinois, 1994. 

(ANSI/ANS, 1992) American National Standards Institute/American Nuclear Society. 

“Determining Design Basis Flooding at Power Reactor Sites.” ANSI/ANS 2.8–1992. La Grange 

Park, Illinois, 1992. 

(ASCE, 1999) American Society of Civil Engineers. “Seismic Analysis of Safety-Related 

Nuclear Structures and Commentary.” ASCE 4–98. Reston, Virginia, 1999. 

(ASCE, 1998) American Society of Civil Engineers, “Minimum Design Loads for Buildings and 

Other Structures.” ASCE 7–98. Reston, Virginia,1998. 

(ASCE, 1991) American Society of Civil Engineers, “Specification for the Design of ColdFormed Stainless Steel Structural Members.” ASCE 8–91, Reston, Virginia, 1991. 

(ASCE 1990) American Society of Civil Engineers, “Specification for the Design of Cold-Formed 

Stainless Steel Structural Members.” ASCE 8−90. Reston, Virginia, 1990. 

(ASCE 1980) American Society of Civil Engineers, “Seismic Analysis of Safety-Related Nuclear 

Structures and Commentary.” ASCE Manual and Report No. 58. New York City, New York: 

1980. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 200

(Baker 1983) Baker, W.E., P.A. Cox, P.S. Westine, J.J. Kulesz, and R.A. Strehlow. Explosion 

Hazards and Evaluation. Atlanta, Georgia: Elsevier Scientific Publishing Company. 1983. 

(NED 1972,) Chelapati, C.V. and R.P. Kennedy. “Probabilistic Assessment of Aircraft Hazard 

for Nuclear Power Plants.” Nuclear Engineering and Design. Vol. 19. pp. 333–364. 1972. 

(DCS, 2005a) Duke Cogema Stone & Webster. “Estimates of Static Settlement of MFFF 

Structure.” DCS01–WRS–DS–CAL–G–00017D. Report prepared for the Department of 

Energy, Chicago Operations Office. Security-Related and Proprietary Information. Charlotte, 

North Carolina, 2005a. 

(DCS, 2005b) “Tornado Missile Barrier Analysis and Design.” DCS01–XGA–DS–CAL–B01063–

0. Security-Related and Proprietary Information. Aiken, South Carolina. 2005b. 

(DCS 2005c) Duke Cogema Stone & Webster ,“Vertical Soil Springs at Base Slabs of MOX Fuel 

Fabrication Building.” DCS01–XGA–DS–CAL–B–01070–0. Report prepared for the 

Department of Energy, Chicago Operations Office. Security-Related and Proprietary 

Information. Charlotte, North Carolina, 2005c. 

(DCS, 2004) Duke Cogema Stone & Webster, “Soil-Structure Interaction Analysis of MOX Fuel 

Fabrication Building.” DCS–01–XGA–DS–CAL–B–01069–1. Report prepared for the 

Department of Energy, Chicago Operations Office. Security-Related and Proprietary 

Information. Charlotte, North Carolina, 2004. 

(DCS 2003) Duke Cogema Stone & Webster “MOX Fuel Fabrication Facility Site Geotechnical 

Report.” DCS01–WRS–DS–NTE–G–00005–E. Report prepared for the Department of Energy, 

Chicago Operations Office. Security-Related and Proprietary Information. Charlotte, North 

Carolina, 2003. 

(DCS, 2002) “Clarification of Responses to NRC Request for Additional Information.” DCS–

NRC–000085. Charlotte, North Carolina: Duke Cogema Stone & Webster. 2002. 

Lysmer, J. and R.L. Kuhlemeyer. “Finite Dynamic Model for Infinite Media.” Journal of 

Engineering Mechanics Division. American Society of Civil Engineering. Vol. 95, No. EM4. 

pp. 859–877. 1969. 

(UC, 1999a) University of California, Ysmer, J., F. Ostandan, and C.C. Chin. “SASSI 2000—A 

System for Analysis of Soil-Structure Interaction, User’s Manual.” Rev. 1. Berkeley, California: 

. 1999a. 

(UC, 1999b) “SASSI 2000—A System for Analysis of Soil-Structure Interaction, Theoretical 

Manual.” Rev. 1. Berkeley, California: University of California. 1999b. 

(MOX 2010a) Shaw AREVA MOX Services. “Mixed Oxide Fuel Fabrication Facility—License 

Application.” Aiken, South Carolina, October 2009. 

(MOX, 2010b) Shaw AREVA MOX Services, “Mixed Oxide Fuel Fabrication Facility—Integrated 

Safety Analysis Summary.” Aiken, South Carolina: October 2009. 

(MOX, 2009a) Shaw AREVA MOX Services “Seismic Floor Response Spectra for BMF and 

BEG.” DCS01–XGA–DS–CAL–B–01072–0. Security-Related and Proprietary Information. 

Savannah River Site, South Carolina, 2009. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 201

(MOX, 2009b) Shaw AREVA MOX Services, “External Explosion Analysis and Design Quality 

Level 1a-IROFS.” DCS01–XGA–DS–CAL–B-01084–0. Security-Related and Proprietary 

Information. Savannah River Site, South Carolina, 2009. 

(MOX 2009c) Shaw AREVA MOX Services, “External Explosions Quality Level 1a-IROFS.” 

DCS01–AAS–DS-CAL–H–38413–0. Security-Related and Proprietary Information. Savannah 

River Site, South Carolina, 2009. 

(DOE, 1996a) U.S. Department of Energy. “Natural Phenomena Hazards Design and 

Evaluation Criteria for Department of Energy Facilities.” DOE–STD–1020–94. Change Notice 

No. 1. Washington, DC, 1996. 

(DOE 1996b) U.S. Department of Energy, “Accident Analysis for Aircraft Crash Into Hazardous 

Facilities.” DOE–STD–3014–96. Washington, DC, 1996b. 

(DOD, 1969) U.S. Department of the Army, the Navy and the Air Force. “Structures To Resist 

the Effects of Accidental Explosions.” Department of the Army Technical Manual, TM 5-1300, 

Department of the Navy Publication NAVFAC P-397, Department of the Air Force Manual AFM 

88-22: Department of the Army, the Navy and the Air Force, Alexandria, Virginia, 1969. 

(NRC, 2007a) U. S. Nuclear Regulatory Commission, Letter from David Tiktinsky to William 

Troskoski, “In-Office Review Summary: Mixed Oxide Fuel Fabrication Facility (Civil/Structural 

Review), Rockville, MD, July 11, 2007. 

(NRC, 2007b) U. S. Nuclear Regulatory Commission, Letter from David Tiktinsky to Margie 

Kotzalas, “In-Office Review Summary: Mixed Oxide Fuel Fabrication Facility (Civil/Structural 

Review II), Rockville, MD, September 24, 2007. 

(NRC, 2000) U.S. Nuclear Regulatory Commission. NUREG–1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” Washington, 

DC, 2000. 

(NRC, 1986) U.S. Nuclear Regulatory Commission, NUREG–0800, “Standard Review Plan for 

the Review of Safety Analysis Reports for Nuclear Power Plants.” Washington, DC, 1993. 

(NRC, 1980) U.S. Nuclear Regulatory Commission, NUREG–0612, “Control of Heavy Loads at 

Nuclear Power Plants.” Washington, DC,1980. 

(NRC, 1978) U.S. Nuclear Regulatory Commission, Regulatory Guide 1.122, “Development of 

Floor Design Response Spectra for Seismic Design of Floor-Supported Equipment or 

Components.” Washington, DC, 1978. 

(NRC, 1977) U.S. Nuclear Regulatory Commission Regulatory Guide 3.40, “Design Basis 

Floods for Fuel Reprocessing Plants and for Plutonium Processing and Fuel Fabrication Plants.” 

Washington, DC, 1977. 

(NRC, 1976) U.S. Nuclear Regulatory Commission, Regulatory Guide 1.92, “Combining Modal 

Responses and Spatial Components in Seismic Response Analysis.” Washington, DC, 1976. 

(NRC, 1973a) U.S. Nuclear Regulatory Commission, Regulatory Guide 1.60, “Design Response 

Spectra for Seismic Design of Nuclear Power Plants.” Washington, DC,1973a. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

11 - 202

(NRC, 1973b) U.S. Nuclear Regulatory Commission, Regulatory Guide 1.61, “Damping Values 

for Seismic Design of Nuclear Power Plants.” Washington, DC,1973b. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 1 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12.0 HUMAN FACTORS ENGINEERING 

This chapter of the safety evaluation report (SER) describes the review by the U.S. Nuclear 

Regulatory Commission (NRC) staff of human factors engineering (HFE) as described in 

Chapter 12 of the mixed oxide (MOX) fuel fabrication facility (MFFF) license application (LA) 

(MOX 2010a). The purpose of the review is to establish that HFE is applied to personnel 

activities identified as safety significant is consistent with the findings of the Integrated Safety 

Analysis (ISA) (MOX 2010b) and to determine whether an item relied on for safety (IROFS) has 

special or unique safety significance. The staff evaluated the information provided in 

Chapter 12 of the LA and supporting documentation (NRC 2009), in accordance with the 

guidance provided in NUREG-1718, “Standard Review Plan for Review of an Application for a 

Mixed Oxide (MOX) Fuel Fabrication Facility,” Chapter 12, “Human Factors Engineering” (NRC, 

2000). 

12.1 Regulatory Requirements

The staff reviewed how the LA and ISA summary address the following regulatory requirements 

for HFE for personnel activities: 

• Title 10 of the Code of Federal Regulations (10 CFR) § 70.61(e), “Performance 

requirements,” which requires a safety program to ensure that each IROFS will be 

available and reliable to perform its intended function when needed 

• 10 CFR § 70.62, “Safety Program and Integrated Safety Analysis,” which requires a 

safety program and an ISA 

• 10 CFR § 70.64(b)(2), “Requirements for new facilities or new processes at existing 

facilities,” which requires features that enhance safety by reducing challenges to IROFS 

(defense-in-depth practices) 

12.2 Regulatory Acceptance Criteria

NUREG-1718, Section 12.4.3, “Regulatory Acceptance Criteria” (NRC, 2000), contains the 

acceptance criteria to be used to support the HFE review. The criteria are divided into nine 

areas of review, designated as Criteria A through I: 

A. a description of the safety-significant personnel actions, the associated human systems 

interfaces (HSIs), and the consequences of incorrectly performing or omitting actions for 

each personnel activity 

B. the applicant’s plans for HFE design review 

C. operating experience review 

D. function and task analysis 

E. HSI design, inventory, and characterization 

F. staffing 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 2 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

G. procedure development 

H. training program development 

I. human factors verification and validation (V&V) 

In Section 12.3 below, each review area and its associated acceptance criteria are evaluated. 

12.3 Regulatory Review and Analysis

The purpose of this review is to establish that HFE is applied to personnel activities identified as 

safety significant, consistent with the findings of the ISA and the determination of whether an 

IROFS has special or unique safety significance. A graded approach commensurate with the 

complexity and integration and operation of the control systems is appropriate. The application 

of HFE to personnel activities ensures that the potential for human error in facility operations is 

addressed during the design of the facility by facilitating correct, and inhibiting wrong, decisions 

by personnel and by providing the means for detecting and correcting or compensating for error. 

The review was conducted in accordance with the review guidance in Chapter 12 of 

NUREG-1718 (NRC, 2000). The results are organized according to the review topics identified 

in Section 12.3 of NUREG-1718 and summarized in Section 12.4 of this SER. 

12.3.1 Safety-Significant Personnel Actions 

12.3.1.1 Review Criterion 

Section 12.3 of NUREG-1718 states, “The scope of the review should be consistent with the 

results of the ISA and should include as appropriate, a description of the safety-significant 

personnel actions, the associated human systems interfaces (HSIs), and the consequences of 

incorrectly performing or omitting actions for each personnel activity” (NRC, 2000). 

Section 12.4.1 of NUREG-1718 states that the regulatory requirements for HFE for personnel 

activities are 10 CFR § 70.61(e) and 10 CFR § 70.64(b)(2). Section 12.4.3 provides 

Acceptance Criterion A for the review of personnel actions: “The applicant appropriately 

identified the personnel activities such that the reviewer can understand the actions, the HSIs 

involved, and the consequences.” 

12.3.1.2 Evaluation 

Chapter 12.0 of the LA states the following: 

HFE principles and practices are applied specifically to the MFFF active and 

passive Engineered IROFS (for maintainability, testing, and surveillance 

purposes) and to those personnel activities that are identified by the ISA as 

Enhanced Administrative Control (EAC) IROFS and Administrative Control (AC) 

IROFS (i.e., Administrative IROFS). 

This provides a clear commitment to HFE for the most important activities and equipment in the 

MFFF. Chapter 12.0 of the LA also states: 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 3 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

MOX Services will also review the operator actions identified as Defense-inDepth in the Nuclear Criticality Safety Evaluations (NCSEs) and Nuclear Safety 

Evaluations (NSEs) using a graded approach as defined in the Human Factors 

Engineering Program Plan (HEPP) and the Human Factors Engineering 

Implementation Plan (HFIP). 

This commitment provides for further HFE of activities that may also play a lesser role in 

ensuring the safety of the MFFF. 

Chapter 1.0, “Overview,” of the ISA Summary (Page 1-2) states the following: 

...the identified IROFS are the necessary and sufficient set of design features 

and administrative controls (activities of personnel) implemented in the design to 

satisfy the performance requirements of 10 CFR §70.61. To provide an 

additional safety margin and satisfy the requirements of 10 CFR §70.64(b), the 

MFFF employs defense-in-depth practices. These features ensure that multiple 

layers of risk reduction exist. 

Section 5.3 of the ISA summary describes the results of the hazard and accident analyses 

performed to identify the facility IROFS. Section 5.3.3 has several subsections that describe the 

results of the consequence analysis for each of the analyzed events. These subsections 

describe the event and the safety strategy to protect against the event and list the IROFS 

identified as necessary to implement the safety strategy. They also discuss risk and identify 

defense-in-depth systems for that event. Tables in each of the Section 5.3.3 subsections list the 

IROFS, with separate tables for engineered IROFS and administrative IROFS. Many of the 

engineered IROFS contain HSIs, such as controls, displays, and alarms that are not separately 

identified in the administrative IROFS. As noted above, the applicant’s HFE program addresses 

these engineered IROFS, as well as the administrative IROFS. 

 

HEPP Section 1.1, “Scope,” provides for the application of HFE in the design, construction, test 

and evaluation, startup, and operation of the MFFF. Section 1.3 states that the HFE program 

goal is to successfully integrate the human subsystem into the MFFF. The program is focused 

on HSI vis-à-vis engineering and administrative IROFS. HEIP Section 1.4 indicates that the 

HFE program applies to ISA-identified IROFS functions (personnel activities identified as IROFS 

and personnel activities that support safety, such as maintenance). 

HFIP Section 1.3 describes the HFE program goals as the successful integration of the human 

subsystem into the MFFF design and modification within the constraints provided in the 

regulatory requirements of 10 CFR Part 70, “Domestic Licensing of Special Nuclear Material,” 

and the MFFF project. Additional goals are to ensure that engineering provides an MFFF work 

environment that fosters effective procedures, work patterns, personnel safety and health, and 

that minimizes factors that degrade human performance and increase error potential. Additional 

human factors goals are identified that are similar to those in NUREG-0711, “Human Factors 

Engineering Program Review Model” (NRC, 2004), with some exceptions (addressed in the 

function allocation (SER Section 12.3.4.2) and HSI design sections (SER Section 12.3.5.1). 

In summary, the staff has reviewed the applicant’s LA and supporting documentation and finds 

that the review criterion on safety-significant personnel actions is acceptable. The commitments 

made in the LA are consistent with the guidance provided in NUREG-1718 and the regulatory 

requirements of 10 CFR § 70.61(e) and 10 CFR § 70.64(b)(2) and thus are acceptable to the 

staff. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 4 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

12.3.2 Human Factors Engineering Planning

12.3.2.1 Review Criterion

Section 12.4.3 of NUREG-1718 (NRC, 2000) provides Acceptance Criterion B for the review of 

HFE planning: 

B. HFE Design Review Planning 

The applicant’s approach for planning HFE design review includes: 

i. Identification of appropriate goals and scope to ensure that HFE 

practices and guidelines are implemented during design, 

construction, and operation of the facility. 

ii. Implementation by an HFE team that has the appropriate 

composition, experience, and organizational authority to ensure 

that HFE is considered in the design of HSI for personnel 

activities. The HFE team’s responsibilities include ensuring the 

proper development, execution, oversight, and documentation of 

the HFE function. Depending on the identification of personnel 

activities, it may be appropriate for the HFE team to consist of a 

single individual. 

iii. An HFE team that attains the HFE goals and scope through 

established processes and procedures and that tracks HFE 

issues. 

iv. An HFE function that ensures that all aspects of the personnel 

activities including the HSI are developed, designed, and 

evaluated on the basis of a structured approach using HFE. 

The following section addresses each of the four subcriteria separately.

12.3.2.2 Evaluation

Review Criterion 12.4.3 B(i)

LA Chapter 12.2 states, “The MOX Project HFE program documented in the HEPP includes 

identification of HFE programmatic goals, scope, a description of the various HFE processes 

used for HFE review; the MOX HFE team composition; and preparation of a human 

performance monitoring strategy.” 

HEPP Section 1.1 provides for the application of HFE in design, construction, test and 

evaluation, startup, and operation of MFFF. Section 1.3 states that the goal of the HFE program 

is to successfully integrate the human subsystem into the MFFF. The program is focused on 

HSI vis-à-vis engineering and administrative IROFS. HEIP Section 1.4 indicates that the HFE 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 5 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

program applies only to ISA-identified IROFS functions: personnel activities identified as IROFS 

and personnel activities that support safety, such as maintenance. 

HEIP Section 1.3, “HFE Program Goals,” defines the program goal as the successful integration 

of the human subsystem into the MFFF design and modification within the constraints provided 

in the regulatory requirements of 10 CFR Part 70 and the MFFF project: 

• 10 CFR 70.61(e) requires a safety program to ensure that each IROFS will be available 

and reliable to perform its intended function when needed. Per the HEIP, this includes 

enhanced administrative IROFS and administrative IROFS. 

• 10 CFR 70.64(b)(2) requires features that enhance safety by reducing challenges to 

IROFS. MFFF design and construction incorporate HFE principles and practices for 

personnel activities designed as IROFS to eliminate or reduce the possibility of 

challenges to the performance capabilities of operators and maintainers. 

The ISA Summary provides the following definitions: 

• Administrative Controls—A human action that is prohibited or required to maintain safe 

process conditions (i.e., a simple administrative control). 

• Enhanced Administrative Controls—A procedurally required or prohibited human action, 

combined with a physical device that alerts the operator that the action is needed to 

maintain safe process conditions, or otherwise adds substantial assurance of the 

required human performance (i.e., augmented administrative control). 

Additional goals of the HEIP are to ensure that the work environment fosters effective 

procedures, work patterns, personnel safety and health, and minimizes factors that degrade 

human performance and increase error potential. Human factors goals are identified that are 

similar to those described in NUREG-0711 (NRC, 2004) with some exceptions (these are 

addressed in the function allocation (SER Section 12.3.4.2) and HSI design (SER Section 

12.3.5.1). 

Review Criterion 12.4.3 B(ii)

Team Characteristics 

Section 12.2.2 of the LA describes the MOX project team characteristics. The LA indicates that 

the team is composed of a core group from functional groups involved in the design of the HFE 

aspects of the plant. Additional expertise is added as needed (e.g., training and procedure 

writing). The team also has the authority to make design changes. 

The HEIP presents additional information on the project team. HEIP Section 2 addresses HFE 

organizational placement. Organizationally, HFE is within the MOX Services I&C Section. It 

reports to the Electrical/I&C Group which reports directly to the vice president of engineering. 

HEIP Section 2.1 identifies the HFE team, which comprises a core group of persons from 

different functional groups. Once operational, the team will transition to Plant Operations to 

continue human performance monitoring. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 6 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

The expertise of the group is identified in HEIP Table 3, “HFE Core Team.” This table provides 

qualifications and expected contributions that are consistent with those in NUREG-0711. 

Team Responsibility 

Section 12.2.2 of the LA describes the MFFF project team responsibilities. The team is 

responsible for implementing the HEPP and HFIP and making design changes within their 

scope. The team ensures that HFE criteria are properly applied to the design. 

HEIP Section 2 also addresses team responsibilities. The human factors (HF) engineer 

develops the HFE program and implementation plans (IPs). The HF engineer is the focal point 

for HFE matters, including the design of applicable HSIs, and has primary control, direction, and 

supervision over all technical HFE aspects of the project and the authority to ensure that all HFE 

program plans are accomplished. HEIP Section 2 identifies an extensive list of responsibilities. 

Review Criterion 12.4.3 B(iii)

Section 12.2.3 of the LA describes the HFE team’s processes and procedures. The team uses 

a structured approach to HFE, which comprises established HFE activities such as operating 

experience review (OER), function allocation, task analysis, HSI design, and V&V. The HEPP 

and the HEIP further define and amplify the HFE program and the applicant’s approach to HFE 

design. These provide the HFE goals and scope, as discussed in the previous review criteria. 

They also provide and refer to various HFE processes and procedures as described below. 

HEIP Section 1.6 provides an overview of the technical program and the issues tracking system. 

This section also includes summary reports for major HFE activities. Figure 2 of the HEIP gives 

an overview of the application of HFE through the design process. 

LA Section 12.2.4, “Issue Tracking,” discusses the process by which issues are tracked. The 

HEIP indicates that HSI issues are identified as human engineering discrepancies (HEDs), and 

they are not considered in isolation. Any HFE concern or identified issue is tracked via the MOX 

project tracking system per MOX Services Project Procedure PP9-28, “Human Engineering 

Discrepancy.” 

Review Criterion 12.4.3 B(iv)

Section 12.2.3 of the LA addresses the HFE function for ensuring a structured approach and 

describes the full range of all HFE activities. The HFPP, HEIP, and supporting engineering 

plans reinforce the LA description. 

In summary, the staff has reviewed the applicant’s LA and supporting documentation and finds 

that the review criterion for HFE goals and scope, HFE team, HFE approach and issues 

tracking, and use of a structured approach to HFE is acceptable. The commitments made in the 

LA are consistent with the guidance provided in NUREG-1718 (NRC, 2000) and the regulatory 

requirements of 10 CFR § 70.61(e) and 10 CFR § 70.64(b)(2) and are acceptable to the staff. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 7 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12.3.3 Operating Experience Review 

12.3.3.1 Review Criterion

Section 12.4.3 of NUREG-1718 (NRC, 2000) provides Acceptance Criterion C for the OER: 

C. Operating Experience Review (OER) 

The applicant identified safety-related HFE events or potential events that 

have occurred in existing facilities that are similar to the proposed facility. 

The applicant: 

i. Reviewed the HFE-related events or potential events for 

relevance; 

ii. Analyzed the HSI technology employed for the relevant HFE 

events or potential events; and 

iii. Conducted (or reviewed existing) operator interviews and surveys 

on the HSI technology for the relevant HFE events or potential 

events. 

12.3.3.2 Evaluation

In LA Section 12.0 the applicant stated that the design of the MFFF is based on the designs of 

two successfully operating AREVA NC facilities at La Hague and MELOX (the reference plants) 

in France, with modifications to incorporate “lessons learned” from operating those facilities. 

Existing designs of facilities, equipment, or systems that are adapted or modified for use in the 

MFFF are reviewed to evaluate the efficacy of human factors design elements. The depth and 

rigor of the evaluation depend on a determination of the complexity and importance to safety of 

the component or system and the consequences of human error. 

LA Section 12.5 also addresses the OER. This section indicates that an OER was performed 

that focused on lessons learned from the reference plants. The review included sources such 

as interviews with operations, maintenance, and systems engineering personnel who are 

familiar with the reference plants. Further, Section 12.5 states that insights gained from the 

OER have been incorporated into the MFFF design. 

The HEPP, Attachment D, “Lessons Learned,” lists 30 documents that outline where and how 

OERs were conducted for the reference plants in France (the aqueous polishing plant and the 

MELOX plant at La Hague). The staff reviewed some examples of completed OERs from the 

reference plants as documented in the MOX Services document entitled “MFFF Processing 

Area—Lessons Learned from Experience at MELOX—Overall Summary.” 

In the OER area, the HEIP refers to the DCS Lessons Learned Program, PP1-7, Revision 1, 

dated March 1, 2006, and to the project-level lessons learned coordinator. PP1-7 applies to all 

MFFF personnel and specifies that during their work all personnel should identify potential 

lessons learned, which should then be evaluated and necessary actions determined. OER from 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 8 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

external sources and reference plants is also evaluated. The procedure has an OER form and 

specifies routing of identified issues for review. If appropriate, the issues are entered into the 

condition report system governed by MOX Services procedure PP3-6, which uses logs and 

tracking numbers. The system appears appropriately specified and detailed. 

The HFIP, Attachment B, “Lessons Learned Decision Point Questions,” contains questions that 

can aid in determining the use and applicability of operating experience and lessons learned 

from the reference plants. Section 3.9, “Documentation,” of the HFE IP discusses the “HFE 

Lessons Learned Log,” which is used for tracking identified items. Section 3.10 of the HFE IP 

notes that while much has been accomplished in the area of lessons learned, the HFE team will 

continue to monitor various sources of lessons learned from the reference plants that might 

apply to the MFFF design and operation. 

The staff has reviewed the applicant’s LA and supporting documentation and finds that the 

review criterion for the operating experience review is acceptable. The commitments made in 

the LA are consistent with the guidance provided in NUREG-1718 (NRC, 2000) and the 

regulatory requirements of 10 CFR § 70.61(e) and 10 CFR § 70.64(b)(2) and are acceptable to 

the staff. 

12.3.4 Function and Task Analysis 

12.3.4.1 Review Criterion

Section 12.4.3 of NUREG-1718 (NRC, 2000) provides Acceptance Criterion D for the review of 

function and task analysis: 

D. Functional Allocation Analysis and Task Analysis 

i. Functional allocation analysis: The functional allocation analysis 

is based on the OER. Personnel activities are functionally 

allocated to take advantage of human strengths and to avoid 

demands that are not compatible with human capabilities. 

ii. Task analysis: The task analysis includes the task analysis 

scope, identification and analysis of critical tasks; detailed 

description of personnel demands (e.g., input, processing, and 

output); iterative nature of the analysis; and incorporation of job 

design issues. The task analysis addresses each operating mode 

for each personnel activity (e.g., startup, normal operations, 

emergency operations, and shutdown). The task analysis results 

support the functional allocation. 

The following section addresses each of the two subcriteria separately. 

12.3.4.2 Evaluation 

 

Review Criterion 12.4.3 D(i)
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 9 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

The LA addresses function allocation in Section 12.3. The function allocation methodology 

begins with an analysis of functional requirements for meeting MFFF safety functions. 

Section 12.3 of the LA states, “Functional requirements analysis (FRA) is the identification of 

functions that must be performed to satisfy the MFFF safety objectives to prevent or mitigate the 

consequences of postulated accidents that could damage the facility or cause undue risk to the 

health and safety of the public.” This section also lists the specific objectives of the FRA. 

HEPP Section 4, “Functional Requirements Analysis (FRA) and FA,” defines FRA as the 

identification of IROFS functions that must be performed to satisfy MFFF safety objectives. It 

further notes that the FRA identifies IROFS control actions required to achieve functional goals. 

The ISA will identify all safety functions, with particular attention focused on the nuclear safety 

evaluation and the nuclear criticality safety evaluation. 

The “Purpose” section of the document “Functional Classification List,” dated January 7, 2008, 

states that the list is a product of general safety principles, the basis-of-design documents, and 

the ISA. It is essentially a large table providing quality levels and seismic qualification levels by 

system. Section 2.2, “Approach,” lists the facility’s performance criteria, as follows: 

• Confinement of nuclear and radiochemical material with the use of 

o static or physical barriers, 

o dynamic means (ventilation systems) 

o emergency power 

• Prevention of a nuclear criticality incident with the use of 

o equipment geometry control 

o fissile material mass control 

o moderation control 

o criticality control 

o process control 

• Other items 

o fire detection and suppression 

o monitoring and alarm 

The applicant’s approach to functional requirements provides an acceptable definition of 

functions that can be and have been used as input to the rest of the HFE process. 

According to the LA, function allocation results in the assignment of control functions to 

personnel, systems, or a combination of the two. Most of the allocations are based on the 

reference plant design where the approach taken is to automate operations to the extent 

possible. Thus, the allocations are based largely on the operating experience of the reference 

plants. 

The allocations are then evaluated as part of the ISA. The Section 12.3 of LA states the 

following: 

Personnel activities are functionally allocated to take advantage of human 

strengths and to avoid demands that are not compatible with human capabilities. 

PrHAs for each process unit or workshop are performed and include the OER 

review for the unit. This is where the allocation is made to either an appropriate 

engineering control or to an Administrative Control (personnel action). HFE 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 10 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

evaluations or analyses on proposed Administrative IROFS are conducted to 

consider that the human interaction requirements will be compatible with human 

capability, under stated conditions or hypotheses. The HFE evaluations support 

the ISA in evaluating operator actions and inactions, including errors of omission 

and commission. 

The HEPP and HEIP describe the function allocation methodology in greater detail. 

HEPP Section 4 states that the MFFF function allocation is based largely on the reference plant 

design. It is acceptable to base MFFF predecessor functions on successful operation 

experience as long as the functions have not been modified and no other plant or procedure 

modifications negatively impact them. The HEPP states that operations at the MELOX and 

La Hague MFFF reference plants clearly demonstrate that automatic manufacturing processes 

produce the highest yield, lowest product variability, and highest and most consistent levels of 

quality for manufactured products. At the same time, both the chances and the consequences 

of an error or incident are greatly reduced. 

With respect to function allocation (FA) methodology, MFFF safety and reliability are enhanced 

by exploiting the strengths and weaknesses of personnel and system elements. HEIP Section 4 

states that FA will be based on HFE principles, in addition to technological and economic 

considerations, using a structured, well-documented methodology that seeks to provide 

personnel with logical, coherent, meaningful tasks. The HEIP indicates that the analysis 

considers the effects of interface management effects on situation awareness and workload. 

The items identified in the MOX plan include all the function allocation considerations in 

Figure 4.1 in NUREG-0711 (NRC, 2004). 

With respect to the role of the MFFF operators, HEPP Section 4 indicates that the allocation of 

tasks between human and machine subsystems for activities that support IROFS will support 

the basis design goals contained in DCS01 AAJ DS DOB C 40112, “Basis of Design for 

Instrumentation and Control,” to automate the MFFF operations to the fullest extent. HEIP 

Section 4 indicates that the main driver for function allocation is the allocation of the 

predecessor plant designs; thus, OER is the technical basis. The basic design goal of FA is 

high automation, as stated in the “Basis of Design for Instrumentation and Controls.” This is 

further elaborated in the “Basis for Instrumentation and Control Design” document, which 

contains statements on the benefits of automation referenced above. The model for the MFFF 

control systems will be the MELOX system, which is a fully automated manufacturing and 

processing control system. 

The staff has reviewed the applicant’s LA and supporting documentation and finds that the 

review criterion for function allocation is acceptable. The commitments made in the LA are 

consistent with the guidance provided in NUREG-1718 (NRC, 2000) and the regulatory 

requirements of 10 CFR § 70.61(e) and 10 CFR § 70.64(b)(2) and are acceptable to the staff. 

Review Criterion 12.4.3 D(ii)

Task Analysis Scope 

LA Section 12.5 addresses the task analysis scope and includes personnel activities 

identified as administrative IROFS. The scope of the task analysis is appropriately 

consistent with the scope of the overall program as discussed in SER Section 12.3.2. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 11 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

Identification and Analysis of Critical Tasks 

LA Section 12.1 addresses the identification of critical tasks, which are designated in the ISA as 

administrative IROFS. HEIP Section 5 states that there are over 200 such tasks. These will be 

examined to establish procedures, determine if they can be accomplished, and discover if 

human error can be introduced into the procedure. A task inventory will be prepared to list the 

IROFS tasks that operators and maintainers are to perform, along with a description of each 

task in behavioral terms. This provides an acceptable approach to identifying and analyzing 

critical tasks. 

Detailed Description of Personnel Demands (e.g., input, processing, and output) 

This subsection addresses the general task analysis (TA) methodology and summarizes key 

aspects of the methodology. In describing the general methodology, LA Section 12.5 

indicates that task descriptions include detailed descriptions of personnel demands, 

including input, processing, and output. The process begins with a gross level of analysis 

involving the development of detailed narratives describing the tasks that personnel must 

accomplish. More detailed evaluations will be made based on specific methods selected by 

the responsible engineer. 

HEIP Section 5 states that TA is the identification of task requirements for accomplishing 

functions allocated to personnel. TA can be conducted using many different methodologies. 

The desired type of information needed and its application will aid in selecting the appropriate 

technique and how it will be used. These considerations also determine the completeness of 

the analysis needed. The highest priority tasks (administrative IROFS) are deconstructed into 

their individual steps. The analyst suggests ways to make the task more efficient or suggests 

new tasks that more effectively support the goals. It is also important to discover where human 

errors are likely to be made and to attempt to prevent error. This portion of the TA should 

identify ways to advise the operator of an error just made, possible consequences of the 

uncorrected error, and how to correct the error. 

The HFE team will agree on what TA method to apply. The responsible engineer will conduct 

TA during final design (HEPP Section 5). 

HEIP Section 5.2 addresses specific methodologies. Generally, the method starts with a 

gross-level analysis (narrative of what personnel must do) that becomes more detailed (input, 

process, and output needed). HEIP Section 5.2 refers to Table 5, which is the task 

requirements table developed from NUREG-0711 (NRC, 2004). 

HEIP Section 5 identifies the following TA steps: 

Step 1—Information collection—After a task description is in place, the type of 

information needed to do the analysis has to be decided (refers to Table 5.1, 

Identification of Task Information). It includes rows such as task, cognitive task, 

identification of subtasks, grouping of subtasks, commonalities and 

interrelationships, importance of subtasks, frequency, sequencing, decisions, 

objectives, performance criteria, info required, knowledge employed, etc. Each 

row has a description of what the task information is. Table 5.2 identifies 

methods that can be used to collect information to be used in TA, including: 

observation, interview, focus group, existing documentation, checklist, 

questionnaire, and videotape. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 12 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

Step 2—Data recording—There are a variety of ways that data can be recorded 

and presented. A list of many types of data to be recorded are presented and 

are consistent with the task requirements table in NUREG-0711. 

Step 3—Data analysis—The final step is using the information to yield the basic 

data for design decisions. Five selected techniques are described in Table 5.4. 

These are: hierarchical TA, interface surveys, link analysis, operational 

sequence diagrams (OSDs), and timeline analysis. 

HEIP Appendix F gives an example TA recording form. It is in tabular format, with rows 

corresponding to task steps and columns for action, location, controls and displays, system 

response, confirmation required and how to confirm, and error of omission or commission 

observed. There is also heading information for IROFS, purpose of the task, equipment 

involved, special tools, task start cue, task stop cue, and total time. The form includes a set of 

14 questions, including considerations such as how often a task is accomplished, the skill 

needed, and whether a task depends on another task. 

HEPP Section 5 indicates that during TA, checks are done to ensure that operations has 

appropriate instrumentation and controls (I&C) available to confirm proper operation of the 

automated systems under all conditions. In addition, the TA will address the following: 

• minimum number of operators 

• minimum skills needed 

 

• allocation of monitoring and control tasks to achieve meaningful jobs and to address 

workload management 

HEPP Section 5 lists the task considerations and includes information similar to that found in 

Table 5.1 of NUREG-0711 (NRC, 2004). HEIP Section 5.1 defines additional task 

considerations. To ensure dependable and consistent human performance, the following 

should be addressed: 

• Conditions leading to overload (multitasking) or underload are important in examining 

IROFS performance. 

• Incorporation of reasonable margins may accommodate the consequences of 

inadequate performance. 

• Meaningful feedback on task performance is needed. 

• Designing for error tolerance to minimize human errors includes considerations such as 

automating the task, changing the task-loading condition, applying buffers such as time 

delays, and addressing significant findings in design, procedures, and training. 

HEPP Section 5 states that the TA will identify applicable operator time response 

requirements, where the ISA has credited human actions. The ability of the operator to 

respond in a timely manner should be assessed. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 13 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

HEPP Section 5 indicates that problem tasks (those that cannot be performed well, are 

confusing, or create a safety concern) will be identified and written as an HED for resolution. 

HEIP Section 5 also indicates that the product of the TA will be documented in a summary 

report. 

The methodology described by the applicant should result in a detailed description of personnel 

demands that includes input, processing, and output requirements for the tasks being analyzed, 

and meets the staff’s review criterion. 

Iterative Nature of the Analysis 

LA Section 12.5 indicates that TA is performed iteratively and becomes progressively more 

detailed over the design cycle. HEIP Section 5.2 also describes the iterative aspect of tasks 

analysis. This meets the staff’s review criterion. 

Incorporation of Job Design Issues 

LA Section 12.5 states that the TA methodology will address job design issues. (See also the 

job design discussion under “Detailed Description of Personnel Demands” above.) This meets 

the staff’s review criterion. 

TA Addresses Each Operating Mode for Each Personnel Activity 

LA Section 12.5 indicates that personnel activities identified as IROFS are identified for each 

operating mode, including startup, normal operations, emergency operations, and shutdown. 

This meets the staff’s review criterion. 

TA Results Support the FA 

LA Section 12.5 indicates that TA will confirm the results of the function analysis or the results 

may dictate a change in allocation. This meets the staff’s review criterion. 

The staff has reviewed the applicant’s LA and supporting documentation and finds that it meets 

the review criterion for TA’s. The commitments made in the LA are consistent with the guidance 

provided in NUREG-1718 (NRC, 2000) and the regulatory requirements of 10 CFR 70.61(e) and 

10 CFR 70.64(b)(2) and are acceptable to the staff. 

12.3.5 Human Systems Interface Design, Inventory, and Characterization 

12.3.5.1 Review Criterion 

Section 12.4 of NUREG-1718 provides Acceptance Criterion E for the review of HSI design. 

(Note that this criterion has several subparts. Brief titles have been added in brackets following 

each of the subparts for ease of reference in the evaluation that follows.)

E. HSI Design, Inventory, and Characterization 

The HSI design incorporates the functional allocation analysis and TA into 

the detailed design of safety-significant HSI components (e.g., alarms, 

displays, controls, and operator aids) through the systematic application 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 14 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

of HFE [HSI Design Inputs]. The HSI design includes the overall work 

environment, the work space layout (e.g., control room and remote 

shutdown facility layouts), the control panel and console design, the 

control and display device layout, and information and control interface 

design details [HSI Design Scope]. The HSI design process ensures the 

application of HFE to the HSI required to perform personnel activities [HSI 

Design Process]. The HSI design process excludes the development of 

extraneous controls and displays [Extraneous HSIs]. The HSI design 

documentation includes a complete HSI inventory and the basis for the 

HSI characterization [HSI Documentation]. 

The following section evaluates each of the five subcriteria separately. 

12.3.5.2 Evaluation 

HSI Design Inputs 

LA Section 12.6 indicates that the “HSI design is derived from the existing and proven design of 

the reference plants HSIs, modified for both cultural calibration purposes and U.S. safety 

requirements.” Additional inputs to the HSI design process come from a variety of sources, 

including the following: 

• Analyses of personnel task requirements performed in the earlier stages of the design 

process are used to identify the requirements for the HSIs. These analyses include the 

OER, the FRA and FA, and the TA, along with the evaluations of staffing, qualifications, 

and job analyses. 

• System requirements are interpreted as constraints imposed by the overall I&C system 

and are considered throughout the HSI design process. 

• Regulatory requirements are identified as inputs to the HSI design process. 

• The applicant’s human factors design guideline, which is consistent with the staff’s HSI 

design review guidance in NUREG-0700, “Human-System Interface Design Review 

Guidelines” (NRC, 2002). 

• Other requirements that may be identified and are input to the HSI design function 

allocation and task analyses. 

This information provides acceptable inputs to the HSI design process. 

HSI Design Scope 

LA Section 12.6 identifies the scope of the HSI design effort, including the HSI of the work 

environment, the work space layout, control panel and console design, control and display 

device layout, and information and control interface design. The HSI design avoids extraneous 

controls and displays and minimizes the incorporation of information, displays, controls, and 

features that unnecessarily complicate operator activities. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 15 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

HEPP Section 7 indicates that, for those HSI design and characterization elements not carried 

over from the reference facilities or for elements that were substantially changed for 

“Americanization,” the HSI design process translates function and task requirements into HSI 

characteristics. 

The process is applied to those HSIs involving IROFS and will also be applied to non-IROF 

HSIs where practical. The HSI design scope is appropriately consistent with the scope of the 

overall HFE program. 

HSI Design Process 

LA Section 12.6 describes the general process by which HSIs are designed. Inputs are used to 

develop the human factors design guide (HFDG). The HFDG provides HFE guidance used for 

both the design and evaluation of HSIs. The HFDG is intended to provide MFFF staff with an 

easy-to-use resource for human factors guidance. It addresses a broad range of human factors 

topics that pertain to automation, maintenance, human-machine interface, workplace design, 

documentation, system security, safety, the environment, and anthropometry. The HFDG will 

be subject to updates and revision as the need arises. Because the HFDG is an approved 

project document, it is revised, reviewed, approved, and maintained in accordance with 

approved project records management procedures. 

As noted in the review of the preceding criterion, the HSI design process will apply to those 

HSIs involving IROFS and will also be applied to non-IROF HSIs where practicable. 

The staff reviewed the HFE guidance provided in the HEIP pertaining to alarm system, displays, 

controls, communications, and labeling. In general, the staff finds the guidance provided to be 

consistent with the HFE principles described in NUREG-0700 (NRC, 2002) and acceptable to 

the staff. 

Extraneous HSIs 

LA Section 12.6 indicates that the HSI design avoids extraneous controls and displays and 

minimizes the incorporation of information, displays, controls, and features that unnecessarily 

complicate operator activities. This meets the staff’s review criterion. 

HSI Design Documentation

LA Section 12.6 indicates that the design documentation includes a complete HSI inventory and 

HSI design basis. HEPP Section 7 provides additional detail concerning HSI documentation. 

The documentation will include the basis for HSI requirements and design characteristics, 

including the results of tests and analyses performed. 

The staff has reviewed the applicant’s LA and supporting documentation and finds that the 

review criterion on HIS design is acceptable. The commitments made in the LA are consistent 

with the guidance provided in NUREG-1718 (NRC, 2000) and the regulatory requirements of 

10 CFR § 70.61(e) and 10 CFR § 70.64(b)(2) and are acceptable to the staff. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 16 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12.3.6 Staffing 

12.3.6.1 Review Criterion 

 

Section 12.4.3 of NUREG-1718 (NRC, 2000) provides Acceptance Criterion F for the review of 

staffing: 

F. Staffing 

Staffing is based on a review of the number and qualifications of 

personnel for each personnel activity during all plant operating conditions. 

The applicant conducts this review in a systematic manner that 

incorporates the functional allocation and task analysis results. 

Categories of personnel are based on the types of personnel activities. 

Staffing considerations include issues identified in the OER, functional 

allocation, HSI design, procedure development, and V&V. 

12.3.6.2 Evaluation 

Section 12.7 of the LA states that the MFFF organization will comprise five major groups: 

Business, Engineering, Licensing, Quality, and Plant Operations. Plant Operations is divided 

into the following subgroups: Operations, Maintenance, and Technical Support groups. The 

initial staffing levels are estimated and established based on experience with the reference 

plants that have been in operation for the last few decades in France and discussions with the 

NRC-licensed U.S. fuel assembly manufacturers. The LA also states that staffing will be 

updated based on results from the HFE program, including OER, TA, HSI design, procedure 

development, and V&V. The evaluation will also consider the number and complexity of tasks 

determined from the startup and test phase of the MFFF. 

HEIP Section 6.2, “Objectives,” states that there will be a systematic analysis applying the 

results of the HFE elements of FA and TA to the number and qualifications of personnel. These 

analyses will also consider the other HFE elements (OER, HSI design, procedures, and V&V). 

HEIP Section 6.1, “Purpose,” states that ultimately the operations manager and the operations 

group will make the final staffing and qualification decisions based on input from the HFE 

program elements. The HEIP also discusses the roles of different staff positions, including plant 

management, operators, shift supervisor, and maintenance personnel. 

HEIP Section 6.6, “Role Developments,” states that the operations group defines the 

responsibilities and qualifications for individuals to assume their positions. It outlines “core 

competencies” that will be needed. Figure 6.1 of HEIP Section 6.6 shows the expected MFFF 

organization for full production operation, which has a staff of 787 personnel. 

LA Section 12.7.1.2 states that shift staff teamwork and communications is based on the 

reference plants and NRC-licensed fuel assembly manufacturers. The applicant noted in a 

response to a request for additional information that staffing will probably be modified when 

more details become available. Generally, the operations manager meets with the staff to 

provide top-level guidance for shift work. The aqueous polishing manager and the MOX 

processing manager develop workbooks containing instructions for their shifts. The operators 

will have workbooks with specific instructions for the shift and also for recording the results of 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 17 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

the process. During shift changeover, approximately 30 minutes of overlap are allowed for the 

operating shift to brief and update the oncoming shift. 

The staff has reviewed the applicant’s LA and supporting documentation and finds that the 

review criterion on staffing is acceptable. The commitments made in the LA are consistent with 

the guidance provided in NUREG-1718 (NRC, 2000) and the regulatory requirements of 

10 CFR § 70.61(e) and 10 CFR § 70.64(b)(2) and are acceptable to the staff. 

12.3.7 Procedure Development 

12.3.7.1 Review Criterion 

Section 12.4.3 of NUREG-1718 (NRC, 2000) provides Acceptance Criterion G for the review of 

procedure development: 

G. Procedure Development 

The applicant’s procedure development for personnel activities 

incorporates HFE principles and criteria, along with all other design 

requirements, to develop procedures that are technically accurate, 

comprehensive, explicit, easy to utilize, and validated consistent with the 

acceptance criteria in Section 15.5.4 of this SRP. Because procedures 

are considered an essential component of the HSI design, they are 

derived from the same design process and analyses as the other 

components of the HSI (for example, displays, controls, operator aids) 

and subject to the same evaluation processes. Procedures include, as 

needed to support the personnel activity: generic technical guidance, 

plant and system operations, abnormal and emergency operations, tests 

(for example, preoperational, startup, and surveillance), and alarm 

response. 

12.3.7.2 Evaluation 

Types of Procedures

LA Section 12.8, “Procedure Development,” states that procedures are essential to MFFF safety 

because they will guide personnel interactions with plant systems and responses to a variety of 

process-related events. Section 12.8 also states that the MFFF will include the following types 

of procedures: generic technical guidance, plant and system operations, abnormal and 

emergency operations, tests (e.g., preoperational, startup, and surveillance), and alarm 

response. LA Section 12.8 refers to MOX Project Quality Assurance Plan (MPQAP) for a more 

detailed description of MFFF procedures. The operating procedures include production 

procedures (such as normal, off-normal, temporary, shutdown, and alarm response), 

maintenance procedures (such as preventive and corrective maintenance, calibration, 

surveillance, functional testing, and work control), and emergency procedures. 

Procedures will be developed for the following activities: 

• operations—normal, off-normal, emergency, alarm response, startup, and shutdown 

• maintenance 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 18 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

• surveillance and testing 

• management control processes 

In HEIP Section 9.12, the HFE list of MFFF procedures provides examples of the categories of 

procedures that will be developed. 

The ISA results are used in identifying necessary procedures. Also, Section 9.3, “Basis 

Documentation,” of the IP states that procedures are derived from management basis 

documents, design criteria, vendor information, engineering standards, drawings, and 

specifications. 

In summary, the staff has reviewed the applicant’s LA and supporting documentation and finds 

that the review criterion for procedures planned is acceptable. 

HFE for Procedures

LA Section 12.8 states that “MFFF procedures for IROFS, including administrative control 

IROFS, incorporate HFE principles and other design criteria to develop procedures that are 

technically accurate, comprehensive, easy to utilize, and validated.” Section 12.8 further states 

that “the scope of the procedures for HFE review will include Administrative IROFS covering 

emergency operating procedures; procedures for startup, operation, and shutdown; procedures 

for recovery from a “frozen” process; alarm response; and possible abnormal conditions.” LA 

Section 12.8.1 states, “Procedures will incorporate appropriate HFE principles, practices and 

guidance criteria (NUREG-0700) into the text format and presentation to aid legibility, 

readability, and comprehension. Procedures will be technically accurate, comprehensive, 

explicit and validated.” 

HEIP Section 9 describes the procedure development process and the interaction of procedure 

development with the HFE program. Section 9.4 notes that TA and HSI design elements 

provide information needed by the procedure writers. 

HEIP Section 9.13 describes how the operations staff is actively involved in the development of 

the procedures. Section 9.11 provides the required elements and format to be used for the 

procedures. Section 9.8, “Responsibilities,” states that the MFFF HFE team will review the 

writers’ style guides and the IROFS procedures. 

The planned HFE for procedures at the MFFF is acceptable. 

Procedure V&V 

LA Section 12.8 states, “All applicable procedures will be verified and validated for correctness 

and that they can be carried out as required. Changes or modifications to procedures will be 

again verified.” Section 12.8.1 states, that the HFE team will verify the hardcopy administrative 

control procedures (IROFS) of ISA-required administrative controls and validate the 

administrative procedures by observing operator walk-through or talk-through. 

The MPQAP states that the procedure preparation methodology will ensure that plant 

procedures are validated through field tests. The MPQAP also states that 

 “Operating and administrative procedures are reviewed and approved by management 

responsible and accountable for the associated operation. Prior to initial use or after major 

revisions, production and maintenance procedures are verified and validated.” 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 19 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

Section 8 of the HEPP states, that all applicable procedures will be verified and validated to 

ensure that, they can be carried out as required. Section 9.8 of the HEIP states, that the HFE 

team will verify and validate the IROFS procedures. 

The staff finds the planned V&V for procedures for the MFFF acceptable. 

Overall, the HFE aspects of the procedure development program are acceptable. The 

commitments made in the LA are consistent with the guidance provided in NUREG-1718 

(NRC, 2000) and the regulatory requirements of 10 CFR § 70.61(e) and 10 CFR § 70.64(b)(2) 

and are acceptable to the staff. 

12.3.8 Training Program Development 

12.3.8.1 Review Criterion 

Section 12.4.3 of NUREG-1718 (NRC, 2000) provides Acceptance Criterion H for the review of 

training program development: 

H. Training Program Development 

The applicant’s training program development addresses all personnel 

activities. The training program development indicates how the 

knowledge and skill requirements of personnel will be evaluated, how the 

training program development is coordinated with the other activities of 

the HFE design process, and how the training program will be 

implemented in an effective manner consistent with human factors 

principles and practices. The training program development should 

address the areas of review and acceptance criteria described in 

Section 15.4.4 of this SRP and should result in a training program that 

provides personnel with the qualifications commensurate with the 

personnel activities. 

12.3.8.2 Evaluation 

Section 12.9 of the LA states that the operator training program for the MFFF will address active 

and passive engineered IROFS and administrative control IROFS. Section 12.9 also states, “All 

personnel (except visitors) that have a need for MFFF plant access will be provided a General 

Employee Training (GET), along with more specified training according to position 

requirements. All the various functional groups of employees will be required to be trained in 

the aspects of their job responsibilities.” The “Training and Qualification section of the MPQAP 

explains the systematic approach to training that is used at the MFFF and discusses the 

organization and management of training, the analysis of functional areas requiring 

training/qualification, the position training requirements, the use of learning objectives, 

organization of instruction, evaluation of trainee learning, systematic evaluation of training 

effectiveness, and retraining. 

HEPP Section 9, “Training,” discusses training programs and stresses the importance of training 

for safe and reliable operation of the MFFF. It also notes that personnel can perform only those 

functions for which training requirements are met. Personnel are trained for both normal 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 20 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

operations and emergencies. Sections 9.1 through 9.5 describe a systematic approach to 

training that includes learning objectives, a comprehensive outline of knowledge, skills, and 

abilities, design and implementation of training, evaluation of trainee mastery, and evaluation 

and revision of training. 

HEPP Section 9.4 states that trainees will be evaluated using methods that include written and 

oral tests, walk-throughs, and evaluation of on-the-job performance. 

The HEIP provides more detailed information on training. Sections 10.3 through 10.9 describe 

the systematic approach to training to be used at the MFFF, as follows: 

10.3 Training Program Development 

10.4 General Approach Outline 

10.5 Organization and Management of Training 

10.6 Learning Objectives 

10.7 Control of Training Program 

10.8 Systematic Evaluation of Training Effectiveness and Modification of Training 

10.9 Periodic Retraining and Continuing Assurance 

Section 10.3 states that the training program development process will be coordinated with 

other HFE program activities. Section 10.6 states that learning objectives are derived from the 

HFE program elements of FRA, FA, TA, HSI design, and plant procedures. Section 10.11, 

“Personnel Qualifications,” notes that minimum qualifications will be commensurate with 

assigned function responsibility. Section 10.13 states that the operations and maintenance 

organization is provided with training to ensure that its personnel can safely perform their 

assigned roles and work functions while meeting regulatory and product quality requirements. 

The staff finds that the MFFF LA and supporting documentation meet this review criterion for the 

HFE aspects of training program development. The commitments made in the LA are 

consistent with the guidance provided in NUREG-1718 (NRC, 2000) and the regulatory 

requirements of 10 CFR § 70.61(e) and 10 CFR § 70.64(b)(2) and are acceptable to the staff. 

12.3.9 Human Factors Verification and Validation 

12.3.9.1 Review Criterion 

Section 12.4.3 of NUREG-1718 (NRC, 2000) provides Acceptance Criterion I for the review of 

human factors V&V: 

I. Verification & Validation 

V&V confirms that the design incorporates HFE to HSI in a manner that 

enables the successful completion of personnel activities. The V&V 

should be applied to personnel activities and HSI design. The V&V 

process should consist of the following: 

i. HSI task support verification: HSI components are appropriately 

provided for personnel activities through HSI task support 

verification. The verification shows that each HSI identified the 

task analysis and that the HSI design is appropriately provided, 

yet minimizes the incorporation of information, displays, controls, 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 21 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

and decorative features that unnecessarily complicate personnel 

activities. 

ii. HFE design verification: The HFE design verification shows that 

each HSI identified for a personnel activity incorporated HFE into 

the design. Deviations from accepted HFE principles and 

guidelines should be justified or documented for 

resolution/correction. If all HSI components are not addressed by 

HFE design verification, then an alternative multidimensional 

sampling methodology should be used to assure comprehensive 

consideration of the safety significance of HSI components. The 

sample size should be sufficient to identify a range of significant 

safety issues. 

iii. Integrated system validation: The applicant commits to a 

performance-based evaluation of the integrated design to ensure 

that the HFE/HSI supports safe operation of the plant. Integrated 

system validation is performed after HFE problems identified in 

HFE design activities are resolved or corrected because these 

may negatively affect performance and, therefore, validation 

results. Validation is performed by evaluating personnel activities 

using appropriate measurement tools. All personnel activities 

should be tested and found to be adequately supported in the 

design, including personnel activities outside the control room. 

iv. Human factors issue resolution verification: The applicant verifies 

that HFE issues identified during the design process were 

addressed and resolved. Issue resolution verification should be 

documented in the HFE issue tracking system established by the 

HFE team. Issues that cannot be resolved until the HSI design is 

constructed, installed, and tested should be identified and 

incorporated into the final HFE/HSI design verification. 

v. Final HFE/HSI design verification: The applicant should commit to 

performing a final HFE/HSI design verification if the applicant 

cannot demonstrate that it has fully evaluated the actual 

installation of the final HSI design in the plant through the V&V 

activities described above. Final HFE/HSI design verification 

should demonstrate that in-plant HFE design implementation 

conforms to the HFE design as modified V&V activities. 

V&V activities should be performed in the order listed above, as necessary. 

However, the applicant may find that it is necessary to iterate in order to address 

design corrections and modifications that occur during V&V. 

The following section separately evaluates these six subcriteria (the sixth corresponds to the 

final unnumbered paragraph of the above criterion in NUREG-1718). 

12.3.9.2 Evaluation 

Review Criterion 12.4.3 I(i)
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 22 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

LA Section 12.10.1 addresses task support verification and indicates that it will verify that the 

HSI design is appropriately provided yet minimizes the incorporation of alarms, information, 

displays, and control capabilities that unnecessarily complicate personnel actions. 

LA Section 12.10 indicates that HSI task support verification is an evaluation to verify that the 

HSI supports personnel task requirements as defined by task analyses. HSI task support 

verification determines whether the HSI provides all alarms, information, and control capabilities 

required for personnel tasks. The criteria for task support verification will come from earlier task 

analyses of HSI requirements for performance of personnel tasks. HEDs are identified for 

(1) personnel task requirements that are not fully supported by the HSI and (2) the presence of 

HSI components that may not be needed to support personnel tasks or that may impede 

personnel tasks. HFIP Sections 11.8.1, “Inventory and Characterization,” and 11.8.2, “Task 

Support Verification,” describe the task support verification methodology in greater detail. 

In summary, the applicant has described an acceptable approach to HSI task support 

verification that meets the guidance provided in Review Criterion 12.4.3 I(i). The commitments 

made in the LA are consistent with the guidance provided in NUREG-1718 (NRC, 2000) and the 

regulatory requirements of 10 CFR 70.61(e) and 10 CFR 70.64(b)(2) and are acceptable to the 

staff. 

Review Criterion 12.4.3 I(ii)

LA Section 12.10 indicates that HFE design verification is a static evaluation to verify that the 

HSI is designed to accommodate human capabilities and limitations as reflected in HFE 

guidelines, primarily using those guidelines provided in NUREG-0700 (NRC, 2002). HEDs are 

identified if the design is inconsistent with HFE guidelines. LA Section 12.10.2 describes the 

methodology for HFE design verification. 

The HEPP indicates that the HSI design is compared with the MFFF style guide to perform HFE 

design verification. 

HFIP Section 11.8.3 describes the HSI design verification methodology. The methodology 

described is essentially taken directly from NUREG-0711 (NRC, 2004). 

In summary, the applicant has described an acceptable approach to HSI task support 

verification that meets the guidance provided in Review Criterion 12.4.3 I(ii). The commitments 

made in the LA are consistent with the guidance provided in NUREG-1718 (NRC, 2000) and the 

regulatory requirements of 10 CFR § 70.61(e) and 10 CFR § 70.64(b)(2) and are acceptable to 

the staff. 

Review Criterion 12.4.3 I(iii)

LA Section 12.10.3 indicates that integrated system validation (ISV) is an evaluation using 

performance-based tests to determine whether an integrated system design (i.e., hardware, 

software, and personnel elements) meets performance requirements and acceptably supports 

safe operation of the MFFF. ISV will be conducted after significant HEDs identified in 

verification reviews have been resolved. 

LA Section 12.10.3 identifies detailed ISV objectives, which include validation that the tasks 

associated with administrative IROFS can be accomplished within time and performance 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 23 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

criteria. Other objectives are identified as well. Together, these objectives should lead to a 

comprehensive evaluation of the integrated system that meets the staff’s review criterion. 

The applicant’s ISV methodology has not been developed yet. Instead, the LA commits to 

preparing an ISV methodology with general considerations of what a methodology should 

address. The ISV considerations identified in the LA include: 

• The participants will be MFFF personnel. 

• The scenarios to be used will include the administrative IROFS. 

• Since no simulator will be available to conduct ISV scenarios, alternative methodologies, 

such as walk-throughs and observation of operation actions are the methods most likely 

to be used. 

• Performance measures will be developed to validate that the operator understands the 

state of the system process, can navigate process screens on the Supervisory Control 

and Data Acquisition (SCADA) units, knows how to carry out emergency procedures, 

and has all the information and controls needed to accomplish the task. 

• ISV acceptance criteria will include the requirement that personnel actions associated 

with administrative IROFS are 100 percent correct. 

• HEDs are identified if performance criteria are not met. 

In summary, the applicant has described a high-level approach to ISV. The commitments 

associated with this approach are made in the LA and are consistent with the guidance provided 

in NUREG-1718 (NRC, 2000) and the regulatory requirements of 10 CFR § 70.61(e) and 

10 CFR § 70.64(b)(2) and are acceptable to the staff. 

Review Criterion 12.4.3 I(iv)

LA Section 12.10.4 indicates that the resolution of HEDs identified during the design process 

will be verified prior to plant operation. Any significant HFE issues are reviewed, addressed, 

and documented. LA Section 12.10 indicates that HED resolution is an evaluation to provide 

reasonable assurance that the HEDs identified during the V&V activities have been acceptably 

assessed and resolved. HED resolution is an activity that should be performed iteratively with 

V&V. The MFFF process lead engineer or process responsible engineer may address and 

resolve issues identified during a V&V activity before conducting other V&V activities. 

This commitment to use this methodology should ensure that identified HFE issues are 

resolved. 

In summary, the applicant has described an acceptable approach to HFE issue resolution 

verification that meets the guidance provided in Review Criterion 12.4.3 I(iv). The commitments 

made in the LA are consistent with the guidance provided in NUREG-1718 (NRC, 2000) and the 

regulatory requirements of 10 CFR § 70.61(e) and 10 CFR § 70.64(b)(2) and are acceptable to 

the staff. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 24 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

Review Criterion 12.4.3 I(v)

LA Section 12.10.5 indicates that the final (i.e., as-built) HSIs, procedures, and training program 

are compared with the detailed design description and HFDG to verify that they conform to the 

design that resulted from the HFE design process activities. The LA further indicates that 

aspects of the design not addressed during the V&V are evaluated later using an appropriate 

strategy or method (e.g., main control room noise and HVAC). Identified discrepancies are 

either corrected or justified. 

Section 11 of the HEPP presents additional information, including the following: 

• The design implementation verifies aspects of the design that are either 

partially verified or unverified prior to operation at the site. 

• The final as-built HSIs, procedures, and training program are compared 

with the detailed design description to verify that they conform to the 

design that resulted from the HFE design process activities. 

• HFE-related issues documented in the HFE issues tracking system and 

the MFFF project Action Tracker will be verified as having been 

adequately addressed. 

HEIP Section 12.4, “Design Implementation Methods,” provides more detail on the 

implementation of the design. 

This methodology should demonstrate that the final HSI conforms to the verified and validated 

design and that the design features not assessed in earlier V&V activities have been evaluated. 

In summary, the applicant has described an acceptable approach to final HFE/HSI design 

verification that meets the guidance provided in Review Criterion 12.4.3 I(v). The commitments 

made in the LA are consistent with the guidance provided in NUREG-1718 (NRC, 2000) and the 

regulatory requirements of 10 CFR § 70.61(e) and 10 CFR § 70.64(b)(2) and are acceptable to 

the staff. 

Review Criterion 12.4.3 I(vi)

LA Section 12.10 states that the preferred order is HSI task support verification, HFE design 

verification, and ISV, although iteration may be necessary. The HEPP and HFIP describe the 

order of V&V activities consistent with the criterion. However, Section 11.2 of the HFIP notes 

that it may be necessary to iterate portions of some activities in order to address design 

corrections and modifications that arise during V&V. This type of iteration is necessary and 

acceptable. 

In summary, the applicant has described an acceptable approach to scheduling V&V activities 

that meets the guidance provided in Review Criterion 12.4.3 I(vi). The commitments made in 

the LA are consistent with the guidance provided in NUREG-1718 (NRC, 2000) and the 

regulatory requirements of 10 CFR § 70.61(e) and 10 CFR § 70.64(b)(2) and are acceptable to 

the staff. 

12.4 Overall Evaluation Findings
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

12 - 25 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

The staff reviewed the application of HFE to personnel activities described in the LA to possess 

and use radioactive material at the MFFF according to Chapter 12 of NUREG-1718 (NRC, 

2000). The staff evaluated the LA and related HFE plans against the guidance contained in 

NUREG-1718 and the regulatory requirements related to HFE. 

The staff concludes that the applicant included commitments that applied HFE to personnel 

activities identified as IROFS, consistent with the results of the ISA, and that its personnel 

activities meet the requirements associated with human factors given in 10 CFR Part 70. 

REFERENCES 

10 CFR Part 70 U.S. Code of Federal Regulations, “Domestic Licensing of Special Nuclear 

Material, Part 70, Chapter I, Title 10, “Energy.” 

(MOX, 2010a) Duke Cogema Stone & Webster, “Mixed Oxide Fuel Fabrication Facility License 

Application,” Aiken, SC, March 2010. 

(MOX, 2010b) Duke Cogema Stone & Webster, “Mixed Oxide Fuel Fabrication Facility 

Integrated Safety Analysis Summary,” Aiken, SC, March 2010. 

(NRC, 2009) Memorandum from David Tiktinsky (NRC) to Margie Kotzalas, In-Office Review 

Summary—Human Factors, June 26, 2009. 

(NRC, 2008) Memorandum from David Tiktinsky (NRC) to Margie Kotzalas, In-Office Review 

Summary—Human Factors, March 18, 2008. 

(NRC, 2004) U.S. Nuclear Regulatory Commission, NUREG-0711, Revision 2, “Human Factors 

Engineering Program Review Model,” Washington, DC, February 2005. 

(NRC, 2002) U.S. Nuclear Regulatory Commission, NUREG-0700, “Human-System Interface 

Design Review Guidelines,” Washington, DC, May 2002. 

NRC (2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” Washington, DC, 

August 2000. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

13 - 1

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

13.0 SAFEGUARDS AND SECURITY

13.1 Physical Protection

The purpose of the review was to determine that the applicant has committed to having a 

physical protection system that provides high assurance that activities involving Special Nuclear 

Material (SNM) are not inimical to the common defense and security and do not constitute an 

unreasonable risk to the public health and safety. 

MOX Services submitted a Physical Protection Plan (PPP) (MOX, 2010a), a Training and 

Qualification Plan (T&QP) (MOX, 2010b), and a Safeguards Contingency Response Plan 

(SCRP) (MOX, 2010c) as part of its application to possess and use radioactive material at the 

MFFF. All three of these plans were submitted as classified documents.

13.1.1 Regulatory Requirements 

The regulatory requirements for the MFFF are: 

• 10 CFR 73.45, Performance capabilities for fixed site physical protection systems and 

10 CFR Part 73.46, Fixed site physical protection systems, subsystems, components, 

and procedures.

• 10 CFR Part 73, Appendix B—General Criteria for Security Personnel, Appendix CNuclear Power Plant Safeguards Contingency Plans, and Appendix H-Weapons 

Qualification Criteria.

13.1.2 Regulatory Guidance 

The regulatory guidance used by the staff in the review of the physical security related 

submittals was: 

• Regulatory Guide (RG) 5.70 Guidance for the Application of the Theft and Diversion of 

Category I Special Nuclear Material Design-Basis Threat in the design, development, 

and implementation of a physical security program that meets 10 CFR 73.45 and 73.46 

requirements (NRC, 2007) (Document is classified CONFIDENTIAL-NSI).

• NUREG 1718, Standard Review Plan for the Review of an Application for a Mixed Oxide 

(MOX) Fuel Fabrication Facility (NRC, 2000a).

• NUREG/CR-6667, Standard Review Plan for Safeguards Contingency Response Plans 

for Category I Fuel Facilities (NRC, 2000b).

• NUREG/CR-6668, Standard Review Plan for Training and Qualification Plans for 

Security Personnel at Category I Fuel Facilities (NRC, 2000c).

13.1.3 Staff Review and Analysis 

MOX Services submitted a PPP, T&QP, and a SCRP as part of its application to possess and 

use radioactive material at the MFFF. All three of these plans were classified documents.
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

13 - 2

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

The plans stated above referenced a MFFF Final Design Vulnerability Assessment Study 

(FDVAS) dated April 15, 2008, (MOX, 2008), and Penetration Delay Analysis of the MFFF 

Barriers Report generated by Sandia National Laboratories, undated, (MOX). Both reports were 

used to justify the use of alternate security methods as authorized in 10 CFR 73.46(a). The 

staff reviewed both documents submitted by the Applicant. 

In the plans, the applicant requested the use of alternate methods for numerous areas at the 

MFFF. The results of the review and analysis of the alternate methods are classified SECRET 

and are not publicly available. 

For information purposes, MOX Services was provided with the Category I (NRC, 2002) and 

Design Basis Threat (DBT) Interim Compensatory Measures Orders (ICMO) to assist in the 

design of the Physical Protection System (NRC, 2003). The ICMOs were incorporated into the 

PPP, SCRP, and T&QP that were submitted as part of the license application process. The 

Orders will be formally issued in the future. The licensee will then be required to review the 

applicable plans to ensure that the Orders are incorporated as required and are adequately 

addressed. Since the Orders have not been officially issued, the staff cannot assess the degree 

to which the Order requirements have been incorporated into the security plans until after the 

Orders are officially issued.

13.1.4 Evaluation Findings

The NRC staff’s review of the PPP, for the protection of Strategic Special Nuclear Materials 

(SSNM) contains information that has been marked by the Applicant as “CONFIDENTIAL-NSI” 

(SECRET when Appendix C is attached) pursuant to 10 CFR 2.390. NRC staff reviewed the 

applicant’s PPP for fixed site physical protection of SSNM. The methods, alternate methods, 

and procedures outlined in the PPP satisfy or sometimes exceed the performance objectives, 

systems capabilities, and reporting requirements specified in 10 CFR 73.45 and 73.46. The PPP 

for the facility is acceptable and provides reasonable assurance that the requirements for the 

physical protection of SSNM will be met.

The NRC staff’s review of the applicant’s SCRP contains information that has been marked by 

the applicant as “CONFIDENTIAL-NSI” pursuant to 10 CFR 2.390. The methods, alternate 

methods, and procedures outlined in the SCRP satisfy or sometimes exceed the performance 

objectives, systems capabilities, and reporting requirements specified in 10 CFR 73.45, 73.46, 

and Part 73 Appendix C. The SCRP for the facility is acceptable and provides reasonable 

assurance that the requirements for the physical protection of SSNM will be met.

The NRC staff’s review of the applicant’s T&QP, contains information that has been marked by 

the applicant as “CONFIDENTIAL-NSI” pursuant to 10 CFR 2.390. The methods, alternate 

methods, and procedures outlined in the T&QP satisfy or sometimes exceed the performance 

objectives, systems capabilities, and reporting requirements specified in 10 CFR 73.45, 73.46, 

and part 73 Appendix B. The T&QP for the facility is acceptable and provides reasonable 

assurance that the requirements for the physical protection of SSNM will be met.

REFERENCES

 

(NRC, 2000a) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” Washington, 

DC, August 2000.

(NRC, 2000b), U.S. Nuclear Regulatory Commission, NUREG/CR-6667, Standard review plan 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

13 - 3

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

for safeguards contingency response plans for Category I fuel facilities, Washington, D.C, May 

2000.

(NRC, 2000c), U.S. Nuclear Regulatory Commission, NUREG/CR-6668, Standard review plan 

for training and qualification plans for security personnel at Category I fuel facilities, 

Washington, D.C., May 2000

(NRC, 2002) Interim Compensatory Measure Order number EA 02-CAT I, Washington, DC, 

August 21, 2002. (Document is CONFIDENTIAL-NSI)

(NRC, 2003) Interim Compensatory Measure Order number EA 03-087, Design Basis Threat, 

Washington, DC, April 29, 2003. (Document is CONFIDENTIAL-NSI)

(MOX, 2008) MFFF Final Design Vulnerability Assessment Study (FDVAS), Aiken, SC April 15, 

2008 (Document is SECRET), 

(MOX) Penetration Delay Analysis of the MFFF Barriers Report, Sandia National Laboratories, 

Albuquerque, NM, undated, (Document is CONFIDENTIAL-NSI)

(MOX, 2010a) Revision 3 of the Physical Protection Plan (PPP), Aiken, SC, May, 2010 with 

page changes dated September 30, 2010, (Document is CONFIDENTIAL-NSI).

(MOX, 2010b) Revision 2 of the Training and Qualification Plan (T&QP), Aiken, SC, May, 2010 

with page changes dated September 30, 2010, (Document is CONFIDENTIAL-NSI).

(MOX, 2010c) Revision 2 of the Safeguards Contingency Response Plan (SCRP), Aiken, SC, 

May 2010, (Document is CONFIDENTIAL-NSI). 

(NRC, 2007) U.S. Nuclear Regulatory Commission, Regulatory Guide (RG) 5.70 Guidance for 

the application of the theft and diversion of Category I special nuclear material design-basis 

threat in the design, development, and implementation of a physical security program that 

meets 10 CFR 73.45 and 73.46 requirements, Washington, D.C, September 2007, (Document 

is CONFIDENTIAL-NSI). 

10 CFR Part 73, Physical Protection of Plants and Materials

13.2 Material Control and Accounting

The purpose of this review was to verify that the applicant, Shaw AREVA MOX Services, LLC 

(MOX Services), provided sufficient information in the Mixed Oxide Fuel Fabrication Facility 

(MFFF) Fundamental Nuclear Material Control Plan (FNMCP) (MOX, 2010) for the staff of the 

U.S. Nuclear Regulatory Commission (NRC) to determine that the material control and 

accounting (MC&A) program meets the applicable regulatory requirements in Title 10 of the 

Code of Federal Regulations (10 CFR) Part 74, “Material Control and Accounting of Special 

Nuclear Material.” Specifically, the review is to ensure that the applicant’s FNMCP describes 

how an MC&A system will be established, implemented, and maintained, and to ensure that the 

MC&A system is adequate to protect against, detect, and respond to the loss or theft of strategic 

special nuclear material (SSNM) by achieving the following five performance objectives stated in 

10 CFR 74.51(a): 

A. Prompt investigation of anomalies potentially indicative of SSNM losses; 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

13 - 4

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

B. Timely detection of the possible abrupt loss of five or more formula kilograms (FKG) of 

SSNM from an individual unit process; 

C. Rapid determination of whether an actual loss of five or more FKG occurred; 

D. Ongoing confirmation of the presence of SSNM in assigned locations; and 

E. Timely generation of information to aid in the recovery of SSNM in the event of an actual 

loss. 

13.2.1 Regulatory Requirements

The NRC specifies the requirements for MC&A, including provisions for reports and regulatory 

inspections, in 10 CFR Part 74.

13.2.2 Regulatory Acceptance Criteria

The FNMCP must meet the regulatory requirements specified in 10 CFR Part 74. The NRC 

staff used the following guidance to determine if the applicant’s FNMCP meets the requirements 

in 10 CFR Part 74:

• NUREG-1718, “Standard Review Plan for the Review of an Application for a Mixed 

Oxide (MOX) Fuel Fabrication Facility” (NRC, 2000)

• NUREG-1280, “Standard Format and Content Acceptance Criteria for the Material 

Control and Accounting (MC&A) Reform Amendment: 10 CFR Part 74, Subpart E,” 

Revision 1 (NRC, 1995)

• NUREG/BR-0006, Revision 7, “Instructions for Completing Nuclear Material Transaction 

Reports (DOE/NRC Forms 741 and 740M)” (NRC 2008)

• NUREG/BR-0007, Revision 6, “Instructions for the Preparation and Distribution of 

Material Status Reports (DOE/NRC Forms 742 and 742C)” (NRC 2009)

• NUREG/BR-0096, “Instructions and Guidance for Completing Physical Inventory 

Summary Reports” (NRC, 1992)

13.2.3 Staff Review and Analysis

The staff reviewed and evaluated information provided by the applicant in the MFFF FNMCP 

(MOX, 2010) for the proposed MC&A program. The staff reviewed the following aspects of the 

MC&A program to ensure that the applicant’s FNMCP meets the five performance objectives 

outlined above:

- Process monitoring

- Item monitoring

- Alarm resolution

- Qualtiy assurance and accounting
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

13 - 5

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

13.2.3.1 Process Monitoring

For each unit process, the applicant must establish a production quality control program capable 

of monitoring the status of material in process. To that end, the FNMCP identifies the two main 

operation processes and segments them into process control units and related measurement 

points that allow for monitoring the status of licensed materials in process. 

The applicant described adequate material control tests for each process unit that has at least a 

95 percent chance of detecting potential abrupt material losses of five FKG. The plan also calls 

for the evaluation and update of the action thresholds on a semiannual basis and outlines the 

ability to detect material losses involving credible substitute materials. 

The staff concludes 

the description of the process subdivision is acceptable because it satisfies test criteria for the 

category of material being processed, and meets the unit detection requirements and 

associated measurement points and parameters in accordance with 10 CFR 74.53.

The staff concludes that 

the applicant's description of the material control test is adequate per 10 CFR 74.53(b)(1) 

because one is provided for each process control unit, and a system of material control tests is 

confirmed for detecting abrupt loss of SSNM from single process units or locations within the 

facility.

The applicant also identified credible material substitutions and methods of testing for 

substitution or of controlling the substitute material to prevent or detect attempts at substitutions. 

The applicant also provided a basis for material and location categorization, including the 

classification of inaccessible locations and a listing of material types exempted from the abrupt 

loss detection tests, with respective locations and bases for exemption. 

The description of the process monitoring program includes trend analysis techniques and 

decision criteria to indicate trickling material diversions. 

Staff confirmed that the 

applicant identified the nuclear material locations within the facility classified as inaccessible and 

provided supporting rationale per 10 CFR 74.53(b)(2).

The staff concludes that the applicant's

trend analysis is adequate because it meets the requirements of 10 CFR 74.53(b)(3) for 

monitoring sequences of process differences from material control tests, including the decision 

criteria for ascertaining when a significant trend exists.

The staff evaluated the applicant’s process monitoring program and found that this program 

contains adequate system features to detect abrupt losses and monitor the status of material in 

process, including process subdivisions and measurement points, material control tests, 

material classification, location categorization, material substitution, trend analysis, material 

exemptions, and research and development operations. The staff found that the applicant is 

capable of implementing a process monitoring program that permits effective functioning of the 

MC&A system and ensures that MC&A program performance will conform to the requirements 

in 10 CFR 74.53, “Process Monitoring.”

13.2.3.2 Item Monitoring

The applicant must establish a process to verify the presence and integrity of SSNM items 

on a statistical sampling basis. To that end, the FNMCP identifies and describes an item 

monitoring program that establishes the capability to provide timely plantwide detection of the 

loss of items that total two FKG of plutonium, with 99-percent power of detection. The staff 

concludes that the applicant can detect, in a timely manner, the loss of items that total two FKG

of plutonium or more, and verify the presence and integrity of selected nuclear material items on 

an established periodic detection basis because it has established an adequate item monitoring 

program, per the requirements of 10 CFR 74.55(a). 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

13 - 6

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

The applicant described an identification system that includes attributes to ensure unique item 

identification. The description also includes the system features that precludes falsification or 

makes prompt detection of such attempts. Staff also determined that the applicant’s item 

identification system is adequate because it possesses control measures that ensure unique 

item identification, precludes or make prompt detection of such attempts highly probable by 

using numbered containers, printed labels, and tamper-safe seal numbers for unique 

identification, per the requirements of 10 CFR 74.55(a).

To establish the capability to detect a five FKG loss in item forms, the applicant described a 

program for item monitoring tests to verify the presence and integrity of selected items, including 

the appropriate power of detection, verification frequency, and relative attractiveness of the 

material type in the item. In addition, the applicant described the statistical method used to 

establish the sample population and how the presence of selected items will be verified and 

confirmed through item monitoring tests. Staff determined that the applicant’s item verification 

tests and related statistical sampling basis are consistent with the requirements specified in 10 

CFR 74.55(b). 

It is also determined that the applicant’s tamper-safing procedures are acceptable to ensure the 

continuing validity of previously measured and attested to nuclear material values assigned to 

unique items, and the personnel access controls, surveillance and records procedures for 

entrance and exit of personnel to and from control access areas. This meets the requirements 

of 10 CFR 74.55(a) for storage of nuclear material items.

The applicant provided a basis for item classification and exempted items from item control 

tests, and a sound tamper-safing system employed to ensure the continuing validity of

previously measured and attested to values assigned to unique items. Also included was a 

description of facility accessibility associated with personnel access controls, surveillance 

procedures, and item accounting and control procedures for items placed in and removed from 

secure storage. 

To achieve the detection capability, the applicant identified an item measurement system to 

quantify the content of items, including confirmatory measurements, an item sampling 

technique, and a verification method for verifying the presence and integrity of licensed nuclear 

materials. The applicant also applied facility design features in the form of a highly automated 

remote-controlled process and manufacturing facility features, including its Manufacturing 

Management and Information System. 

Staff determined that the applicant’s methods used to classify nuclear material 

items are adequate because the methods are consistent with the material categories for the 

related process monitoring program, per the requirements of 10 CFR 74.55.

Staff determined that the applicant's description of the 

item accounting and control procedures for items placed in and removed from secure storage is 

acceptable because it will quantify the contents, and included the confirmatory measurements 

used to quantitatively verify the nuclear material content of items, including the controls that 

prevent or detect material substitution attempts.

The staff has reviewed the elements of this item monitoring program and found that the 

applicant’s program is capable of providing timely plantwide detection of the loss of items and 

verifying the presence and integrity of nuclear material items at a required frequency. The staff 

also found that the applicant provided an adequate item monitoring program with real-time 

status of nuclear materials, a system of item identification and classification, tamper-safing 

procedures, material accessibility, item accounting and control procedures, item measurements, 

sample items, and item verification tests, as required in 10 CFR 74.55, “Item Monitoring.”
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

13 - 7

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

13.2.3.3 Alarm Resolution

The applicant must establish an alarm resolution program that is capable of: 

• Resolving the nature and causes of any MC&A alarm within approved time periods; 

• Notifying the NRC of any MC&A alarms that remain unresolved beyond the time periods; 

• Determining the amount of actual SSNM lost and taking corrective actions; 

• Providing an ability to rapidly assess the validity of alleged thefts; and 

• Taking appropriate actions when the abrupt loss detection estimate exceeds 2 kg of 

plutonium.

The FNMCP identifies and describes features of an alarm resolution program that is capable of 

resolving the nature and cause of any MC&A alarm within an approved time period and notifying 

the NRC of any unresolved alarm beyond the time period specified for its resolution. The 

applicant described the alarm resolution procedures that are applied to the various types of 

alarms and process units. The FNMCP provides a listing of credible causes of possible alarms 

by process unit and details of the resolution procedures by which specific causes could be 

identified, as required by 10 CFR 74.57(b).

The applicant described an alarm reporting program to notify the NRC of any MC&A alarms that 

remain unresolved beyond the time period specified for its resolution. The applicant also 

described the responsibility and assignment within the facility’s organization for reporting 

unresolved alarms, and the types of information that will be provided to the NRC, including 

types of resolved alarms and related innocent causes as specified in 10 CFR 74.57(c) and 

(f)(2).

Decision rules by which a particular cause or combination of causes is considered acceptable 

for an alarm declaration, response time allotted to resolve each alarm type, and actions in 

response to the listing of item discrepancies are appropriately identified and described in the 

applicant’s FNMCP to meet the requirements of 10 CFR 74.57(d) and (f)(1).

The applicant described a program to rapidly assess the validity of any suspected thefts of 

licensed nuclear materials, using a maintained item control system to determine the identity, 

quantity, and location of materials in item form, and implemented protective measures to 

prevent loss, misplacement, or accidental destruction of inventory and item location records. 

This program description satisfies the requirement in 10 CFR 74.57(e) to respond rapidly to 

alleged thefts. 

The staff has reviewed the elements of this alarm resolution program and found that the 

applicant’s program demonstrates that it will have the ability to respond to and resolve MC&A 

alarms of the potential loss of nuclear materials. This program covers alarm resolution 

procedures, decision rules, response time, item discrepancies, alarm reporting responsibilities, 

and the handling of any alleged thefts. This alarm resolution program conforms to the 

requirements contained in 10 CFR 74.57 “Alarm Resolution,” and is acceptable.
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

13 - 8

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

13.2.3.4 Quality Assurance and Accounting

The applicant must establish quality assurance and accounting capabilities that address the 

following 11 elements: (1) MC&A management structure, (2) personnel qualification and 

training, (3) measurement systems, (4) measurement control, (5) physical inventory, (6) records 

systems and record maintenance (accounting), (7) material shipping and receiving, (8) scrap 

material control, (9) prevention of human error, (10) independent assessment, and (11) SSNM 

custodianship responsibilities. In its FNMCP, the applicant identified detailed methods and 

measures with respect to the overall MC&A quality assurance and accounting programs, which 

includes the 11 elements just described.

(1) The management structure described by the applicant includes the establishment and 

implementation of an organization that permits the effective functioning of the MC&A 

program; independence of responsibilities that have potentially conflicting goals; and 

adequate review, approval, and use of MC&A core procedures that are critical to the 

effectiveness of the MC&A system. Therefore, the applicant’s management structure 

satisfies 10 CFR 74.59(b).

(2) The applicant provided a personnel qualification and training program to ensure the 

competency of key MC&A personnel, including job requirements, minimum qualification, 

requalification needs, training program structure, and training objectives. The training 

program is also extended to operators and analysts involved with MC&A activities in 

order to perform their functions correctly with a minimum of errors. Therefore, the 

applicant’s personnel qualification and training program satisfies 10 CFR 74.59(c). 

(3) The measurement system described in the FNMCP identifies all measurement points 

and the types of nuclear materials, and appropriate measurement methods for the types 

of materials and the components of each measurement system involved at each 

measurement point . This will ensure that all material information in accounting records 

is based on measured values, that the standard deviation associated with each 

measurement quantity is estimated, and that necessary data are provided for performing 

material control tests. Therefore, the applicant’s measurement system satisfies 10 CFR 

74.59(d).

(4) The applicant described a measurement control program that is applied to measurement 

systems used for inventory, shipper-receiver measurement, monitoring cumulative

shipper-receiver differences, standard error of the inventory difference estimator, and 

detection and response measurements. Therefore, the applicant’s measurement 

controls satisfies 10 CFR 74.59(e).

(5) The applicant provided the necessary requirements for scheduling, performing, and 

evaluating physical inventories, including an implementation of policies, practices, and 

procedures designed to ensure the quality of physical inventories, and methods for 

controlling and maintaining records and documentation associated with the inventory 

program. Therefore, the applicant’s physical inventory program satisfies 10 CFR 

74.59(f).

(6) The applicant described the auditable records system, including recordkeeping policies, 

the type of data and information routinely recorded, and control measures and record 

maintenance to ensure record integrity, redundancy, and protection. Therefore, the 

applicant’s accounting system satisfies 10 CFR 74.59(g).
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

13 - 9

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

(7) In the FNMCP, the applicant established a program to accurately quantify in a timely 

manner the material contents of shipments and receipts, including procedures for the 

verification and confirmation measurements of shipments and receipts and for the 

review, evaluation, investigation, and resolution of significant shipper-receiver 

differences. Therefore, the applicant’s internal control program satisfies 10 CFR 

74.59(h)(1).

(8) The applicant also established a control program to process internally generated scrap 

materials, including identification of scrap quantities with regard to source, storage, and 

disposition, potential onsite or offsite recovery capacity, and measurements and 

inventory control via scrap control procedures. Therefore, the applicant’s internal control 

program satisfies 10 CFR 74.59(h)(2).

(9) The applicant in its FNMCP establishes a human errors program to incorporate checks 

and balances in the MC&A system to control the rate of human errors in the MC&A 

accounting information, including procedures used to control the frequency and types of 

human errors in MC&A data. Therefore, the applicant’s internal control program satisfies 

10 CFR 74.59(h)(3). 

(10) The applicant described an audit and independent assessment program to review the 

overall effectiveness of the MC&A system and past performance of its MC&A program

relative to the performance objectives and system capabilities defined respectively in 10 

CFR 74.51(a) and (b). Therefore, the applicant’s internal control program satisfies 10 

CFR 74.59(h)(4). 

(11) The applicant provided a material custodianship program that identifies a sufficient 

number of areas to ensure an effectively executed custodial responsibility, as well as 

defined duties and authorities, minimum number of alternates, and maintenance of a 

listing of custodians and alternates. Therefore, the applicant’s internal control program 

satisfies 10 CFR 74.59(h)(5).

The staff has reviewed the 11 elements of these quality assurance and accounting programs 

and found that these programs are appropriate and acceptable with regard to the requirements 

contained in 10 CFR 74.59, “Quality Assurance and Accounting Requirements.” 

13.2.3.5 Items Addressed by Compliance Plan

In its FNMCP, the applicant described the compliance item commitments in each affected 

section of the plan, the actions to be taken to achieve compliance, and the schedule for 

completing those actions. The compliance items pertain mainly to the development of 

implementing procedures associated with measurements, measurement control, item control, 

inventory, shipments and receipts, and basic software user guides for its computerized 

accounting programs. The staff determined that the commitments in the compliance plan are

adequate and will be verified prior to granting authorization for possession of special nuclear 

material.

13.2.4 Evaluation Findings

The staff reviewed the MFFF license application to possess and use strategic special nuclear 

materials and special nuclear materials according to Section 13.2 of NUREG-1718 (NRC, 2000)

and 10 CFR Part 74. Based on the review of the license application, the staff concludes that the 

applicant provided an acceptably robust FNMCP for the facility operations that will meet the 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

13 - 10

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION

applicable 10 CFR Part 74 requirements. The FNMCP describes acceptable methods for 

achieving the performance objectives in 10 CFR 74.51(a) and the system capabilities of 

10 CFR 74.51(b). As a result, the staff has determined that the applicant meets the 

requirements in the area of MC&A to operate the facility under 10 CFR Part 74.

REFERENCES

 

(MOX, 2010) Shaw AREVA MOX Services, “Fundamental Nuclear Material Control Plan,” 

Aiken, SC, May 2010.

(NRC, 1992) U.S. Nuclear Regulatory Commission, NUREG/BR-0096, “Instructions and 

Guidance for Completing Physical Inventory Summary Reports,” Washington, DC, 1992. 

(NRC, 1995) U.S. Nuclear Regulatory Commission, NUREG-1280, Revision 1, “Standard 

Format and Content Acceptance Criteria for the Material Control and Accounting (MC&A) 

Reform Amendment: 10 CFR Part 74, Subpart E,” Washington, DC, April 1995.

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” Washington, 

DC, August 2000.

(NRC, 2008) U.S. Nuclear Regulatory Commission, NUREG/BR-0006, Revision 7, “Instructions 

for Completing Nuclear Material Transaction Reports (DOE/NRC Forms 741 and 740M),” 

Washington, DC, June 2008.

(NRC, 2009) U.S. Nuclear Regulatory Commission, NUREG/BR-0007, Revision 6, “Instructions 

for the Preparation and Distribution of Material Status Reports (DOE/NRC Forms 742 and 

742C),” Washington, DC, January 2009.

(10 CFR) Title 10 of the Code of Federal Regulations Part 74, “Material Control and Accounting 

of Special Nuclear Material.”
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 14 - 1

 14.0 EMERGENCY MANAGEMENT 

14.1 Regulatory Requirements

In accordance with Title 10 of the Code of Federal Regulations (10 CFR) Part 70.22(i)(1), Shaw 

AREVA MOX Services (MOX Services) is required to develop an emergency plan or conduct an 

evaluation to demonstrate that an emergency plan is not required. The applicant is not required 

to submit an emergency plan if “an evaluation demonstrates that the maximum dose, resulting 

from a release of radioactive material, to a member of the public off site would not exceed 1 rem 

effective dose equivalent or an intake of 2 milligrams (mg) of soluble uranium.” The applicant 

chose to submit an evaluation rather than submit an emergency plan and submitted this revised 

evaluation on September 14, 2009 (MOX, 2009). 

14.2 Facility Description

The mixed oxide (MOX) fuel fabrication facility (MFFF) is located near the center of the 

Savannah River Site (SRS), which extends over 803 square kilometers (km2

) (310 square miles) 

in southwestern South Carolina. The nearest public residence is located in the town of Jackson, 

South Carolina., outside the SRS boundary, approximately 9.7 km (6 miles) northwest of the 

facility. The SRS boundary is controlled with barriers, sign postings, and a security force. 

Several public transportation corridors, including public roads, rail lines, and recreational traffic 

on the Savannah River, allow unobstructed travel through the SRS, but only one of these 

corridors is within a 5-mile radius of the MFFF. During an emergency, these roads are 

evacuated and controlled. Figures 2-1 to 2-3 of the evaluation document (MOX, 2009) provide 

both a regional map of the SRS and a local map of the MFFF facility. The MFFF site comprises 

an area of approximately 0.17 km2

 (41 acres), with 0.07 km2 (17 acres) developed and the 

remaining 0.10 km2 (24 acres) landscaped. 

The MFFF processes plutonium recovered from decommissioned weapons and other U.S. 

Department of Energy (DOE) sources. Impurities are removed in a liquid extraction process, 

which results in the development of plutonium dioxide. This material is blended with uranium 

dioxide to fabricate fuel for commercial reactors. Throughout the liquid extraction process and 

fuel fabrication, the plutonium and uranium compounds must be handled with care to avoid 

internal exposure. 

The MFFF implements an effluent control system to minimize the environmental release of 

radioactive materials. The ventilation system for each process area is designed with multiple 

filters to remove hazardous chemicals and radioactive materials. Off-gas scrubbers, 

high-efficiency particulate air (HEPA) filters, and effluent monitors are used to minimize 

radioactive releases. After passing through filtration, effluent gases are exhausted through the 

plant stack, which extends approximately 36.6 m (120 feet) above the surrounding landscape. 

The emergency evaluation describes the MFFF location, population, and plant layout. The site 

has effluent controls, including a stack, which limit the release of radioactive material and 

reduce the potential for public exposure. The evaluation was prepared by the applicant to 

demonstrate compliance with the regulatory requirements in 10 CFR 70.22(i)(1)(i). The staff 

reviewed the emergency evaluation in accordance with the staff review guidance in Chapter 

14.3.1 of NUREG-1718 (NRC, 2000). Details of the evaluation and the staff’s review follow. 

The facility processes large quantities of MOX material, but its location within the SRS facility 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 14 - 2

and effluent control systems support the evaluation in accordance with regulatory requirements 

in and Chapter 14.2.1 of NUREG-1718. 

14.3 Types of Accidents

14.3.1 Radiation Exposure 

The applicant evaluated credible accident events to members of the public located on the SRS 

site boundary which is 6.05km (5 miles) from the MFFF. The evaluation consisted of a hazard 

analysis to identify general events that could lead to a significant exposure to radioactive 

material. Event sequences identified in the Integrated Safety Analysis Summary (MOX 2010) 

were evaluated under accident conditions (i.e., assuming the accidents occurred). The 

mitigating factors listed in 10 CFR § 70.22(i)(2) were used to demonstrate that postulated 

events would fall below the 10 CFR § 70.22(i)(1)(i) thresholds for radiation exposures (0.01 

sieverts (1 rem)) and the chemical exposures (20 mg of soluble uranium) at the SRS boundary. 

Internal exposures are the primary concern at the MFFF because the uranium and plutonium 

compounds are dominated by alpha radiation. The distance to the SRS site boundary would 

limit any direct radiation from material on site. MOX Services evaluated the release of 

plutonium and uranium compounds due to fires, spills, criticality, and explosions. The bounding 

events were determined based on radiological consequences identified in the hazards analyses, 

when considering 10 CFR § 70.22(i)1(i). 

The bounding sequences for the four general accident types are addressed individually. Fires 

are limited to a single fire zone because of the combustible material available, fire detection, 

and fire barriers. Load-handling events (spills) involve a single container in a process unit and 

are further limited by restrictions on the lift height of containers. Criticality events are limited by 

the mass of material allowed in process units such as tanks, gloveboxes, and filters. Explosion 

releases are limited by the amount of material involved in a single container and the airborne 

release fractions for the type of material involved. For each of these event types, HEPA 

filtration through the heating, ventilation, and air conditioning (HVAC) system and the applicant’s 

response resulting from early detection by radiation monitors would reduce the release. 

The MFFF used a dispersion model to evaluate the Χ Q dispersion factor and postulated doses 

at the SRS boundary. This evaluation determined the dose to an individual at the SRS 

boundary to be approximately 0.001 Sieverts (0.1 rem), well below the 0.01 Sieverts (1-rem) 

regulatory limit in 10 CFR § 70.22(i)(1)(i). This dispersion factor and dose estimate was 

confirmed by the applicant using RASCAL, as demonstrated in Enclosure 2 of the evaluation 

(MOX, 2009). Events evaluated in the ISA but not described in the ISA Summary, due to 

low-consequences as defined by 10 CFR § 70.61, “Performance Requirements,” would not 

exceed the 0.01 Sieverts (1-rem) limit due to dispersion during propagation to the site boundary. 

14.3.2 Uranium Exposure 

Uranium exposure to a member of the public on the site boundary was evaluated for uranium 

dioxide and uranyl nitrate. The primary release mechanism was due to spills and fires. The 

applicant determined the maximum source term that would be released for each uranium 

compound. Once the source term was established, MOX Services analyzed the uranium 

consequence and dispersion at the SRS boundary using ALOHA9 and MACCS210 computer 

codes. For spills, the source term was estimated based on evaporation from a puddle formed 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 14 - 3

near a leak. For fires, the maximum amount of material involved, the airborne release fractions, 

and respirable fractions were used to estimate the source term. 

 Such a fire event evaluated over 8 hours was calculated to result in an 

intake of 0.1 mg at the site boundary, well below the 2-mg regulatory limit in 

10 CFR 70.22(i)(1)(i). The source term will be reduced further if the10 CFR 70.22(i)(2) criteria, 

such as limited tank inventory, leak detection, leak isolation, and operator action, is included in 

the evaluation. The calculations of the source terms are based on published airborne release 

and respirable fractions and a conservative quantity of material available for the vent. The 

dispersion factor is also reasonable because of the large distance from the MFFF and the site 

boundary (i.e., 5 miles). Based on these considerations, the staff finds that the evaluation 

provides reasonable assurance that a uranium release event would not result in a uranium 

exposure on the site boundary exceeding the 10 CFR 70.22(i)(1)(i) threshold of 2 mg. 

14.3.3 Criticality 

The MFFF evaluated a worst-case criticality accident, which would produce 1.0×1019 fissions 

with an initial burst of 1.0×1018 fissions and continuing to pulse for 8 hours. The dose was 

calculated based on exposure to material boiled from solution and the release of fission 

products. The criticality was assumed to occur in the largest MFFF process tank with standard 

variables drawn from NUREG/CR-6410, “Nuclear Fuel Cycle Facility Accident Analysis 

Handbook” (NRC, 1998). The inhalation and submersion doses were summed to obtain the 

dose to a member of the public on the site boundary of 0.000252 Sieverts (0.0252 rem). The 

airborne release fraction and dispersion for nonvolatiles would result in negligible uranium 

exposure at the site boundary. This evaluation did not credit criticality detection alarm systems 

or the HVAC HEPA filter system which would further minimize criticality impacts. The direct 

radiation would be rapidly attenuated, and dispersion would minimize internal exposure as 

confirmed by the applicant in Table 9-1 of the evaluation (MOX, 2009). Based on these 

considerations, the staff finds that the evaluation provides reasonable assurance that a criticality 

event would not exceed the 10 CFR 70.22(i)(1)(i) threshold on the site boundary. 

14.3.4 Additional Considerations 

The applicant also evaluated the impact of natural phenomena and external manmade events in 

its ISA Summary. The facility has been designed and built to meet the baseline design criteria 

as required in 10 CFR 70.64(a), “Requirements for New Facilities or New Processes at Existing 

Facilities.” The staff agrees with the applicant’s conclusion that the events addressed in the 

emergency evaluation (MOX, 2009) bound these accident scenarios. 

14.4 Interaction with Savannah River Site and Offsite Officials 

The applicant’s description of the internal emergency response plan includes participation in the 

SRS emergency response plan. The interaction between these two plans is defined by a work 

task agreement, which both parties have reviewed and approved. MOX Services remains 

responsible for contacting the NRC and DOE in case of an event, but interactions with State and 

local officials are conducted through the SRS Emergency Duty Officer who oversees the SRS 

Operations Center. The MFFF emergency preparedness program incorporates plans for 

radiation monitoring, repair and recovery efforts, search and rescue, and initial medical 

response. Additional resources are available upon request from the SRS. As part of the work 

task agreement, MFFF personnel are trained in emergency response, which includes 

participating in SRS drills and exercises. The applicant stated in the evaluation that they will 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 14 - 4

work with the SRS Operations Center to verify that the SRS emergency plan incorporates MFFF 

emergencies. The MFFF maintains emergency procedures and coordinates with SRS 

emergency requirements to comply with NRC regulations while also complying with DOE 

requirements. Based on the review of the evaluation, the MFFF the internal emergency plan 

and procedure for interaction with the SRS Operations Center provides the staff reasonable 

assurance that the MFFF has adequate emergency capability in compliance with 10 CFR § 

70.64(a)(6). 

14.5 Evaluation

The staff has reviewed MOX Services dose calculations and determined that (1) the calculated 

dose to the offsite public is reasonable and conservative, (2) the dose to the offsite public is less 

than 0.01 Sieverts (1 rem) effective dose equivalent or an intake of 2 mg of soluble uranium, (3) 

the accident scenarios chosen by the applicant are credible and bounding based on regulatory 

requirements; and (4) no formal emergency plan is required in accordance with 10 CFR § 

70.22(i)(1)(i). 

The staff notes that although an NRC-approved emergency plan is not required by 

10 CFR 70.22, “Contents of Applications,” the MFFF has committed to maintaining an 

emergency plan, implementing procedures, and emergency response organization for internal 

use. The staff considers this commitment prudent and acceptable. Based on this evaluation, 

the staff concludes that the MFFF has demonstrated reasonable assurance of compliance with 

10 CFR 70.22(i)(1)(i), 10 CFR 70.64(a)(6), and the performance criteria in NUREG-1718, 

Sections 14.4.1 through 14.4.3.1.4 (NRC, 2000). 

REFERENCES 

(MOX, 2009a) Shaw AREVA MOX Services, “Emergency Plan Evaluation,” Aiken, SC, 

September 14, 2009. 

(MOX, 2010) Shaw AREVA MOX Services (MOX Services). “Mixed Oxide Fuel Fabrication 

Facility Integrated Safety Analysis Summary,” Aiken, SC, March 2010. 

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” Washington, 

DC, August 2000). 

(NRC, 1998) U.S. Nuclear Regulatory Commission, NUREG/CR-6410, “Nuclear Fuel Cycle 

Facility Accident Analysis Handbook,” Washington, DC, March 1998. 

10 CFR Part 70 – Domestic Licensing of Special Nuclear Material. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 1

15.0 Management Measures 

Management measures are functions that MOX Services performs, generally on a continuing 

basis, that are applied to items relied on for safety (IROFS), to ensure the items are available 

and reliable to perform their safety functions when needed. Management measures shall be 

implemented to ensure compliance with the performance requirements of Title 10 of the Code of 

Federal Regulations (10 CFR) 70.61, “Performance requirements,” and the degree to which 

they will be applied will be a function of the item’s importance in terms of meeting performance 

requirements, as evaluated in the integrated safety analysis (ISA). This chapter addresses 

each of the management measures included in the definition of management measures in 

10 CFR Part 70, “Domestic Licensing of Special Nuclear Material,” including (1) configuration 

management (CM), (2) maintenance, (3) training and qualifications, (4) procedures, (5) audits 

and assessments, (6) incident investigations, (7) records management, and (8) other quality 

assurance (QA) elements. 

The purpose of this review is to verify whether the MOX Services license application (MOX, 

2010a) provided conclusive information to demonstrate that the management measures applied 

to IROFS, as documented in the ISA Summary, provide adequate assurance that the IROFS will 

be available and reliable and will function according to the performance requirements of 

10 CFR § 70.61. 

Quality level definitions and the requirements for applying graded QA to IROFS are found in the 

MOX Services Project Quality Assurance Plan (MPQAP), which the staff of the U.S. Nuclear 

Regulatory Commission (NRC) has reviewed and approved. Revision 8 of the MPQAP was 

reviewed and accepted by the staff, as documented in letter dated October 19, 2009 

(ML092790580). 

15.1 Regulatory Requirements

The requirements in 10 CFR Part 70 specify fuel cycle facility management measures, as 

follows: 

• 10 CFR § 70.4, “Definitions,” states that management measures include CM, 

maintenance, training and qualifications, procedures, audits and assessments, incident 

investigations, records management, and other QA elements. 

• 10 CFR § 70.22(a)(8), Contents of applications,” requires that each application for a 

license contain proposed procedures to protect health and minimize danger to life or 

property. 

• 10 CFR § 70.62(a)(3), “Safety program and integrated safety analysis,” states that 

records must be kept for all IROFS failures, describes required data to be reported, and 

sets time requirements for updating the records. 

• 10 CFR § 70.62(d) requires an applicant to establish management measures for 

engineered and administrative controls (ACs) and control systems that are identified as 

IROFS, pursuant to 10 CFR 70.61(e), so that they are available and reliable to perform 

their functions when needed. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 2

• 10 CFR § 70.64(a)(1), “Requirements for new facilities or new processes at existing 

facilities,” states that new facilities or new processes at existing facilities shall develop 

and implement designs in accordance with management measures, to provide adequate 

assurance that IROFS will be available and reliable to perform their safety function when 

needed. 

• 10 CFR § 70.64(a)(1) states that appropriate records of IROFS must be maintained by, 

or under the control of, the licensee throughout the life of the facility. 

• 10 CFR § 70.64(a)(8) states that the design of IROFS must provide for inspection, 

testing, and maintenance adequate to ensure their availability and reliability to perform 

their function when needed. 

• Facility changes and change processes are required to conform to 10 CFR § 70.72, 

“Facility Changes and Change Process.” 

• 10 CFR § 70.74(a) and (b), “Additional reporting requirements,” require incident 

investigation and reporting. 

• In addition, an applicant to possess and use special nuclear material (SNM) in a 

plutonium processing and fuel fabrication facility such as the mixed oxide (MOX) fuel 

fabrication facility (MFFF) is required, pursuant to 10 CFR § 70.22(f), to describe the QA 

program to be applied to the design, fabrication, construction, testing, and operation of 

the structures, systems, and components (SSCs) of the facility. 

• 10 CFR Part 21, “Reporting of Defects and Noncompliance,” contains additional 

pertinent regulatory requirements for identifying, controlling, and reporting defects with a 

facility, activity, or basic component supplied to a facility licensed under 10 CFR Part 70. 

15.2 Regulatory Acceptance Criteria

Section 15, “Management Measures,” of NUREG-1718, “Standard Review Plan for the Review 

of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility” (NRC, 2000), contains the 

acceptance criteria for the NRC review of MOX Service’s management measures program. 

15.3 Staff Review and Analysis

15.3.0 Management Measures

The applicant established management measures to ensure that facility IROFS would be 

available and reliable to perform their safety function when needed and to ensure that work is 

conducted efficiently and in a manner that protects workers, the public, and the environment. 

The applicant describes its management measures as a framework of administrative and 

programmatic measures that includes CM, maintenance, training and qualification, procedures, 

audits and assessments, incident investigations, and records management. 

The applicant commits to implementing management measures in accordance with a QA 

program established in accordance with Appendix B, “Quality Assurance Criteria for Nuclear 

Power Plants and Fuel Reprocessing Plants,” of 10 CFR Part 50, “Domestic Licensing of 

Production and Utilization Facilities.” 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 3

The applicant commits to applying management measures to IROFS to ensure that they are 

available and reliable upon demand. The applicant assigns management measures for training 

based on four types of IROFS classifications and the risk-reduction level attributed to the 

IROFS. The types of IROFS classifications are as follows: 

(1) passive engineered controls (PECs), which are devices that use only fixed physical 

design features to maintain safe process conditions and require no human action 

(2) active engineered controls (AECs), which are physical devices that use active sensors, 

electrical components, or moving parts to maintain safe process conditions and which 

require no human action 

(3) enhanced ACs (EACs), which are procedurally required or prohibited human actions, 

combined with a physical device that alerts the operator that the action is needed to 

maintain safe process conditions, or otherwise adds substantial assurance of the 

required human performance 

(4) ACs, which are procedurally required or prohibited human actions needed to maintain 

safe process conditions 

The applicant identifies the specific elements of the various management measures programs 

assigned to each IROFS classification in the license application. This illustrates how the various 

management measures elements apply to the different IROFS classifications (i.e., PECs, EACs, 

AECs, and ACs). The applicant describes the application of EACs and states that, for the EAC, 

the specific management measures for the physical device are covered under the AEC 

classification. 

15.3.1 Quality Assurance 

In accordance with Option A of NUREG-1718, the applicant elects to implement and maintain a 

QA program in conformance with the applicable requirements of Parts I and II of 

ASME-NQA-1-1994, as revised by the ASME NQA-1a-1995 (ASME, 1995) Addenda or 

equivalent. The MOX Services QA program is described in the MPQAP, which the NRC 

approved in a safety evaluation report dated October 1, 2001 (NRC, 2001). The MPQAP 

establishes the QA requirements to control quality-affecting activities related to the design, 

construction, and operation of the MFFF. By letter dated October 19, 2009 (NRC, 2009), the 

staff documented its review and approval of the latest revision to the MPQAP, Revision 8. 

The applicant commits to submitting any change that would reduce the commitments of the 

NRC-approved QA program, along with written justification for the change, to the NRC for 

acceptance before implementing it. The applicant states that it will update the MPQAP, as 

necessary, during testing, operation, and deactivation of the MFFF. The applicant commits to 

implementing the requirements of 10 CFR Part 21 for design, construction, procurement, 

testing, and operations of Quality Level 1 SSCs (i.e., IROFS). Section 4 of the MPQAP, 

“Procurement Document Control,” requires that 10 CFR Part 21 be invoked for procurements of 

IROFS for the MFFF, unless the procurement is for a commercial grade item. 

15.3.2 Configuration Management 

15.3.2.1 Configuration Management Policy
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 4

The applicant states that the CM program for MFFF will ensure that IROFS are designed and 

operated within the design basis. As stated in the application, the MFFF CM program will 

identify and control the preparation and review of documentation associated with IROFS, control 

changes to IROFS, and maintain the physical configuration of the facility consistent with the 

approved design. 

The applicant states that it accomplishes configuration control during design through the use of 

procedures for controlling design activities. These design control procedures will encompass 

activities related to the preparation, review, verification (where appropriate), approval, release, 

and distribution of the design for use. The applicant states that changes to the approved design 

are subject to a review to ensure consistency with the design bases of the IROFS. 

The applicant has established quality level classifications for MFFF SSCs and associated 

documents, as documented in Section 2.2 of the MPQAP. As described in the MPQAP, quality 

levels are assigned to SSCs commensurate with their safety significance and a combination of 

the likelihood and consequences of design basis events. Quality Level 1 (QL-1) SSCs are 

IROFS credited in the Integrated Safety Analysis with a required function to prevent or mitigate 

design basis events such that high-consequence events are made highly unlikely; intermediateconsequence events are made unlikely; or to prevent criticality. Quality Level 2 (QL-2) SSCs 

are not relied on to satisfy the performance requirements of 10 CFR 70.61; they perform 

functions such as maintaining public and worker radiological exposure within normal operating 

limits; monitoring and alerting personnel of changes to facility conditions, such as criticality; 

managing radioactive waste; and protecting IROFS from potentially harmful physical 

interactions. Quality Level 3 (QL-3) SSCs have no safety function but their performance may be 

important to ensuring operational or mission-critical goals are achieved. Finally, Quality Level 4 

(QL-4) SSCs are those SSCs that are not designated as QL-1, QL-2, or QL-3, and controls on 

those SSCs do not impact the regulatory basis of the MFFF. 

The applicant states that it will accomplish CM through design review and verification, which 

ensure that design documents are consistent and that design requirements for IROFS are met. 

The applicant states that changes identified during construction or testing must be approved by 

the Engineering Department through a documented engineering change process or an 

approved nonconformance report before implementation to ensure that testing is successfully 

accomplished and that configuration is maintained. 

The applicant commits to conducting initial and periodic assessments of the CM system to 

determine its effectiveness and to correct deficiencies. The applicant states that it will conduct 

audits and assessments of the CM program to ensure that the program meets its goals and that 

the design is consistent with the design bases. The applicant also states that it will perform the 

corrective action process in accordance with the MPQAP and associated procedures, in the 

event that any problems are identified. The applicant will develop prompt corrective actions in 

response to audit or assessment findings or as a result of incident investigations. 

The applicant states that it will maintain CM as the project progresses from design and 

construction to operations and will establish procedures to define the turnover responsibilities 

and processes. 

The applicant demonstrates that it has established design requirements and associated design 

bases and that the appropriate organizational unit maintains them. The applicant states that the 

Functional Area Manager will approve procedures and revisions thereto for facility modifications 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 5

made during the operations phase. Change procedures will ensure quality in the facility 

modification program and will include technical and quality requirements necessary to 

implement a modification, as well as the requirements for initiating, approving, monitoring, 

designing, verifying, and documenting modifications. The applicant also states that it will write 

the facility modification procedure to ensure that policies are formulated and maintained to 

satisfy the MPQAP, as applicable. 

The applicant describes its compliance with the provisions of 10 CFR § 70.72 and commits to 

ensuring that each change to the MFFF or to activities of personnel during operations will have 

an evaluation performed in accordance with the requirements of 10 CFR § 70.72, as applicable. 

The applicant also states that it will evaluate each modification for any required changes or 

additions to the facility’s procedures, personnel training, testing program, or regulatory 

documents, as applicable. 

The applicant demonstrates that the CM system will ensure that the appropriate technical, 

management, and safety reviews are performed in support of changes to the MFFF and its 

IROFS. In describing its change control process, the applicant states that it will require that the 

impacts of any change (i.e., new design or operation) or modification to the facility or to activities 

of personnel (e.g., site SSCs, computer programs, processes, operating procedures, 

management measures) that involve or could affect the ISA, be evaluated and documented. 

The change control process also requires that, before implementing any change, the applicant 

shall demonstrate that it does not affect the safety basis, in accordance with 10 CFR § 70.72. 

Changes that affect the safety basis require NRC approval before implementation. 

In the application, the applicant states that it will evaluate and document each modification to 

the facility or to activities of personnel for radiation exposure to minimize worker exposures as 

part of the facility’s as-low-as-reasonably-achievable program (ALARA), criticality and worker 

safety requirements, or restrictions. The applicant states that it may also evaluate modifications 

in terms of cost; lessons learned from similar completed modifications; QA requirements; 

potential operability, maintainability, or constructability concerns; postmodification testing 

requirements; environmental considerations; human factors; and the ISA, as applicable. 

The applicant commits to post-modification testing of items in addition to established periodic 

performance monitoring and maintenance functions. The applicant states that, upon completion 

of a modification to an SSC, the modification’s responsible manager, or designee, will confirm 

that applicable testing has been completed to ensure correct operation of the system(s) affected 

by the modification. The applicant adds that the responsible manager will also ensure that 

documentation regarding the modification is complete. Documents such as the revised process 

description, checklists for operation, and flowsheets will be made available to operations and 

maintenance departments before the startup of the modified system to ensure that operators 

are able to operate the modified system safely. The applicant also states that it will complete 

the appropriate training on the modification before a system is placed in operation and will 

distribute a formal notice of the modification completion to appropriate managers. The applicant 

will complete drawings incorporating the modification, in accordance with MFFF design control 

procedures, and will retain identifiable records related to the modification, in accordance with 

the MFFF records management procedures. 

15.3.2.2 Implementation of Configuration Management

As stated in the application, during the design phase of the project, the applicant will base CM 

on the design control provisions and associated procedural controls over design documents to 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 6

establish and maintain the technical baseline. The applicant states that it will identify 

documents that provide design input, analysis, or results specifically for IROFS, including the 

ISA, with the appropriate quality level. The applicant states that these design documents will 

undergo interdisciplinary review during the initial issue and during each subsequent revision. 

During the construction phase of the project, the applicant states that it systematically reviews 

and verifies changes to drawings and specifications issued for construction, procurement, or 

fabrication; evaluates changes for impact to the ISA; and approves the changes before 

implementing them. The applicant commits to verifying proper implementation of such changes 

by the QA organization. 

The applicant states that it will implement measures to ensure that the quality of MFFF IROFS is 

not compromised by planned changes (modifications). These measures will include assigning 

responsibility for the design of and modifications to facility IROFS to the Plant Manager. These 

measures will also include performing the design and implementation of modifications so as to 

ensure quality is maintained in a manner commensurate with the remainder of the system that is 

being modified, or as dictated by applicable regulations. 

15.3.2.3 Organization

The applicant describes the organizational structure and staffing interfaces of the CM system. 

The President of MOX Services is responsible for the overall implementation of the CM 

program, including development and approval of plans and policies necessary to provide overall 

program direction. The Vice President—Engineering administers the CM program during 

design, and the engineering organization includes engineering disciplines. Discipline engineers 

have primary technical responsibility for the work performed within their disciplines. 

Responsibility for interdisciplinary reviews lies with the responsible managers. Reviews are also 

conducted, as appropriate, by construction management, operations, environmental safety and 

health, QA, and support services personnel. 

The applicant commits to an acceptable method of controlling and storing documents within the 

CM system. The applicant states that the MFFF design control process interfaces with the 

document control and records management process through procedures. The applicant’s 

document control program includes provisions for the inclusion of documents in the MOX 

Services electronic document management system (Documentum), maintenance and 

distribution of documents, document retention, tracking of document change status, and 

document retrieval. 

The Vice President—Construction is responsible for CM during construction and establishes 

and maintains processes and procedures used during construction of the facility. 

The Plant Manager is responsible for ensuring the implementation of CM during operational 

testing, operation, and deactivation of the MFFF. 

The various MOX Services departments and subcontractors perform quality-related activities, 

and the primary MOX Services subcontractors work to the MPQAP. Some MOX Services 

subcontractors will develop and implement their respective QA programs in a manner that is 

consistent with the requirements of the MPQAP for activities determined to be within the scope 

of the MPQAP. The interfaces between subcontractors and MOX Services or among 

subcontractors will be documented. MOX Services and subcontracted personnel have the 

responsibility to identify quality problems. Disagreements that cannot be resolved will be 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 7

elevated to the next level of management for resolution and, if necessary, through successive 

layers of management until resolution is achieved. 

 

15.3.2.4 Scope of Configuration Management Program

The applicant clearly defines the IROFS to be included in the scope of the CM program. The 

MFFF CM program includes the IROFS identified by the ISA and any items that may affect the 

safety function of the IROFS. The applicant also shows that the CM system will consistently 

capture documents that are relevant and important to safety as the project evolves from design 

and construction through operations. The applicant states that calculations, safety analyses, 

design criteria, engineering drawings, system descriptions, technical documents, operating 

procedures, and specifications that establish design and safety requirements for IROFS are also 

subject to CM. During the design phase, these documents are maintained under CM upon 

initial approval. 

The applicant’s design process leading to drawings and other statements of requirements 

proceeds logically from the MFFF design basis. The applicant states that the number of 

documents included in the CM program will increase throughout the design process as drawings 

and specifications related to IROFS are prepared and issued for procurement, fabrication, or 

construction. The related documents are included in CM. 

The applicant states that, during construction, initial startup, and operations, the scope of 

documents under CM will continue to increase and will include, as appropriate: vendor data; 

test data; inspection data; initial startup, test, operating, and administrative procedures, as 

applicable to IROFS; and nonconformance reports. These documents will be generated 

through functional interfaces with QA, maintenance, and personnel training and qualification. 

The applicant commits to establishing CM procedures that evaluate, implement, and track 

changes to IROFS, as well as processes, equipment, computer programs, and activities of 

personnel that affect IROFS. 

The applicant states that CM is implemented through or related to other management 

measures. The applicant identifies key interfaces and the relationship of CM to other 

management measures, including QA, records management, maintenance, training and 

qualifications, audits and assessments, and procedures. 

The applicant states that the MFFF QA program establishes the framework for CM and other 

management measures for IROFS and items that affect the function of the IROFS. 

The applicant commits to generating and processing records associated with IROFS, in 

accordance with the applicable requirements of the QA program. The applicant also commits to 

providing evidence of the conduct of activities associated with the CM of those IROFS. 

The applicant commits to the establishment of maintenance requirements as part of the design 

basis, which is controlled under CM. The applicant will maintain records sufficient to provide 

evidence of compliance with preventative and corrective maintenance schedules for IROFS. 

The applicant states that it will control personnel training and qualification in accordance with 

approved project procedures. Personnel qualifications and training to specific processes and 

procedures are management measures that support the safe design, operation, maintenance, 

and testing of IROFS. The applicant commits to developing and implementing procedures for 

work activities that are themselves IROFS (i.e., ACs) and to training and qualifying personnel to 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 8

these procedures. The applicant also states that training and qualification requirements and 

documentation of training may be considered part of the design basis and be controlled under 

CM. 

The applicant describes the interface between CM and audits, assessments, and incident 

investigations and applies its audit and assessment activities to the CM program, which includes 

the control of design requirements and the implementation of those requirements. The 

applicant states that corrective actions identified as a result of the management measures of 

audits, assessments, and incident investigations may result in changes to design features, ACs, 

or other management measures (e.g., operating procedures). The applicant commits to using 

the MFFF QA program and procedures to evaluate changes to maintain CM and to conducting 

periodic assessments of the CM program, in accordance with the audit and assessment 

program. The audit and assessment program includes requirements to perform both document 

assessments and physical assessments (walkdowns) to check the adequacy of the CM system 

and to document assessment and follow-up activities. 

The applicant states that it will use operating, administrative, maintenance, and emergency 

procedures to conduct various operations associated with IROFS and will review these 

procedures as part of the CM program to identify potential impacts to the design basis. The 

applicant also states that work activities that are themselves IROFS (i.e., ACs) will be contained 

in procedures. 

15.3.2.5 Change Control

The applicant fully describes the activities that comprise its CM program. According to the 

applicant, CM includes those activities conducted under design control provisions to ensure that 

design and construction documentation is prepared, reviewed, and approved in accordance with 

a systematic process. This process includes interdisciplinary reviews appropriate to ensure 

consistency between the design and the design bases of IROFS. During construction, it also 

includes those activities that ensure that construction is consistent with design documents. 

Finally, it includes activities that provide for operation of the IROFS in accordance with the limits 

and constraints established in the ISA and that provide for the control of changes to the facility 

in accordance with 10 CFR § 70.72. 

The applicant states that CM also includes records to demonstrate that personnel conducting 

activities that are IROFS are appropriately qualified and trained to perform that work. 

The applicant commits to applying the MFFF document control system to the control of 

implementing documents as a means of controlling documents within the CM system. The 

applicant states that implementing documents include those documents that support CM by 

ensuring that only reviewed and approved procedures, specifications, and drawings are used for 

procurement, construction, installation, testing, operation, and maintenance of IROFS, as 

appropriate. 

The applicant demonstrates that the CM system provides for keeping design requirements and 

the safety assessment of the ISA current and ensures that suitable hazard and accident 

analysis methods are available to evaluate safety margins of proposed changes. The applicant 

states that it uses procedures to control changes to the design documents, and the change 

process includes an appropriate level of technical, management, and safety review and 

approval before implementation. During the design phase of the project, the method of 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 9

controlling changes is the design control process described in the implementing procedures. 

This process includes conducting interdisciplinary reviews and design reviews and verifications 

that constitute a primary mechanism for ensuring that the design is consistent with the design 

bases. During both the construction and operations phases of the facility, the applicant will use 

appropriate reviews to ensure consistency with the design bases of IROFS and the ISA, 

respectively, to ensure that the design is constructed and operated or modified within the limits 

of the design basis. 

The applicant commits to performing a systematic review of the design bases when making 

changes to the design, to ensure consistency. In the event that changes reflect design or 

operational changes from the established design bases, the applicant commits to properly 

modifying, reviewing, and approving the ISA before the change is implemented. The applicant 

states that it will make approved changes available to personnel through the established 

document control function. 

During design, the applicant commits to using the interdisciplinary review process as the 

method of ensuring consistency between documents, including consistency between design 

changes and the safety analyses. The applicant asserts that interdisciplinary reviews ensure 

that design changes: (1) do not affect the ISA, (2) are accounted for in subsequent changes to 

the ISA, or (3) are not approved or implemented. Before issuance of the license, MOX Services 

commits to notifying the NRC of potential changes that reduce the level of commitments or 

margin of safety in the design bases of IROFS. 

When the project enters the construction phase, the applicant will document, review, approve, 

and post changes to documents issued for construction, fabrication, and procurement against 

each affected design document. Vendor drawings and data will also undergo an 

interdisciplinary review to ensure compliance with procurement specifications and drawings and 

to incorporate interface requirements into facility documents. 

During construction, the applicant will continue to evaluate design changes against the 

approved design bases. The applicant expects changes to the design as detailed design and 

construction activities progress and states that it will use a systematic process, consistent with 

that described above, to evaluate changes in the design against the design bases of IROFS and 

the ISA. 

Upon issuance of the MFFF Possession and Use License, the applicant states that the 

configuration change process will fully implement the provisions of 10 CFR § 70.72, including 

reporting changes made without prior NRC approval, as required by 10 CFR § 70.72(d)(2) 

and (3). The applicant also states that it will submit any change that requires Commission 

approval as a license amendment request, as required by 10 CFR § 70.72(d)(1), and that it will 

not implement the change without prior NRC approval. 

During the operations phase, the applicant commits to documenting, reviewing, and approving 

changes to the design before implementation. The applicant also commits to using a change 

process that fully implements the provisions of 10 CFR § 70.72. The applicant states that it will 

make responsible facility personnel aware of design changes and modifications that may affect 

the performance of their duties. 

The applicant assigns specific personnel the responsibility for maintaining the design bases and 

requirements. The applicant states that, upon acceptance by Operations, the Plant Manager 

will be responsible for the design of and modifications to IROFS and for designing and 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 10

implementing modifications so as to ensure that quality is maintained in the remainder of the 

system, or as dictated by applicable regulations. 

The applicant commits to applying CM controls incorporated into the original design and 

modifications throughout operations to facilitate deactivation of the facility. 

The applicant describes its technical management review and approval procedure. The 

applicant states that the Functional Area Manager approves the administrative instructions for 

modifications contained in a facility administrative procedure, including revisions. The applicant 

states that the modification procedure contains (1) the technical and quality requirements that 

shall be met to implement a modification and (2) requirements for initiating, approving, 

monitoring, designing, verifying, and documenting modifications. The applicant maintains that 

the facility modification procedure will be written to ensure that policies are formulated and 

maintained to satisfy the MPQAPas applicable and that QA is ensured. 

The applicant commits to performing an evaluation of each change to the facility or to activities 

of personnel, in accordance with the requirements of 10 CFR § 70.72, as applicable. The 

applicant also commits to the evaluation of modifications to identify any required changes or 

additions to the facility’s procedures, personnel training, testing program, or regulatory 

documents. 

The applicant states that it will evaluate and document the impacts of changes (e.g., new design 

or operation, or modification to the facility or to activities of personnel, IROFS, computer 

programs, processes, operating procedures, management measures) that involve or could 

affect the ISA. The applicant also maintains that, before implementing any change, it will 

demonstrate that the change does not affect the safety basis, in accordance with 10 CFR § 

70.72. 

15.3.2.5.1 Identification of Changes 

The applicant states that design bases and design requirements that are derived from the 

design bases will be established and maintained by the engineering organization during design 

and construction and by the Plant Manager during operations. The applicant will document the 

design bases in licensing bases documents and in design documents such as calculations, 

safety analysis, engineering drawings, system descriptions, technical documents, and 

specifications. The applicant commits to controlling design documents under the design control 

provisions of the CM program. 

The applicant describes the quality levels and CM controls assigned to IROFS. The applicant 

has designated all IROFS as Quality Level 1 and commits to performing interdisciplinary 

reviews and design review and verification activities for design documents associated with 

IROFS, as well as for analyses constituting the ISA. The applicant summarizes IROFS in the 

ISA Summary and commits to evaluating changes to the design to ensure consistency with the 

design bases. 

The applicant demonstrates that suitable design control analysis methods are available to 

evaluate the safety margins of proposed changes and describes the methods applied to control 

computer codes used for such evaluations. The applicant states that it will subject computer 

codes used in safety analyses and the design of IROFS to the same design control measures 

as IROFS and ISA analyses, with additional requirements, as appropriate, for software control, 

verification, and validation. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 11

The applicant describes personnel responsibilities for maintaining design bases and 

requirements. The applicant states that qualified individuals will prepare design documents 

(e.g., calculations, specifications, procedures, or drawings) and will specify and include the 

appropriate codes, standards, and license requirements within the design documents. The 

applicant states that these individuals will note any deviations or changes from such standards 

within the design documentation package. 

The applicant identifies its process for the review and approval of design documents. After the 

preparation of design documents by qualified individuals, each design document is reviewed by 

another individual qualified in the same discipline. The applicant states that design inputs will 

be sufficiently detailed so as to permit verification of the document. The manager having overall 

responsibility for the specific design function will then approve the document and will record the 

entire review process in accordance with approved procedures. The applicant’s procedures will 

include provisions to ensure that design documents specify the appropriate quality standards, 

including quantitative or qualitative acceptance criteria. The QA Manager will conduct audits on 

the design control process using independent technically qualified individuals to augment the 

QA audit team. 

During the review of design documents, the applicant commits to emphasizing conformance 

with applicable codes, standards, and license application design commitments. The applicant 

grants full and independent authority to engineering personnel assigned to perform document 

reviews such that review personnel may withhold approval of design documents until questions 

concerning the work have been resolved. 

The applicant will accomplish the design verification function through design reviews, alternative 

calculations, or qualification testing. The applicant requires that (1) the bases for a design, such 

as analytical models, theories, examples, tables, codes, and computer programs, be referenced 

in the design document, and (2) the application of such bases be verified during check and 

review. The applicant states that the responsible qualified individual will review and approve 

model tests when such tests are required to prove the adequacy of a concept or a design. The 

applicant commits to applying design verification testing to demonstrate adequate performance 

under conditions that simulate the most adverse design conditions. The applicant states that 

tests used for design verification will meet the design requirements. 

The applicant will use qualified individuals other than those who prepared the design to verify it. 

MFFF personnel from the same organization as those who prepared the design may verify it; 

the supervisor of the individual who prepared the design may verify it, provided that the 

supervisor did not specify a singular design approach or rule out certain design considerations 

and did not establish the design inputs. 

The applicant commits to accomplishing independent design verification before use of the 

design document (or information contained therein) by other organizations for design work or to 

support other activities, such as procurement, construction, or installation. The applicant states 

that, when this is not practical because of time constraints, it will identify and control the 

unverified portion of the document; however, the applicant commits to completing all design 

verification activities before relying on an item to perform its function. The applicant requires 

that the review and approval of changes to design and procurement documents be 

commensurate with the original approval requirements. This requirement applies to all 

changes, including field changes. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 12

15.3.2.5.2 Review and Approval of Changes 

The applicant demonstrates that the CM system will maintain strict consistency among design 

requirements, physical configuration, and facility documentation. The applicant will accomplish 

configuration control during design through the use of design control procedures. These 

procedures include controls for design preparation, review (including interdisciplinary review and 

preparation of nuclear safety evaluations (NSEs) and nuclear criticality safety (NCS) evaluations 

(NCSEs), as applicable), verification, approval, and release and distribution for use. The 

applicant will assess engineering documents for quality level classification and will review 

changes to the approved design to ensure consistency with the design bases of IROFS. 

The applicant will apply design verification in the CM program to ensure that design documents 

are consistent and that design requirements for IROFS are met. The applicant states that the 

construction and quality control organizations will conduct in-process verifications during 

construction, and the startup and quality organizations will verify configuration during testing to 

demonstrate the performance of IROFS. 

The applicant states that the MPQAP will require the use of procedures to ensure that work is 

accomplished in accordance with the requirements and guidelines imposed by applicable 

specifications, drawings, codes, standards, regulations, QA criteria, and site characteristics. 

The applicant will incorporate acceptance criteria established by the designer into the 

instructions, procedures, and drawings used to perform work at the MFFF. The applicant 

commits to maintaining documentation, such as test results and inspection records, to 

demonstrate the proper performance of work activities. The applicant also states that MFFF 

procedures will provide for review, audit, approval, and documentation of activities affecting the 

quality of items to ensure that applicable criteria have been met. 

The applicant establishes measures to review procedures to ensure that current maintenance, 

operations, and other facility procedures reflect any modifications to facility IROFS. The 

applicant states that qualified personnel knowledgeable in the QA disciplines will review MFFF 

maintenance, modification, and inspection procedures to determine the need for inspection, 

identification of inspection personnel, and documentation of inspection results. The review will 

also verify that applicable procedures have identified the necessary inspection requirements, 

methods, and acceptance criteria. The applicant commits to reviewing facility procedures on a 

frequency based on the age and use of the procedure to determine if changes are necessary or 

desirable and to ensuring that procedures are kept current with the facility configuration. The 

applicant states that procedure reviews will be conducted by individuals knowledgeable in the 

area(s) affected by each procedure. 

15.3.2.5.3 Implementation of Changes 

The applicant describes its process for tracking, implementing, documenting, and distributing 

changes to design requirements and facility documentation, including the placement of 

documents into a document control center and plans to disseminate these changes to affected 

functions within the facility. The applicant states that, after the appropriate parties have properly 

prepared, reviewed, and approved design documents, the responsible engineer will send them 

to document control for distribution. After the document is entered into Documentum, it will be 

electronically routed (distributed) to employees identified on the record submittal form. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 13

The applicant describes its process for identifying, authorizing, and implementing changes to 

design requirements and facility documentation in the event that it identifies deficiencies that 

affect the design of IROFS. The applicant states that it documents and resolves such 

deficiencies in accordance with approved corrective action program (CAP) procedures. In 

accordance with the CAP, the deficiency report documenting the inadequacy is forwarded for 

appropriate review to the responsible manager, who coordinates further review of the problem 

and revises the design documents affected by the deficiency. Where required, the responsible 

manager will forward the report to engineers in other areas to enable them to coordinate 

necessary revisions to their affected documents. 

The applicant states that design interfaces will be maintained by communication among the 

Functional Area Managers. The applicant describes the methods used to accomplish effective 

communication among design interfaces. The responsible engineer or authorized 

representative will review design documents. Project interface meetings will provide the primary 

working interface among the MFFF organizations and will be scheduled and held to coordinate 

design, procurement, construction, and preoperational testing of the facility. In addition to 

document review activities and project interface meetings, the applicant will maintain design 

interfaces by using procedures to establish policies for the transmittal and control of 

nonconformance reports. 

The applicant commits to establishing measures for MFFF operations to ensure responsible 

facility personnel are made aware of design changes and modifications that may affect the 

performance of their duties. 

15.3.2.6 Document Control

15.3.2.6.1 Storage of Documents 

The applicant commits to establishing procedures to control the preparation, issuance, and 

revision of documents, such as manuals, instructions, drawings, procedures, specifications, 

procurement documents, and supplier-provided documents. The applicant also commits to 

establishing measures to ensure that documents, including revisions thereto, will be adequately 

reviewed, approved, and released for use by authorized personnel. 

In the MFFF electronic document control and storage system, the applicant states that approved 

documents included in the CM program will be stored in Documentum, which is a tool capable 

of reporting the status of documents. The applicant commits to storing records not suitable for 

storage in Documentum in accordance with the requirements of MPQAP Section 6, “Document 

Control.” 

The applicant states that document control procedures will require documents to be transmitted 

and received in a timely manner at appropriate locations (including the location where the 

prescribed activity will be performed) to ensure that controlled copies of documents and their 

revisions are distributed to and used by the persons performing the activities. 

As stated in the application, the MFFF will retain superseded documents within Documentum 

and control them through document control. The applicant commits to generating indexes of 

current documents using Documentum. 

15.3.2.6.2 Identification of Documents 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 14

The applicant describes procedures that it will use to implement the document control program 

at the MFFF. The applicant states that it will implement approved procedures to track and 

retrieve current documents, historical records, and other information included in the CM 

program by attributes such as document number, document subject, component number, 

component name, and status. The applicant also states that the MFFF document control 

system will be capable of generating indices of controlled documents, which will be uniquely 

numbered (including revision numbers). 

The applicant commits to maintaining controlled documents until they are cancelled or 

superseded, after which the applicant commits to maintaining the documents as records for the 

life of the project or until termination of the license, whichever occurs later. The applicant 

commits to distributing controlled documents in hard-copy format when needed, in accordance 

with applicable procedures (e.g., when the electronic document management system (EDMS) is 

not available). 

The applicant defines documents that will be controlled at the MFFF. These documents will 

include design requirements; the ISA, through the controlled copies of supporting analyses; 

NSEs and NCSEs; drawings; specifications; calculations; technical reports; project procedures; 

QA documents; maintenance documents; audit and assessment reports; operating procedures; 

emergency response plans; and system modification documents. 

15.3.2.7 Audits and Assessments

The applicant commits to performing initial assessment(s) of the CM program as part of system 

turnover upon entering the operations phase. The applicant further commits to performing 

periodic assessments of the CM and design control program to determine the system’s 

effectiveness and to correct deficiencies. The applicant states that assessments will include a 

review of the adequacy of documentation and will be scheduled, conducted, and documented in 

accordance with approved procedures. 

As stated in Section 15.2.1, “Configuration Management Policy,” of the license application and 

reiterated in Section 15.2.7, the applicant commits to ensuring that the system meets its goals 

and that the design is consistent with the design bases through periodic audits and 

assessments of the CM program and of the design. The applicant states that it will perform 

incident investigations in accordance with the MPQAP and associated CAP procedures in the 

event problems are encountered. When needed as a result of incident investigations or in 

response to adverse audit or assessment results, the applicant commits to developing prompt 

corrective actions in accordance with CAP procedures. 

15.3.3 Maintenance

The applicant describes the maintenance and functional testing programs that will be 

implemented for the operations phase of the facility in Section 15.3 of the application. The 

applicant states that it will develop the maintenance program using information from sources 

such as equipment suppliers, reference plants, and lessons learned from other appropriate 

facilities. The preventive and corrective maintenance activities, surveillance activities, and 

performance trending, as discussed in this section, will provide reasonable and continuing 

assurance that IROFS will be available and reliable to perform their safety functions 

commensurate with the risk levels identified in the ISA. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 15

The applicant commits to providing and implementing measures that ensure that: (1) the safe 

and reliable operation of IROFS is continued, (2) the quality of the IROFS is not compromised 

by planned changes (modifications) or maintenance activities, and (3) quality will be maintained, 

in accordance with the quality requirements of the system under modification or as required by 

applicable regulations. As stated in the application, the Plant Manager will be responsible for 

the design of, and any modifications to, IROFS, as well as for maintenance activities performed 

during operations. The Plant Manager will also be responsible for ensuring the operational 

readiness of IROFS during maintenance. 

The applicant will develop and maintain IROFS so as to maximize their availability and 

reliability. The applicant commits to performing planned and scheduled maintenance of IROFS 

to ensure that they remain in a condition of readiness to perform their planned and designed 

functions when required. As stated in the application, the applicant will perform maintenance 

activities in accordance with approved procedures that meet the applicable requirements of the 

MPQAP. However, planning, scheduling, coordinating, and tracking work activities to 

completion, maintaining data analysis records, and trending equipment performance will be the 

responsibility of a work management group that will be compiled by the applicant. The work 

management group will also be responsible for the assessments of any recommendations or 

corrective actions identified by the Incident Investigations Program. 

15.3.3.1 Maintenance Categories

The applicant’s maintenance activities are categorized into four general areas or programs: 

(1) surveillance and monitoring, (2) preventive maintenance (PM), (3) corrective maintenance, 

and (4) functional testing. The applicant commits to performing audits and assessments of the 

maintenance activities to ensure the effectiveness of the maintenance function. 

15.3.3.1.1 Surveillance and Monitoring 

The applicant states the general purpose of the surveillance and monitoring program is to 

measure the degree to which IROFS meet performance specifications and detect degradation 

and adverse trends of IROFS. The applicant states that it will use data sources such as 

surveillances, periodic and diagnostic test results, plant computer information, operator rounds, 

walkdowns, as-found conditions, failure trending, and predictive maintenance to select 

parameters to be monitored. As stated by the applicant, these parameters will be selected 

based upon their ability to detect the predominant failure modes of the critical components. 

Surveillances, as stated by the applicant, may consist of measurements, inspections, functional 

tests, and calibration checks. The applicant will conduct surveillances at specified intervals and 

will trend results. The applicant states that PM frequencies will be adjusted and appropriate 

corrective actions implemented when trending identifies the degradation of IROFS. Incident 

investigations may be used, as stated in the application, to identify the root causes of failures 

that are related to the type or frequency of maintenance performed. The lessons learned from 

such investigations will be factored into the surveillance and monitoring and PM programs, as 

appropriate. 

The applicant states that it will establish criteria to monitor plant performance, IROFS functions, 

and component parameters. The applicant commits to establishing maintenance procedures 

that include appropriate compensatory measures for surveillance tests of IROFS that can be 

performed only while equipment is out of service. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 16

The applicant commits to maintaining records identifying the current surveillance schedule, 

performance criteria, and test results for IROFS, in accordance with the record management 

system. 

15.3.3.1.2 Preventive Maintenance 

The applicant provides a description of the PM program, including the commitment to conduct 

preplanned and scheduled periodic refurbishment, partial or complete overhauls, or 

replacement of IROFS, as necessary, to ensure the continued safety function of IROFS, even 

with unplanned outages. The applicant states that it will consider the results of surveillance and 

monitoring activities, in addition to any failure history, during PM planning. 

As part of PM activities, the applicant states that it will address instrumentation calibration and 

testing through procedures and calibration standards traceable to the national standards 

system. The applicant further states that it will provide compensatory measures during testing 

performed on IROFS that are not redundant to ensure that the IROFS function until they are 

returned to service. 

The applicant states that it will determine initial PM frequencies and procedures through the use 

of applicable industry experience, vendor-recommended intervals, and data derived from the 

reference facilities. Should it choose to deviate from those industry standards or vendor 

recommendations, the applicant commits to documenting the rationale for the deviation. In 

addition, the applicant states that feedback from PM and corrective maintenance, the results of 

incident investigations, and identified root causes, as appropriate, will be used to modify the 

frequency or scope of PM. The applicant states that, in determining the PM frequencies, it will 

consider the need to appropriately balance the objective of preventing failures through 

maintenance against the objective of minimizing the unavailability of IROFS because of PM. 

After conducting PM on IROFS, and before returning IROFS to operational status, the applicant 

commits to performing necessary functional testing as described in Section 15.3.1.4 of the 

application, “Functional Tests,” to ensure IROFS will perform their intended safety function. 

The applicant commits to maintaining records pertaining to PM in accordance with the records 

management system. As stated by the applicant, it will evaluate the results of PM activities 

related to IROFS through the CM system by safety disciplines to determine any impact on the 

ISA and the need for updates. 

15.3.3.1.3 Corrective Maintenance 

The applicant describes the corrective maintenance program as the repair or replacement of 

equipment that has unexpectedly degraded or failed. The applicant’s corrective maintenance 

program provides a planned, systematic, controlled, and documented approach for repair and 

replacement activities associated with IROFS. 

After conducting corrective maintenance on IROFS, and before returning them to operational 

status, the applicant commits to performing necessary functional testing, as described in 

Section 15.3.1.4 of the application, to ensure IROFS will perform their intended safety function. 

As stated by the applicant, it will evaluate the results of corrective maintenance activities related 

to IROFS through the CM system by safety disciplines to determine any impact on the ISA and 

the need for updates. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 17

15.3.3.1.4 Functional Tests 

The applicant states that it will implement a test control program incorporating plant procedures 

for test control and will provide for applicable compensatory measures during testing, in 

accordance with the limiting conditions for operations. 

The applicant divided the operational testing program structure into two major testing 

programs—the preoperational testing program (defined below) and the operational testing 

program (defined below), each of which contains two testing categories. The preoperational 

testing program contains functional and initial startup testing, while the operational testing 

program includes periodic and special testing. 

The applicant defines the objectives of the preoperational and operational testing program as 

ensuring that IROFS: (1) have been adequately designed and constructed, (2) meet licensing 

requirements, (3) do not adversely affect the health and safety of workers or the public, and 

(4) can be operated in a dependable manner so as to perform their intended function. In 

addition, the applicant states that the programs will ensure that operating, emergency, and 

surveillance procedures are correct. 

The applicant states that the facility operating, emergency, and surveillance procedures will be 

progressively use-tested throughout the testing program and will also be used in the 

development of preoperational and startup testing procedures, to the extent practicable. In 

addition, the preoperational use of procedures will serve to familiarize personnel with plant 

operations during the testing phases and also will ensure the adequacy of the procedures under 

actual or simulated operating conditions. 

Preoperational Testing Program 

The applicant defines preoperational testing as testing performed following construction 

turnover to determine facility parameters and to verify the ability of IROFS to meet performance 

requirements. As stated in the application, the applicant will complete MFFF preoperational 

functional tests related to IROFS before the introduction of SNM to the facility to verify that 

those IROFS that are essential to the safe operation of the plant are capable of performing as 

intended. The applicant states that any tests or portions thereof that are not required to be 

completed before the introduction of the SNM will be specified in the test plans. 

Functional Testing 

As stated in the application, the applicant will perform functional testing, as appropriate, 

(1) following initial installation, (2) as part of periodic surveillance testing, and (3) after PM or 

corrective maintenance or calibration, to ensure that the item is capable of performing its safety 

function when required. 

Initial Startup Testing 

The applicant defines the period during which it will perform initial startup testing. The applicant 

states that initial startup testing will begin during the introduction of SNM to the facility and will 

end with the start of operations. The applicant states that the purpose of initial startup testing is 

to ensure the safe processing of SNM and the verification of parameters assumed in the ISA. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 18

Operational Testing Program 

The operational testing program, as described by the applicant, consists of periodic testing and 

special testing. Periodic testing will be conducted at the facility to monitor facility parameters 

and verify the continuing integrity and capability of IROFS. Special testing is defined by the 

applicant as any testing that does not fall under any of the other testing programs and is 

conducted on a nonrecurring basis. 

The applicant states that the Maintenance Manager will have overall responsibility for the 

development and conduct of the operational testing program. The Operations Manager and 

Licensing Manager, in conjunction with the Maintenance Manager, will ensure that testing 

commitments and applicable regulatory requirements are met. 

Periodic Testing 

Periodic testing, as described by the applicant, will verify that the facility (1) complies with 

regulatory and licensing requirements, (2) does not endanger health and minimizes danger to 

life or property, and (3) is capable of operating so as to perform its intended function. The 

applicant states that the periodic testing program will apply during preoperational and 

operational stages of the facility, and the applicant commits to performing periodic testing and 

surveillances associated with the Quality Level 1 and Quality Level 2 SSCs in accordance with 

written procedures. 

The applicant states that it will establish a periodic testing schedule to ensure that required 

testing is performed properly, in a timely manner, and consistent with the limiting conditions for 

operations, as identified in the Operating Limits Manual. The applicant further states that it will 

schedule periodic testing, such that the plant’s safety will not be dependent on IROFS that are 

not tested. In cases where the testing is not performed within the specified timeframe, the 

applicant commits to providing appropriate compensatory measures. 

Special Testing 

The applicant describes special testing as testing that is not a facility preoperational test, 

periodic test, postmodification test, or postmaintenance test. The applicant states that it will 

conduct special testing to determine facility parameters or to verify the capability of IROFS to 

meet performance requirements. The applicant states that, at the discretion of the plant 

manager, any test may be conducted as a special test. 

The applicant identifies some of the purposes of special testing as acquisition of particular data 

for special analysis; determination of information relating to facility incidents; verification that 

required corrective actions reasonably produce expected results and do not adversely affect the 

safety of operations; and confirmation that facility modifications reasonably produce expected 

results and do not adversely affect systems, equipment, or personnel by causing them to 

function outside established design conditions. 

15.3.3.2 Measuring and Test Equipment

The Measuring and Test Equipment/Calibration Program, as described by the applicant, will be 

used to calibrate and maintain active engineered components used as IROFS. The applicant 

states that this program will identify the processes and plans to maintain and control calibration 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 19

instruments and calibrations used at the MFFF. The applicant states that the program will also 

describe how instrument maintenance activities will take place. 

15.3.3.3 Work Control 

The applicant describes the maintenance work control process as a coordinated and structured 

process that integrates production activities and requirements. The work control process, as 

structured, seeks to minimize challenges to safety and production requirements, maximize work 

efficiency, and maintain consistency when making modifications. As stated by the applicant, it 

will include representation from other organizations, as needed to complete work activities. 

Some of the coordinated work support functions identified by the applicant include work 

requests, procedures, schedules, radiation work permits, and lockout or tagout requirements. 

15.3.3.4 Relationship of Maintenance to Other Management Measures 

The applicant states that it will perform maintenance activities in accordance with the QA 

program, as described in the MPQAP. The applicant also states that approved and controlled 

documents needed to support maintenance activities will be obtained through the CM program. 

Furthermore, the applicant states that the training and qualification program will ensure that 

maintenance personnel are trained to perform their tasks. 

The applicant commits to performing audits and assessments of the maintenance program to 

ensure that the program implementation is effective. The applicant states that it will establish 

procedures to support the maintenance activities and that records management will provide the 

framework for review, maintenance, approval, handling, identification, retention, and retrieval of 

QA records related to maintenance activities. As stated by the applicant, incident investigations 

will identify the root cause(s) of any failures of the maintenance program. 

15.3.4 Training and Qualification

The applicant’s QA plan provides training and qualification requirements applicable during the 

operations phase of the facility, including preoperational functional testing and startup testing. 

The applicant states that the training program requirements apply to plant personnel who 

perform activities related to IROFS to ensure competent and safe job performance. The 

applicant commits to establishing requirements for the training of personnel performing QA 

Level 1 and Level 2 work activities; personnel performing nondestructive examination, 

inspections, and tests; and QA auditors. 

The applicant states that the principal objective of the training program system is to ensure job 

proficiency of all facility personnel through effective training and qualification. The applicant 

commits to providing employees with (1) training to establish the knowledge foundation, (2) onthe-job training (OJT) to develop work performance skills, and (3) continuing training, as 

required, to maintain proficiency in these knowledge and skill components, and to provide 

further employee development. 

The applicant identifies the requirements for personnel qualification and states that qualification 

will be indicated by the successful completion of prescribed training, a demonstration of the 

ability to perform assigned tasks, and the maintenance of requirements established by 

regulation. The applicant states that training will be designed, developed, and implemented 

according to a systematic approach that includes a variety of methods to accomplish the 

analysis, design, development, implementation, and evaluation of training. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 20

15.3.4.1 Organization and Management of Training 

The applicant states that line management is responsible and accountable for the development 

and effective conduct of training. The position description for line managers includes their 

training responsibilities; they are given the authority to manage, supervise, and implement 

training for their personnel and are supported by the training organization. The job function, 

responsibility, authority, and accountability of personnel involved in managing, supervising, and 

implementing training is clearly defined. The applicant identifies the accountability of line 

managers on the organizational chart included in the license application. The training manager 

is responsible for the facility training programs. The applicant will use performance-based 

training to analyze, design, develop, conduct, and evaluate training. 

The applicant will develop and implement administrative procedures to establish requirements 

for the training of personnel performing activities related to IROFS. The procedures will also 

provide reasonable assurance that all phases of training are conducted reliably and 

consistently. The applicant will grant exceptions from training requirements when justified, 

properly documented, and approved by appropriate management. The applicant will 

incorporate the results of human factor engineering analysis into the training process and will 

incorporate the human factors task analysis of the IROFS identified in the ISA into plant 

procedures. 

The applicant will use lesson plans or other approved process-controlling documents, as 

required, for training to ensure consistent presentation of the subject matter and will include 

updates to affected lesson plans in the change control process of the CM system when making 

design changes or plant modifications. 

The applicant will maintain accurate and retrievable training records to support management 

information needs associated with personnel training, job performance, and qualifications. It will 

maintain individual records on each employee’s qualifications, experience, and training. 

Specifically, training files will include records of general employee training, technical training, 

and employee development training conducted at the facility. The training manager is 

responsible for training records, which are retained in accordance with records management 

procedures. The applicant will use a learning management system to maintain training and 

qualification records. As stated in the application, all data entries will be peer reviewed within 

the training organization to ensure accuracy of the data, and data will be backed up nightly by 

the MOX information technology organization, with backup copies of the tapes stored remotely. 

15.3.4.2 Analysis and Identification of Functional Areas Requiring Training or Qualification 

The applicant will perform a needs and job analysis and will identify tasks to ensure that it 

provides appropriate training to personnel engaged in managing, supervising, performing, and 

verifying activities related to IROFS. The applicant states that it will identify job hazards as 

precautions and limitations in the procedure related to that task and will include them in the 

task’s needs and job analysis. 

The applicant will consult relevant subject matter experts, as necessary, to identify tasks for 

which training is appropriate. The applicant states that the training organization will identify, 

document, and address areas requiring training for competent and safe job performance and 

will consult with relevant subject matter experts, as necessary, to develop a list of tasks for 

which personnel training for specific jobs is appropriate. The applicant commits to comparing 

and reviewing the tasks selected for training with training materials as part of a training 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 21

effectiveness evaluation. As stated in the application, the applicant will update the list of tasks 

selected for training as necessitated by changes in procedures, processes, plant systems, 

equipment, or job scope and will create a matrix of the task list and the supporting procedures 

and training materials. 

15.3.4.3 Position Training Requirements 

The applicant states that it will develop minimum training requirements for positions where 

activities are relied on for safety. The initial identification of job-specific training requirements 

will be based on experience from the MFFF reference facilities of MELOX and La Hague, and 

other U.S. fuel cycle facilities. The applicant will determine the level at which an employee will 

initially enter the training program by an evaluation of the employee’s past experience, level of 

ability, and qualifications. The applicant will describe, in position descriptions, the entry-level 

criteria for positions where activities are relied on for safety and will grant exceptions from 

training requirements when justified and documented in accordance with the approved MFFF 

procedure. The applicant will conduct radiation safety training commensurate with each 

employee’s duties. 

The applicant also states that facility personnel may be trained through participation in general 

employee training or technical training. The applicant states that it will design the training 

program to prepare initial and replacement personnel for the safe, reliable, and efficient 

operation of the facility. The applicant commits to providing appropriate training for personnel of 

various abilities and experience backgrounds. As stated in the application, training 

requirements will be applicable, but not necessarily restricted, to personnel within the plant 

organization who have a direct relationship to the operation, maintenance, testing, or other 

technical aspects of the facility IROFS. The applicant will update training courses before use to 

reflect plant modifications and changes to procedures, when applicable. 

15.3.4.3.1 General Employee Training 

The applicant describes the general employee training that is required for access to the 

Savannah River Site and the MOX facility. The applicant states that general employee training 

will include QA, radiation protection, safety, emergency, and administrative procedures that are 

established by facility management and applicable regulations. The applicant states that 

persons that are under the supervision of facility management, including subcontractors, must 

participate in general employee training; however, certain temporary service and maintenance 

personnel will receive training to the extent necessary to ensure the safe execution of their 

duties. 

15.3.4.3.2 Technical Training 

The applicant states that it will design, develop, and implement technical training to assist 

employees in understanding applicable fundamentals, procedures, and practices related to 

IROFS. In addition, the applicant will use the technical training to develop the manipulative 

skills necessary to perform work related to IROFS. The applicant states that technical training 

will consist of initial training, OJT, and continuing training. 

Initial Training

 

The applicant described the initial training as that used to provide employees with an 

understanding of the fundamentals, basic principles, and procedures involved in work related to 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 22

IROFS. The applicant states that initial training will consist of, but will not be limited to, live 

lectures, taped and filmed lectures, required reading, self-guided study, demonstrations, 

laboratories, workshops, and OJT. 

The applicant states that certain new employees or employees transferred from other sections 

of the facility may be partially qualified by reason of previous training or experience, and thus it 

will determine the extent of training for these employees by applicable regulations, performance 

in review sessions, comprehensive examinations, or other techniques that can identify the 

employee’s level of ability. 

The applicant will develop initial job training and qualification programs for operations, 

maintenance, and technical services classifications and will group training for each program into 

logical blocks or modules. It will present training in a manner that ensures that specific 

behavioral objectives are accomplished, and it will evaluate trainee progress by written 

examinations and oral or practical tests. 

On-the-Job Training

The applicant will conduct OJT to provide the required job-related skills and knowledge for 

positions. It will conduct OJT in an environment as close to the work environment as feasible 

and will supplement and complement classroom training. The OJT and qualifications program 

will comprise applicable tasks and related procedures for each technical area. The applicant 

states that it will derive technical areas for OJT based on the activities identified in the ISA 

Summary, job and task analyses, and associated procedures. 

Continuing Training

The applicant defines continuing training as any training not provided as initial qualification or 

basic training that maintains and improves job-related knowledge and skills. The applicant will 

establish continuing training courses on a frequency needed to ensure that facility personnel 

remain proficient and will use periodic exercises, computer or classroom instruction, and any 

other type of training that is appropriate. The applicant states that, once it has established the 

objectives for continuing training, the methods for conducting it may vary; however, the method 

selected will provide clear evidence of objective accomplishment and consistency in delivery. 

15.3.4.4 Basis and Objectives for Training

The applicant states that the objective of the training program shall be to ensure the safe and 

efficient operation of the facility and compliance with applicable established regulations and 

requirements. The applicant also states that its training requirements shall be applicable, but 

not necessarily restricted, to those personnel within the plant organization who have a direct 

relationship to the operation, maintenance, testing, or other technical aspects of the facility 

IROFS. 

The applicant’s learning objectives will identify the training content based on needs, and job 

analyses, and position-specific requirements. The applicant will use the task list from the needs 

and job analysis to develop action statements describing desired post-training performance. 

The training program’s learning objectives will include: the knowledge, skills, and abilities to be 

demonstrated by the trainee; the conditions under which required actions will take place; and 

the standards of trainee performance expected by the applicant. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 23

15.3.4.5 Organization of Instruction

The applicant will develop lesson plans from training learning objectives, which are based on job 

performance requirements. The lesson plans and other training guides are developed under 

guidance from the training organization. These plans are reviewed by the training organization 

and, generally, by the organization responsible for the subject matter before approval and or 

use. The applicant will use lesson plans as required for classroom training and OJT and will 

include standards for evaluating acceptable trainee performance in the plans. 

15.3.4.6 Evaluation of Trainee Learning

The applicant will use observation, demonstration, or oral or written tests to evaluate a trainee’s 

mastery of learning objectives. The evaluations will measure the trainee’s skills and knowledge 

of job performance requirements. 

15.3.4.7 Conduct of On-the-Job Training 

The applicant will use OJT in combination with classroom training for selected activities. The 

applicant states that it will use lesson plans for classroom and OJT as required. The applicant 

also commits to using well-organized and current performance-based training materials and to 

including standards for evaluating acceptable trainee performance in training materials. As 

stated in the application, OJT will be conducted by personnel who are competent in the program 

standards of the job being performed and the methods of conducting the training. The applicant 

states that the completion of OJT will be demonstrated through actual task performance, where 

feasible and appropriate, or through performance of a simulation of the task, with the trainee 

explaining task actions based on the conditions that would be encountered during actual 

performance of the task and using references, tools, and equipment appropriate for the actual 

task, to the extent practical. 

15.3.4.8 Systematic Evaluation of Training Effectiveness

The applicant will evaluate the training program periodically to measure its effectiveness in 

producing competent employees. The evaluation will consider feedback provided from trainees 

after completion of classroom training sessions and will evaluate program strengths and 

weaknesses, determine whether the program content matches current job needs, and identify 

any corrective actions needed to improve the program’s effectiveness. 

The applicant may address the following elements of training as they apply to the evaluation 

objectives of the training program or topical area being reviewed: 

• management and administration of training and qualification programs 

• development and qualification of the training staff 

• position training requirements 

• determination of training program content, including its facility change control interface 

with the CM system 

• design and development of training programs, including lesson plans 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 24

• conduct of training 

• trainee examinations and evaluations 

• training program assessments and evaluations 

The applicant will document the evaluation results and will highlight the program’s noteworthy 

practices and weaknesses. The applicant will review identified deficiencies, recommend 

improvements, and make any changes to the affected procedures, practices, or training 

materials. In the event of plant modifications and procedure changes, the applicant will update 

affected training materials before their use. 

Designated facility or contracted training personnel will periodically monitor training and 

qualification activities. The applicant states that the QA organization will audit the facility training 

and qualification program. Trainees and vendors can also provide input related to training 

program effectiveness. Methods used to obtain training program feedback include surveys, 

questionnaires, performance appraisals, and staff evaluations, as well as instruments to 

evaluate the overall effectiveness of the training program. The applicant states that it does not 

evaluate frequently conducted training classes every time they are held but evaluates them 

routinely at a frequency sufficient to determine program effectiveness. 

15.3.4.9 Personnel Qualification 

The applicant will determine qualification requirements for technical personnel in accordance 

with Chapter 15 of the MOX license application and will identify training and qualification 

requirements associated with quality-affecting activities in the MPQAP. These requirements will 

include QA training for project personnel and qualification of nondestructive examination 

personnel, inspection and test personnel, personnel performing special processes, and auditors. 

The applicant provides the requirements for key management positions in Chapter 4, 

“Organization and Administration,” of the MOX license application. 

15.3.4.10 Provisions for Continuing Assurance 

The applicant states that it will evaluate personnel who perform activities relied on for safety at 

least biennially to verify that they continue to understand, recognize the importance of, and have 

the qualifications to perform such activities. The applicant will evaluate personnel using written 

or oral tests or on-the-job performance evaluations and will document the results of the 

evaluation. The applicant will provide retraining or other appropriate action when results of the 

evaluations dictate a need. The applicant will retrain personnel in the event of plant 

modifications, procedure changes, or QA program changes that result in new or revised 

information. 

15.3.5 Plant Procedures

The applicant commits to conducting all activities involving SNM in accordance with approved 

procedures. The applicant describes the procedures it will use for control of overall facility 

operations, including the conduct of all operations involving controls identified in the ISA as 

IROFS and all management control systems supporting IROFS. The applicant states that 

MFFF management policies will require strict adherence to procedures when performing work. 

The applicant states that it will require personnel to notify their supervisor in the event that a 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 25

procedure cannot be executed as written. The applicant also state that each MOX Services 

employee will have the authority to stop work that is being conducted within his or her scope of 

responsibility whenever it involves the health and safety of workers or the public, or protection of 

the environment, or when continued work will produce results that are not in compliance with the 

MOX Services QA program. 

The applicant commits to implementing the requirements of the MPQAP for the development 

and control of plant procedures. The applicant states that activities associated with the 

development and control of plant procedures will be performed by personnel who have 

undergone training in accordance with the requirements of MPQAP Section 2, “Quality 

Assurance Program.” The applicant states that all MFFF maintenance, testing, and operating 

procedures will meet the requirements of MPQAP Section 5, “Instructions, Procedures, and 

Drawing,” and that plant procedures will be distributed and controlled in accordance with the 

requirements of MPQAP Section 6, “Document Control.” The applicant also states that it will 

maintain documents that contain the results of procedure implementation (e.g., sign-offs, 

checklists, data sheets) in the records management system in accordance with the 

requirements of MPQAP Section 17, “Quality Assurance Records.” 

15.3.5.1 Types of Procedures

The applicant states that it will categorize MFFF procedures as either administrative procedures 

(which apply to functions or specific interfaces with other organizational functions) or operating 

procedures (which provide specific direction for functional task-based work). The applicant 

states that operating procedures can apply to all MOX Services organizations or only to a 

specific organization within MOX Services. 

15.3.5.1.1 Administrative Procedures 

The applicant states that administrative procedures will specify controls that apply to specific 

MFFF functions or to specific interfaces with other MFFF organizational functions. The 

applicant commits to implementing administrative procedures to address the administration and 

conduct of the following process activities: (1) training and qualification, (2) audits and 

assessments, (3) incident investigation, (4) records management, (5) CM, (6) human systems 

interface, (7) reporting, (8) QA, (9) equipment control (lockout or tagout), (10) shift turnover, 

(11) work control, (12) management control, (13) procedure management, (14) NCS, (15) fire 

protection, (16) radiation protection, (17) radioactive waste management, (18) maintenance, 

(19) environmental protection, (20) chemical process safety, (21) operations, (22) calibration 

control, (23) PM, (24) design control, and (25) test control. 

15.3.5.1.2 Operating Procedures 

The applicant states that operating procedures at MFFF will provide specific direction for 

functional task-based work within an organizational function and will include production, 

maintenance, and emergency procedures that address startup, operation, shutdown, control of 

process operations, and recovery after a process upset. The applicant identifies the specific 

areas addressed by these procedures as follows: ventilation; criticality alarms; shift routines, 

shift turnover, and operating practices; decontamination operations; plant utilities (air, other 

gases, cooling water, firewater, steam); temporary changes in operating procedures; and 

abnormal operation or alarm responses, including loss of cooling water, loss of instrument air, 

loss of electrical power, loss of the criticality alarm system, loss of containment, fires, and 

chemical process releases. The applicant commits to using the results of the ISA to identify the 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 26

need for, and to support the development of, specific ACs for IROFS contained in operating 

procedures. 

The applicant states that its operating procedures will include operating limits and controls and 

specific IROFS ACs necessary to ensure nuclear criticality safety, chemical safety, fire 

protection, emergency planning, and environmental protection. The applicant commits to 

identifying safety checkpoints (e.g., hold points for radiological or criticality safety checks, QA 

verifications, independent operator verification) at appropriate steps in operating procedures, if 

needed, to ensure the proper accomplishment of work. 

The applicant states that it will organize all of the documents that comprise operating 

procedures with a consistent structure. The applicant commits to applying a consistent 

structure to general rules for production, maintenance, operational safety, and security; 

abnormal operating procedures; emergency planning procedures; emergency operating 

procedures; and the environmental protection program. The applicant will also apply a 

consistent structure to unit operating instructions and maintenance instructions, which provide 

instructions for operating and maintaining process units, systems, and equipment. 

The applicant describes three categories of operating procedures that it will maintain at the 

MFFF: production, maintenance, and emergency procedures. Production procedures will 

control the startup, operation, and shutdown functions at the facility, as well as provide 

instructions for dealing with abnormal conditions, responding to alarms, controlling process and 

laboratory operations, and recovering after a process upset. Maintenance procedures will 

control preventive and corrective maintenance, calibration, surveillance, functional testing, and 

work control activities. Emergency procedures will describe the applicant’s response to a 

criticality event, a hazardous chemical release, or an emergency external to the MFFF that may 

affect the MFFF. 

15.3.5.1.2.1 Production Procedures

The applicant states that production procedures will control MFFF process operations and will 

apply to utility, workstation, and control room operations. The applicant commits to including the 

following elements, as applicable, in all production procedures: (1) purpose of the activity, 

(2) regulations, policies and guidelines governing the procedure, (3) type of procedure, (4) steps 

for each operating process phase, (5) initial startup and periodic startup and shutdown, 

(6) normal operations, (7) offnormal operations, (8) temporary operations, (9) emergency 

shutdown, (10) emergency operations, (11) normal shutdown, (11) startup following an 

emergency or extended downtime, (12) hazards and safety considerations (13) operating limits, 

(14) precautions necessary to prevent exposure to hazardous chemicals or SNM, 

(15) measures to be taken if contact or exposure occurs, (16) safety controls and the functions 

associated with the process, and (17) specified time period or other limitations on the validity of 

the procedure. 

15.3.5.1.2.2 Maintenance Procedures

The applicant states that MFFF maintenance procedures will include requirements for 

premaintenance activities, as necessary, and that these activities may include reviews of the 

work to be performed, work controls, and reviews of procedures. The applicant commits to 

requiring clearance from, or notification of, the operations organization as appropriate, when 

maintenance work and associated postmaintenance functional testing are complete. The 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 27

applicant commits to monitoring and assessing maintenance activities in accordance with the 

MPQAP. 

The applicant states that it will maintain facility SSCs in accordance with written procedures, 

documented instructions, checklists, or drawings appropriate to the circumstances. The 

applicant further states that maintenance activities will address repair, calibration, surveillance, 

and functional testing and will specifically include repairs and preventive repairs of IROFS, 

testing of criticality alarm units, calibration of IROFS, maintenance of high-efficiency particulate 

air filters, functional testing of IROFS, relief valve replacement and testing, surveillance and 

monitoring, pressure vessel testing, piping integrity testing, and containment device testing. 

The applicant identifies the organizational responsibilities for the preparation of maintenance 

procedures; specifically, the applicant states that the MFFF maintenance department, which is 

led by the Maintenance Manager, will be responsible for the preparation and implementation of 

maintenance procedures. 

The applicant will use approved, written procedures for periodic tests performed to determine 

various facility parameters and verify the continuing capability of IROFS to meet performance 

requirements. The applicant states that periodic test procedures will be sufficiently detailed so 

as to enable qualified personnel to perform the required functions without direct supervision. 

The applicant commits to implementing compensatory measures when testing is performed on 

IROFS that are not redundant, to ensure that they are able to perform their safety functions until 

they are returned to service. 

15.3.5.1.2.3 Emergency Procedures

The applicant commits to implementing emergency procedures to address the preplanned 

actions of operators and other plant personnel in response to an incident, criticality event, 

hazardous chemical release, or external emergency that may affect the MFFF. The applicant 

also commits to reviewing applicable procedures after unusual incidents (e.g., accidents, 

unexpected transients, significant operator errors, equipment malfunctions, system 

modifications) and to making revisions, as needed. 

15.3.5.2 Preparation of Procedures

The applicant states that its facility procedures will be consistent in format, well organized, clear, 

concise, and comprehensive. The applicant also states that its procedures may include 

(approved) checklists or data sheets as documented records of completion. The applicant 

describes its approval process for plant procedures; other members of the MFFF staff and 

vendors, as appropriate, will review procedure drafts for inclusion and correctness of technical 

information, including formulas, set points, and acceptance criteria. The applicant will require a 

peer review of all procedures that are written for the operation of equipment related to IROFS. 

The Functional Area Manager will be responsible for (1) determining whether procedures 

require any additional, cross-disciplinary review, and (2) approving procedures. The applicant 

commits to clearly identifying safety limits associated with IROFS in the applicable procedures. 

15.3.5.2.1 Identification and Preparation 

The applicant commits to using the results of the ISA and other processes to identify specific 

operating and administrative procedures that are developed for MFFF. The applicant also 

states that plant procedures will be prepared by qualified individuals who are assigned by the 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 28

organization’s management to be responsible and accountable for the operation associated with 

the procedure. 

The applicant commits to including consideration of ISA results or changes in ISA results in the 

process of identifying procedures needed for facility operation. The applicant further commits to 

incorporating a methodology for identifying, developing, approving, implementing, and 

controlling operating procedures. The applicant states that the methodology it is committed to 

implementing will ensure that, as a minimum, (1) the procedure will specify operating and safety 

limits related to IROFS, (2) procedures will include required actions for normal and abnormal 

conditions of operation. (3) safety checkpoints will be identified at appropriate steps in the 

procedure, if necessary, (4) procedures will be validated through field tests, (5) Functional Area 

Managers who are responsible and accountable for the operation will approved procedures, 

(6) a mechanism will be specified for revising and reissuing procedures in a controlled manner, 

(7) the QA elements and CM program at the facility will provide reasonable assurance that 

current procedures are available and in use at work locations, and (8) the facility training 

program will train the required persons in the use of the latest procedures available. 

15.3.5.2.2 Review and Approval 

The applicant states that managers who are responsible and accountable for an operation will 

review and approve the associated operating and administrative procedures. The applicant 

further states that the functional management may specify a review to be performed by another 

functional group. The applicant commits to verifying and validating production and maintenance 

procedures before initial use or after major revisions. 

15.3.5.2.3 Revisions 

The applicant commits to preparing and approving procedure revisions, including temporary 

changes, in the same manner as the original. The applicant also commits to defining the 

procedure change process in an MFFF procedure. 

15.3.5.3 Use of Procedures

The applicant states that it will require compliance with operating and maintenance procedures 

and will train operators and technicians to report inadequate procedures or the inability to follow 

procedures. The applicant states that procedures will either be available at work stations or 

readily accessible where needed to perform work. 

15.3.5.4 Control of Procedures 

The applicant describes its process for document control of plant procedures and states that, 

after approval, plant procedures will be processed for entry into the EDMS and issued for use. 

The applicant commits to implementing the MFFF training program, which is addressed in 

Section 15.4 of the MPQAP, to ensure that necessary personnel are trained in the use of 

approved procedures before implementation. 

The applicant commits to applying the same change control measures to operating and 

administrative procedures that are applied to other items in the document management system. 

The applicant states that document management procedures will ensure that changes to the 

facility, including procedures, are entered into the EDMS. The applicant also states that 

document management procedures will address control and distribution of changes, including 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 29

changes implemented for emergency conditions, temporary procedure changes, and temporary 

modifications. The applicant states that the MPQAP will provide requirements for QA 

procedures, which will detail the controls for design input, design output, processes, verification, 

interfaces, changes, approval, and records. 

The applicant commits to reviewing radiation protection, respiratory protection, operating, 

maintenance, and administrative procedures every five years to ensure technical adequacy and 

to verify their continued applicability and accuracy. The applicant also commits to reviewing 

respiratory protection procedures, as appropriate, whenever the MFFF undergoes a 

modification, change in process, or replacement of equipment. The applicant commits to 

reviewing emergency procedures annually for the first two years of MFFF operation and at least 

every two years thereafter. The applicant states that periodic reviews will be performed by 

qualified individuals who are assigned to be responsible and accountable for the associated 

operation by functional management. The applicant states that any reissue or approval of a 

procedure will meet the requirements for periodic review, and if a procedural inadequacy is 

identified as a root cause from an incident investigation, it will review and modify the applicable 

procedures as necessary. 

15.3.6 Audits and Assessments 

As described in Section 16 of the application, the applicant will maintain the audits and 

assessment program in accordance with Section 18, “Audits” of the MPQAP. The applicant 

states that it will review any changes to the MPQAP to ensure that the audit and assessment 

program will be current and will reflect the program description. As described by the applicant, 

audits will focus on verifying compliance with regulatory and procedural requirements, licensing 

commitments, and selected operating limits, and assessments will focus on evaluating the 

effectiveness of activities and ensuring that IROFS and items that affect the function of IROFS 

are available and reliable to perform their intended safety functions. In addition, the applicant 

states that it will perform audits and assessments to ensure that facility activities are conducted 

in accordance with the written procedures and that the processes reviewed are effective. As a 

minimum, the applicant commits to performing audits and assessments for activities related to 

radiation protection; criticality safety control; hazardous chemical safety; industrial safety, 

including fire protection; results of the ISA; environmental protection; and other areas identified 

through trends. 

As stated in the application, the applicant will perform audits in accordance with a written plan 

that identifies the audits to be performed and their schedules. The applicant confirms that 

qualified staff personnel who are not directly responsible for production activities will perform 

audits and assessments on an annual basis. The applicant states that audit team members will 

not have direct responsibility for the function and area being audited, will have technical 

expertise or experience in the area being audited, and will be trained in audit techniques. 

The applicant commits to performing technical and programmatic audits and assessments 

internally and externally to provide a comprehensive independent verification and evaluation of 

procedures and activities for IROFS. As described by the applicant, the QA Department will be 

responsible for audits related to Quality Level 1 work activities and items required to satisfy 

regulatory requirements for which Quality Level 1 requirements are applied. The applicant 

states that it will provide audits results to the Plant Manager and the managers responsible for 

the activities audited. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 30

The applicant states that any deficiencies identified during audits or assessments that require 

corrective action will be forwarded to the responsible manager in accordance with the CAP 

procedure. The manager will then be responsible for promptly responding to any deficiencies 

noted in the audits. The applicant states that it will enter deficiencies into the CAP, track them 

to completion, and re-examine them during future audits to ensure that associated corrective 

actions have been completed. As described by the applicant, the audit and assessment 

program will provide for on-the-spot corrective actions with appropriate documentation, in 

accordance with the CAP procedure, and will include the evaluation of corrective actions to 

determine their effectiveness. 

In the application, the applicant describes two assessments categories: (1) management 

assessments conducted by the line organizations responsible for the work activity and 

(2) independent assessments conducted by individuals not involved in the area being assessed. 

The applicant states that it will maintain records of the instructions and procedures, persons 

conducting the audits or assessments, identified violations of license conditions, and any 

corrective actions taken. 

15.3.6.1 Areas to be Audited or Assessed

The applicant identifies a list of areas that it will audit or assess at the MFFF, including radiation 

safety; nuclear criticality safety; chemical safety; industrial safety, including fire protection; 

environmental protection; emergency management; QA; CM; maintenance; training and 

qualifications; procedures; CAP and incident investigations; records management; and other 

ISA safety areas. The applicant commits to performing assessments of nuclear criticality safety 

in accordance with ANSI/ANS-8.19 to ensure that operations conform to criticality requirements. 

15.3.6.2 Scheduling of Audits and Assessments

The applicant states that it will establish a schedule identifying audits and assessments to be 

performed and the responsible organization assigned to conduct the activity. As described by 

the applicant, the frequency of audits and assessments will be reviewed periodically and revised 

as necessary to ensure coverage commensurate with current and planned activities. The 

applicant states that major activities will be audited or assessed on an annual basis. 

The applicant also states that it will conduct and document nuclear criticality safety audits such 

that all aspects of the Nuclear Criticality Safety Program will be audited every two years and 

assessed annually. 

15.3.6.3 Procedures for Audits and Assessments

The applicant commits to conducting internal and external audits and assessments in 

accordance with approved procedures. Among the audit and assessment activities that will be 

controlled by procedures are scheduling, planning, certifying personnel, developing audit plans, 

and reporting, tracking, and closure of findings. The applicant states that it will emphasize, 

through the applicable procedures, the importance of reporting and correcting findings to 

prevent recurrence. 

As described in the application, the applicant will conduct audits and assessments by using 

checklists (where applicable); interviewing personnel; performing plant area walkdowns, 

including accessible out-of-the-way and limited-access areas; reviewing plans and procedures; 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 31

observing work in progress; and reviewing completed QA documentation. The applicant 

commits to tracking the results of audits and assessments in the CAP. The applicant states that 

it will evaluate audit and assessment results for trends and needed improvements, which will be 

reported to the appropriate levels of management when identified. As described in the 

application, deficiencies will require corrective action in accordance with the applicable CAP 

procedure, and the QA organization will be responsible for performing followup reviews on 

significant deficiencies reported as a result of the trend analysis and for verifying completion of 

corrective actions. 

 

The applicant states that the audit or assessment team leader will develop a report documenting 

the findings, observations, and recommendations for program improvement and provide it to 

management. As described by the applicant, the report will include documented verification of 

performance against established performance criteria for IROFS and will be developed, 

reviewed, approved, and issued in accordance with applicable procedures. The applicant states 

that audit reports will contain an effectiveness evaluation and statement for each of the 

applicable QA program elements that were reviewed during the audit. The applicant commits to 

closing the audit or assessment with the proper documentation, in accordance with the 

applicable audit and assessment procedure. 

As described in the application, the QA organization will conduct followup audits or 

assessments to verify that corrective actions were taken in a timely manner and to assess their 

effectiveness. 

15.3.6.4 Qualifications and Responsibilities for Audits and Assessments 

The applicant states that the QA Manager will initiate audits and will determine the scope of 

each audit in coordination with the lead auditor. The QA Manager will also be responsible for 

the initiation of any special audits or the expansion of the scope of audits, when necessary. As 

described by the applicant, the lead auditor will direct the audit team in conducting the audit as 

well as in developing the applicable checklists, instructions, or plans for performing the audit. 

The applicant states that audit teams will consist of one or more auditors, and, should the team 

deem it necessary, it may expand the scope of the audit during the audit activity. The applicant 

commits to ensuring that audits will be performed in accordance with applicable checklists. 

The applicant states that auditors and lead auditors will hold the appropriate certifications, as 

required by the MPQAP. As stated in the application, to be certified under the MOX Services 

QA program, MFFF auditors will be required to complete training in areas such as the MFFF QA 

program, audit fundamentals, objectives and techniques of performing audits, and OJT. 

As described in the license application, to form the basis of each auditor’s certification, the QA 

Manager will evaluate the auditors’ and lead auditors’ education, experience, professional 

qualifications, leadership, sound judgment, maturity, analytical ability, tenacity, past 

performance, and success in completion of QA training courses. The applicant states that lead 

auditors must meet additional requirements for qualification, such as a minimum of five QA 

audits or audit equivalents within a period of time not to exceed three years before the date of 

certification, at least one of which must be a nuclear-related QA audit or audit equivalent within 

the year before certification. 

The applicant states that it will require personnel performing assessments to complete QA 

orientation training, as well as training on the assessment process. The applicant states that 

personnel performing assessments will not report to the production organization and will have 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 32

no direct responsibility for the function or area being assessed, enabling them to maintain 

independence and objectivity. 

15.3.7 Incident Investigations 

Section 15.7 of the application describes the two MFFF programs for investigating 

discrepancies during operations: the corrective action process and incident investigations. 

15.3.7.1 Corrective Action Process 

The applicant states that it will use the corrective action process, which is described in 

Section 16 of the MPQAP, “Corrective Action,” to identify, investigate, report, track, correct, and 

prevent recurrence of conditions that are adverse to quality or that may affect radiation 

protection, safety, quality, regulatory compliance, reliability, human performance, or project 

performance. The applicant states that MOX Services employees have the authority and 

responsibility to initiate the corrective action process if they discover deficiencies. The applicant 

further states that it will analyze reports of conditions adverse to quality to identify trends in 

quality performance, and these will be reported to senior management in accordance with 

corrective action process procedures. 

15.3.7.2 Incident Investigation 

The applicant commits to using the incident investigation program for investigating abnormal 

events other than those that involve a condition adverse to quality. As described in the 

application, the process that will be used for incident investigations may be similar to that of the 

CAP; the applicant states that it will consider events in terms of their regulatory reporting 

requirements and the level of investigation required. The applicant commits to providing 

guidance in written procedures for classifying occurrences (including examples of the threshold 

for offnormal events), incident identification, investigation, root-cause analysis, environmental 

protection analysis, recording, reporting, and followup. 

The applicant states that the depth of incident investigations will depend upon the severity of the 

classified incident in terms of the levels of SNM released or the degree of potential for exposure 

of workers, the public, or the environment. The applicant commits to addressing radiological, 

criticality, hazardous chemical, and other ISA-related safety requirements in incident 

investigations and states that anyone in the MFFF organization may identify the need for an 

incident investigation, which will be performed by one or more individuals assigned by the 

manager of production. As described in the application, MOX Services will maintain a record of 

corrective actions, including lessons learned and worker training, to be implemented as a result 

of investigations of offnormal occurrences and will track the corrective actions to completion. 

The applicant states that it will establish an incident investigation program to investigate 

abnormal events that may occur during operation of the facility to determine their specific or 

generic root cause(s) and generic implications, to recommend corrective actions, and to make 

reports to the NRC as required by 10 CFR § 70.50, “Reporting Requirements,” and 10 CFR § 

70.74, “Additional Reporting Requirements.” As described by the applicant, the investigation 

teams will include at least one process expert and one team member trained in root-cause 

analysis. The applicant commits to monitoring and documenting corrective actions taken 

through to completion. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 33

The applicant states that it will maintain auditable records and documentation related to 

abnormal events, investigations, and root-cause analyses so that it may apply the lessons 

learned to future operations of the facility. The applicant will compare details of the event 

sequence with accident sequences already considered in the ISA and, as appropriate, will 

modify the ISA and ISA Summary to include an evaluation of the risk associated with accidents 

of the type actually experienced. 

The investigation process, as described by the applicant, will include a prompt risk-based 

evaluation that, depending on the complexity and severity of the event, may be conducted by 

one individual. The applicant states that incident investigator(s) will be (1) qualified individuals 

appointed from internal or external staff, (2) independent from the line function(s) involved with 

the incident under investigation, and (3) assured of no retaliation for participating in 

investigations. The applicant commits to initiating investigations within forty-eight hours of the 

abnormal event, or sooner, depending on the safety significance of the event. As described in 

the application, the applicant will review the record of IROFS failures required to be maintained 

by 10 CFR § 70.62(a)(3), “Safety program and integrated safety analysis,” as part of the 

investigation. and, following completion of the investigation, the applicant will record revisions 

necessitated by post-failure investigation conclusions. 

The applicant states that it will develop CAP procedures for conducting incident investigations 

that will contain elements such as the following: 

• a documented plan for investigating an abnormal event; 

• a description of the functions, qualifications, and responsibilities of the manager who will 

lead the investigative team and those of the other team members, the scope of the 

team’s authority and responsibilities, and the assurance of management cooperation; 

• assurance of the team’s authority to obtain the information considered necessary and its 

independence from responsibility for or to the functional area involved in the incident 

under investigation; 

• requirements for retention of documentation related to abnormal events for two years or 

for the life of the activity, whichever is greater; 

• guidance for personnel conducting the investigation on how to apply a reasonable, 

systematic, structured approach to determine the specific or generic root cause(s) and 

generic implications of the problem; 

• requirements to make original investigation reports available to the NRC on request; and 

• a system for monitoring the completion of appropriate corrective actions and for ensuring 

that those actions are completed in a timely manner. 

15.3.8 Records Management 

The applicant describes the records management requirements in Section 15.8 of the 

application and states that Section 17 of the MPQAP contains additional details related to the 

records management program. The applicant identifies QA records as documents that include 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 34

the results of tests and inspections required by applicable codes and standards; construction, 

procurement, and receiving records; personnel certification records; design calculations; 

purchase orders; specifications; procedures; corrective action records; source surveillance and 

audit reports; and any other QA documentation required by specifications or procedures. As 

described in the application, the applicant will use a controlled and systematic approach to 

records management to provide identifiable and retrievable documentation during design, 

construction, and operation of the MFFF. The applicant commits to controlling QA records in 

accordance with approved procedures and will not consider these records valid until they are 

authenticated by authorized personnel. The applicant further commits to developing and 

implementing records management procedures that establish the requirements and 

responsibilities for record selection, verification, protection, transmittal, distribution, retention, 

maintenance, and disposition. In addition, the applicant states that it will establish procedures 

to promptly detect and correct deficiencies in the records management system or in the 

system’s implementation.

The applicant states that the MPQAP requires procedures for the review, approval, 

identification, handling, retention, retrieval, and maintenance of QA records. The applicant 

commits to maintaining records at locations where they can be reviewed and audited to ensure 

that the required quality of the records is maintained. The applicant further states that 

applicable design specifications, procurement documents, and other documents will specify 

applicable QA record requirements. 

The applicant states that it will manage classified records in accordance with approved project 

procedures that will identify the required physical protection and access control measures. As 

stated in the application, the applicant will establish a satellite records retention facility in 

accordance with the records management procedure. 

The applicant commits to establishing procedures to control and manage computer codes and 

electronic data used for IROFS over the life cycle of the MFFF. The applicant states that the 

MFFF Records Center will maintain control over access and use of records, either originals or 

reproductions, that are entered into the EDMS and will ensure that documents in the EDMS are 

legible and can be identified with the subject to which they pertain. The applicant states that 

documents will only be considered valid if stamped, initialed, signed, or otherwise authenticated 

by authorized personnel. 

The applicant will establish requirements to preclude deterioration of records in the EDMS, 

specifically, requirements pertaining to the records storage arrangement, to prevent damage 

from moisture, temperature, and pressure. For hardcopy records, the applicant will require 

records to be: (1) firmly attached in binders, placed in folders, or placed in envelopes for 

storage in steel file cabinets, or (2) stored on shelving in containers appropriate for the record 

medium. The applicant further states that the storage arrangement will provide adequate 

protection of special processed records (e.g., radiographs, photographs, negatives, microform, 

and magnetic media) to prevent damage from moisture, temperature, excessive light, 

electromagnetic fields, or stacking, consistent with the type of record being stored. 

The applicant identifies measures to ensure the accurate retrieval of information without undue 

delay. The applicant states that it will store and preserve the records in the Records Center in 

accordance with an approved QA procedure that contains the following: 

• a description of the storage facility; 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 35

• a description of the filing system to be used; 

• a method for verifying that the records received are in agreement with the transmittal 

document; 

• a method for verifying that the records are those designated and the records are legible 

and complete; 

• a description of rules governing control of the records, including access, retrieval, and 

removal; 

• a method for maintaining control of, and accountability for, records removed from the 

storage facility; 

• a method for filing supplemental information and disposition of superseded records; 

• a method for precluding entry of unauthorized personnel into the storage area, to guard 

against larceny and vandalism; and 

• a method for providing for replacement, restoration, or substitution of lost or damaged 

records. 

The applicant lists examples of the records that it will retain, including operating logs, 

procedures, non-conforming item reports, drawings and specifications, procurement documents, 

audit reports, and dosimetry records. As stated in the application, retention times will be 

specified in records management procedures and will ensure that records are retained in 

accordance with regulatory requirements. The applicant commits to storing one-of-a-kind 

records in two hour fire-rated cabinets, to ensure records are adequately protected from 

damage. 

15.4 Evaluation Findings

15.4.1 Quality Assurance 

The staff reviewed the QA program for a license for the MFFF to possess and use SNM 

according to Chapter 15.1 of NUREG-1718. Based on its review of the MOX Services QA Plan, 

the NRC staff concluded that the applicant has adequately described its QA program, and the 

applicant’s QA program meets the regulatory requirements of 10 CFR Part 70, as applied to 

SSCs, and will provide reasonable assurance of protection against natural phenomena and the 

consequences of potential accidents. The staff’s review and approval of the MFFF QA program 

is documented in the safety evaluation report dated October 1, 2001, as updated by the letter 

dated October 19, 2009. 

Configuration Management 

The staff reviewed the CM system for MFFF according to Section 15.2 of NUREG-1718. Based 

on its review of the material submitted in the license application, the NRC staff concluded that 

the applicant suitably and acceptably described its commitment to a proposed CM system, 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 36

including the method for managing changes in procedures, facilities, activities, and equipment 

for IROFS identified in the safety assessment for the design bases. 

The applicant described management-level policies and procedures, including an analysis and 

independent safety review of proposed activities involving IROFS that will ensure that the 

relationship among design requirements, construction, and facility documentation is maintained 

as part of a new design or change to an existing design. The MFFF ACs, as described in the 

application, will ensure that the organizational structure, procedures, and responsibilities 

necessary to implement CM are in place; that the design requirements and bases are 

documented and supported by analyses and the documentation is maintained current; that 

documents, including drawings, are appropriately stored and accessible; that drawings and 

related documents adequately describe IROFS; that procedures adequately describe how the 

applicant will achieve and maintain strict consistency among the design requirements, facility 

construction, and facility documentation; and that methods are in place for suitable analysis, 

review, approval, and implementation of identified changes to IROFS. 

The staff concludes that the applicant’s CM function meets the requirements of 10 CFR Part 70 

and provides reasonable assurance that the environment and the health and safety of the public 

are protected. 

15.4.2 Maintenance 

The staff reviewed the maintenance program for MFFF according to Section 15.3 of 

NUREG-1718. Based on the review of the license application, the staff concluded that the 

applicant committed to performing maintenance of IROFS, with the exception of personnel 

activities (safety controls). The staff reviewed and evaluated the maintenance commitments, 

which contain measures to ensure availability and reliability of IROFS through surveillance and 

monitoring, corrective maintenance, PM, and functional testing activities. The functional testing 

activities comprise a detailed test control program that covers preoperational and operational 

activities, including initial startup testing and periodic testing. The applicant’s maintenance 

function is proactive, using both surveillance and monitoring and maintenance records to 

analyze equipment performance and identify the root causes of repetitive failures. 

In addition, the surveillance and monitoring activities described in this section of the application 

provide assurance of the validity of the ISA by examination, calibration, and testing of 

equipment that monitors process safety parameters and acts to prevent or mitigate accident 

consequences. 

The maintenance function (1) is based on approved procedures, (2) employs work control 

methods that properly consider personnel safety, awareness of facility operating groups, QA, 

and the rules of CM, (3) links IROFS requiring maintenance to the ISA, (4) justifies the PM 

intervals in terms of equipment reliability goals, and (5) creates documentation that includes 

detailed records of all surveillances, inspections, equipment failures, repairs, and replacements. 

The staff concludes that the applicant's maintenance program meets the requirements of 

10 CFR Part 70 and provides reasonable assurance that the environment and the health and 

safety of the public are protected. 

15.4.3 Training and Qualifications 

The staff reviewed the application for the MFFF according to Section 15.4 of NUREG-1718. 

The applicant described the structure of the MFFF training and qualification program and 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 37

committed to providing plant personnel with a combination of general and technical training that 

includes initial training, OJT, and continuing education, as required, to establish and maintain 

the proficiency of personnel in their work duties. The applicant commits to performing a needs 

and job analysis to identify tasks that require training, to ensure that appropriate training is 

provided to personnel managing, supervising, performing, and verifying activities related to 

IROFS. The applicant further commits to systematically evaluating the effectiveness of the 

training program at periodic intervals. Based on its review of the application, the NRC staff 

concludes that the applicant adequately described its training and qualification of plant 

personnel and that the applicant’s training and qualification of plant personnel will, based on 

commitments, meet the requirements of 10 CFR Part 70 and provide reasonable assurance of 

the protection of public health and safety and of the environment. 

15.4.4 Procedures 

The staff reviewed procedural controls described in the license application for the MFFF 

according to Section 15.5 of NUREG-1718. The applicant described the administrative and 

operating procedures for control of overall facility operations, including the conduct of all 

operations involving controls identified in the ISA as IROFS and all management control 

systems supporting IROFS. The applicant committed to conducting all activities involving SNM 

in accordance with approved procedures and to reviewing all radiation protection, respiratory 

protection, operating, maintenance, and administrative procedures every five years to ensure 

technical adequacy and to verify the continued applicability and accuracy of the procedures. 

The applicant has suitably described the processes for development, review, approval, control, 

and implementation of procedures. As described in the application, MOX Services has 

established or made commitments to establish sufficient procedural guidance to ensure the 

proper control and protection of IROFS, as well as systems important to the health of workers 

and the public and the protection of the environment during testing, startup, and operation of the 

facility. Based on its review of the application, the NRC staff concludes that the applicant has 

adequately described its controls for the establishment, maintenance, use, and revision of 

MFFF procedures, and those controls meet the requirements of 10 CFR Part 70 and provide 

reasonable assurance of the protection of public health and safety and of the environment. 

15.4.5 Audits and Assessments 

The staff reviewed the MFFF audit and assessment program description, as described in the 

license application, according to Section 15.6 of NUREG-1718. The staff reviewed the 

applicant’s description of its policy directives, plans, and procedural requirements with respect 

to (1) the general structure of the audits and assessments program, (2) the activities to be 

audited or assessed, (3) the scheduling of audits and assessments, (4) the procedures for 

audits and assessments, and (5) the qualifications and responsibilities for audits and 

assessments. 

Based on its review of the application, the NRC staff concludes that the applicant has 

adequately described its system of audits and assessments, and this system meets the 

requirements of 10 CFR Part 70 and provides reasonable assurance of the protection of public 

health and safety and of the environment. 

15.4.6 Incident Investigations 

The staff reviewed the license application for MFFF as it pertains to incident investigations 

according to Section 15.7 of NUREG-1718. As described, the MFFF incident investigation 

program specifies the process for investigating abnormal events, the qualification requirements 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 38

for investigation personnel, the size and composition of investigation teams, corrective action 

commitments, and records requirements for investigation-related documents. The applicant 

commits to performing incident investigations in accordance with approved procedures. 

Based on its review, the NRC staff concluded that the applicant has established an organization 

for (1) investigating incidents that occur during operation of the facility, (2) determining the root 

cause(s) and any generic implications of each incident, and (3) taking corrective actions for 

ensuring the safety of the MFFF and its operations. Furthermore, the applicant has committed 

to reviewing the results of the investigation against the ISA, to monitoring and documenting 

corrective actions through to completion, to maintaining investigation-related documentation, 

and to applying lessons learned to future operations of the facility. Based on its review of the 

application, the NRC staff concludes that the applicant has adequately described its program for 

incident investigations, and the applicant’s controls for investigating incidents meet the 

requirements of 10 CFR Part 70 and provide reasonable assurance of the protection of public 

health and safety and of the environment. 

15.4.7 Records Management 

The staff reviewed the MFFF records management controls, as described in the license 

application, according to Section 15.8 of NUREG-1718. The staff reviewed the applicant’s 

records management requirements for the control and handling of the records and concluded 

that there is reasonable assurance that the system will (1) be effective in collecting, verifying, 

protecting, and storing information about the health and safety aspects of the facility and its 

operations and will be able to retrieve the information in readable form for the designated 

lifetimes of the records, (2) provide record storage facilities capable of protecting and preserving 

records that are stored there during the mandated periods, including protecting the stored 

records against loss, theft, tampering, or damage during and after emergencies, and (3) ensure 

that any deficiencies in the records management system or its implementation will be detected 

and corrected in a timely manner. The staff concludes that the applicant’s facility records 

management system meets the requirements of 10 CFR Part 70 and is acceptable.

REFERENCES 

(MOX, 2010a) Shaw AREVA MOX Services, “MFFF—License Application,” Aiken, SC, March 

2010. 

(MOX, 2010b) Shaw AREVA MOX Services, “MFFF—Integrated Safety Analysis Summary,” 

Aiken, SC, March 2010. 

(NRC, 2009) U.S. Nuclear Regulatory Commission, Letter from Marissa Bailey to David Stinson, 

“Approval of Changes to the Mixed Oxide Project Quality Assurance Program, Revision 8”, 

Washington, D.C., October 19, 2009. 

(NRC, 2001) U.S. Nuclear Regulatory Commission, Letter from Andrew Persinko to Peter 

Hastings, “Duke Cogema Stone & Webster Quality Assurance Program for Construction of the 

MOX Fuel Fabrication Facility,” Washington, D.C., October 1, 2001. 

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” August 2000. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

15 - 39

(ASME, 1995) American Society of Mechanical Engineers, ASME NQA-1a-1995, “Quality 

Assurance Requirements for Nuclear Facility Applications,” 1995. 

10 CFR Part 50, “Domestic Licensing of Production and Utilization Facilities” 

10 CFR Part 21, “Reporting of Defects and Noncompliance” 

10 CFR 70, “Domestic Licensing of Special Nuclear Material” 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

16 - 1 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

16.0 AUTHORIZATIONS AND EXEMPTIONS

16.1 Purpose of Review

This chapter of the safety evaluation report (SER) contains the U.S. Nuclear Regulatory 

Commission (NRC) staff’s review of Chapter 16 of the “Mixed Oxide Fuel Facility (MFFF) 

License Application” (MOX, 2010). The staff performed the review using general guidance from 

NUREG-1718, “Standard Review Plan for the Review of an Application for a Mixed Oxide 

(MOX) Fuel Fabrication Facility” (NRC, 2000), and the regulatory requirements of Title 10 of the 

Code of Federal Regulations (10 CFR) Part 20, “Standards for Protection against Radiation”; 

10 CFR Part 40, “Domestic Licensing of Source Material”; and 10 CFR Part 70, “Domestic 

Licensing of Special Nuclear Material.” The objective of this review is to verify whether the 

applicant (Shaw AREVA MOX Services, also referred to as MOX Services) has included 

exemptions and authorizations that are acceptable as determined by the staff’s review. 

16.2 Areas of Review

16.2.1 Exemptions 

16.2.1.1 Decommissioning 

In Section 16.1.1 of the license application (LA), the applicant stated that the U.S. Department 

of Energy (DOE) will assume responsibility for decommissioning the MFFF and that MOX 

Services has submitted a request for exemption (DCS, 2006a) from decommissioning 

requirements. The staff’s review of the acceptability of this exemption follows. 

As stated in Section 1.2.4.1 of the Construction Authorization Request (DCS, 2004), DOE 

intends to assume responsibility for decommissioning the MFFF. 

The contract between DOE and MOX Services includes a requirement that, following 

completion of its mission for disposition of excess plutonium, the facility will be deactivated and 

returned to DOE. As discussed in Issue 8 of SECY 99-177, “Current Status of Legislative 

Issues Related to NRC Licensing a Mixed Oxide Fuel Fabrication Facility,” dated July 8, 1999 

(NRC, 1999), it was suggested that the LA state that the MFFF be returned to DOE at the 

conclusion of the contract between DOE and MOX Services for the operation of the MFFF 

following deactivation of the MFFF to the satisfaction of DOE. 

Pursuant to 10 CFR § 70.17(a) and 10 CFR § 40.14(a), MOX Services requested an exemption 

from the requirements of 10 CFR § 70.38(d)–(k) and 10 CFR § 40.42, “Expiration and 

Termination of Licenses and Decommissioning of Sites and Separate Buildings or Outdoor 

Areas,” relating to the responsibility for decommissioning. Based on the agreement for DOE to 

assume responsibility for decommissioning, the staff finds the requested exemption to be 

acceptable. The requested exemption is authorized by law and will not endanger life, property, 

or the common defense and security and is in the public interest. Since DOE will assume 

responsibility for decommissioning, the method of financial assurance for decommissioning is in 

accordance with 10 CFR 70.25(f)(5) and 10 CFR § 40.36(e)(5). 

This exemption will be included in the license to possess and use radioactive material that may 

be granted to the applicant after completion of other regulatory requirements in 10 CFR Part 70. 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

16 - 2 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

16.2.1.2 Financial Protection 

In Section 16.1.2 of the LA, the applicant addressed the issue of Price-Anderson liability 

coverage. DOE has agreed to indemnify MOX Services in accordance with Section 170(d) of 

the Atomic Energy Act of 1954, as amended, and DOE Acquisition Regulation (DEAR) 952.250-

70, “Nuclear Hazards Indemnity Agreement” (48 CFR § 952.250-70). The applicant submitted a 

request (DCS, 2006b) for exemption from 10 CFR Part 140, “Financial Protection Requirements 

and Indemnity Agreements,” including the requirement in 10 CFR § 140.13a, “Amount of 

Financial Protection Required for Plutonium Processing and Fuel Fabrication Plants.” Chapter 2 

of this SER describes the staff’s review of the acceptability of this exemption. 

16.2.1.3 Labeling 

The applicant submitted a request (DCS, 2006c) for an exemption from the labeling 

requirements of containers with licensed material set forth in 10 CFR § 20.1904(a). Section 9.5 

of this SER presents the staff’s review of the acceptability of this exemption. 

16.2.2 Authorizations 

16.2.2.1 Prior Commitments 

In Section 16.2.1 of the LA, the applicant provided the authorization that all commitments made 

to the NRC prior to the most recent NRC-approved revision of the LA shall no longer be binding 

upon MOX Services unless imposed by license condition. The applicant has included this 

authorization under the assumption that all commitments relating to the MFFF will be included in 

or referenced by the license for the facility. The staff believes that upon issuance of a license, 

all issues that require commitments will be resolved or will be conditions of the license. The 

staff therefore finds that this authorization is acceptable. 

16.2.2.2 Frequencies 

When measurement, surveillance, and/or other frequencies are specified in the LA or other 

license commitments, the applicant proposes a list of definitions of the time period for specific 

frequency designations. The staff reviewed the frequencies associated with each time period 

and finds that the frequencies are well defined and reasonable. The staff therefore finds the use 

of the defined frequencies provided in the LA and their use to be acceptable. 

16.2.2.3 Changes to the License Application 

In Section 16.2.3 of the LA, the applicant provided the conditions to make changes to the LA 

and the criteria for determining when prior approval from the NRC would be needed. MOX 

Services maintains the LA so that it is accurate and up to date by means of the MFFF 

configuration management processes, which include written procedures. MOX Services 

evaluates changes to the facility and its processes for impact on the LA and updates the LA as 

necessary to ensure its continued accuracy. Responsibility for maintaining and updating the LA 

belongs to the manager of the support services function, as described in Chapter 4 of the LA. 

A change to the facility or its processes is evaluated before the change is implemented. The 

applicants’ evaluation of the change determines, before the change is implemented, whether an 

application for an amendment to the LA must be submitted in accordance with 10 CFR 70.34, 

“Amendment of licenses.” The LA describes the sites, structures, processes, systems, 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

16 - 3 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

equipment, components, computer programs, and activities of personnel. MOX Services may 

make changes to these items, as described in the LA, without prior NRC approval, if the change 

meets the following criteria: 

• It does not decrease the level of effectiveness of the design basis as described in the 

LA. 

• It does not result in a departure from a method of evaluation described in the LA and 

used in establishing the design bases. 

• It does not result in a degradation in safety. 

• It does not affect compliance with applicable regulatory requirements. 

• It does not conflict with an existing license condition. 

If a change to the LA is made, the applicant will promptly update the affected onsite 

documentation per written procedures. MOX Services will maintain records of changes to its 

facility. These records include a written evaluation that provides the bases for the determination 

that the changes to the LA do not require prior NRC approval. The applicant retains these 

records until termination of the license. Changes are communicated to the NRC as follows: 

• For changes that require NRC preapproval, MOX Services submits an amendment 

request to the NRC in accordance with 10 CFR 70.34 and 10 CFR 70.65, “Additional 

Content of Applications.” 

• For changes that do not require NRC preapproval of the LA, MOX Services submits to 

the NRC annually, within 30 days after the end of the calendar year during which the 

changes occurred, a brief summary of the changes. 

The staff has reviewed the commitments and requirements for making changes to the LA. 

Consistent with the change process of 10 CFR 70.72, “Facility changes and change process,” 

for the facility safety program, the requirements provided by the applicant have three key 

elements: 

(1) the criteria used to evaluate changes to determine when preapproval by the staff is 

required 

(2) the timeliness of updates to onsite documentation and reporting of changes to the staff 

(3) the commitment to providing documentation for the evaluation for determining prior NRC 

approval and to maintaining records of changes 

The staff finds that the criteria provided by the applicant for determining whether prior NRC 

approval is needed are consistent with the type of changes that would be made to the LA. The 

staff finds that the timeliness required for prompt updating of the onsite documentation and the 

timeframe for reporting changes not requiring NRC prior approval are reasonable and consistent 

with the process for making changes to the safety program as described in 10 CFR 70.72. The 

staff also finds that the commitment to performing and documenting the evaluation of NRC prior 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

16 - 4 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

approval and maintaining records is acceptable. The staff therefore finds that the authorization 

for making changes to the LA is acceptable. 

REFERENCES 

10 CFR Part 70 U.S. Code of Federal Regulations, “Domestic Licensing of Special Nuclear 

Material,” Part 70, Chapter I, Title 10, “Energy.” 

Atomic Energy Act, as amended 1954. 

(DCS, 2006a) Duke Cogema Stone & Webster Mixed Oxide Fuel Fabrication Facility to USNRC, 

“Request for Exemption from Decommissioning Requirements,” Aiken, SC, September 27, 

2006. 

(DCS, 2006b) Duke Cogema Stone & Webster Mixed Oxide Fuel Fabrication Facility to USNRC, 

“Request for Exemption from Indemnity Agreement and Financial Protection Requirements,” 

Aiken, SC, September 27, 2006. 

(DCS, 2006c) Duke Cogema Stone & Webster Mixed Oxide Fuel Fabrication Facility to USNRC, 

“Request for Exemption from Radiation Labeling Requirements,” Aiken, SC, September 27, 

2006. 

(DCS, 2004) Duke Cogema Stone & Webster, Mixed Oxide Fuel Fabrication Facility 

Construction Authorization Request, Aiken, SC, 2004. 

DOE Acquisition Regulations (DEAR) 952.250-70, “Nuclear Hazards Indemnity Agreement.” 

(MOX, 2010) Shaw AREVA MOX Services, “MFFF-License Application,” Aiken, SC, March 

2010.. 

(MOX, 2009b) Shaw AREVA MOX Services, “Request for Additional Information Regarding the 

Review of the Fundamental Nuclear Material Control Plan for the MFFF License Application 

Request, NRC-DCS-0000406, 26 February 2009,” Aiken, SC, December 17, 2009. 

(NRC, 2000) U.S. Nuclear Regulatory Commission, NUREG-1718, “Standard Review Plan for 

the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” Washington, 

DC, August 2000. 

(NRC, 1999) U.S. Nuclear Regulatory Commission, SECY 99-177, “Current Status of 

Legislative Issues Related to NRC Licensing a Mixed Oxide Fuel Fabrication Facility,” 

Washington, DC, July 1999. 

Price-Anderson Nuclear Industries Indemnity Act, Washington, DC, 1957. 

10 CFR Part 20, Standards for Protection Against Radiation 

10 CFR Part 40, Domestic Licensing of Source Material 

10 CFR Part 74, Material Control and Accounting of Special Nuclear Material 

10 CFR Part 140, Financial Protection Requirements and Indemnity Agreements 
OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

16 - 5 

OFFICIAL USE ONLY – SECURITY-RELATED INFORMATION 

48 CFR Part 952, Solicitation Provisions and Contract Clauses