Standard Review Plan 

for Fuel Cycle Facilities

License Applications

Final Report

Office of Nuclear Material Safety and Safeguards

NUREG-1520, Rev. 2
AVAILABILITY OF REFERENCE MATERIALS

IN NRC PUBLICATIONS

NRC Reference Material

As of November 1999, you may electronically access 

NUREG-series publications and other NRC records at 

NRC’s Library at www.nrc.gov/reading-rm.html. Publicly 

released records include, to name a few, NUREG-series

publications; Federal Register notices; applicant, 

licensee, and vendor documents and correspondence; 

NRC correspondence and internal memoranda; bulletins 

and information notices; inspection and investigative 

reports; licensee event reports; and Commission papers 

and their attachments.

NRC publications in the NUREG series, NRC regulations, 

and Title 10, “Energy,” in the Code of Federal Regulations

may also be purchased from one of these two sources.

1. The Superintendent of Documents

U.S. Government Publishing Office

Mail Stop IDCC

Washington, DC 20402-0001

Internet: bookstore.gpo.gov

Telephone: (202) 512-1800

Fax: (202) 512-2104

2. The National Technical Information Service

5301 Shawnee Rd., Alexandria, VA 22312-0002

www.ntis.gov

1-800-553-6847 or, locally, (703) 605-6000

A single copy of each NRC draft report for comment is

available free, to the extent of supply, upon written

request as follows:

Address: U.S. Nuclear Regulatory Commission

Office of Administration

Publications Branch

Washington, DC 20555-0001

E-mail: distribution.resource@nrc.gov

Facsimile: (301) 415-2289

Some publications in the NUREG series that are posted 

at NRC’s Web site address www.nrc.gov/reading-rm/

doc-collections/nuregs are updated periodically and may 

differ from the last printed version. Although references to 

material found on a Web site bear the date the material 

was accessed, the material available on the date cited 

may subsequently be removed from the site.

Non-NRC Reference Material

Documents available from public and special technical 

libraries include all open literature items, such as books, 

journal articles, transactions, Federal Register notices, 

Federal and State legislation, and congressional reports. 

Such documents as theses, dissertations, foreign reports 

and translations, and non-NRC conference proceedings 

may be purchased from their sponsoring organization.

Copies of industry codes and standards used in a

substantive manner in the NRC regulatory process are 

maintained at—

The NRC Technical Library

Two White Flint North

11545 Rockville Pike

Rockville, MD 20852-2738

These standards are available in the library for reference 

use by the public. Codes and standards are usually 

copyrighted and may be purchased from the originating 

organization or, if they are American National Standards, 

from—

American National Standards Institute

11 West 42nd Street

New York, NY 10036-8002

www.ansi.org

(212) 642-4900

Legally binding regulatory requirements are stated only in 

laws; NRC regulations; licenses, including technical specifications; or orders, not in NUREG-series publications. The 

views expressed in contractorprepared publications in this 

series are not necessarily those of the NRC.

The NUREG series comprises (1) technical and administrative reports and books prepared by the staff (NUREG–

XXXX) or agency contractors (NUREG/CR–XXXX), (2) 

proceedings of conferences (NUREG/CP–XXXX), (3) reports 

resulting from international agreements (NUREG/IA–XXXX), 

(4) brochures (NUREG/BR–XXXX), and (5) compilations of 

legal decisions and orders of the Commission and Atomic 

and Safety Licensing Boards and of Directors’ decisions 

under Section 2.206 of NRC’s regulations (NUREG–0750).

DISCLAIMER: This report was prepared as an account 

of work sponsored by an agency of the U.S. Government. 

Neither the U.S. Government nor any agency thereof, nor 

any employee, makes any warranty, expressed or implied, 

or assumes any legal liability or responsibility for any third 

party’s use, or the results of such use, of any information, 

apparatus, product, or process disclosed in this publication, 

or represents that its use by such third party would not 

infringe privately owned rights.
Standard Review Plan 

for Fuel Cycle Facilities

License Applications

Final Report

Manuscript Completed: May 2015

Date Published: June 2015

Office of Nuclear Materials Safety and Safeguards

NUREG-1520, Rev. 2

 

June 2015 iii NUREG-1520, Revision 2 

 

ABSTRACT

NUREG-1520, “Standard Review Plan (SRP) for Fuel Cycle Facilities License Applications” 

(hereinafter referred to as the SRP), provides guidance to the staff reviewers in the U.S. Nuclear 

Regulatory Commission’s (NRC’s) Office of Nuclear Material Safety and Safeguards who 

perform safety and environmental impact reviews of applications to construct or modify and 

operate nuclear fuel cycle facilities. This SRP addresses the longstanding health, safety, and 

environmental-protection requirements of Title 10, “Energy,” of the Code of Federal Regulations

(10 CFR) Part 20, “Standards for Protection against Radiation,” and 10 CFR Part 70, “Domestic 

Licensing of Special Nuclear Material,” as well as the accident-safety requirements reflected in 

Subpart H, “Additional Requirements for Certain Licensees Authorized To Possess a Critical 

Mass of Special Nuclear Material,” of 10 CFR Part 70. 

The SRP is intended to be a comprehensive and integrated document that provides the 

reviewer with guidance that describes methods or approaches that the staff has found 

acceptable for meeting NRC requirements. Separate chapters of this SRP discuss the major 

topics addressed within the safety program description of a facility license application, including 

general information, organization and administration, ISA and ISA summary, radiation 

protection, nuclear criticality safety, chemical process safety, fire safety, emergency 

management, environmental protection, decommissioning, management measures, material 

control and accounting, and physical protection. This SRP also makes information about 

licensing acceptance criteria widely available to interested members of the public and the 

regulated industry and is intended to improve industry and public stakeholder understanding of 

the staff review process. Each SRP section addresses the responsibilities of the staff 

reviewers, the matters that they review, the Commission's regulations pertinent to specific 

technical matters, the acceptance criteria used by the staff, the process and procedures used to 

accomplish the review, and the conclusions that are appropriate to summarize the review. 

The draft SRP was made publicly available for public comment on June 5, 2014, with a 

comment period ending on November 3, 2014 (79 FR 32579 and 79 FR 45849). A comment 

resolution table listing all comments and the NRC staff’s responses was made publicly available 

on March 23, 2015 (Agency Wide Documents Access and Management System Accession No. 

ML15065A339). This SRP is not a substitute for NRC regulations and compliance is not 

required. The approaches and methods in this report are provided for information only. 

Methods and solutions different from those described in this report will be acceptable if they 

provide a basis for the staff to make the determination needed to issue or continue a license. 

June 2015 v NUREG-1520, Revision 2 

CONTENTS 

 Page 

ABSTRACT .................................................................................................................................. iii

ACRONYMS AND ABREVIATIONS ........................................................................................... xiii 

INTRODUCTION .......................................................................................................................... 1 

1. GENERAL INFORMATION .................................................................................................... 1-1

1.1 Facility and Process Overview ........................................................................................ 1-1

1.1.1 Purpose of Review ................................................................................................... 1-1 

1.1.2 Responsibility for Review ......................................................................................... 1-1 

1.1.3 Areas of Review ....................................................................................................... 1-1 

1.1.4 Acceptance Criteria .................................................................................................. 1-2 

1.1.5 Review Procedures .................................................................................................. 1-3

1.1.6 Evaluation Findings .................................................................................................. 1-4 

1.2 Institutional Information ................................................................................................... 1-6 

1.2.1 Purpose of Review ................................................................................................... 1-6 

1.2.2 Responsibility for Review ......................................................................................... 1-6 

1.2.3 Areas of Review ....................................................................................................... 1-6 

1.2.4 Acceptance Criteria .................................................................................................. 1-7 

1.2.5 Review Procedures .................................................................................................. 1-9

1.2.6 Evaluation Findings ................................................................................................ 1-10 

1.3 Site Description ............................................................................................................. 1-12 

1.3.1 Purpose of Review ................................................................................................. 1-12

1.3.2 Responsibility for Review ....................................................................................... 1-12 

1.3.3 Areas of Review ..................................................................................................... 1-12 

1.3.4 Acceptance Criteria ................................................................................................ 1-14 

1.3.5 Review Procedures ................................................................................................ 1-15 

1.3.6 Evaluation Findings ................................................................................................ 1-15 

1.4 REFERENCES ............................................................................................................. 1-16

2. ORGANIZATION AND ADMINISTRATION ........................................................................... 2-1 

2.1 Purpose of Review .......................................................................................................... 2-1 

2.2 Responsibility for Review ................................................................................................ 2-1 

2.3 Areas of Review .............................................................................................................. 2-1 

2.4 Acceptance Criteria ......................................................................................................... 2-2 
June 2015 vi NUREG-1520, Revision 2 

2.4.1 Regulatory Requirements ........................................................................................ 2-2 

2.4.2 Regulatory Guidance ............................................................................................... 2-2 

2.4.3 Regulatory Acceptance Criteria ............................................................................... 2-2 

2.5 Review Procedures ......................................................................................................... 2-4 

2.5.1 Acceptance Review .................................................................................................. 2-4 

2.5.2 Safety Evaluation ..................................................................................................... 2-4 

2.6 Evaluation Findings ......................................................................................................... 2-4 

2.7 References ...................................................................................................................... 2-6

3. INTEGRATED SAFETY ANALYSIS ...................................................................................... 3-1 

AND INTEGRATED SAFETY ANALYSIS SUMMARY .............................................................. 3-1 

3.1 Purpose of Review .......................................................................................................... 3-1 

3.2 Responsibility for Review ................................................................................................ 3-3 

3.3 Areas of Review .............................................................................................................. 3-3 

3.3.1 Safety Program and Integrated Safety Analysis Commitments ............................... 3-4 

3.3.2 Integrated Safety Analysis Summary and Documentation ....................................... 3-5 

3.4 Acceptance Criteria ......................................................................................................... 3-7 

3.4.1 Regulatory Requirements ........................................................................................ 3-7 

3.4.2 Regulatory Guidance ............................................................................................... 3-8 

3.4.3 Regulatory Acceptance Criteria ............................................................................... 3-9 

3.5 REVIEW PROCEDURES ............................................................................................. 3-32 

3.5.1 Acceptance Review ................................................................................................ 3-33 

3.5.2 Safety Evaluation ................................................................................................... 3-33 

3.6 Evaluation Findings ....................................................................................................... 3-37 

3.7 References .................................................................................................................... 3-39 

APPENDIX A: EXAMPLE PROCEDURE FOR ACCIDENT SEQUENCE EVALUATION ...... 3-A-1 

ANNEX TO APPENDIX A: USE OF APPENDIX A RISK INDEX METHODOLOGY ........... 3-AA-1 

APPENDIX B: QUALITATIVE CRITERIA FOR EVALUATION OF LIKELIHOOD ................. 3-B-1 

APPENDIX C: INITIATING EVENT FREQUENCY ................................................................ 3-C-1 

APPENDIX D: NATURAL PHENOMENA HAZARDS ............................................................ 3-D-1 

ANNEX TO APPENDIX D: EXAMPLE OF NATURAL PHENOMENA HAZARD 

REVIEW FOR COMPLIANCE WITH 10 CFR 70.61 ........................................ 3-DD-1 

APPENDIX E: HUMAN FACTORS ENGINEERING FOR PERSONNEL ACTIVITIES .......... 3-E-1

4. RADIATION PROTECTION ................................................................................................... 4-1

4.1 Purpose of Review .......................................................................................................... 4-1 

4.2 Responsibility for Review ................................................................................................ 4-1 

4.3 Areas of Review .............................................................................................................. 4-1 

4.4 Acceptance Criteria ........................................................................................................ 4-2 
June 2015 vii NUREG-1520, Revision 2 

4.4.1 Commitment to Radiation-Protection Program Implementation ............................... 4-2 

4.4.2 Commitment to an ALARA Program ........................................................................ 4-3 

4.4.3 Organization and Personnel Qualifications .............................................................. 4-4 

4.4.4 Commitment to Written Procedures ......................................................................... 4-5 

4.4.5 Radiation Safety Training ......................................................................................... 4-6 

4.4.6 Ventilation and Respiratory Protection Programs .................................................... 4-8 

4.4.7 Radiation Surveys and Monitoring Programs ........................................................... 4-9 

4.4.8 Control of Radiological Risk Resulting from Accidents .......................................... 4-13 

4.4.9 Additional Program Commitments ......................................................................... 4-15 

4.5 Review Procedures ....................................................................................................... 4-16 

4.5.1 Acceptance Review ................................................................................................ 4-16 

4.5.2 Safety Evaluation ................................................................................................... 4-17 

4.6 Evaluation Findings ....................................................................................................... 4-17 

4.7 References .................................................................................................................... 4-18

5. NUCLEAR CRITICALITY SAFETY ........................................................................................ 5-1 

5.1 Purpose of Review .......................................................................................................... 5-1 

5.2 Responsibility for Review ................................................................................................ 5-1 

5.3 Areas of Review .............................................................................................................. 5-1 

5.4 Acceptance Criteria ......................................................................................................... 5-3 

5.4.1 Regulatory Requirements ........................................................................................ 5-3 

5.4.2 Regulatory Guidance ............................................................................................... 5-4 

5.4.3 Regulatory Acceptance Criteria ............................................................................... 5-4 

5.5 Review Procedures ....................................................................................................... 5-29 

5.5.1 Acceptance Review ................................................................................................ 5-29 

5.5.2 Safety Evaluation .................................................................................................... 5-29 

5.6 Evaluation Findings ....................................................................................................... 5-31 

5.7 References .................................................................................................................... 5-32 

APPENDIX A: NUCLEAR CRITICALITY SAFETY PERFORMANCE REQUIREMENTS 

AND DOUBLE-CONTINGENCY PRINCIPLE ..................................................... 5-A-1 

APPENDIX B: JUSTIFICATION FOR MINIMUM MARGIN OF SUBCRITICALITY 

FOR SAFETY ..................................................................................................... 5-B-1 

ANNEX TO APPENDIX B: ANSI/ANS-8.17 CALCULATION OF MAXIMUM Keff ............... 5-BB-1 

APPENDIX C: EXAMPLE PROCEDURE FOR SUBRITICAL EVALUATION ........................ 5-C-1

6. CHEMICAL PROCESS SAFETY ........................................................................................... 6-1 

6.1 Purpose of Review .......................................................................................................... 6-1 

6.2 Responsibility for Review ................................................................................................ 6-2 
June 2015 viii NUREG-1520, Revision 2 

6.3 Areas of Review .............................................................................................................. 6-2 

6.4 Acceptance Criteria ......................................................................................................... 6-3 

6.4.1 Regulatory Requirements ........................................................................................ 6-3 

6.4.2 Regulatory Guidance ............................................................................................... 6-4 

6.4.3 Regulatory Acceptance Criteria ............................................................................... 6-4 

6.5 Review Procedures ......................................................................................................... 6-8 

6.5.1 Acceptance Review .................................................................................................. 6-8 

6.5.2 Safety Evaluation ..................................................................................................... 6-8 

6.6 Evaluation Findings ....................................................................................................... 6-10 

6.7 References .................................................................................................................... 6-11

7. FIRE SAFETY ........................................................................................................................ 7-1 

7.1 Purpose of Review .......................................................................................................... 7-1 

7.2 Responsibility for Review ................................................................................................ 7-1 

7.3 Areas of Review .............................................................................................................. 7-1 

7.4 Acceptance Criteria ......................................................................................................... 7-2 

7.4.1 Regulatory Requirements ........................................................................................ 7-3 

7.4.2 Regulatory Guidance ............................................................................................... 7-3 

7.4.3 Regulatory Acceptance Criteria ............................................................................... 7-3 

7.5 Review Procedures ....................................................................................................... 7-10 

7.5.1 Acceptance Review ................................................................................................ 7-10 

7.5.2 Safety Evaluation ................................................................................................... 7-10 

7.6 Evaluation Findings ....................................................................................................... 7-11 

7.7 References .................................................................................................................... 7-13

8. EMERGENCY MANAGEMENT ............................................................................................. 8-1 

8.1 Purpose of Review .......................................................................................................... 8-1 

8.2 Responsibility for Review ................................................................................................ 8-1 

8.3 Areas of Review .............................................................................................................. 8-1 

8.3.1 Emergency Plan ....................................................................................................... 8-1 

8.3.2 Evaluation that No Emergency Plan Is Required ..................................................... 8-2 

8.4 Acceptance Criteria ......................................................................................................... 8-3 

8.4.1 Regulatory Requirements ........................................................................................ 8-3 

8.4.2 Regulatory Guidance ............................................................................................... 8-3 

8.4.3 Regulatory Acceptance Criteria ............................................................................... 8-3 

8.5 Amendments or Changes to the Emergency Plan ........................................................ 8-14 

8.6 Review Procedures ....................................................................................................... 8-14 
June 2015 ix NUREG-1520, Revision 2 

8.6.1 Acceptance Review ................................................................................................ 8-14 

8.6.2 Safety Evaluation ................................................................................................... 8-15 

8.7 Evaluation Findings ....................................................................................................... 8-16 

8.8 References .................................................................................................................... 8-17

9. ENVIRONMENTAL PROTECTION ....................................................................................... 9-1 

9.1 Purpose of Review .......................................................................................................... 9-1 

9.2 Responsibility for Review ................................................................................................ 9-1 

9.3 Areas of Review .............................................................................................................. 9-1 

9.3.1 Effluent and Environmental Controls and Monitoring ............................................... 9-3 

9.3.2 Integrated Safety Analysis Summary ....................................................................... 9-3 

9.3.3 Environmental Protection Management Measures .................................................. 9-4 

9.4 Acceptance Criteria ......................................................................................................... 9-5 

9.4.1 Regulatory Requirements ........................................................................................ 9-5 

9.4.2 Regulatory Guidance ............................................................................................... 9-6 

9.4.3 Regulatory Acceptance Criteria ............................................................................... 9-7 

9.5 Review Procedures ....................................................................................................... 9-16 

9.5.1 Review Procedures ................................................................................................ 9-16 

9.5.2 Effluent and Environmental Controls and Monitoring ............................................. 9-16 

9.5.3 Integrated Safety Analysis Summary ..................................................................... 9-16 

9.5.4 Management Measures ......................................................................................... 9-17 

9.5.2 Environmental Report ............................................................................................. 9-17 

9.6 Evaluation Findings ....................................................................................................... 9-17 

9.7 References .................................................................................................................... 9-20

10. DECOMMISSIONING ........................................................................................................ 10-1 

10.1 Purpose of review ....................................................................................................... 10-2

10.2 Responsibility for Review ............................................................................................ 10-2 

10.3 Areas of Review .......................................................................................................... 10-2 

10.4 Acceptance Criteria ..................................................................................................... 10-2 

10.4.1 Regulatory Requirements .................................................................................... 10-2 

10.4.2 Regulatory Guidance ........................................................................................... 10-3 

10.5 Review Procedures ..................................................................................................... 10-3 

10.5.1 Safety Evaluation ................................................................................................. 10-4 

10.6 Evaluation Findings ..................................................................................................... 10-4 

10.7 References .................................................................................................................. 10-5
June 2015 x NUREG-1520, Revision 2 

11. MANAGEMENT MEASURES ............................................................................................ 11-1 

11.1 Purpose of Review ...................................................................................................... 11-1 

11.2 Responsibility for Review ............................................................................................ 11-1 

11.3 Areas of Review .......................................................................................................... 11-1 

11.4 Acceptance Criteria ..................................................................................................... 11-5 

11.4.1 Regulatory Requirements ................................................................................... 11-5 

11.4.2 Regulatory Guidance .......................................................................................... 11-6 

11.4.3 Regulatory Acceptance Criteria .......................................................................... 11-6 

11.5 Review Procedures ................................................................................................... 11-27 

11.5.1 Acceptance Review .......................................................................................... 11-27 

11.5.2 Safety Evaluation ............................................................................................. 11-27 

11.5.3 Configuration Management .............................................................................. 11-27 

11.5.4 Maintenance ..................................................................................................... 11-29 

11.5.5 Training and Qualification ................................................................................. 11-29 

11.5.6 Procedures ....................................................................................................... 11-30

11.5.7 Audits and Assessments .................................................................................. 11-30 

11.5.8 Incident Investigations ...................................................................................... 11-30 

11.5.9 Records Management ...................................................................................... 11-31 

11.5.10 Other Quality Assurance Elements .................................................................. 11-31 

11.6 Evaluation Findings ................................................................................................... 11-31 

11.6.1 Configuration Management .............................................................................. 11-32 

11.6.2 Maintenance ..................................................................................................... 11-34 

11.6.3 Training and Qualification ................................................................................. 11-34 

11.6.4 Procedures ....................................................................................................... 11-34

11.6.5 Audits and Assessments .................................................................................. 11-35 

11.6.6 Incident Investigations ...................................................................................... 11-35 

11.6.7 Records Management ...................................................................................... 11-35 

11.6.8 Other Quality Assurance Elements .................................................................. 11-35 

11.7 References ................................................................................................................ 11-37

APPEDIX A: CHECKLIST FOR PROCEDURES...................................................... 11-A-1 

APPENDIX B: INCIDENT INVESTIGATION PROGRAMS AND PROCEDURES.............11-B-1 

APPENDIX C: RECORDS....................................................................................11-C-1 

12. MATERIAL CONTROL AND ACCOUNTING ..................................................................... 12-1 

12.1 Purpose of Review ...................................................................................................... 12-1 

12.2 Responsibility for Review ............................................................................................ 12-1 

12.3 Areas of Review .......................................................................................................... 12-2 
June 2015 xi NUREG-1520, Revision 2 

12.3.1 Category I Facility ................................................................................................ 12-2 

12.3.2 Category II Facility ............................................................................................... 12-3 

12.3.3 Category III Fuel Fabrication Facility .................................................................... 12-4 

12.3.4 Category III Enrichment Facility ........................................................................... 12-4 

12.4 Acceptance Criteria ..................................................................................................... 12-5 

12.4.1 Category I Facility ................................................................................................ 12-5 

12.4.2 Category II Facility ............................................................................................... 12-6 

12.4.3 Category III Fuel Fabrication Facility .................................................................... 12-6 

12.4.4 Category III Enrichment Facility ........................................................................... 12-7 

12.5 Review Procedures ..................................................................................................... 12-8 

12.5.1 Acceptance Review .............................................................................................. 12-8 

12.5.2 Safeguards Evaluation ......................................................................................... 12-8 

12.6 Evaluation Findings ..................................................................................................... 12-8 

12.7 References ................................................................................................................ 12-10

13. PHYSICAL PROTECTION ................................................................................................. 13-1 

13.1 Purpose of Review ...................................................................................................... 13-1 

13.2 Responsibility for Review ............................................................................................ 13-1 

13.3 Areas of Review .......................................................................................................... 13-1 

13.3.1 Formula Quantity of Strategic Special Nuclear Material ...................................... 13-2 

13.3.2 Moderate Strategic or Low Strategic Special Nuclear Material ............................ 13-3 

13.4 Acceptance Criteria ..................................................................................................... 13-3 

13.4.1 Formula Quantity of Strategic Special Nuclear Material ...................................... 13-4 

13.4.2 Moderate Strategic or Low Strategic Special Nuclear Material ............................ 13-5 

13.5 Review Procedures ..................................................................................................... 13-6 

13.5.1 Acceptance Review .............................................................................................. 13-6 

13.5.2 Safety Evaluation ................................................................................................. 13-6 

13.6 Evaluation Findings ..................................................................................................... 13-7 

13.7 References .................................................................................................................. 13-8

14. GLOSSARY ....................................................................................................................... 14-1 

June 2015 xiii NUREG-1520, Revision 2 

ACRONYMS AND ABBREVIATIONS

ACGIH American Conference of Governmental Industrial Hygienists 

AEC active engineered control 

AEGL Acute Exposure Guideline Level 

ALARA as low as is reasonably achievable 

ANS American Nuclear Society 

ANSI American National Standards Institute 

ASME (formerly the American Society of Mechanical Engineers) 

ASTM (formerly the American Society for Testing and Materials) 

B.A. Bachelor of Arts [degree] 

B.S. Bachelor of Science [degree] 

BDC baseline design criterion/criteria 

CAAS criticality accident alarm system 

CD chemical dose 

CFR Code of Federal Regulations 

Ci curie(s) 

CM configuration management 

DFP decommissioning funding plan 

DOE U.S. Department of Energy 

DP decommissioning plan 

EA environmental assessment 

EAL emergency action level 

EIS environmental impact statement 

ERDA Energy Research and Development Administration 

ERPG Emergency Response Planning Guidelines 
June 2015 xiv NUREG-1520, Revision 2 

FCSE Division of Fuel Cycle Safety, Safeguards, and Environmental Review [in the Office of 

Nuclear Material Safety and Safeguards] 

FHA fire-hazards analysis/analyses 

FONSI finding(s) of “no significant impact” 

FR Federal Register

GBq gigabecquerel(s) 

HFE human-factors engineering 

HPS Health Physics Society 

HS&E health, safety, and environment 

HSI human/systems interface 

ICRP International Commission on Radiological Protection 

IEF initiating-event frequency 

IROFS item(s) relied on for safety 

 

ISA integrated safety analysis/analyses 

ISO International Organization for Standardization 

kg kilogram(s) 

km kilometer(s) 

MDC minimum detectable concentration 

mg milligram(s) 

mi mile(s) 

MTTF mean time to failure 

MTTR mean time to repair 

NCRP National Council on Radiation Protection and Measurements 

NCS nuclear criticality safety 

NFPA National Fire Protection Association 

NMSS Office of Nuclear Material Safety and Safeguards [in the U.S. Nuclear Regulatory 

Commission] 
June 2015 xv NUREG-1520, Revision 2 

NRC U.S. Nuclear Regulatory Commission 

OCB oxide-conversion building 

OER operating-experience review 

ORR operational readiness review 

OSHA Occupational Safety and Health Administration 

PEC passive engineered control 

PFOD probability of failure on demand 

PHA process hazard analysis/analyses 

PM preventive maintenance 

PMF probable maximum flood 

QA quality assurance 

RAI request(s) for additional information 

RD radiological dose 

RWP radiation work permits 

SBC Standard Building Code 

SER safety-evaluation report 

SNM special nuclear material 

SRP standard review plan 

SSE safe-shutdown earthquake 

Sv sievert 

TEDE total effective dose equivalent(s) 

UF6 uranium hexafluoride 

UO2 uranium dioxide 

V&V verification and validation 

yr year(s) 

June 2015 1 NUREG-1520, Revision 2 

INTRODUCTION

NUREG-1520, “Standard Review Plan (SRP) for Fuel Cycle Facilities License Applications” 

(hereinafter referred to as the SRP), provides U.S. Nuclear Regulatory Commission (NRC) 

guidance for reviewing and evaluating the health, safety, and environmental protection aspects 

of applications for licenses to possess and use special nuclear material (SNM) to produce 

nuclear reactor fuel. This guidance is specific to fuel cycle facilities regulated under Title 10, 

“Energy,” of the Code of Federal Regulations (10 CFR) Part 70, “Domestic Licensing of Special 

Nuclear Material”; that is, facilities that are authorized for or are seeking a license to possess 

and use more than a critical mass of SNM. This guidance also applies to the review and 

evaluation of proposed amendments and license renewal applications for nuclear fuel cycle 

facilities. This guidance does not apply to conversion facilities,1

 reprocessing facilities, or 

plutonium processing facilities.2

The principal purpose of this SRP is to ensure the quality and uniformity of reviews conducted 

by the staff of the NRC’s Office of Nuclear Material Safety and Safeguards (NMSS). This SRP 

also provides a well-defined foundation from which to evaluate proposed changes in the scope, 

level of detail, and acceptance criteria of reviews. It also provides information and guidance to 

assist the licensing staff and the applicant in understanding the underlying objectives of the 

regulatory requirements, the relationships among NRC requirements, the licensing process, the 

major guidance documents that the NRC staff has prepared for licensing fuel cycle facilities, and 

information about aspects of the staff review process set out in individual SRP sections. 

Another important purpose of this SRP is to make information about regulatory reviews widely 

available and to improve communication and understanding of the staff review process. In 

addition, because this SRP describes the scope, level of detail, and acceptance criteria for 

reviews, it contains regulatory guidance for applicants who need to determine what information 

to present in a license application and related documents. This SRP does not preclude 

licensees or applicants from suggesting alternative approaches to those specified in the SRP to 

demonstrate compliance with applicable regulations. 

This SRP addresses the longstanding health, safety, and environmental-protection 

requirements of 10 CFR Part 20, “Standards for Protection against Radiation,” and 10 CFR 

Part 70, as well as the accident safety requirements reflected in Subpart H, “Additional 

Requirements for Certain Licensees Authorized To Possess a Critical Mass of Special Nuclear 

Material,” of 10 CFR Part 70. 

Subpart H of 10 CFR Part 70 identifies risk-informed performance requirements and requires 

applicants and existing licensees to conduct an integrated safety analysis (ISA) and submit an 

ISA Summary, as well as other information. Specific requirements for ISA Summaries are 

described in 10 CFR 70.65, “Additional Contents of Applications.” For new facilities that have 

not already been designed, built, licensed and operated, Subpart H also requires adherence to 

baseline design criteria, as specified in 10 CFR 70.64, “Requirements for New Facilities or New 

Processes at Existing Facilities.” 

 

1

 The NRC regulates conversion facilities under the provisions of 10 CFR Part 40, “Domestic Licensing of Source 

Material.” 2

 Guidance for the review of a license application for a Mixed Oxide (MOX) Fuel Fabrication Facility is provided in 

NUREG-1718, “Standard Review Plan for the Review of a License Application for a MOX Fuel Fabrication Facility,” 

issued August 2000. 
June 2015 2 NUREG-1520, Revision 2 

In reviewing a license application, renewal application, or license amendment for a fuel cycle 

facility, the staff must determine whether there is reasonable assurance that the facility can and 

will be operated in a manner that will not be inimical to the common defense and security and 

will adequately protect the health and safety of workers, the public, and the environment. The 

staff uses a “reasonable assurance” paradigm and focuses on the programmatic provisions of 

the applicant’s proposed activities. To carry out this responsibility, the staff focuses on the 

descriptive commitments of the safety program in the license application and the description of 

processes, hazards, controls, and management measures in its ISA Summary and onsite ISA 

documentation. The staff evaluates the information that the applicant provides and, through 

independent assessments, determines whether the applicant has proposed an adequate safety 

program that is compliant with regulatory requirements. To assist the staff in carrying out this 

responsibility, this SRP clearly states and identifies those standards, criteria, and bases that the 

staff will use in reaching licensing decisions. 

An application for a 10 CFR Part 70 license must satisfy the requirements described in 

10 CFR 70.22, “Contents of Application,” including specific information on the proposed 

equipment and facility in accordance with 10 CFR 70.22(a)(7), which states that each 

application shall contain the following: 

A description of equipment and facilities which will be used by the applicant to protect health 

and minimize danger to life or property (such as handling devices, working areas, shields, 

measuring and monitoring instruments, devices for the disposal of radioactive effluents and 

wastes, storage facilities, criticality accident alarm systems, etc.). 

Consequently, the licensing decision is ultimately based on information with a sufficient level of 

detail that permits reviewers to understand process system functions and, functionally, how 

items relied on for safety (IROFS) can perform as intended and be reliable. This staff review 

method is intended to ensure that the staff decision is based on a reasonable assurance that 

the submitted ISA Summary is complete, that the licensee will comply with the ISA and maintain 

it consistent with the regulations, and that the applicant’s programs will be adequate to design 

and operate a facility that complies with all applicable regulations and provides for adequate 

protection of public health and safety. For new facilities or new processes at existing facilities, 

there may not be complete detail or a final design available at the time of licensing. However, 

sufficient information must be available to permit the staff to understand the theory of operation 

and function of each IROFS, to have reasonable assurance that all credible accident sequences 

have been identified, that a sufficient set of IROFS has been defined, and that management 

measures will be sufficient to ensure IROFS will be available and reliable to perform their 

intended functions in the context of 10 CFR 70.61, “Performance Requirements.” 

For uranium enrichment facilities, to ensure that the applicant’s programs have been sufficiently 

implemented and commitments have been properly applied in the final facility design and in the 

constructed facility, 10 CFR 70.32(k) states: 

No person may commence operation of a uranium enrichment facility until the Commission 

verifies through inspection that the facility has been constructed in accordance with the 

requirements of the license. 

This requirement applied through inspections, and not by licensing reviews, will ensure that the 

programmatic commitments made by licensee are properly applied in the as built facility. This 

inspection is intended to inspect the final design of the facility and the procedures that have 
June 2015 3 NUREG-1520, Revision 2 

been prepared to implement the licensee’s commitments that are reflected in the license. 

Furthermore, for significant modifications to existing fuel cycle facilities, such as the licensing 

and construction of new processes, the staff may impose a license condition that specifies that 

an operational readiness review (ORR) inspection be conducted before operation to verify that 

the new part of the facility has been constructed in accordance with the requirements of the 

license. To facilitate the planning and accomplishment of a risk-informed ORR, the staff relies 

upon the licensee to provide a complete set of information. This complete set of information has 

been referred to in some projects as IROFS boundary packages.3

 For simplicity they will be 

referred to hereinafter in this document as IROFS boundary packages. Regardless of what they 

are called in a license application, the key point is that they provide information to the reviewers 

and inspectors about supporting systems that directly affect the effectiveness of the IROFS and 

the reliability and availability of the IROFS as required by 10 CFR 70.62(d). Inspectors use this 

information during the ORR inspection to determine if the licensee meets the requirements in 

10 CFR 70.23(a)(3)–(4) and in 10 CFR 70.61(e). 

In developing the performance requirements in 10 CFR Part 70, the NRC anticipated that, in the 

future, changes would be made to the facility design and processes and, therefore, described a 

process for addressing these changes is described in 10 CFR 70.72, “Facility Changes and 

Change Processes.” For a uranium enrichment facility, the licensee may make changes to its 

design, after receiving its license, during the construction phase, and after operations begin. 

These changes, therefore, need to be submitted and reviewed in accordance with 

10 CFR 70.72. 

The requirements in 10 CFR 70.22; 10 CFR 70.23, “Requirements for the Approval of 

Applications”; and Subpart H to 10 CFR Part 70 specify, in general terms, the information to be 

supplied in a safety program description. As such, this SRP identifies the specific information 

that an applicant should submit for staff evaluation. Prospective applicants should study the 

topic areas treated in this SRP and the sections within each chapter (particularly those 

regarding areas of review and acceptance criteria). To facilitate the staff’s review, a license 

application should contain a safety program description that addresses the contents of this SRP 

 

3

 IROFS boundary packages are documents that contain the physical descriptions and parameters of structures, 

systems, and components that are used to meet the performance requirements of 10 CFR 70.61. IROFS boundary 

definition packages are also prepared for administrative procedures or worker actions that are defined as IROFS. 

The boundary packages identify the specific functions to be performed by an IROFS and identify any items that 

may affect the function of the IROFS. The boundary packages also identify the facility areas in which the IROFS is 

used, its design and functional attributes, management measures related to it, any open items about it, and its 

supporting documentation (e.g., piping and instrumentation diagrams and schematics). 

 Design and functional attributes should include safety functions such as separation from other IROFS, redundancy 

and diversity, fail-safe design, set points, environmental qualification, seismic qualification, and fire protection. 

System interfaces such as instrumentation, electrical, cooling, and lubrication requirements should also be included 

under design and functional attributes. 

 Management measures should address all of the management measures required to be applied to IROFS under 

10 CFR 70.4, “Definitions,” and should include summary descriptions; references to maintenance, training, and 

procedures documents; or both, as appropriate for the IROFS. The references should be adequate to identify the 

actual working-level training or procedures document. 

 Open items that affect the reliability, the effectiveness, or both of the IROFS should be closed by the time of the 

ORR. The open items section should identify open items associated with the IROFS during the review and 

describe how the open items were resolved. 
June 2015 4 NUREG-1520, Revision 2 

in the same order as presented in this document. Applicants may reference material submitted 

in one location in a license application at another location to avoid unnecessary duplication. In 

addition, 10 CFR 70.61 requires each applicant to evaluate, in an ISA performed in accordance 

with 10 CFR 70.62, “Safety Program and Integrated Safety Analysis,” its compliance with the 

performance requirements in 10 CFR 70.61(b), 10 CFR 70.61(c), and 10 CFR 70.61(d). 

Based on the information in the ISA Summary provided in accordance with 10 CFR 70.65, the 

NRC makes licensing decisions as required under 10 CFR 70.21, “Filing”; 10 CFR 70.22; 

10 CFR 70.23; and 10 CFR 70.60, “Applicability,” through 10 CFR 70.66, “Additional 

Requirements for Approval of License Application.” These decisions include compliance with 

the performance requirements, the baseline design criteria, defense in depth, and the adequacy 

of management measures. Staff analyses are intended to provide regulatory confirmation of 

reasonable assurance of safe design and operation. A staff determination of reasonable 

assurance leads to a decision to issue or renew a license or to approve an amendment. If the 

staff determines that an application contains inadequate descriptions or commitments, the staff 

will inform the applicant of what is needed and the basis on which the determination was made. 

The acceptance criteria delineated in this SRP are intended to communicate the underlying 

objectives, but they do not represent the only means of satisfying those objectives. An applicant 

should tailor its safety program to the particular features of its facility. If an applicant chooses 

approaches other than those presented in this SRP, the applicant should identify the portions of 

its license application that differ from the design approaches and acceptance criteria of the SRP 

and should document how the proposed alternatives provide an acceptable method of 

complying with the Commission's regulations. The staff retains the responsibility to make an 

independent determination concerning the adequacy of the applicant’s proposed approaches. 

Each SRP chapter is structured as follows: 

Purpose of Review 

This section presents a brief statement of the purpose and objectives of reviewing the subject 

areas. It emphasizes the staff’s evaluation of the ways in which the applicant will achieve 

identified performance objectives and ensures (through the review) that the applicant has used 

a multidisciplinary, systems-oriented approach to establish designs, controls, and procedures 

within individual technical areas. 

Responsibility for Review 

This section identifies the NRC organization and individuals (by function) who are responsible 

for evaluating the specific subject or functional area. In general, the licensing project manager 

has responsibility for the total review product, which is referred to as a safety evaluation report 

(SER). However, an identified technical specialist will have primary responsibility for a particular 

review topic (usually an SRP chapter) and one or more specialists may have supporting 

responsibility. 

Areas of Review 

This section describes the topics, functions, systems, components, analyses, applicant 

commitments, data, or other information that should be reviewed as part of the given subject 

area of the license application. Because this section identifies information to be reviewed in 
June 2015 5 NUREG-1520, Revision 2 

evaluating the adequacy of the application, it identifies the acceptable content of an applicant's 

submittal in the areas discussed. 

The topics identified in this section also set the content of the next two sections of the SRP, 

covering the acceptance criteria and review procedures. Applications should address, in the 

same order, the topics set forth as areas of review. 

Acceptance Criteria 

This section defines a set of applicable NRC acceptance criteria on the basis of regulatory 

requirements, and these collectively establish the basis for assessing the acceptability of the 

applicant’s commitments relative to the design, programs, or functions within the scope of the 

particular SRP section. Technical bases consist of specific criteria, such as NRC regulations, 

regulatory guides, NUREG reports, and industry codes and standards. As such, the acceptance 

criteria present positions and approaches that are acceptable to the staff. As noted above, 

other than the regulations, the NRC does not consider these criteria to be the only acceptable 

positions or approaches, and the applicant may propose others. 

The requirements for approval of an application are listed in 10 CFR 70.23(a)(1) through (12) 

and 10 CFR 70.66. As a technical matter, NMSS will determine how final the design must be to 

make this finding. The NRC staff will interpret applicant commitments to follow an industry 

standard as a commitment to adhere to all “shall” statements in the standard. The staff will not 

consider suggestions and recommendations in the standards (so-called “should” statements) as 

binding commitments by the applicant, unless the applicant specifically states an intent to treat 

the “should” statements as binding commitments (i.e., to treat them as if they are “shall” 

statements). The applicant may make such commitments as part of its description of the safety 

program basis. If the staff finds that a definitive commitment to a “should” statement is 

necessary to provide adequate protection, the reviewer will raise this as an issue in any request 

for additional information on specific licensing actions. However, applicants should note that 

some industry or consensus standards specifically direct users to provide justifications for not 

abiding by recommendations contained in the standards. For example, American National 

Standards Institute/American Nuclear Society Standard 8.1, “Nuclear Criticality Safety in 

Operations with Fissionable Materials Outside Reactors,” states that “when recommendations 

are not implemented, justification shall be provided,” thus effectively mixing “should” and “shall” 

statements. In such instances, applicants should be prepared to justify any decisions not to 

abide by recommendations contained in the standards. 

Review Procedures 

This section describes procedures that the reviewer should follow to achieve an acceptable 

scope and depth of review and to obtain reasonable assurance that the applicant has provided 

appropriate commitments to ensure that it will operate the facility safely. This could include 

identifying which licensee commitments the reviewer needs to verify, and could include directing 

the reviewer to coordinate with others having review responsibilities for other portions of the 

application than those assigned to the reviewer. This section should provide whatever 

procedural guidance is necessary to evaluate the applicant’s level of achievement of the 

acceptance criteria. 

 
June 2015 6 NUREG-1520, Revision 2 

Evaluation Findings 

This section presents the type of positive conclusion that is sought, for the particular review 

area, to support a decision to grant a license or amendment. The review must be adequate to 

permit the reviewer to support this conclusion. For each section, the staff SER publishing the 

results of the review will include a conclusion of this type. The SER will also contain a 

description of the review, including aspects that received special emphasis, matters that the 

applicant modified during the review, matters that require additional information or will be 

resolved in the future, aspects where the facility’s design or the applicant’s proposals deviate 

from the criteria in the SRP, and the bases for any deviations from the SRP or proposed 

exemptions from the regulations. 

In the SER, the staff may recommend license conditions to address any issues that were not 

previously resolved by an applicant’s commitments. Such conditions are discussed with an 

applicant before issuing the license (or license amendment) and become commitments to 

performance in addition to those commitments that the applicant presented in the application. 

References 

This section lists references that the staff should consult during the review process. However, 

depending on the action and approaches proposed by the applicant, they may not always be 

relevant to the review. 
June 2015 1-1 NUREG-1520, Revision 2 

1. GENERAL INFORMATION 

1.1 Facility and Process Overview 

1.1.1 Purpose of Review 

The purpose of this review is to ascertain whether an application for a new, renewed, or 

amended license includes an overview of the facility layout and a summary description of its 

manufacturing processes. All reviewers, U.S. Nuclear Regulatory Commission (NRC) 

managers, and the public may use this overview to gain a general understanding of the purpose 

of the facility and an overview of the design of its processes. The integrated safety analysis 

(ISA) summary describes the facility and its manufacturing processes in more detail. 

1.1.2 Responsibility for Review 

Primary: Licensing Project Manager 

Secondary: ISA Reviewer, Environmental Reviewer, Emergency Protection Reviewer, other 

Technical Reviewers 

Supporting: None 

1.1.3 Areas of Review 

The staff should review the general facility and process descriptions provided in the license 

application. The areas of review should include the following: 

1. Facility Layout Description—This area includes a description of the purpose of each 

feature and the interrelationships between features. 

2. Process Overview—The process description should be a narrative description of the 

different processes at the facility involving licensed material. 

3. Site Overview—The description includes the proximity of facility buildings to the site 

boundary and nearby populations, including the most recent census data available when 

the license application was submitted. 

4. Descriptive Summary of Licensed Material—The summary should include the name, 

amount, and specification (including chemical and physical forms) of the special nuclear 

material (SNM). The license application also should include a list of raw materials, 

byproducts, wastes, moderators, and finished products of the facility. 

The facility and process description in the license application must be consistent with the 

information presented in the ISA summary and in Chapter 8, which addresses emergency 

management, of this standard review plan (SRP). 
June 2015 1-2 NUREG-1520, Revision 2 

Review Interfaces 

In addition to the general information in the application, the reviewer should examine information 

in the following areas to ensure that it is consistent with the general information section in the 

license application: 

 information about the facility and site and the different processes that will involve SNM in 

Chapter 3 of this SRP 

 the facility and process descriptions in Chapter 8 of this SRP 

1.1.4 Acceptance Criteria 

1.1.4.1 Regulatory Requirements 

The regulations applicable to the areas of review in this SRP are Title 10, “Energy,” of the Code 

of Federal Regulations (10 CFR) 70.22, “Contents of Applications,” and 10 CFR 70.65(b)(1) 

and (2). 

1.1.4.2 Regulatory Guidance 

No regulatory guides apply to a general facility description for a fuel cycle facility.

1.1.4.3 Regulatory Acceptance Criteria

The reviewer should find the applicant’s general information acceptable if it provides reasonable 

assurance that the acceptance criteria presented below are adequately addressed and satisfied. 

1.1.4.3.1 Facility Layout Description 

The applicant’s overview of the facility is acceptable if it meets the following conditions: 

1. The application presents information at a level of detail that is appropriate for general 

familiarization with and understanding of the proposed facility. This information should 

be consistent with that presented in the ISA summary but may be less detailed. 

2. The overview should describe the relationship of specific facility features to the major 

processes that will be ongoing at the facility. 

3. This description should include the building locations of major process components; 

drawings illustrating the layout of the buildings and structures within the controlled area 

boundary should be used to support the description. 

4. If applicable, the applicant has marked portions of the application to identify any 

proprietary or sensitive information related to the facility (e.g., the location of certain 

enrichment processes). 
June 2015 1-3 NUREG-1520, Revision 2 

1.1.4.3.2 Process Overview 

The process overview is acceptable if it summarizes the major chemical or mechanical 

processes involving licensable quantities of radioactive material based, in part, on information 

presented in the ISA summary. This description should include the building locations of major 

process components and brief accounts of the process steps. 

1.1.4.3.3 Site Overview 

The license application summarizes the site information contained in the ISA summary. This 

includes descriptions of the overall facility layout and the drawings to support such descriptions. 

The license application describes the site’s geographical characteristics and facility structural 

features (such as buildings, towers, and tanks), transportation rights of way, and proximity to 

nearby populations. The license application fully describes the facility location. These 

descriptions are consistent with the information in Chapter 8 of this SRP. 

If applicable, the applicant has portion-marked the application to identify any proprietary or 

sensitive information (e.g., the location of the controlled area boundary). 

1.1.4.3.4 Descriptive Summary of Licensed Material 

The summary is acceptable if it includes the following: 

1. The summary should describe chemical and physical forms of SNM in process; the 

maximum amounts of SNM in process in various building locations; and the types, 

amounts, and discharge points of waste materials discharged to the environment from 

the processes. 

2. The application presents a summary identification of the raw materials byproducts, 

wastes, and finished products of the facility. This information should include data on 

expected levels of trace impurities or contaminants (particularly fission products or 

transuranic elements) characterized by identity and concentration. In addition, this 

summary should identify the proposed possession at the facility of any moderator or 

reflector with special characteristics, such as beryllium or graphite. 

3. If applicable, the applicant has marked portions of the application to identify any 

proprietary or sensitive information (e.g., possession limits). 

1.1.5 Review Procedures 

1.1.5.1 Acceptance Review 

During the NRC staff’s acceptance review, the staff should screen the submittals to identify 

major deficiencies in the information provided in each review area in Section 1.1.3. Reviewers 

must decide whether they have enough information to proceed with a detailed technical review. 

Less significant errors or deficiencies that can be addressed in a request for additional 

information should be accepted. However, before the NRC performs a detailed review, the 

applicant should correct major deficiencies that would require several requests for additional 

information to resolve. 
June 2015 1-4 NUREG-1520, Revision 2 

Reviewers should record whether each area of review is adequately addressed in the 

application, is adequately addressed in a referenced document, is not applicable to the 

application, or has a major deficiency. 

1.1.5.2 Safety Evaluation 

The information submitted by the applicant in this section is informational in nature and no 

technical analysis is required. In addition, the reviewers use the information in this section only 

as background for the more detailed descriptions in later sections of the application. Therefore, 

the primary reviewer ascertains whether the descriptive information presented is consistent with 

the information presented in the ISA summary and the emergency management plan. During 

the initial review, the reviewer should draft the safety evaluation report (SER) described below. 

A request for additional information (RAI) will be prepared when clarification and additional 

information are needed to determine whether the licensee’s submittals comply with the 

regulations. The primary reviewer should coordinate with the licensing project manager in 

preparing RAIs. Additional information submitted by the applicant will be evaluated and a final 

SER will be provided to the licensing project manager. 

1.1.6 Evaluation Findings 

The regulations in 10 CFR 70.23, “Requirements for the Approval of Applications,” and 

10 CFR 70.66, “Additional Requirements for Approval of License Application,” state that an 

application for a license will be approved if the Commission can make the general findings listed 

in those sections. The basis for the general findings is an evaluation of whether the application 

adequately addresses all of the applicable regulatory requirements. More specifically, the staff’s 

evaluation should determine whether the licensing submittals provide sufficient information to 

satisfy the regulatory requirements listed in Section 1.1.4.1 of this SRP and whether the 

applicant has appropriately addressed the regulatory acceptance criteria in SRP 

Section 1.1.4.3. The SER should state how the applicable regulatory requirements have or 

have not been met based on the acceptance criteria described in this chapter of the SRP. If the 

applicant chooses to use an alternative approach, the reviewer should discuss in the SER 

whether the proposed approach satisfies the applicable regulatory requirements. The reviewers 

should use the following approach to document their evaluation: 

1. State a specific regulatory requirement that applies to the application. Detailed 

acceptance criteria may be included where appropriate or necessary. 

2. Identify the areas where the regulatory requirement is addressed in the application, 

including the areas where the specific acceptance criteria described in this SRP are 

addressed. 

3. Describe your evaluation of the application, the basis for your conclusion, and whether 

regulatory requirements are met. 

4. Repeat these steps for every regulatory requirement that applies to the application. 

There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

application or amendment request, (2) denial of the application or request, or (3) approval with 

conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

reviewer may consider proposing a license condition. Absent an NRC Order, license conditions 
June 2015 1-5 NUREG-1520, Revision 2 

must be agreed upon with the licensee or applicant before becoming part of the license. 

A license condition should only be proposed if there is reasonable assurance that, if the 

licensee meets the condition, all regulatory requirements will be satisfied. Thus, license 

conditions should not be used to cover major deficiencies in an application. License conditions 

should be unambiguous, inspectable, and enforceable. They should only require those actions 

necessary to ensure compliance with applicable regulations. The basis for license conditions 

must be documented in the SER. 

The report should include a statement, summarizing what was reviewed and why the reviewer 

finds the submittal acceptable, such as the following: 

The staff has reviewed the general facility description for [name of facility] 

according to Section 1.1 of the Standard Review Plan. [Name of facility] has 

adequately described (1) the facility and its processes so that the staff has an 

overall understanding of the relationships of the facility features and (2) the 

function of each feature. [Name of facility] has cross-referenced its general 

description with the more detailed descriptions elsewhere in the application. The 

staff also confirmed that the information provided in the license application is 

consistent with the ISA summary and the emergency management plan. 

Therefore, the NRC staff concludes that [name of facility] has complied with the 

general requirements of 10 CFR 70.22, “Contents of Applications,” and 

10 CFR 70.65(b)(1) and (2), as applicable to this section.
June 2015 1-6 NUREG-1520, Revision 2 

1.2 Institutional Information 

1.2.1 Purpose of Review 

The purpose of this review is to establish whether the license application includes adequate 

information identifying the applicant, the applicant’s characteristics, and the proposed activity. 

1.2.2 Responsibility for Review 

Primary: Licensing Project Manager 

Secondary: None 

Supporting: Office of the General Counsel 

 Office of Federal and State Materials and Environmental Management 

 Programs/Division of Waste Management and Environmental Protection 

 Office of Nuclear Reactor Regulation/Division of Policy and Rulemaking 

1.2.3 Areas of Review 

The staff should review the institutional information provided by the applicant or licensee in the 

license application. Information provided for review should include the following: 

1. Corporate Identity and Ownership—This section should include the identity and physical 

address of the applicant’s facility and corporate headquarters, corporate information 

sufficient to show the relationship of the applicant’s organization to other corporate 

entities, and the existence and extent of foreign ownership or influence. 

2. Financial Qualifications—Information provided for review in this section should include 

the applicant’s financial qualifications to pursue the activities for which the license is 

sought. 

3. Characteristics of the Material—This information should include the type, quantity, and 

form(s) of material(s) proposed for use at the licensed facility. 

4. Authorized Uses—The application should clearly describe each proposed licensed 

activity in the form of requested authorized uses and the type of license the applicant is 

requesting. 

5. Special Exemptions or Special Authorizations—The application should clearly describe 

any special exemptions and authorizations the applicant is requesting and the regulatory 

requirements for which the applicant is seeking approval or exemption. 

6. Protection of Safeguard Information— The application should describe how safeguards 

information will be protected against unauthorized disclosure. 

7. Security of Classified Information—The license application will include this section only if 

the applicant or licensee has requested and received a facility security clearance in 

accordance with 10 CFR Part 95, “Facility Security Clearance and Safeguarding of 

National Security Information and Restricted Data.” 
June 2015 1-7 NUREG-1520, Revision 2 

8. Period of Time for Which the License Is Requested—The license application should 

specify the period of time for which the applicant is seeking approval. 

Review Interfaces 

None 

1.2.4 Acceptance Criteria 

1.2.4.1 Regulatory Requirements 

The regulations applicable to the areas of review in this SRP are 10 CFR 70.22; 10 CFR 70.23, 

“Requirements for the Approval of Applications”; 10 CFR 70.33, “Renewal of Licenses”; and 

10 CFR Part 95. 

1.2.4.2 Regulatory Guidance 

No regulatory guides apply to institutional information for a fuel cycle facility. 

1.2.4.3 Regulatory Acceptance Criteria 

The application is acceptable if it meets the criteria below. 

1.2.4.3.1 Corporate Identity 

The applicant has furnished its full name and physical address and the address of the fuel cycle 

facility if it is different from that of the applicant. If the application is for license renewal, the 

applicant has identified the number of the license to be renewed. The application indicates the 

State where the applicant is incorporated or organized and the location of the principal office. 

The application should include any information known to the applicant concerning the control or 

ownership, if any, exercised over the applicant by any alien, foreign corporation, or foreign 

government. Primary ownership and relationships to other components of the same ownership 

are explicitly described. The presence and operations of any other company on the site to be 

licensed are fully described. 

1.2.4.3.2 Financial Qualifications 

A description of financial qualifications demonstrates the applicant’s current and continuing 

access to the financial resources necessary to engage in the proposed activity in accordance 

with 10 CFR 70.22(a)(8) and 10 CFR 70.23(a)(5). The information should provide a basis for 

the NRC staff to find that projected revenue and expenses are within reasonable expectations 

given past performance. Such information could include income statements for three or more 

of the most recent fiscal years. In addition, the information could include balance sheet 

forecasts for 3 or more years into the future. 
June 2015 1-8 NUREG-1520, Revision 2 

A license application that involves the use of special nuclear material in a uranium enrichment 

facility must include the applicant's provisions for liability insurance in accordance with 10 CFR 

70.22(n). Under 10 CFR 140.13b, uranium enrichment facilities must have, and maintain, offsite 

liability insurance. Proof of insurance must be provided prior to the issuance of the license. The 

methods and instruments where applicants and licensees prove that they have the necessary 

financial protection are provided in 10 CFR 140.15. For new facilities, the description includes 

sufficient details demonstrating that the applicant has adequate financial resources to support 

the safe siting, construction, operation, maintenance, and eventual decommissioning of the 

proposed facility. 

1.2.4.3.3 Characteristics of the Material 

The application identifies the elemental name, maximum quantity, and specifications, including 

the chemical and physical form(s), of the licensable material that the applicant proposes to 

acquire, deliver, receive, possess, produce, use, transfer, or store. For such material, the 

specifications include the isotopic content and amount of enrichment by weight percent. 

1.2.4.3.4 Authorized Uses 

The application includes a summary, nontechnical narrative description for each activity or 

process in which the applicant proposes to acquire, deliver, receive, possess, produce, use, 

process, transfer, or store SNM. The authorized uses of SNM proposed for the facility are 

described and are consistent with the Atomic Energy Act of 1954, as amended. The description 

is consistent with more detailed process descriptions submitted as part of the ISA summary 

reviewed in Chapter 3 of this SRP. 

If the application is for a license renewal, the applicant has clearly stated the time period for 

which renewal is sought. 

Applicants seeking authorization to possess and use byproduct material or source material are 

subject to additional regulations and guidance that is not provided in this SRP. For byproduct 

materials, regulations in 10 CFR Part 30, “Rules of General Applicability to Domestic Licensing 

of Byproduct Material,” through 10 CFR Part 39, “Licenses and Radiation Safety Requirements 

for Well Logging,” would apply; guidance is provided in NUREG-1556, “Consolidated Guidance 

About Materials Licenses.” Additional requirements described in 10 CFR Part 40, “Domestic 

Licensing of Source Material,” would apply if applicants are seeking to receive, possess, use, 

transfer, or deliver source materials. 

1.2.4.3.5 Special Exemptions or Special Authorizations 

The license application clearly describes any proposed exemptions, and authorizations of an 

unusual nature and adequately justifies them for the NRC’s consideration. The applicant has 

explained any cross-reference to other sections in the license application supporting such 

justifications. The license application clearly discusses special authorizations and/or 

exemptions already granted by the NRC. 
June 2015 1-9 NUREG-1520, Revision 2 

1.2.4.3.6 Protection of Safeguards and Classified Information 

The license application describes how the requirements to protect safeguards information from 

unauthorized disclosure have been satisfied in accordance with 10 CFR 70.22(l), and how the 

requirements to protect classified information have been met in accordance with 10 CFR 

Part 25, “Access Authorization,” and 10 CFR Part 95. 

1.2.4.3.7 Information Security at Uranium Enrichment Facilities 

For license applications regarding authorization to enrich uranium, the application describes 

how the requirements in 10 CFR 70.22(m) have been satisfied as well as the applicable 

regulations described in 10 CFR Part 25 and Part 95. 

The applicant has requested and received a facility security clearance in accordance with 

10 CFR Part 95, if this is applicable. 

1.2.5 Review Procedures 

1.2.5.1 Acceptance Review 

The primary reviewer should determine whether the license application is complete and 

addresses each issue in Section 1.2.3. Reviewers must decide whether they have enough 

information to proceed with a detailed review. Less significant errors or deficiencies that can be 

addressed in a request for additional information should be accepted. However, before the 

NRC performs a detailed review, the applicant should correct major deficiencies that would 

require several requests for additional information to resolve. 

Reviewers should record whether each area of review is adequately addressed in the 

application, is adequately addressed in a cited document, is not applicable to the application, or 

has a major deficiency. 

1.2.5.2 Safety Evaluation 

The information submitted by the applicant in this section is, for the most part, informational in 

nature, and detailed technical analysis is generally not required beyond the acceptance criteria. 

For new facilities, the reviewer requests review assistance, as needed, from the Office of the 

General Counsel, the Office of Federal and State Materials and Environmental Management 

Programs/Division of Waste Management and Environmental Protection, and the Office of 

Nuclear Reactor Regulation/Division of Policy and Rulemaking in the review of corporate and 

financial information. During the initial review, the reviewer should draft the SER described 

below. A request for additional information (RAI) will be prepared when clarification and 

additional information are needed to determine whether the licensee’s submittals comply with 

the regulations. The primary reviewer should coordinate with the licensing project manager in 

preparing RAIs. Additional information submitted by the applicant will be evaluated and a final 

SER will be provided to the licensing project manager. 
June 2015 1-10 NUREG-1520, Revision 2 

1.2.6 Evaluation Findings 

The regulations in 10 CFR 70.23 and 70.66 state that an application for a license will be 

approved if the Commission can make the general findings listed in those sections. The basis 

for the general findings is an evaluation of whether the application adequately addresses all of 

the applicable regulatory requirements. More specifically, the staff’s evaluation should 

determine whether the licensing submittals provide sufficient information to satisfy the regulatory 

requirements listed in Section 1.2.4.1 of this SRP and whether the applicant has appropriately 

addressed the regulatory acceptance criteria in SRP Section 1.2.5.4.3. The SER should state 

how the applicable regulatory requirements have or have not been met based on the 

acceptance criteria described in this chapter of the SRP. If the applicant chooses to use an 

alternative approach, the reviewer should discuss in the SER whether the proposed approach 

satisfies the applicable regulatory requirements. The reviewers should use the following 

approach to document their evaluation: 

1. State a specific regulatory requirement that applies to the application. Detailed 

acceptance criteria may be included where appropriate or necessary. 

2. Identify the areas where the regulatory requirement is addressed in the application, 

including the areas where the specific acceptance criteria described in this SRP are 

addressed. 

3. Describe your evaluation of the application, the basis for your conclusion, and whether 

regulatory requirements are met. 

4. Repeat these steps for every regulatory requirement that applies to the application. 

There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

application or amendment request, (2) denial of the application or request, or (3) approval with 

conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

reviewer may consider proposing a license condition. Absent an NRC Order, license conditions 

must be agreed on with the licensee or applicant before becoming part of the license. A license 

condition should only be proposed if there is reasonable assurance that, if the licensee meets 

the condition, all regulatory requirements will be satisfied. Thus, license conditions should not 

be used to cover major deficiencies in an application. License conditions should be 

unambiguous, inspectable, and enforceable. They should only require those actions necessary 

to ensure compliance with applicable regulations. The basis for license conditions must be 

documented in the SER. 

If the submittal is acceptable, the final SER input should conclude with a statement similar to the 

following: 

The staff has reviewed the institutional information for [name of facility] according 

to Section 1.2.of the Standard Review Plan. On the basis of the review, the NRC 

staff has determined that [name of facility] has adequately described and 

documented its corporate structure and financial information, and is in 

compliance with those requirements in 10 CFR 70.22 and 10 CFR 70.65 related 

to other institutional information. In addition, in accordance with 

10 CFR 70.22(a)(2), (3), and (4), [name of facility] has adequately described: 
June 2015 1-11 NUREG-1520, Revision 2 

(1) the period of time for which the license is requested and the (2) types, 

(3) forms, (4) quantities, and (5) proposed authorized uses of licensed materials 

to be permitted at this facility as follows: 

Material Form Quantity Authorized Use(s) 

[name of facility]’s proposed activities are consistent with the Atomic Energy Act 

of 1954, as amended. [Name of facility] has provided all institutional information 

necessary to understand the ownership, financial qualifications, and location of 

the facility to be licensed, as well as the planned activities at the facility and the 

nuclear materials to be handled in connection with the requested license. 
June 2015 1-12 NUREG-1520, Revision 2 

1.3 Site Description 

1.3.1 Purpose of Review 

The purpose of this review is to determine whether the information provided by an applicant 

adequately describes the geographic, demographic, meteorological, hydrologic, geologic, and 

seismologic characteristics of the site and the surrounding area. The site description is a 

summary of the information that the applicant used in preparing the environmental report, 

emergency plan, and ISA summary. 

1.3.2 Responsibility for Review 

Primary: Licensing Project Manager 

Secondary: ISA Reviewer, Environmental Protection Reviewer, Emergency Plan 

Reviewer 

Supporting: None 

1.3.3 Areas of Review 

The information in this section of the application is summarized from the information presented 

in more detail in the applicant’s environmental report, emergency-management plan, and ISA 

summary. The information that the NRC staff will review includes the following (as appropriate 

for the facility being reviewed): 

1. Site geography 

a. Site location: State, county, municipality, topographic quadrangle (in eight 

7-1/2-minute quadrants), site boundary, and controlled-area boundary 

b. Major nearby highways 

c. Nearby bodies of water 

d. Any other significant geographic feature that may affect accident analysis within 

1.6 kilometers (1 mile) of the site (e.g., ridges, valleys, specific geologic 

structures) 

2. Demographics 

a. Latest census results for area of concern 

b. Description, distance, and direction to nearby population centers 

c. Description of and distance and direction to nearby public facilities (e.g., schools, 

hospitals, and parks) 

d. Description, distance, and direction to nearby industrial areas or facilities that 

may present potential hazards (including other nearby nuclear facilities) 
June 2015 1-13 NUREG-1520, Revision 2 

e. Uses of land within the licensed facility or its proposed boundaries 

(i.e., residential, industrial, commercial, or agricultural) 

f. Description of nearby bodies of water and their uses 

3. Meteorology 

a. Primary wind directions and average windspeeds 

b. Annual amount and forms of precipitation, as well as the design-basis values for 

accident analysis of maximum snow or ice load and probable maximum 

precipitation 

c. Type, frequency, and magnitude of severe weather (e.g., lightning, tornado, and 

hurricane) and design-basis event summary descriptions for accident analysis 

4. Hydrology 

a. Characteristics of nearby rivers, streams, and bodies of water as appropriate 

b. Depth to the water table and potentiometric surface map 

c. Groundwater flow direction and velocity for the site 

d. Characteristics of the uppermost aquifer and any hydrogeological connections to 

other aquifers in the region 

e. Design-basis flood events used for accident analysis 

5. Geology 

a. Onsite characteristics of soil types and bedrock 

b. Design-basis earthquake magnitudes and return periods used for accident 

analysis 

c. Description of other geologic hazards (e.g., mass wasting) 

Review Interfaces 

To ensure consistency, the listed SRP sections and documents interface with this section as 

follows: 

 Review information about the facility and site and the different processes that will involve 

licensable material in Chapter 3 of the SRP. 

 Review the facility and process descriptions in Chapter 8 of the SRP. 
June 2015 1-14 NUREG-1520, Revision 2 

 Review information in the applicant’s environmental report about the site’s geography, 

demographics, meteorology, hydrology, and geology. 

1.3.4 Acceptance Criteria 

1.3.4.1 Regulatory Requirements 

The regulations applicable to the areas of review in this SRP are 10 CFR 70.22 and 

10 CFR 70.65(b)(1) and (2). 

1.3.4.2 Regulatory Guidance 

No regulatory guides apply to site descriptions for a fuel cycle facility. 

1.3.4.3 Regulatory Acceptance Criteria 

The reviewer should find the site description—including the site geography, demographics, 

meteorology, hydrology, and geology (see Section 1.3.3) —acceptable if it meets the following 

acceptance criteria: 

1. The summary briefly describes site geography, including its location relative to 

prominent natural and manmade features (such as mountains, rivers, airports, 

population centers, schools, and commercial and manufacturing facilities). The 

summary also describes the site boundary and the controlled area. 

2. The summary provides population information on the basis of the most current available 

census data. To the extent possible, data reflect observations and measurements made 

over a period of years, especially for conditions that are expected to vary seasonally 

(e.g., precipitation, windspeed, wind direction, and groundwater levels). 

3. The application addresses appropriate meteorological data, including a summary of 

design-basis values for accident analysis of maximum snow or ice load and probable 

maximum precipitation, as may be developed by the applicant and presented in the ISA 

summary. The applicant presents appropriate design-basis values for lightning, high 

winds, tornado, hurricane, and other severe weather conditions that are applicable to the 

site. 

4. The application includes a summary description of the hydrology and geology (including 

seismicity) for the area and cites the design-basis flood event for which the facility may 

be safely shut down. 

5. The applicant’s descriptions are consistent with the more detailed information presented 

in the ISA summary, the environmental report, and the emergency plan, if these are 

applicable. 
June 2015 1-15 NUREG-1520, Revision 2 

1.3.5 Review Procedures 

1.3.5.1 Acceptance Review 

The staff will initially determine whether the application is complete and addresses all topics 

discussed in Section 1.3.3. Reviewers must decide whether they have enough information to 

proceed with a detailed review. Less significant errors or deficiencies that can be addressed in 

a request for additional information should be accepted. However, before the NRC performs a 

detailed review, the applicant should correct major deficiencies that would require several 

requests for additional information to resolve. 

Reviewers should record whether each area of review is adequately addressed in the 

application, is adequately addressed in a cited document, is not applicable to the application, or 

has a major deficiency. 

1.3.5.2 Safety Evaluation 

The material in this section of the SRP is informational, because it summarizes material in the 

ISA summary, environmental report, emergency plan, and other documents cited by the 

applicant. No technical analysis is required because the primary reference for the information is 

the ISA summary. The applicant may also need to update this section to verify any information 

changes made in response to the staff’s environmental, emergency-management, and ISA 

summary reviews. During the initial review, the reviewer should draft the SER described below. 

A request for additional information (RAI) will be prepared when clarification and additional 

information are needed to determine whether the licensee’s submittals comply with the 

regulations. The primary reviewer should coordinate with the licensing project manager in 

preparing RAIs. Additional information submitted by the applicant will be evaluated and a final 

SER will be provided to the licensing project manager.

1.3.6 Evaluation Findings 

The regulations in 10 CFR 70.23 and 70.66 state that an application for a license will be 

approved if the Commission can make the general findings listed in those sections. The basis 

for the general findings is an evaluation of whether the application adequately addresses all of 

the applicable regulatory requirements. More specifically, the staff’s evaluation should 

determine whether the licensing submittals provide sufficient information to satisfy the regulatory 

requirements listed in Section 1.3.4.1 of this SRP and whether the applicant has appropriately 

addressed the regulatory acceptance criteria in SRP Section 1.3.4.3. The SER should state 

how the applicable regulatory requirements have or have not been met based on the 

acceptance criteria described in this chapter of the SRP. If the applicant chooses to use an 

alternative approach, the reviewer should discuss in the SER whether the proposed approach 

satisfies the applicable regulatory requirements. The reviewers should use the following 

approach to document their evaluation: 

1. State a specific regulatory requirement that applies to the application. Detailed 

acceptance criteria may be included where appropriate or necessary. 

2. Identify the areas where the regulatory requirement is addressed in the application, 

including the areas where the specific acceptance criteria described in this SRP are 

addressed. 
June 2015 1-16 NUREG-1520, Revision 2 

3. Describe your evaluation of the application, the basis for your conclusion, and whether 

regulatory requirements are met. 

4. Repeat these steps for every regulatory requirement that applies to the application. 

There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

application or amendment request, (2) denial of the application or request, or (3) approval with 

conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

reviewer may consider proposing a license condition. Absent an NRC order, license conditions 

must be agreed on with the licensee or applicant before becoming part of the license. A license 

condition should only be proposed if there is reasonable assurance that, if the licensee meets 

the condition, all regulatory requirements will be satisfied. Thus, license conditions should not 

be used to cover major deficiencies in an application. License conditions should be 

unambiguous, inspectable, and enforceable. They should only require those actions necessary 

to ensure compliance with applicable regulations. The basis for license conditions must be 

documented in the SER. 

If the license application provides sufficient information and is consistent with the guidance in 

this SRP, the staff will conclude that this evaluation is complete and that the applicant’s site 

description is acceptable with statements similar to the following: 

The staff has reviewed the site description for [name of facility] in accordance 

with Section 1.3 of the Standard Review Plan. [Name of facility] has adequately 

described and summarized general information pertaining to (1) the site 

geography, including its location relative to prominent natural and manmade 

features such as mountains, rivers, airports, population centers, schools, and 

commercial and manufacturing facilities; (2) population information using the 

most current available census data; (3) meteorology, hydrology, and geology for 

the site; and (4) applicable design-basis events. The review verified that the site 

description is consistent with the information used as a basis for the 

environmental report, emergency-management plan, and ISA Summary. 

1.4 References 

U.S. Code of Federal Regulations, “Domestic Licensing of Special Nuclear Material,” Part 70, 

Chapter I, Title 10, “Energy.” 

U.S. Code of Federal Regulations, “Facility Security Clearance and Safeguarding of National 

Security Information and Restricted Data,” Part 95, Chapter I, Title 10, “Energy.” 
June 2015 2-1 NUREG-1520, Revision 2 

2. ORGANIZATION AND ADMINISTRATION 

2.1 Purpose of Review 

The purpose of the review of the applicant’s organization and administration is to ensure that 

the proposed management hierarchy and policies will provide reasonable assurance that the 

licensee plans, implements, and controls site activities in a manner that ensures the safety of 

workers, the public, and the environment. The review also ensures that the applicant has 

identified and provided adequate qualification descriptions for key management positions. 

2.2 Responsibility for Review

Primary: Licensing Project Manager 

Secondary: None 

Supporting: Primary Reviewers for Other Standard Review Plan (SRP) Chapters 

 (e.g., technical-area chapters and management-measures chapters); 

 Fuel Facility Inspection Staff 

2.3 Areas of Review

The organizational structure and associated administrative program proposed by the applicant 

should include administrative policies, procedures and management policies, and qualifications 

of key management positions and describe how these will provide reasonable assurance that 

the health, safety, and environmental (HS&E) protection functions will be effective. 

For new facilities, or currently licensed facilities undergoing major modifications, the applicant 

should describe the comprehensive management policies and procedures that will be used to 

manage and closely monitor the facility design, engineering, construction, and modifications. 

The application should address how the management policies ensure the establishment and 

maintenance of design and operations. The administrative and management policies should 

describe the relationships among major facility safety functions and programs, such as the 

integrated safety analysis, management measures for items relied on for safety (IROFS), 

radiation safety, nuclear criticality safety, fire safety, chemical safety, environmental monitoring, 

and emergency planning. The applicant should also describe its qualification criteria with regard 

to education (i.e., degree and field), training, and experience for key management positions. 

Management positions for which such criteria should be described include the facility manager, 

operations manager, shift supervisor, and managers for various safety and environmental 

disciplines. Alternative named management positions could be proposed. Qualification criteria 

should be described generally, in terms of academic credentials, formal continuing education, 

and work experience. For example, “bachelor’s degree in nuclear engineering or related 

scientific or engineering field, with 5 years of experience managing the operations of a nuclear 

fuel manufacturing facility.” 

Review Interfaces 

None 
June 2015 2-2 NUREG-1520, Revision 2 

2.4 Acceptance Criteria

2.4.1 Regulatory Requirements 

The regulations in Title 10 of the Code of Federal Regulations (10 CFR) 70.22(a)(6), 

70.23(a)(2), and 70.62(d) require a management system and administrative procedures for the 

effective implementation of HS&E functions concerning the applicant’s corporate organization, 

qualifications of the staff, and adequacy of the proposed equipment, facilities, and procedures to 

provide adequate safety for workers, the public, and the environment. 

2.4.2 Regulatory Guidance 

There are no regulatory guides specific to the description of the organization and administration 

of fuel cycle facilities. 

2.4.3 Regulatory Acceptance Criteria 

The application is acceptable if it meets the criteria identified below. The applicant’s safety 

program description should include appropriate commitments relevant to these criteria. 

A. The following criteria apply to new facilities or facilities undergoing major modifications 

(in addition to the criteria listed below for existing facilities): 

1. The applicant has identified and functionally described the specific organizational 

groups that are responsible for managing the design, construction, operations, 

and modifications of the facility or licensed activities. The application also 

includes organizational charts. 

2. Clear, unambiguous management controls and communications exist among the 

organizational units responsible for managing the design, construction, 

operations, and modifications of the facility or licensed activities. 

3. The personnel responsible for managing the design, construction, operation, and 

modifications of the facility or licensed activities have substantive breadth and 

level of experience and are appropriately available. The qualifications, 

responsibilities, and authorities for key supervisory and management positions 

with HS&E responsibilities are clearly defined in position descriptions that are 

accessible to all affected personnel and to the U.S. Nuclear Regulatory 

Commission (NRC), upon request. 

4. The applicant has described specific plans to commission the facility’s startup 

and operation, including the transition from the startup phase to operations, 

under the direct supervision of the applicant’s personnel responsible for safe 

operations. The application clearly describes the roles and responsibilities of the 

different functions engaged in these commissioning activities. 
June 2015 2-3 NUREG-1520, Revision 2 

B. The following criteria apply to existing facilities: 

1. The applicant has identified and functionally described the specific organizational 

groups responsible for operating the facility and managing the development of 

design changes to the facility. The application also includes organizational 

charts. 

2. The qualifications, responsibilities, and authorities of key supervisory and 

management positions with HS&E responsibilities are clearly defined in position 

descriptions that are accessible to affected persons and to the NRC, upon 

request. 

3. In the organizational hierarchy, the HS&E organization(s) is independent of the 

operations organization(s), allowing it to provide objective HS&E audit, review, or 

control activities. “Independent” means that neither organization reports to the 

other in an administrative sense. (However, both may report to a common 

manager.) Lines of responsibility and authority are clearly drawn. 

4. The individual delegated overall responsibility for the HS&E functions has the 

authority to shut down operations if they appear to be unsafe and, in that case, 

must approve restart of shutdown operations or licensed activities. 

5. The activities essential for effective implementation of the HS&E functions are 

documented in formally approved, written procedures, prepared in compliance 

with a formal document-control program. 

6. The applicant should commit to a simple mechanism, available for use by any 

person in the plant, for reporting potentially unsafe conditions or activities to the 

HS&E organization. Reported concerns should be promptly investigated, 

assessed, and resolved. 

7. The application clearly defines effective lines of communication and authority 

among the organizational units involved in the engineering, HS&E, and 

operations functions of the facility. 

8. The applicant has committed to establishing the formal management measures 

required to ensure the availability and reliability of IROFS. Chapter 11 of this 

SRP discusses management measures. 

9. Written agreements exist with offsite emergency resources such as fire, police, 

ambulance and rescue units, and medical services. Chapters 7 and 8 of this 

SRP address these agreements in more detail. 

The applicant’s safety program description includes commitments relevant to meeting the 

acceptance criteria described above. 
June 2015 2-4 NUREG-1520, Revision 2 

2.5 Review Procedures 

2.5.1 Acceptance Review 

During the acceptance review of a license application, the reviewer should examine the 

submittals to identify major deficiencies in the information provided for each area of review 

specified in SRP Section 2.3. Reviewers must decide whether they have enough information to 

proceed with a detailed review. Less significant errors or deficiencies that can be addressed in 

a request for additional information should be accepted. However, before the NRC performs a 

detailed review, the applicant should correct major deficiencies that would require several 

requests for additional information to resolve. 

Reviewers should record whether each area of review is adequately addressed in the 

application, is adequately addressed in a referenced document, is not applicable to the 

application, or has a major deficiency. 

2.5.2 Safety Evaluation 

The primary reviewer should perform a safety evaluation with respect to the acceptance criteria 

described in Section 2.4. The objective of the review is to ensure that the corporate-level 

management and technical support structure, as demonstrated by organizational charts and 

descriptions of functions and responsibilities, is clear with respect to assignments of primary 

responsibility. If necessary, the primary reviewer consults with the NRC inspection staff to verify 

that the applicant’s management positions are adequately defined in terms of both numbers of 

persons and their responsibilities, authorities, and required qualifications. If necessary, the 

reviewer may visit the site to discuss and verify implementation of the acceptance criteria with 

facility management. 

On the basis of the foregoing, the supporting staff reviewers determine the overall acceptability 

of the applicant’s management system, management qualifications, organizational structure, 

and administrative procedures. The reviewers should determine whether the application 

satisfies the acceptance criteria of Section 2.4 and then prepare a safety evaluation report 

(SER) in accordance with Section 2.6. During the initial review, the reviewer should draft the 

safety evaluation report (SER) described below. A request for additional information (RAI) will 

be prepared when clarification and additional information are needed to determine if the 

licensee’s submittals comply with the regulations. The primary reviewer should coordinate with 

the licensing project manager in preparing RAIs. Additional information submitted by the 

applicant will be evaluated and a final SER will be provided to the licensing project manager.

2.6 Evaluation Findings 

The regulations in 10 CFR 70.23, “Requirements for the Approvals of Applications,” and 70.66, 

“Additional Requirements for Approval of License Application,” state that an application for a 

license will be approved if the Commission can make the general findings listed in those 

sections. The basis for the general findings is an evaluation of whether the application 

adequately addresses all of the applicable regulatory requirements. More specifically, the staff’s 

evaluation should determine whether the licensing submittals provide sufficient information to 

satisfy the regulatory requirements listed in SRP Section 2.4.1 and whether the applicant has 

appropriately addressed the regulatory acceptance criteria in SRP Section 2.4.3. The SER 
June 2015 2-5 NUREG-1520, Revision 2 

should state how the applicable regulatory requirements have or have not been met based on 

the acceptance criteria described in this chapter of the SRP. If the applicant chooses to use an 

alternative approach, the reviewer should discuss in the SER whether the proposed approach 

satisfies the applicable regulatory requirements. The reviewers should use the following 

approach to document their evaluation: 

1. State a specific regulatory requirement that applies to the application. Detailed 

acceptance criteria may be included where appropriate or necessary to clarify the 

requirement. 

2. Identify the areas where the regulatory requirement is addressed in the application, 

including the areas where the specific acceptance criteria described in this SRP are 

addressed. 

3. Describe your evaluation of the application, the basis for your conclusion, and whether 

regulatory requirements are met. 

4. Repeat these steps for every regulatory requirement that applies to the application. 

There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

application or amendment request, (2) denial of the application or request, or (3) approval with 

conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

reviewer may consider proposing a license condition. Absent an NRC Order, license conditions 

must be agreed upon with the licensee or applicant before becoming part of the license. 

A license condition should only be proposed if there is reasonable assurance that, if the 

licensee meets the condition, all regulatory requirements will be satisfied. Thus, license 

conditions should not be used to cover major deficiencies in an application. License conditions 

should be unambiguous, inspectable, and enforceable. They should only require those actions 

necessary to ensure compliance with applicable regulations. The basis for license conditions 

must be documented in the SER. 

If the submittal is acceptable, the final SER input should conclude with a statement similar to the 

following: 

The staff has reviewed the organization and administration for [name of facility] 

according to Chapter 2 of the Standard Review Plan.

(a) For new facilities 

[Name of facility] described: (1) clear responsibilities and associated resources 

for the design, construction, operations, and modifications of the facility, and 

(2) its plans for managing the project. [Insert a summary statement of what was 

evaluated and why the reviewer finds the submittal acceptable.] The staff has 

reviewed these plans and commitments and concludes that they provide 

reasonable assurance that an acceptable organization, administrative policies, 

and sufficient qualified resources have been established or are committed to 

satisfy [name of facility]’s commitments for the design, construction, operations, 

and modifications of the facility.
June 2015 2-6 NUREG-1520, Revision 2 

(b) For operating and new facilities 

[Name of facility] described its organization and management policies for 

providing adequate safety management and management measures for the safe 

operation of the facility. [Insert a summary statement of what was evaluated and 

why the reviewer finds the submittal acceptable.] The staff has reviewed this 

information and concluded that [name of facility] has an acceptable organization, 

administrative policies, and sufficient qualified resources to provide for the safe 

operation of the facility under both normal and abnormal conditions. 

2.7 References 

U.S. Code of Federal Regulations, “Domestic Licensing of Special Nuclear Material,” Part 70, 

Chapter I, Title 10, “Energy.” 

U.S. Nuclear Regulatory Commission, “Proposed Methods for Regulating Major Materials 

Licensees,” NUREG-1324, Sections 3.1, “Organization Plan,” and 3.2, “Managerial Controls and 

Oversight,” February 1992 

.
June 2015 3-1 NUREG-1520, Revision 2 

3. INTEGRATED SAFETY ANALYSIS 

AND INTEGRATED SAFETY ANALYSIS SUMMARY 

3.1 Purpose of Review 

An integrated safety analysis (ISA) identifies potential accident sequences in the facility’s 

operations, designates items relied on for safety (IROFS) to either prevent such accidents or 

mitigate their consequences to an acceptable level, and describes management measures to 

provide reasonable assurance of the availability and reliability of IROFS. Applicants for new 

licenses and persons holding licenses under Title 10 of the Code of Federal Regulations

(10 CFR) Part 70, “Domestic Licensing of Special Nuclear Material,” on September 18, 2000, 

must perform an ISA and submit a summary (referred to as an “ISA Summary”) to the 

U.S. Nuclear Regulatory Commission (NRC) for approval. The ISA Summary focuses on higher 

risk accident sequences with consequences that could exceed the criteria of 10 CFR 70.61, 

“Performance Requirements.” The ISA Summary is a synopsis of the results of the ISA and 

contains information specified in 10 CFR 70.65(b). 

The ISA and supporting documentation (such as piping and instrumentation diagrams, criticality 

safety analyses, dose calculations, process safety information, and ISA worksheets) would be 

maintained on site at an existing facility. For an applicant seeking a license before commencing 

construction of a facility, full details concerning hardware, procedures, and programs usually 

would not exist. However, at the time of the operational readiness review1

 for a new facility, or 

major modifications to an existing facility, such details must exist to comply with the safety 

program requirements of 10 CFR Part 70, Subpart H, “Additional Requirements for Certain 

Licensees Authorized to Possess a Critical Mass of Special Nuclear Material.” The level of 

detail that is acceptable in a license application and ISA Summary does not differ between 

existing and new facilities. 

The NRC determines the acceptability of the applicant’s ISA by reviewing a portion of the ISA 

documentation and any supporting documentation maintained on site and by reviewing and 

approving the applicant’s ISA Summary which, although not part of the license application, is 

placed on the public docket. Neither the ISA nor the ISA Summary is incorporated as part of the 

license. 

Reviewers must confirm that an ISA Summary meets the regulatory requirements of 

10 CFR 70.65, “Additional Content of Applications,” and, specifically, that suitable IROFS and 

management measures have been designated for high-risk accident sequences and that 

programmatic commitments to maintain the ISA and ISA Summary are acceptable. The term 

“programmatic” is used here to refer to the organization, criteria, methods, and practices for 

conducting activities important to safety, such as the ISA program, criticality and other safety 

discipline programs, and the management measures programs addressed in Chapter 11 of this 

Standard Review Plan (SRP). In fact, the primary purpose of the review conducted under the 

guidance of this chapter is to attain reasonable assurance that the applicant has established an 

 

1

 The operational readiness review is an assessment review inspection performed by a multidisciplinary inspection 

team to ensure that a plutonium or enrichment facility has been completed in accordance with the application or 

license, and so can be operated safely within the intended safety basis. For new facilities other than plutonium or 

enrichment facilities regulated under 10 CFR Part 70, Subpart H, or major modifications to existing ones, such 

reviews, though not strictly required, are normally conducted. 
June 2015 3-2 NUREG-1520, Revision 2 

ISA program that is, and will continue to be, in compliance with 10 CFR Part 70, Subpart H. 

Other chapters of this SRP offer guidance for review of management measures and other safety 

programs. This reasonable assurance of ISA program compliance is attained in part by a 

selective review of some of the ISA results, as described in Section 3.5 of this chapter under the 

subjects of “horizontal slice” and “vertical slice” reviews. However, it is not normally necessary 

to review the full details of all processes and IROFS in order to attain such reasonable 

assurance. An applicant may submit, for NRC approval, one ISA Summary for the entire facility, 

or multiple ISA Summaries for individual processes (or groups of processes) in the facility as 

they are completed. Reviewers of ISA Summaries for new and existing facilities may find it 

useful to examine the ISA and its supporting documentation to confirm the underpinnings of 

calculations, conclusions, and components of safety programs. 

This chapter provides guidance for the NRC’s review of two types of information submitted by 

applicants: 

(1) commitments regarding the applicant’s safety program including the ISA, pursuant to the 

requirements of 10 CFR 70.62, “Safety Program and Integrated Safety Analysis” 

 

(2) ISA summaries submitted in accordance with 10 CFR 70.62(c)(3)(ii) and 10 CFR 70.65 

 

In the case of license applications (either initial or renewal), applicants would submit both types 

of information. In the case of a license amendment, an applicant may submit either or both 

types of information, as needed, to address the areas amended. 

The purpose of the review of the ISA Summary is to establish reasonable assurance that the 

applicant has performed the following tasks: 

 Conducted an ISA of appropriate detail for each applicable process, using methods and 

staff adequate to achieve the requirements of 10 CFR 70.62(c)(1) and (2). 

 Identified and evaluated, in the ISA, all credible events (accident sequences) involving 

process deviations or other events internal to the facility (e.g., explosions, spills, and 

fires) and credible external events that could result in facility-induced consequences to 

workers, the public, or the environment, that could exceed the performance 

requirements of 10 CFR 70.61. As a minimum, external events normally include the 

following: 

– natural phenomena such as floods, high winds, tornadoes, and earthquakes 

– fires external to the facility 

– transportation accidents and accidents at nearby industrial facilities 

 Designated engineered and administrative IROFS and correctly evaluated the set of 

IROFS addressing each accident sequence, as providing reasonable assurance, 

through preventive or mitigative measures and through application of supporting 

management measures (discussed in Chapter 11 of this SRP) that the performance 

requirements of 10 CFR 70.61 are met. 
June 2015 3-3 NUREG-1520, Revision 2 

3.2 Responsibility for Review 

 

Primary: Assigned Licensing Reviewer 

 

Secondary: Technical Specialists in Specific Areas 

 Licensing Project Manager 

 

Supporting: Fuel Facility Inspectors 

 

3.3 Areas of Review 

 

This chapter addresses two types of submittals: (1) those containing descriptive commitments 

regarding the safety program, including the ISA; and (2) ISA summaries. The descriptive 

commitments for the safety program should be found in license applications, renewals, and 

amendments. ISA summaries may be submitted for an entire existing facility, a new facility, a 

new process, or altered processes requiring revision of the ISA. 

 

The safety program and ISA commitments and descriptions to be reviewed consist of 

(1) process safety information (10 CFR 70.62(b)), (2) methods used to perform the ISA, 

(3) qualifications of the team performing the ISA (10 CFR 70.62(c)(2)), (4) methods of 

documenting and implementing the results of the ISA, (5) procedures to maintain the ISA 

current when changes are made to the facility, and (6) management measures 

(10 CFR 70.62(d)). An ISA chapter in the license application will usually contain appropriate 

documentation of these commitments and descriptions. However, pursuant to Chapter 11 of 

this SRP, a separate chapter of an application may address the commitments to and 

descriptions of management measures. 

An ISA Summary presents the results of ISA analyses performed for compliance with Subpart H 

of 10 CFR Part 70. This ISA Summary may be submitted with an application for a new license, 

a license renewal, or a license amendment, but in accordance with 10 CFR 70.65(b) is not 

incorporated as part of the license. 

 

The staff will review the ISA Summary submitted to the NRC and the portions of the ISA and 

ISA documentation maintained on site to determine the adequacy of the applicant’s ISA. The 

contents of the ISA Summary, specified in 10 CFR 70.65, include the following nine topics: 

 

(1) general description of the site 

(2) general description of the facility 

(3) description of facility processes, hazards, and types of accident sequences 

(4) demonstration of compliance with 10 CFR 70.61 performance requirements 

(5) description of the ISA team qualifications and ISA methods 

(6) descriptive list of IROFS 

(7) description of acute chemical exposure standards used 

(8) descriptive list of sole IROFS 

(9) definition of the terms “credible,” “unlikely,” and “highly unlikely” 

 

The documentation supporting the ISA (e.g., piping and instrumentation drawings, engineered 

IROFS boundary descriptions, criticality safety analyses, dose calculations, process hazards 

analysis, process safety information, ISA worksheets) will normally be maintained at the facility 
June 2015 3-4 NUREG-1520, Revision 2 

site. The reviewer may find it efficient to consult the ISA supporting documentation at the facility 

site to establish the completeness and acceptability of the ISA or, in the case of an existing 

facility, to visit the site to fully understand a process operation. For example, the reviewer could 

confirm that accident sequences that were not reported in the ISA Summary because they were 

not credible were correctly identified and analyzed in the ISA. 

 

3.3.1 Safety Program and Integrated Safety Analysis Commitments 

 

The NRC reviews the application to determine whether the applicant’s commitments to establish 

a safety program and to perform and maintain an ISA are adequate. In the following, the phrase 

“process node” or “process” refers to a single, reasonably compact piece of equipment or 

workstation where a single unit process or processing step is conducted. A typical fuel cycle 

facility is divided into several major process lines or areas, each consisting of many process 

nodes. The areas of review for ISA commitments are as follows: 

 

 The applicant’s description of, and commitments to, a method for maintaining a current 

and accurate set of process safety information, including information on the hazardous 

materials, technology, and equipment used in each process. The applicant should 

explain this activity in detail in the description of its configuration management program 

(Section 11.1). 

 The applicant’s description of, and commitments to, requirements for ISA team training 

and qualifications (Section 11.4) for those individuals who will conduct and maintain the 

ISA and ISA Summary. 

 The applicant’s description of, and commitments to, ISA methods, method selection 

criteria, or specific methods to be used for particular classes of process nodes (usually 

process workstations). The review of the ISA method includes evaluating the applicant’s 

methods in the following specific areas: 

 

– hazard identification 

– process hazard analysis (accident identification) 

– accident sequence construction and evaluation 

– consequence determination and comparability to 10 CFR 70.61 

– likelihood categorization for determining compliance with 10 CFR 70.61 

 

 The applicant’s description of, and commitments to, management procedures for 

conducting and maintaining the ISA. Specific review areas include the following 

applicant procedures: 

– performance of, and updates to, the ISA 

– review responsibility 

– ISA documentation 

– reporting of ISA Summary changes per 10 CFR 70.72(d)(1) and (3) 

– maintenance of ISA records per 10 CFR 70.62(a)(2) 

 
June 2015 3-5 NUREG-1520, Revision 2 

3.3.2 Integrated Safety Analysis Summary and Documentation 

 

The NRC reviews the ISA Summary and, if necessary, the ISA and supporting ISA 

documentation to determine whether there is reasonable assurance that the applicant has 

performed a systematic evaluation of the hazards and has identified credible accident 

sequences, IROFS, and management measures that satisfy the performance requirements of 

10 CFR 70.61. The NRC confirms that credible accidents that result in a release of radioactive 

material, a nuclear criticality event, or any other exposure to radiation resulting from use of 

licensed material that exceeds the exposure limits stated in 10 CFR 70.61 are “highly unlikely” 

or “unlikely,” as appropriate. In addition, the NRC reviews accidents involving hazardous 

chemicals produced from licensed materials. Hazardous chemical include chemicals that are 

licensed materials or have licensed materials as precursor compounds, or substances that 

physically or chemically interact with licensed materials and that are toxic, explosive, flammable, 

corrosive, or reactive to the extent that they endanger life or health. These include substances 

that are commingled with licensed material or are produced by a reaction with licensed material. 

If a chemical accident has the potential to cause, or reduce protection from, a radiation 

exposure accident, then it also must be addressed (see Chapter 6 for more information on 

chemical process safety). On the other hand, accident sequences having unmitigated 

consequences that will not exceed the performance requirements of 10 CFR 70.61(c), once 

identified as such, do not require reporting in the ISA Summary. 

 

The areas of review for the ISA Summary are as follows: 

 

 Site: The site description in the ISA Summary (see Section 1.3) focuses on those 

factors that could affect safety, such as geography, meteorology (e.g., high winds and 

flood potential), seismology, demography, and nearby industrial facilities and 

transportation routes. 

 Facility: The facility description in the ISA Summary focuses on features that could 

affect potential accidents and their consequences. Examples of these features are 

facility location, facility design information, and the location and arrangement of buildings 

on the facility site. 

 Processes, Hazards, and Accident Sequences: The process description in the ISA 

Summary addresses each process that was analyzed as part of the ISA. Specific areas 

reviewed include basic process function and theory, functions of major components and 

their operation, process design and equipment, and process operating ranges and limits. 

This description must also include a list of the hazards (and interactions of hazards) for 

each process and the accident sequences that could result from such hazards and for 

which unmitigated consequences could exceed the performance requirements of 

10 CFR 70.61. 

 Demonstration of Compliance with 10 CFR 70.61: For each applicable process, this 

section presents the following information that should be developed in the ISA to 

demonstrate compliance with the performance criteria of 10 CFR 70.61: 

– postulated consequences and comparison to the consequence levels identified in 

10 CFR 70.61, as well as information, such as inventory and release path factors 

supporting the results of the consequence evaluation 
June 2015 3-6 NUREG-1520, Revision 2 

– information showing how the applicant established the likelihoods of accident 

sequences that could exceed the performance requirements of 10 CFR 70.61 

– information describing how designated IROFS protect against accident 

sequences that could exceed the performance requirements of 10 CFR 70.61 

– information on management measures applied to the IROFS (addressed in 

greater detail in Chapter 11) 

– information on how the criticality monitoring requirements of 10 CFR 70.24, 

“Criticality Accident Requirements,” are met 

– if applicable, ways that the baseline design criteria of 10 CFR 70.64, 

“Requirements for New Facilities or New Processes at Existing Facilities,” are 

addressed 

 

 Team Qualifications and ISA Methods: This section should discuss the applicant’s ISA 

team qualifications and ISA methods, as described in the ISA Summary. (If methods are 

adequately described in the license application, the applicant will not need to duplicate 

this information in the ISA Summary. The ISA Summary should include specific 

examples of the application of ISA methods to enable the reviewer to understand their 

selection and use.) 

 

 List of IROFS: This list describes the IROFS for all intermediate- and high-consequence 

accidents in sufficient detail to permit an understanding of their safety function. 

 Chemical Consequence Standards: This discussion identifies the applicant’s 

quantitative standards for assessing the chemical consequence levels specified in 

10 CFR 70.61, as described in the ISA Summary. 

 List of Sole IROFS: This list identifies those IROFS that are the sole item preventing or 

mitigating an accident for which the consequences could exceed the performance 

requirements of 10 CFR 70.61. 

 Definitions of “Unlikely,” “Highly Unlikely,” and “Credible”: The applicant must define the 

terms “unlikely,” “highly unlikely,” and “credible,” as used in the ISA Summary. 

 

The regulations in 10 CFR 70.65(b) list the types of information required to be submitted in an 

ISA Summary. This includes generic information, such as site description, ISA methods, and 

ISA team qualifications. This also includes process-specific information, such as a list of 

IROFS, general descriptions of types of accident sequences, and “information demonstrating 

compliance with 10 CFR 70.61.” To meet the latter requirement, an applicant would have to 

provide, at a minimum, likelihood and consequence information for each type of process 

accident sequence identified in the ISA Summary. To evaluate the effectiveness of the 

applicant’s likelihood and consequence evaluation methods, the reviewer should also examine 

the analyses of some accident sequences that are not reported in the ISA Summary for which 

the applicant established that consequences will not exceed the performance requirements of 

10 CFR 70.61. 
June 2015 3-7 NUREG-1520, Revision 2 

 

In some simple cases, the information normally contained in the ISA Summary process 

descriptions and list of IROFS might be sufficient to enable the reviewer to understand how 

compliance is achieved when considered with the description of ISA likelihood evaluation 

methods and criteria. However, in general, the applicant should describe how its ISA team 

evaluated a credible accident likelihood to be “highly unlikely” or “unlikely.” 

 

The reviewer should evaluate the efficacy of the applicant’s ISA methods. To do this, in addition 

to reviewing the description of the ISA methods, the reviewer will need to understand how these 

methods have been applied in practice to the wide diversity of process safety designs in the 

facility. Examples in the ISA Summary of how the methods are applied to a representative 

sample of processes would help the reviewer to understand the applicant’s ISA methods. 

However, if the ISA Summary does not include examples providing details of how the methods 

were applied, such information may be available at the applicant’s site, as part of the overall 

safety information records. 

 

The NRC review of the applicant’s example accident sequence evaluations included in the ISA 

Summary is not a substitute for the “vertical slice” and “horizontal” reviews that should be 

performed using detailed information at the site. The NRC must select this onsite evaluation of 

ISA documentation and processes to confirm that the ISA was actually performed as described 

in the ISA Summary. 

 

3.4 Acceptance Criteria 

 

3.4.1 Regulatory Requirements 

 

The regulation in 10 CFR 70.62 specifies the requirement to establish and maintain a safety 

program, including performance of an ISA. Paragraph (c) of 10 CFR 70.62 specifies 

requirements for conducting an ISA, which include a demonstration that credible 

high-consequence and intermediate-consequence events meet the safety performance 

requirements of 10 CFR 70.61. The requirement to prepare and submit an ISA Summary for 

NRC approval, stated in 10 CFR 70.65(b), also describes the contents of an ISA Summary. The 

regulation in 10 CFR 70.72, “Facility Changes and Change Process,” set forth requirements for 

maintaining a current ISA and other safety program documentation when changes are made to 

the site, structures, processes, systems, equipment, components, computer programs, and 

activities of personnel; however, the ISA Summary need be updated only annually. 

 

The information to be included in the ISA Summary can be divided into four categories: (1) site 

and facility characteristics, (2) ISA methods, (3) hazards and accident analysis, and (4) IROFS. 

Table 3.1 summarizes the information requirements of each category, the corresponding 

regulatory citation, and the section of this chapter that describes the expectations for such 

information. 

 
June 2015 3-8 NUREG-1520, Revision 2 

Table 3.1 Information Requirements for the ISA Summary 

3.4.2 Regulatory Guidance 

 

NUREG-1513, “Integrated Safety Analysis Guidance Document,” issued May 2001, contains 

guidance applicable to performing an ISA and documenting the results. NUREG/CR-6410, 

“Nuclear Fuel Cycle Facility Accident Analysis Handbook,” issued March 1998, provides 

Information Category and Requirement 10 CFR Part 70 Regulatory 

Citation 

NUREG-1520, Chapter 3 

Section Reference 

Site and Facility Characteristics:

Site description 70.65(b)(1) 3.4.3.2(1) 

Facility description 70.65(b)(2) 3.4.3.2(2) 

Criticality monitoring and alarms 70.65(b)(4) 3.4.3.2(4c) 

Compliance with baseline design criteria, criticality monitoring, 

and alarms 

70.64 (if applicable) 

70.65(b)(4) 3.4.3.2(4d) 

ISA Methods

ISA method(s) description 70.65(b)(5) 3.4.3.2(5) 

ISA team description 70.65(b)(5) 3.4.3.2(5) 

Quantitative standards for acute chemical exposures 70.65(b)(7) 3.4.3.2(7) 

Definition of “unlikely,” “highly unlikely,” and “credible” 70.65(b)(9) 3.4.3.2(9) 

Hazards and Accident Analysis 

Description of processes analyzed 70.65(b)(3) 3.4.3.2(3a) 

Identification of hazards 70.65(b)(3) 3.4.3.2(3b) 

Description of accident sequences 70.65(b)(3) 3.4.3.2(3c) 

Characterization of high- and intermediate-consequence 

accident sequences 70.65(b)(3) 3.4.3.2(3c) 

Items Relied on for Safety

List and description of IROFS 70.65(b)(6) 3.4.3.2(6) 

Description of IROFS’ link to accident sequences to show 

10 CFR 70.61 compliance 70.65(b)(6) 3.4.3.2(4) and (6) 

IROFS management measures 70.65(b)(4) 3.4.3.2(4b) and (6) 

List of sole IROFS 70.65(b)(8) 3.4.3.2(8)
June 2015 3-9 NUREG-1520, Revision 2 

guidance on acceptable methods for evaluating the chemical and radiological consequences of 

potential accidents. NUREG-1601, “Chemical Process Safety at Fuel Cycle Facilities,” issued 

August 1997, provides guidance on chemical safety practices acceptable for compliance with 

the regulations. 

 

3.4.3 Regulatory Acceptance Criteria 

 

The acceptance criteria for an ISA are derived from and support compliance with the relevant 

requirements of 10 CFR Part 70. The ISA will form the basis for the safety program by 

identifying potential accidents, designating IROFS and management measures, and evaluating 

the likelihood and consequences of each accident sequence for compliance with the 

performance requirements of 10 CFR 70.61. Some of the acceptance criteria address the 

programmatic commitments made by the applicant to perform and maintain an ISA. The 

remainder of the criteria address the ISA results, as documented in the ISA Summary, and 

whether those documented results demonstrate that the applicant’s IROFS and management 

measures can reasonably be expected to ensure that the relevant accident sequences will meet 

the performance requirements of 10 CFR 70.61. The acceptance criteria are thus intended to 

support the ultimate finding of the license review that, based on the information submitted and 

reviewed, there is reasonable assurance that the proposed facility, IROFS, safety programs, 

and management measures conforming to the commitments in the application comply with the 

regulations and provide adequate protection of public health and safety. 

 

A high level of detail describing the process designs and IROFS might not be submitted with the 

license application or ISA Summary. In other words, the applicant might not provide information 

about all the components in a system, because not every component would be a safety-related 

component. In particular, for proposed new facilities, the level of detail may be limited since the 

hardware has not actually been fabricated. However, the applicant must describe the IROFS in 

enough detail to permit an understanding of the intended safety function and to permit an 

assessment that it is capable of the reliability expected of it in the evaluation of likelihoods of 

accident sequences. The NRC staff may obtain additional details for processes selected for the 

vertical slice review by visiting the applicant’s site. While there may be an actual difference in 

the level of detail known about processes and IROFS, as documented at the applicant’s site, for 

existing and proposed new facilities, the minimum level of detail that is sufficient in descriptions 

of processes and IROFS, as documented in the ISA Summary, does not differ between existing 

and proposed new facilities. 

The purpose of the review, and its acceptance criteria, for most facilities, is primarily to permit a 

finding that the applicant’s safety program, including the ISA program as described, provides 

reasonable assurance that compliance will be achieved. However, to generate the ISA 

Summary, which is a required submission, the applicant must first perform an ISA. This in turn 

requires that the applicant identify process designs, accident sequences, and IROFS. These 

latter items are not programmatic, but are elements of design and analysis of design. 

Attainment of reasonable assurance that the ISA program is and will be effective does not 

usually require that all safety elements and IROFS be reviewed in full detail, nor is it required 

that the applicant’s description of IROFS and process designs be at the level of detail that will 

eventually exist at the time of operations (see the discussion of vertical slice review in 

Section 3.5). The requisite level of detail to achieve reasonable assurance may vary among 

processes, depending on factors such as use of established technology, commitment to 

standards, applicant expertise, industry experience, safety margins, and inherent difficulty in 

achieving the safety function. However, the underlying requirements for the descriptions are 
June 2015 3-10 NUREG-1520, Revision 2 

exactly the same for each process and IROFS; namely, “...a description of each process...in 

sufficient detail to understand the theory of operation...” (10 CFR 70.65(3)); and “a description 

of IROFS...in sufficient detail to understand their functions in relation to the performance 

requirements...” (10 CFR 70.65(8)). Thus, the requirements for new technology are no different 

than those for old technology, but more explanatory detail may be necessary to meet the 

requirements related to “sufficient detail to understand.” 

3.4.3.1 Safety Program and Integrated Safety Analysis Commitments 

 

This section discusses the acceptance criteria for license commitments pertaining to the 

facility’s safety program including the performance of an ISA. A number of specific safety 

program requirements related to the ISA appear in 10 CFR Part 70. Section 3.4.3.2 presents 

the acceptance criteria for the content of the ISA Summary. These include the primary 

requirements that an ISA be conducted and that, based on the ISA Summary submitted, there is 

reasonable assurance that the applicant’s facility and safety program complies with the ISA 

requirements of 10 CFR Part 70, Subpart H, including the performance requirements of 

10 CFR 70.61. For each component of the safety program, several elements may be 

necessary, including organization, assignment of responsibilities, management policies, 

required activities, written procedures for activities, use of industry consensus standards, and 

technical safety practices, among others. 

Procedures and industry standards for hardware safety controls vary according to the type of 

equipment and by the degree of reliability and performance required in specific applications. 

For this reason, blanket commitments to apply all standards in all cases may not appear in the 

license application. However, some standards for engineering practices and hardware and 

software design or analysis are generic. Hence, an applicant may specify a general 

commitment to such a generic standard or may make conditional commitments to standards, 

subject to specified applicability criteria. The purpose of such commitments is to support 

likelihood or other performance evaluations for compliance with the regulations. NRC guidance 

has endorsed some standards, possibly with exceptions. Such commitments to standards are 

acceptable if they are consistent with their use in demonstrating compliance and with specific 

NRC guidance. 

Among those engineering practices and standards that are generically applicable to IROFS and 

safety controls are those that apply to personnel activities relevant to administrative controls, 

management measures, or human-machine interfaces. This area is called human factors 

engineering. Human factors engineering should generally be part of the safety program. 

Human factors practices should be incorporated into the applicant’s safety program sufficiently 

to ensure that IROFS and management measures perform their functions in meeting the 

requirements of 10 CFR Part 70. Appendix E to this chapter describes areas of review and 

acceptance criteria for human factors engineering in the context of 10 CFR Part 70 for fuel cycle 

facilities. 

 

The applicant’s commitments for each of the three elements of the safety program defined in 

10 CFR 70.62(a) should be acceptable if the applicant does the following: 

 

(1) Process Safety Information 

 

a. The applicant commits to compiling and maintaining an up-to-date database of 

process safety information. Written process safety information will be used in 
June 2015 3-11 NUREG-1520, Revision 2 

updating the ISA and in identifying and understanding the hazards associated 

with the processes. The compilation of written process safety information should 

include information pertaining to the following: 

 

i. The description of hazards of all materials used or produced in the 

process, which should include information on chemical and physical 

properties (such as toxicity, acute exposure limits, reactivity, and 

chemical and thermal stability) such as are included on Material Safety 

Data Sheets (meeting the requirements of 29 CFR 1910.1200(g)). 

 

ii. The discussion of the technology of the process should include a block 

flow diagram or simplified process flow diagram, a brief outline of the 

process chemistry, safe upper and lower limits for controlled parameters 

(e.g., temperature, pressure, flow, and concentration), and evaluation of 

the health and safety consequences of process deviations. 

 

iii. The description of the equipment used in the process should include 

general information on topics such as the materials of construction, piping 

and instrumentation diagrams, ventilation, design codes and standards 

employed, material and energy balances, IROFS (e.g., interlocks, 

detection, or suppression systems), electrical classification, and relief 

system design and design basis. 

b. The applicant includes procedures and criteria for changing the ISA, along with a 

commitment to design and implement a facility change mechanism that meets 

the requirements of 10 CFR 70.72. The applicant should discuss the evaluation 

of the change within the ISA framework, as well as procedures and 

responsibilities for updating the facility’s ISA. 

 

c. The applicant commits to engage personnel with appropriate experience and 

expertise in engineering and process operations to maintain the ISA. The ISA 

team for a process should consist of individuals who are knowledgeable in the 

facility’s ISA methods and the operation, hazards, and safety design criteria of 

the particular process. 

 

(2) ISA 

 

a. The applicant conducts and commits to maintaining an ISA of appropriate 

complexity for each process, such that it identifies (i) radiological hazards, (ii) 

chemical hazards that could increase radiological risk, (iii) facility hazards that 

could increase radiological risk, (iv) potential accident sequences, 

(v) consequences and likelihood of each accident sequence, and (vi) IROFS 

including the assumptions and conditions under which they support compliance 

with the performance requirements of 10 CFR 70.61. The application is 

acceptable if it describes sufficiently specific methods and criteria that would be 

effective in accomplishing each of these tasks. Such effective methods and 

criteria are described in NUREG-1513, NUREG/CR-6410, item (5) of 

Section 3.4.3.2 of this SRP, and Appendix A to this chapter. 

 
June 2015 3-12 NUREG-1520, Revision 2 

b. The applicant commits to keeping the ISA and its supporting documentation 

accurate and up to date by means of a suitable configuration management 

system and to submitting changes to the ISA Summary to the NRC, in 

accordance with 10 CFR 70.72(d)(1) and (3). The ISA must account for any 

changes made to the facility or its processes (e.g., changes to the site, operating 

procedures, or control systems). Management policies, organizational 

responsibilities, revision timeframe, and procedures to perform and approve 

revisions to the ISA should be outlined succinctly. The applicant commits to 

evaluating any facility changes or changes in the process safety information that 

may alter the parameters of an accident sequence by means of the facility’s ISA 

methods. For any revisions to the ISA, the applicant commits to using personnel 

with qualifications similar to those of ISA team members who conducted the 

original ISA. 

 

c. The applicant commits to training personnel in the facility’s ISA methods and/or 

using suitably qualified personnel to update and maintain the ISA and ISA 

Summary. 

 

d. The applicant commits to evaluating proposed changes to the facility or its 

operations by means of the ISA methods and to designating new or additional 

IROFS and appropriate management measures as required. The applicant also 

agrees to promptly evaluate the adequacy of existing IROFS and associated 

management measures and to make any required changes that may be affected 

by changes to the facility and/or its processes. If a proposed change results in a 

revised accident sequence in the ISA Summary or increases the consequences 

and/or likelihood of a previously analyzed accident sequence within the context 

of 10 CFR 70.61, the applicant commits to promptly evaluating the adequacy of 

existing IROFS and associated management measures and to making necessary 

changes, if required. 

 

e. The applicant commits to addressing any unacceptable performance deficiencies 

in the IROFS that are identified through updates to the ISA. 

 

 f. The applicant commits to maintaining written procedures on site. 

 

g. The applicant commits to establishing all IROFS (if not already established) and 

to maintaining them so that they are available and reliable when needed. 

 

In citing industry consensus standards, the applicant should delineate specific 

commitments in the standards that will be adopted. The applicant should provide 

justification if it has not adopted all of the required elements of a standard. 

 

(3) Management Measures 

 

The applicant commits to establishing management measures (which are evaluated 

using SRP Chapter 11) that constitute the principal mechanism for ensuring the reliability 

and availability of each IROFS. 

 
June 2015 3-13 NUREG-1520, Revision 2 

3.4.3.2 Integrated Safety Analysis Summary and Documentation

 

Information in the ISA Summary should provide the basis for the reviewer to conclude that there 

is reasonable assurance that the identified IROFS will satisfy the performance requirements of 

10 CFR 70.61. To do this, the reviewer must conclude that the applicant’s ISA program has the 

capability to identify appropriate IROFS and that IROFS identified in the ISA Summary are 

adequate to control the potential accidents of concern at the facility. The accidents of concern 

are those that would have consequences at the high and intermediate levels, absent any 

preventive or mitigative controls. In this context, adequacy means the capability of the IROFS 

to prevent the related accidents with sufficient reliability, or to sufficiently mitigate their 

consequences, so that the performance requirements of 10 CFR 70.61 can be met. To support 

such a review, the ISA Summary must include sufficient information about an accident 

sequence and the proposed IROFS to allow the reviewer to assess the contributions of the 

IROFS to prevention or mitigation. The ISA Summary must contain enough information 

concerning the ISA methods and the qualifications of the team that performed the ISA and any 

other resources employed to give the reviewer confidence that the list of potential accidents 

identified is reasonably complete. 

 

In addition, the reviewer needs to determine that appropriate management measures will be in 

place to ensure the availability and reliability of the identified IROFS, when needed. Chapter 11 

of this SRP addresses the review of designated management measures 

 

The following acceptance criteria address each of the content elements of the ISA Summary 

required by 10 CFR 70.65(b). For new facilities, the reviewer should also evaluate those 

aspects of the design that address the baseline design criteria of 10 CFR 70.64 applicable to 

individual processes. Thus, the following nine content elements have defined acceptance 

criteria: 

 

(1) general description of the site 

(2) general description of the facility 

(3) description of facility processes, hazards, and types of accident sequences 

(4) demonstration of compliance with 10 CFR 70.61 performance requirements 

(5) description of the ISA team qualifications and ISA methods 

(6) descriptive list of IROFS 

(7) description of acute chemical exposure standards used 

(8) descriptive list of sole IROFS 

(9) definitions of “credible,” “unlikely,” and “highly unlikely” 

 

Detailed acceptance criteria for each element of the ISA Summary follow: 

 

(1) Site. The description in the ISA Summary of the site for processing nuclear material is 

considered acceptable if the applicant includes, or references, the following safetyrelated information, with emphasis on those factors that could affect safety: 

a. A description of the site geography, including its location, taking into account 

prominent natural and manmade features such as mountains, rivers, airports, 

population centers, possibly hazardous commercial and manufacturing facilities, 

transportation routes, etc., adequate to permit evaluation of (i) the likelihoods of 

accidents caused by external factors and (ii) the consequences of potential 

accidents. 
June 2015 3-14 NUREG-1520, Revision 2 

b. Population information, based on the most recent census data, that shows 

population distribution as a function of distance from the facility, adequate to 

permit evaluation of regulatory requirements, including exposure of the public to 

consequences listed in 10 CFR 70.61. 

c. Characterization of natural phenomena (e.g., tornadoes, hurricanes, floods, and 

earthquakes) and other external events sufficient to allow assessment of their 

impact on facility safety and their likelihood of occurrence. At a minimum, the 

100-year flood should be postulated, consistent with U.S. Army Corps of 

Engineers flood plain maps. The applicant should also provide earthquake 

accelerations for the site associated with a 250-year and 500-year earthquake. 

The discussion should identify all design-basis natural events for the facility, 

indicate which events are considered incredible, and describe the basis for that 

determination. The assessment should also indicate which events could occur 

without adversely impacting safety. 

(2) Facility. The description of the facility is considered acceptable if the applicant identifies 

and describes the general features that affect the reliability or availability of IROFS. If 

such information is available elsewhere in the application, reference to the appropriate 

sections is considered acceptable. The information provided should adequately support 

an overall understanding of the facility structure and its general arrangement. As a 

minimum, the applicant should adequately identify and describe the following: 

a. the facility location and the distance from the site boundary in all directions, 

including the distance to the nearest resident and distance to boundaries in the 

prevailing wind directions 

b. restricted area and controlled area boundaries 

c. design information regarding the resistance of the facility to failures caused by 

credible external events, when those failures may produce consequences 

exceeding those identified in 10 CFR 70.61 

d. the location and arrangement of buildings on the facility site 

(3) Processes, Hazards, and Accident Sequences 

a. Processes. The descriptions of processes in the ISA Summary must include all 

processes in which upset conditions could credibly lead to accidents with high or 

intermediate consequences. No areas or processes can be omitted, unless 

screened out because the accidents are non-credible. The description in the ISA 

Summary of the processes analyzed as part of the ISA (10 CFR 70.62(c)(1)(i–vi)) 

is considered acceptable if it describes the following features in sufficient detail to 

permit an understanding of the theory of operation and to assess compliance 

with the performance requirements of 10 CFR 70.61. A description at a systems 

level is acceptable, provided that it permits the NRC reviewer to adequately 

evaluate (1) the completeness of the hazard and accident identification tasks and 

(2) the likelihood and consequences of the accidents identified. If the information 

is available elsewhere in the application and is adequate to support the purposes 
June 2015 3-15 NUREG-1520, Revision 2 

of the ISA Summary, reference to the appropriate sections is considered 

acceptable. The descriptions of processes must permit an understanding of how 

the set of IROFS in that process could reliably perform their safety function for 

each high- and intermediate-consequence accident sequence. Hence, all 

process designs must be described in sufficient detail to reasonably permit 

identification of all accident sequences and IROFS to prevent or mitigate them. 

The level of detail in process safety documentation held at the site would 

normally be greater than the descriptions in the ISA Summary and may include 

some or all of the information listed as items i through iv below, as needed. 

a. Basic process function and theory includes a general discussion of the 

basic theory of the process. Normally, this would include the following: 

 parameters to be controlled and strategy for complying with 

10 CFR 70.61 

 chemical or mechanical theory principles, materials, and quantities 

needed to understand the hazards and safety functions 

 normal and potential transport and changes in materials in the 

process 

b. Major components include the general arrangement, function, and 

operation of major components in the process. If appropriate, it could 

also include arrangement drawings and process schematics showing the 

major components and instrumentation, and flowsheets showing 

compositions of the various process streams. 

iii. Process design and equipment include a discussion of process design, 

equipment, and instrumentation that is sufficiently detailed to permit an 

adequate understanding of the results of the ISA. As appropriate, it 

includes schematics indicating safety interrelationships of parts of the 

process. In particular, it is usually necessary for criticality safety to 

diagram the location and geometry of the fissile and other materials in the 

process, for both normal and bounding abnormal conditions. This can be 

done using either schematic drawings or textual descriptions indicating 

the location and geometry of fissile materials, moderators, etc., sufficient 

to permit an understanding of how the IROFS limit the mass, geometry, 

moderation, reflection, and other factors. 

iv. Process safety limits and margins on variables (e.g., temperatures, 

pressures, flows, fissile mass, enrichment, and composition) that are 

controlled by IROFS to ensure safe operations of the process, should be 

specified, because these limits and margins would be needed to 

understand the likelihood of failure assigned by the applicant to the 

IROFS. For example, if a process is designed, and an IROFS procedure 

specified, to ensure critical mass control by double-batching proof, the 
June 2015 3-16 NUREG-1520, Revision 2 

margin from a single batch to the subcritical limit should be specified. 

Traditionally, the single batch is 45 percent of the subcritical limit. 

b. Hazards. The description of process hazards provided in the ISA Summary is 

acceptable if it identifies, for each process, all types of hazards that are relevant 

to determining compliance with the performance criteria of 10 CFR 70.61. That 

is, the acceptance criterion is completeness. All hazards that could result in an 

accident sequence in which the consequences could exceed the performance 

requirements of 10 CFR 70.61 should be listed, even if later analysis of a 

particular hazard shows that resulting accident sequences do not exceed these 

limits. Otherwise, the reviewer cannot determine completeness. General 

exclusion from consideration of certain hazards for an entire facility can be 

justified by bounding case analyses showing that, for the conditions or credible 

inventories on site, the performance requirements of 10 CFR 70.61 cannot be 

exceeded. In this case, the bounding inventories or conditions, if under the 

control of the applicant, become IROFS. 

Any locations where hazardous regulated material, including fissile material, 

could accidentally be located should also be considered. Improper screening out 

of locations and processes that are not normally hazardous, but that could 

become so in upset conditions, can lead to a failure to apply IROFS to prevent 

such upsets and potential accidents arising from them. 

The list of process hazards is acceptable if the ISA Summary provides the 

following information: 

i. a list of materials (radioactive, fissile, flammable, and toxic) or conditions 

that could result in hazardous situations (e.g., loss of containment of 

licensed nuclear material), including the maximum intended inventory 

amounts and locations of the hazardous materials at the facility 

ii. potential interactions among materials or conditions that could result in 

hazardous situations 

c. Accident Sequences. The general description of types of accident sequences in 

the ISA Summary is acceptable if the reviewer can determine the following: 

The applicant has identified all types of accidents for which the consequences 

could exceed the performance requirements of 10 CFR 70.61. The level of detail 

required in describing accidents is closely related to the level of detail in 

describing IROFS, as many events leading to consequences of concern in 

10 CFR 70.61 are failures of IROFS. It is not usually necessary to specify all 

modes and mechanisms by which the IROFS failure could occur in order to 

understand the role that the IROFS plays in preventing or mitigating the accident. 

 

The applicant has identified how the IROFS listed in the ISA Summary protect 

against each such type of accident. 
June 2015 3-17 NUREG-1520, Revision 2 

To satisfy the requirement that all accidents be identified, the applicant should 

describe the process design in sufficient detail. In particular, all IROFS need to 

be specified. The level of detail in specifying the process and IROFS should be 

sufficient to permit a reasonable understanding as to how the safety function will 

be performed so as to meet the performance requirements of 10 CFR 70.61. 

General types of accident sequences differ if they consist of a different set of 

IROFS failures. Thus, several processes, each using a set of IROFS that is 

functionally of the same type (e.g., having the same mechanical, physical, and/or 

electrical principle of operation), can be summarized as a single type of accident 

sequence and listed only once. However, the individual processes covered by 

this system should be individually identified in a way that the reviewer can 

determine the application’s completeness in addressing all processes. 

For this reason, it is not generally acceptable as a description of an accident to 

merely list the type of hazard, or the controlled parameters, without referencing 

the items relied on to control the parameters or hazard. The description of 

general types of accident sequences is acceptable if it covers all types of 

sequences, initiating events, and IROFS failures. Initiating events can be (1) an 

external event such as a hurricane or earthquake, (2) a facility event external to 

the process being analyzed (e.g., fires, explosions, failures of other equipment, 

flooding from facility water sources), (3) deviations from normal operations of the 

process (credible abnormal events), or (4) failures of an IROFS in the process. 

Human errors that are initiating events would generally be administrative IROFS 

failures. The description of a general type of accident sequence is acceptable if 

it permits the reviewer to determine how each accident sequence for which the 

consequences could exceed the performance requirements of 10 CFR 70.61 is 

protected against by IROFS or a system of IROFS. 

One acceptable way to do this is to show a fault tree on which the basic events 

are IROFS failures. Another acceptable method is to provide a table in which 

each row displays the events in an accident sequence, such as in Appendix A to 

this chapter, Table A-7, where, in general, each event is a failure of an IROFS. 

Another acceptable way is to provide a narrative summary for each process 

describing the sequence of events in each type of accident. 

To demonstrate completeness, the process hazard analysis identifying general 

types of accident sequences must use systematic methods and consistent 

references. Therefore, each description of a general type of accident sequence 

is acceptable if it meets the following criteria: 

i. An acceptable method of hazard identification and process hazard 

analysis is used in accordance with the criteria of NUREG-1513. 

ii. The selected method is correctly applied. 

iii. The applicant does not overlook any type of accident sequence for which 

the consequences could exceed the performance requirements of 

10 CFR 70.61. A key test of whether a type of accident has been 
June 2015 3-18 NUREG-1520, Revision 2 

overlooked is whether IROFS have been identified to meet the 

performance requirements. 

iv. The applicant uses a method of identifying facility processes that ensures 

identification of all processes. 

During the early phases of an ISA, accidents will be identified for which the 

consequences may initially be unknown. These accidents will later be analyzed 

and may be shown to have consequences that are less than the levels identified 

in 10 CFR 70.61. 

The ISA Summary need not list as a separate type of accident sequence, every 

conceivable permutation of an accident. Accidents having characteristics that all 

fall in the same categories can be grouped as a single type of accident in the ISA 

Summary provided that the following conditions are met: 

i. The initiating IROFS failures or events have the same effect on the 

system. 

ii. They all consist of failures of the same IROFS or system of IROFS. 

iii. They all result in violation of the safety limit on the same parameter. 

iv. They all result in the same type and severity categories of consequences. 

(4) Information Demonstrating Compliance with the Performance Requirements of 

10 CFR 70.61 

a. Accident Sequence Evaluation and IROFS Designation. The regulation in 

10 CFR 70.65(b)(4) requires that the ISA Summary contain “information that 

demonstrates the licensee’s compliance with the performance criteria of 

10 CFR 70.61...” Since the requirements of 10 CFR 70.61 are expressed in 

terms of consequences and likelihoods of events, the ISA Summary should 

provide sufficient information to demonstrate the following: 

 i. Credible high-consequence events are highly unlikely. 

 ii. Credible intermediate-consequence events are unlikely. 

 iii. Under normal and credible abnormal conditions, all nuclear processes are 

 subcritical. 

The performance requirements of 10 CFR 70.61 have three elements, including 

completeness, consequences, and likelihood. 

“Completeness” refers to the requirement that the ISA address each credible 

event. “Consequence” refers to the magnitude of the chemical and radiological 

doses of the accident and is the basis for classification of an accident as a highor intermediate-consequence event as described in 10 CFR 70.61. “Likelihood” 

refers to the requirement in 10 CFR 70.61 that intermediate-consequence events 
June 2015 3-19 NUREG-1520, Revision 2 

be “unlikely” and high-consequence events be “highly unlikely.” Thus, the 

information provided must address each of these three elements. 

To be acceptable, the information provided must correspond to the ISA methods, 

consequence, and likelihood definitions described in the submittal. The 

information must also show the basis for and results of applying these methods 

to each process. In addition, the information must show that the methods have 

been properly applied in each case. 

The information showing completeness, consequences, and likelihood for 

accident sequences can be presented in various formats, including logic 

diagrams, fault trees, or tabular summaries. Appendix A to this chapter shows 

one example of how an application can present this information. 

Each of these performance requirements (completeness, consequences, and 

likelihood) is discussed below. 

i. Completeness is demonstrated by correctly applying an appropriate 

accident identification method, as described in NUREG-1513. 

Completeness can be effectively displayed by using an appropriate 

diagram or description of the identified accidents. 

ii. Consequence information in the ISA Summary is acceptable for showing 

compliance with 10 CFR 70.61 provided that the following conditions are 

met: 

 For each accident for which the consequences could exceed the 

performance requirements of 10 CFR 70.61, the ISA Summary 

includes an estimate of its quantitative consequences (doses, 

chemical exposures, criticality) in a form that can be directly 

compared with the consequence levels in 10 CFR 70.61 or 

includes a reference to a value documented elsewhere in the ISA 

Summary that applies to or bounds that accident. 

 The consequences were calculated using a method and data 

consistent with NUREG/CR-6410, or another method described 

and justified in the methods description section of the ISA 

Summary. 

 All consequences that could result from the accident sequence 

have been evaluated. That is, if an accident can result in a range 

of consequences, all possibilities must be considered, including 

the maximum source term and most adverse weather that could 

occur. In other words, because of possible variations in weather 

or other conditions, the consequences of a type of potential 

accident may vary. If, for some such conditions, the 

consequences will be high, then the subset of such accidents 

resulting in high consequences are a “high consequence accident 
June 2015 3-20 NUREG-1520, Revision 2 

sequence” in the ISA, even though for average conditions, such 

high consequences would not result. If such conditions are 

unlikely to occur, credit can be taken for this in the evaluation of 

likelihood. 

 The ISA Summary correctly assigns each type of accident to one 

of the consequence categories of 10 CFR 70.61 (namely, high or 

intermediate). 

Unshielded nuclear criticality accidents are considered to be 

high-consequence events, because the radiation exposure that an 

individual could receive exceeds the acute 1-sievert (Sv) 

(100-rem) dose established by 10 CFR 70.61(b)(1). For 

processes with effective engineered shielding, criticalities may 

actually produce doses below the intermediate consequences of 

10 CFR 70.61. As stated in 10 CFR 70.61(d), such processes 

must nevertheless be subcritical for all normal and credible 

abnormal conditions, and primary reliance must be on prevention. 

This applies notwithstanding shielding or other mitigative features. 

If needed, NUREG/CR-6410 provides methods for estimating the 

magnitudes of criticality events that can be applied for workers or 

members of the public at varying distances from the event. 

c. Likelihood information in the ISA Summary is acceptable to show 

compliance with 10 CFR 70.61, provided that the following conditions are 

met: 

 The ISA Summary specifies the likelihood of each general type of 

accident sequence that could exceed the performance 

requirements of 10 CFR 70.61. 

 The likelihoods are derived using an acceptable method described 

in the ISA Summary’s section on methods. 

 The likelihoods comply with acceptable definitions of the terms 

“unlikely” and “highly unlikely,” as described in this SRP chapter. 

When interpreted as required accident frequencies, these terms 

refer to long-run average frequencies, not instantaneous values. 

That is, a system complies with the performance requirements of 

10 CFR 70.61 as a long-run average. Otherwise, failure of any 

IROFS, even for a very short period, would violate the requirement, 

which is not the intent. 

b. Management Measures. According to 10 CFR 70.65(b)(4), the ISA Summary 

must include a description of the management measures to be applied to IROFS, 

as well as information necessary to demonstrate compliance with the 

performance requirements of 10 CFR 70.61. Chapter 11 of this SRP provides 

detailed criteria for use in evaluating the adequacy of such management 

measures. 
June 2015 3-21 NUREG-1520, Revision 2 

c. Criticality Monitoring. The regulation in 10 CFR 70.24 defines specific sensitivity 

and coverage requirements for criticality monitors. Chapter 5 of this SRP 

describes the acceptance criteria and review of information supporting a 

demonstration of compliance with 10 CFR 70.24. 

Specific emergency preparations are also required by 10 CFR 70.24. 

Specifically, the application should provide information to demonstrate that the 

applicant’s equipment and procedures are adequate to meet these requirements. 

d. Requirements for New Facilities or New Processes at Existing Facilities. The 

baseline design criteria specified in 10 CFR 70.64 must be used, as applicable, 

for new facilities and new processes at existing facilities. If the application 

involves such new facilities or processes, the ISA Summary should explain how 

the design of the facility addresses each baseline design criterion. For 

deterministic design criteria such as double contingency, the process-specific 

information may be provided, along with the other process information in the ISA 

Summary. The application should also describe the design-basis events and 

safety parameter limits. In addition, the application should provide methods, 

data, and results of analysis showing compliance with these design bases for 

individual processes and facilities. 

10 CFR 70.64(b) states that facility and system design must be founded on 

defense-in-depth practices and must incorporate, to the extent practicable: (1) 

preference for engineered controls over administrative controls and (2) reduction 

of challenges to IROFS. Thus, facility and system designs relying only on 

administrative controls, or relying on IROFS that are frequently or continuously 

challenged, are not acceptable, unless the application provides a justification 

showing that alternatives to achieve the design criteria are not practicable. 

(5) ISA Team Qualifications and ISA Methods. The ISA teams (10 CFR 70.62(c)(2)) and 

their qualifications as stated in the ISA Summary are acceptable if the following criteria 

are met: 

a. The ISA team has a leader who is formally trained and knowledgeable in the ISA 

methods chosen for the hazard and accident evaluations. In addition, the team 

leader should have an adequate understanding of all process operations and 

hazards under evaluation but should not be the responsible, cognizant engineer 

or expert for that process. 

b. At least one member of the ISA team has thorough, specific, and detailed 

experience in the type of process design under evaluation. 

c. The team has a variety of process design and safety experience in the particular 

safety disciplines relevant to hazards that could credibly be present in the 

process, including, if applicable, radiation safety, nuclear criticality safety, fire 

protection, and chemical safety disciplines. 

d. A manager provides overall administrative and technical direction for the ISA. 
June 2015 3-22 NUREG-1520, Revision 2 

The description of the ISA methods is acceptable if the following criteria are met: 

a. Hazard Identification Method. The hazard identification method selected is 

considered acceptable if it meets the following criteria: 

i. The description includes a list of materials (radioactive, fissile, flammable, 

and toxic) and conditions that could result in hazardous situations (e.g., 

loss of containment of licensed nuclear material). The list should include 

maximum intended inventory amounts and the location of the hazardous 

materials at the facility.1

ii. The method has determined potential interactions between materials or 

upset conditions that could result in hazardous situations where not 

normally present. 

b. Process Hazard Analysis Method. The process hazard analysis method is 

acceptable if it involves selecting one of the methods described in NUREG-1513 

in accordance with the selection criteria established in that document. Methods 

not described in NUREG-1513 may be acceptable provided that they fulfill the 

following conditions: 

 

i. Criteria are provided for their use for an individual process and are 

consistent with the principles of the selection criteria in NUREG-1513. 

ii. The method adequately addresses all the hazards identified in the hazard 

identification task. If an identified hazard is eliminated from further 

consideration, such action is justified. 

iii. The method provides reasonable assurance that the applicant can 

identify all significant accident sequences (including the IROFS used to 

prevent or mitigate the accidents) that could exceed the performance 

requirements of 10 CFR 70.61.2

iv. The method considers the interactions of identified hazards and proposed 

IROFS, including system interactions that could result in an accident 

sequence for which the consequences could exceed the performance 

requirements of 10 CFR 70.61. 

v. The method addresses all modes of operation, including startup, normal 

operation, shutdown, and maintenance. 

 

vi. The method addresses hazards resulting from process deviations 

(e.g., high temperature and high pressure), initiating events internal to the 

 

1

 At a minimum, the inventory list should include the following hazardous materials if present on site: ammonia, fines 

(uranium oxide dust, beryllium), flammable liquids and gases, fluorine, hydrofluoric acid, hydrogen, nitric acid, 

organic solvents, propane, uranium hexafluoride, and Zircaloy. 2 The release of hazardous chemicals is of regulatory concern to the NRC only to the extent that such hazardous 

releases result from the processing of licensed nuclear material or have the potential to adversely affect 

radiological safety.
June 2015 3-23 NUREG-1520, Revision 2 

facility (e.g., fires or explosions), and hazardous credible external events 

(e.g., floods, high winds, earthquakes, and airplane crashes). The 

applicant provides justification for determinations that certain events are 

not credible and, therefore, not subject to the likelihood requirements of 

10 CFR 70.61. 

 

vii. The method adequately considers initiation of or contribution to accident 

sequences by human error through the use of human-systems interface 

analysis or other appropriate methods. 

viii. The method adequately considers common mode failures and system 

interactions in evaluating systems that rely on redundant controls. 

ix. The ISA Summary provides justification that the individual method would 

comply with conditions (ii) through (viii), above. 

c. Consequence Analysis Method. The methods used for ISA consequence 

evaluation, as described in the ISA Summary, are acceptable, provided that the 

following conditions are met: 

i. The methods are consistent with the approaches described in 

NUREG/CR-6410. 

ii. The use of generic assumptions and data is reasonably conservative for 

the types of accidents analyzed. 

d. Likelihood Evaluation Method. The method for evaluating the likelihood of 

accident sequences, as described in the ISA Summary, is considered 

acceptable, provided that it meets the following conditions: 

i. The method clearly shows how each designated IROFS acts to prevent or 

mitigate the consequences (to an acceptable level) of the accident 

sequence being evaluated. 

ii. When multiple IROFS are designated for an accident sequence, the 

method considers the interaction of all such IROFS, as in a logic diagram 

or tabulation that accounts for the impact of redundancy, independence, 

and surveillance on the likelihood of occurrence of the accident. 

iii. The method has objective criteria for evaluating, at least qualitatively, the 

likelihood of failure of individual IROFS. When applicable, such likelihood 

criteria should include the means to limit potential failure modes, the 

magnitude of safety margins, the type of engineered equipment (active or 

passive) or human action that constitutes the IROFS, and the types and 

safety grading (if any) of the management measures applied to the 

IROFS. 

iv. The method evaluates the likelihood of each accident sequence as 

“unlikely,” “highly unlikely,” or neither, as defined by the applicant, in 

accordance with Section 3.4.3.2, item (9), of this chapter. 
June 2015 3-24 NUREG-1520, Revision 2 

v. For nuclear criticality accident sequences, the method evaluates 

compliance with 10 CFR 70.61(d). That is, even in a facility with 

engineered shielding to limit the consequences of nuclear criticalities, 

preventive controls must be in place that are sufficient to ensure that the 

process is subcritical for all credible abnormal conditions. Compared to 

unshielded processes, a moderately higher likelihood may be permitted in 

preventing such events, consistent with American National Standards 

Institute/American Nuclear Society (ANSI/ANS) Standard 8.10, “Criteria 

for Nuclear Criticality Safety Controls in Operations with Shielding and 

Confinement,” reaffirmed in 2005. In particular, criticality cannot result 

from any credible failure of a single IROFS. In addition, potential 

criticality accidents must meet an approved margin of subcriticality for 

safety. Acceptance criteria for such margins are reviewed as 

programmatic commitments, but the ISA methods must consider, and the 

ISA Summary must document, the actual magnitude of those margins 

when they are part of the reason that the postulated accident sequence 

resulting in criticality is deemed highly unlikely. 

Appendix A to this chapter provides an example of one acceptable method for evaluating 

likelihood that is based on a likelihood index. Appendix B offers additional guidance on 

acceptable methods for qualitative evaluation of likelihood. Appendix C discusses 

issues relating to the use of initiating event frequencies in demonstrating compliance 

with the likelihood requirements. Appendix D discusses acceptable ways for the ISA to 

address natural phenomena. 

(6) Descriptive List of All IROFS. The “list describing items relied on for safety” required by 

10 CFR 70.62(c)(1)(vi) is acceptable, provided that it meets the following conditions: 

a. The list includes all IROFS in the identified high- and intermediate-consequence 

accident sequences. 

b. The description of the IROFS may include management measures applied to the 

IROFS (including the safety grading); should include the characteristics of its 

preventive, mitigative, or other safety function; and may include assumptions and 

conditions, such as safety limits or margins, if these are needed to understand 

how the item is capable of achieving compliance with 10 CFR Part 70, 

Subpart H. 

 The above acceptance criteria are explained in greater detail below. 

a. The primary function of the list describing each IROFS is to document the safety 

basis of all processes in the facility. This list assists in ensuring that the items 

(IROFS) are not degraded without a justifying safety review. Thus, the key 

feature of this list is that it includes all IROFS. To be acceptable, no item, 

control, or control system of a process that is needed to show compliance with 

the safety performance requirements of the regulation may be omitted from this 

list (see 10 CFR 70.61(e)). However, sets of hardware or procedures that 

perform the same safety function may be referred to as a single set of IROFS 

and do not need to be individually identified. The list of IROFS may erroneously 
June 2015 3-25 NUREG-1520, Revision 2 

be incomplete in a number of ways: (1) an ineffective method of identifying 

accident sequences may have been used, (2) in applying the method to identify 

accidents something was overlooked, (3) a whole area or process subject to 

accidents was improperly screened out or simply omitted from the ISA, 

(4) IROFS were not applied to an identified accident, or (5) the list of accidents 

was incomplete because of incompleteness in the process design itself. The 

reviewer should attempt, in the horizontal slice review, to determine if any of 

these errors has occurred. 

b. IROFS may be hardware with a dedicated safety function or hardware with a 

property that is relied on for safety. Thus, IROFS may be the dimension, shape, 

capacity, or composition of hardware. The ISA Summary need not provide a 

breakdown of hardware IROFS by component or identify all support systems. 

However, the ISA documentation maintained on site, such as system schematics 

and/or descriptive lists, should contain sufficient detail about items within a 

hardware IROFS, that it is clear to the reviewer and the applicant what structure, 

system, equipment, or component is included within the hardware IROFS’ 

boundary and would, therefore, be subject to management measures specified 

by the applicant. Some examples of items within a hardware IROFS are 

detectors, sensors, electronics, cables, valves, piping, tanks, and dikes. In 

addition, ISA documentation should also identify essential utilities and support 

systems on which the IROFS depends to perform its intended function. Some 

examples of these are backup batteries, air supply, and steam supply. In some 

processes, the frequency of demands made on IROFS must be controlled or 

limited to comply with 10 CFR 70.61. In such processes, whatever features are 

needed to limit the frequency of demands are themselves IROFS. 

c. The essential features of each IROFS should be described. Sufficient 

information should be provided about engineered hardware controls to permit an 

evaluation that, in principle, controls of this type will have adequate reliability. 

Because the likelihood of failure of items often depends on safety margins, 

descriptions of the safety parameter controlled by the item, the safety limit on the 

parameter, and the margin to true failure may be needed. For IROFS that are 

administrative controls, the nature of the action or prohibition involved must be 

described sufficiently to permit an understanding that, in principle, adherence to it 

should be reliable. Features of the IROFS that affect its independence from 

other IROFS, such as reliance on the same power supplies, should be indicated. 

 The description of each IROFS should identify its expected function, conditions 

needed for the IROFS to reliably perform its function, and the effects of its failure. 

The description of each IROFS within an ISA Summary should identify the 

management measures, such as maintenance, training, and configuration 

management that are applied to it. If a system of graded management measures 

is used, the grade applied to each control should be determinable from 

information in the ISA Summary. The reliability required for an IROFS is 

proportionate to the amount of risk reduction it is expected to supply. Thus, the 

quality of the management measures applied to an IROFS may be graded 

commensurate with the required reliability. The management measures should 

ensure that IROFS are designed, implemented, and maintained, as necessary, to 

be available and reliable to perform their function when needed. The degree of 
June 2015 3-26 NUREG-1520, Revision 2 

reliability and availability of IROFS ensured by these measures should be 

consistent with the evaluations of accident likelihoods. In particular, for 

redundant IROFS, all information necessary to establish the average vulnerable 

outage time is required in order to maintain acceptable availability. Otherwise, 

failures must be assumed to persist for the life of the facility. In particular, for 

IROFS whose availability is to be relied on, the time interval between surveillance 

observations or tests of the item should be stated, since restoration of a safe 

state cannot occur until the failure is discovered. 

Table A-13 in Appendix A to this chapter is one example of a tabular description of 

IROFS meeting these criteria. 

(7) Quantitative Standards for Chemical Consequences. The applicant’s description in the 

ISA Summary of proposed quantitative standards used to assess consequences from 

acute chemical exposure to licensed material or chemicals incident to the processing of 

licensed material is acceptable, provided that the following criteria are met: 

a. Unambiguous quantitative standards exist for each of the applicable hazardous 

chemicals that meet the criteria of 10 CFR 70.65(b)(7) on site, corresponding to, 

and consistent with, the quantitative standards in 10 CFR 70.61(b)(4)(i), 

70.61(b)(4)(ii), 70.61(c)(4)(i), and 70.61(c)(4)(ii). 

b. The quantitative standard of 10 CFR 70.61(b)(4)(i) addresses exposures that 

could endanger the life of a worker. The applicant is appropriately conservative 

in applying the language “could endanger,” so as to include exposures that could 

result in death for some workers, consistent with the methods used in the 

U.S. Environmental Protection Agency’s acute exposure guidelines in 

Appendix A, “Table of Toxic Endpoints,” to 40 CFR Part 68, “Chemical Accident 

Prevention Provisions.” 

c. The quantitative standards for 10 CFR 70.61(b)(4)(ii) and 10 CFR 70.61(c)(4)(i) 

will correctly categorize all exposures that could lead to irreversible or other 

serious, long-lasting health effects to individuals. As with criterion (b) above, the 

standard selected should have appropriate conservatism. 

d. The quantitative standard for 10 CFR 70.61(c)(4)(ii) will correctly categorize all 

exposures that could cause mild transient health effects to an individual. 

The NRC finds the use of the Emergency Response Planning Guidelines (ERPGs) 

established by the American Industrial Hygiene Association, the Acute Exposure 

Guideline Levels (AEGLs) established by the National Advisory Committee for Acute 

Guideline Levels for Hazardous Substances, and exposure limits established by the 

Occupational Safety and Health Administration or contained in International Organization 

for Standardization (ISO) standards to be acceptable. If the applicant does not use a 

published exposure standard, or if a chemical has an unknown exposure standard, the 

ISA Summary must describe how an alternative exposure standard was established for 

use in the ISA. The ISA Summary must list the actual exposure values for each 

chemical, specify the source of the data (e.g., ERPG, AEGL, ISO), and provide 

information or a reference supporting the claim that they meet the acceptance criteria 

stated above. (See also Section 6.4.3.1 of this SRP.) 
June 2015 3-27 NUREG-1520, Revision 2 

(8) List of Sole IROFS. The descriptive list in the ISA Summary that identifies all IROFS 

that are the sole item credited as such for demonstrating compliance with 10 CFR 70.61 

is acceptable if it includes the following: 

a. descriptive title of the IROFS 

b. an unambiguous and clear reference to the process to which the item applies 

c. clear and traceable references to the description of the item as it appears in the 

full list of all IROFS and the list of accident sequences 

(9) Definitions of “Unlikely,” “Highly Unlikely,” and “Credible.” The regulation in 

10 CFR 70.65 requires that the applicant’s ISA Summary must define the terms 

“unlikely,” “highly unlikely,” and “credible.” The applicant’s definitions of these terms are 

acceptable if, when used with the applicant’s method of assessing likelihoods, they 

provide reasonable assurance that the performance requirements of 10 CFR 70.61 can 

be met. The applicant’s method of likelihood evaluation and the definitions of the 

likelihood terms are closely related. Qualitative methods require qualitative definitions. 

Such a qualitative definition would identify the qualities of IROFS controlling an accident 

sequence that would qualify that sequence as “unlikely” or “highly unlikely.” 

An applicant may use quantitative methods and definitions for evaluating compliance 

with 10 CFR 70.61, but nothing in this SRP should be construed as an interpretation that 

such methods are required. The reviewer should focus on objective qualities and 

information provided concerning accident likelihoods. 

As stated in 10 CFR 70.61, credible high-consequence events must be “highly unlikely.” 

Thus, the meaning of the phrase “highly unlikely” is on a per-event basis. The same is 

true for the terms “unlikely” and “credible.” Hence, applicant definitions should be on a 

per-event basis. The events referred to are occurrences of consequences, which are 

synonymous with the phrase “accident sequence” in this context. This is important to 

recognize, since an ISA may identify hundreds of potential accident sequences. Thus, 

the likelihood of each individual sequence must be quite low. 

Acceptance Criteria for the Definition of “Credible” 

The regulation in 10 CFR 70.65 requires that the applicant define the term “credible.” 

This term is used in 10 CFR 70.61, which requires that all credible accident sequences 

for which the consequences could exceed the performance requirements of 

10 CFR 70.61 must be controlled to be unlikely or highly unlikely, as appropriate. If an 

event is not credible, IROFS are not required to prevent or mitigate the event. Thus, to 

be “not credible” could be used as a criterion for exemption from use of IROFS. This 

raises a danger of circular reasoning. In the safety program embodied in Subpart H to 

10 CFR Part 70, the “not credible” nature of an event must not depend on any facility 

feature that could credibly fail to function or be rendered ineffective as a result of a 

change to the system. Each facility feature that is needed to ensure that accident events 

are sufficiently unlikely is an IROFS. Management measures must offer high assurance, 

that such features are not removed or rendered ineffective during system changes. One 
June 2015 3-28 NUREG-1520, Revision 2 

cannot claim that a process does not need IROFS because it is “not credible” due to 

characteristics provided by some other controls or features of the plant that are not 

IROFS. Such an evaluation would be inconsistent with 10 CFR 70.61. However, 

although an accident sequence may not meet a definition of “not credible,” it may meet 

the standards for “highly unlikely” or “unlikely” because of an infrequent external initiating 

event, without the use of IROFS. In such a case, IROFS are not necessary, but 

information is needed to show that the event does qualify as “highly unlikely” or 

“unlikely.” 

Any one of the following three independent acceptable sets of qualities could define an 

event as not credible: 

(1) An external event has a frequency of occurrence that can conservatively be 

estimated as less than once in a million years. 

(2) A process deviation consists of a sequence of many unlikely events or errors for 

which there is no reason or motive. In determining that there is no reason for 

such errors, a wide range of possible motives, short of intent to cause harm, 

must be considered. Complete ignorance of safe procedures is possible for 

untrained personnel, which should be considered a credible possibility. 

Obviously, no sequence of events should be categorized as not credible if it has 

actually occurred in any fuel cycle facility. 

(3) A convincing argument exists that, given physical laws, process deviations are 

not possible, or are extremely unlikely. The validity of the argument must not 

depend on any feature of the design or materials controlled by the facility’s 

system of IROFS or management measures. 

Such a demonstration of “not credible” must be convincing despite the absence of 

designated IROFS. Typically, this can be achieved only for external events known to be 

extremely unlikely. 

Acceptance Criteria for Qualitative Definitions of Likelihood 

If the applicant’s definitions are qualitative, they are acceptable if they meet all of the 

following criteria: 

 They are reasonably clear and based on objective criteria. 

 They can reasonably be expected to consistently distinguish accidents that are 

“highly unlikely” from those that are merely “unlikely.” 

 Their categorization of events as “highly unlikely” or “unlikely” yields results 

reasonably consistent with quantitative information and quantitative criteria such 

as those given in the example here. 

The phrase “objective criteria” means the extent to which the method relies on specific 

identifiable characteristics of a process design, rather than subjective judgments of 
June 2015 3-29 NUREG-1520, Revision 2 

adequacy. Objective criteria are needed to achieve consistency. “Consistency” means 

the degree to which different analysts obtain the same results when they apply the 

method. This is important in maintaining an adequate standard of safety because the 

ISAs of future facility modifications may be performed by individuals not involved in 

conducting the initial ISA. An acceptable qualitative method of likelihood evaluation 

should yield results comparable to the examples of evaluation methods given in the 

appendices to this chapter. 

Reliability and Availability Qualities 

Qualitative methods of evaluating the likelihood of an accident sequence involve 

identifying the reliability and availability qualities of each of the events that constitute the 

sequence. The following lists of qualities are not necessarily complete, but they do 

contain many of the factors most commonly encountered. Some of these qualities relate 

to the characteristics of individual IROFS, such as the following examples: 

 safety margin in the controlled parameter, compared with process variation and 

uncertainty 

 whether the IROFS is an active engineered control, a passive engineered 

control, an administrative control, or an enhanced administrative control 

 the type and safety grading, if any, of management measures applied to the 

control 

 fail-safe, self-announcing, or surveillance measures to limit downtime 

 failure modes 

 demand rate 

 failure rate 

Other reliability qualities relate to characteristics of the IROFS or system of IROFS that 

protect against the following accident sequences as a whole, among others: 

 

 defense in depth 

 degree of redundancy 

 degree of independence 

 diversity 

 vulnerability to common-cause failure 

Methods of likelihood evaluation and definitions of the likelihood terms “unlikely” and 

“highly unlikely” may mix qualitative and quantitative information. Certain types of 
June 2015 3-30 NUREG-1520, Revision 2 

objective quantitative information may be available concerning specific processes in a 

facility. Examples of such objective quantitative information include the following: 

 reports of failure modes of equipment or violations of procedures recorded in 

maintenance records or corrective action programs 

 the time intervals at which surveillance is conducted to detect failed conditions 

 the time intervals at which functional tests or configuration audits are held 

 for a fail-safe, monitored, or self-announcing IROFS, the time it takes to render 

the system safe 

 demand rates (i.e., the frequency of the demands on an IROFS to perform) 

(some situations amount to effectively continuous demand) 

Such items of quantitative information should be considered in evaluating the likelihood 

of accident sequences, even in purely qualitative evaluations. For example, knowing the 

value to which downtime is limited by surveillance can indicate that a system’s 

availability is extremely high. For redundant systems, such high availability can virtually 

preclude concurrent independent failures of multiple IROFS. 

Acceptance Criteria for Likelihood Indexing Methods 

One acceptable definition for the likelihood terms “unlikely” and “highly unlikely” could be 

based on a risk-indexing method. The example in Appendix A to this chapter shows the 

use of such a method, which primarily relies on a qualitative evaluation of reliability and 

availability factors. In such methods, qualitative characteristics of the system of IROFS, 

such as those listed above, are used to estimate a quantitative likelihood index for each 

accident sequence. Then, the definitions of “highly unlikely” and “unlikely” would be 

acceptable limiting values of this likelihood index. For example, “highly unlikely” could 

be defined as “having a risk index value less than or equal to minus 5,” and “unlikely” 

could be defined as “having a risk index value less than or equal to minus 4.” 

Acceptance Criteria for Purely Qualitative Methods 

A purely qualitative method of defining “unlikely” and “highly unlikely” is acceptable if it 

incorporates all of the applicable reliability and availability qualities to an appropriate 

degree. For example, one statement of applicable qualities is double-contingency 

protection, the quality of a process design that incorporates sufficient factors of safety to 

require at least two unlikely, independent, and concurrent changes in process conditions 

before a criticality accident is possible. 

Double contingency explicitly addresses several reliability and availability qualities: 

 factors of safety: safety margins 

 at least two: redundancy 
June 2015 3-31 NUREG-1520, Revision 2 

 unlikely: low failure rate, low downtime of one of two controls 

 concurrent: low downtime 

 independent: independence 

 process conditions: physical events, not virtual human errors 

One acceptable definition of “highly unlikely” is a system of IROFS that possesses 

double-contingency protection, where each of the applicable qualities is present to an 

appropriate degree. For example, as implied by the modifier “at least” in the phrase “at 

least two unlikely, independent and concurrent changes,” sometimes more than two-fold 

redundancy may be appropriate. 

A qualitative method may also be proposed for defining “unlikely.” Such a qualitative 

method might simply list various combinations of reliability qualities for a system of 

IROFS that would qualify as “unlikely.” For example, a single high-reliability IROFS, 

such as an engineered hardware control with a high grade of applicable management 

measures, might qualify to be considered “unlikely to fail.” Systems relying on 

administrative controls would normally have to use enhancing qualities, such as large 

safety margins and redundancy, to qualify as “unlikely to fail.” A single simple 

administrative control, regularly challenged, and without any special safety margin or 

enhancement, where a single simple error would lead to an accident, would not qualify 

as “unlikely to fail.” Likewise, two simple administrative controls without special margins 

or enhancements, particularly of their independence, would not normally qualify as 

“highly unlikely to fail.” 

Acceptance Criteria for Quantitative Definitions of Likelihood 

An applicant may choose to provide quantitative definitions of the terms “unlikely” and 

“highly unlikely.” One example of acceptable quantitative guidelines is given in the next 

paragraph. These guidelines serve two purposes. Specifically, these guidelines can be 

used as acceptance criteria for quantitative definitions of “highly unlikely” and “unlikely,” 

if provided by an applicant. 

Quantitative Guidelines 

A discussion of quantitative guidelines here does not imply that quantitative 

demonstration of compliance with 10 CFR 70.61 is required. The NRC has provided 

various guidance documents, including a strategic plan pertinent to ensuring that 

exposures of individuals to NRC-regulated hazards, such as radiation, are acceptably 

infrequent. For example, the NRC Strategic Plan has a performance goal of “no 

inadvertent nuclear criticalities.” The quantitative guidelines given below for definitions 

of “highly unlikely” and “unlikely”, as used in 10 CFR 70.61, were developed so as to be 

reasonably consistent with other relevant NRC guidance. 

 
June 2015 3-32 NUREG-1520, Revision 2 

Highly Unlikely 

Among other considerations, the guideline for acceptance of the definition of “highly 

unlikely” considers the highest acceptable frequency that is consistent with the 

performance goal of having no inadvertent nuclear criticality accidents. This guideline is 

thus applied in considering the 10 CFR 70.61 requirement that high-consequence events 

be highly unlikely, because such events may involve high radiation doses, as is often 

true for criticality accidents. To within an order of magnitude, this is taken to mean a 

definition that translates to a frequency limit of less than one such accident in the 

industry every 100 years. This results in a guideline limiting the frequency of any 

individual accident to 10-5 per event, per year. As the goal is to have no such accidents, 

the expectation is that most accidents would have frequencies substantially below this 

guideline when feasible. 

Unlikely 

Intermediate-consequence events include significant radiation exposures to workers 

(those exceeding 0.25 Sv or 25 rem). The NRC has a strategic goal that there be no 

increase in the rate of such significant exposures. This guideline has been interpreted 

here to correspond to a range between 10-4 and 10-5 per event, per year. 

Quantitative Guidelines for Use with Acceptance Criteria 

The applicant’s quantitative definitions of the terms “unlikely” and “highly unlikely,” as 

applied to individual accident sequences identified in the ISA, are acceptable to show 

compliance with 10 CFR 70.61 if they are reasonably consistent with the following 

quantitative guidelines: 

Likelihood Term of 10 CFR 70.61 Guideline 

Unlikely Less than 10-4 per event, per year 

Highly Unlikely Less than 10-5 per event, per year 

The stated quantitative guidelines are used to define the largest likelihood values that 

would be acceptable limits. Definitions based on lower limits are also acceptable. Note 

that the word “unlikely” as it appears in 10 CFR 70.61(c) does not have the same 

meaning as it does in the definition of double contingency. (See Chapter 5 of this SRP.) 

3.5 Review Procedures 

Organization of the reviews addressed by this chapter of the SRP will differ depending on the 

scope of the documents submitted. For a license application, renewal, or amendment 

application containing a new or revised chapter addressing the applicant’s safety program and 

ISA commitments, there may be only a primary ISA reviewer. However, for an initial ISA 

Summary submittal, specialists in the various safety disciplines and management measures will 

assist the primary ISA reviewer. An ISA Summary update submitted as part of an amendment 

for a process that has hazards in multiple disciplines would also require a team approach. In 

general, a primary ISA reviewer will evaluate generic methods, risk, and reliability criteria used 
June 2015 3-33 NUREG-1520, Revision 2 

in the ISA and generic information about individual processes. Assisting this primary reviewer 

will be secondary reviewers, who will evaluate selected individual accidents and advise on the 

completeness of the accident list for specific safety disciplines. 

3.5.1 Acceptance Review 

During the acceptance review of a license application, the reviewer should examine the 

submittals to identify major deficiencies in the information provided for each area of review 

specified in SRP Section 3.3. Reviewers must decide whether they have enough information to 

proceed with a detailed review. Less significant errors or deficiencies that can be addressed in 

a request for additional information should be accepted. However, before the NRC performs a 

detailed review, the applicant should correct major deficiencies that would require several 

requests for additional information to resolve. 

Reviewers should record whether each area of review is adequately addressed in the 

application, is adequately addressed in a referenced document, is not applicable to the 

application, or has a major deficiency. 

For an ISA Summary, the primary ISA reviewer will also conduct an acceptance review to 

determine whether the document submitted contains sufficient information addressing the areas 

of review noted in Section 3.3.2, including specifically each of the elements required by 

10 CFR 70.65(b), to permit an evaluation of safety for compliance with the regulations. If 

sufficient information is not present, the ISA Summary will not be accepted for review. 

3.5.2 Safety Evaluation 

The primary reviewer will perform a safety evaluation with respect to the acceptance criteria in 

Section 3.4. During the initial review, the reviewer should draft the safety evaluation report 

(SER) described below. A request for additional information (RAI) will be prepared when 

clarification and additional information are needed to determine if the licensee’s submittals 

comply with the regulations. The primary reviewer should coordinate with the licensing project 

manager in preparing RAIs. Additional information submitted by the applicant will be evaluated 

and a final SER will be provided to the licensing project manager.

3.5.2.1 Evaluation of Safety Program and Integrated Safety Analysis Commitments 

The reviewer examines the descriptions and commitments to program elements in the 

application or other documents for the areas of review described in Section 3.3.1 to ascertain 

whether the program elements are sufficient to meet the acceptance criteria of Section 3.4.3.1. 

The ISA reviewer must coordinate his or her review with reviews being conducted under other 

chapters of this SRP. 

3.5.2.2 Evaluation of ISA Summary 

A team consisting of a primary reviewer together with specialists in each category of accidents 

would normally perform an evaluation of the ISA Summary to determine if it meets the 

acceptance criteria of Section 3.4.3.2. These categories of accidents depend on the facility, but 

in general, they are nuclear criticality, fires, chemical accidents, and radiological accidents. If 

external event analysis is complex, specialists may be employed to review these separately, as 

well. The primary ISA reviewer would normally evaluate the acceptability of the generic 
June 2015 3-34 NUREG-1520, Revision 2 

elements of the ISA Summary as described in 10 CFR 70.65, such as site and facility 

descriptions, ISA methods, criteria, and consequence and likelihood definitions. However, each 

specialist should also review these elements to obtain information in support of his or her own 

evaluations. 

In contrast to these generic ISA elements, process-specific information is needed by, and must 

be acceptable to, all of the specialists. Thus, all team members should evaluate the process 

descriptions in the ISA Summary. 

Separate specialists for each category of accidents (i.e., nuclear criticalities, fires, radiological 

releases, and chemical accidents) should undertake the reviews of accident sequence 

descriptions and the likelihood and consequence information showing compliance with 

10 CFR 70.61. As indicated in Appendix A to this chapter, one acceptable format for the ISA 

Summary is to separately tabulate or give logic diagrams for accident sequences in each 

accident category. 

After a preliminary team review of the ISA Summary, the team should visit the facility to become 

familiar with the three-dimensional geometry of process equipment, to review components of the 

ISA, and to address any issues that arose during review of the ISA Summary. 

To select a subset of the accident sequences reported in the ISA Summary for more detailed 

review, the reviewer should look at the applicant’s tabulation of high- and intermediateconsequence accident sequences and the types of IROFS designated for each. 

High-consequence accident sequences protected by administrative controls should be 

examined very carefully, whereas intermediate consequence accident sequences protected by 

redundant passive engineered controls warrant less scrutiny. 

To select specific accident sequences and IROFS for more detailed evaluation, the reviewer 

should evaluate potential accidents using information supplied in the ISA Summary. The 

applicant’s method for identifying and establishing the consequences and likelihood of an 

accident sequence may provide information sufficient for this purpose. The NRC reviewer may 

evaluate the accidents using qualitative screening criteria analogous to those in Table A-6 in 

Appendix A to this chapter. Other, more rigorous reliability or consequence analyses may be 

performed as deemed necessary. On the basis of this analysis, accidents will be categorized. 

The reviewer may elect to examine in greater detail the engineered and administrative controls 

for accidents in the category of highest consequences. While onsite, the reviewer should also 

select for specific evaluation a small sample of accident sequences determined by the applicant 

either to result in less than intermediate consequences or to be not credible. 

From the list of the IROFS, the reviewer should categorize IROFS so that similar items are 

grouped together. The reviewer should then ensure that he or she has fully understood one or 

more prototype IROFS selected from each category. For these selected prototypes, the 

reviewer may, if necessary, request additional information needed to completely understand a 

particular IROFS. For complex processes, the reviewer may need to visit the facility to reach an 

adequate understanding of how the IROFS work for the process. 

3.5.2.3 Onsite Integrated Safety Analysis Review 

The reviewer should plan on visiting the applicant’s facility at least once as part of the 

application review process. This visit should be scheduled after the applicant’s ISA Summary 
June 2015 3-35 NUREG-1520, Revision 2 

has received a preliminary review. The visits will enable the reviewer to confirm through 

detailed examination of the ISA and ISA documentation that the ISA methods were selected and 

applied in a reasonable and thorough manner to all facility processes, that all credible high- and 

intermediate-consequence accident sequences were correctly identified, that accident sequence 

consequences and likelihoods were reasonably determined, and that appropriate IROFS and 

supporting management measures have been proposed. By means of a “horizontal” review and 

several “vertical” slice reviews (defined below) of processes selected by the reviewer, the NRC 

staff can establish the completeness and adequacy of the applicant’s ISA method. The 

reviewer may use the ISA documentation to perform independent evaluations of process 

hazards and accident sequences using methods selected from NUREG-1513, Appendix A to 

this SRP chapter, or other NRC guidance. 

The reviewer should not attempt a comprehensive, all-encompassing review of every facility 

process and every accident sequence on the site visit. Rather, the reviewer should use the site 

visit to confirm the appropriateness and adequacy of the applicant’s ISA method and the 

completeness of the ISA and accuracy of analysis of accident sequences by means of a 

horizontal review and several vertical slice reviews of selected processes. The site visit will also 

afford the reviewer an opportunity to seek answers to questions from the applicant (or possibly 

the ISA team) that may have arisen in the preliminary review of the ISA Summary. 

The following discusses each of the three facets of the onsite ISA review: 

(1) ISA Methods Review 

The purpose of the ISA methods review is two-fold: (a) to ensure that the applicant 

selected appropriate ISA methods for each facility process and (b) to ensure that the 

methods were correctly applied in conducting the ISA. The ISA Summary should 

describe the ISA methods and give a few examples of the application of the ISA 

methods. The ISA methods review should answer any questions that a reviewer may 

have concerning ISA methods and procedures after completion of the preliminary review 

of the ISA Summary. In reviewing process-specific information in the ISA Summary and 

ISA documentation maintained on site, the reviewer should select a few processes and 

accident sequences to examine the adequacy of the selected ISA methods and their 

application. The reviewer should examine any procedures, checklists, or guidance 

documents that the applicant may have onsite as guidance to ISA team members to 

ensure a complete understanding of the applicant’s ISA methods. The reviewer should 

then examine the ISA documentation, including the selected processes and accident 

sequences, showing how the ISA methods were applied as part of the horizontal and 

vertical slice reviews discussed below. 

(2) Horizontal Review 

The basic purpose of the horizontal review is to ensure completeness of the ISA of 

facility processes. This does not require an absolute checkoff of ISA documentation 

against the full list of processes to be covered, but it does mean that a substantial 

fraction of the processes should receive a brief examination. 

The reviewer should consult the ISA and ISA documentation to answer questions or to 

resolve outstanding issues resulting from the preliminary review of the ISA summary. In 

particular, the reviewer should examine safety information that is not included in the 
June 2015 3-36 NUREG-1520, Revision 2 

ISA summary. For example, ISA documentation related to hardware IROFS, such as 

system schematics and/or descriptive lists, should contain sufficient detail about 

hardware IROFS so that it is clear to the reviewer what components (such as cables, 

detectors, alarms, valves, and piping) are included within the boundary of the hardware 

IROFS system and would therefore be subject to management measures specified by 

the applicant. In addition, such documentation should also identify support systems 

(such as backup batteries, air supply, and steam supply) on which the IROFS depends 

to perform its intended function. The reviewer should also examine a few processes to 

confirm that all accident sequences were considered and that the ISA summary includes 

those having potential consequences exceeding the performance requirements of 

10 CFR 70.61. 

(3) Vertical Slice Review 

The purpose of the vertical slice review is to examine the application of the ISA methods 

to a selected subset of facility processes. For this subset of facility processes, the 

reviewer should examine the underpinnings of calculations, conclusions, and the design 

of safety programs that result from the ISA, as well as safety information that is not 

identified in the ISA summary. The reviewer should examine accident sequences for 

this subset of processes to determine the adequacy of the applicant’s consequence and 

likelihood determinations. In addition, the reviewer should examine the appropriateness 

and robustness of designated IROFS and the suitability of proposed management 

measures. 

The ISA Summary will have categorized accidents according to their consequences, 

likelihoods, and IROFS. The reviewer should select a subset of processes for vertical 

slice review of these categories. The subset should include accident sequences with 

relatively high levels of consequence and likelihood and accident sequences for which 

IROFS of different types and relatively low robustness are designated. For ISAs where 

the index method of Appendix A is used, and where the index scoring for all accident 

sequences is readily available to the reviewer, in principle, these index scores could be 

used to establish sequences of relatively higher risk. However, if the ISA declares as 

IROFS only a set of controls that are minimally necessary to demonstrate compliance 

with 10 CFR 70.61 likelihood requirements, then such index scores would be misleading. 

Instead, in selecting processes or sequences for the vertical slice reviews, one may 

need to use other objective qualities of the processes. For example, the selection might 

be based on experience or potential consequences as in (1) criticality accidents in 

solution systems, solvent extraction process upsets, or using plutonium or high-enriched 

uranium or (2) chemical processes involving large quantities of toxic chemicals that are 

highly reactive, flammable, or volatile, or are exceptionally toxic. Vertical slice reviews 

should examine processes for which less robust IROFS are designated (e.g., those with 

greater reliance on administrative rather than engineered controls). Again, if only a 

minimal set of IROFS is declared, it may be supported by more robust controls that are 

not IROFS and hence are not documented in the ISA Summary. Still, a review of sets of 

IROFS that are purely administrative, or are otherwise known from experience to be 

unreliable, may be advisable. 

While on site, the reviewer may confirm the adequacy of sample accident analyses that 

the applicant included in the ISA Summary. However, the reviewer should focus on 
June 2015 3-37 NUREG-1520, Revision 2 

processes and/or accident sequences that were not included as sample accident 

analyses in the ISA Summary to ensure the completeness of the ISA. 

The vertical slice review should address any specific questions the reviewer may have 

related to the ISA methods. If the applicant’s methods are evaluated as effective in 

these selected cases, there is greater assurance that they will be effective for other 

processes. If questions or weaknesses are discovered that may be generic, the 

reviewer may have to perform vertical slice analyses on several additional processes. 

However, a specific question on the ISA of one process may not imply that there is a 

generic question requiring further examination. The purpose of the vertical slice reviews 

is not complete verification of ISA implementation. 

The total number of vertical slice reviews to be conducted will depend on the facility’s 

total number of accident sequences for which the consequences could exceed the 

performance requirements of 10 CFR 70.61, the diversity of the types of processes and 

types of IROFS at the facility, and the results of initial reviews of the ISA Summary and 

the horizontal and vertical slice reviews. For most fuel fabrication facilities, the reviewer 

should plan on conducting vertical slice reviews for 5 to 10 processes significant to 

nuclear criticality safety, 1 to 3 fire-significant processes, and 1 to 3 

chemical/radiological/environmental-significant processes. However, if the initial reviews 

of the ISA Summary and the horizontal and vertical slice reviews identify significant 

issues, then additional vertical slice reviews may be warranted. Ultimately, to approve 

the ISA and ISA program, the reviewer must attain reasonable assurance that the 

applicant has implemented them in compliance with the regulations. 

Each vertical slice review should include (1) familiarization of the reviewer with the safety 

design of the selected process and (2) examination of all onsite documentation related to 

the ISA of that process. If the content of the documentation leaves certain issues 

unclear, interviews with facility personnel may be necessary. The review should focus 

on the onsite information that is not provided in the ISA Summary but is key to 

determining compliance with 10 CFR 70.61 requirements. 

Following the horizontal and vertical slice reviews, if outstanding questions remain about 

compliance with the performance requirements of 10 CFR 70.61, the reviewer may conduct an 

independent evaluation using appropriate methods selected from NUREG-1513, Appendix A to 

this chapter, or other agency guidance. The purpose of such an independent review is to 

identify strengths and weaknesses in the applicant’s ISA methods or implementation practices, 

not simply to check compliance in this one case. 

The reviewer should take care to document findings and evaluations made during this process. 

3.6 Evaluation Findings 

The regulations in 10 CFR 70.23, “Requirements for the Approval of Applications,” and 

10 CFR 70.66, “Additional Requirements for Approval of License Application,” state that an 

application for a license will be approved if the Commission can make the general findings listed 

in those sections. The basis for the general findings is an evaluation of whether the application 

adequately addresses all of the applicable regulatory requirements. More specifically, the staff’s 

evaluation should determine whether the licensing submittals provide sufficient information to 
June 2015 3-38 NUREG-1520, Revision 2 

satisfy the regulatory requirements listed in Section 3.4.1 of this SRP and whether the applicant 

has appropriately addressed the regulatory acceptance criteria in SRP Section 3.4.3. On the 

basis of this information, the reviewers should write material for inclusion in the SER. In 

general, the review findings should state that the requirements of 10 CFR 70.64 for a new 

facility, 10 CFR 70.65 for content, and 10 CFR 70.66 have been met, and provide the basis for 

each finding. A finding statement should follow the evaluation of each specific area of review, 

stating how and why the information submitted in that area complies with the related regulatory 

requirement, if it does so. The SER should state how the applicable regulatory requirements 

have been met based on the acceptance criteria described in this chapter of the SRP. If the 

applicant chooses to use an alternative approach, the reviewer should discuss in the SER 

whether the proposed approach satisfies the applicable regulatory requirements. The reviewers 

should use the following approach to document their evaluation findings: 

5. State a specific regulatory requirement that applies to the finding. Detailed acceptance 

criteria may be included where appropriate or necessary to clarify the requirement. 

6. Identify the areas where the regulatory requirement is addressed in the application, 

including the areas where the specific acceptance criteria described in this SRP are 

addressed. 

7. Describe your evaluation of the application, the basis for your conclusion, and whether 

regulatory requirements are met. 

8. Repeat these steps for every regulatory requirement that applies to the application. 

There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

application or amendment request, (2) denial of the application or request, or (3) approval with 

conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

reviewer may consider proposing a license condition. Absent an NRC order, license conditions 

must be agreed upon with the licensee or applicant before becoming part of the license. 

A license condition should only be proposed if there is reasonable assurance that, if the 

licensee meets the condition, all regulatory requirements will be satisfied. Thus, license 

conditions should not be used to cover major deficiencies in an application. License conditions 

should be unambiguous, inspectable, and enforceable. They should only require those actions 

necessary to ensure compliance with applicable regulations. The basis for license conditions 

must be documented in the SER. 

If the submittal is acceptable, the final SER input should conclude with statements similar to the 

following: 

 general conclusion resulting from the reviewer’s evaluation of safety program 

commitments: 

The NRC staff concludes that the applicant’s safety program, if 

established and maintained pursuant to 10 CFR 70.62, is adequate to 

provide reasonable assurance that IROFS will be available and reliable to 

perform their intended safety function when needed and in the context of 

the performance requirements of 10 CFR 70.61. 
June 2015 3-39 NUREG-1520, Revision 2 

General findings for each of the areas of review should state how the applicant’s information 

demonstrates compliance with the acceptance criteria of Section 3.4.3.1. If the reviewer finds 

that the acceptance criteria are not met and the applicant is not in compliance with the 

regulations, then the situation must be rectified before approval can be given. If the applicant 

has submitted an adequate explanation of an alternative way of complying with the regulations, 

the NRC’s safety evaluation report should contain a finding that the alternative is acceptable to 

meet the basic regulatory requirement addressed. 

 general conclusions resulting from the staff’s evaluation of an ISA Summary: 

Many hazards and potential accidents can result in unintended exposure of persons to 

radiation, radioactive materials, or toxic chemicals incident to the processing of licensed 

materials. The NRC staff finds that the applicant has performed an ISA to identify and 

evaluate those hazards and potential accidents as required by the regulations. The 

NRC staff has reviewed the ISA Summary and other information and finds that it 

provides reasonable assurance that the applicant has identified IROFS and established 

engineered and administrative controls to ensure compliance with the performance 

requirements of 10 CFR 70.61. Specifically, the NRC staff finds that the ISA results, as 

documented in the ISA Summary, provide reasonable assurance that the IROFS, the 

management measures, and the applicant’s programmatic commitments will, if properly 

implemented, make all credible intermediate-consequence accidents unlikely, and all 

credible high-consequence accidents highly unlikely. 

Findings should be made concerning any specific requirement in 10 CFR Part 70 that 

addresses the nine elements in the ISA Summary. In particular, these findings should include 

statements concerning compliance with the requirements of 10 CFR 70.64 (regarding new 

facilities and new processes at existing facilities). 

The review should result in findings concerning the compliance of specific processes with the 

requirements of 10 CFR 70.61, or other parts of the regulation, for those processes that receive 

specific detailed review. However, such findings should be limited to a finding of reasonable 

assurance that a process having the IROFS described in the ISA Summary is capable of 

meeting the requirements if properly implemented, operated, and maintained. 

3.7 References 

U.S. Code of Federal Regulations, “Domestic Licensing of Special Nuclear Material,” Part 70, 

Chapter I, Title 10, “Energy.” 

U.S. Code of Federal Regulations, “Air Contaminants,” Section 1910.100, Chapter XVII, 

Title 29, “Labor.” 

U.S. Code of Federal Regulations, “Table of Toxic Endpoints,” Appendix A to “Chemical 

Accident Prevention Provisions,” Part 68, Chapter I, Title 40, “Protection of Environment.” 

American Institute of Chemical Engineers, “Guidelines for Hazard Evaluation Procedures, 

Second Edition with Worked Examples,” New York, NY, September 1992. 
June 2015 3-40 NUREG-1520, Revision 2 

American National Standards Institute/American Nuclear Society, “Nuclear Criticality Safety in 

Operations with Fissionable Materials Outside Reactors,” ANSI/ANS-8.1-1983, La Grange Park, 

IL, 1983. 

U.S. Department of Commerce, Bureau of the Census, “Statistical Abstract of the 

United States,” Table No. 688, Washington, DC, 1995. 

U.S. Nuclear Regulatory Commission, “Integrated Safety Analysis Guidance Document,” 

NUREG-1513, May 2001. 

U.S. Nuclear Regulatory Commission, “Chemical Process Safety at Fuel Cycle Facilities,” 

NUREG-1601, August 1997. 

U.S. Nuclear Regulatory Commission, “Nuclear Fuel Cycle Facility Accident Analysis 

Handbook,” NUREG/CR-6410, March 1998. 
June 2015 3-A-1 NUREG-1520, Revision 2 

APPENDIX A 

EXAMPLE PROCEDURE FOR ACCIDENT SEQUENCE EVALUATION

This appendix provides the U.S. Nuclear Regulatory Commission (NRC) reviewer with an 

example of one method of evaluating accident sequences for compliance with the likelihood 

requirements of Title 10 of the Code of Federal Regulations (10 CFR) 70.61, “Performance 

Requirements.” It employs a semiquantitative risk index method for categorizing accident 

sequences in terms of their likelihood of occurrence and their consequences of concern. The 

risk index method framework will enable the applicant to identify, and the NRC reviewer to 

confirm, which accident sequences have consequences that exceed the performance 

requirements of 10 CFR 70.61 and, therefore, require designation of items relied on for safety 

(IROFS) and supporting management measures. The integrated safety analysis (ISA) summary 

should include descriptions of these general types of higher consequence accident sequences. 

This appendix presents an example of how the risk index method can be applied to a uranium 

powder blender. It describes one method of evaluating compliance with the consequence and 

likelihood performance requirements of 10 CFR 70.61. The method is intended to permit any 

available quantitative information to be considered. For consistency, the NRC reviewer’s 

approach could also include assigning quantitative values to any qualitative likelihood 

assessments made by an applicant, since likelihoods are inherently quantitative. This method 

should not be interpreted as a requirement that an applicant use quantitative evaluation. 

However, evaluation of a particular accident should be consistent with any facts available, which 

may include quantitative information concerning the availability and reliability of IROFS involved. 

This appendix is not a “format and content guide” for either the ISA or the ISA summary. It 

simply presents one method of analysis and categorization of credible accident sequences for 

facility processes. The method described in this appendix uses both qualitative and quantitative 

criteria for evaluating frequency indices of safety controls. These criteria for assigning indices, 

particularly the descriptive criteria provided in some tables of this appendix, are intended to be 

examples, not universal criteria. It is preferable that each applicant develop such criteria based 

on particular types of IROFS and management measure programs. The applicant should 

modify and improve such criteria as insights are gained during performance of the ISA. 

If the applicant evaluates accidents using a different method, the method should produce similar 

results in terms of how accidents are categorized. The method should be regarded as a 

screening method, not as a definitive method of proving the adequacy or inadequacy of the 

IROFS for any particular accident. Because methods can rarely be universally valid, an 

evaluation using other methods may be justified for individual accidents for which this method 

does not appear applicable. The method does have the benefit that it evaluates, in a consistent 

manner, the characteristics of IROFS used to limit accident sequences. This will permit 

identification of accident sequences with defects in the combination of IROFS used. Such 

IROFS can then be further evaluated or improved to establish adequacy. The procedure also 

ensures the consistent evaluation of similar IROFS by different ISA teams. Sequences or 

IROFS that are risk significant and are evaluated as marginally acceptable are good candidates 

for more detailed evaluation by the applicant and the reviewer. 

For each sequence, the tabular accident summary resulting from the ISA should identify the 

engineered or administrative IROFS that must fail to allow the occurrence of consequences that 

exceed the levels identified in 10 CFR 70.61. Chapter 3 of this Standard Review Plan (SRP) 
June 2015 3-A-2 NUREG-1520, Revision 2 

specifies acceptance criteria for these IROFS and for meeting the performance requirements of 

10 CFR 70.61. These criteria require that IROFS be sufficiently unlikely to fail. However, the 

acceptance criteria do not explicitly mandate any particular method for assessing likelihood. 

The purpose of this appendix is to provide an example of an acceptable method to perform this 

evaluation of likelihood. 

A.1 Risk Matrix Development

Consequences 

The regulation in 10 CFR 70.61 specifies two categories for accident sequence consequences: 

“high consequences” and “intermediate consequences.” Implicitly, there is a third category for 

accidents that produce consequences less than “intermediate.” This category will be referred to 

as “low-consequence” accident sequences. The primary purpose of process hazard analysis 

(PHA) is to identify all uncontrolled and unmitigated accident sequences. These accident 

sequences can then be categorized into one of these three consequence categories (high, 

intermediate, or low) based on their predicted radiological, chemical, and/or environmental 

impacts. Although the subsequent ISA analysis focuses only on those accident sequences 

having high or intermediate consequences, by examining low-consequence events identified 

and tabulated in the ISA, the reviewer can evaluate the completeness of the PHA and ISA 

analyses. Table A-1 presents the radiological and chemical consequence severity limits of 

10 CFR 70.61 for each of the three accident consequence categories.

Table A-1 Consequence Severity Categories Based on 10 CFR 70.61 

Workers Offsite Public Environment

Category 3 

High 

Consequence 

*RD > 1 sievert (Sv) 

(100 rem)

**CD = endanger life 

RD > 0.25 Sv (25 rem)

30 milligrams (mg) sol 

U intake 

CD = long-lasting 

health effects 

Category 2 

Intermediate 

Consequence 

0.25 Sv (25 rem) 

< RD ≤ 1 Sv (100 rem)

CD = long-lasting

health effects 

0.05 Sv (5 rem) 

< RD ≤ 0.25 Sv 

(25 rem) 

CD = mild transient

health effects 

Radioactive release 

> 5,000 x Table 2 of 

10 CFR Part 20, 

Appendix B 

Category 1 

Low 

Consequence 

Accidents with lower 

radiological and 

chemical exposures 

than those above in 

this column 

Accidents with lower 

radiological and 

chemical exposures 

than those above in 

this column 

Radioactive releases 

producing lower 

effects than those 

referenced above in 

this column 

 * RD = Radiological Dose 

 ** CD = Chemical Dose 

 
June 2015 3-A-3 NUREG-1520, Revision 2 

Likelihood 

The regulation in 10 CFR 70.61 also specifies the permissible likelihood of occurrence of 

accident sequences of different consequences. High-consequence accident sequences must 

be “highly unlikely” and intermediate-consequence accident sequences must be “unlikely.” 

Implicitly, accidents in the low-consequence category can have a likelihood of occurrence less 

than “unlikely” or simply “not unlikely.” Table A-2 shows the likelihood of occurrence limits of 

10 CFR 70.61 for each of the three likelihood categories. 

Table A-2 Likelihood Categories Based on 10 CFR 70.61 

Qualitative Description

Likelihood Category 1 Consequence Category 3 accidents must be 

“highly unlikely.” 

Likelihood Category 2 Consequence Category 2 accidents must be 

“unlikely.” 

Likelihood Category 3 Consequence Category 1 accidents may be 

“not unlikely.” 

Risk Matrix 

The three categories of consequence and likelihood can be displayed as a 3x3 risk index matrix. 

By assigning a number to each category of consequence and likelihood, a qualitative risk index 

can be calculated for each combination of consequence and likelihood. The risk index equals 

the product of the integers assigned to the respective consequence and likelihood categories. 

Table A-3 illustrates the risk index matrix, along with computed risk index values. The shaded 

blocks identify accidents for which the consequences and likelihoods yield an unacceptable risk 

index and to which IROFS must be applied. 

Table A-3 Risk Matrix with Risk Index Values 

Severity of 

Consequences 

Likelihood of Occurrence 

Likelihood Category 1 

Highly Unlikely 

(1) 

Likelihood Category 2 

Unlikely 

(2) 

Likelihood Category 3 

Not Unlikely 

(3) 

Consequence 

Category 3 High 

 (3)

Acceptable Risk 

 

3 

Unacceptable Risk 

6 

Unacceptable Risk 

9 

Consequence 

Category 2 

Intermediate (2)

Acceptable Risk 

2 

Acceptable Risk 

4 

Unacceptable Risk 

6 

Consequence 

Category 1 Low (1)

Acceptable Risk 

1 

Acceptable Risk 

2 

Acceptable Risk 

3 
June 2015 3-A-4 NUREG-1520, Revision 2 

The risk indices can initially be used to examine whether the consequences of an uncontrolled 

and unmitigated accident sequence (i.e., without any IROFS) could exceed the performance 

requirements of 10 CFR 70.61. If the performance requirements could be exceeded, the 

applicant must designate IROFS to prevent the accident or to mitigate its consequences to an 

acceptable level. A risk index value less than or equal to 4 means that the accident sequence is 

acceptably protected against and/or mitigated. If the applicant provides this risk index in the ISA 

and ISA summary, the reviewer can quickly scan these data to confirm that each accident 

sequence meets the performance requirements of 10 CFR 70.61. 

If the risk index of an uncontrolled and unmitigated accident sequence exceeds 4, the likelihood 

of the accident must be reduced through designation of IROFS. In this risk index method, the 

likelihood index for the uncontrolled and unmitigated accident sequence is adjusted by 

subtracting a score corresponding to the type and number of IROFS that have been designated. 

Table A-4 lists the qualitative scores assigned to the four types of IROFS. 

Reviewers should note that the qualitative scores assigned in Table A-4 are for illustrative 

purposes only. IROFS meeting the criteria for a particular score in Table A-4 could have a wide 

range of availability or reliability. Such coarse criteria are useful for screening purposes, but 

when the total evaluated likelihood score for an accident sequence lies near the acceptance 

guideline value, a more careful evaluation should be done. Such evaluations should consider 

the management measures applied to all the reliability and availability qualities of the IROFS, or 

system of IROFS, protecting against the accident, as explained in the likelihood acceptance 

criteria of Section 3.4.3.2 of this SRP. 

Table A-4 Qualitative Categorization of IROFS 

Numeric 

Value 

Description of IROFS 

1 Protection by a single trained operator with adequate response time

(Administrative lROFS)

2 Protection by a single, active engineered IROFS, functionally tested on a

regular basis

(Active Engineered lROFS)

3 Protection by a single, passive engineered IROFS, functionally tested on a

regular basis, or by an active engineered IROFS with a trained operator for 

backup 

(Passive Engineered IROFS or Combined Engineered and Administrative 

IROFS)

4 Protection by two independent and redundant engineered IROFS, as

appropriate, functionally tested on a regular basis 

(Combination of Two Active or Passive Engineered IROFS)

To demonstrate compliance with the performance requirements of 10 CFR 70.61, the ISA 

should assign a consequence category to each identified accident sequence. The likelihood of 

occurrence of those accident sequences identified as high- or intermediate-consequence events 

must then be assigned to one of the three likelihood categories. To be acceptable, the 
June 2015 3-A-5 NUREG-1520, Revision 2 

controlled and/or mitigated accident consequences and likelihoods must have valid bases, and 

the applicant must include the bases for all general types of high- and intermediateconsequence accident sequences in the ISA summary. 

A.2 Consequence Category Assignment 

Categorization of an accident sequence as a high-consequence event or an intermediateconsequence event, or neither, is based on the estimated consequences of prototype accidents. 

Although accident consequences can be determined by actual calculations, calculations need 

not be performed for each individual accident sequence listed for a process. Accident 

consequences may also be estimated by comparison to similar events for which reasonably 

bounding conservative calculations have been made. Categorization also requires 

consideration of acute chemical exposures that an individual could receive from licensed 

material or hazardous chemicals incident to the processing of licensed material. The applicant 

must select appropriate acute chemical exposure data and relate these data to the performance 

requirements of 10 CFR 70.61(b)(4) and (c)(4). This appendix uses the Acute Exposure 

Guideline Level (AEGL) and Emergency Response Planning Guideline (ERPG). AEGL-3 and 

ERPG-3 exposure levels are life threatening. 

Consequence Category 3 (High Consequences) includes accidents resulting in any 

consequence specified in 10 CFR 70.61(b). These include (1) acute worker exposures of 

(a) radiation doses greater than 1 Sv (100 rem) total effective dose equivalent (TEDE), and 

(b) chemical exposures that could endanger life (above AEGL-3 or ERPG-3), and (2) acute 

exposures to members of the public outside the controlled area to (a) radiation doses greater 

than 0.25 Sv (25 rem) TEDE, (b) soluble uranium intakes greater than 30 mg, and (c) chemical 

exposures that could lead to irreversible or other serious long-lasting health effects (exceeding 

AEGL-2 or ERPG-2). An unshielded nuclear criticality would normally be considered a highconsequence event because of the potential for producing a high radiation dose to a worker. 

Consequence Category 2 (Intermediate Consequences) includes accidents resulting in any 

consequence specified in 10 CFR 70.61(c). These include (1) acute exposures of workers to 

(a) radiation doses between 0.25 Sv (25 rem) and 1 Sv (100 rem) TEDE, and (b) chemical 

exposures that could lead to irreversible or other serious long-lasting health effects above 

AEGL-2 or ERPG-2), and (2) acute exposures of members of the public outside the controlled 

area to (a) radiation doses between 0.05 Sv (5 rem) and 0.25 Sv (25 rem) TEDE, (b) chemical 

exposures that could cause mild transient health effects (exceeding AEGL-1 or ERPG-1), and 

(3) release of radioactive material outside the restricted area that would, if averaged over a 

24-hour period, exceed 5,000 times the values specified in Table 2 of Appendix B, “Annual 

Limits on Intake (ALIs) and Derived Air Concentrations (DACs) of Radionuclides for 

Occupational Exposure; Effluent Concentrations; Concentrations for Release to Sewerage,” to 

10 CFR Part 20, “Standards for Protection against Radiation.” 

Consequence Category 1 (Low Consequences) includes accidents with potential adverse 

radiological or chemical consequences but at exposures less than Categories 3 and 2. 

Table A-5 shows this system of consequence categories. 
June 2015 3-A-6 NUREG-1520, Revision 2 

Table A-5 Consequence Severity Categories Based on 10 CFR 70.61

Workers Offsite Public Environment

Category 3 

High 

Consequence 

*RD > 1 Sv 

(100 rem)

**CD > AEGL-3, 

ERPG-3 

RD > 0.25 Sv (25 rem)

30 mg sol U intake 

CD > AEGL-2, 

ERPG-2 

Category 2 

Intermediate 

Consequence 

0.25 Sv (25 rem) 

< RD ≤ 1 Sv (100 rem)

AEGL-2, ERGP-2 

< CD ≤ AEGL-3, 

ERPG-3 

0.05 Sv (5 rem) 

< RD ≤ 0.25 Sv 

(25 rem) 

AEGL-1, ERGP-1 

< CD ≤ AEGL-2, 

ERPG-2 

Radioactive release

> 5,000 x Table 2 in 

Appendix B to

10 CFR Part 20 

Category 1 

Low 

Consequence 

Accidents with lower 

radiological and 

chemical exposures 

than those above in 

this column 

Accidents with lower 

radiological and 

chemical exposures 

than those above in 

this column 

Radioactive releases 

with lower effects than 

those referenced 

above in this column 

 * RD = Radiological Dose 

 **CD = Chemical Dose 

The applicant should document the bases for bounding calculations of the consequence 

assignment in the ISA summary submittal. NUREG/CR-6410, “Nuclear Fuel Cycle Facility 

Accident Analysis Handbook,” issued March 1998, describes valid methods and data that the 

applicant or staff may use for confirmatory evaluations. 

A.3 Likelihood Category Assignment 

An assignment of an accident sequence to a likelihood category is acceptable if it is based on 

the record of occurrences at the facility, the record of failures of IROFS at the facility, applicable 

event data for similar systems, objective qualitative criteria governing system failure rates and 

availability, or other methods that have objective validity. Because sequences leading to 

accidents often involve multiple failures, the likelihood of the whole sequence will depend on the 

frequencies of initiating events and failure likelihoods of engineered and administrative IROFS. 

The method of likelihood assignment used in this appendix relies on the expert engineering 

judgment of the analyst and includes assessment of the number, type, independence, and 

observed failure history of designated IROFS. Engineered and administrative IROFS, even 

those of the same types, have a wide range of reliability. By requiring explicit consideration of 

most of the underlying events and factors that significantly affect the likelihood of the accident 

and explicit criteria for assigning likelihood, greater consistency in assigning likelihood to 

accident sequences across different systems within a facility and among different applicants 

should be possible. 

This section provides one example of a set of acceptable semiquantitative risk guidelines for 

determining compliance with the likelihood requirements of 10 CFR 70.61 when using methods 

of evaluation that are either quantitative or use the risk index method outlined in this appendix. 
June 2015 3-A-7 NUREG-1520, Revision 2 

The performance criteria of 10 CFR 70.61 are formulated in terms of likelihood limits on each 

separate event sequence. The example guidelines given in Table A-6 are based on the 

acceptance criteria guidance on likelihood definitions given in Section 3.4.3.2 of this SRP. 

Table A-6 Example Likelihood Index Limit Guidelines 

Likelihood 

Category Event Frequency Limits* Risk Index 

Limits 

Not Unlikely 3 more than 10-4 per event, 

per year 

> -4 

Unlikely 2 between 10-4 and 10-5 per 

event, per year -4 to -5 

Highly Unlikely 1 less than 10-5 per event, 

per year 

≤ -5 

Any risk or risk index method of likelihood evaluation using criteria as simple as those provided 

in the example method in this appendix should not be relied on exclusively in deciding the 

acceptability of the likelihood of a given event sequence. Consideration of qualitative criteria, 

such as degree of defense in depth or independence of controls, may be used to alter decisions 

based on the example of simple semiquantitative criteria presented here. 

A.4 Assessing Effectiveness of Items Relied on for Safety 

The risk of an accident sequence is reduced through application of different numbers and types 

of IROFS. By either reducing the likelihood of occurrence or by mitigating the consequences, 

IROFS can reduce the overall resulting risk. The designation of IROFS should generally be 

made to reduce the likelihood (i.e., prevent an accident), but the consequences may also be 

reduced by minimizing the potential hazards (e.g., quantity), if practical. Based on hazards 

identification and accident sequence analyses for which the resulting unmitigated or 

uncontrolled risks are unacceptable, key safety controls (administrative and/or engineered 

IROFS) may be designated as IROFS to reduce the likelihood of occurrence and/or mitigate the 

consequence severity. 

The accident evaluation method described below does not preclude the need to comply with the 

double-contingency principle for sequences leading to criticality (see Chapter 5 of this SRP). 

A.5 Example Risk Index Evaluation Method

As previously mentioned, one acceptable way for the applicant to present the results of the ISA 

is a tabular summary of the identified accident sequences. Table A-7 shows an acceptable 

format for such a table. This table lists several example accident sequences for a powder 

blender at a typical facility. Table A-7 summarizes two sets of information: (1) the accident 

sequences identified in the ISA and (2) a risk index, calculated for each sequence, to show 

compliance with the regulation. This risk index is a representation of the frequency of the 

accident sequence in accordance with the mathematics underlying accidents resulting from 

sequences of events. The next section describes the underlying mathematics of this approach. 
June 2015 3-A-8 NUREG-1520, Revision 2 

A.5.1 Mathematics of Accident Sequence Frequencies and the Risk Index Method

According to 10 CFR 70.61, controls must be applied so that high-consequence events are 

highly unlikely and intermediate-consequence events are unlikely. This means that each 

accident sequence, consisting of initiating events and subsequent events, that leads to high 

consequences must be highly unlikely. In quantitative terms, “highly unlikely” will be treated 

here in terms of annual frequency of occurrence. The purpose of this section is to explain the 

concepts and mathematical formulas underlying the risk index method of likelihood evaluation, 

which is cited in this appendix as one example of an acceptable method for such evaluations in 

ISAs. 

Since high-consequence events are, for workers, potentially life threatening or fatal, “highly 

unlikely” must be taken to mean of quite low frequency. Generally, achieving such low 

frequency requires either redundancy, robust passive control with large safety margin, or rare 

external events. Redundancy of safety controls is a method for limiting the occurrence rate of 

accidents by applying controls such that two coincident failure conditions must exist for a 

high-consequence event to occur. Use of redundant controls is common in criticality safety, 

where the double-contingency principle is standard. There are different types of redundant 

control systems. The effectiveness of each of these systems depends not just on having 

controls with low failure rates, but also on limiting downtime after failure occurs. Downtime, or 

the period of vulnerability resulting from an event, may be limited by the inherent fail-safe or 

failure-evident nature of the event. For events lacking these properties, failure should be 

detected either by hardware monitoring or by surveillance testing, which is usually part of the 

plant preventive maintenance program. Definition of the following symbols will aid in 

understanding how accident frequencies depend on frequency of failure events and downtime: 

λi = rate of failure of control i or of occurrence of initiating event i (in units of per year) 

t = mean time to failure (MTTF) = 1/λi = mean uptime 

Ti = mean downtime of control i = 1/μi

ui = unavailability of control i 

sfr = system failure rate (accident rate) 

Mean downtime is often not the same as mean time to actually repair the affected safety system 

(MTTR), but rather indicates the mean time that the system is vulnerable to the second failure. 

This may be considerably shorter than the MTTR, if there is an alternative means of placing the 

system in a state as safe as it was with the unfailed control. 

Unavailability, u, is defined as the probability that a control or system is not available to perform 

its function at a particular time. Unavailability is usually the predominant component of 

probability of failure of a system on demand. The normal model is that a control or system is 

either in an unavailable (“down”) state or an available (“up”) state. The system randomly 

changes from one state to the other over time, governed by the failure rate λ and the repair rate 

μ = 1/T. As a long-run average, the unavailability of a control is thus the fraction of the time that 

it is down, which is the ratio of downtime to downtime plus uptime: 

u = T/(t+T) 

 

For any reasonably available system, uptime is much greater than downtime, t >> T. 

Thus, approximately, u ≈ T/t and t = 1/λ, so that u ≈ λT. 
June 2015 3-A-9 NUREG-1520, Revision 2 

The three most common types of redundant control systems have the following equations for 

their system failure rate (accident rate): 

two continuous parallel controls: sfr = λ1u2(1 - u1) + λ2u1(1 - u2) 

 usually approximated as: sfr ≈ λ1u2 + λ2u1 ≈ λ1(λ2T2) + λ2( λ1T1) 

Equation (1) 

 

three continuous parallel controls: sfr = λ1u2 u3(1 - u1)+ λ2u1u3(1 - u2) + λ3u1u2(1 - u3)

 usually approximated as: sfr ≈ λ1u2 u3 + λ2u1u3 + λ3u1u2 

Equation (2)

challenging initiating event of frequency λ1 with one control: sfr = λ1u2 

Equation (3) 

initiating event i with two redundant standby identical controls: sfr = λi u1u2 

Equation (4) 

The system of frequency and probability (of failure on demand) described in this appendix is 

based on taking the logarithm of each of the terms in the above equations. Thus, for 

Equation (1), in log space, two terms would correspond to the two accident sequences by which 

the system could fail, namely control 1 first or control 2 first: 

sequence 1: log(λ2) + log(u1) 

sequence 2: log(λ1) + log(u2) 

If only failure rates λ and downtimes T are used, then, with the approximation u ≈ λT, the 

formulas corresponding to Equation (1) become the following: 

sfr = λ1(λ2T2) + λ2(λ1T1) 

sequence 1: log(λ2) + log(λ1) + log(T1) 

sequence 2: log(λ1) + log(λ2) + log(T2) 

Thus, for two continuous redundant controls, two accident sequences are typically scored for 

likelihood. One of the two will usually have a larger frequency, so it is important to evaluate 

both. For situations modeled by Equation (3), there would be just one term. 

Table A-9 below provides one example of criteria that might be used to assign frequency index 

numbers (log(frequency) = log(λ)). Table A-10 provides one example of criteria that might be 

used to assign index numbers for probabilities of failure on demand (log(unavailability) = log(u)). 

Table A-11 provides one example of criteria for assigning index numbers for downtime, that is, 

logarithms of durations of vulnerability, log(T). Note that when MTTF >> MTTR, u = λT 

approximately, so that the values λ from Table A-9 and the values T from Table A-11 can be 

combined to obtain u for a given control if λ and T are the known quantities. 

 

The “average” downtime, when determined by surveillance, depends on the interval of time 

between scheduled system surveillance tests. If a surveillance test is done weekly, then, when 

the system is found to be in a failed state, the time that it could have been in this state is 

between zero and 1 week. Thus, the average time that the system will have been down, when 
June 2015 3-A-10 NUREG-1520, Revision 2 

discovered by the test, is half this, or 3.5 days. In units of per year, this is 3.5/365 = 0.01 year, 

and log(.01) = -2. Thus, a short surveillance interval can considerably reduce the system failure 

rate. 

A.5.2 An Example Application of a Risk Index Method of Likelihood Evaluation 

Accident sequences result from initiating events, followed by failure of one or more IROFS. 

Thus, Table A-7 has columns for the initiating event and for IROFS. The initiating event may be 

failure of one of the IROFS, which may be mitigative or preventive. Mitigative IROFS are 

measures that reduce the consequences of an accident. In accordance with Tables A-9 through 

A-11, index numbers are assigned to initiating events, IROFS failure events, and mitigation 

failure events, based on the reliability characteristics of these items. 

As an example, with two redundant IROFS, there is an accident sequence in which an initiating 

failure of one IROFS places the system in a vulnerable state. While the system is in this 

vulnerable state, the second IROFS may fail, which would result in an accident with 

consequences exceeding the criteria in 10 CFR 70.61. For such sequences, the frequency of 

the accident depends on three quantities: the frequency of the first event, the duration of 

vulnerability, and the frequency of the second IROFS failure. For this reason, the duration of 

the vulnerable state should be considered, and a duration index should be assigned. The 

values of all index numbers for a sequence are added to obtain a total likelihood index, T. In 

this risk index method of evaluation, accident sequences are then assigned to one of the three 

likelihood categories of the risk matrix, depending on the value of this index in accordance with 

Table A-8. 

The values of index numbers in accident sequences are assigned considering the criteria in 

Tables A-9 through A-11. Each table applies to a different type of event. Table A-9 applies to 

events that have frequencies of occurrence, such as initiating events, which may be IROFS 

failures or external events. When failure probabilities are required for an event subsequent to 

the initiating event, Table A-10 provides the index values. Table A-11 provides index numbers 

for durations of failure. These are used in cases where information on probability of failure on 

demand is not available for the IROFS failures subsequent to the initiating event. Note the third 

row in Table A-7; it evaluates the reverse sequence to that in the first row. That is, the second 

IROFS fails first. This should be considered as a separate accident sequence, because, as 

shown, it may have a different frequency. 
June 2015 3-A-11 NUREG-1520, Revision 2 

Table A-7 Example Accident Sequence Summary and Risk Index Assignment 

Process: uranium dioxide (UO2) powder preparation (PP) 

Unit Process: additive blending 

Node: blender hopper node (PPB2) 

Accident 

Identifier 

A

Initiating 

Event 

 or 

IROFS 1 

Failure 

B

Preventive 

Safety 

Parameter 2 

or IROFS 2 

Failure/Success 

C

Mitigation 

IROFS 

Failure/ 

Success 

D

Likelihood* 

Index T 

E=B+C+D

Likelihood 

Category 

F

Consequence 

Category 

G

Risk 

Index 

H=F+G

Comments 

and 

Recommendations

PPB2-1A 

(Criticality 

from 

blender 

leak of 

UO2) 

PPB2-C1: 

Mass 

Control 

Failure: 

Blender 

leaks UO2

onto floor; 

critical 

mass 

exceeded 

Frq1 = -1 

Dur1 = -4 

PPB2-C2: 

Moderation 

Failure: 

Sufficient water 

for criticality 

introduced while 

UO2 on floor: 

Frq2 = -2 

N/A 

T = -7 1 3 4 

Criticality, 

consequences = 3, 

IROFS 2 fails while 

IROFS 1 is in failed 

state. 

T = -1-4-2 = -7 

PPB2-1B 

(Radiation 

release 

from 

blender 

leak of 

UO2)

PPB2-C1: 

Mass 

Control 

Failure: 

Mass 

control 

fails but 

critical 

mass not 

exceeded 

Frq1=-1 

Dur1 N/A 

PPB2-C2: 

N/A 

Ventilation 

Failure: 

Ventilated 

blender 

enclosure 

Prf = -3 T = -4 1 2 3 

Rad consequences, 

no criticality 

unmitigated 

sequence: IROFS 1 

and mitigation fail. 

T= -1-3 = -4 

PPB2-1C 

(Criticality 

from 

presence 

of water 

under 

blender)

PPB2-C2: 

Moderation 

Failure: 

Sufficient 

water for 

criticality 

on floor 

under UO2

blender 

Frq1 = -2 

Dur1 = -3 

PPB2-C1: Mass 

Control 

Failure: 

Blender leaks UO2

on floor while 

water present 

Frq2 = -1 

N/A 

T = -6 1 3 4 

Criticality by reverse 

sequence of 

PPB2-1A. 

Moderation fails first. 

Note different 

likelihood. T = -6 

 

Table A-8 Likelihood Category Assignment 

Likelihood Category Likelihood Index T* (= sum of index numbers)

1 T ≤ -5 

2 -5 < T ≤ -4 

3 -4 < T
June 2015 3-A-12 NUREG-1520, Revision 2 

Table A-9 Failure Frequency Index Numbers 

Frequency 

Index No. 

Based on 

Evidence 

Based on Type of IROFS** Comments 

-6* External event 

with frequency < 

10-6/yr 

If initiating event, no 

IROFS needed. 

-4* No failures in 

30 years for 

hundreds of 

similar IROFS in 

industry 

Exceptionally robust passive 

engineered IROFS (PEC), or an 

inherently safe process, or two 

independent active engineered 

IROFS (AECs), PECs, or 

enhanced administrative IROFS 

Rarely justified by 

evidence. Further, most 

types of single IROFS 

have been observed to 

fail. 

-3* No failures in 

30 years for tens 

of similar IROFS 

in industry 

A single IROFS with redundant 

parts, each a PEC or AEC 

-2* No failure of this 

type in this 

facility in 

30 years 

A single PEC 

-1 A few failures 

may occur during 

facility lifetime 

A single AEC, an enhanced 

administrative IROFS, an 

administrative IROFS with large 

margin, or a redundant 

administrative IROFS 

0 Failures occur 

every 1 to 3 

years 

A single administrative IROFS 

1 Several 

occurrences per 

year 

Frequent event, inadequate 

IROFS 

Not for IROFS, just 

initiating events. 

2 Occurs every 

week or more 

often 

Very frequent event, inadequate 

IROFS 

Not for IROFS, just 

initiating events. 

* Indices less than (more negative than) -1 should not be assigned to IROFS unless the configuration management, 

auditing, and other management measures are of high quality, because without these measures, the IROFS may 

be changed or not maintained. 

** Failure frequencies based on experience for a particular type of IROFS, as described in this column, may differ 

from values in column 1; in this case, data from experience take precedence. 
June 2015 3-A-13 NUREG-1520, Revision 2 

Table A-10 Failure Probability Index Numbers

Probability 

Index No. 

Probability 

of Failure on 

Demand 

Based on Type of IROFS Comments 

-6* 10-6 If initiating event, no 

IROFS needed. 

-4 or -5* 10-4–10-5 Exceptionally robust passive engineered 

IROFS (PEC), or an inherently safe 

process, or two redundant IROFS more 

robust than simple administrative IROFS 

(AEC, PEC, or enhanced administrative) 

Rarely justified by 

evidence. Most types of 

single IROFS have 

been observed to fail. 

-3 or -4* 10-3–10-4 A single passive engineered IROFS 

(PEC) or an active engineered IROFS 

(AEC) with high availability 

-2 or -3* 10-2–10-3 A single active engineered IROFS, or an 

enhanced administrative IROFS, or an 

administrative IROFS for routine planned 

operations 

-1 or -2 10-1–10-2 An administrative IROFS that must be 

performed in response to a rare 

unplanned demand 

* Indices less than (more negative than) -1 should not be assigned to IROFS unless the configuration management, 

auditing, and other management measures are of high quality, because without these measures, the IROFS may 

be changed or not maintained. 

Table A-11 Failure Duration Index Numbers

Duration 

Index 

No. 

Average Failure Duration Duration in Years Comments 

1 More than 3 years 10 

0 1 year 1 

-1 1 month 0.1 Formal monitoring to 

justify indices less than -1

-2 A few days 0.01 

-3 8 hours 0.001 

-4 1 hour 10-4 

-5 5 minutes 10-5 
June 2015 3-A-14 NUREG-1520, Revision 2 

As shown in Table A-11, the duration of failure, and thus the period that the system is in a state 

of heightened vulnerability, is accounted for in establishing the overall frequency of the accident 

sequence. The period of vulnerability will normally be terminated by discovery of the vulnerable 

condition or failure; the system will then be rendered safe, either by removing the hazardous 

material, or by repairing or substituting for the safety function of the failed IROFS. The duration 

of this period of vulnerability determines the index value to be assigned from Table A-11. 

For all these index numbers, the more negative the number, the lower the frequency of the 

event. Accident sequences may consist of varying numbers of events, starting with an initiating 

event. The total likelihood index is the sum of the indices for all the events in the sequence, 

including those for duration, except the initiating event, for which only the occurrence frequency 

index should be used. For example, a three-event sequence would correspond to an event 

sequence frequency of the form λ1(λ2T2) (λ3T3), or five index values, three being frequencies, 

and two durations. 

Consequences are assigned to one of the three consequence categories of the risk matrix, 

based on calculations or estimates of the actual consequences of the accident sequence. The 

consequence categories are based on the levels identified in 10 CFR 70.61. Multiple types of 

consequences can result from the same event. If there are multiple types of consequence, the 

consequence category is the most severe. Similarly, if a range of consequences could occur, 

then the highest consequence event of this range could occur, and if it falls in the highconsequence range, it should be evaluated as such. 

Table A-12 provides a more detailed description of the accident sequences used in the example 

of Table A-7. Such descriptive information may be necessary for the reviewer to understand the 

nature of the accident sequences listed in Table A-7. 

Table A-13 is an example of one format for the descriptive list of IROFS required by the 

regulation. It should also include external initiating events that appear in the accident 

sequences and whose frequencies are relied on in demonstrating that the overall accident 

sequence frequency complies with the likelihood requirements. The information on IROFS in 

Table A-13 should have sufficient detail to permit the reviewer to understand why the initiating 

events and IROFS listed in Table A-7 have the frequency, unavailability, or duration indices 

assigned. Thus, Table A-13 may also contain such information as (1) the margins to safety 

limits, (2) the redundancy of an IROFS, and (3) the measures taken to ensure adequate 

reliability of an IROFS, if this information is necessary to understand the reliability and safety 

function of the IROFS with respect to the likelihood performance requirements. 
June 2015 3-A-15 NUREG-1520, Revision 2 

Table A-12 Accident Sequence Descriptions

Process: UO2 powder preparation (PP) 

Unit: additive blending 

Node: blender hopper node (PPB2) 

Accident 

(see Table A-6)

Description 

PPB2-1A 

Blender UO2 leak 

criticality 

The initial failure is a blender leak of UO2 that results in a mass sufficient for criticality on the 

floor. (This event is not a small leak.) Before the UO2 can be removed, moderator sufficient to 

cause criticality is introduced. Duration of critical mass UO2 on floor is estimated to be 1 hour. 

PPB2-1B 

Blender UO2 leak, 

radiological 

release 

The initial failure is a blender leak of UO2 that results in a mass insufficient for criticality on the 

floor or a mass sufficient for criticality but moderation failure does not occur. Consequences are 

radiological, not a criticality. A ventilated enclosure should mitigate the radiological release of 

UO2. If it fails during cleanup or is not working, unmitigated consequences occur. 

PPB2-1C The events of PPB2-1A occur in reverse sequence. The initial failure is introduction of water 

onto the floor under the blender. Duration of this flooded condition is 8 hours. During this time, 

the blender leaks a critical mass of UO2 onto the floor. Criticality occurs. 

Table A-13 Descriptive List of IROFS

Process: UO2 powder preparation (PP) 

Unit: additive blending 

Node: blender hopper node (PPB2) 

IROFS 

Identifier 

Safety 

Parameter 

and Limits 

IROFS Description Max. Value of 

Other 

Parameters 

Reliability 

Management 

Measures 

Quality 

Assurance 

Grade 

PPB2-C1 Mass outside 

hopper: zero 

Mass outside hopper: Hopper 

and outlet design prevent UO2

leaks, double gasket at outlet 

Full water 

reflection, 

enrichment 5% 

Surveillance for 

leaked UO2 each 

shift 

A 

PPB2-C2 Moderation: 

in UO2 < 1.5 

wt.% 

External water 

in area: zero 

Moderation in UO2: Two sample 

measurements by two persons 

before transfer to hopper 

External water: Posting excluding 

water, double piping in room, floor 

drains, roof integrity 

Full water 

reflection, 

enrichment 5% 

Drain, roof, and 

piping under 

safety-grade 

maintenance 

A

Note: In addition to IROFS, which are facility hardware and procedures, this table should describe external 

initiating events, the low likelihood of which is relied on to achieve acceptable risk, especially those that are 

assigned frequency indices lower than -4. The descriptions of these initiating events should contain 

information supporting the frequency index value selected by the applicant.

A.6 Determination of Likelihood Category in Table A-8 

The likelihood category is determined by calculating the likelihood index, T, which equals the 

sum of the indices for the events in the accident sequence. Based on the calculated value of T, 

the likelihood category of each accident sequence can be determined from Table A-8. 
June 2015 3-A-16 NUREG-1520, Revision 2 

A.7 Failure Probability Index Numbers in Table A-10 

Occasionally, information concerning the reliability of an IROFS may be available as a 

probability on demand. That is, there may be a history of tests or incidents where the system in 

question is demanded to function. To quantify such accident sequences, the demand 

frequency, the initiating event, and the demand failure probability of the IROFS must be known. 

This table provides an assignment of index numbers for such IROFS in a way that is consistent 

with Table A-9. The probability of failure on demand may be the likelihood that it is in a failed 

state when demanded (availability) or that it fails to remain functional for a sufficient time to 

complete its function. 

A.8 Management Measures for Items Relied on for Safety

Table A-13 is an acceptable way of listing IROFS in all the general types of accident sequences 

having consequences exceeding those identified in 10 CFR 70.61. The items listed should 

include all IROFS and all external events whose low likelihood of occurrence is relied on to meet 

the performance requirements of 10 CFR 70.61. For certain IROFS or accident sequences 

included in this list, information on management measures that is specific to that sequence or 

IROFS should be presented to permit the reviewer to understand how the IROFS perform. The 

reviewer examines this list to determine whether adequate management measures have been 

applied to each IROFS to ensure its continual availability and reliability, in conformance with 

10 CFR 70.62(d). Management measures include such activities as maintenance, training, 

configuration management, audits and assessments, and quality assurance. The baseline 

design criteria indicate criteria for management measures; SRP Chapters 4 through 7 and 

Chapter 11 describe other criteria in greater detail. IROFS may have management measures 

applied in varying ways or to varying degrees, depending on the nature of the IROFS, and the 

degree of reliability assumed in demonstrating compliance with the likelihood requirements. 

This is the meaning of “graded management measures.” 

A.9 Risk-Informed Review of Items Relied on for Safety 

Column (H) in Table A-7 gives the risk indices for each accident sequence identified in the ISA. 

There are two indices, uncontrolled and controlled. The controlled index is a measure of risk 

without credit for the IROFS. If the uncontrolled risk index is a 6 or 9, while the controlled index 

is an acceptable value (4 or less), the set of IROFS involved are significant in achieving 

acceptable risk. That is, these IROFS have high risk significance. Reviewers will use the 

uncontrolled risk index to identify all risk-significant systems of IROFS. These systems of 

IROFS will be reviewed more closely than IROFS established to prevent or mitigate accident 

sequences of low risk. 

REFERENCES 

U.S. Code of Federal Regulations, Chapter I, Title 10, “Energy,” Part 20, “Standards for 

Protection Against Radiation.” 

U.S. Code of Federal Regulations, Chapter I, Title 10, “Energy,” Part 70, “Domestic Licensing of 

Special Nuclear Material.” 

U.S. Nuclear Regulatory Commission, “Nuclear Fuel Cycle Facility Accident Analysis 

Handbook,” NUREG/CR-6410, March 1998. 
June 2015 3-AA-1 NUREG-1520, Revision 2 

ANNEX TO APPENDIX A 

USE OF APPENDIX A RISK INDEX METHODOLOGY 

Introduction

The purpose of this annex is to clarify the proper use of the semiquantitative index method as 

described in Appendix A to Chapter 3 of this Standard Review Plan. Several licensees and 

applicants have used the index method of Appendix A (or a variation thereof) in performing their 

integrated safety analyses (ISAs). The U.S. Nuclear Regulatory Commission (NRC) reviews of 

these ISA Summaries have discovered a need for additional guidance on the use of this 

method. Because of the method’s widespread use and a lack of common understanding about 

its use, guidance on the index method is appropriate. 

As stated in the introduction to Appendix A, the index method is but one method of likelihood 

evaluation. The index method is not strictly a qualitative method; rather, it is a semiquantitative 

method that considers both qualitative and quantitative information (if it is available and 

applicable). In this method, the definition of likelihood terms (i.e., “not unlikely,” “unlikely,” and 

“highly unlikely”) is expressed quantitatively (more than 10-4 per event, per year; between 10-4

and 10-5 per event, per year; and less than 10-5 per event, per year, respectively). As a purely 

qualitative method would use purely qualitative definitions of likelihood and qualitative methods 

of evaluating likelihood, much of the quantitative discussion in this appendix would not apply. 

However, this method illustrates the logic that should be used in even a purely qualitative 

method. 

The index method is one acceptable method of demonstrating compliance with the performance 

requirements. However, taking credit for using this method requires that the applicant follow all 

of the guidance contained in Appendix A. Otherwise, the applicant should provide additional 

justification. 

Likelihood Definitions

The likelihood definitions in Table A-6 of Appendix A are, as stated above, given in quantitative 

terms (e.g., “highly unlikely” is defined as less than 10-5 per event, per year). The footnote to 

Table A-6 indicates, however, that these are based on approximate order-of-magnitude ranges. 

Therefore, these values should not be regarded as strict numerical limits but as indicative of the 

approximate order of magnitude of likelihood. Any definition of likelihood should be stated on a 

per-event basis. 

Likelihood Evaluation Method

The likelihood evaluation method used should be consistent with the likelihood definitions, such 

that the qualitative score assigned can be compared to the likelihood definitions. In the index 

method, the likelihood index for the accident sequence must be no greater than -5 to meet the 

definition of “highly unlikely” and must be no greater than -4 to meet the definition of “unlikely.” 

The likelihood index for the accident sequence is determined by summing likelihood indices for 

the initiating event and subsequent failures of items relied on for safety (IROFS). Tables A-9, 

A-10, and A-11 of Appendix A present criteria for the assignment of the likelihood indices. 
June 2015 3-AA-2 NUREG-1520, Revision 2 

 

Appendix A distinguishes between two different kinds of events that can be combined to form 

the accident sequences in the ISA summary. The two basic kinds of events are (1) events that 

are characterized by a frequency of occurrence, and (2) events that are characterized by a 

probability of failure on demand (PFOD). In the index method of Appendix A, the category to 

which an event belongs determines how it is scored by means of either Table A-9 or A-10, as 

explained below. 

Events characterized by a frequency of occurrence (f-type events) can include external events, 

internal events that are not IROFS failures, or IROFS failures. IROFS failures characterized by 

a frequency of occurrence are those that are required to be continuously present, rather than 

those that are required to perform a safety function only when certain conditions are present. 

Examples may include favorable geometry equipment or an active engineered device 

monitoring a continuous process. 

Events characterized by a PFOD (p-type events) typically include IROFS that are not required to 

be continuously present but that must perform a safety function on demand (subsequent to 

some process deviation or failure). Examples include active interlocks that perform some 

protective function when system parameters exceed preset limits, administrative controls 

required in response to process deviations, or certain administrative controls in batch 

processes. These are usually part of the subsequent failures following the initiating event but 

may sometimes be part of the initiating event. 

In general, accident sequences may comprise many individual events. In general, accident 

sequences consist of an initiating event followed by the failure of one or more IROFS. Because 

the overall accident sequence likelihood must be consistent with the likelihood categories, it 

must have the same dimensional units as those of the likelihood definitions (i.e., probability per 

event, per year). Even though qualitative indices are used instead of quantitative probabilities, 

this requirement imposes constraints on the ways in which individual indices may be combined. 

For simplicity, the following considers only two-event sequences (in which the events are 

independent). The two basic kinds of events result in four basic types of two-event accident 

sequences, as described in the following sections. 

F-Type Initiating Event with Subsequent P-Type IROFS Failure

In the index method of Appendix A, a failure frequency index may be applied to the initiating 

event using the criteria in Table A-9, and a failure probability index may be applied to the 

subsequent IROFS failure using the criteria in Table A-10. The overall likelihood index for the 

accident sequence is the sum of the likelihood indices for the two events. This is because the 

IROFS is assumed to be demanded every time the initiating event occurs. 

Mathematically, this results in an accident sequence likelihood index corresponding to an 

accident sequence likelihood with the correct dimensional units: 

 accident sequence likelihood (yr-1) = initiating event frequency (yr-1) × PFOD 

accident sequence index = initiating event index + subsequent failure index 

An example of this type of accident sequence is a criticality sequence consisting of a loss of 

concentration control in a continuous solution processing operation, followed by failure of an 
June 2015 3-AA-3 NUREG-1520, Revision 2 

inline concentration monitor that closes an isolation valve on a transfer line upon detection of 

highly concentrated solution. 

F-Type Initiating Event with Subsequent F-Type IROFS Failure

Using the index method of Appendix A, a failure frequency index may be applied to both the 

initiating event and the subsequent IROFS failure using the criteria in Table A-9. The overall 

likelihood index for the accident sequence is the sum of the individual likelihood indices for the 

two events and a duration index for the initiating event. This is because the probability of the 

second event occurring concurrently with the first event is dependent on the time during which 

the conditions caused by the first event persist. For the accident sequence likelihood to have 

the correct units (yr-1), the duration of failure for the first event must be considered. 

 

Mathematically, this results in an accident sequence likelihood index corresponding to an 

accident sequence likelihood with the correct dimensional units: 

 accident sequence likelihood (yr-1) = initiating event frequency (yr-1) × initiating 

event duration (yr) × subsequent failure frequency (yr-1) 

 accident sequence index = initiating event index + initiating event duration 

index + subsequent failure index 

An example of this type of accident sequence is a criticality sequence consisting of a loss of 

geometry control followed by a loss of moderation control resulting from the unrelated sprinkler 

activation before geometry control can be restored. 

P-Type Initiating Event with Subsequent P-Type IROFS Failure

Using the index method of Appendix A, a failure probability index may be applied to both the 

initiating event and the subsequent IROFS failure using the criteria in Table A-10. The overall 

likelihood index for the accident sequence is the sum of the individual likelihood indices for the 

two events, which includes consideration of the demand rate associated with the initiating event. 

This is because the total failure frequency for the initiating event depends on the frequency with 

which the demand occurs, as well as the associated PFOD. The subsequent IROFS is 

assumed to be demanded every time the initiating event occurs. For the accident sequence 

likelihood to have the correct units (yr-1), the demand rate of the first event must be considered. 

Mathematically, this results in an accident sequence likelihood index corresponding to an 

accident sequence likelihood with the correct dimensional units: 

 accident sequence likelihood (yr-1) = initiating event demand rate (yr-1) × initiating 

event PFOD × subsequent event PFOD 

 accident sequence index = initiating event index (including demand rate) 

+ subsequent failure index 

An example of this type of accident sequence is a criticality sequence consisting of the failure of 

an operator to sample solution before transfer in a batch operation, followed by failure of an 

inline concentration monitor as discussed previously. 
June 2015 3-AA-4 NUREG-1520, Revision 2 

P-Type Initiating Event with Subsequent F-Type IROFS Failure

Using the index method of Appendix A, a failure probability index may be applied to the initiating 

event using the criteria in Table A-10. A failure frequency index may be applied to the 

subsequent IROFS failure using the criteria in Table A-9. The overall likelihood index for the 

accident sequence is the sum of likelihood indices for the two events, which includes 

consideration of the demand rate associated with the initiating event and a duration index for the 

initiating event. This is because the failure frequency for the initiating event depends on the 

frequency with which the demand occurs, as well as the associated PFOD. The probability of 

the second event occurring concurrently with the first event is dependent on the time during 

which the conditions caused by the first event persist. For the accident sequence likelihood to 

have the correct units (yr-1), both the duration of failure for the first event and its demand rate 

must be considered. 

Mathematically, this results in an accident sequence likelihood index corresponding to an 

accident sequence likelihood with the correct dimensional units: 

 accident sequence likelihood (yr-1) = initiating event demand rate (yr-1) × initiating 

event PFOD × initiating event duration (yr) × subsequent failure frequency (yr-1) 

 accident sequence index = initiating event index (including demand rate) + failure 

duration index + subsequent failure index 

An example of this type of accident sequence is a criticality sequence consisting of a uranium 

solution spill that results from improper preventive maintenance on a pump, followed by the loss 

of moderation control because of inadvertent sprinkler activation before the spill can be 

cleaned up. 

Use of Tables A-9, A-10, and A-11 in Appendix A 

As illustrated above, an accident sequence generally consists of an initiating event with a 

certain frequency, followed by a number of subsequent events. While the number and type of 

events making up the sequence may vary, the likelihood indices of the individual events are 

combined, with appropriate consideration for duration of failure and demand rate, to arrive at a 

likelihood index for the accident sequence as a whole. The basic steps in this process are 

outlined below: 

(1) Determine the events making up the sequence (initiating event and subsequent failures). 

(2) Determine whether the event is characterized by a frequency of occurrence (f-type) or a 

PFOD (p-type). If an f-type event, use Table A-9 to assign the indices. If a p-type event, 

use Table A-10 to assign the indices. 

(3) If the initiating event is a p-type event, take the demand rate into account to modify the 

indices from Table A-9. 

(4) If the subsequent event is an f-type event, take into account the duration index for the 

initiating event from Table A-11. 

(5) Combine the appropriate indices into an overall accident sequence likelihood index. 
June 2015 3-AA-5 NUREG-1520, Revision 2 

The table below summarizes the use of Tables A-9, A-10, and A-11 to determine overall 

accident sequence likelihood: 

Initiator Type Subsequent 

Event Type 

Initiator Index Subsequent 

Event Index 

Duration 

Index 

Accident 

Sequence 

Index 

f-type p-type f1: Table A-9 p2: Table 

A-10 

NA f1 × p2 

f-type f-type f1: Table A-9 f2: Table A-9 d1: Table 

A-11 

f1 × d1 × f2 

p-type p-type p1: Table 

A-10* 

p2: Table 

A-10 

NA p1 × p2 

p-type f-type p1: Table 

A-10* 

f2: Table A-9 d1: Table 

A-11 

p1 × d1 × f2 

* To convert PFOD indices to frequency indices, use the indices of Table A-10 modified to take demand rate into 

account as follows: 

Demand Rate Modify Table A-10 Index 

Hundreds of times per year (daily) Increase base index by 2 

Tens of times per year (monthly) Increase base index by 1 

Once per year Use base index 

Once every 10 years Decrease base index by 1 

Users of these tables must be careful not to confuse frequency with probability. For example, it 

is often assumed that the initiating event occurs because soothe assumption is simpler and 

more conservative. This is not, however, equivalent to assigning an initiating event frequency 

of 1, which is an event that occurs once per year. The confusion of failure frequency (with units 

of inverse time) with probability (dimensionless) can lead to significant errors in the overall 

accident sequence likelihood. 

Example: In this accident sequence, the initiating event is solution sampling before transfer to a 

tank with an unfavorable geometry. A single administrative control might have a probability 

index of -2 (with appropriate management measures or redundancy). Similarly, if the historical 

data indicated a PFOD of 10-2, an index of -2 would be appropriate. However, if this operation is 

a batch process conducted 10 times per year, this results in an initiating event frequency of 

10/yr × 10-2 (PFOD) = 10-1/yr (for an index of -1). If the operation is conducted 100 times per 

year, this results in an initiating event frequency of 100/yr × 10-2 (PFOD) = 100

/yr (for an index 

of 0). Use of Table A-10 without any consideration of the demand rate would result in an index 

of -2. 

Use of the incorrect table can also lead to erroneous results. A comparison of the indices in 

Tables A-9 and A-10 for the same type of control (although this is not the only factor that should 

be considered) immediately shows that use of Table A-9 results in a higher index than does use 
June 2015 3-AA-6 NUREG-1520, Revision 2 

of Table A-10. For example, a simple administrative control (without enhancing factors such as 

redundancy or large margin) would have a probability index of -1 to -2 based on Table A-10, but 

a frequency index of 0 based on Table A-9. This is intuitively reasonable because Table A-9 is 

for events characterized by a frequency (which must be present on a continuous basis) and 

Table A-10 is for events that are demanded only under certain conditions (which must be 

present on occasion). 

Additional Considerations in the Use of Index Tables

Assignment of a qualitative score may be based either on objective evidence of the frequency of 

occurrence or on certain qualitative characteristics of the process or facility (availability and 

reliability qualities). In accordance with this, Tables A-9 and A-10 contain two columns that 

represent two different methods for assigning likelihood indices. As stated in the introduction to 

Appendix A, this is a semiquantitative method that allows for the use of quantitative information 

if available. 

For initiating events that are external events or internal events other than IROFS failures, the 

column entitled “Based on Evidence” in Table A-9 should be used in assigning indices. For 

IROFS failures to which Table A-9 applies, either the column entitled “Based on Evidence” or 

“Based on Type of IROFS” may be used. Because the type of IROFS is only one of the 

availability and reliability qualities on which likelihood depends, the footnote to this table 

indicates that the index scores applicable to a particular type of IROFS can be one value higher 

or lower than the index shown.1

 Thus, other specific availability and reliability qualities (as 

discussed in Section 3.4.3.2(9) of this SRP) should be considered in assigning the final 

likelihood index.2

 In the absence of sufficiently detailed information about these factors, 

appropriate conservatism should be used in assigning indices (e.g., using the highest index in 

the range). Because of the large uncertainty associated with basing likelihood on the type of 

IROFS, historical and/or operating evidence should be used to assign indices whenever 

available. The same considerations discussed above should be employed when using 

Table A-10 to assign likelihood indices. 

The presence of two columns should not be construed to mean that the two sets of criteria may 

be considered equivalent except in a rough, order-of-magnitude sense (e.g., a single passive 

engineered IROFS does not necessarily have a PFOD of 10-3 to 10-4). This is because the type 

of IROFS is only one of the availability and reliability qualities that must be considered. 

Appropriate use of Tables A-9 and A-10 to assign likelihood indices also requires that attention 

be given to the footnotes and comments in these tables. As indicated in the footnotes, indices 

less than -1 should not be used unless the management measures are of high quality. This is 

because even though a passive engineered control may have high inherent reliability while it is 

installed, this control could be easily defeated by a poor configuration management program, 

which is administrative in nature (as are all management measures). Justification should be 

provided as to why the management measures are deemed to be of high quality. Also, the ISA 

 

1 The title “Based on Type of IROFS” is somewhat of a misnomer in that several of the criteria also include 

consideration of redundancy, margin, and independence. Indices based solely on the type of IROFS would cover 

an even broader range. 2 This is consistent with the caveat for Table A-4, which warns that such coarse criteria are useful only for screening 

purposes or making an initial estimate of the likelihood. Because IROFS meeting these criteria can have a broad 

range of reliability, management measures applied to all the availability and reliability qualities of the IROFS should 

be considered in assigning the likelihood indices. 
June 2015 3-AA-7 NUREG-1520, Revision 2 

summary should justify the use of a more negative index whenever a range of indices is 

possible. As the comments suggest, the more negative the index, the more justification is 

required. As indicated, indices of -4 and -5 can rarely be justified by evidence. Use of these 

indices requires substantial evidence that the IROFS are exceptionally robust. 

The assignment of failure duration indices using Table A-11 should also be based on objective 

criteria (such as documented mean time to repair or surveillance periods established in plant 

procedures). 

When the analysis uses demand rates to modify probability indices from Table A-10, 

conservative estimates of the demand rate should be used and the basis for this estimate 

documented and, if the rates could credibly be changed, controlled. For example, the time 

needed to fill a cylinder may depend on inherent physical laws and would not need specific 

controls. However, if the maximum allowed inventory limits the number of batches, the license 

or plant procedures should control this inventory. 

 

Description of Accident Sequences and IROFS

Tables A-12 and A-13 include descriptions of accident sequences and IROFS. These must be 

sufficiently clear to permit the reviewer to understand the sequence of events needed for an 

accident to occur and how the established controls prevent the sequence from occurring. The 

initial failure and all subsequent failures necessary for the sequence to progress to the ultimate 

consequences (an accident exceeding the consequence thresholds in Title 10 of the Code of 

Federal Regulations (10 CFR) 70.61, “Performance Requirements”) should be specified. In 

addition, any initial conditions credited in meeting the performance requirements should be 

specified. If important to the likelihood of the sequence, the order in which these events occur 

should be specified. For example, in Table A-12, sequence PPB2-1C is the reverse of the 

events in sequence PPB2-1A. When failure duration indices are considered, these pertain to 

the initiating event; therefore, the accident sequence likelihood is dependent on which event 

occurs first. 

In describing IROFS, it is important that the safety function performed by the IROFS and the 

attributes of the IROFS necessary to perform the safety function be specified. For example, for 

the first IROFS in Table A-13, the safety function is to prevent mass from accumulating outside 

the hopper. Therefore, the only attribute of IROFS PPB2-C1 that must be specified is that it be 

designed to prevent leaks; such a design would include the use of a double gasket at the 

hopper’s outlet. Because the material of composition, size, and other attributes of the hopper 

have no role in preventing this accident sequence, they need not be specified. The second 

IROFS is an example of a system of IROFS that collectively provides for moderation control 

(i.e., dual sampling, administrative exclusion of water, double piping, floor drains, and roof 

integrity). As in the preceding example, the size of the piping is not significant; double piping is 

the only feature important to preventing this accident sequence. The level of detail should be 

sufficient to provide assurance that safety-significant aspects of the IROFS are recognized and 

appropriately controlled. However, excessive detail could lead to obscuring the safetysignificant aspects of IROFS and could lead to unnecessary and burdensome changes to the 

ISA and ISA summary. IROFS may be specified at the subcomponent level, component level, 

or system level, as appropriate. For example, it is not necessary to specify every geometry 

limited pipe in the building as an IROFS. If the safety function is to maintain geometry control, it 

would be sufficient to specify a systems-level IROFS with the description “all fissile material 

piping in the solution recovery area will be less than 2 inches in diameter.” 
June 2015 3-AA-8 NUREG-1520, Revision 2 

A single piece of equipment may perform several different safety functions and be credited in 

several different accident sequences. In such cases, the accident sequence must clearly 

describe the safety function and attribute of the IROFS being credited, as well as the failure 

mode of the IROFS that leads to the accident. 

Summary Table of Accident Sequences

Table A-7 of Appendix A is a summary table showing several accident sequences for a 

powder-blending process. This is one way to display the information on accident sequences 

obtained during performance of the ISA. As shown in Appendix A to NUREG-1718, “Standard 

Review Plan for the Review of an Application for a Mixed Oxide Fuel Fabrication Facility,” 

issued August 2000, a fault tree (quantitative or qualitative) is one of the other formats that may 

be used. The important information that must be conveyed, however, is a list of accident 

sequences, identification of the initiating event, the set of subsequent events leading to the 

accident and the IROFS that prevent them, the likelihood of the initiating event and subsequent 

failures, the ultimate consequence category, and the overall assessment of compliance with the 

performance requirements (e.g., total risk index). Any other information needed to demonstrate 

that the performance requirements are met should also be specified (e.g., initial conditions, 

demand rate, duration indices, index modification for dependent failures). Table A-7 shows two 

types of accident sequences: (1) two sequences initiated by IROFS failures (both f-type 

initiating events with f-type subsequent failures and crediting duration indices) and (2) two 

sequences initiated by internal events other than IROFS failures (and crediting initiating event 

frequency). 

While this guidance follows the structure of Appendix A to this Standard Review Plan, it also 

applies to Appendix A to NUREG-1718. 

REFERENCES 

U.S. Code of Federal Regulations, Chapter I, Title 10, “Energy,” Part 70, “Domestic Licensing of 

Special Nuclear Material.” 

U.S. Nuclear Regulatory Commission, “Standard Review Plan for the Review of an Application 

for a Mixed Oxide (MOX) Fuel Fabrication Facility,” NUREG-1718, August 2000. 
June 2015 3-B-1 NUREG-1520, Revision 2 

APPENDIX B 

QUALITATIVE CRITERIA FOR EVALUATION OF LIKELIHOOD 

Purpose

 

This appendix provides additional guidance on the use of qualitative criteria in methods for 

evaluation of likelihood. These evaluations are used in demonstrating compliance with the 

performance requirements of Title 10 of the Code of Federal Regulations (10 CFR) 70.61, 

“Performance Requirements.” 

Introduction 

The regulation in 10 CFR 70.61(b) requires that the risk of each credible high-consequence 

event be limited by ensuring that upon implementation of engineered or administrative controls, 

the event is made highly unlikely or its consequences reduced to less than high consequence. 

This regulation similarly requires that the risk of each credible intermediate-consequence event 

be limited by ensuring that the event is made unlikely, or its consequences reduced. Rather 

than defining the terms “highly unlikely,” “unlikely,” and, “credible,” 10 CFR 70.65(b)(9) instead 

states that the applicant must include definitions of these terms in its integrated safety analysis 

(ISA) summary. 

As stated in Section 3.4.3.2(9) of this Standard Review Plan (SRP), the applicant’s definitions of 

these terms may be either quantitative or qualitative. The method used to evaluate accident 

sequence likelihood must be consistent with the definitions. Quantitative definitions require 

quantitative methods; qualitative definitions require qualitative methods. Qualitative methods 

are based on objective qualitative criteria and characteristics of the process or system being 

evaluated. In addition, some methods (semiquantitative methods) may rely on a mixture of 

qualitative and quantitative definitions, methods, and information. This appendix provides 

general guidance on the use of qualitative methods for evaluation of likelihood. However, the 

U.S. Nuclear Regulatory Commission’s (NRC’s) review of recently submitted ISA Summaries 

has revealed a lack of common understanding as to what constitutes an acceptable qualitative 

method. 

Additional guidance is provided on the acceptance criteria for qualitative methods of evaluating 

likelihood, both for the failure of items relied on for safety (IROFS) and for accident sequences 

as a whole. Either external events or internal events (which may or may not be IROFS failures) 

may initiate these accident sequences. Appendix D to Chapter 3 of this SRP provides 

additional guidance on the use of initiating events that are natural phenomena. Appendix C to 

Chapter 3 offers additional guidance on the use of initiating events that are internal to the 

facility. That guidance may be used with the guidance in this appendix as an acceptable 

qualitative method for likelihood evaluation. 
June 2015 3-B-2 NUREG-1520, Revision 2 

Discussion 

Definitions of Likelihood 

According to 10 CFR 70.65(b)(9), the ISA summary must define the terms “unlikely,” “highly 

unlikely,” and “credible.” Section 3.4.3.2(9) of this SRP states that qualitative definitions of 

likelihood are acceptable if they meet two conditions: (1) they are reasonably clear and based 

on objective criteria and (2) they can reasonably be expected to consistently distinguish 

accidents that are highly unlikely from those that are merely unlikely (or not unlikely). This 

means that the definitions should be sufficiently clear that there is reasonable assurance that 

they will yield the same result when applied by different reviewers and that they can be used to 

make meaningful distinctions between events in different likelihood categories. Both the 

definitions of likelihood and the methods for likelihood determination should meet these criteria 

since they must work together to ensure that the performance requirements are met. 

This NUREG states that “objective criteria” means that the method relies on specific identifiable 

characteristics of a process design, rather than subjective judgments of adequacy. Because the 

likelihood of an accident sequence is a function of the likelihood of the initiating event, the 

subsequent IROFS failures, and the relationship between the IROFS (e.g., whether the IROFS 

are independent), the characteristics of the process design that the method should rely on are 

the specific identifiable characteristics of the initiating event, IROFS failures, and other process 

features that affect the likelihood of the accident sequence. These features include the safety 

margin, type of control, type and grading of management measures, whether the system is 

fail-safe or failure is self-announcing, failure modes, demand rates, and failure rates for 

individual IROFS (whether credited as part of the initiating event or subsequent failures). These 

features include the degree of redundancy, independence, diversity, and vulnerability to 

common-cause failure for systems of IROFS. The following sections describe these features in 

detail. It is important that any features of the process or equipment necessary to meet the 

performance requirements are recognized as important to safety and appropriately maintained 

through the use of management measures. 

Examples of acceptable qualitative definitions of likelihood are the second and third definitions 

of “not credible” in Section 3.4.3.2(9) of this SRP: 

A process deviation consists of a sequence of many unlikely human actions or 

errors for which there is no reason or motive.... 

A convincing argument exists that, given physical laws, the process deviations 

are not possible, or are unquestionably extremely unlikely.... 

Similarly, the following is an example of an acceptable qualitative definition of “highly unlikely”: 

a system of IROFS that possesses double-contingency protection, where each of 

the applicable qualities is present to an appropriate degree 

In this definition, the qualities to be considered should be described in sufficient detail so that 

their effect on the overall likelihood can be evaluated. This is the meaning of “present to an 

appropriate degree.” Other definitions are acceptable provided that they meet the two criteria 

specified above and provide system features to ensure that the likelihood is appropriately 

maintained. 
June 2015 3-B-3 NUREG-1520, Revision 2 

Evaluation of Likelihood 

Accident sequences, in general, consist of an initiating event followed by one or more 

subsequent events. The likelihood of an accident sequence is, therefore, a function of the 

likelihood of the individual events making up the accident sequence and the relationship 

between them (e.g., whether they are independent). Because the likelihood of the accident 

sequence must be compared to the likelihood definitions to determine whether it is “unlikely,” 

“highly unlikely,” or “not unlikely,” qualitative methods of likelihood evaluation are acceptable if 

they (1) are reasonably clear and based on objective criteria and (2) can reasonably be 

expected to consistently distinguish accidents that are “highly unlikely” from those that are 

merely “unlikely.” The likelihood definitions establish the standard for what is “unlikely” and 

“highly unlikely,” and the assigned likelihood for the accident sequence is then compared to this 

standard. As mentioned above, the method must take into account all objective qualities of the 

system that can reasonably be considered to affect likelihood. These qualities are referred to in 

this NUREG as the “reliability and availability” qualities of IROFS or systems of IROFS. 

Initiating Events and Initial Conditions 

Each accident sequence begins with an initiating event. An initiating event may consist of an 

external event (including a natural phenomenon or external manmade event), an internal event 

other than an IROFS failure, or an IROFS failure. Natural phenomena may include heavy rains, 

winds, flooding, earthquakes, and fires. External manmade events may include impacts from 

nearby facilities, aircraft or vehicle crashes, fires, and loss of offsite utilities. Internal events 

other than IROFS failures may include spills, non-IROFS equipment failure, process deviations, 

industrial accidents, and loss of onsite utilities. In a qualitative method of likelihood 

determination, a qualitative score is associated with the initiating event based on its objective 

qualities. The score may be expressed in either numerical (e.g., -1, -2, -3) or nonnumerical 

(e.g., A, B, C, D) form but is still qualitative if based on qualitative criteria. 

The likelihood of external initiating events (by definition, they are outside the control of the 

facility) does not rely on any design features of the facility or process and is thus characterized 

only by a frequency of occurrence. In a qualitative method for assigning likelihood to these 

events, a qualitative score is associated with the external event based on its frequency of 

occurrence. Events with the same frequency of occurrence should have the same score 

regardless of the type of event or severity of its consequences. The method should thus include 

a table of the scores assigned based on qualitative frequency criteria. These criteria may 

include qualitative descriptions of frequency, such as “100-year flood” or “1,000-year 

earthquake,” or may include other qualitative criteria that can be correlated to a frequency, such 

as “design-basis earthquake” or “exceeds the mean annual rainfall by a factor of x.” By 

contrast, quantitative or semiquantitative methods may include quantitative descriptions of 

frequency such as “having a frequency less than 10-2 per year.” Because these events are 

beyond human control, no features have to be maintained to ensure the continued validity of the 

assigned likelihood. However, it may be necessary to periodically reexamine the basis of these 

likelihoods if it is reasonably expected that the likelihood could change (e.g., following 

construction of a new railroad spur next to the facility). Appendix D to Chapter 3 contains 

additional guidance applicable to initiating events that are natural phenomena. 

By contrast, the likelihood of internal initiating events other than IROFS failures depends on 

specific, identifiable characteristics of the facility or process design, such as those discussed in 

the following sections. Scores may be assigned to such events based either on objective 

evidence of their frequency of occurrence or on specific identifiable characteristics of the facility 
June 2015 3-B-4 NUREG-1520, Revision 2 

or process that can affect the frequency of occurrence. If the actual frequency of occurrence is 

known, this information should be used as it represents objective knowledge about the event 

likelihood and accounts for the cumulative effect of all characteristics that can affect likelihood. 

Otherwise, the features of the facility or process design that can affect the likelihood should be 

described. Regardless of the method used to assign a likelihood score, care must be taken that 

all facility and process features that can affect the event likelihood (reliability and availability 

qualities) are recognized as such and appropriately maintained. Appendix C to Chapter 3 

contains additional guidance applicable to internal initiating events other than IROFS failures. 

Similarly, the likelihood of internal initiating events that are IROFS failures also depends on 

specific, identifiable characteristics of the facility or process design. Scores may be assigned to 

such events based either on objective evidence of their frequency of occurrence or on specific 

identifiable characteristics of the IROFS that can affect the frequency of occurrence. If the 

actual frequency of occurrence is known, this information should be used. Otherwise, the 

features of the IROFS that can affect the likelihood should be described. Regardless of the 

method used to assign a likelihood score, care must be taken that all IROFS attributes that can 

affect the event likelihood (reliability and availability qualities) are recognized as such and 

appropriately maintained. The following provides guidance on specific reliability and availability 

qualities associated with individual IROFS. 

For both types of internal initiating events, facility or process features (or physical and chemical 

phenomena) that can affect the initiating event likelihood may be identified as initial conditions 

or bounding assumptions. The important factor is that these initial conditions and bounding 

assumptions must be identified and, if susceptible to change over the lifetime of the facility 

(such as through process deviations or facility changes), must be appropriately maintained. For 

example, the maximum throughput or inventory in a process may change; thus, measures 

should be in place to maintain this throughput or inventory if it is relied on to meet the 

performance requirements, whereas the flow of gravity or maximum density may not require 

specific controls. 

Individual IROFS 

Section 3.4.3.2(9) of Chapter 3 of this NUREG states that the reliability and availability qualities 

of individual IROFS include (1) safety margin in the controlled parameter, (2) the type of IROFS 

(passive or active engineered, simple or enhanced administrative), (3) the type and safety 

grading of any management measures, (4) whether the system is fail-safe, failure is 

self-announcing, or the IROFS is subject to periodic surveillance, (5) failure modes, (6) demand 

rate, and (7) failure rate. It is very important that any qualitative (or quantitative) method of 

likelihood evaluation consider all applicable IROFS attributes that could affect the reliability and 

availability of the IROFS, such as those discussed below. For example, reliance should not be 

based solely on the type of IROFS (passive engineered, active engineered, simple 

administrative, or enhanced administrative). 

In addition to those reliability and availability qualities discussed above, other factors may 

require consideration. For example, environmental conditions, such as extreme temperatures 

and pressures, corrosive atmosphere, excessive vibration, may have a significant effect on 

IROFS reliability and should be appropriately considered. 

The level of detail describing the IROFS in the ISA summary is also important. It would be 

acceptable to describe the IROFS at the system level if that is sufficient to demonstrate 

compliance with the performance requirements. The regulation in 10 CFR 70.65(b)(6) states 
June 2015 3-B-5 NUREG-1520, Revision 2 

that IROFS should be described “in sufficient detail to understand their functions in relation to 

the performance requirements.” It is important that the description be sufficiently detailed to 

identify all attributes of the IROFS that can affect its likelihood of failure, as well as everything 

that is within the boundary of the IROFS. It may not be necessary to specify the model number 

or exact design of a pump if the only attribute relied on to meet the performance requirement is 

the pumping capacity or oil reservoir volume. It may be sufficient to describe the pump as 

“centrifugal pump limited to less than 10 liters oil.” The IROFS boundary includes everything 

necessary for the IROFS to perform its intended safety function. For example, the boundary of 

an enhanced administrative IROFS includes all instrumentation (sensors, annunciators, 

circuitry, any controls activated by the operator) relied on to trigger the operator action; the 

boundary of a simple administrative control includes the equipment necessary to correctly 

perform the action; and the boundary of an active engineered control includes the attendant 

instrumentation, sensors, essential utilities, and any auxiliary equipment needed to perform its 

safety function. The reliability and availability qualities of every component within the IROFS 

boundary must be considered in evaluating the total IROFS likelihood. 

Additional guidance on some of the specific reliability and availability qualities of individual 

IROFS is provided below. 

Safety Margin in Controlled Parameter: “Safety margin” refers to the difference between the 

value of a parameter likely to be encountered during normal or credible abnormal conditions and 

the value that would allow an accident to be possible. The precise value of the margin in terms 

of the parameter is not meaningful; rather, for the event to be unlikely or highly unlikely based 

on safety margin, the margin should be several times larger than the expected process variation 

or uncertainty. Similarly, if the margin is much greater than the change in the parameter 

resulting from the worst case credible upset, this fact could be credited for ensuring that the 

event is unlikely or highly unlikely. 

The phrase “controlled parameter” indicates that means should be provided to ensure that the 

safety margin is continuously present, if the margin is relied on in evaluating likelihood. 

Parameters that are not controlled should be considered to be at their worst case credible 

values. 

Type of Control: Passive engineered controls are generally considered preferable to active 

engineered controls, active engineered controls preferable to enhanced administrative controls, 

and enhanced administrative controls preferable to simple administrative controls. This is 

because, ordinarily, passive engineered controls are the most reliable, and simple 

administrative controls are the least reliable. Although this is one of the factors that should be 

considered, evaluations of likelihood should not rely solely on the type of control. This is 

because the likelihood associated with passive engineered controls, for example, can vary 

widely depending on specific attributes of the IROFS. 

Type and Safety Grading of Management Measures: The specific management measures 

applied to an IROFS can have a significant effect on its overall likelihood. Of particular 

importance is surveillance, because this can have a direct and transparent effect on the duration 

of failure in a method that gives credit to duration of failure. It may not be necessary to specify 

the frequency of preventive maintenance, testing, and calibration quantitatively in the ISA 

summary. For example, to take credit for generic failure rates for a piece of equipment, it may 

be sufficient to specify that maintenance will be performed at a frequency and in a manner 

consistent with the manufacturer’s recommendations. Functional testing should be conducted 
June 2015 3-B-6 NUREG-1520, Revision 2 

in a manner that ensures that everything within the IROFS boundary is working as needed for 

the IROFS to perform its safety function. 

While the degree and type of management measures can increase or decrease the likelihood 

score associated with an IROFS, primary reliance should be on designing IROFS that have a 

certain reliability and then applying management measures to maintain that reliability. It should 

not be supposed that one can achieve any desired reliability by applying increasingly stringent 

management measures. 

 

Fail-Safe or Self-Announcing: This is the characteristic of an IROFS that determines the degree 

to which failure of an IROFS is detected and appropriately corrected. For the purpose of the 

ISA and ISA summary, an IROFS is considered to fail only when it fails to perform its intended 

safety function. Thus, a valve that is an IROFS is not considered to fail in the context of the 

accident sequence (i.e., to contribute to the progression of an accident sequence) as long as it 

fails in a safe configuration (fails-safe). If the valve is designed to fail closed (and closed is the 

safe configuration), credit may be taken for the fact that the valve is designed to fail closed. The 

likelihood thus is not the likelihood that the valve fails, but the likelihood that it fails in a way 

other than how it is designed to fail. An IROFS that is fail-safe may include within its boundary a 

system designed to put the process into a safe condition upon failure of a component. An 

IROFS whose failure is self-announcing is one in which failure is either self-revealing (e.g., by 

presence of solution on a floor where operators are continuously present) or results in an alarm 

to alert operators. The main effect for the ISA summary is to limit the duration of failure by 

ensuring that the upset condition is corrected essentially immediately. Similarly, surveillance 

may be relied on to limit the duration of failure to a specified period. 

Failure Modes: In addition to specifying the safety function that an IROFS must perform, it is 

necessary to consider the specific failure modes of the IROFS. A particular IROFS may be 

credited in several different accident sequences but may have different scores in each because 

of the differing failure modes leading to an accident. For example, a pipe may either plug or 

leak. A valve may leak, fail open, or fail closed. A complex piece of equipment such as a pump 

may have multiple different failure modes, each with a different likelihood, leading to several 

different accident sequences. The description of the accident sequence should clearly specify 

the conditions and failures that must occur for the undesired consequences to result. 

Demand Rate: Demand rate refers to the frequency with which an IROFS having a specified 

probability of failure on demand is required to perform its safety function. The number of times 

an IROFS is required to work can have a significant effect on its likelihood of failure. For 

example, a particular administrative control may have a certain failure likelihood. However, 

whether the accident sequence is “not unlikely,” “unlikely,” or “highly unlikely” will depend on the 

frequency with which the action is performed. If the action is required several hundred times a 

year, then occurrence of the initiating event will be significantly more likely than if the action is 

required once per year. Similarly, a passive control (such as the integrity of a storage container) 

may have a certain failure likelihood. However, if there are a thousand such containers in a 

storage array, then the likelihood that any one container will leak is much greater than if there is 

only one such container. Care must be taken to specify whether the initiating event is the leak 

of a particular container, or any one container, in the array. 

Failure Rate: Failure rate refers to the frequency with which a continuously demanded item is 

observed to fail. In a qualitative method for likelihood evaluation, the failure rate is described in 

terms of qualitative descriptors (e.g., “several failures per year,” “a few failures during facility 

lifetime,” “no failures in 30 years for tens of similar IROFS in industry”) used in the assignment 
June 2015 3-B-7 NUREG-1520, Revision 2 

of qualitative likelihood scores (e.g., -1, -2, -3; A, B, C). This information is often not available 

with any precision, but when available, it should be used along with other qualitative information 

in the assignment of scores. This is because the failure rate represents an objective measure of 

the cumulative effect of all the reliability and availability qualities of the system. (See the 

discussion of qualitative and quantitative information below.)

This is not intended to be a comprehensive list of all facility- or process-specific factors that can 

affect the failure likelihood of individual IROFS. 

Accident Sequences 

Section 3.4.3.2(9) of this SRP states that there are other reliability and availability qualities that 

relate to characteristics of the entire system of IROFS credited in the accident sequence. This 

is because the accident sequence likelihood is not just a function of the likelihood of failure of 

the individual IROFS, but also of the relationship between the IROFS. 

Additional guidance on some of the specific reliability and availability qualities applicable to the 

accident sequence as a whole is provided below. 

Defense in Depth: Defense in depth is the degree to which multiple IROFS or systems of 

IROFS must fail before the undesired consequences (e.g., criticality, chemical release) can 

result. IROFS that provide for defense in depth may be either independent or dependent, 

although IROFS should be independent whenever practical because of the possibility that the 

reliability of any single IROFS may not be as great as anticipated. This will make the results of 

the risk evaluation more tolerant of error. In addition, IROFS must be independent if the method 

for likelihood determination assumes independence (such as methods relying on summation of 

indices). IROFS are independent if there is no credible single event (common-mode failure) that 

can cause the safety function of each IROFS to fail. Multiple independent IROFS generally 

provide the highest level of risk reduction. The degrees of redundancy, independence, and 

diversity are important factors in determining the amount of risk reduction afforded by the 

system of IROFS. 

Degree of Redundancy: Defense in depth is provided by specifying redundant IROFS that 

perform the same essential safety function. Redundant IROFS may be either diverse or 

nondiverse; it is not necessary for them to consist of identical equipment or operator actions. 

However, when identical equipment or operator actions provide redundancy, it is important to 

ensure that all credible common-mode failures have been identified. 

Degree of Independence: To qualify as independent, the failure of one IROFS should neither 

cause the failure nor increase the likelihood of failure of another IROFS. No single credible 

event should be able to defeat the system of IROFS such that an accident is possible. A 

systematic method of hazard identification should thus be used to provide a high degree of 

assurance that all credible failure mechanisms that could contribute to (i.e., by initiating or failing 

to prevent or mitigate) an accident have been identified. Methods commonly used for likelihood 

evaluation almost always assume that the chosen IROFS are independent. Examples of these 

methods include layer of protection analysis and the index method in Appendix A to this report. 

In a few cases, it may not be feasible to entirely eliminate the possibility of dependent failures. 

Methods that rely on independent IROFS should not be used to evaluate the likelihood of 

systems of IROFS with dependent failures. (Guidance applicable to the rare system with 

dependent failures is provided below.) If, however, the common-cause failure is sufficiently 

unlikely, it may be possible to treat IROFS as independent for purposes of the ISA and ISA 
June 2015 3-B-8 NUREG-1520, Revision 2 

summary, as discussed below. Because of the added requirement to meet the 

double-contingency principle, this approach will not be valid for criticality accident sequences 

when the requirements of 10 CFR 70.64(a)(9) apply. 

Many factors can lead to IROFS not being independent, and these factors can have a significant 

effect on the likelihood of an accident sequence. A partial list of conditions that will almost 

always lead to two or more IROFS not being independent follows: 

 The same individual performs administrative actions. 

 Two different individuals perform administrative actions but use the same equipment 

and/or procedures. 

 Two engineered controls share a common hardware component or common software. 

 Two engineered controls measure the same physical variable using the same model or 

type of hardware. 

 Two engineered controls rely on the same source of essential utilities (e.g., electricity, 

instrument air, compressed nitrogen, water). 

 Two engineered controls are collocated such that credible internal or external events 

(e.g., structural failure, forklift impacts, fires, explosions, chemical releases) can cause 

both to fail. 

 Administrative or engineered controls are susceptible to failure because of the presence 

of credible environmental conditions (e.g., two operator actions defeated by corrosive 

atmosphere, sensors rendered inoperable because of high temperature). 

The presence of any of these conditions does not necessarily mean that the IROFS cannot be 

considered independent, but the applicant should provide additional justification demonstrating 

the lack of common-mode failure. The likelihood of such conditions in relation to the overall 

likelihood of an accident should be factored into the determination of the significance of the 

common-mode failure. 

Diversity: Diversity is the degree to which IROFS that perform different safety functions provide 

defense in depth. This means that different types of failures must occur before an accident is 

possible. Diverse controls may consist of controls on different parameters or different means of 

controlling the same parameter. In choosing redundant controls, preference should be given to 

diverse means of control, because they are generally less susceptible to common-mode failure 

than are nondiverse means. However, it is still necessary to consider all credible failure modes 

of the system when evaluating the overall likelihood of failure. 

Vulnerability to Common-Cause Failure: Diverse means of control should be provided 

whenever practicable to minimize the potential for common-mode failure. For example, Chapter 

5 of this SRP states that for criticality protection, a two-parameter control should be considered 

preferable to two controls on one parameter. Where a two-parameter control is not practicable, 

diverse means of controlling a single parameter should likewise be considered preferable to two 

redundant controls on that single parameter. 
June 2015 3-B-9 NUREG-1520, Revision 2 

It is not always possible to provide absolute assurance that IROFS are perfectly independent. 

However, if the cumulative likelihood of all common-mode failures of a system of IROFS is 

significantly less than the independent failure of the system of IROFS, then the IROFS may be 

treated for all practical purposes as independent. Quantitatively, this means that the likelihood 

of the common-cause failure should be at least two orders of magnitude less than that of the 

independent failure of the system of IROFS. Qualitatively, this means that the likelihood of the 

common-cause failure should be sufficiently low that it does not change the score for the system 

of IROFS. 

If credible common-mode failures cannot be neglected, as discussed above, then they must be 

considered in evaluating the overall accident sequence likelihood. A likelihood evaluation 

method (whether quantitative or qualitative) that correctly treats dependent failures should be 

used when such failures are present. 

In general, the probability of failure of a system of two IROFS may be expressed as: 

PAB P AB P AB PAPB P AB ind dep dep (,) (,) (,) ()() (,)    

That is, there is a component to the likelihood that is the independent failure of IROFS A and B 

and a component that represents the common-mode failure of IROFS A and B. Independent 

failure of the IROFS is represented by the product P(A)P(B). Therefore, the condition that the 

two IROFS be considered independent may be expressed as: 

P(,) ()() A B  P A P B

or equivalently 

P AB PAPB dep (,) ()()  

A variety of different methods may be used to treat dependent failures when the conditions 

above are not met. For example, in a quantitative method, the likelihood of the common-mode 

event may be estimated and factored into the above equation. In a qualitative scoring method, 

the likelihood score may be increased to reflect the existence of a common-mode failure. (In a 

qualitative scoring method similar to that employed in Appendix A to Chapter 3 of this SRP, 

summation of individual IROFS scores to determine the overall accident sequence score is 

permissible only if the IROFS are independent. Such a method assumes that independence 

should be modified as needed to correctly treat common-mode failures.) In the layer of 

protection analysis method, only the independent IROFS are credited in evaluating the overall 

accident sequence likelihood. In a qualitative fault tree method, the common-mode failure may 

be included as an additional basic event in the fault tree. It is permissible then to treat the 

independent failure of the system of IROFS as one accident sequence and the dependent 

failure as another. The method used to treat dependent failures should be appropriately 

justified.

Qualitative criteria may be used to assess the effect of dependent failures on likelihood scores. 

The effect of qualitative performance-shaping factors should be considered in these criteria. For 

example, repeated failures of identical administrative IROFS (e.g., multiple batching, multiple 

valving, or spacing violations) should not be considered to be independent nor receive the same 

score without substantial justification, as discussed below. This is because the likelihood of 

subsequent human failures increases once the initial failure has occurred. The set of factors 
June 2015 3-B-10 NUREG-1520, Revision 2 

that could contribute to multiple administrative failures may include inadequate or out-of-date 

procedures, poor training, environmental distractions, and poor human factors design. For the 

same reason, the possibility of two different administrative failures by the same individual should 

be carefully considered for common-mode vulnerability. In assessing the vulnerability of these 

actions to common-mode failure, consideration may be given to any recovery factors that may 

be in place to interrupt the sequence of failures (e.g., supervisory checking, inspection, 

independent verification). Such recovery factors should be treated as measures that enhance 

the reliability of the administrative IROFS or ensure that repeated failures may be considered to 

be independent. In particular, independent verification of one administrative IROFS should not 

be used as a separate IROFS in the same accident sequence. For the same reasons as cited 

above, verification that an action has been performed correctly would be susceptible to the 

same factors that caused the initial failure. In addition, verification of an action is likely to be 

more cursory and, therefore, less reliable than performance of the original action. Moreover, in 

the event that the first action was performed correctly, the independent verification of that first 

action would not contribute to meeting the performance requirements, and therefore, the first 

action would constitute a sole IROFS. Thus, independent verification should be used only to 

increase the reliability of an IROFS and should not be treated as a separate IROFS nor credited 

with the same level of risk reduction. 

In addition to the above, for criticality accident sequences required to comply with the 

double-contingency principle (see appendix 5-A of this SRP). 

Use of Quantitative and Qualitative Information 

Section 3.4.3.2(9) of this SRP acknowledges that a mix of quantitative and qualitative 

information is often available to an analyst performing an ISA. This SRP includes a list of some 

types of objective quantitative information and states that this information should be considered 

in evaluating likelihood, even in purely qualitative methods. The information listed includes 

(1) reports of equipment failures or procedural violations, (2) surveillance intervals, (3) functional 

testing intervals or audit frequencies, (4) time required to render the system safe, and 

(5) demand rates. In a purely qualitative method, such information, to the extent it is available, 

should be considered qualitatively. One example of this is using surveillance periods as part of 

the justification for qualitative duration indices (as in Appendix A to Chapter 3 of this SRP). 

In using such objective data, facility-specific data are preferable to generic data, and 

process-specific data are preferable to facility-specific data because of the many environmental 

and other factors that can affect likelihood. For example, a manufacturer may have certified a 

particular pump with a given reliability rating, but the actual performance in process will depend 

on maintenance, electrical and mechanical loading, type of oil, ambient temperature, and 

vibration, among other factors. While more specific data are preferable, typically, the more 

specific the conditions, the fewer data are available. The amount and specificity of the data 

should be given appropriate weight in evaluating likelihood. For example, the use of generic 

failure data for a specific type of valve may be acceptable if an appropriately bounding value 

(i.e., the less conservative extreme of a range of values) is used. A less bounding value may be 

acceptable if information is available from the manufacturer on the specific model of valve. An 

even less bounding value may be acceptable if sufficient operating experience is available to 

support facility- or process-specific values. Sufficient margin to bound uncertainties in failure 

rates should be provided when relying on generic information. 

Operating history may be credited in justifying likelihood scores for individual IROFS. Care 

must be taken that this credit is based on documented performance data and not anecdotal 
June 2015 3-B-11 NUREG-1520, Revision 2 

evidence and that the operating history is applicable to the event being evaluated. For example, 

not having any criticality accidents in 30 years of operation would not be justification for a failure 

frequency for a particular component or initiating event (since the initiating event may have 

occurred several times during that time period without resulting in a criticality). It would also not 

be justification for a likelihood corresponding to a time between failures longer than 30 years. In 

addition, if significant facility changes occurred over the previous 30 years of operation, this 

information may not be meaningful. The limits and applicability of the operating data used to 

justify likelihood should be explained. 

Especially for new processes or facilities, such objective quantitative data may not be available. 

Appropriate margin in plant operations and conservatism in likelihood scoring should be used 

and justified when such information is not available. Over the facility lifetime, however, 

information gained with regard to operational events and IROFS failures should be evaluated 

and fed back into the ISA process. This may be justification for reducing margins and 

conservatism over the facility lifetime. 

Graded Approach to Integrated Safety Analysis 

The performance requirements of 10 CFR 70.61(b) and (c) establish an acceptable level of risk, 

in that high-consequence events must be made “highly unlikely” and intermediate-consequence 

events must be made “unlikely.” In addition, 10 CFR 70.65(b)(4) requires that an applicant’s 

ISA summary contain a demonstration of compliance with the performance requirements of 

10 CFR 70.61. The means and the level of effort required to demonstrate compliance with 

10 CFR 70.61 depend on the amount of risk reduction needed to meet the likelihood thresholds 

in that regulation. For example, a facility that obviously has inherently low risk (even before the 

performance of the ISA) requires less effort to demonstrate compliance than an inherently 

higher risk facility. Examples would include facilities with small mass or very low enrichment of 

special nuclear material, low chemical inventories, or insignificant combustible loading. Thus, 

the ISA methods used may be graded commensurate with the risk of the facility. 

The facility and process characteristics that determine inherent risk should be identified as initial 

conditions and/or assumptions and appropriately identified and maintained to ensure that they 

will be present over the lifetime of the facility, if credit is taken for them in meeting the 

performance requirements. For example, a possession limit on the maximum enrichment or 

amount of special nuclear material at the facility may be credited in ensuring low risk of 

criticality, because the license sets an explicit limit. Chemical inventories may be likewise 

credited, provided that they are limited by license or the maximum inventory is identified as 

important to safety and rigorously controlled. ISA methods may be graded commensurate with 

the amount of risk reduction required once these factors have been explicitly identified and 

maintained. 

The following are examples of aspects of the ISA process that may be graded commensurate 

with risk: 

 In the selection of the hazard identification method, the what-if or what-if/checklist 

method would be more suitable for low-risk, simple operations; hazardous operations, 

fault tree, and other sophisticated methods may be appropriate for more complex or 

higher risk operations. 

 In the evaluation of the type, number, and robustness of IROFS, lower risk facilities will 

not require the same level of control. 
June 2015 3-B-12 NUREG-1520, Revision 2 

 In the application of management measures, lower risk facilities will not require 

measures as stringent as those for higher risk facilities. 

 In the evaluation of likelihood, the technical justification required to support a high 

degree of risk reduction is much greater than that required to support a low or moderate 

degree of risk reduction. Methods used to support a high degree of risk reduction should 

be more sophisticated, and warrant greater regulatory scrutiny, than methods used to 

support a lower degree of risk reduction. 

In addition to the inherent risk of the facility or process, the amount of conservatism may be 

considered in grading ISA methods. For example, if a very conservative likelihood is assumed 

for all IROFS failures, then the rigor and level of detail in describing the IROFS, considering all 

reliability and availability qualities and treating dependent failures, would not have to be at the 

same level as in a facility taking more realistic credit for IROFS failures. The grading of ISA 

methods necessitates that the applicant demonstrate (1) that the risk is inherently low and will 

be maintained over the lifetime of the facility, or (2) that there is a consistent and dependable 

amount of conservatism in ISA methods that offsets the uncertainty arising from lack of rigor. 

Regulatory Basis

The risk of each credible high-consequence event must be limited. Engineered controls, 

administrative controls, or both shall be applied to the extent needed to reduce the likelihood of 

occurrence of the event so that, upon implementation of such controls, the event is highly 

unlikely or its consequences are less severe than those described in 10 CFR 70.61(b)(1–4). 

The risk of each credible intermediate-consequence event must be limited. Engineered 

controls, administrative controls, or both shall be applied to the extent needed so that upon 

implementation of such controls, the event is unlikely or its consequences are less than those 

described in 10 CFR 70.61(c)(1–4). 

Each licensee or applicant shall conduct and maintain an ISA that is of appropriate detail for the 

complexity of the process and that identifies “the consequences and likelihood of occurrence of 

each potential accident sequence...and the methods used to determine the consequences and 

likelihoods,” as stated in 10 CFR 70.62(c)(1)(v). 

The ISA summary must contain “information that demonstrates the licensee’s compliance with 

the performance requirements of Section 70.61,” as stated in 10 CFR 70.65(b)(4). 

The ISA summary must also include the definitions of “unlikely,” “highly unlikely,” and “credible” 

as used in the evaluations of the ISA, as stated in 10 CFR 70.65(b)(9). 

Technical Review Guidance

The reviewer should use the information contained in this appendix, as applicable, to evaluate 

an applicant’s or a licensee’s qualitative methods of likelihood evaluation, commensurate with 

the level of risk reduction required to comply with the performance requirements of 

10 CFR 70.61. If the applicant is using the index method defined in Appendix A to Chapter 3 of 

this SRP, the reviewer should use the guidance in Appendix A to evaluate the adequacy of the 

applicant’s ISA summary. The purpose of the ISA summary review is not to verify the 
June 2015 3-B-13 NUREG-1520, Revision 2 

correctness of the likelihood scores for every single accident sequence, but to verify that the 

applicant has an acceptable methodology that contributes to reasonable assurance of 

maintaining an adequate safety basis over the facility lifetime, by ensuring that the methodology 

results in assignment of appropriate likelihoods. Thus, the reviewer should primarily determine 

whether there is a justifiable basis for the scores, and whether there is reasonable assurance 

that this basis will be maintained over the facility lifetime, assuming the application of 

appropriate management measures. 

The applicant’s qualitative method for likelihood evaluation should be acceptable if the following 

are true: 

 The definitions of likelihood are clear, are based on objective criteria, and can 

consistently distinguish events in different likelihood categories. 

 The methods for likelihood evaluation are consistent with the likelihood definitions and 

the process being evaluated (e.g., the methods correctly treat initiating events and initial 

conditions, subsequent failures, and dependent failures). 

 The methods for likelihood evaluation appropriately consider all availability and reliability 

qualities of individual IROFS and the interdependencies between them in assigning 

qualitative likelihood scores. 

 The ISA summary describes initiating events, initial conditions, and subsequent IROFS 

failures in detail sufficient to demonstrate that the performance requirements will be met 

and maintained. 

Recommendations

This guidance should be used to supplement Chapter 3 and Appendix A to this SRP. 

References

U.S. Code of Federal Regulations, Title 10, “Energy,” Part 70, “Domestic Licensing of Special 

Nuclear Material.” 

U.S. Nuclear Regulatory Commission, “Standard Review Plan for the Review of an Application 

for a Mixed Oxide (MOX) Fuel Fabrication Facility,” NUREG-1718, August 2000. 

June 2015 3-C-1 NUREG-1520, Revision 2 

APPENDIX C 

INITIATING EVENT FREQUENCY 

Purpose

This appendix addresses the measures needed to ensure the validity and maintenance of the 

initiating event frequencies (IEFs) used to demonstrate compliance with Title 10 of the Code of 

Federal Regulations (10 CFR) 70.61, “Performance Requirements.” 

 

Introduction

The purpose of this appendix is to clarify the use of IEFs for demonstrating compliance with the 

performance requirements of 10 CFR 70.61. NUREG-1718, “Standard Review Plan for the 

Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” issued 

August 2000, and this Standard Review Plan (SRP) provide methods for reviewing integrated 

safety analyses (ISAs) by employing a semi-quantitative risk index method. While one of these 

methods is described below to illustrate the use of IEFs, applicants and licensees may use other 

methods that would produce similar results. No particular method is explicitly mandated, and 

sequences that are risk significant or marginally acceptable are candidates for more detailed 

evaluation by the applicant or licensee and reviewer. 

Discussion

Each licensee or applicant is required to perform an ISA to identify all credible highconsequence and intermediate-consequence events. The risk of each such credible event is to 

be limited through the use of appropriate engineered and/or administrative controls to meet the 

performance requirements of 10 CFR 70.61. Such a control is referred to as an item relied on 

for safety (IROFS). In turn, a safety program must be established and maintained to ensure that 

each IROFS is available and reliable to perform its intended function when needed. The safety 

program may be graded such that the management measures applied are graded 

commensurate with the reduction of risk attributable to that item. In addition, a configuration 

management system must be established pursuant to 10 CFR 70.72, “Facility Changes and 

Change Process,” to evaluate changes and to ensure, in part, that the IROFS are not removed 

without at least equivalent replacement of the safety function. 

The risk of each credible event is determined by cross-referencing the severity of the 

consequence of the unmitigated accident sequence with the likelihood of occurrence in a risk 

matrix with risk index values. The likelihood of occurrence risk index values can be determined 

by considering the criteria in Tables A-9 through A-11 in Appendix A to Chapter 3 of this SRP. 

Accident sequences result from initiating events that are followed by the failure of one or more 

IROFS. Initiating events can be (1) an external event such as a hurricane or earthquake, (2) a 

facility event external to the process being analyzed (e.g., fires, explosions, failures of other 

equipment, flooding from facility water sources), (3) deviations from normal operations of the 

process (credible abnormal events), or (4) failures of an IROFS in the process. (Appendix D to 

Chapter 3 offers additional guidance regarding initiating probabilities from natural phenomena 

hazards.) 
June 2015 3-C-2 NUREG-1520, Revision 2 

An initiating event does not have to be an IROFS failure. An item becomes an IROFS only if the 

ISA credits it for mitigation or prevention per the definition in 10 CFR 70.4, “Definitions.” If an 

item whose failure initiates an event has strictly an operational function, it does not have to be 

an IROFS. This applies to external events and can apply to internal events. If the item whose 

failure initiates an event has solely a safety function that is credited in the ISA, then it should be 

an IROFS. If the item has both an operational and a safety function, the safety function should 

make it an IROFS (for its ISA-credited safety features only). 

IEFs can play a significant role in determining whether the performance requirements of 

10 CFR 70.61 are met for a particular accident sequence. Whether an initiating event results 

from an IROFS or a non-IROFS failure, licensees should take appropriate action to ensure that 

any change to the basis for assigning an IEF value to that event is evaluated on a continuing 

basis to ensure continued compliance with the performance requirements. For example, a 

non-IROFS component may not be subject to the same quality assurance (QA) program 

controls and other management measures that an IROFS would receive (i.e., surveillance, 

testing, procurement). However, appropriate management controls should be considered, in a 

graded manner, to provide assurance that performance requirements are met over time. The 

ability to identify a non-IROFS component failure, similar to that for IROFS, may be needed to 

provide feedback on failure rates and IEFs to the ISA process. Changes to the IEF values may 

result from changes to a component’s design, procurement, operation, or maintenance history, 

as well as new or increased external plant hazards, and should be considered in a graded 

approach. 

Regulatory Basis 

This guidance relies on the following regulatory bases: 

 10 CFR 70.61 

 10 CFR 70.62, “Safety Program and Integrated Safety Analysis” 

 10 CFR 70.65, “Additional Content of Applications” 

 10 CFR 70.72, “Facility Changes and Change Process” 

Applicability

This guidance is for use in those cases where an applicant or licensee chooses to use an 

IROFS or non-IROFS failure IEF for risk determination. 

Technical Review Guidance 

1. Initiating Event Frequency and Identification of an IROFS 

 Example 

A licensee uses a heater/blower unit to heat a uranium hexafluoride (UF6) cylinder in a 

hot box to liquefy the contents before sampling. The unmitigated accident sequence 

involves the failure of the controller for the heater/blower resulting in overheating of the 

cylinder. This results in the cylinder becoming overpressurized and rupturing, which 

releases the UF6 to the surrounding process area. Analysis of such a release indicates 

that it would exceed the performance requirements of 10 CFR 70.61. The licensee has 

two basic choices: (1) assume that the initiating event probability equals 1 and provide 
June 2015 3-C-3 NUREG-1520, Revision 2 

an appropriate level of mitigation or prevention solely through one or more IROFS or 

(2) assign a value to the initiating event (blower/heater controller failure) and provide one 

or more preventive or mitigative IROFS to bring the accident sequence risk within the 

performance requirements. 

If the licensee chooses the second option and assigns an appropriate value to the IEF, 

the indices of Table A-9 in Appendix A to Chapter 3 of this SRP may be used. The 

controller for the heater/blower unit would be assigned an appropriate frequency index 

number. The licensee would then analyze the accident sequence and determine 

whether additional IROFS are necessary to meet the performance requirements. There 

are now two variables that feed into the risk determination: one or more IROFS 

controllers for the heater/blower unit in a manner that changes the licensee’s previous 

determination of compliance with the performance requirements must be evaluated per 

10 CFR 70.72(a). 

2. Initiating Event Frequency Index Use 

Indices may be used to determine the overall likelihood of an accident sequence. 

Table A-9 of Appendix A to Chapter 3 of this SRP identifies frequency index numbers 

based on specified evidence. The evidence used by applicants and licensees should be 

supportable and documented in the ISA summary as required by 10 CFR 70.65(b)(4). 

The evidence cited in the ISA documentation should not be limited to anecdotal 

accounts and must demonstrate compliance with the definitions of “unlikely,” “highly 

unlikely,” and “credible” as required by 10 CFR 70.65(b)(9). The rigor and specificity of 

the documented evidence should be commensurate with the item’s importance to safety, 

and the data should support the frequency chosen (e.g., data from 30 years of plant 

operating experience based on a single component typically could not be expected to 

support a 10-2 failure probability). 

An item’s failure rate should be determined from actual data for that specific component 

or safety function in the current system design under the current environmental 

conditions. When specific failure data are limited or not available, the applicant or 

licensee may use more “generic” data with appropriate substantiation. However, when 

less specific failure data are available, appropriate conservatism should be exercised in 

assigning frequency indices. The footnote to Table A-9 that states “Indices less than 

(more negative than) -1 should not be assigned to IROFS unless the configuration 

management, auditing, and other management measures are of high quality, because 

without these measures, the IROFS may be changed or not maintained” should also be 

applied to non-IROFS IEFs. In this case, appropriate management controls should be 

provided to ensure that any changes to the evidence supporting IEF indices will be 

identified and promptly evaluated to ensure that the performance requirements of 

10 CFR 70.61 are met. A graded approach may be used in applying management 

controls based on the IEF values; however, the ISA summary should explain how this 

will be done. 

The licensee or applicant should periodically evaluate possible changes to IEFs, failure 

rates, and the assumptions they are based on to ensure that the ISA process has 

accounted for any change to an IEF. Over time, an IEF may change because of 

component aging or deterioration. Maintenance and performance experience should be 

fed back into the IEF evaluation. IEF changes could involve, for example, the 

introduction of new effects or hazards from nearby processes or new materials or 
June 2015 3-C-4 NUREG-1520, Revision 2 

changes in design, maintenance, or operation activities. The applicant or licensee 

should establish management measures, which may be graded, to periodically confirm 

that the ISA assumptions have not changed. For example, an applicant or licensee may 

choose to verify that there have been no changes to hazards from maintenance activities 

during a certain period of time based on an appropriate documented technical review or 

audit under the QA program. 

Whatever strategy the applicant or licensee chooses should result in timely identification 

and periodic evaluation of failure rates, followed by a prompt evaluation of the failure 

rate change on the ISA assumptions. This can be accomplished in accordance with the 

corrective maintenance program and/or the QA problem identification and corrective 

action system. 

Indices particularly relied on (i.e., less than -1) for overall likelihood will be examined 

during the ISA review process. 

3. External Initiating Event Frequencies 

The applicant or licensee should periodically evaluate possible changes to nonnatural 

phenomena external events to ensure that the ISA process has accounted for any 

change to an IEF. Such changes could involve, for example, the introduction of new 

hazards from an adjoining industrial site or changes in adjoining transportation activities. 

The applicant or licensee should establish management measures, which may be 

graded, to periodically confirm that the ISA assumptions have not changed. For 

example, an applicant or licensee may choose to verify that external hazards have not 

changed based on a 2- to 3-year review under the QA program. 

4. Assurance 

The safety program required by 10 CFR 70.62(a) should have provisions for 

implementing the appropriate management controls to maintain the validity of the IEFs. 

Consideration should also be given to commitments in the QA program or a specific 

license condition. 

References

U.S. Code of Federal Regulations, Chapter I, Title 10, “Energy,” Part 70, “Domestic Licensing of 

Special Nuclear Material.” 

U.S. Nuclear Regulatory Commission, “Standard Review Plan for the Review of an Application 

for a Mixed Oxide (MOX) Fuel Fabrication Facility,” NUREG-1718, August 2000.
June 2015 3-D-1 NUREG-1520, Revision 2 

APPENDIX D 

NATURAL PHENOMENA HAZARDS 

Purpose

This appendix provides additional guidance addressing accident sequences that may result 

from natural phenomena hazards in the context of a license application or an amendment 

request under Title 10 of the Code of Federal Regulations (10 CFR) Part 70, “Domestic 

Licensing of Special Nuclear Material,” Subpart H, “Additional Requirements for Certain 

Licensees Authorized To Possess a Critical Mass of Special Nuclear Material.” 

Introduction 

This appendix provides additional guidance for reviewing the applicant’s (or licensee’s) 

evaluation of natural phenomena hazards up to and including “highly unlikely” events for both 

new and existing facilities. 

Discussion

For facilities processing special nuclear materials, 10 CFR 70.61, “Performance Requirements,” 

requires that individual accident sequences resulting in high consequences to workers and the 

public be “highly unlikely” and that sequences resulting in intermediate consequences to these 

receptors be “unlikely.” Although the regulations establish the threshold levels that differentiate 

high-consequence events from intermediate-consequence events, they do not define “highly 

unlikely” and “unlikely.” According to 10 CFR 70.65(b)(9) and subject to staff approval, the 

integrated safety analysis (ISA) summary submitted by applicants and licensees must include 

definitions of these terms. Chapter 3 of this NUREG further describes the acceptance criteria 

for the definitions of these terms. 

The implementation of these requirements may vary somewhat because of different definitions 

of likelihood proposed by different applicants (or licensees).1

 The regulation specifies 

quantitative consequence thresholds of the performance requirements (except for chemical 

releases). The regulation and its performance requirements pertain to existing facilities, as well 

as proposed facilities, and apply to manmade external hazards and natural phenomena 

hazards, in addition to process hazards. However, new facilities and new processes at existing 

facilities must also address the requirements of 10 CFR 70.64, “Requirements for New Facilities 

or New Processes at Existing Facilities,” which includes the baseline design criterion for natural 

phenomena hazards (10 CFR 70.64(a)(2)). This baseline design criterion requires that “the 

design must provide for adequate protection against natural phenomena with consideration of 

the most severe documented historical events for the site.” The Statement of Considerations 

describes the application of the baseline design criteria as consistent with good engineering 

practice, which dictates that certain minimum requirements should be applied to design and 

safety considerations. The baseline design criteria must be applied to the design of new 

 

1

 For natural phenomena, deterministically defined events such as the probable maximum flood (PMF) or 

safe-shutdown earthquake (SSE), which are used as reactor design bases, can also be applied to 10 CFR Part 70 

facilities as “highly unlikely” events. The actual probability (or likelihood) of such events may be difficult to define 

quantitatively and varies from site to site. 
June 2015 3-D-2 NUREG-1520, Revision 2 

facilities and new processes at existing facilities but does not require retrofits to existing facilities 

or existing processes (e.g., those housing or adjacent to the new processes). Also included in 

10 CFR 70.64(b) are a requirement for incorporation of defense in depth in design and a 

requirement to prefer engineered controls over administrative controls. 

New structures associated with facilities being reviewed, such as the gas centrifuge facilities 

and the mixed oxide fuel fabrication facility, will be designed and constructed to meet the 

seismic regulatory requirements. Hence, these facilities and additional new facilities to be 

licensed under 10 CFR Part 70 are not expected to present designs with seismic deficiencies. 

New facilities can also be expected to be sited above a “highly unlikely” flood such as the PMF 

and can be expected to withstand tornado winds and missiles, if necessary. 

Most structures at existing nuclear fuel cycle facilities are built to a model building code, which 

includes meeting a design-basis earthquake having an exceedance probability of 2x10-3 per 

year to less than 10-3 per year (U.S. Department of Energy (DOE) Standard-1020-2002, 

“Natural Phenomena Hazards Design and Evaluation Criteria for Department of Energy 

Facilities,” Appendix C). Existing facilities are generally sited above the 100-year flood plain 

and are designed for wind as well as snow and ice loading as specified in applicable building 

codes. Extreme natural events such as “highly unlikely” floods and/or earthquakes have not 

been calculated for many existing sites, and it would be expensive and time consuming to do 

so. 

The staff believes that many existing facilities can be shown to be in compliance with, or at least 

near compliance with, the performance requirements of the regulation by accounting for 

conservatisms in the seismic, flooding, and wind design of the facility. In addition, relatively 

minor engineered improvements and administrative measures may further enhance safety, at 

least with respect to the public and other offsite receptors. 

Seismic Hazards 

Potential damage to and/or failure of items relied on for safety (IROFS) as the result of ground 

movement and/or the seismic response of adjacent or interior IROFS must be considered in the 

ISA and ISA summary accident sequence evaluations. Damage or failures that also should be 

considered include the following: 

 seismic-induced failure of a facility component that is not an IROFS but that can fall and 

damage an IROFS (for example, a heavy load drop from a crane onto a container) 

 displacement of adjacent IROFS during a seismic event causing them to pound together 

 displacement of adjacent components resulting in failure of connecting pipes or cables 

which may cause flooding, fires, and/or releases of radiological or chemical materials 

Seismic event evaluations should also consider potential multiple failure of IROFS (for example, 

multiple failures of tanks). 

DOE has also recognized the difference between earthquake design probability and the 

probability that a safety component cannot perform its function. To quantify this difference, 

DOE has developed a risk reduction factor, R, as the ratio between the seismic hazard 

exceedance probability and the performance goal probability. Conservatism in nuclear facility 

design arising from factors such as use of prescribed analysis methods, specification of material 
June 2015 3-D-3 NUREG-1520, Revision 2 

strengths, and limits on inelastic behavior explains at least part of this apparent reduction in 

actual risk. Appendix C to DOE Standard-1020-2002 discusses this risk reduction factor. 

For a consequence to affect the public or external site workers, licensed material or hazardous 

chemicals that could affect the safety of licensed material must be released through at least 

one, and often two, confinement barriers, such as the following: 

 storage containers, glove boxes, tanks, or handling devices 

 ventilation system dynamic confinement and filtration 

 building structural shell 

Criticalities, on the other hand, may result from the introduction of a moderator or loss of safe 

geometric control of confined materials. 

By using risk reduction factors calculated for a facility and its specific components and/or 

estimating the degree of failure by comparison with the observed behavior of similarly 

constructed buildings during severe earthquakes, analysts can postulate reasonable scenarios. 

These scenarios may not release all the material at risk or present an unimpeded leak path to 

receptors. For example, some facilities might be able to show that, even in the case of an 

earthquake that is “highly unlikely,” only certain types of containers or confinement systems are 

likely to be breached. If the amount of material contained in such containers is variable, then 

that probabilistic component may be factored into the overall likelihood of the accident 

sequence. If employing some of these mitigating considerations in the analysis requires 

reliance on special containers or procedures, then additional IROFS may also be needed. 

Another factor to consider is the likely rate of release based on the damage sustained. For 

example, some facilities may lose dynamic confinement but maintain building integrity. In some 

processes, radiologically and/or chemically hazardous material is held inside its primary 

containment at subatmospheric pressure. In these cases, even though the primary 

containments are inside a structure designed to withstand less than a “highly unlikely” 

earthquake, the subatmospheric conditions may be sufficient to limit both facility worker and 

offsite doses in the event of a greater earthquake. For example, an earthquake that results in 

limited subatmospheric containment losses may allow adequately trained workers to evacuate 

and/or take mitigative actions. The buildings containing cylinders of liquid uranium hexafluoride 

(UF6 ) at gas centrifuge facilities are designed for a “highly unlikely” earthquake. In addition, 

some buildings at one of the proposed facilities are equipped with a seismically activated 

interlock (an IROFS) that will shut off the buildings’ heating, ventilation, and air conditioning 

system during an event, thus limiting any leakage of UF6 to the outside. 

Flooding Hazards 

Most fuel cycle licensees do not require large quantities of cooling water and, therefore, do not 

need to be located near large bodies of water. A site licensed under 10 CFR Part 70 does not 

need to meet prescriptive flood protection requirements but does have to meet the performance 

requirements for all credible events including flooding. A site meeting the flood protection 

requirements of a commercial reactor should be considered as being designed or located 

adequately to withstand a “highly unlikely” flooding event. Section 2.4 of NUREG-1407, 

“Procedural and Submittal Guidance for the Individual Plant Examination of External Events 

(IPEEE) for Severe Accident Vulnerability,” issued June 1991, states that the design-basis flood 

(which for river sites is the PMF) as described in Regulatory Guide 1.59, “Design Basis Flooding 

for Nuclear Power Plants,” is estimated to have an exceedance frequency of less than 10-5 per 
June 2015 3-D-4 NUREG-1520, Revision 2 

year. Sites that do not meet this level of protection can still meet the 10 CFR 70.61 

performance requirements but must be considered on an individual basis. 

In an evaluation of the effects of flooding on existing facilities, the following flood-related 

hazards should be considered: 

 river flooding 

– inundation and hydrostatic loading 

– dynamic forces 

– wave action 

– sedimentation and erosion 

– ice loading 

 upstream dam failures 

– inundation and hydrostatic loading 

– dynamic forces 

– erosion and sedimentation 

 precipitation/local storm runoff 

– inundation (local ponding) and hydrostatic loading 

– dynamic loads (flash flooding) 

 tsunami, seiche, hurricane storm surge 

– inundation and hydrostatic loading 

– dynamic forces 

– wave action 

American National Standards Institute/American Nuclear Society Standard 2.8, “Determining 

Design Basis Flooding at Power Reactor Sites,” issued July 1992, describes methods for 

determining these flooding and water-related effects for reactor sites. These methods can be 

applied to 10 CFR 70.61 analyses with less conservatism in some of these parameters. 

A standard siting requirement for residential and commercial developments is to be above the 

100-year flood plain. For large river basins, warning time and time to secure materials and 

evacuate personnel will probably be available. For small streams, there may be relatively little 

warning in regard to thunderstorms and localized rainfall. In such cases, rapid actions may be 

the only administrative protection available. An evaluation of the effectiveness of proposed 

protection will need to consider the effects of inundation, hydrostatic loading, erosion, and 

sedimentation. At a minimum, this would require that criticality events be prevented and 

materials remain confined within site structures. 
June 2015 3-D-5 NUREG-1520, Revision 2 

At some sites, a delineation of the 500-year flood plain may also be available. If the site is 

above the 500-year flood plain, flooding may be considered an unlikely2

 event, depending on 

the quality of the estimate. In this category, criticality events should still be prevented, but the 

breaching of a limited number of material containers may be allowable under the performance 

requirements (up to 25 rem for the public, up to 100 rem for workers, and a specified release 

limit) for events that, in terms of likelihood, are between “unlikely” and “highly unlikely.” 

In addition to the facility’s location relative to the 100-year or 500-year flood plains, the effects of 

local intense precipitation and snow load should be considered. Local intense precipitation, 

especially in the form of snow, can result in roof collapse and localized site flooding. Normally, 

protection from local precipitation and snow is relatively easy to achieve through roof design and 

local site drainage design. 

Wind and Tornado Loading 

Wind design for an existing facility if prescribed by an applicable building code would have an 

annual exceedance probability of greater than or equal to 2x10-2. At such relatively high 

probabilities, tornado design criteria are not specified. However, depending on the geographic 

location of the facility, the effects of a tornado with an annual exceedance probability of 10-5 or 

greater may need to be considered. 

Wind forces on walls of structures should be determined using appropriate pressure 

coefficients, gust factors, and other site-specific adjustments. If the wind is likely to blow inside 

the structure, either through design or wind-driven missile vulnerability, the effects of wind on 

internal IROFS requires consideration. If the winds are from a tornado, the effects of the 

atmospheric pressure change associated with the tornado must be considered. Normally, 

ventilation systems are most vulnerable to atmospheric pressure change, but windows, buried 

tanks, and sand filters can also be affected. 

For straight winds, hurricanes, and weak tornadoes, missile criteria as specified in Table 3-3 of 

DOE Standard-1020-2002 may be considered. The missile specified is a 15-pound plank, 

measuring 2 inches by 4 inches, at a specified elevation and impact velocity. For facilities that 

may be subjected to more severe tornado missiles, the guidance in Tables 3-4 and 3-5 of DOE 

Standard-1020-2002 may be followed. For the tornado, a 3,000-pound automobile rolling and 

tumbling on the ground should also be considered. For such evaluations, the probability of the 

entire sequence should be considered, and missile criteria from either Table 3-4 or 3-5 of DOE 

Standard-1020-2002 may be used as appropriate. 

Considerations for Existing Processes at Existing Facilities 

For existing processes at existing facilities, licensees are not required to address 10 CFR 70.64 

baseline design criteria. However, they must still meet the performance requirements of 

10 CFR 70.61, including accidents caused by natural phenomena, for which the staff may 

require additional IROFS to meet the performance requirements. Existing facilities can use 

IROFS in the form of additional administrative controls to meet the performance requirements 

 

2 Even if the licensee defines “unlikely” as less than 10-3 per year for the process sequences in the ISA summary, the conservative 

assumptions inherent in most flood plain hydrologic studies, such as those performed for Federal Emergency Management 

Agency flood insurance rate maps, should justify the consideration of flooding above the 500-year flood plain as an unlikely event.
June 2015 3-D-6 NUREG-1520, Revision 2 

without the need for design features normally required by accepted engineering practice. When 

near compliance can be achieved and complete compliance will be relatively costly, plants may 

request an exemption to the regulation. 

As discussed earlier, many existing 10 CFR Part 70 facilities are not designed for an earthquake 

beyond that specified in applicable building codes. Although this design may provide fairly good 

seismic protection to the structure, it may not protect internal equipment. Also, an existing 

facility may not be designed to any specific seismic criteria, in which case its ability to withstand 

earthquakes can only be estimated based on comparison with similar structures or through 

complex structural analysis. In such cases, licensees may add IROFS to meet the performance 

requirements. An example of such IROFS (procedures and upgrades) being effectively 

implemented would be a facility where the consequences of a release of licensed material to the 

public in a seismic event would be from fires and/or explosions. In this case, fixes such as 

seismically qualified flammable gas shutoff valves or electrical shutoffs might provide a large 

decrease in potential seismic consequences. 

In regard to flooding, flood elevations beyond that of the 100-year flood may not have been 

determined for the site. For sites in proximity to a river, these determinations could be 

expensive and time consuming. For these cases, flood warning time may allow measures such 

as moving material at risk and/or blocking doors and openings in the facility structure. 

A facility’s ability to withstand high winds, rain and snow loads, and exterior fires can likewise be 

improved through a combination of administrative procedures and engineered improvements. 

Removing material at risk from under walls or roofs that are not seismically designed can 

reduce potential releases in case of collapse from winds or roof loads. 

Exemptions to the regulation may still be required for existing facilities even with administrative 

and engineered improvements. In regard to consequences to the public, complete compliance 

with 10 CFR 70.61 using realistic assumptions should be the goal. Compliance with 

10 CFR 70.61 regarding consequences to facility workers may require a request for an 

exemption once personnel protective equipment, emergency procedures, and worker training 

are taken into account. In the evaluation of a request for an exemption to the regulation, the 

expected operational life of the facility should also be factored into the determination of risk. 

Considerations for New Processes at Existing Facilities 

The design of new processes at existing facilities must address natural phenomena hazards in 

accordance with 10 CFR 70.64(a)(2), as well as the performance requirements of 

10 CFR 70.61. Nevertheless, new processes at existing facilities may present the same 

problems in demonstrating compliance with 10 CFR 70.61 in regard to accident sequences 

initiated by natural phenomena as do existing facilities based on the design and/or siting of the 

original structures. In the case of new processes, the U.S. Nuclear Regulatory Commission 

staff should expect compliance with the performance requirements of 10 CFR 70.61 to the 

extent possible, given the existing facility design and location. New processes at existing 

facilities also must meet the requirements of 10 CFR 70.64(b), which requires defense in depth 

and a preference for engineered controls over administrative controls. However, the staff 

cannot require structural improvements, permanent flood barriers, and other engineered 

improvements that could be considered retrofits to be applied to existing structures. New 

structural features within existing structures to prevent breaches in containment in the event of 

natural phenomena hazards may be considered, however. An example might be a seismically 

designed vault to hold radioactive materials associated with a new process. In regard to new 
June 2015 3-D-7 NUREG-1520, Revision 2 

processes, engineered controls, where feasible, are preferred over administrative procedures 

that might otherwise be proposed for an existing process with a limited operational lifetime. 

Such engineered improvements may not be required for licensing but could be scheduled to 

replace administrative procedures or other long-term compensatory measures on a timely basis 

after the start of operations. The objective is to encourage engineered safety in new processes 

compared to equivalent existing processes, while recognizing the restraints of the existing 

structures and location. Although primarily aimed at reducing risk to the public, the emphasis on 

engineered safety may also be applied to worker consequences in a way consistent with the 

method accepted at other facilities. 

 

Regulatory Basis 

The regulation in 10 CFR 70.61 specifies performance requirements associated with risks 

identified by an ISA. 

For new facilities or new processes at existing facilities, 10 CFR 70.64 specifies requirements, 

including Baseline Design Criterion (a)(2), “Natural Phenomena Hazards.” 

Technical Review Guidance 

When examining the applicant’s evaluation of the effects of natural phenomena on its facility, 

reviewers should recognize that estimates of “unlikely” and “highly unlikely” natural phenomena 

such as the PMF or SSE may not exist for the particular site. Hence, extrapolation and/or 

transposition of extreme event estimates made for other relatively nearby facilities (such as 

power reactor sites) should be allowed where feasible and technically justifiable. In addition, 

sophisticated probabilistic tools such as Bayesian analysis or Monte Carlo sampling methods 

need not be employed to improve the estimate of likelihoods of natural phenomena event 

sequences unless desired by the applicant (or licensee). For the purpose of determining 

appropriate values of extreme events, deterministic events such as the PMF or SSE can be 

used in place of purely probabilistically determined “highly unlikely” events and may be 

preferable, depending on the quality of historical data. Where extreme events need to be 

coupled with other probability-driven mechanisms, such as the release fraction or transport 

pathway, already low likelihood combinations do not have to be made even less likely by the 

use of conservative parameters. 

For existing facilities, due credit should be given to analysis assumptions and administrative 

controls, emergency procedures, and active engineered controls that do not change the design 

bases of the facility structures to natural phenomena. If the ISA and ISA summary demonstrate 

that the existing facility is near compliance (within an order of magnitude of a likelihood 

threshold or within 50 percent of meeting a consequence threshold, but not both), an exemption 

to the regulation may be considered. 

The annex to this appendix presents an example of an evaluation for an amendment request. 

Recommendation

This guidance should be used to supplement Chapter 3 of this SRP. 

 
June 2015 3-D-8 NUREG-1520, Revision 2 

References 

American National Standards Institute/American Nuclear Society, “Determining Design Basis 

Flooding at Power Reactor Sites,” ANS-2.8, July 1992. 

U.S. Code of Federal Regulations, Chapter I, Title 10, “Energy,” Part 70, “Domestic Licensing of 

Special Nuclear Material.” 

U.S. Department of Energy, “Natural Phenomena Hazards Design and Evaluation Criteria for 

Department of Energy Facilities,” DOE Standard-1020-2002, 2002. 

U.S. Nuclear Regulatory Commission, “Domestic Licensing of Special Nuclear Material; 

Possession of a Critical Mass of Special Nuclear Material,” Federal Register, Vol. 65, No. 181, 

pp. 56211–562331, September 18, 2000. 

U.S. Nuclear Regulatory Commission, “Procedural and Submittal Guidance for the Individual 

Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities,” 

NUREG-1407, June 1991. 

U.S. Nuclear Regulatory Commission, “Design Basis Flooding for Nuclear Power Plants,” 

Regulatory Guide 1.59, Revision 2, August 1997. 

 
June 2015 3-DD-1 NUREG-1520, Revision 2 

ANNEX TO APPENDIX D 

EXAMPLE OF NATURAL PHENOMENA HAZARD REVIEW FOR 

COMPLIANCE WITH 10 CFR 70.61 

This example review is for an amendment to authorize operations in a blended low-enriched 

uranium oxide conversion building (OCB). The site is located near a river and is just above the 

100-year flood plain of a nearby creek. The effluent process building was also part of the 

amendment but was not evaluated because the quantities of radioactive material or hazardous 

chemicals (that come under U.S. Nuclear Regulatory Commission (NRC) regulation) that it 

contained are not considered sufficient to exceed the consequence threshold for “unlikely” 

events given in Title 10 of the Code of Federal Regulations (10 CFR) 70.61, “Performance 

Requirements.” 

Seismic Evaluation 

The OCB is of reinforced concrete construction and is built to seismic criteria in the Standard 

Building Code (SBC-1999), which is equivalent to being designed for an earthquake with a 

probability of exceedance of approximately 4x10-4 per year. Using Appendix C to 

U.S. Department of Energy (DOE) Standard-1020-2002, “Natural Phenomena Hazards Design 

and Evaluation Criteria for Department of Energy Facilities,” the NRC staff determined the risk 

reduction factor to be 4, which gives the structure a likelihood of significant damage from an 

earthquake of 10-4 per year or less. Hence, the collapse or loss of building integrity from an 

earthquake may be considered to be “highly unlikely,” as the probabilistic value of “highly 

unlikely” indicated by the applicant was a probability of exceedance of 10-4 to 10-5 per year. 

Within the building, the material at risk consists of low-enriched uranyl nitrate liquid, ammonium 

diuranate slurry, and uranium dioxide powder. All of these materials are expected to be within 

containers, and spillage during a seismic event is expected to be minimal. Since the building is 

expected to retain its integrity, the leak path factor will be relatively minor even without dynamic 

confinement from the ventilation system. Facility workers are expected to take actions to limit 

personal intake of radionuclides. The staff concludes that the OCB complies with the 

performance requirements of 10 CFR 70.61 with regard to seismic events. 

High-Winds Evaluation 

The OCB structure is also designed for wind loads in accordance with SBC-1999, and the 

probability of a tornado impacting the facility is less than 10-5 per year. Therefore, the facility 

needs to be evaluated only in regard to the effects of wind loads and missiles, but not for 

tornadoes. The NRC staff considers the reinforced concrete exterior walls of the OCB to be 

adequate to withstand high wind velocities, as well as the missiles (from DOE 

Standard-1020-2002) that should be assumed for such events. The staff considers a collapse 

of building walls because of wind forces such that radioactive material would escape to be 

“highly unlikely.” In addition, the meteorological conditions likely to result in severe winds may 

be forecast in advance and protective measures taken. The staff concludes that the OCB 

complies with the performance requirements of 10 CFR 70.61 with regard to wind events. 
June 2015 3-DD-2 NUREG-1520, Revision 2 

Flooding Evaluation 

The lowest floor in the OCB is 15 feet above the 100-year flood from an adjacent creek. From a 

review of the topography of the site area, it appears that flooding of the site could occur, most 

likely from flooding of the nearby river with coincident flooding of the adjacent creek, which 

could back up through the railroad culvert. This event is expected to have warning time and 

may overtop the railroad embankment to the north of the facility and flood parts of the nearby 

town. However, the facility is sufficiently removed from the main channel of the river that 

flood-induced scouring and erosion would not be expected. In addition, the hydrostatic loading 

from the flood on the exterior walls of the OCB would not be expected to cause collapse. The 

primary concern is inundation, which could float unsecured containers within the OCB but not 

remove them from the facility. A criticality event cannot be excluded, but it could occur only in 

the flooded and, therefore, evacuated section of the plant and would not affect facility workers. 

In addition, the warning time would allow the movement of material to reduce the likelihood of a 

flood-induced criticality. The staff concludes that the OCB complies with the performance 

requirements of 10 CFR 70.61 with regard to flooding. 

REFERENCES 

U.S. Code of Federal Regulations, Chapter I, Title 10, “Energy,” Part 70, “Domestic Licensing of 

Special Nuclear Material.” 

U.S. Department of Energy, “Natural Phenomena Hazards Design and Evaluation Criteria for 

Department of Energy Facilities,” DOE Standard-1020-2002, 2002. 

 
June 2015 3-E-1 NUREG-1520, Revision 2 

APPENDIX E 

HUMAN FACTORS ENGINEERING FOR PERSONNEL ACTIVITIES 

The purpose of this review is to establish that human factors engineering (HFE) is applied to 

personnel activities identified as safety significant, consistent with the findings of the integrated 

safety analysis (ISA), and the determination of whether an item relied on for safety (IROFS) has 

special or unique safety significance. A graded approach commensurate with the complexity 

and integration and operation of the control systems is appropriate. The application of HFE to 

personnel activities ensures that the potential for human error in the facility operations was 

addressed during the design of the facility by facilitating correct, and inhibiting wrong, decisions 

by personnel and by providing a means for detecting and correcting or compensating for error. 

Title 10 of the Code of Federal Regulations (10 CFR) 70.61(e) requires a safety program to 

ensure that each IROFS will be available and reliable to perform its intended function when 

needed. Therefore, the applicant should identify those “personnel activities1

” that are 

considered IROFS and personnel activities that support safety (e.g., maintenance). An HFE 

review should be performed to demonstrate compliance with 10 CFR 70.61(e). Also, the 

applicant should demonstrate how personnel activities will enhance safety by reducing 

challenges to IROFS, as required in 10 CFR 70.64(b)(2). 

A human factors specialist and an ISA reviewer should conduct the human factors review. The 

review should also be coordinated with the reviewers of other technical areas and the reviewer 

of management measures, as necessary. 

AREAS OF REVIEW AND ACCEPTANCE CRITERIA 

Some facilities rely heavily on automated systems employing advanced digital instrumentation 

and control technology. These systems may be complex, with potential negative impacts on 

human performance activities in both operations and maintenance. The scope of review for the 

HFE for personnel activities should be consistent with the results of the ISA and include the 

following, as appropriate2

: 

A. Identification of Personnel Activities—The applicant should appropriately identify the 

personnel activities such that the reviewer can understand the actions, the humansystems interfaces (HSIs) involved, and the consequences. 

B. HFE Design Review Planning—The applicant’s approach for planning HFE design 

review should include the following: 

 

1

 For the purposes of this chapter, the phrase “personnel activities” represents personnel activities identified as 

IROFS and personnel activities that support safety, such as maintenance. 

2

 All nine areas of review (A through I) may not be necessary for a specific application. Areas of review should be 

based on the applicant’s provisions to address personnel activities consistent with the ISA findings, the similarity of 

the associated HFE issues for similar type plants, and the determination of whether an IROFS has special or 

unique safety significance. 
June 2015 3-E-2 NUREG-1520, Revision 2 

i. Identification of appropriate goals and scope to ensure that HFE practices and 

guidelines are implemented during design, construction, and operation of the 

facility. 

ii. Implementation by an HFE team that has the appropriate composition, 

experience, and organizational authority to ensure that HFE is considered in the 

design of HSI for personnel activities. The HFE team’s responsibilities include 

ensuring the proper development, execution, oversight, and documentation of the 

HFE function. Depending on the identification of personnel activities, it may be 

appropriate for the HFE team to consist of a single individual. 

iii. An HFE team that attains the HFE goals and scope through established 

processes and procedures and that tracks HFE issues. The HFE function that 

should ensure that all aspects of the personnel activities including the HSI are 

developed, designed, and evaluated on the basis of a structured approach using 

HFE. 

C. Operating Experience Review (OER)—To the extent possible, the applicant should 

identify safety-related HFE events or potential events in existing facilities that are similar 

to the proposed facility. The applicant should do all of the following: 

i. Review the HFE-related events or potential events for relevance. 

 

ii. Analyze the HSI technology employed for the relevant HFE events or potential 

events. 

 

iii. Conduct (or review existing) operator interviews and surveys on the HSI 

technology for the relevant HFE events or potential events. 

D. Functional Allocation Analysis and Task Analysis 

i. The functional allocation analysis should be based on the OER. Personnel 

activities should be functionally allocated to take advantage of human strengths 

and to avoid demands that are not compatible with human capabilities. 

ii. The task analysis should include the task analysis scope, identification, and 

analysis of critical tasks; detailed description of personnel demands (e.g., input, 

processing, and output); iterative nature of the analysis; and incorporation of job 

design issues. The task analysis should address each operating mode for each 

personnel activity (e.g., startup, normal operations, emergency operations, and 

shutdown). The task analysis results support the functional allocation. 

E. HSI Design, Inventory, and Characterization—The HSI design should incorporate the 

functional allocation analysis and task analysis into the detailed design of safetysignificant HSI components (e.g., alarms, displays, controls, and operator aids) through 

the systematic application of HFE. The HSI design should include the overall work 

environment, the work space layout (e.g., control room and remote shutdown facility 

layouts), the control panel and console design, the control and display device layout, and 

information and control interface design details. The HSI design process should ensure 

the application of HFE to the HSI required to perform personnel activities. The HSI 
June 2015 3-E-3 NUREG-1520, Revision 2 

design process should exclude the development of extraneous controls and displays. 

The HSI design documentation should include a complete HSI inventory and the basis 

for the HSI characterization. 

F. Staffing—Staffing should be based on a review of the number and qualifications of 

personnel for each personnel activity during all plant operating conditions. The applicant 

should conduct this review in a systematic manner that incorporates the functional 

allocation and task analysis results. 

Categories of personnel should be based on the types of personnel activities. Staffing 

considerations should include issues identified in the OER, functional allocation, HSI 

design, procedure development, and verification and validation (V&V). 

G. Procedure Development—The applicant’s procedure development for personnel 

activities should incorporate HFE principles and criteria, along with all other design 

requirements, to develop procedures that are technically accurate, comprehensive, 

explicit, easy to use, and validated consistent with the acceptance criteria in this 

Standard Review Plan. Because procedures are considered an essential component of 

the HSI design, they should be derived from the same design process and analyses as 

the other components of the HSI (for example, displays, controls, operator aids) and 

subject to the same evaluation processes. Procedures to support the personnel activity 

may include generic technical guidance, plant and system operations, abnormal and 

emergency operations, tests (for example, preoperational, startup, and surveillance), 

and alarm response. 

H. Training Program Development—The applicant’s training program development should 

address all personnel activities. The training program development indicates how the 

knowledge and skill requirements of personnel will be evaluated, how the training 

program development will be coordinated with the other activities of the HFE design 

process, and how the training program will be implemented in an effective manner 

consistent with human factors principles and practices. 

The training program development should address the areas of review and acceptance 

criteria described in Chapter 11 of this SRP and should result in a training program that 

provides personnel with qualifications commensurate with their activities. 

I. Verification & Validation—V&V confirms that the design incorporates HFE to HSI in a 

manner that enables the successful completion of personnel activities. The V&V should 

be applied to personnel activities (see item A) and HSI design (see item E). The V&V 

process should consist of the following: 

i. HSI task support verification: HSI components should be appropriately provided 

for personnel activities through HSI task support verification. The verification 

should show that each HSI has identified the task analysis (see item D(ii)) and 

that the HSI design (see item E) is appropriately provided, yet minimizes the 

incorporation of information, displays, controls, and embellishments that 

unnecessarily complicate personnel activities. 

ii. HFE design verification: The HFE design verification should show that each HSI 

identified for a personnel activity has incorporated HFE into the design. 

Deviations from accepted HFE principles and guidelines should be justified or 

documented for resolution or correction. If HFE design verification does not 

address all HSI components, then an alternative multidimensional sampling 
June 2015 3-E-4 NUREG-1520, Revision 2 

methodology should be used to ensure comprehensive consideration of the 

safety significance of HSI components. The sample size should be sufficient to 

identify a range of significant safety issues. 

iii. Integrated system validation: The applicant should conduct a performancebased evaluation of the integrated design to ensure that the HFE/HSI supports 

safe operation of the plant. Integrated system validation is performed after HFE 

problems identified in HFE design activities are resolved or corrected because 

these may negatively affect performance and, therefore, validation results. 

Validation is performed by evaluating personnel activities using appropriate 

measurement tools. All personnel activities should be tested and found to be 

adequately supported in the design, including personnel activities outside the 

control room. 

iv. Human factors issue resolution verification: The applicant should verify that HFE 

issues identified during the design process were addressed and resolved. Issue 

resolution verification should be documented in the HFE issue tracking system 

established by the HFE team (see item B). Issues that cannot be resolved until 

the HSI design is constructed, installed, and tested should be identified and 

incorporated into the final HFE/HSI design verification. 

v. Final HFE/HSI design verification: The applicant should commit to performing a 

final HFE/HSI design verification if the applicant cannot demonstrate that it has 

fully evaluated the actual installation of the final HSI design in the plant through 

the V&V activities described above. Final HFE/HSI design verification should 

demonstrate that in-plant HFE design implementation conforms to the HFE 

design (see item E) as modified by V&V activities. V&V activities should be 

performed in the order listed above, as necessary. However, the applicant may 

find that it is necessary to repeat the activities in order to address design 

corrections and modifications that occur during V&V. 

REFERENCES 

U.S. Code of Federal Regulations, Chapter I, Title 10, “Energy,” Part 70, “Domestic Licensing of 

Special Nuclear Material.” 

U.S. Nuclear Regulatory Commission, “Standard Review Plan for the Review of a License 

Application for a Mixed Oxide Fuel Fabrication Facility,” NUREG-1718, August 2000. 
June 2015 4-1 NUREG-1520, Revision 2

4. RADIATION PROTECTION 

4.1 Purpose of Review 

The purpose of this review is to determine, consistent with Title 10, “Energy,” of the Code of 

Federal Regulations (10 CFR) 70.23(a)(2), (3), and (4), whether the applicant’s 

radiation-protection program is adequate to protect the radiological health and safety of workers 

and to comply with the regulatory requirements in 10 CFR Part 19, “Notices, Instructions and 

Reports to Workers: Inspection and Investigations”; 10 CFR Part 20, “Standards for Protection 

Against Radiation”; 10 CFR Part 70, “Domestic Licensing of Special Nuclear Material”, and 

10 CFR Part 71, “Packaging and Transportation of Radioactive Material.” 

The content and level of detail in this chapter are generally greater than in other chapters 

because this chapter provides acceptance criteria for evaluating compliance with 10 CFR 

Part 20, which has very specific requirements. The applicant should also incorporate, and the 

U.S. Nuclear Regulatory Commission (NRC) reviewer should consider, insights gained from the 

conduct of the integrated safety analysis (ISA) and information contained in the ISA summary in 

developing and reviewing the acceptability of the applicant’s radiation-protection program. 

In addition, the reviewer should evaluate the adequacy of the ISA summary with respect to 

ensuring that the application meets the radiation exposure performance criteria of 

10 CFR 70.61(b) and (c). Chapter 9 of this Standard Review Plan (SRP), which discusses 

environmental protection, contains the review procedures and acceptance criteria for the 

applicant’s program for protecting members of the public and controlling effluent releases. 

4.2 Responsibility for Review 

Primary: Health Physicist 

Secondary: Licensing Project Manager, Environmental Reviewer 

Supporting: Fuel Cycle Facility Inspector 

4.3 Areas of Review 

The radiation protection program must address the occupational radiation protection measures 

in 10 CFR Parts 19, 20, 70, and 71. Specifically, licensees must develop, document, and 

implement a radiation protection program in accordance with 10 CFR 20.1101, “Radiation 

Protection Programs.” Additionally, 10 CFR 20.2102, “Records of Radiation Protection 

Programs,” requires licensees to keep records of the radiation protection program, including a 

description of the program components, audits, and other aspects of program implementation. 

The reviewer should also refer to the ISA summary to identify those facility operations analyzed 

in the ISA that have radiological consequences and the associated items relied on for safety 

(IROFS) and management measures implemented to prevent or mitigate such radiological risks. 

The ISA review should include a judgment as to the comprehensiveness of evaluations 

performed by the licensee. 

The staff will review an applicant’s commitments regarding the following components of the 

radiation protection program: 

1. Establish, maintain, and implement a radiation protection program. 
June 2015 4-2 NUREG-1520, Revision 2

2. Keep occupational exposures to radiation as low as reasonably achievable (ALARA). 

3. Appoint radiological protection staff who are suitably qualified and trained in radiation 

protection procedures. 

4. Prepare written radiation protection procedures and radiation work permits (RWPs). 

5. Train employees in radiation protection, including the health protection problems 

associated with exposure to radiation, precautions and procedures to minimize 

exposure, and the purposes and functions of protective devices employed. 

6. Design and implement programs to control airborne concentrations of radioactive 

material by using ventilation systems, containment systems, and respirators. 

7. Conduct radiation surveys and monitoring programs to document radiation levels, 

concentrations of radioactive materials in the facility, and occupational exposures to 

radiation by workers. 

8. Evaluate the radiological risks from accidents occurring during operations; identify 

IROFS that limit high and intermediate consequences, consistent with regulatory 

performance criteria; and have appropriate management measures in place to ensure 

that identified IROFS are available and reliable. 

9. Maintain additional programs, including (1) a records maintenance program, 

(2) a corrective action program, and (3) a program for reporting to the NRC in 

accordance with requirements in 10 CFR Part 20 and 10 CFR Part 70. 

Review Interfaces 

In addition to Chapter 4 of the application, the reviewer should examine information in the 

following other areas to ensure that it is consistent with the information in Chapter 4: 

 The emergency plan applicable to radiation protection under SRP Chapter 8. 

 The safety program, ISA commitments, and ISA documentation applicable to radiation 

protection under SRP Chapter 3. 

 The environmental and effluent monitoring, as well as any effluent controls applicable to 

radiation protection under SRP Chapter 9. 

Procedural, document control, and training criteria may also be addressed in response to 

Chapter 11 as these may be considered management measures and/or IROFS.

4.4 Acceptance Criteria 

4.4.1 Commitment to Radiation-Protection Program Implementation 

4.4.1.1 Regulatory Requirements 

Regulations in 10 CFR 20.1101 apply to the establishment of a radiation protection program. 
June 2015 4-3 NUREG-1520, Revision 2

4.4.1.2 Regulatory Guidance 

The NRC regulatory guide applicable to the commitment to design and implement a radiation 

protection program is Regulatory Guide 8.2, “Administrative Practices in Radiation Surveys and 

Monitoring,” issued May 2011. 

4.4.1.3 Regulatory Acceptance Criteria 

In accordance with Subpart B, “Radiation Protection Programs,” of 10 CFR 20, the purpose of 

the radiation protection program is to maintain occupational and public doses below regulatory 

limits and ALARA. The applicant’s radiation protection program will be acceptable if it includes: 

1. A documented management commitment to keep exposures ALARA; 

2. A trained and qualified radiation protection organization with independence from the 

facility’s operations, well-defined responsibilities, and sufficient authority to carry out 

those responsibilities; 

3. Adequate facilities, equipment, and procedures to effectively implement the program; 

and 

4. The review, at least annually, of the radiation protection program’s content and 

implementation, as required by 10 CFR 20.1101(c). The review should consider facility 

changes, new technologies, and other process enhancements that could improve the 

effectiveness of the overall program. 

4.4.2 Commitment to an ALARA Program 

4.4.2.1 Regulatory Requirements 

Regulations in 10 CFR 20.1101 apply to the ALARA program. 

4.4.2.2 Regulatory Guidance 

The following NRC regulatory guides are applicable to the ALARA program: 

1. Regulatory Guide 4.21, “Minimization of Contamination and Radioactive Waste 

Generation: Life Cycle Planning,” June 2008 

2. Regulatory Guide 8.2 

3. Regulatory Guide 8.10, “Operating Philosophy for Maintaining Occupational Radiation 

Exposures as Low as Is Reasonably Achievable,” Revision 1-R, May 1977 

4. Regulatory Guide 8.13, “Instructions Concerning Prenatal Radiation Exposure,” 

Revision 3, June 1999 

5. Regulatory Guide 8.15, “Acceptable Programs for Respiratory Protection,” Revision 1, 

October 1999 
June 2015 4-4 NUREG-1520, Revision 2

6. Regulatory Guide 8.29, “Instructions Concerning Risks from Occupational Radiation 

Exposure,” February 1996 

 

4.4.2.3 Regulatory Acceptance Criteria

The applicant’s ALARA program is acceptable if the license application provides data and 

information that meet each of the following commitments: 

1. Establish a written, comprehensive, and effective ALARA program. 

2. Prepare policies and procedures to ensure that occupational radiation exposures are 

maintained ALARA and that such exposures are consistent with the requirements of 

10 CFR 20.1101. 

3. Outline specific ALARA program goals, establish an ALARA program organization and 

structure, and include written procedures for its implementation in the plant design and 

operations. 

4. Establish an ALARA committee or equivalent organization with sufficient staff, 

resources, and clear responsibilities to ensure that the occupational radiation exposure 

does not exceed the dose limits of 10 CFR Part 20 under normal operations.1

5. Use the ALARA program as a mechanism to facilitate interaction between radiation 

protection and operations personnel. 

6. Regularly review and revise, when appropriate, the ALARA program goals and 

objectives and incorporate, when appropriate, new approaches, technologies, operating 

procedures, or changes that could reduce potential radiation exposures at a reasonable 

cost. 

4.4.3 Organization and Personnel Qualifications 

4.4.3.1 Regulatory Requirements

Regulations in paragraph (a)(6) of 10 CFR 70.22, “Contents of Applications,” apply to the 

organization and qualifications of the radiological protection staff. 

4.4.3.2 Regulatory Guidance

The following are the NRC regulatory guides applicable to the organization and personnel 

qualifications of radiation protection program staff: 

 

1

 The ALARA committee should meet at least annually, and the membership should include areas such as 

management, radiation protection, environmental safety, industrial safety, and production. The committee’s review 

of the ALARA program should include an evaluation of the results of audits made by the radiation-protection 

organization, reports of radiation levels in the facility, contamination levels, employee exposures, and effluent 

releases. The review should determine whether there are any upward trends in personnel exposure for identified 

categories of workers and types of operations. The review should identify any upward trends in effluent releases 

and contamination levels. Finally, the review should determine whether exposures, releases, and contamination 

levels are in accordance with the ALARA concept. The ALARA committee should document its recommendations 

and track them to completion. 
June 2015 4-5 NUREG-1520, Revision 2

1. Regulatory Guide 8.2 

2. Regulatory Guide 8.10

4.4.3.3 Regulatory Acceptance Criteria 

The applicant’s commitment to organize and staff a radiation protection program is acceptable if 

the license application provides data and information that meet each of the following 

commitments: 

1. Appoint radiation protection personnel and identify their authority and responsibilities for 

implementing the radiation protection program functions. 

2. Establish clear organizational relationships among the individual positions responsible 

for the radiation protection program and other line managers. 

3. Appoint a suitably educated, experienced, and trained radiation protection program 

director (typically referred to as the radiation safety officer) who (1) has direct access to 

the plant manager, (2) is skilled in the interpretation of data and regulations pertinent to 

radiation protection, (3) is familiar with the operation of the facility and radiation 

protection concerns of the site, (4) participates as a resource in radiation safety 

management decisions, and (5) will be responsible for establishing and implementing 

the radiation protection program. 

4. Describe the minimum education, experience, and training requirements for the radiation 

protection program director and staff. 

 

4.4.4 Commitment to Written Procedures 

4.4.4.1 Regulatory Requirements 

The regulations in 10 CFR 70.22(a)(8) apply to radiation protection procedures and RWPs. 

4.4.4.2 Regulatory Guidance 

The regulatory guidance applicable to procedures and RWPs appears in Regulatory Guide 8.10, 

Revision 1-R. 

4.4.4.3 Regulatory Acceptance Criteria 

The applicant’s commitment to prepare written radiation protection procedures and RWPs is 

acceptable if the license application provides data and information that meet each of the 

following commitments: 

1. Prepare written, approved procedures to carry out activities related to the radiation 

protection program. Procedures should address applicable radiation protection 

requirements found in 10 CFR 19, 20, 70, and 71 and any other applicable regulations. 
June 2015 4-6 NUREG-1520, Revision 2

2. Establish a process for procedure generation or modification, authorization, distribution, 

and training, such that changes in technology or practices are communicated effectively 

and in a timely manner. Review and revise procedures, as necessary, to incorporate 

any facility or operational changes, including changes in the ISA. The radiation safety 

officer, or an individual who has the qualifications of the radiation safety officer, should 

approve all procedures related to radiation protection. 

3. Specify written, approved RWPs for activities involving licensed material that are not 

covered by written radiation protection procedures. RWPs should define the authorized 

activities, the level of approval required (a radiation specialist, as a minimum), 

information requirements, period of validity, expiration and termination times, and 

recordkeeping requirements. 

4.4.5 Radiation Safety Training 

The SRP addresses an applicant’s commitments to employee training in several places. This 

chapter addresses corporate radiation protection training programs, and Chapter 11 discusses 

training that serves as a management measure for ensuring that an administrative control 

IROFS is available and reliable when required. 

4.4.5.1 Regulatory Requirements 

The following regulations apply to the radiation safety training program: 

1. 10 CFR 19.12, “Instructions to Workers” 

2. 10 CFR 20.2110, “Form of Records” 

3. 10 CFR 70.22, paragraph (a)(6) 

4.4.5.2 Regulatory Guidance 

The following NRC regulatory guides, reports of the National Council on Radiation Protection 

(NCRP), and standards of the American National Standards Institute (ANSI)/Health Physics 

Society (HPS) and the American Society for Testing and Materials pertain to radiation protection 

training: 

1. Regulatory Guide 8.10 

2. Regulatory Guide 8.13 

3. Regulatory Guide 8.29 

4. ANSI/HPS N13.36, “Ionizing Radiation Safety Training for Workers,” October 30, 2001, 

reaffirmed July 19, 2011 

5. ASTM E1168-95, “Radiological Protection Training for Nuclear Facility Workers,” 

reapproved in 2008 

6. NCRP Report No. 134, “Operational Radiation Safety Training,” 2000 
June 2015 4-7 NUREG-1520, Revision 2

4.4.5.3 Regulatory Acceptance Criteria 

The applicant’s commitment to train its employees in radiation protection is acceptable if the 

license application provides data and information that meet each of the following commitments: 

1. Design and implement an employee radiation protection training program that complies 

with the requirements of 10 CFR Parts 19 and 20. 

2. Provide training to all personnel and visitors entering restricted areas that is 

commensurate with the health risk to which they may be exposed, or provide escorts 

who have received the appropriate training. 

3. Provide a level of training commensurate with the potential radiological health risks 

associated with that employee’s work responsibilities. 

4. Conduct refresher training, at least every 3 years that will accurately address changes in 

policies, procedures, requirements, and the facility ISA. 

5. Incorporate into the radiation protection training program the provisions in 10 CFR 19.12 

and additional relevant topics, such as the following (the asterisk denotes those topics 

with a basis in 10 CFR 19.12): 

a. correct handling of radioactive materials 

b. the storage, transfer, or use of radiation or radioactive material as relevant to the 

individual’s activities* 

c. minimization of exposures to radiation or radioactive materials* 

d. access and egress controls and escort procedures 

e. radiation safety principles, policies, and procedures* 

f. monitoring for internal and external exposures 

g. radiation exposure reports available to workers* 

h. monitoring instruments 

i. contamination control procedures, including protective clothing and equipment* 

j. ALARA and exposure limits* 

k. radiation hazards and health risks* 

l. emergency response* 

m. responsibility to report promptly any condition that may lead to, or cause, a 

violation of regulations and licenses or create unnecessary exposure* 
June 2015 4-8 NUREG-1520, Revision 2

6. Review and evaluate the accuracy, effectiveness, and adequacy of the radiation 

protection training program curriculum and instructors, as applicable, at least every 

3 years. 

4.4.6 Ventilation and Respiratory Protection Programs 

4.4.6.1 Regulatory Requirements 

Subpart H, “Respiratory Protection and Controls to Restrict Internal Exposure in Restricted 

Areas,” of 10 CFR Part 20 and 10 CFR 70.22(a)(7) apply to the ventilation and respiratory 

protection programs. 

4.4.6.2 Regulatory Guidance 

The following NRC regulatory guides, ANSI standards, and other publications apply to the 

design of the ventilation and respiratory protection programs: 

1. Regulatory Guide 4.21 

2. Regulatory Guide 8.15 

3. Regulatory Guide 8.24, “Health Physics Surveys During Enriched Uranium-235 

Processing and Fuel Fabrication,” Revision 2, June 2012 

4. American Conference of Governmental Industrial Hygienists (ACGIH), “Industrial 

Ventilation: A Manual of Recommended Practice for Design,” ACGIH 2096, 2010 

5. ACGIH, “Industrial Ventilation: A Manual of Recommended Practice for Operation and 

Maintenance,” ACGIH 2106, 2007 

6. American Glovebox Society, “Guideline for Gloveboxes,” AGS-G001, 2007 

7. American National Standards Institute, “Practices for Respiratory Protection,” 

ANSI Z88.2-1992 

8. ASME AG-1, “Code on Nuclear Air and Gas Treatment,” American Society of 

Mechanical Engineers, New York, NY, 2009, and applicable addenda 

9. AGS-G001, “Guideline for Gloveboxes,” American Glovebox Society, Santa Rosa, CA, 

2007 

10. Energy Research and Development Administration (ERDA) 76-21, “Nuclear Air Cleaning 

Handbook,” by C.A. Burchsted, A.B. Fuller, and J.E. Kahn, March 31, 1976 

11. ANSI Z88.2-1992, “Practices for Respiratory Protection” 
June 2015 4-9 NUREG-1520, Revision 2

4.4.6.3 Regulatory Acceptance Criteria 

The applicant’s commitment to have ventilation and respiratory protection programs is 

acceptable if the license application provides data and information that meet each of the 

following commitments: 

1. Install appropriately sized ventilation and containment systems in areas of the plant 

identified as having potential airborne concentrations of radionuclides that could exceed 

the occupational derived air concentration values specified in 10 CFR Part 20, 

Appendix B, “Annual Limits on Intake (ALIs) and Derived Air Concentrations (DACs) of 

Radionuclides for Occupational Exposure; Effluent Concentrations; Concentrations for 

Release to Sewerage,” during normal operations. Air flow in buildings housing these 

operations should be directed towards the area(s) of highest potential contamination. 

2. Describe management measures, including preventive and corrective maintenance and 

performance testing, to ensure that the ventilation and containment systems operate 

when required and are within their design specifications. 

3. Describe the operations criteria for the ventilation and containment systems, including 

minimum flow velocity at openings in these systems, maximum differential pressure 

across filters, and types of filters to be used. 

4. Describe the frequency and types of tests to measure the performance of ventilation and 

containment systems, the acceptance criteria, and the actions to be taken when the 

acceptance criteria are not satisfied. 

5. Establish a respiratory protection program that meets the requirements of Subpart H of 

10 CFR Part 20. 

6. Prepare written procedures for the selection, fitting, issuance, maintenance, testing, 

training of personnel, monitoring, and recordkeeping for individual respiratory protection 

equipment and for specifying when such equipment is to be used. 

7. Revise the written procedures for the use of individual respiratory protection equipment, 

as applicable, when making changes to processing, the facility, or the equipment. 

8. Maintain records of the respiratory protection program, including training in respirator 

use and maintenance. 

4.4.7 Radiation Surveys and Monitoring Programs 

Radiation surveys are conducted for two purposes: (1) to ascertain radiation levels, 

concentrations of radioactive material, and potential radiological hazards that could be present 

in the facility and (2) to detect releases of radioactive material from plant equipment and 

operations. Radiation surveys will focus on those areas of the plant necessary to show 

compliance with the dose limits and monitoring requirements of Subpart C, “Occupational Dose 

Limits”; Subpart D, “Radiation Dose Limits for Individual Members of the Public”; and Subpart F, 

“Surveys and Monitoring,” of 10 CFR Part 20. 

Measurements of airborne radioactive material and bioassays are used to determine internal 

occupational exposures to radiation. When combined with external occupational exposure data, 
June 2015 4-10 NUREG-1520, Revision 2

the dose of record can be compared against the dose limits specified in Subpart C of 10 CFR 

Part 20. 

Effluent and environmental monitoring, including stack monitoring and environmental radiation 

monitoring, may be addressed in Chapter 9, “Environmental Protection,” of this SRP.

4.4.7.1 Regulatory Requirements 

The following NRC regulations in 10 CFR Part 20 apply to radiation surveys and monitoring 

programs: 

1. Subpart C 

2. Subpart F 

3. Subpart L, “Records” 

4. Subpart M, “Reports”

4.4.7.2 Regulatory Guidance 

The following NRC regulatory guides, NUREG, and ANSI standards are applicable to radiation 

surveys and monitoring programs: 

1. Regulatory Guide 8.2 

2. Regulatory Guide 8.4, “Personnel Monitoring Device, Direct-Reading Pocket 

Dosimeters,” Revision 1, June 2011 

3. Regulatory Guide 8.7, “Instructions for Recording and Reporting Occupational Radiation 

Exposure Data,” Revision 2, November 2005 

4. Regulatory Guide 8.9, “Acceptable Concepts, Models, Equations, and Assumptions for a 

Bioassay Program,” Revision 1, July 1993 

5. Regulatory Guide 8.24 

6. Regulatory Guide 8.25, “Air Sampling in the Workplace,” Revision 1, June 1992 

7. Regulatory Guide 8.34, “Monitoring Criteria and Methods To Calculate Occupational 

Radiation Doses,” July 1992 

8. Regulatory Guide 8.40, “Methods for Measuring Effective Dose Equivalent from External 

Exposure,” July 2010 

9. NUREG-1400, “Air Sampling in the Workplace,” September 1993 

10. ANSI N323A-1997, “American National Standard Radiation Protection Instrumentation 

Test and Calibration, Portable Survey Instruments,” Approved April 3, 1997 
June 2015 4-11 NUREG-1520, Revision 2

11. ANSI N13.1-2011, “Sampling and Monitoring Releases of Airborne Radioactive 

Substances from the Stacks and Ducts of Nuclear Facilities,” approved March 30, 2011 

12. ANSI N13.6-2010, “Practice for Occupational Radiation Exposure Records Systems,” 

approved August 3, 2010 

13. ANSI N13.30-2011, “Performance Criteria for Radiobioassay,” approved 

December 16, 2011 

14. ANSI N13.39—2001, “Design of Internal Dosimetry Programs,” approved May 24, 2001, 

reaffirmed July 19, 2011 

15. ANSI N13.49—2001, “Performance and Documentation of Radiological Surveys,” 

approved August 6, 2001, reaffirmed June 10, 2011 

16. ANSI N13.6-2010, “Practice for Occupational Radiation Exposure Records Systems,” 

Approved August 3, 2010 

4.4.7.3 Regulatory Acceptance Criteria 

The applicant’s commitment to implement radiation surveys and monitoring programs is 

acceptable if the license application provides data and information that meet each of the 

following commitments: 

1. Provide radiation survey and monitoring programs that are necessary to comply with the 

requirements of 10 CFR Part 20 and that are reasonable to evaluate the magnitude and 

extent of radiation levels, the concentrations or quantities of radioactive material, and the 

potential radiological hazards. 

2. Prepare written procedures for the radiation survey and monitoring programs that 

include an outline of the program objectives, sampling procedures, data-analysis 

methods, types of equipment and instrumentation, frequency of measurements, 

recordkeeping and reporting requirements, and actions to be taken when measurements 

exceed regulatory limits in 10 CFR Part 20 or administrative levels established by the 

applicant. 

3. Design and implement a personnel monitoring program for external occupational 

radiation exposures that outlines methods or procedures to do the following: 

a. Identify the criteria for worker participation in the program. 

b. Identify the types of radiation to be monitored. 

c. Specify how exposures will be measured, assessed, and recorded. 

d. Identify the type and sensitivity of personal dosimeters to be used, when they will 

be used, and how they will be processed and evaluated. 

e. Identify the plant’s administrative exposure levels or the levels at which actions 

are taken to investigate the cause of exposures exceeding these levels. 

 
June 2015 4-12 NUREG-1520, Revision 2

4. Design and implement a personnel monitoring program for internal occupational 

radiation exposures based on the requirements of 10 CFR 20.1201, “Occupational Dose 

Limits for Adults”; 10 CFR 20.1204, “Determination of Internal Exposure”; and 

10 CFR 20.1502(b) that outlines methods or procedures to do the following: 

a. Identify the criteria for worker participation in the program. 

b. Identify the type of sampling to be used, the frequency of collection and 

measurement, and the minimum detection levels. 

c. Specify how worker intakes will be measured, assessed, and recorded. 

d. Specify how the data will be processed, evaluated, and interpreted. 

e. Identify the plant’s administrative exposure levels or the levels at which actions 

are taken to investigate the cause of exposures exceeding these levels. 

5. Design and implement an air-sampling program in areas of the plant identified as 

potential airborne-radioactivity areas to conduct airflow studies and to calibrate and 

maintain the airborne sampling equipment in accordance with the manufacturers’ 

recommendations. 

6. Implement additional procedures, as may be required by 10 CFR Part 20 and the ISA 

summary, to control exposure to airborne radioactive material (e.g., control of access, 

limitation of exposure times to licensed materials, and use of respiratory protection 

equipment). 

7. Conduct a contamination survey program in areas of the plant most likely to be 

radiologically contaminated; the program must include the types and frequencies of 

surveys for various areas of the plant and the action levels and actions to be taken when 

contamination levels are exceeded. 

8. Implement the facility’s corrective action program when the results of personnel 

contamination monitoring exceed the applicant’s administrative personnel contamination 

levels. 

9. Implement the facility’s corrective action program when any incident results in either 

unplanned occupational exposures exceeding the facility’s administrative limits or 

unplanned airborne contamination exceeding the applicable concentration in Appendix B 

to 10 CFR Part 20.for one week. Note that applicants utilizing soluble uranium may be 

more restricted by the soluble uranium intake limit in 10 CFR 20.1201(e) than the values 

in Appendix B to 10 CFR 20. 

10. Use equipment and instrumentation with sufficient sensitivity for the type or types of 

radiation being measured and calibrate and maintain equipment and instrumentation in 

accordance with the manufacturers’ recommendations or applicable ANSI standards. 

11. Establish policies to ensure that equipment and materials removed from restricted areas 

to unrestricted areas are not contaminated above the release levels presented in 

Appendix A, “Acceptable Surface Contamination Levels,” to Regulatory Guide 8.24. 
June 2015 4-13 NUREG-1520, Revision 2

12. Leak-test all sealed sources consistent with direction provided in Appendix C, “Leak Test 

Requirements,” to Regulatory Guide 8.24 or the applicable regulations for the materials 

involved (e.g., 10 CFR 31.5(c)(2) has direction for leak testing of certain byproduct 

devices). 

13. Establish and implement an access control program that ensures that (1) signs, labels, 

and other access controls are properly posted and operative, (2) restricted areas are 

established to prevent the spread of contamination and are identified with appropriate 

signs, and (3) step-off pads, change facilities, protective clothing facilities, and personnel 

monitoring instruments are provided in sufficient quantities and locations. 

14. Establish a reporting program that is consistent with the requirements of 10 CFR Part 19 

and 10 CFR Part 20. 

 

4.4.8 Control of Radiological Risk Resulting from Accidents 

To be consistent with participation in the integrated review of the ISA summary performed in 

accordance with Chapter 3 of the SRP, the reviewer should examine, in detail, the radiological 

exposure and release accident sequences provided in the ISA summary to demonstrate 

compliance with 10 CFR 70.61, “Performance Requirements.” This review should focus on 

evaluation of sequences involving radiological releases or exposures with respect to the 

initiators and their frequency, radiological consequences, and IROFS chosen to prevent or 

mitigate those consequences. 

The reviewer should also identify and note any items or issues that should be inspected during 

an operational readiness review, if such will be performed. These items may include confirming 

that engineered controls meet performance specifications described in the ISA summary and 

that administrative controls are implemented through procedures and operator training. These 

may also be addressed by reviewers involved with Chapter 11 of the SRP, “Management 

Measures.” 

The reviewer should ensure that (a) the emergency plan, if one is required, adequately 

addresses the licensee response to a release of radioactive materials or (b) the licensee gives a 

proper justification that precludes the development of an emergency plan. 

Finally, the reviewer should be aware that accident sequences considered “not unlikely” in the 

ISA summary are constricted, under the ALARA requirement in 10 CFR Part 20, to minimize 

exposure to personnel and the public. 

4.4.8.1 Regulatory Requirements 

The following NRC regulations apply to the control of radiological risk from accidents: 

1. 10 CFR 70.22(i)(1) requires either an evaluation that the maximum dose to a member of 

the public resulting from a release of materials would not exceed 1 rem or 2 milligrams 

soluble uranium intake or the submission of an emergency plan for responding to the 

radiological hazards of a postulated accident. 

2. Subpart H, “Additional Requirements for Certain Licensees Authorized To Possess a 

Critical Mass of Special Nuclear Material,” of 10 CFR Part 70 contains requirements for 

performing ISAs, designating IROFS, and having management measures in place, both 
June 2015 4-14 NUREG-1520, Revision 2

to ensure that IROFS are readily available and reliable and to provide facility change 

management and configuration control. 

3. 10 CFR 20.1101 states that licensees shall apply procedures and engineering controls 

to achieve exposures to workers and the public that are ALARA. 

4. 10 CFR 20.1406, “Minimization of Contamination,” states that licensees shall design and 

develop procedures for operation that will minimize contamination of the facility and the 

environment, facilitate eventual decommissioning, and minimize the generation of 

radioactive waste. 

5. Subpart H of 10 CFR Part 20 discusses controls to restrict internal exposures. 

4.4.8.2 Regulatory Guidance 

The following guidance applies to the control of radiological risk resulting from accidents: 

1. NUREG-1513, “Integrated Safety Analysis Guidance Document,” May 2001 

2. NUREG/CR-6410, “Nuclear Fuel Cycle Accident Analysis Handbook,” March 1998 

3. Chapter 3 of this SRP 

4. Chapter 11 of this SRP 

4.4.8.3 Acceptance Criteria 

The reviewer should consider the factors listed below in determining the acceptability of the 

applicant’s descriptions of radiological exposure or release accident sequences. 

1. Accident sequences should be sufficiently described and detailed to allow an 

understanding of the radiological hazards (e.g., radioactive materials at risk) and the 

release mechanism. 

2. The applicant should provide adequate descriptions of the radiological consequences 

(i.e., exposure estimates) for the credible high and intermediate consequence events 

identified in the ISA summary. The reviewer should verify that the exposure estimates 

are reasonable, based on the sequence description and the radioactive materials 

involved. 

3. The applicant should justify the likelihood of the initiating event, its prevention, or 

mitigation of the results of an accident sequence with high or intermediate 

consequences, if credited in a questionable or nonconservative manner. If controls are 

relied on to reduce the likelihood or severity of a high- or intermediate-consequence 

accident sequence, they should be identified as IROFS (10 CFR 70.61). 

4. Analyses that the applicant has performed as part of the ISA process should be 

referenced or identified for potential further review (vertical slice) by the NRC staff 

(10 CFR 70.61). 

5. The application should demonstrate the management measures proposed to ensure that 
June 2015 4-15 NUREG-1520, Revision 2

IROFS are available and reliable, when required, by briefly describing both of the 

following: 

a. procedures to ensure the reliable operation of engineered controls 

(e.g., inspection and testing procedures and frequencies, calibration programs, 

functional tests, corrective and preventive maintenance programs, and criteria for 

acceptable test results) (10 CFR 70.62(d)) 

b. procedures to ensure that administrative controls will be correctly implemented 

when required (e.g., employee training and qualification in operating procedures, 

refresher training, safe work practices, development of standard operating 

procedures, and training program evaluations) (10 CFR 70.62(d)) 

6. The application shall include either of the following: 

a. an evaluation that demonstrates that public exposures resulting from offsite 

releases of material are less than 1 rem or 2 milligrams soluble uranium intake 

(10 CFR 70.22(i)(1)(i)) 

b. an emergency plan that includes sufficient detail for responding appropriately to 

an offsite release of radioactive materials (10 CFR 70.22(i)(1)(ii)) 

4.4.9 Additional Program Commitments 

4.4.9.1 Regulatory Requirements 

The following regulations are applicable to the additional program commitments: 

1. Subpart L of 10 CFR Part 20 

2. Subpart M of 10 CFR Part 20 

3. 10 CFR 20.1906, “Procedures for Receiving and Opening Packages”

4. 10 CFR 20.2006, “Transfer for Disposal and Manifests” 

5. 10 CFR 70.74, “Additional Reporting Requirements”

6. 10 CFR Part 71, “Packaging and Transportation of Radioactive Material” 

7. 49 CFR, “Transportation” 

4.4.9.2 Regulatory Guidance 

1. NUREG-1660, “U.S.-Specific Schedules of Requirements for Transport of Specified 

Types of Radioactive Material Consignments,” January 1999 

2. Regulatory Guide 7.4, “Leak Tests on Packages for Shipment of Radioactive Materials,” 

Revision 1, March 2012
June 2015 4-16 NUREG-1520, Revision 2

3. Regulatory Guide 7.7, “Administrative Guide for Verifying Compliance with Packaging 

Requirements for Shipping and Receiving of Radioactive Material,” Revision 1, 

March 2012 

4. Regulatory Guide 7.10, “Establishing Quality Assurance Programs for Packaging Used 

in Transport of Radioactive Material,” Revision 2, March 2005

4.4.9.3 Acceptance Criteria 

The applicant’s commitment to implement additional program features is acceptable if the 

license application provides data and information that meet each of the following commitments:

1. Maintain records of the radiation protection program (including program provisions, 

audits, and reviews of the program content and implementation), radiation survey results 

(air sampling, bioassays, external exposure data from monitoring of individuals, internal 

intakes of radioactive material), results of corrective action program referrals, RWPs, 

and planned special exposures. 

2. Establish a program to report to the NRC, within the timeframe stated in regulations, 

incidents specified in 10 CFR 20.2202, “Notification of Incidents,” and safety significant 

events specified in 10 CFR 70.74. Refer reportable incidents or events to the facility’s 

corrective action program and report to the NRC both the corrective action(s) taken (or 

planned) to protect against a recurrence and any proposed schedule to achieve 

compliance with applicable license conditions. 

3. Prepare and submit to the NRC an annual report of the results of individual monitoring, 

as required by 10 CFR 20.2206(b). Establish a program that will assure shipment and 

receipt of radioactive materials consistent with regulations in 10 CFR 20, 10 CFR 71, 

49 CFR, and others, as applicable. This includes having (a) qualified personnel 

performing these operations, (b) procedures to implement the program and generate 

and maintain appropriate records, and (c) a supporting quality assurance function. 

4.5 Review Procedures 

4.5.1 Acceptance Review

During the acceptance review of a license application, the reviewer should examine the 

submittals to identify major deficiencies in the information provided for each area of review 

specified in SRP Section 4.3. Reviewers must decide whether they have enough information to 

proceed with a detailed review. Less significant errors or deficiencies that can be addressed in 

a request for additional information should be accepted. However, before the NRC performs a 

detailed review, the applicant should correct major deficiencies that would require several 

requests for additional information to resolve. 

Reviewers should record whether each area of review is adequately addressed in the 

application, is adequately addressed in a referenced document, is not applicable to the 

application, or has a major deficiency. 
June 2015 4-17 NUREG-1520, Revision 2

4.5.2 Safety Evaluation

The primary reviewer will perform a safety evaluation with respect to the acceptance criteria in 

Section 4.4. During the initial review, the reviewer should draft the safety evaluation report 

(SER) described below. A request for additional information (RAI) will be prepared when 

clarification and additional information are needed to determine whether the licensee’s 

submittals comply with the regulations. The primary reviewer should coordinate with the 

licensing project manager in preparing RAIs. For existing facilities, the reviewer will consult with 

the cognizant NRC inspector for radiation protection to identify and resolve any issues of 

concern related to the licensing review. Additional information submitted by the applicant will be 

evaluated and a final SER will be provided to the licensing project manager.

4.6 Evaluation Findings 

The regulations in 10 CFR 70.23, “Requirements for the Approval of Applications,” and 

10 CFR 70.66, “Additional Requirements for Approval of License Application,” state that an 

application for a license will be approved if the Commission can make the general findings listed 

in those sections. The basis for the general findings is an evaluation of whether the application 

adequately addresses all of the applicable regulatory requirements. More specifically, the basis 

for the general findings is an evaluation of all the detailed regulatory requirements that apply to 

the application. The staff’s evaluation should determine whether the licensing submittals 

provide sufficient information to satisfy the regulatory requirements listed in Section 4.4 of this 

SRP and whether the applicant has appropriately addressed the regulatory acceptance criteria 

in satisfying the requirements also described in this SRP section. The reviewer will write an 

SER addressing each topic reviewed and explaining why the NRC staff has reasonable 

assurance that the radiation protection part of the application is acceptable and that the health 

and safety of the workers are adequately protected. The SER should state how the applicable 

regulatory requirements have been met based on the acceptance criteria described in this 

chapter of the SRP. If the applicant chooses to use an alternative approach, the reviewer 

should discuss in the SER whether the proposed approach satisfies the applicable regulatory 

requirements. The reviewers should use the following approach to document their evaluation: 

1. State a specific regulatory requirement that applies to the application. Detailed 

acceptance criteria may be included where appropriate or necessary. 

2. Identify the areas where the regulatory requirement is addressed in the application, 

including the areas where the specific acceptance criteria described in this SRP are 

addressed. 

3. Describe your evaluation of the application, the basis for your conclusion, and whether 

regulatory requirements are met. 

4. Repeat these steps for every regulatory requirement that applies to the application. 

There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

application or amendment request, (2) denial of the application or request, or (3) approval with 

conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

reviewer may consider proposing a license condition. Absent an NRC order, license conditions 

must be agreed upon with the licensee or applicant before becoming part of the license. 

A license condition should only be proposed if there is reasonable assurance that, if the 

licensee meets the condition, all regulatory requirements will be satisfied. Thus, license 
June 2015 4-18 NUREG-1520, Revision 2

conditions should not be used to cover major deficiencies in an application. License conditions 

should be unambiguous, inspectable, and enforceable. They should only require those actions 

necessary to ensure compliance with applicable regulations. The basis for license conditions 

must be documented in the SER. 

The applicant has committed to an acceptable radiation protection program that includes 

the following: 

 an effective documented program to ensure that occupational radiological 

exposures are ALARA 

 an organization with adequate qualification requirements for the radiation 

protection personnel 

 approved written radiation protection procedures and RWPs for radiation 

protection activities 

 radiation protection training for all personnel who have access to 

restricted areas 

 a program to control airborne concentrations of radioactive material with 

engineering controls and respiratory protection 

 a radiation survey and monitoring program that includes requirements for 

controlling radiological contamination within the facility and monitoring 

external and internal radiation exposures 

 other programs to maintain records; report to the NRC in accordance with 

10 CFR Part 20 and 10 CFR Part 70; and appropriately respond to, 

investigate, and prevent incidents and accidents involving radiological 

exposures or uncontrolled releases of radioactive material 

The NRC staff concludes that the applicant’s radiation protection program is adequate 

and meets the requirements of 10 CFR Part 19, 10 CFR Part 20, 10 CFR Part 70, and 

10 CFR Part 71. Conformance to the license application and license conditions will 

ensure safe operation. 

The applicant has accurately evaluated, in the ISA summary, those accident sequences 

with intermediate and high radiological consequences. The applicant has also identified 

controls and management measures that reduce the likelihood or consequences of 

accident sequences and meet the performance criteria of 10 CFR 70.61. 

4.7 References

U.S. Code of Federal Regulations, Part 19, “Notices, Instructions and Reports to Workers: 

Inspection and Investigations,” Part 19, Chapter I, Title 10, “Energy.” 

U.S. Code of Federal Regulations, “Standards for Protection Against Radiation,” Part 20, 

Chapter I, Title 10, “Energy.” 
June 2015 4-19 NUREG-1520, Revision 2

U.S. Code of Federal Regulations, “Domestic Licensing of Special Nuclear Material,” Part 70, 

Chapter I, Title 10, “Energy.”

U.S. Code of Federal Regulations, “Packaging and Transportation of Radioactive Material,” 

Part 71, Chapter I, Title 10, “Energy.” 

U.S. Code of Federal Regulations, Title 49, “Transportation.” 

American Conference of Governmental Industrial Hygienists (ACGIH), “Industrial Ventilation: 

A Manual of Recommended Practice for Design,” ACGIH 2096, Cincinnati, OH, 2010. 

ACGIH, “Industrial Ventilation: A Manual of Recommended Practice for Operation and 

Maintenance,” ACGIH 2106, Cincinnati, OH, 2007. 

American Glovebox Society, “Guideline for Gloveboxes,” AGS-G001, Santa Rosa, CA, 2007. 

American National Standards Institute (ANSI), “Sampling and Monitoring Releases of Airborne 

Radioactive Substances from the Stacks and Ducts of Nuclear Facilities,” ANSI N13.1-2011, 

Washington, DC, 2011. 

ANSI, “Practice for Occupational Radiation Exposure Records Systems,” ANSI N13.6-2010, 

Washington, DC, 2010.

ANSI, “Performance Criteria for Radiobioassay,” ANSI N13.30-2011, Washington, DC, 2011. 

ANSI, “Design of Internal Dosimetry Programs,” ANSI N13.39-2001, Washington, DC, 2001. 

ANSI, “Performance and Documentation of Radiological Surveys,” ANSI N13.49-2001, 

Washington, DC, 2001. 

ANSI, “Radiation Protection Instrumentation Test and Calibration,” ANSI N323A-1997, 

Washington, DC, 1997. 

ANSI, “Practices for Respiratory Protection,” ANSI Z88.2-1992, Washington, DC, 1992. 

ANSI and the Health Physics Society, “Ionizing Radiation Safety Training for Workers,” 

ANSI/HPS N13.36, McLean, VA, October 30, 2001, reaffirmed July 19, 2011. 

ASME (formerly the American Society of Mechanical Engineers), “Code on Nuclear Air and Gas 

Treatment,” ASME AG-1 and applicable addenda, New York, NY, 2009. 

ASTM International (formerly the American Society for Testing and Materials), “Radiological 

Protection Training for Nuclear Facility Workers,” ASTM E1168-95, West Conshohocken, PA, 

reapproved 2008. 

Burchsted, C.A., A.B. Fuller, and J.E. Kahn, “Nuclear Air Cleaning Handbook,” Energy 

Research and Development Administration (ERDA) 76-21, Washington, DC, March 31, 1976. 

National Council on Radiation Protection and Measurements, “Operational Radiation Safety 

Training,” NCRP Report No. 134, Bethesda, MD, October 2000. 
June 2015 4-20 NUREG-1520, Revision 2

U.S. Nuclear Regulatory Commission, “Air Sampling in the Workplace,” NUREG-1400, 

September 1993. 

U.S. Nuclear Regulatory Commission, “Integrated Safety Analysis Guidance Document,” 

NUREG-1513, May 2001. 

U.S. Nuclear Regulatory Commission, “U.S.-Specific Schedules of Requirements for Transport 

of Specified Types of Radioactive Material Consignments,” NUREG-1660, January 1999 

U.S. Nuclear Regulatory Commission, “Nuclear Fuel Cycle Facility Accident Analysis 

Handbook,” NUREG/CR-6410, March 1998. 

U.S. Nuclear Regulatory Commission, “Minimization of Contamination and Radioactive Waste 

Generation: Life Cycle Planning,” Regulatory Guide 4.21, June 2008. 

U.S. Nuclear Regulatory Commission, “Leak Tests on Packages for Shipment of Radioactive 

Materials,” Regulatory Guide 7.4, Revision 1, March 2012.

U.S. Nuclear Regulatory Commission, “Administrative Guide for Verifying Compliance With 

Packaging Requirements for Shipping and Receiving of Radioactive Material,” Regulatory 

Guide 7.7, Revision 1, March 2012. 

U.S. Nuclear Regulatory Commission, “Establishing Quality Assurance Programs for Packaging 

Used in Transport of Radioactive Material,” Regulatory Guide 7.10, Revision 2, March 2005.

U.S. Nuclear Regulatory Commission, “Administrative Practices in Radiation Surveys and 

Monitoring,” Regulatory Guide 8.2, May 2011. 

U.S. Nuclear Regulatory Commission, “Personnel Monitoring Device--Direct-Reading Pocket 

Dosimeters,” Regulatory Guide 8.4, Revision 1, June 2011. 

U.S. Nuclear Regulatory Commission, “Instructions for Recording and Reporting Occupational 

Radiation Exposure Data,” Regulatory Guide 8.7, Revision 2, November 2005. 

U.S. Nuclear Regulatory Commission, “Acceptable Concepts, Models, Equations, and 

Assumptions for a Bioassay Program,” Regulatory Guide 8.9, Revision 1, July 1993. 

U.S. Nuclear Regulatory Commission, “Operating Philosophy for Maintaining Occupational 

Radiation Exposures as Low as Is Reasonably Achievable,” Regulatory Guide 8.10, 

Revision 1-R, May 1977. 

U.S. Nuclear Regulatory Commission, “Instructions Concerning Prenatal Radiation Exposure,” 

Regulatory Guide 8.13, Revision 3, June 1999. 

U.S. Nuclear Regulatory Commission, “Acceptable Programs for Respiratory Protection,” 

Regulatory Guide 8.15, Revision 1, October 1999. 

U.S. Nuclear Regulatory Commission, “Health Physics Surveys During Enriched Uranium-235 

Processing and Fuel Fabrication,” Regulatory Guide 8.24, Revision 2, June 2012. 
June 2015 4-21 NUREG-1520, Revision 2

U.S. Nuclear Regulatory Commission, “Air Sampling in the Workplace,” Regulatory Guide 8.25, 

Revision 1, June 1992. 

U.S. Nuclear Regulatory Commission, “Instructions Concerning Risks from Occupational 

Radiation Exposure,” Regulatory Guide 8.29, Revision 1, February 1996. 

U.S. Nuclear Regulatory Commission, “Monitoring Criteria and Methods To Calculate 

Occupational Radiation Doses,” Regulatory Guide 8.34, July 1992. 

U.S. Nuclear Regulatory Commission, “Methods for Measuring Effective Dose Equivalent from 

External Exposure,” Regulatory Guide 8.40, July 2010. 

June 2015 5-1 NUREG-1520, Revision 2 

5. NUCLEAR CRITICALITY SAFETY 

5.1 Purpose of Review 

The primary purpose of the review is to determine, with reasonable assurance, whether the 

applicant has designed a facility that will provide adequate protection against criticality hazards 

related to the storage, handling, and processing of licensed materials, as required by Title 10, 

“Energy,” of the Code of Federal Regulations (10 CFR) Part 70, “Domestic Licensing of Special 

Nuclear Material.” The facility design must adequately protect the health and safety of workers 

and the public from the risk of accidental criticality during both normal and credible abnormal 

conditions.1

To support this primary purpose, the review should also determine, with reasonable assurance, 

whether the licensee’s or applicant’s Nuclear Criticality Safety (NCS) Program is adequate to 

meet the regulatory requirements of 10 CFR Part 70 and to support the safe possession and 

use of special nuclear material (SNM) at the facility. The review should therefore examine the 

parts of the license application that describe the NCS Program. The review should also ensure 

that, if applicable, the requirements pertaining to performance of an Integrated Safety Analysis 

(ISA) (e.g., 10 CFR 70.61, “Performance Requirements”) are satisfied, and that the contents of 

the ISA summary required by 10 CFR 70.65, “Additional Content of Applications,” are adequate 

with regard to the evaluation of NCS-related hazards. 

5.2 Responsibility for Review 

Primary: NCS License Reviewer / Nuclear Process Engineer (Criticality) 

Secondary: NCS Inspector / Nuclear Process Engineer (Criticality) 

 Other U.S. Nuclear Regulatory Commission (NRC) staff cognizant in NCS 

 Licensing Project Manager 

5.3 Areas of Review 

Regulations in 10 CFR 70.62(a) require the applicant to establish and maintain a safety program 

that will adequately protect worker and public health and safety and the environment and that 

demonstrates compliance with the performance requirements of 10 CFR 70.61. In addition, as 

specified in 10 CFR 70.22(a)(8), licensees must describe, in their license application, 

procedures to protect health and minimize danger to life or property, including procedures to 

avoid accidental criticality. These requirements are implemented by establishment of an NCS 

program as described in this chapter of the SRP. Applicants must also perform an ISA and 

submit an ISA summary that meets the requirements of 10 CFR 70.65. 

A. For a new application or a license-renewal application, the specific areas of review are 

as follows: 

 

1

 Throughout Chapter 5 of this SRP and its appendices, the term “credible” as used in “credible abnormal conditions” 

in 10 CFR 70.61(d) should be understood in the context of meeting the double-contingency principle. This is not 

necessarily quantitatively equivalent to “credible” as used in 10 CFR 70.61(b) and (c). See Appendix 5-A for more 

details. 
June 2015 5-2 NUREG-1520, Revision 2 

1. The sections of the license application describing the licensee’s or applicant’s 2

license commitments with regard to the NCS Program. This includes 

identification of the organization and administration of the NCS Program, 

management measures, and methodologies and technical practices. 

2. The sections of the ISA summary describing how the applicant meets the 

performance requirements for NCS hazards. This includes the applicant’s 

methodology for performing the ISA, as it is applied to NCS hazards, and the 

results of applying that methodology to analyzing NCS hazards and scenarios 

and demonstrating subcriticality under normal and credible abnormal conditions. 

3. The sections of the license application and ISA summary describing the 

applicant’s criticality accident alarm system (CAAS) and emergency response 

measures for protecting workers and the public from the consequences of 

accidental criticality events. 

4. The applicant’s quality assurance plan, emergency plan, and criticality code 

validation report, if applicable and to the extent that they have provisions related 

to NCS. These items support but are not part of the license application, and the 

reviewer should ensure that all necessary commitments have been included, 

either explicitly or by reference, in the license application. 

5. ISA documentation, including the applicant’s process-hazard analyses, criticality 

safety evaluations (CSEs),3

 and calculations and other supporting technical 

documents, that demonstrate the adequacy of the applicant’s license 

commitments and demonstrate that the applicant meets the performance 

requirements of 10 CFR 70.61. These will generally be examined in a sampling 

review as part of an in-office or onsite vertical slice review. 

 

B. For a license amendment, the specific areas of review are as follows: 

1. Those portions of the license application affected by the change. The reviewer 

should ensure that the effectiveness of any license commitments is not reduced, 

or that the licensee has provided an adequate justification that there is still 

adequate protection against the risk of an accidental criticality. 

2. Those portions of the ISA summary affected by the change. The reviewer should 

verify that any changed facility operations still comply with the performance 

requirements of 10 CFR 70.61. This includes examining any changes to process 

descriptions, new or changed assumptions, controlled parameters, safety limits, 

controls, or safety margin, as well as new or changed criticality accident 

sequences and items relied on for safety. 

3. Any portions of the license application and ISA summary pertaining to the 

licensee’s CAAS and emergency response measures affected by the change. 

The reviewer should verify that the applicant still complies with the requirements 

of 10 CFR 70.24, “Criticality Accident Requirements.” 

 

2

 Hereinafter referred to for simplicity as “the applicant,” except where it is clear the staff is referring solely to an 

existing licensee. 3

 The specific terms used in each applicant’s NCS Program will vary (NCS analyses, NCS evaluations, etc.). The 

term “CSE” is used generically in this chapter for formal and structured analyses performed to demonstrate 

subcriticality for a nuclear system. This may consist of a single document or multiple documents. 
June 2015 5-3 NUREG-1520, Revision 2 

4. Any relevant portions of the quality assurance plan, emergency plan, or criticality 

code validation report affected by the change, if applicable. With regard to 

quality assurance, the reviewer should verify that criticality controls have 

appropriate management measures applied. With regard to the emergency plan, 

the reviewer should verify that it appropriately protects personnel from the 

consequences of a criticality accident. With regard to the validation, the reviewer 

should verify that calculations pertaining to changed operations are still within the 

licensee’s validated area of applicability, or that the area of applicability has been 

appropriately extended, and that the licensee’s margin of subcriticality for safety 

remains valid. 

5. Justification for the change, including revised criticality safety basis documents 

(process hazard analyses, CSEs, calculations, and other supporting technical 

documents) that are needed to demonstrate adequate protection against the risk 

of accidental criticality. 

Review Interfaces 

The criticality reviewer should examine information in the following other areas to determine 

whether it is consistent with Chapter 5 of the application. The listed standard review plan (SRP) 

sections interface with this section as follows: 

 Review facility and process descriptions applied to criticality safety under SRP 

Chapter 1. 

 Review the organization structure and qualifications and responsibilities of key personnel 

under SRP Chapter 2. 

 Review ISA methodology for applicability to criticality hazards under SRP Chapter 3. 

 Review the emergency plan as applied to criticality safety under SRP Chapter 8. 

 Review management measures applied to criticality-related items relied on for safety 

(IROFS) under SRP Chapter 11. 

The specific acceptance criteria and review procedures are contained in the referenced SRP 

sections. 

5.4 Acceptance Criteria 

The applicant should provide NCS commitments and describe how the commitments will be 

implemented. Commitments and descriptions are expected when the acceptance criteria are 

relevant to the safety of special nuclear material. 

5.4.1 Regulatory Requirements 

Acceptance criteria are based on meeting the relevant requirements of the following regulations: 

1. The general and additional contents that an application must contain are stated in 

10 CFR 70.22, “Contents of Applications,” and 70.65. General information that must be 

included in the license application is described in 10 CFR 70.22. Information that must 

be included in the ISA summary is described in 10 CFR 70.65. 
June 2015 5-4 NUREG-1520, Revision 2 

2. The requirements for approval of the application are stated in 10 CFR 70.23, 

“Requirements for the Approval of Applications,” and 70.66, “Additional Requirements for 

New Facilities or New Processes at Existing Facilities.” 

3. The requirements for a CAAS and emergency response procedures are stated in 

10 CFR 70.24. 

4. The requirements for demonstrating adequate protection against the risk of a nuclear 

criticality accident are stated in 10 CFR 70.61. 

5. The requirements for establishing and maintaining a safety program are stated in 

10 CFR 70.62, “Safety Program and Integrated Safety Analysis.” 

6. The requirements for new facilities or new processes at existing facilities requiring a 

license amendment under 10 CFR 70.72, “Facility Changes and Change Process,” are 

stated in 10 CFR 70.64, “Requirements for New Facilities or New Processes at Existing 

Facilities,” and include adherence to the double-contingency principle. 

7. The requirements to report certain conditions affecting the safety of licensed material are 

in 10 CFR 70.50, “Reporting Requirements,” and Appendix A, “Reportable Safety 

Events,” to 10 CFR Part 70. 

5.4.2 Regulatory Guidance 

The following additional guidance may be used to supplement the review of the NCS Program: 

1. NUREG-1513, “Integrated Safety Analysis Guidance Document,” May 2001 

2. NUREG/CR-6410, “Nuclear Fuel Cycle Facility Accident Analysis Handbook,” 

March 1998 

3. NUREG/CR-6698, “Guide for Validation of Nuclear Criticality Safety Calculational 

Methodology,” January 2001 

4. NRC Regulatory Guide (RG) 3.71, “Nuclear Criticality Safety Standards for Fuels and 

Material Facilities,” December 2010 

5.4.3 Regulatory Acceptance Criteria 

Specific criteria acceptable to meet the relevant requirements of the NRC’s regulations identified 

above are as follows for each review described in subsection 5.4 of this SRP section. 

The SRP is not a substitute for the NRC’s regulations, and compliance with it is not required. 

The SRP provides one acceptable method for demonstrating compliance with the regulatory 

requirements for obtaining a materials license for a fuel cycle facility, though it might not apply in 

every case. An applicant that does not meet applicable guidance in this SRP should describe 

and justify an acceptable alternative to meet the regulations. The reviewer should consider the 

applicant’s commitments in a given area to be acceptable if the applicant has met the following 

acceptance criteria or has identified and justified an acceptable alternative approach.
June 2015 5-5 NUREG-1520, Revision 2 

5.4.3.1 License Application 

The reviewer should examine the applicant’s license commitments regarding the organization 

and administration of its NCS Program. 

5.4.3.1.1 Use of Industry Standards 

RG 3.71, “Nuclear Criticality Safety Standards for Fuels and Material Facilities,” endorses 

American National Standards Institute (ANSI)/American Nuclear Society (ANS)-8 national 

standards, with some exceptions and qualifications. The NRC endorsement of these standards 

means that they provide methods and practices generally acceptable to the NRC staff for the 

prevention and mitigation of criticality accidents. However, application of a standard is not a 

substitute for detailed NCS analyses for specific operations. 

 

If the applicant is requesting to conduct activities to which an NRC-endorsed standard applies, 

the reviewer should verify that the applicant addresses the subjects covered by the standard by 

satisfying the following acceptance criteria: 

(1) The license application contains a commitment to follow the requirements (i.e., “shall” 

statements) of the standard, subject to any exceptions and qualifications taken by the 

NRC. The application clearly specifies the version of the standard and the specific parts 

of the standard to which the applicant is committing. 

(2) If there are parts of the industry standard to which the applicant does not commit, the 

applicant provides sufficient information for the staff to determine that the parts of the 

standard are not applicable to the applicant’s activities or that the license application 

contains other commitments that achieve an equivalent safety purpose. 

The applicant may also choose to demonstrate compliance with regulatory requirements by 

committing to follow the recommendations (i.e., “should” statements) of a standard, though 

committing to the recommendations is not required for compliance with a standard. 

The applicant should clarify its intent in committing to requirements expressed only as general 

principles in the standards by more specific commitments and descriptions of how those 

principles will be implemented in its license application. Applicants should generally use the 

most current revision of the standards that have been endorsed by the NRC in the version of 

RG 3.71 in effect when the license application is submitted. If the applicant commits to a 

standard or a version of a standard that the NRC has not endorsed or is not the most current 

endorsed version, or commits to unendorsed portions of an otherwise endorsed standard, the 

license application should contain justification for the acceptability of these commitments. The 

use of standards other than ANS standards (e.g., International Organization for Standardization 

(ISO) 1709, “Nuclear Energy—Fissile Materials—Principles of Criticality Safety in Storing, 

Handling and Processing,” or ISO 7753, “Nuclear Energy—Performance and Testing 

Requirements for Criticality Detection and Alarm Systems”) may be acceptable if suitably 

justified. 

RG 3.71 endorses the following ANSI/ANS-8 national standards in full, as of the date of 

publication of this SRP: 

 ANSI/ANS-8.5-1996 (reaffirmed in 2007), “Use of Borosilicate-Glass Raschig Rings as a 

Neutron Absorber in Solutions of Fissile Material” 
June 2015 5-6 NUREG-1520, Revision 2 

 ANSI/ANS-8.6-1983 (reaffirmed in 2010), “Safety in Conducting Subcritical 

Neutron-Multiplication Measurements In Situ” 

 ANSI/ANS-8.7-1998 (reaffirmed in 2007), “Nuclear Criticality Safety in the Storage of 

Fissile Materials” 

 ANSI/ANS-8.10-1983 (reaffirmed in 2005), “Criteria for Nuclear Criticality Safety Controls 

in Operations with Shielding and Confinement” 

 ANSI/ANS-8.12-1987 (reaffirmed in 2002), “Nuclear Criticality Control and Safety of 

Plutonium-Uranium Fuel Mixtures Outside Reactors” 

 ANSI/ANS-8.14-2004, “Use of Soluble Neutron Absorbers in Nuclear Facilities Outside 

Reactors” 

 ANSI/ANS-8.15-1981 (reaffirmed in 2005), “Nuclear Criticality Control of Special Actinide 

Elements” 

 ANSI/ANS-8.19-2005, “Administrative Practices for Nuclear Criticality Safety” 

 ANSI/ANS-8.20-1991 (reaffirmed in 2005), “Nuclear Criticality Safety Training” 

 ANSI/ANS-8.21-1995 (reaffirmed in 2001), “Use of Fixed Neutron Absorbers in Nuclear 

Facilities Outside Reactors” 

 ANSI/ANS-8.22-1997 (reaffirmed in 2006), “Nuclear Criticality Safety Based on Limiting 

and Controlling Moderators” 

 ANSI/ANS-8.23-2007, “Nuclear Criticality Accident Emergency Planning and Response” 

 ANSI/ANS-8.26-2007, “Criticality Safety Engineer Training and Qualification Program” 

 RG 3.71 currently endorses the following ANSI/ANS-8 national standards in part: 

 ANSI/ANS-8.1-1998 (reaffirmed in 2007), “Nuclear Criticality Safety in Operations with 

Fissionable Material Outside Reactors” 

 ANSI/ANS-8.3-1997 (reaffirmed in 2003), “Criticality Accident Alarm System” 

 ANSI/ANS-8.17-2004 (reaffirmed in 2009), “Criticality Safety Criteria for the Handling, 

Storage, and Transportation of LWR [Light-Water Reactor] Fuel Outside Reactors” 

 ANSI/ANS-8.24-2007, “Validation of Neutron Transport Methods for Nuclear Criticality 

Safety Calculations” 

The reviewer should consult the version of RG 3.71 in effect at the time the license application 

is submitted and determine whether newer versions of these standards or new standards have 

been endorsed, and should make note of any exceptions of qualifications. 
June 2015 5-7 NUREG-1520, Revision 2 

5.4.3.1.2 Criticality Accident Alarm System (CAAS) 

The reviewer should consider that the applicant’s commitment to meet the CAAS requirements 

in 10 CFR 70.24 is acceptable if the applicant or licensee has met the following acceptance 

criteria or has identified and justified an alternative in the application: 

1. The applicant describes a facility CAAS that meets the requirements of 10 CFR 70.24. 

2. The applicant commits to the current endorsed version of ANSI/ANS-8.3, with 

exceptions as noted in RG 3.71, or to an acceptable alternative (e.g., ISO 7753) with 

justification: 

a. For licensees authorized to possess quantities greater than the 10 CFR 70.24 

mass limits (e.g., special nuclear material containing more than 700 grams of 

235U), there shall be CAAS coverage in all areas in which such quantities of 

special nuclear material are handled, used, or stored (to be consistent with 

ANSI/ANS-8.3 as endorsed by RG 3.71). Controls are established to preclude 

such SNM from areas where coverage is not provided. 

b. Each monitored area must be covered by two criticality detectors. 

c. The monitoring system must be capable of detecting a nuclear criticality that 

produces an absorbed dose in soft tissue of 20 rads of combined neutron and 

gamma radiation at an unshielded distance of 2 meters from the material within 

1 minute. 

With regard to commitments to follow specific industry practices described in ANSI/ANS-8.3, 

the applicant should provide additional details as follows: 

1. The applicant describes a CAAS appropriate to the facility for the type of radiation 

detected, intervening shielding, and magnitude of the minimum accident of concern. 

 The applicant’s description of its CAAS should include the type of radiation detector and 

alarm; the detection threshold and minimum accident of concern; the detector logic used 

to provide dual alarm coverage, minimize false alarms, and detect failure; method used 

to determine radius of coverage; placement of alarms; and actions for maintaining and 

calibrating the system. 

2. The applicant commits to designing a CAAS to be resistant to damage from anticipated 

adverse events such as a fire, explosion, corrosive atmosphere, seismic shock 

equivalent to the site-specific design-basis earthquake or equivalent value specified by 

the Uniform Building Code, or other adverse conditions that do not result in evacuation 

of the entire facility. 

3. The applicant commits to providing emergency power for the CAAS or provides 

justification for the use of continuous monitoring with portable instruments. 

4. The applicant commits to rendering operations safe, by shutdown and quarantine if 

necessary, in any area where CAAS coverage has been lost and not restored within a 

specified number of hours. The number of hours may be determined on a 

process-by-process basis, because shutting down certain processes, even to make 

them safe, may carry a larger risk than being without a CAAS for a short time. The 
June 2015 5-8 NUREG-1520, Revision 2 

applicant should commit to compensatory measures (e.g., limiting access, halting 

movement of SNM) when the CAAS is not functional. 

5.4.3.1.3 Emergency Planning and Response 

In addition to meeting the CAAS requirements of 10 CFR 70.24(a), the reviewer should consider 

the applicant’s commitments to emergency planning and response acceptable if the applicant 

has met the following acceptance criteria or has justified acceptable alternatives (see Chapter 8 

of this SRP): 

1. The applicant commits to the ANSI/ANS-8.23 standard. 

2. The applicant has an emergency plan or satisfies the alternative requirements in 

10 CFR 70.22(i)(1)(i). 

3. The applicant commits to personnel accident dosimeters in areas that require a CAAS, 

pursuant to 10 CFR 70.24(b)(1). These dosimeters should be readily available to 

personnel responding to an emergency, and there should be a method for prompt onsite 

dosimeter readout. 

4. The applicant describes arrangements for the on-site decontamination of personnel and 

the transport and medical treatment of exposed individuals, pursuant to 10 CFR 

70.24(b)(2). 

5.4.3.1.4 Subcriticality and Double-Contingency Principle

The reviewer should consider the applicant’s commitments to demonstrating that all nuclear 

processes will be subcritical under normal and credible abnormal conditions to be acceptable if 

the applicant has met the following acceptance criteria or has justified acceptable alternatives: 

1. The applicant commits to one or more of the following methods for determining 

subcritical limits on controlled parameters under normal conditions, or subcritical values 

under abnormal conditions: 

a. The applicant commits to use the subcritical values in a currently endorsed 

standard (e.g., ANSI/ANS-8.1, -8.5, -8.7, -8.12, or -8.15) or ANSI/ANS-8.9, 

“Nuclear Criticality Safety Guide for Pipe Intersections Containing Aqueous 

Solutions of Enriched Uranyl Nitrate” (withdrawn as an active standard). 

b. The applicant commits to use the subcritical or critical values, with appropriate 

margin, from widely accepted industry handbooks (e.g., Los Alamos National 

Laboratory’s LA-10860-MS, “Critical Dimensions of Systems Containing 235U, 

239Pu, and 233U,” or Atlantic Richfield Hanford Company’s ARH-600, “Criticality 

Handbook”), experimental data, or peer-reviewed publications. The specific 

sources used should be referenced by name in the license application. 

c. The applicant commits to use industry-accepted hand-calculation methods 

(e.g., areal density, solid angle technique, etc.), subject to the limitations of those 

methods. 

d. The applicant commits to use deterministic or probabilistic (e.g., discrete 

ordinates or Monte Carlo) computer codes to calculate the effective multiplication 
June 2015 5-9 NUREG-1520, Revision 2 

factor keff. These calculational methods should be validated in accordance with 

the ANSI/ANS-8.24 standard. 

2. For each method used to demonstrate subcriticality, the applicant commits to use the 

method consistent with any limitations, with an appropriate margin of subcriticality and 

within its area of applicability. The margin of subcriticality and area of applicability are to 

be described in the license application. 

3. The applicant commits to determine safety limits based on one of the methods listed in 

paragraph (1) above. The applicant commits to evaluate controlled parameters at their 

safety limits (or more conservatively) and to evaluate parameters that are not controlled 

at their most reactive credible values. 

4. The applicant describes a program that complies with the double contingency principle, 

where practicable. This principle is defined in 10 CFR 70.4, “Definitions” (and is stated 

in ANSI/ANS-8.1), as follows: 

Process designs should incorporate sufficient factors of safety to require at least 

two unlikely, independent, and concurrent changes in process conditions before 

a criticality accident is possible.4

Each process that has accident sequences leading to criticality should have sufficient 

engineered and administrative controls in place to ensure double-contingency protection 

during normal operations. If double-contingency protection is lost through the failure of 

one or more of these controls, the process should be halted until the controls can be 

reestablished. This necessitates a program that incorporates prompt detection and 

correction of such contingencies. The term “concurrent” means that the effect of the first 

process change persists when the second change occurs. It does not mean that the two 

events must occur simultaneously. The likelihood of criticality can be markedly reduced 

if control failures are promptly detected and processes are promptly rendered safe. 

The term “process conditions” encompasses the full spectrum of factors that can affect 

criticality safety, not just the set of controlled parameters. “Process condition” is not 

synonymous with “controlled parameter.” Thus, double contingency protection may be 

provided by either (1) control of two independent parameters, or (2) control of a single 

process parameter, such that at least two independent failures or events involving the 

parameter would have to happen before a criticality accident is possible. The first 

method, reliance on two different parameters, is preferred because of the inherent 

difficulty in preventing common-mode failures when controlling only one parameter. 

The reviewer should note that double contingency does not necessarily mean that two 

controls are required. In some cases, it may be appropriate to credit the natural and 

credible course of events (e.g., unsintered powder cannot exceed a maximum 

theoretical density; there is no means of enriching beyond 5 wt% 235U; or reliance on the 

low historical likelihood of flooding) without needing to establish explicit controls. Where 

there is no credible accident sequence leading to criticality, the double-contingency 

principle is met by definition. The reviewer should exercise judgment in determining 

 

4

 Throughout Chapter 5 of this SRP and its appendices, the term “unlikely” as used in the double contingency 

principle is not necessarily quantitatively equivalent to “unlikely” as used in 10 CFR 70.61(c). See Appendix 5-A for 

more details. 
June 2015 5-10 NUREG-1520, Revision 2 

whether the applicant has established sufficient measures to ensure that occurrence of 

the contingencies is “unlikely.” 

In rare instances, double-contingency protection will not be practicable. The applicant 

should identify any such cases in the license application and should provide justification 

as to why the affected processes are acceptably safe. The justification should 

demonstrate that the risk is sufficiently low that an exception to the general principle is 

warranted. The reviewer should note that the double-contingency principle is a 

recommendation in ANSI/ANS-8.1 and should recall that earlier statements of the 

principle treated it as a general design principle, rather than expecting that it had to be 

met in every case (“Process designs should, in general, incorporate sufficient factors of 

safety....”). The more important requirement is the subcriticality requirement 

incorporated in 10 CFR 70.61(d) (“all nuclear processes are subcritical” under both 

“normal and credible abnormal conditions”). Thus, as long as the applicant meets this 

10 CFR 70.61(d) provision, an exception to following the double-contingency principle 

may be justified if the criticality risk is shown to be sufficiently low. 

Additional guidance pertaining to compliance with the double-contingency principle is 

given in Appendix 5-A to this SRP. 

5.4.3.1.5 Organization and Administration of the NCS Program

The reviewer should consider the applicant’s management of the NCS program acceptable if 

the applicant has met the following acceptance criteria or has identified and justified an 

alternative approach: 

1. The applicant describes and commits to implement and maintain an NCS Program to 

meet the applicable 10 CFR Part 70 requirements, and to ensure adequate protection 

against the consequences of accidental criticality events. The primary means of doing 

this should be prevention (i.e., ensuring that processes will be subcritical under normal 

and credible abnormal conditions). 

2. The applicant describes the NCS Program’s objectives (which should include the 

following) and how the applicant will meet those objectives. 

a. Performing and documenting criticality safety evaluations (CSEs) for new or 

changed processes and establishing safety limits and controls as necessary to 

ensure that processes will remain subcritical under normal and credible abnormal 

conditions 

b. Establishing, as practicable, double-contingency protection and defense-in-depth 

measures; ensuring sufficient margins of safety and subcriticality to provide 

additional assurance that the likelihood of criticality will be acceptably low 

c. Establishing and maintaining a CAAS system and emergency-response 

procedures to protect health and safety in the event criticality occurs 

 

d. Providing technical support to emergency response personnel in responding to 

and recovering from abnormal conditions and emergencies up to and including a 

criticality accident 

e. Verifying the adequacy of criticality controls through audits and assessments, 

including observation of operations and verification of equipment configuration 
June 2015 5-11 NUREG-1520, Revision 2 

f. Ensuring the adequacy of CSEs through peer reviews, self-assessments, and 

validation and verification of calculational methods 

g. Training and otherwise supporting operations in procedures to ensure the safe 

handling of special nuclear material 

h. Supporting regulatory compliance with regard to event reporting (10 CFR 70.50 

and Appendix A to 10 CFR 70), complying with the facility change process 

(10 CFR 70.72), and participating in the performance and documentation of the 

facility’s ISA (10 CFR 70.61 through 70.66) insofar as they pertain to criticality 

safety. 

3. The applicant outlines an NCS Program structure that is consistent with current industry 

practices (e.g., ANSI/ANS-8.1 and ANSI/ANS-8.19), including establishing the roles and 

responsibilities of key Program personnel (e.g., NCS Manager, NCS Senior Engineers, 

and NCS Engineers). While the specific titles and functions of personnel may vary from 

one applicant to another, specific positions should have responsibility for implementing 

Program objectives, including designation of an NCS Program Manager who has overall 

responsibility for implementing the NCS Program. 

4. The applicant describes the training and qualification of key NCS Program personnel. 

Experience and education levels should be specified commensurate with personnel 

responsibilities. Training and qualification should be consistent with ANSI/ANS-8.26 as 

specified in RG 3.71. 

5. The applicant commits to establish and maintain NCS safety limits, and to maintain any 

operating limits that it may establish5

, and commits to maintain management measures 

to ensure their continued reliability and availability. 

6. The applicant commits to support operations personnel through development of training, 

preparation of NCS postings and other appropriate operator aids for key administrative 

controls (e.g., painted lines on the floor and warning lights), and review of procedures 

and operations to ensure they are unambiguous, easily understood, and readily 

achievable. 

7. The applicant commits to evaluating modifications to the facility or safety program to 

ascertain their impact on criticality safety. 

8. The applicant should describe a corporate structure in which the NCS Organization is 

independent of operations to the extent practical. 

9. The applicant commits to requiring personnel to perform activities in accordance with 

written, approved procedures when the activity could affect NCS. If existing procedures 

do not cover a specific situation, personnel should be trained to take no action until NCS 

staff has evaluated the situation and provided recovery instructions. 

 

5

 Licensees frequently establish separate operating limits to provide additional margin and ensure that safety limits 

established in criticality safety evaluations are unlikely to be transgressed. Established limits should take into 

account process uncertainty and variability, though this is not meant to imply that separate safety and operating 

limits are required. 
June 2015 5-12 NUREG-1520, Revision 2 

10. The applicant commits to requiring its personnel to report defective NCS conditions to 

operations supervision and NCS Program staff. The applicant establishes management 

policies that reinforce operators’ stop-work authority and encourage the reporting of 

defective conditions. 

5.4.3.1.6 Management Measures Applied to the NCS Program 

The reviewer should consider the applicant’s commitments to its management measures for 

NCS acceptable if the applicant has met the following acceptance criteria or has identified and 

justified acceptable alternatives: 

The applicant commits to following industry practices described in ANSI/ANS-8.19 and 

ANSI/ANS-8.20 as they pertain to training, procedures, and audits and assessments. 

1. In addition, with regard to training: 

a. The applicant commits to train personnel in the areas discussed in Section 7 of 

ANSI/ANS-8.20. 

b. The applicant commits to train personnel with regard to procedural compliance, 

stop-work authority, response to alarms, and reporting of defective conditions. 

2. In addition, with regard to audits and assessments6

: 

a. The applicant commits to conducting and documenting audits (e.g.,, the 

observation of operations to verify compliance with criticality limits and controls) 

of all operating SNM process areas, such that all such areas will be reviewed at 

some specified frequency. The reviewer should consider the complexity of the 

process, the degree of process monitoring, the degree of reliance on 

administrative controls, and risk-significance in determining anappropriate 

frequency. Those operations that are no longer operating should also be 

reviewed at some reduced frequency to ensure that they remain in a safe 

condition. 

b. The applicant commits to conducting and documenting periodic NCS program 

audits (e.g.,, the independent review of NCS Program work products, such as 

CSEs, change packages, calculations, andfacility audits) at least once every 

2 years. This should be done by staff independent of those who had performed 

the functions themselves, either internal or external to the NCS Organization. 

c. Weaknesses identified through facility or program audits should be referred to 

the facility’s corrective-action program, which has the responsibility for promptly 

and effectively resolving them. A graded approach may be used to justify an 

alternate schedule for performing audits and assessments or for taking corrective 

action. 

 

6

 This phrase encompasses all kinds of self-assessments performed as part of the NCS Program. Audits and 

assessments of facility operations are the subject of paragraph (a) and those of the program itself are the subject of 

paragraph (b). The reviewer should recognize that these take many different forms and have many different 

names across the nuclear industry, including walkthroughs, audits, assessments, appraisals, inspections, etc. 
June 2015 5-13 NUREG-1520, Revision 2 

5.4.3.1.7 Technical Practices for NCS 

Acceptance criteria applicable to the applicant’s technical practices are as follows: 

In evaluating the applicant’s technical practices, the reviewer should not only ensure that the 

applicant has made the necessary commitments, but should also independently review a 

sampling of the applicant’s analyses to confirm the adequacy of its commitments. 

1. The applicant commits to perform CSEs using industry-accepted and peer-reviewed 

methods (e.g., in ANSI/ANS-8.1, -8.19, -8.24). 

2. The applicant commits to validate calculational methods used to develop NCS safety 

limits, in accordance with ANSI/ANS-8.24. 

3. The applicant = demonstrates an adequate margin of subcriticality for safety in 

accordance with 10 CFR 70.61(d). 

 Additional guidance on the margin of subcriticality is provided in Appendix 5-B to this 

SRP. 

5.4.3.1.7.1 Calculational Method Validation7

The applicant should include a summary description of a documented, reviewed, and approved 

(by the applicant’s NCS Function and management) validation report for each methodology that 

will be used to perform an NCS analysis. For methods such as experimental data, handbooks, 

industry standards, and hand calculations, the validation report may consist of a demonstration 

of each method’s applicability to the applicant’s processes, including specification of any 

limitations or assumptions needed to ensure its validity. For methods that rely on the explicit 

calculation of keff, the validation report should evaluate critical benchmark experiments similar in 

geometry, material composition, and neutron energy spectrum to the systems to be evaluated. 

For computer calculation methods, the reviewer should examine the applicant’s criticality code 

validation report to determine whether it provides for reasonable assurance that processes 

evaluated to be subcritical are actually subcritical. The review should consist of a review of the 

applicant’s selection of benchmark experiments, statistical methodology, and results 

(determination of the area(s) of applicability and Upper Subcritical Limit). The methods used 

should be consistent with the nature of the data (e.g., quantity and distribution of benchmark 

experiments, normality, presence or absence of any trends, and need for extrapolation or 

interpolation). 

Acceptance criteria applicable to the applicant’s summary description of its criticalitycode 

validation process in the license application are as follows: 

A. The applicant’s summary description of its criticality code validation process should 

include: 

 

7

 As used in this chapter of the SRP (and its appendices), the term “validation” normally refers to the process of 

demonstrating the validity of methods used to demonstrate subcriticality with an appropriate margin, and “validation 

report” refers to a document capturing the methodology and results of that process. The term “criticality code 

validation report” indicates that in most cases what is being validated is a computer-based calculational method. 

However, as stated in the following paragraph, this guidance applies to other methods of demonstrating subcriticality 

as well, unless specifically stated otherwise. 
June 2015 5-14 NUREG-1520, Revision 2 

1. A description of the methodology that is sufficiently detailed and clear that it may 

be independently reproduced, including the method used to select benchmark 

experiments, determine the bias and bias uncertainty, and determine the Upper 

Subcritical Limit. 

2. A summary of the physical systems and area(s) of applicability covered by the 

criticality code validation report. It is not necessary to include the full range of 

numerical parameters that defines an area of applicability; a general description 

(e.g., “low-enriched homogeneous uranyl fluoride solutions”, “low-enriched fuel 

pellets”, or “rods containing gadolinia”) is sufficient. 

3. A description of the methods used to extend the area(s) of applicability beyond 

the range of parameters covered by the benchmark experiments. Any such 

extension should be done by making use of trends in the bias, including 

accounting for the increased uncertainty due to the extrapolation. 

4. A description of the benchmark experiments used. It is not necessary to include 

all benchmark experiments used; a brief description of the individual benchmark 

sets is sufficient. 

5. A description of the margin of subcriticality for safety and justification of its 

adequacy. This should include a statement of the minimum margin of 

subcriticality and any other factors that provide reasonable assurance of 

subcriticality. 

6. A description of the controlled software and hardware used. It is not necessary 

to include specific operating systems, hardware platforms, and individual 

workstations, though this information should be specified in the criticality code 

validation report itself. A general description of the computer code, release 

version, cross-section libraries, and type of computer hardware is sufficient. 

7. A description of any limitations on use of the method (e.g., code options (such as 

biasing and use of albedos) or convergence criteria) necessary for validity of the 

method. 

B. Acceptance criteria applicable to the applicant’s commitments with regard to its 

criticalitycode validation process are as follows: 

1. The applicant’s summary description is consistent with the ANSI/ANS-8.24 

standard, with exceptions and qualifications as stated in RG 3.71, or follows 

widely accepted industry practices with the application of an appropriate margin 

to account for any shortcomings (e.g., scarcity of the data, lack of normality, or 

extension beyond the range of benchmark experiments). This requires that the 

NCS reviewer remain aware of current validation practices . 

2. The applicant commits to incorporating each criticality code validation report into 

its configuration-management program. 

3. The applicant commits to and describes its verification process, including 

verification upon installation, in response to changes to the calculational system, 

and at specified periods. 
June 2015 5-15 NUREG-1520, Revision 2 

4. The applicant commits to assessing the applicability of its criticalitycode 

validation for each nuclear system to be evaluated and to documenting its 

assessment in CSEs. 

The above criteria strictly apply only to methods that explicitly calculate keff (deterministic and 

probabilistic computer codes). For other methods used to demonstrate subcriticality, the 

reviewer should use judgment in determining which of the aforementioned criteria are applicable 

to the particular method. 

5.4.3.1.7.2 Criticality Safety Evaluations (CSEs)

The reviewer should consider the applicant’s commitments with regard to performing CSEs 

acceptable if the applicant has met the following acceptance criteria or identified and justified 

acceptable alternatives: 

1. The applicant commits to performing CSEs in accordance with documented and 

approved administrative procedures, which incorporate the following principles: 

a. NCS safety limits will be established based on analyses assuming optimum or 

the most reactive credible values of parameters (e.g., the most reactive 

conditions physically possible or bounding values limited by regulatory 

requirements) unless specified controls are implemented to limit parameters to a 

particular range of values. If less than the optimum values are used, and 

corresponding controls are not identified, the basis will be justified in the CSE. 

b. NCS operating limits maybe established as appropriate to ensure that safety 

limits are unlikely to be exceeded. If separate operating limits are specified, 

process variability and uncertainty should be considered. Additional 

conservatism may be applied. 

c. The specific controls and management measures necessary to enforce NCS 

safety limits and/or operating limits will be specified. 

2. The applicant commits to providing the technical basis that demonstrates 

(a) subcriticality under normal and credible abnormal conditions and (b) compliance with 

the double-contingency principle in the CSEs. 

3. The applicant commits to incorporating each CSE into its configuration-management 

program and its system of ISA documentation. 

5.4.3.1.7.3 Evaluation and Implementation of Controlled Parameters

Parameters available for NCS control are as follows: mass, geometry, density, enrichment (or 

isotopics), reflection, moderation, concentration, interaction (or spacing), neutron absorption (or 

poison), volume, heterogeneity, physicochemical form, and process variables. The number and 

names of specific parameters will vary from one applicant to another. 

 

The reviewer should consider the applicant’s commitments to technical practices associated 

with evaluating and implementing controlled parameters acceptable if the applicant has met the 

following acceptance criteria or identified and justified acceptable alternatives: 

1. The applicant states that the use of a single NCS control to maintain the values of two or 

more controlled parameters constitutes only one component necessary to meet the 

double-contingency principle. 
June 2015 5-16 NUREG-1520, Revision 2 

2. The applicant commits to the following preferred hierarchy of controls: 

a. The applicant commits to the preferred use of passive engineered controls; in 

particular, passive engineered geometry control. 

b. The applicant commits to the following order of preference for NCS control: 

(1) passive engineered, (2) active engineered, (3) enhanced administrative, and 

(4) simple administrative controls. 

c. The applicant commits to preference for designating explicit NCS controls over 

reliance on the natural and credible course of events. 

d. The applicant commits to preference for control of two or more parameters over 

multiple controls on a single parameter. If relying on two or more controls on a 

single parameter, the applicant commits to preference for diverse over redundant 

means of control. 

These commitments do not mean that the applicant will follow the preferred hierarchy of 

controls in every case. The reviewer should examine the applicant’s sets of controls to 

determine whether it is following this preference in the majority of cases. In general, for 

example, where passive controls are readily available, they should be used rather than 

administrative controls. It is up to the applicant to demonstrate how it is meeting these 

commitments (for example, by providing justification when deviating from these criteria). 

3. The use of each controlled parameter should be considered acceptable if the following 

general criteria, in addition to the specific criteria for individual parameters listed below, 

are met: 

a. When a single-parameter limit is used (e.g., minimum critical mass, favorable 

geometry limit, or always-safe concentration), all other parameters are evaluated 

at their optimum or most reactive credible values. In determining 

single-parameter limits, it is permissible to specify a particular physicochemical 

form and isotopic composition. 

 Examples: (1) minimum critical mass is based on spherical geometry, optimum 

moderation, and full water reflection; (2) favorable geometry is based on having 

equipment filled with optimally moderated material and full water reflection. 

b. When process variables can affect the normal or most reactive credible values of 

parameters, controls to maintain them within specified ranges are established. 

c. When measurement of a parameter is needed, instrumentation subject to facility 

management measures is used. 

d. When criticality control is based on measuring a single parameter, independent 

means of measurement (e.g., redundant in-line monitoring or dual independent 

sampling) are used. 

e. Safety limits on controlled parameters are established, taking any tolerances and 

uncertainty into account. 

4. Acceptance criteria for the use of mass as a controlled parameter are as follows: 
June 2015 5-17 NUREG-1520, Revision 2 

a. When mass limits are derived for a material that is modeled assuming a given 

weight percent of SNM, compliance with the mass limit is verified by either 

(1) weighing the material and ascribing the entire mass to SNM or (2) conducting 

physical measurements to establish the actual weight percent of SNM in the 

material. 

b. When the dimensions of equipment or containers with a fixed geometry are used 

to limit the mass of SNM, a conservative process density is used to calculate the 

resulting mass. 

c. When overbatching of SNM is credible, the largest mass resulting from a single 

failure is shown to be subcritical. Overbatching beyond double batching should 

be considered unless it requires multiple independent failures or is precluded by 

equipment capacity, availability of material, or other considerations. 

5. Acceptance criteria for the use of geometry as a controlled parameter are as follows: 

a. Before beginning operations, in response to changes to operations, and at 

periodic intervals, all dimensions relied on in demonstrating subcriticality are 

verified. Relevant dimensions and material properties are maintained in the 

facility’s configuration-management program. 

b. Means of losing geometry control (e.g., corrosion, leakage, bulging, transfer to 

unfavorable geometry, changes to a more reactive physicochemical form) are 

evaluated and controls established as needed if they are credible. 

c. Neutron interaction with other SNM-bearing equipment is considered as part of 

the demonstration of subcriticality, unless individual units meet the criteria for 

being considered neutronically isolated. This includes the introduction of any 

portable SNM-bearing containers. 

6. The use of density as a controlled parameter should be considered acceptable if the 

general criteria for controlled parameters described above are met. 

7. Enrichment refers to the weight percent of 235U in uranium. For mixtures involving other 

fissile nuclides, isotopics (or isotopic abundance) may refer to the weight percent of the 

fissile nuclides (e.g., 239Pu and 241Pu weight percent in plutonium) and to the relative 

ratio of different elements in the mixture (e.g., weight percent of plutonium to the total 

mass of SNM). While the term enrichment is used below for simplicity, the reviewer 

should recognize that the criteria below can apply to more general types of SNM. 

 Acceptance criteria for the use of enrichment as a controlled parameter are as follows: 

a. Either a method of segregating enrichments is used to ensure that differing 

enrichments will not be interchanged, or the most limiting enrichment is applied 

to all material. Use of the plant-wide maximum authorized enrichment may be 

relied on without the need to specify explicit enrichment controls in every CSE. 

 Given that mixtures of differing enrichments are indistinguishable by sight and 

have the same chemical properties, material of differing enrichments should be 

segregated in different parts of the facility or should be conspicuously marked 

with distinctive labels. 
June 2015 5-18 NUREG-1520, Revision 2 

8. Reflection is recognized as a particularly difficult parameter to control, and is therefore 

one of the least-preferred methods of criticality control. The reviewer should exercise 

extra caution in reviewing any instances relying on reflection control. 

 Acceptance criteria for the use of reflection as a controlled parameter are as follows: 

a. In determining subcritical limits for an individual unit, the wall thickness and all 

adjacent reflecting materials are considered in setting up the criticality model. 

Any such materials should be conservatively bounded by the modeled reflection 

conditions. 

b. Criteria are established for determining when materials are sufficiently far away 

to be neglected in the criticality model. For example, in most cases materials 

more than 30 cm (12 inches) away may be neglected. (Care should be taken 

when analyzing large slabs and arrays.) 

c. When reflection is not controlled, full reflection may be represented by 30 cm 

(12 inches) of tight-fitting water or 60 cm (24 inches) of tight-fitting concrete. In 

the presence of special moderators such as deuterium, beryllium, or graphite, or 

if large amounts of hydrogen-rich materials (e.g., hydrocarbon oil or polyethylene, 

etc.) are present, it should be demonstrated that the modeled reflection 

conditions remain bounding. 

d. Minimum reflection conditions equivalent to a 1-inch tight-fitting water reflector 

are assumed to account for personnel and other transient incidental reflectors not 

explicitly included with fixed reflectors in the model. (A 1-inch tight-fitting water 

reflector is generally considered sufficient to bound any amount of reflecting 

material more than 30 cm (12 inches) from the surface of the unit.) 

e. When less than full reflection conditions are assumed in calculations, controls to 

limit reflection around individual units are established, preferably by means of 

rigid barriers. 

f. In evaluating subcriticality for an array of units, the maximum amount of water 

between units may not be the most reactive condition. Reflection should be 

modeled on the exterior of the array consistent with the acceptance criteria in 

paragraphs (8)(a) through (8)(e) above, and interstitial moderation should be 

considered in accordance with the criteria in paragraph (9) below. 

9. Acceptance criteria for the use of moderation as a controlled parameter are as follows: 

a. The applicant commits to meeting the ANSI/ANS-8.22 standard. 

b. As a first preference, physical structures are designed to preclude the ingress of 

moderators. 

c. Moderation-controlled areas may be used to exclude moderators from whole 

areas. Engineered means (e.g., double roof, double-sleeved pipes, exclusion of 

sprinklers, raised/sloped floors) are the primary means of excluding moderators 

from such areas. After evaluation of all credible sources of moderator intrusion 

into such areas, the areas are conspicuously marked and administrative controls 

are established to prevent the introduction of moderators. 
June 2015 5-19 NUREG-1520, Revision 2 

d. Firefighting procedures for use in moderation-controlled areas are evaluated in 

CSEs. Restrictions on the use of moderating firefighting agents are included in 

procedures and training. The effects of a fire and activation of fire suppression 

are evaluated. 

10. Concentration is recognized as one of the least-preferred methods of criticality control. 

The reviewer should exercise extra caution in reviewing any instances relying on 

concentration control. 

Acceptance criteria for the use of concentration as a controlled parameter are as follows: 

a. Controls are established to limit concentration of SNM unless the process has 

been demonstrated to be subcritical at optimum concentration. 

b. When using a tank containing concentration-controlled solution, the tank is kept 

closed and locked to prevent unauthorized introduction of precipitating agents. 

c. Precautions are taken to preclude the inadvertent introduction of precipitating 

agents. 

d. Transfers to unfavorable geometry tanks containing concentration-controlled 

solutions will only be authorized based on dual independent sampling and/or 

in-line monitoring. No single error may result in transfer of concentrated solution 

to a tank with unfavorable geometry. 

e. Process variables that can affect the solubility of fissile solutions are controlled 

and monitored. The need to ensure homogeneity of the solution is assessed in 

CSEs. 

11. Interaction must often be controlled when relying on geometry and volume control. 

Acceptance criteria for the use of interaction as a controlled parameter are as follows: 

a. To maintain physical separation between units, engineered controls are used. If 

engineered controls are not feasible, administrative controls with visual aids such 

as painted lines and postings may be used. However, multiple procedural errors 

should not by themselves lead to criticality. 

b. The structural integrity of spacers, storage racks, etc. is sufficient to ensure 

subcriticality under normal and credible abnormal conditions, including seismic 

events. 

c. Engineered devices that are moveable (e.g., birdcage drums, 55-gallon drums) 

are inspected periodically for deformation. 

12. Neutron absorbers are often controlled in conjunction with geometry and interaction 

control. Fixed neutron absorbers are recognized as among the most-preferred methods 

of criticality control, while soluble neutron absorbers are recognized as one of the 

least-preferred methods. The reviewer should therefore exercise extra caution in 

reviewing any instances relying on soluble absorber control. 

 Acceptance criteria for the use of neutron absorption as a controlled parameter are as 

follows: 
June 2015 5-20 NUREG-1520, Revision 2 

a. The preferred method of absorber control is fixed neutron absorbers. When 

using fixed absorbers, the applicant commits to meeting the ANSI/ANS-8.21 

standard. 

 Whether the applicant is relying on fixed neutron absorbers does not depend on 

whether the absorbing materials are part of the existing structure or are added 

specifically for criticality control. If the material properties of the absorber must 

be included in the model to reduce the value of keff below the Upper Subcritical 

Limit (for normal or credible abnormal conditions), the material is relied on as a 

neutron absorber. If the material can be modeled as a void region, so that only 

the dimensions are needed to ensure subcriticality, it is being relied on only as a 

geometry control. 

b. When using borosilicate glass raschig rings, the applicant commits to meet the 

ANSI/ANS-8.5 standard. 

c. When using soluble neutron absorbers, the applicant commits to meeting the 

ANSI/ANS-8.14 standard. 

d. In evaluating absorber effectiveness, the effect of neutron spectra on the 

absorption cross-section is considered (e.g., cadmium is an effective absorber for 

thermal neutrons but ineffective for fast neutrons). 

13. When the total volume of a unit is limited to ensure subcriticality, irrespective of its 

shape, this constitutes volume control. When the specific dimensions are limited, this 

constitutes geometry control. Occasionally geometry and volume are lumped together 

as a single means of control. This is acceptable because the same acceptance criteria 

apply to both. 

 Acceptance criteria for the use of volume as a controlled parameter are as follows: 

a. Fixed geometry is used to restrict the volume of SNM. The preferred method is 

limiting equipment and containers to less than a subcritical volume. Limiting 

material to part of a larger geometry (e.g., by active level probes or use of 

overflow holes) may also be used. 

b. The maximum subcritical volume is evaluated assuming the most reactive 

credible geometry, optimum moderation, and full water reflection. Normally, 

spherical geometry will be the most reactive (though this could depend on the 

specific boundary conditions to be applied). 

14. Controlling the small-scale structure of fissile materials is particularly important at lower 

enrichments (below approximately 10 wt% 235U). While normally referred to as 

heterogeneity control, generally the concern is maintaining homogeneity because the 

homogeneous case is usually less reactive. 

 Acceptance criteria for the use of heterogeneity as a controlled parameter are as 

follows: 

a. Methods of causing a fissile material to become inhomogeneous are evaluated in 

CSEs and controls established as necessary (e.g., temperature and acidity on a 

solution, active stirring and blending of solutions or powders, or milling of 

powders or scrap). If heterogeneity is considered credible, its effect should be 

evaluated in criticality calculations. These calculations should be validated using 
June 2015 5-21 NUREG-1520, Revision 2 

critical benchmarks that display heterogeneous effects, to ensure that any bias 

due to resonance self-shielding is taken into account. 

b. Assumptions that can affect the physical scale of heterogeneity are based on 

observed physical characteristics of the material; process variables that can 

affect the scale of heterogeneity are controlled. 

15. Subcritical limits on other controlled parameters are normally derived for a particular 

fissile material composition by assuming a bounding physicochemical form and isotopic 

abundance. Physicochemical form consists of controlling the physical state (i.e., solid, 

liquid, or gas) and form (e.g., solution, powder, green or sintered pellets, or metal) and/or 

chemical composition (e.g., uranium hexafluoride, uranyl fluoride, plutonium nitrate, or 

mixed oxide) of a particular fissile material. The physicochemical form could indirectly 

affect other parameters, such as density, moderation, and neutron absorption. 

 

 Acceptance criteria for the use of physicochemical form as a controlled parameter are 

as follows: 

a. Either the most reactive credible physicochemical form in the facility is assumed 

in criticality calculations or explicit controls are established to limit the material 

composition to a particular form. Passive controls (e.g., filters and pellet 

diameter gauges), active controls (e.g., temperature and pressure gauges and 

mass flow totalizers), and administrative controls (e.g., titration and limitations on 

addition of chemical reagents) may be used. 

b. Both in-situ changes in physicochemical form and the migration of material 

between process areas are considered in evaluating credible abnormal 

conditions. 

c. Process variables that can change the fissile material to a more reactive 

physicochemical form are identified as controls in CSEs. 

16. Process variables include those physical characteristics of a process that are relied on to 

control other parameters (e.g., furnace temperature to limit moderation, pressure to 

maintain physicochemical form of UF6, and acidity to maintain homogeneity) or to 

monitor them (e.g., electrical load to monitor viscosity, conductivity to detect moderators, 

the mechanical force of a pellet press to limit density, and radiation readings to detect 

solution transfers). 

 Acceptance criteria for the use of process variables for criticality control are as follows: 

a. Process variables relied on to control or monitor other controlled parameters are 

identified as controls in CSEs; sufficient management measures are applied to 

ensure that the associated controlled parameter safety limit is not exceeded. 

b. The associated controlled parameter is explicitly identified and the correlation of 

process variables to the associated parameter is established by experiment or 

plant-specific measurements. 

5.4.3.1.8 Additional NCS Program Commitments 

Acceptance criteria applicable to the applicant’s description of additional commitments in its 

NCS Program are as follows: 
June 2015 5-22 NUREG-1520, Revision 2 

1. The applicant commits to assess the adequacy of engineered and administrative 

criticality controls as part of its facility audits and inspections, to promptly detect any 

NCS deficiencies, and to refer those deficiencies to the facility’s corrective-action 

program in order to prevent recurrence. 

2. The applicant commits to suspend operations or otherwise render processes safe upon 

loss of double contingency protection, until such protection can be restored, and to 

assess the adequacy of the affected controls. 

3. The applicant commits to retaining records of NCS deficiencies and documenting any 

corrective actions taken. 

4. The applicant commits to identifying all equipment and procedures needed for criticality 

controls to perform their safety function (i.e., to ensure their effectiveness in keeping 

controlled parameters within subcritical limits), and to maintaining such equipment and 

procedures as part of its facility management measures, including audits and 

inspections. 

5. Acceptance criteria applicable to the applicant’s description of measures to implement its 

facility change process (in compliance with 10 CFR 70.72) are as follows: 

a. The applicant describes a change-control process that is sufficient to ensure that 

the safety basis of the facility will be maintained during the facility’s lifetime. The 

change process is documented in written procedures that specify that all 

changes to nuclear processes are evaluated by the NCS Organization to 

determine the impact on NCS, including analytic assumptions, the effectiveness 

of NCS controls, and the NCS of any connected processes. 

b. The applicant commits to supporting the facility’s change process by evaluating 

whether changes are covered by existing CSEs and, if not, to performing CSEs 

to determine any necessary changes to processes, procedures, criticality 

controls, and management measures. 

c. The change-control process is integrated with its configuration-management 

system to ensure that any changes to the NCS basis are incorporated in 

procedures, postings, drawings, and other facility safety documentation as 

appropriate, as well as the ISA summary. 

6. Acceptance criteria applicable to the applicant’s description of measures to implement 

the event reporting requirements in 10 CFR Part 70, Appendix A, “Reportable Safety 

Events,” are as follows: 

a. The applicant’s overall event-reporting commitments are consistent with 

Appendix A, and: 

b. The applicant’s NCS Program has a process in place for rapidly evaluating the 

NCS significance of events, including immediate availability of cognizant NCS 

staff. The evaluation of safety significance includes assessment of the event for 

the loss or degradation of double contingency protection. 
June 2015 5-23 NUREG-1520, Revision 2 

c. The applicant’s process for assessing NCS events is integrated with the overall 

apparatus for making the required notification to the NRC Operations Center, 

which is incorporated in the facility’s emergency procedures. 

d. The applicant commits to evaluating the significance and reportability of events 

based on whether the controls were lost or degraded (i.e., whether they were 

unreliable or unavailable to perform their safety functions), not based on whether 

the safety limits of the associated parameters were actually exceeded. 

e. The applicant commits to treating the event as a one-hour report if it cannot 

ascertain within one hour whether the criteria of paragraph (a) or (b) of 

Appendix A to Part 70 apply. 

5.4.3.2 ISA and ISA Summary Review 

The reviewer should examine the applicant’s ISA documentation as it pertains to the evaluation 

of NCS hazards. The overall review of the applicant’s ISA process is covered in Chapter 3 of 

this SRP. The NCS reviewer’s examination of the NCS-related aspects of the applicant’s ISA 

comprises three parts: (1) review of the applicant’s ISA methodology to assess its applicability 

to analyzing criticality hazards, (2) review of the applicant’s onsite ISA documentation related to 

criticality hazards as part of its onsite vertical slice review, and (3) review of the applicant’s 

discussion of criticality hazards, scenarios, and controls in its ISA summary. The purpose and 

scope of each of these aspects as it relates to NCS is discussed in the following sections. 

The relation of the license-application review to the ISA review is that reasonable assurance of 

safety depends primarily on the adequacy of the applicant’s commitments to its NCS Program, 

because the licensee is ultimately responsible for the safe operation of its facility. The reviewer 

therefore performs a detailed and comprehensive review of the applicant’s commitments with 

regard to its NCS Program. The ISA review provides an additional demonstration of safety by 

assessing whether the applicant’s NCS Program has provided adequate protection against the 

consequences of an accidental criticality. This review consists of a risk-informed sampling of 

scenarios and controls to confirm the adequacy of the applicant’s implementation of its NCS 

Program. 

5.4.3.2.1 ISA Methodology

The reviewer should examine the applicant’s ISA methodology commitments, as described in 

the license application, to determine whether the methodology is being properly applied to the 

analysis of criticality hazards. Acceptance criteria applicable to the applicant’s application of its 

ISA methodology to criticality hazards are as follows: 

1. Criticality is considered a high-consequence event for the purpose of complying with the 

performance requirements of 10 CFR 70.61.8

 If criticality is considered less than a 

high-consequence event, the features relied on to mitigate the dose are identified as 

items relied on for safety. Only those mitigative controls capable of protecting against 

the immediate burst of radiation may be credited in this fashion, and their failure should 

be considered in the ISA. 

 

8

 This is for the purpose of meeting the performance requirements only. For determining emergency-response 

procedures, a conservative estimate of the consequences of criticality, as discussed in Section 5.4.3.3 of this SRP, 

should be used. 
June 2015 5-24 NUREG-1520, Revision 2 

 If the applicant chooses to comply with the performance requirements by demonstrating 

subcriticality under normal and credible abnormal conditions (as discussed in 

Appendix 5-A of this SRP), the consequences of criticality do not need to be so 

characterized. 

2. Nuclear processes are demonstrated to be subcritical under both normal and credible 

abnormal conditions. Subcriticality is based on the establishment of preventive controls 

that limit parameters to within specified ranges of values. 

3. Protection against the consequences of an accidental criticality event is based on 

preventive controls, regardless of whether or not criticality is treated as a 

high-consequence event. 

4. Subcriticality is based on methods that specify an acceptable margin of subcriticality for 

safety. For methods that rely on the explicit calculation of keff, this includes a minimum 

margin of subcriticality and any conservative assumptions, as discussed in Appendix 5-B 

of this SRP. 

5. Controls on controlled parameters that are relied on to demonstrate subcriticality under 

normal and credible abnormal conditions, and/or to demonstrate that the risk of criticality 

is sufficiently low, are designated as items relied on for safety. 

6. The applicant provides for double-contingency protection in the selection of criticality 

controls. 

5.4.3.2.2 ISA Documentation 

The reviewer should examine the applicant’s onsite ISA documentation as part of its onsite 

vertical slice review. The onsite ISA documentation includes the safety-basis documentation 

used to perform the ISA and develop the ISA summary. This includes the applicant’s CSEs, 

calculations, process-hazard analyses, and supporting technical documents, as well as any 

underlying process safety information (e.g., piping and instrumentation diagrams, drawings, 

procedures, and specifications). The purpose of this review is to confirm, on a sampling basis, 

whether the applicant’s establishment and maintenance of criticality controls is adequate to 

protect against the consequences of an accidental criticality. 

The ISA documentation is maintained onsite for an existing facility. For an applicant seeking to 

license a new facility, the full level of detail concerning hardware, procedures, and programs 

necessary to safely operate the facility usually would not exist at the time the ISA summary is 

submitted. The reviewer should use judgment in determining whether there is a sufficient level 

of detail to make a finding of a reasonable assurance of safety. It is expected that all aspects of 

the facility and process design that are safety-significant would be available for inspection 

before operation. The reviewer may therefore identify aspects of the design that are incomplete 

but have bearing on the “reasonable assurance” finding as items to be followed up on during 

any preoperational readiness review that may occur. (See discussion of license conditions in 

Section 5.6, “Evaluation Findings.”) 

The reviewer should use a risk-informed method to select nuclear processes and scenarios for 

the vertical slice review. Those areas containing high masses or concentrations of fissile 

material, high enrichment or fissile isotope abundance, or highly moderated materials 

(e.g., solutions) are normally considered areas of higher risk. Scenarios involving failures that 

have occurred either in criticality accidents or significant fuel facility events and those involving 

failures mainly of administrative controls, especially redundant controls on a single parameter 
June 2015 5-25 NUREG-1520, Revision 2 

(e.g., sampling before solution transfer to unfavorable geometry), are normally considered of 

higher risk. The reviewer should select the higher-risk scenarios from these areas for a detailed 

review. The reviewer should also select some lower-risk processes and scenarios to obtain a 

diversity of process parameters, failure mechanisms, and control strategies to thoroughly test 

the ISA methodology. Consideration should be given to the type and number of controls; 

complexity of the controls; the applicant’s familiarity with the processes, technology, and 

controls; whether the controls are redundant or diverse; the safety margin between normal 

operations and where criticality is possible; etc., in selecting scenarios for review. 

The above pertains to the site-wide ISA reviewed for a new license. For a license amendment, 

the processes selected are limited to those affected by the amendment, and the reviewer should 

select those scenarios most likely to lead to accidental criticality, using criteria such as those in 

the previous paragraph. 

Once the processes and scenarios are selected for review, the reviewer should determine, on a 

sampling basis, whether the applicant’s controls are adequate to ensure that processes will be 

subcritical under normal and credible abnormal conditions and whether the applicant has 

provided for double contingency protection or identified and justified an acceptable alternative. 

This entails determining whether the relevant scenarios have been identified based on the 

process design, and whether controls are appropriately flowed into procedures, configuration 

management, and facility management measures. Evaluating the adequacy of controls may 

involve reviewing the applicant’s criticality calculations and technical reports; it may also entail 

the reviewer performing independent criticality calculations to confirm the applicant’s results. 

The reviewer may wish to consider such confirmatory analyses when the validity of those results 

is in doubt or when the sensitivity of those results to various parameters could have an impact 

on NCS. To the extent practical, the reviewer should use calculational methods different from 

those employed by the applicant to minimize the impact of any errors in the data or methods. 

Confirmatory analyses may not be feasible during a vertical slice review for a site-wide ISA, but 

the reviewer should perform at least some simplified bounding calculations to support a license 

amendment that involves a change to controlled parameters or safety limits. It is expected that 

amendment requests of this nature include the submittal of applicable CSEs and calculations as 

part of their technical basis. 

Lastly, the reviewer should determine whether the applicant’s criticality analysis for the selected 

scenarios is appropriately integrated into its ISA process. Acceptance criteria applicable to the 

applicant’s treatment of selected NCS scenarios in its ISA are as follows: 

1. The ISA Team includes facility personnel knowledgeable and experienced in NCS. 

2. The CSEs, calculations, and other supporting technical information are maintained as 

part of the applicant’s ISA documentation by including them in the facility’s configuration 

management program and ISA program procedures. 

3. Controls relied on to demonstrate subcriticality under normal or credible abnormal 

conditions and/or to demonstrate that the risk of individual criticality scenarios is 

sufficiently low are identified as IROFS. 

4. Management measures are established to ensure that the occurrence of a contingency 

is “unlikely” as used in the context of the double-contingency principle. Management 

measures may be graded commensurate with an item’s importance to safety. 

 Management measures should be appropriate to the type, required reliability, and 

required availability of items relied on for safety. They include: 
June 2015 5-26 NUREG-1520, Revision 2 

a. Procedures to ensure the reliable operation of engineered controls 

(e.g., surveillance and functional testing procedures and frequencies, calibration 

programs, and corrective and preventive maintenance programs) 

b. Procedures to ensure that administrative controls will be correctly implemented 

(e.g., employee training and qualification in operating procedures, including 

refresher training; safe work practices; operating procedures; and postings) 

c. Configuration management, audits and assessments, incident investigation, 

corrective actions, records management, and other quality-assurance elements 

(see Sections 11.3.1 through 11.3.8 of this SRP) 

d. Management of records pertaining to the correct operation of the NCS Program; 

for example, training and qualification of NCS management and staff, NCS 

Program audits, document control of NCS safety-basis documents (including 

independent review of documents), maintenance of the CAAS, and tracking and 

resolution of NCS deficiencies 

5.4.3.2.3 ISA Summary 

 

The reviewer should examine the applicant’s ISA summary to determine whether it meets the 

10 CFR 70.65(b) requirements. The purpose of the review is to determine whether the 

applicant has complied with the applicable requirements specified in 10 CFR 70.66 for granting 

a license. This section of the SRP covers review of the NCS aspects of the ISA summary; 

detailed guidance for the balance of the review is found in Chapter 3 of this SRP. 

Acceptance criteria applicable to the applicant’s documentation of the criticality hazards in its 

ISA summary are as follows: 

1. The ISA summary contains descriptions of the site, facility, and processes with respect 

to criticality safety. This may include process-flow diagrams, major process steps, and 

major pieces of equipment, with an emphasis on aspects of facility operations that affect 

criticality safety. The process description should be sufficiently simple to allow the staff 

an understanding of how the process works and what factors are important for criticality 

safety. 

2. The ISA summary identifies the criticality safety basis for nuclear processes in sufficient 

detail to permit the reviewer to independently make a finding of reasonable assurance of 

safety. This includes a description of criticality-significant aspects of the process, the 

parameters controlled to prevent criticality, the engineered and administrative controls 

used to control them, their safety limits, and management measures. 

3. The ISA summary demonstrates compliance with the performance requirements of 

10 CFR 70.61, either by (1) demonstrating that nuclear processes will be subcritical 

under normal and credible abnormal conditions, or (2) demonstrating that the risk of 

individual criticality scenarios is sufficiently low. This includes sufficient detail to 

demonstrate that: 

a. All credible accident sequences that could lead to accidental criticality have been 

identified and adequate preventive controls established. 

b. All engineered features and operator actions that are relied on to demonstrate 

that nuclear processes will be subcritical under normal and credible abnormal 
June 2015 5-27 NUREG-1520, Revision 2 

conditions have been identified as items relied on for safety, the description of 

which includes specifying their safety function and what systems and 

components are needed to perform their safety function. 

c. Facility management measures appropriate to the type, required reliability, and 

required availability of items relied on for safety have been established. 

4. The ISA summary demonstrates compliance with the double-contingency principle in its 

selection of items relied on for safety and application of management measures. 

5. The ISA summary demonstrates compliance with the CAAS requirements of 

10 CFR 70.24. 

6. Documentation of the criticality scenarios, controls, and management measures relied 

on to prevent criticality complies with the applicant’s commitments pertaining to the 

contents of its ISA summary. 

5.4.3.3 Emergency Plan 

Prevention is the primary means of protection against the consequences of accidental criticality, 

but there is still a small but finite risk that criticality events will occur. For facilities that require a 

CAAS in accordance with 10 CFR 70.24, the applicant must either submit an Emergency Plan 

or an evaluation demonstrating that an Emergency Plan is not required, in accordance with the 

provisions in 10 CFR 70.22(i)(1)(i) and (ii). (See Chapter 8 of this SRP for additional detail.) 

If the applicant determines that a facility CAAS is not required, the reviewer should review the 

applicant’s proposed activities to determine whether they meet the mass-based criteria of 

10 CFR 70.24(a). If the criteria apply and the applicant submitted a request for exemption from 

the CAAS requirements of 10 CFR 70.24(a), the reviewer should evaluate whether an 

exemption is justified. As stated in ANSI/ANS-8.3, “installation of an alarm system implies a 

nontrivial risk of criticality.” Whenever it is determined that criticality in a given area is credible 

and that it has the potential to adversely affect workers or the public, a criticality alarm is 

required unless an exemption is granted. False alarms and evacuations could pose a risk of 

injury to workers, and maintenance may expose workers who would not otherwise be exposed 

to occupational or potential criticality doses, so consideration may be given to whether 

installation of a CAAS results in a net risk benefit. 

 

If a facility CAAS is required, the applicant must establish emergency procedures in response to 

activation of the alarm, in accordance with 10 CFR 70.24(a). In addition, the applicant must 

submit either an Emergency Plan or an evaluation demonstrating that an Emergency Plan is not 

required, in accordance with 10 CFR 70.22(i)(1)(i) and (ii). Acceptance criteria applicable to the 

applicant’s emergency procedures and Emergency Plan, or to an evaluation that an Emergency 

Plan is not required, are as follows: 

1. The applicant commits to the ANSI/ANS-8.3 and -8.23 standards. 

2. The applicant has trained personnel to evacuate immediate upon activation of the alarm, 

and has designated assembly locations for personnel accountability. The designated 

assembly locations are located sufficiently away from fissile material so as to adequately 

protect personnel from excessive radiation doses. Evacuation routes are planned so as 

to minimize the potential for exposing evacuating personnel needlessly. 
June 2015 5-28 NUREG-1520, Revision 2 

3. The applicant has provided monitoring equipment and procedures to monitor the dose 

rate in assembly locations, and to provide for safe reentry and recovery following the 

accident. 

4. The applicant has provided for (a) monitoring to detect individuals with serious radiation 

exposures, (b) immediate decontamination of and first aid for exposed individuals, and 

(c) prompt and effective offsite medical attention. 

5. The applicant has procedures in place to promptly notify local, State, and Federal 

authorities, including the NRC Operations Center, after an accident. 

6. The applicant has procedures in place for coordination with offsite responders, including 

development of response plans and training in safety of nuclear materials (e.g., training 

in radiation hazards and restrictions on use of firefighting agents and methods). 

7. The response to criticality events is commensurate with the onsite and offsite dose to 

individuals. Determination of a bounding radiation dose is done conservatively: 

a. A bounding number of fissions is assumed that is commensurate with the 

worst-case historical accidents appropriate to the type and quantity of material 

that could be involved. 

 Estimates from historical accidents (e.g., tabulated in LA-13638, “A Review of 

Criticality Accidents”) or calculational methods (e.g., use of NUREG/CR-6504, 

“An Updated Nuclear Criticality Slide Rule,” or an empirical formula from 

peer-reviewed literature (Babry, Olsen, Tuck, Nomura)) may be used. 

Alternately, a more conservative estimate (e.g., the generic model in 

NUREG/CR-6410, if applicable) may be used. 

b. Conservative assumptions are made regarding the rate of reactivity insertion, the 

quantity of fissile material, the duration of the excursion, and the potential for 

oscillating criticality. Secondary bursts and/or a plateau should be considered a 

possibility if solutions or slurries are involved. 

c. Conservative assumptions are made regarding the distance from the reacting 

material to the site boundary, the worst credible location for fissile material, and 

the minimum amount of intervening shielding. 

d. Credit should not be taken for quenching mechanisms that are not ensured by 

physical law or the design of the process. In particular, credit should not be 

taken for termination or mitigation of an excursion by human intervention. 

e. Calculation of offsite doses takes into account both direct neutron and gamma 

radiation as well as the dose from radioactive fission products produced, and 

also takes into account such effects as groundshine, skyshine, and secondary 

gamma production. 

 While the calculation of the radiation dose from criticality should be conservative, 

because of the uncertainty and wide variability in the severity of criticality accidents, care 

should be taken that calculations are not excessively conservative, which could result in 

personnel overreacting to an accident. 

The reviewer should also coordinate with the review performed under SRP Chapter 8. 
June 2015 5-29 NUREG-1520, Revision 2 

5.5 Review Procedures 

For each area of review specified in subsection 5.3 of this SRP section, the review procedure is 

identified below. These review procedures are consistent with the identified SRP acceptance 

criteria. For deviations from the acceptance criteria, the staff should evaluate whether the 

applicant’s proposed alternatives to the SRP criteria provide an acceptable method of complying 

with the relevant NRC requirements identified in subsection 5.4. 

5.5.1 Acceptance Review 

During the acceptance review of a license application, the reviewer should examine the 

submittals to identify major deficiencies in the information provided for each area of review 

specified in SRP Section 5.3. Reviewers must decide whether they have enough information to 

proceed with a detailed review. Less significant errors or deficiencies that can be addressed in 

a request for additional information should be accepted. However, before the NRC performs a 

detailed review, the applicant should correct major deficiencies that would require several 

requests for additional information to resolve. 

Reviewers should record whether each area of review is adequately addressed in the 

application, is adequately addressed in a cited document, is not applicable to the application, or 

has a major deficiency. 

5.5.2 Safety Evaluation 

After the application has been accepted for review, the reviewer should conduct a complete 

review of the license application and a sampling review of the ISA summary to determine 

whether it meets the criteria specified in Section 5.4 of this SRP. The reviewer should consult 

with supporting reviewers, as appropriate, and coordinate with the reviewers for SRP 

Chapters 1, 2, 3, 8, and 11 to confirm the adequacy of all aspects of the application pertinent to 

NCS. The reviewer should also coordinate with the reviewers for other technical areas, and 

especially SRP Chapters 6 and 7, to ensure appropriate consideration of any cross-cutting 

issues. During the initial review, the reviewer should draft the safety evaluation report (SER) 

described below. A request for additional information (RAI) will be prepared when clarification 

and additional information are needed to determine whether the licensee’s submittals comply 

with the regulations. The primary reviewer should coordinate with the licensing project manager 

in preparing RAIs. Additional information submitted by the applicant will be evaluated and a 

final SER will be provided to the licensing project manager. 

5.5.2.1 License Application 

The reviewer should review the pertinent sections of the license application for completeness 

and adequacy with respect to the requirements of 10 CFR 70.22, 70.23, 70.24, 70.61, 70.62, 

70.64, and 70.65. The acceptance criteria in Section 5.4 provide a standard for acceptability 

with regard to the regulations. There may be some criteria that do not apply to the applicant’s 

proposed activities. In other cases, the applicant may propose alternatives that provide an 

equivalent assurance of safety. In addition, a mere restatement of the acceptance criteria in the 

application may not be sufficient without an explanation of how the applicant intends to 

implement the criteria to achieve the underlying safety goals. Therefore, the reviewer should 

not review the application to verify compliance with the acceptance criteria, but should rather 

review the application to determine whether the program as a whole provides for a reasonable 

assurance of safety and meets the regulatory requirements, and should be guided by the 

acceptance criteria. 
June 2015 5-30 NUREG-1520, Revision 2 

If, during the review, the reviewer identifies the need for additional information, the reviewer 

should coordinate development of a request for additional information with the licensing project 

manager. The purpose of a request for additional information is to identify information needed 

to make a regulatory decision (approval, denial, or conditional approval). The reviewer should 

also ascertain that the criticality safety approach is consistent with other sections of the license 

application, including those addressed by SRP Chapters 1, 2, 3, 4, 6, 7, 8, and 11. 

For an existing facility, the reviewer should consult with NCS inspectors to identify any ongoing 

issues that could impact the licensing review. For a new facility, the reviewer should identify 

any issues that should be inspected during an operational readiness review, if such a review is 

to be performed. These items could include confirming that commitments made in the license 

application are properly implemented through procedures and training. For a new facility or a 

major new process at an existing facility, the reviewer should, if feasible, observe the actual 

operations under design and construction, or existing processes similar to the process under 

review. The reviewer should also review a sampling of criticality analysis applicable to the 

process under review, including calculations and supporting documentation (process-hazard 

analyses, piping and instrumentation diagrams, drawings, etc.). The reviewer may, if it helps 

him or her in reaching a licensing decision, perform independent analysis to verify the 

applicant’s criticality evaluations. The depth and scope of such analyses should be 

commensurate with an area’s importance to safety. 

The reviewer will prepare input for the safety evaluation report (SER) during the review and 

provide it to the licensing project manager upon completion of the review. The SER should 

describe what aspects of the applicant’s submittals were reviewed, how they were reviewed, 

and the basis for the reviewer’s approval, denial, or conditional approval of the application. 

5.5.2.2 ISA and ISA Summary 

The reviewer should review the pertinent sections of the applicant’s ISA summary, including a 

sampling of the criticality hazards, scenarios, and items relied on for safety together with their 

management measures. The ISA summary provides a supplemental demonstration of the 

adequacy of the criticality safety basis described in the CSEs. The reviewer should evaluate the 

applicant’s ISA methodology, ISA documentation, and ISA summary to determine whether they 

demonstrate an acceptable level of safety that is consistent with the safety basis in the CSEs 

and whether they meet the regulatory requirements of 10 CFR 70.61, 70.62, 70.64, and 70.65. 

In reviewing the ISA documentation and ISA summary, the reviewer may identify the need for 

additional information, as described in the previous section. For a new facility or a major new 

process at an existing facility, the reviewer should, in general, perform an onsite vertical slice 

review of the ISA documentation, including primarily the CSEs. The reviewer should ensure 

that any commitments necessary to make a “reasonable assurance” finding are included in the 

license application. The reviewer should document the ISA review as part of the SER. 

5.5.2.3 Emergency Plan 

The reviewer should first determine whether an Emergency Plan is required for the facility. If an 

Emergency Plan is required, the reviewer should review its pertinent sections to determine 

whether it provides for adequate protection of workers and the public against the consequences 

of an accidental criticality. During the review, the reviewer may identify the need for additional 

information, as discussed above. The reviewer should ensure that any commitments necessary 

to make a “reasonable assurance” finding are included in the license application. The reviewer 

should document the review as part of the SER. 
June 2015 5-31 NUREG-1520, Revision 2 

5.6 Evaluation Findings 

The regulations in 10 CFR 70.23 and 70.66 state that an application for a license will be 

approved if the Commission can make the general findings listed in those sections. The basis 

for the general findings is an evaluation of whether the application adequately addresses all of 

the applicable regulatory requirements. More specifically, the staff’s evaluation should 

determine whether the licensing submittals provide sufficient information to satisfy the regulatory 

requirements listed in Section 5.4.1 of this SRP and whether the applicant has appropriately 

addressed the regulatory acceptance criteria in SRP Section 5.4.3. The SER should state how 

the applicable regulatory requirements have or have not been met based on the acceptance 

criteria described in this chapter of the SRP. If the applicant chooses to use an alternative 

approach, the reviewer should discuss in the SER whether the proposed approach satisfies the 

applicable regulatory requirements. The reviewers should use the following approach to 

document their evaluation: 

1. State a specific regulatory requirement that applies to the application. Detailed 

acceptance criteria may be included where appropriate or necessary. 

2. Identify the areas where the regulatory requirement is addressed in the application, 

including the areas where the specific acceptance criteria described in this SRP are 

addressed. 

3. Describe your evaluation of the application, the basis for your conclusion, and whether 

regulatory requirements are met. 

4. Repeat these steps for every regulatory requirement that applies to the application. 

There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

application or amendment request, (2) denial of the application or request, or (3) approval with 

conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

reviewer may consider proposing a license condition. Absent an NRC order, license conditions 

must be agreed upon with the licensee or applicant before becoming part of the license. 

A license condition should only be proposed if there is reasonable assurance that, if the 

licensee meets the condition, all regulatory requirements will be satisfied. Thus, license 

conditions should not be used to cover major deficiencies in an application. License conditions 

should be unambiguous, inspectable, and enforceable. They should only require those actions 

necessary to ensure compliance with applicable regulations. The basis for license conditions 

must be documented in the SER. 

If the staff’s review verifies that the NCS Program provides for a reasonable assurance of safety 

and meets the applicable regulatory requirements of 10 CFR Part 70, the staff will document its 

findings to that effect. The NRC staff may include statements and conclusions similar to those 

described below if appropriate to the review: 

The staff has reviewed the applicant’s NCS Program, ISA, and ISA summary [or “...ISA, 

ISA Summary, and Emergency Plan”, if appropriate] in ways consistent with SRP 

Chapter 5. Based on its review, the staff has reasonable assurance of the following: 

 The applicant will have in place an NCS Program that will be developed, 

implemented, and maintained to ensure that fissile material is possessed, stored, 
June 2015 5-32 NUREG-1520, Revision 2 

and used safely and in accordance with the requirements of 10 CFR 70.61(b) 

and (d) and 70.64(a)(9). 

 The applicant’s conduct of operations will be based on NCS technical practices 

that will ensure that fissile material will be possessed, stored, and used safely 

and in accordance with the requirements of 10 CFR 70.61(b) and (d) and 

70.64(a)(9). 

 The applicant will develop, implement, and maintain a criticality accident alarm 

system and emergency procedures in accordance with the requirements of 

10 CFR 70.24. 

 The applicant will establish and implement NCS controls, and maintain them 

through the application of facility management measures, to ensure that nuclear 

processes will be subcritical under normal and credible abnormal conditions and 

will provide for double contingency protection, in accordance with 

10 CFR 70.61(d). 

Based on these conclusions, the staff has determined that the applicant’s NCS Program 

meets the requirements of 10 CFR Part 70 and provides reasonable assurance of safety 

against the consequences of an accidental criticality. 

The staff should recognize that this is an example only, and that the specific conclusions to be 

reached will vary depending on the results of the licensing review. For a denial, the reviewer 

may state: “Based on its review, the staff does not have reasonable assurance of safety...” and 

then summarize the reasons why. For a conditional approval, the reviewer may state: “Based 

on its review, the staff has reasonable assurance of safety, subject to the following conditions.” 

The staff may make other such conclusions as appropriate. 

5.7 References 

U.S. Code of Federal Regulations, “Domestic Licensing of Special Nuclear Material,” Part 70, 

Chapter I, Title 10, “Energy.” 

American National Standards Institute (ANSI)/American Nuclear Society (ANS), “Nuclear 

Criticality Safety in Operations with Fissionable Materials Outside Reactors,” 

ANSI/ANS-8.1-1998 (R2007), La Grange Park, IL, 2007. 

ANSI/ANS, “Criticality Accident Alarm System,” ANSI/ANS-8.3-1997 (R2003), La Grange 

Park, IL, 2003. 

ANSI/ANS, “Use of Borosilicate-Glass Raschig Rings as a Neutron Absorber in Solutions of 

Fissile Material,” ANSI/ANS-8.5-1996 (R2007), La Grange Park, IL, 2007. 

ANSI/ANS, “Safety in Conducting Subcritical Neutron-Multiplication Measurements in Situ,” 

ANSI/ANS-8.6-1983 (R2010), La Grange Park, IL, 2010. 

ANSI/ANS, “Nuclear Criticality Safety in the Storage of Fissile Materials,” ANSI/ANS-8.7-1998 

(R2007), La Grange Park, IL, 2007. 

ANSI/ANS, “Criteria for Nuclear Criticality Safety Controls in Operations with Shielding and 

Confinement,” ANSI/ANS-8.10-1983 (R2005), La Grange Park, IL, 2005. 
June 2015 5-33 NUREG-1520, Revision 2 

ANSI/ANS, “Nuclear Criticality Control and Safety of Plutonium-Uranium Fuel Mixtures Outside 

Reactors,” ANSI/ANS-8.12-1987 (R2002), La Grange Park, IL, 2002. 

ANSI/ANS, “Use of Soluble Neutron Absorbers in Nuclear Facilities Outside Reactors,” 

ANSI/ANS-8.14-2004, La Grange Park, IL, 2004. 

ANSI/ANS, “Nuclear Criticality Control of Special Actinide Elements,” ANSI/ANS-8.15-1981 

(R2005), La Grange Park, IL, 2005. 

ANSI/ANS, “Criticality Safety Criteria for the Handling, Storage, and Transportation of LWR Fuel 

Outside Reactors,” ANSI/ANS-8.17-2004 (R2009), La Grange Park, IL, 2009. 

ANSI/ANS, “Administrative Practices for Nuclear Criticality Safety,” ANSI/ANS-8.19-2005, 

La Grange Park, IL, 2005. 

ANSI/ANS, “Nuclear Criticality Safety Training,” ANSI/ANS-8.20-1991 (R2005), La Grange 

Park, IL, 2005. 

ANSI/ANS, “Use of Fixed Neutron Absorbers in Nuclear Facilities Outside Reactors,” 

ANSI/ANS-8.21-1995 (R2001), La Grange Park, IL, 2001. 

ANSI/ANS, “Nuclear Criticality Safety Based on Limiting and Controlling Moderators,” 

ANSI/ANS-8.22-1997 (R2006), La Grange Park, IL, 2006. 

ANSI/ANS, “Nuclear Criticality Accident Emergency Planning and Response,” 

ANSI/ANS-8.23-2007, La Grange Park, IL, 2007. 

ANSI/ANS, “Validation of Neutron Transport Methods for Nuclear Criticality Safety Calculations,” 

ANSI/ANS-8.24-2007, La Grange Park, IL, 2007. 

ANSI/ANS, “Criticality Safety Engineer Training and Qualification Program,” 

ANSI/ANS-8.26-2007, La Grange Park, IL, 2007. 

ANSI/ANS, “Burnup Credit for LWR Fuel,” ANSI/ANS-8.27-2008, La Grange Park, IL, 2008. 

Carter, R.D., G.R. Kiel, and K.R. Ridgway, “Criticality Handbook,” ARH-600, Atlantic Richfield 

Hanford Company, Richland, WA, 1968. 

International Organization for Standardization (ISO), “Nuclear Energy—Fissile Materials—

Principles of Criticality Safety in Storing, Handling, and Processing,” ISO 1709:1995, Geneva, 

Switzerland, 1995. 

ISO, “Nuclear Energy—Performance and Testing Requirements for Criticality Detection and 

Alarm Systems,” ISO 7753:1987, Geneva, Switzerland, 1987. 

Knief, R.A., “Nuclear Criticality Safety—Theory and Practice,” American Nuclear Society, 

La Grange Park, IL, 1985. 

Los Alamos National Laboratory, “A Review of Criticality Accidents: 2000 Revision,” LA-13638, 

Los Alamos, NM, 2000. 

Paxton, H.C., and N.L. Pruvost, “Critical Dimensions of Systems Containing 235U, 239Pu, and 

233U,” LA-10860-MS, Los Alamos National Laboratory, Los Alamos, NM, 1987. 
June 2015 5-34 NUREG-1520, Revision 2 

U.S. Nuclear Regulatory Commission, “Nuclear Criticality Safety Performance Requirements 

and Double-Contingency Principle,” FCSS-ISG-03, February 2005. 

U.S. Nuclear Regulatory Commission, “Justification for Minimum Margin of Subcriticality for 

Safety,” FCSS-ISG-10, June 2006. 

U.S. Nuclear Regulatory Commission, “Integrated Safety Analysis Guidance Document,” 

NUREG-1513, May 2001. 

U.S. Nuclear Regulatory Commission, “Criticality Benchmark Guide for Light-Water-Reactor 

Fuel in Transportation and Storage Packages,” NUREG/CR-6368, March 1997. 

U.S. Nuclear Regulatory Commission, “Nuclear Fuel Cycle Facility Accident Analysis 

Handbook,” NUREG/CR-6410, March 1998. 

U.S. Nuclear Regulatory Commission, “Guide for Validation of Nuclear Criticality Safety 

Calculational Methodology,” NUREG/CR-6698, January 2001. 

U.S. Nuclear Regulatory Commission, “Nuclear Criticality Safety Standards for Fuels and 

Material Facilities,” Regulatory Guide 3.71, October 2005. 
June 2015 5-A-1 NUREG-1520, Revision 2 

APPENDIX A 

NUCLEAR CRITICALITY SAFETY PERFORMANCE REQUIREMENTS 

AND DOUBLE-CONTINGENCY PRINCIPLE 

Purpose 

This appendix provides additional guidance on nuclear criticality safety performance 

requirements and the double-contingency principle. The purpose of this appendix is to clarify 

the relationship between the requirements in Title 10, Energy,” of the Code of Federal 

Regulations (10 CFR) Part 70, “Domestic Licensing of Special Nuclear Material,” Subpart H, 

“Additional Requirements for Certain Licensees Authorized To Possess a Critical Mass of 

Special Nuclear Material,” to ensure nuclear criticality safety. These requirements are 

described in 10 CFR 70.61(b), 70.61(d), and 70.64(a)(9). 

Introduction 

The regulations in Subpart H of 10 CFR Part 70 contain three separate requirements to ensure 

nuclear criticality safety. One requirement, 10 CFR 70.64(a)(9), requires that the design of new 

facilities and processes provide for criticality control including adherence to the double 

contingency principle. A second requirement, 10 CFR 70.61(b), requires that high consequence 

events (which typically will include criticality accidents) be highly unlikely. A third requirement, 

10 CFR 70.61(d), requires that nuclear criticality accidents be limited by assuring that under 

normal and credible abnormal conditions1

 all nuclear processes are subcritical, including use of 

an approved margin of subcriticality, and also requires that the primary means of criticality 

protection be prevention. 

Discussion

There are three separate requirements in 10 CFR Part 70 for ensuring nuclear criticality safety. 

The first requirement of 10 CFR 70.64(a)(9) is more prescriptive and deterministic than the 

performance requirements of 10 CFR 70.61. 10 CFR 70.64 establishes baseline design criteria 

for new facilities and processes, similar to general design criteria in 10 CFR Part 50. One of 

these baseline design criteria applies directly to criticality safety. Specifically, 10 CFR 

70.64(a)(9) requires that the design “provide for criticality control including adherence to the 

double contingency principle.” Section 70.64(b) further specifies that new facilities or processes 

must incorporate defense-in-depth practices, which is defined as a “design philosophy, applied 

from the outset and through completion of the design, that is based on providing successive 

levels of protection such that health and safety will not be wholly dependent upon any single 

element of the design, construction, maintenance, or operation of the facility.” Section 

70.64(b)(1) specifically mentions preference for the selection of engineered controls over 

administrative controls to increase overall system reliability. 

Another more risk-informed and performance-based requirement is contained in 10 CFR 70.61. 

In short, this regulation stipulates that credible high consequence events shall be made “highly 

 

1

 As stated in the footnote on page 5-1 of this SRP, the term “credible” is as used herein should be understood in the 

context of meeting the double contingency principle; this is different from its usage in10 CFR 70.61(b) and (c). 
June 2015 5-A-2 NUREG-1520, Revision 2 

unlikely” or be mitigated (10 CFR 70.61(b)) and that intermediate consequences shall be made 

“unlikely” or be mitigated (10 CFR 70.61(c)). High and intermediate consequence thresholds for 

workers and members of the public are established for both chemical and radiological events. 

Under this risk-informed and performance-based regulation a criticality accident would typically

be considered a high consequence event to the worker since the worker could receive a dose in 

excess of 100 rem TEDE (total effective dose equivalent). 

 

In addition, there is a separate provision within 10 CFR 70.61 that specifically addresses 

criticality safety. Section 70.61(d) states that, in addition to meeting the requirements above for 

high and intermediate consequence events, the “risk of nuclear criticality accidents must be 

limited by assuring that under normal and credible abnormal conditions, all nuclear processes 

are subcritical, including use of an approved margin of subcriticality for safety. Preventive 

controls and measures must be the primary means of protection against nuclear criticality 

accidents.” The purpose of this is to preclude a situation where nuclear criticality would be 

permitted as long as the dose thresholds of § 70.61(b) and § 70.61(c) are not exceeded. 

Thus, 10 CFR Part 70 contains three separate and distinct requirements related to precluding 

nuclear criticality (10 CFR 70.64(a)(9), 10 CFR 70.61(b), and 10 CFR 70.61(d)), besides 

provisions in § 70.24 and § 70.52, which pertain to mitigating the consequences of a criticality 

accident and reporting its occurrence. 

Section 70.61(d) of 10 CFR Part 70 

Section 70.61(d) requires that under normal and credible abnormal conditions all nuclear 

processes are subcritical including use of an approved margin of subcriticality for safety. In 

addition, preventive controls and measures must be the primary means of protection against 

criticality. Meeting this performance requirement entails a number of factors. First, all normal 

and credible abnormal conditions must be identified. There are many different methods that 

may be employed to do this, but a systematic methodology should be used to provide 

reasonable assurance that the complete spectrum of credible conditions has been identified. 

Normal conditions are those specifically allowed for as part of the normal modes of operation in 

the facility design (i.e., conditions that may occur without the failure of any items relied on for 

safety (IROFS)). Abnormal conditions are those events not planned for as a regular occurrence 

in the facility or operation design. They include those undesirable conditions that are the result 

of external events and process deviations, including those resulting from the failure of identified 

IROFS. Credible abnormal events include both credible single events (e.g., an external event or 

failure of a single IROFS) and credible sequences of events. Credible sequences of events 

include, but may not be limited to, chains of independent but not unlikely process deviations 

(i.e., not precluded by IROFS) and chains of related failures of IROFS (i.e., failures that are not 

independent). Some judgment must be employed in determining what constitutes a credible 

abnormal condition. It is not necessary to include multiple independent failures of IROFS within 

the spectrum of credible abnormal conditions. Since many licensees meet the process analysis 

requirement from ANSI/ANS-8.1 by application of the double contingency principle the intent is 

that ensuring subcritical under “credible abnormal conditions” does not necessitate considering 

events and failures beyond that required for compliance with the double contingency principle. 

The requirement that nuclear processes be subcritical is satisfied if the licensee or applicant 

demonstrates that the most reactive credible conditions are subcritical. To provide adequate 
June 2015 5-A-3 NUREG-1520, Revision 2 

assurance of subcriticality, this must include margin. There are several different ways to 

demonstrate sub-criticality, as discussed below: 

 If subcriticality is demonstrated using an appropriately validated calculation method, then 

keff (K effective) (including calculation’s uncertainties) must be less than the approved 

upper subcritical limit (USL), as specified in the license. Meeting this requires that 

models bound actual anticipated conditions (e.g., tolerances and uncertainties 

appropriately taken into account, most reactive credible system parameters allowed are 

assumed), as specified in the license. Additional guidance is provided in the criticality 

chapter of NUREG-1520, “Standard Review Plan for the Review of a License Application 

for a Fuel Cycle Facility,” (Sections 5.4.3.4.1, 5.4.3.4.2, and 5.4.3.4.4). 

 Subcritical margin may also be expressed in terms of system parameters rather than 

system keff. An example would be where the licensee or applicant has committed to use 

mass or dimensional limits that are some specified fraction of the critical values of those 

parameters. In such cases, the approach used must be approved by the NRC. 

 Subcriticality may be demonstrated on the basis of subcritical limits included in the 

license, U.S. Nuclear Regulatory Commission (NRC) endorsed American National 

Standards Institute (ANSI) standards, or other documents that have been approved or 

endorsed by NRC. Approval or endorsement by the NRC implies that the Agency has 

found these references to include an acceptable margin of subcriticality for safety. 

 Industry handbooks of criticality data may also be used if widely accepted in the nuclear 

industry and if used in accordance with any limitations of that data. The NRC, however, 

reserves the right to evaluate the use of such handbooks on a case-by-case basis. 

The requirement that preventive controls and measures be the primary means of protection 

against criticality is satisfied if engineered or administrative controls relied on to meet § 70.61(d) 

are designed to prevent occurrence of the critical excursion rather than mitigate its 

consequences. By stating that prevention should be the primary means of protection, it is 

recognized that there may be extraordinarily rare occasions when prevention alone is not 

sufficient to meet § 70.61(d). Such cases require convincing demonstration that there is no 

practicable way to meet § 70.61(d) with solely preventive measures. 

Some examples where the § 70.61(d) requirement has not been met: 

 A process in which the most reactive credible conditions have not been modeled and 

have not been shown to have keff less than the approved USL. 

 A process in which subcriticality is based on criticality calculations, but the model is 

outside the area of applicability of the calculation method. 

 A process for which there is an unanalyzed or unanticipated credible abnormal condition 

(e.g., unanticipated failure of an IROFS or unanticipated external event). 

 A process for which there is a credible common-mode event that can result in the failure 

of all criticality controls such that it can lead to a critical configuration. 
June 2015 5-A-4 NUREG-1520, Revision 2 

 A process in which the designated IROFS are not sufficient to limit the system to a 

subcritical configuration. 

Relationship of 10 CFR 70.61(b) to 10 CFR 70.61(d) 

Section 70.61(b) states “. . . the risk of each credible high consequence event must be 

limited. . . . Controls . . . shall be applied to the extent needed to reduce the likelihood of 

occurrence of the event so that . . . the event is highly unlikely . . . .” 

Section 70.61(d) states “. . . the risk of nuclear criticality accidents must be limited by assuring 

that under normal and credible abnormal conditions, all nuclear processes are subcritical, 

including an approved margin of subcriticality . . . .” 

As written, the rule language requires both provisions (i.e., § 70.61(b) and § 70.61(d)) be met, 

since § 70.61(d) states “In addition to complying with paragraphs (b) and (c) of this section . . . .” 

However, during the 10 CFR Part 70 rulemaking, regulated industry representatives met with 

NRC and submitted letters in which they expressed their desire that NRC not consider criticality 

accidents high consequence events and not associate quantitative likelihoods with double 

contingency. As discussed in the release notes issued with the 10 CFR Part 70 rulemaking, in 

response to industry arguments accidental criticality was explicitly removed from the high 

consequence (§ 70.61(b)) category and a separate performance requirement for criticality (§ 

70.61(d)) was created. The staff felt that in so doing, both the industry’s desires as well as the 

staff’s needs would be met. Further, the staff felt that the § 70.61(d) requirement required the 

same information as that required by § 70.61(b). Saying all nuclear processes must be 

subcritical in § 70.61(d) implies that criticality events must be prevented. Moreover, since 

likelihood is never zero, some likelihood must be assumed; the highly unlikely requirement in § 

70.61(b) is appropriate for this. Therefore, the staff felt that by removing criticality explicitly from 

§ 70.61(b) and creating § 70.61(d) during the rulemaking, the staff still retained its desired 

outcome–to prevent criticality accidents from occurring. The final rule Statement of 

Considerations (SOC) stated that “...the NRC believes that a separate performance 

requirement for nuclear criticality prevention is appropriate. The staff recognizes that many (but 

not all) nuclear criticality accidents would reasonably be expected to result in worker doses that 

exceed the high- and intermediate-consequence standards in 10 CFR 70.61(b) or (c). However, 

regardless of the dose directly resulting from the accident, an inadvertent nuclear criticality 

should be avoided. This is consistent with the Commission’s goal to prevent inadvertent 

criticalities, as reflected in the NRC Strategic Plan (NUREG-1614) . . . .” However, there 

remained ambiguity regarding the relationship between § 70.61(b) and § 70.61(d). While the 

staff’s intent was to have a single performance requirement for criticality accidents, this cannot 

be substantiated by a literal examination of the final rule. 

Comparing the language in § 70.61(b) and (d), one concludes that § 70.61(d) is actually more 

restrictive than § 70.61(b). Section 70.61(d) essentially requires that there be no criticality 

accidents, with a high degree of assurance, whereas § 70.61(b) essentially requires that deaths 

and injuries (as implemented through a dose limit) be precluded (i.e., be made to be highly 

unlikely). If criticality accidents are prevented, then deaths and injuries are also prevented. 

However, the converse is not necessarily true; if deaths and injuries are prevented, criticality 

accidents are not necessarily prevented. Therefore, if one meets § 70.61(d), then one also 

automatically meets § 70.61(b); and if one meets § 70.61(b) through preventive means (that is, 

preventing the accident and not just the dose consequence), and also meets the additional 

requirements specified in § 70.61(d), then one also meets § 70.61(d).Thus, because the 
June 2015 5-A-5 NUREG-1520, Revision 2 

spectrum of credible abnormal conditions in 10 CFR 70.61(d) need not consider upsets beyond 

those required for compliance with the double contingency principle, if a licensee chooses to 

address criticality event sequences under 10 CFR 70.61(b) and usesa preventive strategy with 

an approved margin of subcriticality for safety, then the licensee will have also met the 

requirements of10 CFR 70.61(d). However, if the licensee chooses to address criticality event 

sequences under 10 CFR 70.61(b) with a mitigative strategy, then the licensee will not have met 

the requirements under 10 CFR 70.61(d) and additional controls will have to be identified to 

ensure subcriticality. 

Another consideration is that both § 70.61(b) and § 70.61(d) set the standard that must be met 

(i.e., the performance requirements), but not the methodology. Methodology requirements are 

contained in § 70.62. One cannot look at § 70.61 in a vacuum. All other 10 CFR Part 70 

provisions must also be met, including the § 70.62(c) provision that requires the integrated 

safety analysis (ISA) to include radiological hazards, facility hazards, potential accident 

sequences, and identification of IROFS as well as the assumptions and conditions under which 

the IROFS are relied upon to support compliance with § 70.61 performance requirements. It 

also requires that the ISA team include a person with experience in criticality safety. These 

requirements must be met regardless of whether the licensee attempts to meet the performance 

requirements starting from § 70.61(b) or § 70.61(d). The three options below can be seen to be 

equivalent when one considers that § 70.62 must also be met for all cases. 

To meet the regulations and prevent criticalities, an applicant/licensee may use one of the three 

approaches below (in conjunction with other 10 CFR Part 70 requirements, including those in 

§ 70.62): 

1. Demonstrate compliance with § 70.61(d); or 

2. Demonstrate compliance with § 70.61(b), considering only preventive controls and 

including an approved margin of subcriticality; or 

3. Separately demonstrate compliance with both § 70.61(d) and § 70.61(b). 

 

Use of any of the above three approaches will satisfy the regulations. 

That both § 70.61(b) and § 70.61(d) apply to criticality is supported by this SRP. In addition, 

there are several references to the requirement to make criticality highly unlikely. 

Double Contingency Principle § 70.64(a)(9) 

In addition to complying with the performance requirement in § 70.61, new facilities and 

processes are required to comply with the baseline design criteria in § 70.64. 

Section 70.64(a)(9) requires that the design provide for criticality control, including adherence to 

the double contingency principle (DCP). In addition to this requirement for new facilities and 

processes, many existing facilities and processes have license commitments to meet the DCP 

for licensed activities. Although Subpart H of 10 CFR Part 70 is relatively new, this conceptual 

framework is not new. Licensees have historically committed to ANSI/American Nuclear 

Society -8.1 (ANSI/ANS-8.1). This standard also requires that nuclear processes be ensured to 

be subcritical under normal and credible abnormal conditions. By contrast, the DCP is stated as 

a recommendation of ANSI/ANS-8.1. Therefore, the standard recognizes that adherence to the 

DCP can be one means, but is not necessarily the only means of meeting the underlying 
June 2015 5-A-6 NUREG-1520, Revision 2 

subcriticality requirement. The conditions under which compliance with the DCP ensures that 

§ 70.61(d) is met are discussed below. 

The double contingency principle is a design principle intended to be used in designing a facility 

that meets the performance requirements of § 70.61. The definition in § 70.4 (“...process 

designs should incorporate sufficient factors of safety...”) implicitly recognizes that there may be 

some cases in which a strict adherence to the double contingency principle is not practicable. 

This should be an exceedingly rare situation and should be accompanied by a convincing 

demonstration that a strict adherence to the double contingency principle is not practicable. 

Section 70.64(a) allows for this in stating that licensees must maintain the application of this 

criterion unless the integrated safety analysis (ISA) demonstrates that it is not relied on for 

safety or otherwise does not require adherence. For example, the consequence of criticality 

may be reduced to less than a high-consequence event in a heavily shielded facility; the NRC 

has endorsed (in Regulatory Guide 3.71) ANSI/ANS-8.10-1983 (R2005), which states that 

singly contingent operation may be permitted if the whole body dose outside the shielded and 

confined area following criticality does not exceed 25 rem. Another example may occur in UF6

cylinder storage yards, which have been found acceptable based on a single moderation control 

barrier (cylinder integrity). Yet another example may be a process involving only depleted or 

natural uranium, which may be singly contingent on enrichment control. 

The presence of two controls may not be necessary, or may not be sufficient, to meet the DCP. 

The DCP does not necessarily require two controls; it requires “at least two...changes in 

process conditions” be needed before criticality is possible. Meeting this may necessitate one, 

two, or more than two controls depending on the possible conditions that can lead to criticality. 

In general, there will be many pathways to criticality and, therefore, more than two controls 

required to meet the DCP for an entire process. 

In addition, § 70.64(b)(1) requires that the design must incorporate, whenever practicable, 

preference for the selection of engineered over administrative controls to increase overall 

system reliability. Passive engineered controls are generally preferable to active engineered 

controls, and engineered to administrative controls. In addition, process design should rely on 

geometry control as opposed to control of other parameters whenever practicable, and on 

diverse means of control (e.g., reliance on two different criticality parameters or different means 

of controlling one parameter) whenever practicable, to minimize the potential for common-mode 

failure. Cases in which these preferences cannot be complied with will generally require more 

justification to show adherence with the DCP. For example, one cannot claim that the double 

contingency principle is met with only two controls (regardless of type) if the resulting 

configuration fails to protect against all credible pathways to criticality or limit the risk of 

inadvertent criticality as required in 10 CFR 70.61(d). 

 

Relationship between § 70.61 and § 70.64(a)(9) 

 

As stated above, adherence to the DCP can be one means of meeting the performance 

requirements of § 70.61(d) (and, therefore, also § 70.61(b)). Historically, a number of different 

approaches to double contingency have been used. Some cases that have been used in the 

past may not be sufficiently robust to satisfy the performance requirements of § 70.61. 

Typically, this has been due to a reliance on controls that were not sufficiently robust (e.g., weak 

administrative controls). The purpose of this guidance is not to promote a new standard for all 

applications but rather to clarify when adherence to the DCP will establish a sufficient basis for 
June 2015 5-A-7 NUREG-1520, Revision 2 

meeting the performance requirements. To facilitate this, the following guidance is provided on 

the various terms in the definition of the DCP: 

Unlikely changes in process conditions should be expected to occur rarely, or not at all, during 

the lifetime of the facility. Operational events that occur regularly should not be credited as a 

contingency relied on to meet the DCP (although they may constitute part of a contingency if a 

combination of events may be considered unlikely). Therefore, the occurrence of any such 

event generally reveals a deficiency in the design that should result in corrective action. 

Determination that a contingency is unlikely should be based on objective attributes of the 

criticality controls, rather than on subjective judgment alone. Examples of such attributes are 

environmental factors that can degrade the reliability and availability of controls, margin, and 

redundancy and diversity of controls. (Guidance on some of the availability and reliability 

qualities that should be considered is provided in Section 3.4.3.2(9) of this SRP and NUREG1718, “Standard Review Plan for the Review of a License Application for a Mixed Oxide (MOX) 

Fuel Fabrication Facility,” Section 5.4.3.2(B)(vii).) Management measures should be provided, 

as needed, to ensure that the failure of the criticality controls is an unlikely contingency. (NOTE: 

Usage of the term “unlikely” in the DCP is not equivalent to the term as used in § 70.61(c) for 

intermediate consequence events.) 

Independent changes in process conditions are such that one contingency neither causes 

another contingency nor increases its likelihood of occurrence. The existence of any credible 

common-mode failure of both contingencies means that it is not valid to consider them 

independent. For example, related actions performed by the same individual or using the same 

equipment will not generally be sufficiently independent to meet the DCP. 

Concurrent does not mean that the two changes in process conditions must occur 

simultaneously, but that the effect of the first contingency persists until the second contingency 

occurs. Prompt detection and correction of abnormal conditions should thus be provided to 

restore double contingency protection. The time required to detect and correct failures should 

be significantly shorter than the anticipated time between failures in order for there to be 

significant risk reduction provided from failure detection. 

Changes in process conditions do not imply that reliance on two different parameters is 

mandatory to meet the DCP. Reliance on two different parameters is preferable to reliance on 

two controls on a single parameter, however, because of the difficulty in achieving complete 

independence when controlling one parameter. In those cases in which single parameter 

control is unavoidable, great care should be taken to ensure that no common-mode failures 

exist. 

In addition to meeting the above, the following guidance is provided to illustrate the conditions 

under which adherence to the double contingency principle (in terms of the guidance above) is 

sufficient to meet the performance requirement of 10 CFR 70.61: 

 Controls are established on system parameters to preclude changes in process 

conditions, and these controls are designated as IROFS in accordance with § 70.61(e). 

(Reliance should be based on items that are designated as IROFS in the ISA Summary 

and not on random factors that may or may not be maintained.) 

 The condition resulting from the failure of a leg of double contingency has been shown to 

be subcritical with an acceptable margin (e.g., keff is less than USL, parameters are 

within subcritical limits specified in the license or endorsed standards). 
June 2015 5-A-8 NUREG-1520, Revision 2 

 Controls are sufficiently reliable to ensure that each change in process conditions 

necessary for criticality is “unlikely.” Management measures are established to ensure 

that they are available and reliable to perform their safety function. 

Because the DCP is only one means of meeting the performance requirements, it is possible to 

meet the DCP without meeting the conditions above (including designating criticality controls as 

IROFS in the ISA Summary). In this case, however, another method must be relied on to meet 

the § 70.61 performance requirements. However, in order to use compliance with the DCP as 

part of the demonstration of meeting the § 70.61 performance requirements, these conditions 

should be met. 

Some specific examples of control systems that meet § 70.61(d) through use of the DCP follow: 

A passive geometry control in which no credible failure mode (e.g., bulging, corrosion, or 

leakage) exists and which has been placed under configuration management: 

 A favorable geometry vessel in a benign environment in which corrosion or other 

material degradation is not credible. In addition, the vessel is of such robust 

construction (e.g., thick stainless steel, steel surrounded by concrete) that it is 

unquestionably not going to leak, and there is no credible mechanism for the material to 

accumulate in an unfavorable configuration. 

 A tank that is not authorized to contain fissile material is located far outside the fissile 

material handling areas and is physically isolated from fissile liquid processes by a blank 

flange or siphon break, such that backflow is not credible. 

Two passive controls in which there is a credible failure mode, and there are sufficient 

management measures to ensure the controls continue to perform their safety functions (e.g., 

periodic surveillance to detect corrosion/bulging): 

 A favorable geometry solution column, in which leakage of the tank is a credible upset. 

In addition, the column is in an area in which the solution would leak into a favorable 

geometry dike, and the leakage would be self-revealing (i.e., column is in a continually 

manned area) or the column and dike would be subject to periodic surveillance. 

 A double-sleeved solution line in which leakage of the inner pipe would be quickly 

detected (e.g., by conductivity probe between the pipes or by transparent baffling). 

 A storage array in which fissile material is stored in fixed geometry containers, and the 

spacing between containers is fixed by birdcages or other fixed devices, and geometry 

and spacing controls are ensured by configuration management and periodic 

walkthroughs. 

One passive control under configuration management and one active engineered control whose 

reliability is ensured by periodic functional testing, maintenance, and an alarm to automatically 

indicate its failure: 

 A calciner relying on geometry and moderation control in which geometry control is 
June 2015 5-A-9 NUREG-1520, Revision 2 

provided by limiting the calciner interior to the height of a single layer of pellet boats, and 

moderation control is provided by monitoring of the calciner temperature. Temperature 

control is ensured by thermocouples that alarm if the temperature drops below a 

minimum set-point. 

 A down-blending tank that is subcritical for uranium solutions with less than a limiting 

enrichment in which volume control is provided by the design of the tank and enrichment 

control is provided using mass flow totalizers and a mechanical stirrer. The failure of 

these active devices automatically stops the transfer of solution and actuates an alarm. 

 A large geometry tank relying on raschig rings for criticality control in which the raschig 

rings are only approved up to a limiting concentration, and the concentration is controlled 

by an in-line sodium iodide detector that closes an isolation valve when actuated. 

One engineered and one enhanced administrative control in which the instrumentation and 

devices included in the administrative control are subject to periodic functional testing and 

maintenance, and the operator action is performed routinely or reinforced by periodic drills and 

training: 

 A powder handling glovebox relying on moderator and mass control in which moderator 

control is provided by the glovebox design (e.g., airtight, dry nitrogen atmosphere, 

sloped ventilation ductwork) and mass is procedurally controlled by limiting batch size. 

In addition, mass transfers must be logged into a computer tracking system that alarms if 

mass limits are exceeded. 

 A vessel in which the volume of fissile solution is controlled by the diameter of the tank 

and by procedurally limiting the solution height. In addition, operator actions are backed 

up with a high-level switch equipped with an alarm. 

One engineered control and one simple administrative control in which the reliability of the 

administrative control is subject to a high degree of redundancy:

 Solution transfer from favorable to unfavorable geometry relying on two controls on 

concentration. Two different operators are required to draw separate samples which are 

then analyzed in the laboratory by two different methods and shown to be within 

concentration limits before transfer is authorized. In addition, the area supervisor 

maintains control of a key to the transfer pump so that the procedure may not be 

inadvertently bypassed. This is backed up with an in-line sodium iodide detector that 

automatically closes an isolation valve if concentration limits are exceeded. 

(NOTE: Use of two independent samples is generally not considered adequate for both legs 

of double contingency because of the difficulty in ensuring complete independence between 

the samples.) 

Two administrative controls that are independent (e.g., performed by different individuals or 

verified by a supervisor), for which human factors have been considered in the design of the 

process such that the operation is not prone to error, and there is sufficient margin to require 

multiple failures before the criticality control limit can be exceeded: 
June 2015 5-A-10 NUREG-1520, Revision 2 

 A glovebox relying on dual mass control in which two operators or an operator and a 

supervisor must confirm that placing material into the glovebox will not result in the mass 

limit being exceeded. In addition, criticality would require the mass limit to be exceeded 

multiple times, which would be difficult to achieve and would be readily apparent. 

 A drum storage array limited to a vertical stack of four drums in which there are no 

forklifts in the area capable of raising a drum above this height. In addition, the drums 

are very heavy and violating the stack height limit would require an immense physical 

effort. 

 A planar storage array in which mass-controlled containers are procedurally limited to 

not less than 24 inches center-to-center, and in which criticality would require 

assembling a very large number of containers into a spherical heap and reflecting them 

intimately with water. 

Other considerations ensuring that there is no credible event leading to criticality: 

 A facility handling uranium enriched to no more than 1 weight percent (wt%) uranium235 (235U). 

 A facility in which the site-wide limit is less than a minimum critical mass. 

 A facility storing contaminated soil or equipment with a very low uranium concentration in 

which there is no known concentration mechanism that can lead to a critical 

configuration. 

Some examples of control systems that would not meet § 70.61(d) through use of the DCP: 

Double contingency consisting of two single operator actions without any supervisor verification 

or redundancy: 

 Solution transfers that rely only on two operators drawing separate samples or in which 

a single procedural deviation could cause an unauthorized transfer. 

 A mass controlled system in which triple batching (i.e., two successive batching errors) 

could result in criticality when the mass transfers are done by a single operator. 

 A storage array in which two violations on administrative spacing requirements could 

credibly lead to criticality. 

A leg of double contingency consisting of an administrative control for which correct 

performance of the action cannot be readily confirmed or is subjective: 

 A solution vessel in which the operator is required to confirm concentration or chemical 

form by visually observing a color change in the solution. 

 A tank in which the operator is required to verify prior to operation that the tank is 

“essentially empty.” 
June 2015 5-A-11 NUREG-1520, Revision 2 

A leg of double contingency consisting of complex administrative tasks composed of multiple 

steps that are susceptible to error: 

 A glovebox in which the operator is required to calculate the mass of plastic, paper, and 

other miscellaneous materials in order to comply with moderator control. 

 A solution transfer operation in which one leg consists solely on a single sample being 

correctly drawn, labeled, analyzed, recorded, and read. 

 Maintenance on a dissolution process in which criticality safety relies on the correct 

performance of a procedure to replace an in-line filter. The procedure requires that the 

filter be removed, flushed, and re-installed in a multi-step process that has several 

opportunities for failure. 

A leg of double contingency consisting of an administrative control with insufficient margin to 

ensure that the safety limit will not be exceeded: 

 A glovebox in which mass is controlled administratively, and in which the normal mass 

limit is almost equal to the minimum critical mass. 

 A planar storage array in which spacing between containers is administratively limited to 

be less than 24 inches center-to-center, and in which criticality will result if a few 

containers are placed 23 inches apart. 

A leg of double contingency consisting of an engineered control in which there is no reasonable 

means to detect and correct the failure within a given time. 

 A solution process in which it is plausible for concentrated solution to be allowed to 

accumulate undetected over a long period of time in an unfavorable geometry. 

 A vessel in which geometry control is provided by a double wall, but there is no means of 

detecting leakage between the walls. In addition, the vessel is of a type known to have a 

history of leakage (e.g., heat exchanger). 

A leg of double contingency consisting of a control in an environment where its safety function is 

degraded. 

 A solution vessel relied on for geometry control, but which is subject to pressure 

fluctuations that can cause the vessel to bulge beyond a favorable diameter. 

 Instrumentation whose performance is degraded under conditions that can be 

reasonably expected during normal operations (e.g., temperature, pressure, presence of 

corrosive gases, or loss of essential utilities such as electricity, plant air, or water). 

A leg of double contingency consisting of a control where its behavior under adverse conditions 

is uncertain.

 An unfavorable geometry pump in which mass control relies on the presumption that the 

pump will malfunction before an unsafe volume of uranium accumulates in the pump oil, 
June 2015 5-A-12 NUREG-1520, Revision 2 

and for which no failures of this type have been observed. 

A leg of double contingency consisting of undeclared design features or process conditions that 

are not precluded by being explicitly controlled. 

 A powder blending operation in which uranium oxide density that is less than the 

theoretical density is assumed, but the process variables affecting density (e.g., 

calcinations temperature, mechanical pressure of the pellet press) are not specifically 

controlled and there is no confirmatory sampling. 

 A solvent extraction process in which nominal concentration of uranyl nitrate is assumed, 

but there is no in-line monitoring or confirmatory sampling. 

 A vault in which the mass limit is not controlled by procedure or license limit, but is 

merely based on current inventory. 

 A process relying on the favorable geometry of passive equipment, but for which the 

dimensions and/or material composition are not specifically identified as criticality 

controls. 

This list is merely illustrative and not meant to be exhaustive. However, these examples 

demonstrate that double contingency that satisfies the performance requirements can be based 

on one, two, or more than two passive engineered, active engineered, or administrative 

controls, and that reliability and availability of those controls depends on management 

measures, safety margins, environmental conditions, human factors, and other process and 

control characteristics. Not every application similar to these examples will be found 

acceptable—determination must be made on the totality of the information available, and an 

analyst should consider all factors that may degrade the robustness of the controls. 

Technical Review Guidance

Relationship of 10 CFR 70.61(b) and 10 CFR 70.61(d) 

The reviewer needs to assure that all applicable 10 CFR Part 70 criticality provisions (including 

§ 70.62(c)) are met. To meet the regulations and prevent criticalities an applicant/licensee may 

use one of the three approaches below (in conjunction with other 10 CFR Part 70 requirements, 

including those in § 70.62): 

1. Demonstrate compliance with § 70.61(d); or 

2. Demonstrate compliance with § 70.61(b), considering only preventive controls and 

including an approved margin of subcriticality; or 

3. Separately demonstrate compliance with both § 70.61(d) and § 70.61(b). 

Use of any of the above three approaches will satisfy the regulations. 

Staff should not dictate which of the above three options must be met; rather, staff should 

assure that the applicant/licensee has met one of these options. 
June 2015 5-A-13 NUREG-1520, Revision 2 

Double Contingency Principle 

One way, but not the only way, of meeting 10 CFR 70.61 is by applying the double contingency 

principle (defined in 10 CFR 70.4) to accident sequences leading to criticality that are required 

to be developed per § 70.62. Adherence to the DCP will satisfy the performance requirement of 

§ 70.61(d) (and therefore also § 70.61(b)) provided the following conditions are met: 

 Controls are established on system parameters to preclude changes in process 

conditions, and these controls are designated as IROFS in accordance with § 70.61(e). 

(Reliance should be based on items that are designated as IROFS in the ISA Summary 

and not on random factors that may or may not be maintained.) 

 The condition resulting from the failure of a leg of double contingency has been shown to 

be subcritical with an acceptable margin (e.g., keff is less than USL, parameters are 

within subcritical limits specified in the license or endorsed standards). 

 Controls are sufficiently reliable to ensure that each change in process conditions 

necessary for criticality is “unlikely.” Management measures are established to ensure 

that they are available and reliable to perform their safety function. 

In the absence of meeting these conditions, an alternate demonstration of compliance with the 

performance requirements should be provided. 

June 2015 5-B-1 NUREG-1520, Revision 2 

APPENDIX B 

JUSTIFICATION FOR MINIMUM MARGIN OF 

SUBCRITICALITY FOR SAFETY 

Purpose 

This appendix provides additional guidance for the minimum margin of subcriticality for safety. 

These evaluations are used in demonstrating compliance with the performance requirements of 

Title 10 of the Code of Federal Regulations (10 CFR) 70.61, “Performance Requirements.” 

Introduction 

The regulation in 10 CFR 70.61(d) requires, in part, that licensees or applicants (henceforth to 

be referred to as “licensees”) demonstrate that “under normal and credible abnormal conditions, 

all nuclear processes are subcritical, including use of an approved margin of subcriticality for 

safety.” There are a variety of methods that may be used to demonstrate subcriticality, including 

use of industry standards, handbooks, hand calculations, and computer methods. Subcriticality 

is assured, in part, by providing margin between actual conditions and expected critical 

conditions. This appendix, however, applies only to margin used in those methods that rely on 

calculation of keff, including deterministic and probabilistic computer methods. The use of other 

methods (e.g., use of endorsed industry standards, widely accepted handbooks, certain hand 

calculations), containing varying amounts of margin, is outside the scope of this appendix.

For methods relying on calculation of keff, margin may be provided either in terms of limits on 

physical parameters of the system (of which keff is a function), or in terms of limits on keff directly, 

or both. For the purposes of this appendix, the term margin of safety will be used to refer to the 

margin to criticality in terms of system parameters, and the term margin of subcriticality (MoS) 

will refer to the margin to criticality in terms of keff. A common approach to ensuring subcriticality 

is to determine a maximum keff limit below which the licensee’s calculations must fall. This limit 

will be referred to in this appendix as the Upper Subcritical Limit (USL). Licensees using 

calculational methods perform validation studies, in which critical experiments similar to actual 

or anticipated facility applications are chosen and then analyzed to determine the bias and 

uncertainty in the bias. The bias is a measure of the systematic differences between 

calculational method results and experimental data. The uncertainty in the bias is a measure of 

both the accuracy and precision of the calculations and the uncertainty in the experimental data. 

A USL is then established that includes allowances for bias and bias uncertainty as well as an 

additional margin, to be referred to in this appendix as the minimum margin of subcriticality

(MMS). The MMS is variously referred to in the nuclear industry as minimum subcritical margin, 

administrative margin, and arbitrary margin, and the term MMS should be regarded as 

synonymous with those terms. The term MMS will be used throughout this appendix, and has 

been chosen for consistency with the rule. The MMS is an allowance for any unknown (or 

difficult to identify or quantify) errors or uncertainties in the method of calculating keff that may 

exist beyond those which have been accounted for explicitly in calculating the bias and its 

uncertainty. 

There is little guidance in the fuel facility Standard Review Plans (SRPs) as to what constitutes 

sufficient technical justification for the MMS. NUREG-1520, “Standard Review Plan for the 

Review of a License Application for a Fuel Cycle Facility,” Section 5.4.3.4.4, states that there 
June 2015 5-B-2 NUREG-1520, Revision 2 

must be margin that includes, among other uncertainties, “adequate allowance for uncertainty in 

the methodology, data, and bias to assure subcriticality.” An important component of this overall 

margin is the MMS. However, there has been almost no guidance on how to determine an 

appropriate MMS. Partly due to the lack of historical guidance, and partly due to differences 

between facilities’ processes and methods of calculation, there have been significantly different 

MMS values approved for the various fuel cycle facilities over time. In addition, the different 

ways licensees have of defining margins and calculating keff limits have made a consistent 

approach to reviewing keff limits difficult. Recent licensing experience has highlighted the need 

for further guidance to clarify what constitutes an acceptable justification for the MMS. 

The MMS can have a substantial effect on facility operations (e.g., storage capacity, throughput) 

and there has, therefore, been considerable recent interest in decreasing margin in keff below 

what has been licensed previously. In addition, the increasing sophistication of computer codes 

and the ready availability of computing resources means that there has been a gradual move 

towards more realistic (often resulting in less conservative) modeling of process systems. The 

increasing interest in reducing the MMS and the reduction in modeling conservatism make 

technical justification of the MMS more risk-significant than it has been in the past. In general, 

consistent with a risk-informed approach to regulation, a smaller MMS requires a more 

substantial technical justification. 

This appendix is only applicable to fuel enrichment and fabrication facilities licensed under 10 

CFR Part 70. 

Discussion 

This guidance is applicable to evaluating the MMS in methods of evaluation that rely on 

calculation of keff. The keff value of a fissionable system depends, in general, on a large number 

of physical variables. The factors that can affect the calculated value of keff may be broadly 

divided into the following categories: (1) the geometric configuration; (2) the material 

composition; and (3) the neutron distribution. The geometric form and material composition of 

the system–together with the underlying nuclear data (e.g., ν, χ(E), cross section data)– 

determine the spatial and energy distribution of neutrons in the system (flux and energy 

spectrum). An error in the nuclear data or the geometric or material modeling of these systems 

can produce an error in the neutron flux and energy spectrum, and thus in the calculated value 

of keff. The bias associated with a single system is defined as the difference between the 

calculated and physical values of keff, by the following equation: 

ߚൌ݇௖௔௟௖ െ ݇௣௛௬௦௜௖௔௟

Thus, determining the bias requires knowing both the calculated and physical keff values of the 

system. The bias associated with a single critical experiment can be known with a high degree 

of confidence, because the physical (experimental) value is known a priori (kphysical ~1). However, 

for calculations performed to demonstrate subcriticality of facility processes (to be referred to as 

“applications”), this is not generally the case. The bias associated with such an application (i.e., 

not a known critical configuration) is not typically known with this same high degree of 

confidence, because the actual physical keff of the system is usually not known. In practice, the 

bias is determined from the average calculated keff for a set of experiments that cover different 

aspects of the licensee’s applications. The bias and its uncertainty must be estimated by 

calculating the bias associated with a set of critical experiments having geometric forms, 
June 2015 5-B-3 NUREG-1520, Revision 2 

material compositions, and neutron spectra similar to those of the application. Because of the 

large number of factors that can affect the bias, and the finite number of critical experiments 

available, staff should recognize that this is only an estimate of the true bias of the system. The 

experiments analyzed cannot cover all possible combinations of conditions or sources of error 

that may be present in the applications to be evaluated. The effect on keff of geometric, material, 

or spectral differences between critical experiments and applications cannot be known with 

precision. Therefore, an additional margin (MMS) must be applied to allow for the effects of any 

unknown uncertainties that may exist in the calculated value of keff beyond those accounted for 

in the calculation of the bias and its uncertainty. As the MMS decreases, there needs to be a 

greater level of assurance that the various sources of bias and uncertainty have been taken into 

account, and that the bias and uncertainty are known with a high degree of accuracy. In 

general, the more similar the critical experiments are to the applications, the more confidence 

there is in the estimate of the bias and the less MMS is needed. 

In determining an appropriate MMS, the reviewer should consider the specific conditions and 

process characteristics present at the facility in question. However, the MMS should not be 

reduced below 0.02. The nuclear cross sections are not generally known to better than -1-2%. 

While this does not necessarily translate into a 2% ∆keff, it has been observed over many years 

of experience with criticality code validation that biases and spreads in the data of a few percent 

can be expected. As stated in NUREG-1520, MoS should be large compared to the uncertainty 

in the bias. Moreover, errors in the criticality codes have been discovered over time that have 

produced keff differences of roughly this same magnitude of 1-2% (e.g., Information Notice 2005-

13, “Potential Non-Conservative Error in Modeling Geometric Regions in the KENO-V.a 

Criticality Code”). While the possibility of having larger undiscovered errors cannot be entirely 

discounted, modeling sufficiently similar critical experiments with the same code options to be 

used in modeling applications should minimize the potential for this to occur. However, many 

years of experience with the typical distribution of calculated keff values and with the magnitude 

of code errors that have occasionally surfaced support establishing 0.02 as the minimum MMS 

that should be considered acceptable under the best possible conditions. 

Staff should recognize the important distinction between ensuring that processes are safe and 

ensuring that they are adequately subcritical. The value of keff is a direct indication of the degree 

of subcriticality of the system, but is not fully indicative of the degree of safety. A system that is 

very subcritical (i.e., with keff «1) may have a small margin of safety if a small change in a 

process parameter can result in criticality. An example of this would be a UO2 powder storage 

vessel, which is subcritical when dry, but may require only the addition of water for criticality. 

Similarly, a system with a small MoS (i.e., with keff ~1) may have a very large margin of safety if 

it cannot credibly become critical. An example of this would be a natural uranium system in light 

water, which may have a keff value close to 1 but will never exceed 1. Because of this, a 

distinction should be made between the margin of subcriticality and the margin of safety. 

Although a variety of terms are in use in the nuclear industry, the term margin of subcriticality 

will be taken to mean the difference between the actual (physical) value of keff and the value of 

keff at which the system is expected to be critical. The term margin of safety will be taken to 

mean the difference between the actual value of a parameter and the value of the parameter at 

which the system is expected to be critical. The MMS is intended to account for the degree of 

confidence that applications calculated to be subcritical will be subcritical. It is not intended to 

account for other aspects of the process (e.g., safety of the process or the ability to control 

parameters within certain bounds) that may need to be reviewed as part of an overall licensing 

review. 
June 2015 5-B-4 NUREG-1520, Revision 2 

There are a variety of different approaches that a licensee could choose in justifying the MMS. 

Some of these approaches and means of reviewing them are described in the following 

sections, in no particular preferential order. Many of these approaches consist of qualitative 

arguments, and therefore there will be some degree of subjectivity in determining the adequacy 

of the MMS. Because the MMS is an allowance for unknown (or difficult to identify or quantify) 

errors, the reviewer must ultimately exercise his or her best judgement in determining whether a 

specific MMS is justified. Thus, the topics listed below should be regarded as factors the 

reviewer should take into consideration in exercising that judgement, rather than any kind of 

prescriptive checklist.1

The reviewer should also bear in mind that the licensee is not required to use any or all of these 

approaches, but may choose an approach that is applicable to its facility or a particular process 

within its facility. While it may be desirable and convenient to have a single keff limit or MMS 

value (and single corresponding justification) across an entire facility, it is not necessary for this 

to be the case. The MMS may be easier to justify for one process than for another, or for a 

limited application versus generically for the entire facility. The reviewer should expect to see 

various combinations of these approaches, or entirely different approaches, used, depending on 

the nature of the licensee’s processes and methods of calculation. Any approach used must 

ultimately lead to a determination that there is adequate assurance of subcriticality. 

(1) Conservatism in the Calculational Models 

The margin in keff produced by the licensee’s modeling practices, together with the MMS, 

provide the margin between actual conditions and expected critical conditions. In terms of the 

subcriticality criterion taken from ANSI/ANS-8.17-2004, “Criticality Safety Criteria for the 

Handling, Storage, and Transportation of LWR Fuel Outside Reactors” (as explained in 

Appendix A): 

௔௦݇௠ ൅ ∆݇ ൒ ∆ܵ݋ܯ

where ∆km is the MMS and ∆ksa is the margin in keff due to conservative modeling of the system 

(i.e., conservative values of system parameters). 

Two different applications for which the sums on the right hand side of the equation above are 

equal to each other are equally subcritical. Assurance of subcriticality may thus be provided by 

specifying a margin in keff (∆km), or specifying conservative modeling practices (∆ksa), or some 

combination thereof. This principle will be particularly useful to the reviewer evaluating a 

proposed reduction in the currently approved MMS; the review of such a reduction should prove 

straightforward in cases in which the overall combination of modeling conservatism and MMS 

has not changed. Because of this straightforward quantitative relationship, any modeling 

conservatism that has not been previously credited should be considered before examining 

other factors. Cases in which the overall MoS has decreased may still be acceptable, but would 

have to be justified by other means. 

 

1

 In the discussion of these factors, the purpose is not to impose any new requirements or standards for acceptability on licensees. 

However, in many cases it will be necessary to go beyond the minimum requirements for a given factor, if that factor is being 

used as part of the technical basis for justifying a smaller MMS than would otherwise be acceptable. 
June 2015 5-B-5 NUREG-1520, Revision 2 

In evaluating justification for the MMS relying on conservatism in the model, the reviewer should 

consider only that conservatism in excess of any manufacturing tolerances, uncertainties in 

system parameters, or credible process variations. That is, the conservatism should consist of 

conservatism beyond the worst-case normal or abnormal conditions, as appropriate, including 

allowance for any tolerances. Examples of this added conservatism may include assuming 

optimum concentration in solution processes, neglecting neutron absorbers in structural 

materials, or assuming minimum reflector conditions (e.g., at least a 1-inch, tight-fitting reflector 

around process equipment). These technical practices used to perform criticality calculations 

generally result in conservatism of at least several percent in keff. To credit this as part of the 

justification for the MMS, the reviewer should have assurance that the modeling practices 

described will result in a predictable and dependable amount of conservatism in keff. In some 

cases, the conservatism may be process-dependent, in which case it may be relied on as 

justification for the MMS for a particular process. However, only modeling practices that result in 

a global conservatism across the entire facility should be relied on as justification for a sitewide 

MMS. Ensuring predictable and dependable conservatism includes verifying that this 

conservatism will be maintained over the facility lifetime, such as through the use of license 

commitments or conditions. 

If the licensee has a program that establishes operating limits (to ensure that subcritical limits 

are not exceeded) below subcritical limits determined in nuclear criticality safety evaluations, the 

margin provided by this (optional) practice may be credited as part of the conservatism. In such 

cases, the reviewer should credit only the difference between operating and subcritical limits 

that exceeds any tolerances or process variation, and should ensure that any such operating 

limits will be maintained over the facility lifetime, through the use of license commitments or 

conditions. 

Some questions that the reviewer may ask in evaluating the use of modeling conservatism as 

justification for the MMS include: 

 How much margin in keff is provided due to conservatism in modeling practices? 

 How much of this margin exceeds allowance for tolerances and process variations? 

 Is this margin specific to a particular process or does it apply to all facility processes? 

 What provides assurance that this margin will be maintained over the facility lifetime? 

(2) Validation Methodology and Results 

Assurance of subcriticality for methods that rely on the calculation of keff requires that those 

methods be appropriately validated. One of the goals of criticality code validation is to determine 

the method’s bias and the uncertainty in the bias. After this has been done, an additional margin 

(MMS) is specified to account for any additional uncertainties that may exist. The appropriate 

MMS depends, in part, on the degree of confidence in the validation results. Having a high 

degree of confidence in the bias and bias uncertainty requires both that there be sufficient (for 

the statistical method used) applicable benchmark-quality experiments and that there be a 

rigorous validation methodology. Critical experiments that do not rise to the level of benchmarkquality experiments may also be acceptable, but may require additional margin. If either the 

data or the methodology is deficient, a high degree of confidence in the results cannot be 
June 2015 5-B-6 NUREG-1520, Revision 2 

attained, and a larger MMS may need to be employed than would otherwise be acceptable. 

Therefore, although validation and determining the MMS are separate exercises, they are 

related. The more confidence one has in the validation results, the less additional margin (MMS) 

is needed. The less confidence one has in the validation results, the more MMS is needed. 

Any review of a licensing action involving the MMS should involve examination of the licensee’s 

validation methodology and results. While there is no clear quantifiable relationship between the 

validation and MMS (as exists with modeling conservatism), several aspects of validation should 

be considered before making a qualitative determination of the adequacy of the MMS. 

There are four factors that the reviewer should consider in evaluating the validation: (1) the 

similarity of critical experiments to actual applications; (2) sufficiency of the data (including the 

number and quality of experiments); (3) adequacy of the validation methodology; and (4) 

conservatism in the calculation of the bias and its uncertainty. These factors are discussed in 

more detail below. 

Similarity of Critical Experiments 

Because the bias and its uncertainty must be estimated based on critical experiments having 

geometric form, material composition, and neutronic behavior similar to specific applications, the 

degree of similarity between the critical experiments and applications is a key consideration in 

determining the appropriateness of the MMS. The more closely critical experiments represent 

the characteristics of applications being validated, the more confidence the reviewer has in the 

estimate of the bias and the bias uncertainty for those applications. 

The reviewer must understand both the critical experiments and applications in sufficient detail 

to ascertain the degree of similarity between them. Criticality code validation reports generally 

contain a description of critical experiments (including source references). The reviewer may 

need to consult these references to understand the physical characteristics of the experiments. 

In addition, the reviewer may need to consult process descriptions, nuclear criticality safety 

evaluations, drawings, tables, input files, or other information to understand the physical 

characteristics of applications. The reviewer must consider the full spectrum of normal and 

abnormal conditions that may have to be modeled when evaluating the similarity of the critical 

experiments to applications. 

In evaluating the similarity of experiments to applications, the reviewer must recognize that 

some parameters are more significant than others to accurately calculate keff. The parameters 

that have the greatest effect on the calculated keff of the system are those that are most 

important to match when choosing critical experiments. Because of this, there is a close 

relationship between similarity of critical experiments to applications and system sensitivity. 

Historically, certain parameters have been used to trend the bias because these are the 

parameters that have been found to have the greatest effect on the bias. These parameters 

include the moderator-to-fuel ratio (e.g., H/U, H/X, vm/vf

), isotopic abundance (e.g., uranium-235 

(

235U), plutonium-239 (239Pu), or overall Pu-to-uranium ratio), and parameters that characterize 

the neutron energy spectrum (e.g., energy of average lethargy causing fission (EALF), average 

energy group (AEG)). Other parameters, such as material density or overall geometric shape, 

are generally considered to be of less importance. The reviewer should consider all important 

system characteristics that can reasonably be expected to affect the bias. For example, the 

critical experiments should include any materials that can have an appreciable effect on the 

calculated keff, so that the effect due to the cross sections of those materials is included in the 
June 2015 5-B-7 NUREG-1520, Revision 2 

bias. Furthermore, these materials should have at least the same reactivity worth in the 

experiments (which may be evidenced by having similar number densities) as in the 

applications. Otherwise, the effect of any bias from the underlying cross sections or the 

assumed material composition may be masked in the applications. The materials must be 

present in a statistically significant number of experiments having similar neutron spectra to the 

application. Conversely, materials that do not have an appreciable effect on the bias may be 

neglected and would not have to be represented in the critical experiments. 

Merely having critical experiments that are representative of applications is the minimum 

acceptance criterion, and does not alone justify having any particular value of the MMS. There 

are some situations, however, in which there is an unusually high degree of similarity between 

the critical experiments and applications, and in these cases, this fact may be credited as 

justification for having a smaller MMS than would otherwise be acceptable. If the critical 

experiments have geometric forms, material compositions, and neutron spectra that are nearly 

indistinguishable from those of the applications, this may be justification for a smaller MMS than 

would otherwise be acceptable. For example, justification for having a small MMS for finished 

fuel assemblies could include selecting critical experiments consisting of fuel assemblies in 

water, where the fuel has nearly the same pellet diameter, pellet density, cladding materials, 

pitch, absorber content, enrichment, and neutron energy spectrum as the licensee’s fuel. In this 

case, the criticality code validation report should be very specific to this type of system, because 

including of the types of critical experiments could mask variations in the bias. Therefore, this 

type of justification is generally easiest when the area of applicability (AOA) is very narrowly 

defined. 

The reviewer should pay particular attention to abnormal conditions. In this example, changes in 

process conditions such as damage to the fuel or partial flooding may significantly affect the 

applicability of the critical experiments. 

 

There are several tools available to the reviewer to ascertain the degree of similarity between 

critical experiments and applications. Some of these are listed below: 

1. NUREG/CR-6698, “Guide to Validation of Nuclear Criticality Safety Calculational 

Method,” Table 2.3, contains a set of screening criteria for determining the applicability 

of critical experiments. As is stated in the NUREG, these criteria were arrived at by 

consensus among experienced nuclear criticality safety specialists and may be 

considered to be conservative. The reviewer should consider agreement on all screening 

criteria to be justification for demonstrating a very high degree of critical experiment 

similarity. (Agreement on the most significant screening criteria for a particular system 

should be considered as demonstration of an acceptable degree of critical experiment 

similarity.) Less conservative (i.e., broader) screening criteria may also be acceptable, if 

appropriately justified. 

2. Analytical methods that systematically quantify the degree of similarity between a set of 

critical experiments and applications in pair-wise fashion may be used. One example of 

this is the TSUNAMI code in the SCALE 5 code package. One strength of TSUNAMI is 

that it calculates an overall correlation that is a quantitative measure of the degree of 

similarity between an experiment and an application. Another strength is that this code 

considers all the nuclear phenomena and underlying cross sections and weights them by 

their importance to the calculated keff (i.e., sensitivity of keff to the data). The NRC staff 

currently considers a correlation coefficient of ck ~ 0.95 to be indicative of a very high 

degree of similarity. This is based on the staff’s experience comparing the results from 
June 2015 5-B-8 NUREG-1520, Revision 2 

TSUNAMI to those from a more traditional screening criterion approach. The NRC staff 

also considers a correlation coefficient between 0.90 and 0.95 to be indicative of a high 

degree of similarity. However, owing to the amount of experience with TSUNAMI, in this 

range use of the code should be supplemented with other methods of evaluating critical 

experiment similarity. Conversely, a correlation coefficient less than 0.90 should not be 

used as a demonstration of a high or very high degree of critical experiment similarity. 

Because of limited use of the code to date, all of these observations should be 

considered tentative and thus the reviewer should not use TSUNAMI as a “black box,” or 

base conclusions of adequacy solely on its use. However, it may be used to test a 

licensee’s statement that there is a high degree of similarity between experiments and 

applications. 

3. Traditional parametric sensitivity studies may be employed to demonstrate that keff is 

highly sensitive or insensitive to a particular parameter. For example, if a 50% reduction 

in the 10B cross section is needed to produce a 1% change in the system keff, then it can 

be concluded that the system is highly insensitive to the boron content, in the amount 

present. This is because a credible error in the 10B cross section of a few percent will 

have a statistically insignificant effect on the bias. Therefore, in the amount present, the 

boron content is not a parameter that is important to match in order to conclude that 

there is a high degree of similarity between critical experiments and applications. 

4. Physical arguments may demonstrate that keff is highly sensitive or insensitive to a 

particular parameter. For example, the fact that oxygen and fluorine are almost 

transparent to thermal neutrons (i.e., cross sections are very low) may justify why 

experiments consisting of UO2F2 may be considered similar to UO2 or UF4 applications, 

provided that both experiments and applications occur in the thermal energy range. 

The reviewer should ensure that those parameters which can reasonably be expected to 

significantly affect the bias are considered when assessing critical experiment similarity. For 

example, comparison should not be based solely on agreement in the 235U fission spectrum for 

systems in which the system keff is highly sensitive to 238U fission, 10B absorption, or 1

H 

scattering. A method such as TSUNAMI that considers the complete set of reactions and 

nuclides present can be used to rank the various system sensitivities, and to thus determine 

whether it is reasonable to rely on the fission spectrum alone in assessing the similarity of 

critical experiments to applications. 

Some questions that the reviewer may ask in evaluating reliance on critical experiment similarity 

as justification for the MMS include: 

 Do the critical experiments adequately span the range of geometric forms, material 

compositions, and neutron energy spectra expected in applications? 

 Are the materials present with at least the same reactivity worth as in applications? 

 Do the licensee’s criteria for determining whether experiments are sufficiently similar to 

applications consider nuclear reactions and nuclides that can have a statistically 

significant effect on the bias? 
June 2015 5-B-9 NUREG-1520, Revision 2 

Sufficiency of the Data 

Another aspect of evaluating the selected critical experiments for a specific MMS is evaluating 

whether there is a sufficient number of benchmark-quality experiments to determine the bias 

across the entire AOA. Having a sufficient number of benchmark-quality experiments means 

that: (1) there are enough (applicable) critical experiments to make a statistically meaningful 

calculation of the bias and its uncertainty; (2) the experiments somewhat evenly span the entire 

range of all the important parameters, without gaps requiring extrapolation or wide interpolation; 

and (3) the experiments are, preferably, benchmark-quality experiments. The number of critical 

experiments needed is dependent on the statistical method used to analyze the data. For 

example, some methods require a minimum number of data points to reliably determine whether 

the data are normally distributed. Merely having a large number of experiments is not sufficient 

to provide confidence in the validation result, if the experiments are not applicable to the 

application. The reviewer should particularly examine whether consideration of only the most 

applicable experiments would result in a larger negative bias (and thus a lower USL) than that 

determined based on the full set of experiments. The experiments should also ideally be 

sufficiently well-characterized (including experimental parameters and their uncertainties) to be 

considered benchmark experiments. They should be drawn from established sources (such as 

from the International Handbook of Evaluated Criticality Safety Benchmark Experiments 

(IHECSBE), laboratory reports, or peer-reviewed journals). For some applications, benchmark 

quality experiments may not be available; when necessary, critical experiments that do not rise 

to the level of benchmark-quality experiments may be used. However, the reviewer should take 

this into consideration and should evaluate the need for additional margin. 

Some questions that the reviewer may ask in evaluating the number and quality of critical 

experiments as justification for the MMS include: 

 Are the critical experiments chosen all high-quality benchmarks from reliable (e.g., peerreviewed and widely-accepted) sources? 

 Are the critical experiments chosen taken from multiple independent sources, to 

minimize the possibility of systematic errors? 

 Have the experimental uncertainties associated with the critical experiments been 

provided and used in calculating the bias and bias uncertainty? 

 Is the number and distribution of critical experiments sufficient to establish trends in the 

bias across the entire range of parameters? 

 Is the number of critical experiments commensurate with the statistical methodology 

being used? 

Validation Methodological Rigor 

Having a sufficiently rigorous validation methodology means having a methodology that is 

appropriate for the number and distribution of critical experiments, that calculates the bias and 

its uncertainty using an established statistical methodology, that accounts for any trends in the 

bias, and that accounts for all apparent sources of uncertainty in the bias (e.g., the increase in 
June 2015 5-B-10 NUREG-1520, Revision 2 

uncertainty due to extrapolating the bias beyond the range covered by the experimental data.) 

Examples of deficiencies in the criticality code validation methodology may include: (1) using a 

statistical methodology relying on the data being normally distributed about the mean keff to 

analyze data that are not normally distributed; (2) using a linear regression fit on data that has a 

non-linear dependence on a trending parameter; (3) use of a single pooled bias when very 

different types of critical experiments are being evaluated in the same validation study. These 

deficiencies serve to decrease confidence in the validation results and may warrant additional 

margin (i.e., a larger MMS). Additional guidance on some of the more commonly observed 

deficiencies is provided below. The assumption that data is normally distributed is generally 

valid, unless there is a strong trend in the data or different types of critical experiments with 

different mean calculated keff values are being combined. Tests for normality require a minimum 

number of critical experiments to attain a specified confidence level (generally 95%). If there is 

insufficient data to verify that the data are normally distributed, or the data are shown to be not 

normally distributed, a non-parametric technique should be used to analyze the data. 

The critical experiments chosen should ideally provide a continuum of data across the entire 

validated range, so that any variation in the bias as a function of important system parameters 

may be observed. The presence of discrete clusters of experiments having a calculated keff

lower than the set of critical experiments as a whole should be examined closely to determine if 

there is some systematic effect common to a particular type of calculation that makes use of the 

overall bias non-conservative. Because the bias can vary with system parameters, if the 

licensee has combined different subsets of data (e.g., solutions and powders, low- and highenriched, homogeneous and heterogeneous), the bias for the different subsets should be 

analyzed. In addition, the goodness-of-fit for any function used to trend the bias should be 

examined to ensure it is appropriate to the data being analyzed. 

If critical experiments do not cover the entire range of parameters needed to cover anticipated 

applications, it may be necessary to extend the AOA by making use of trends in the bias. Any 

extrapolation (or wide interpolation) of the data should be done by means of an established 

mathematical methodology that takes into account the functional form of both the bias and its 

uncertainty. The extrapolation should not be based on judgement alone, such as by observing 

that the bias is increasing in the extrapolated range, because this may not account for the 

increase in the bias uncertainty that will occur with increasing extrapolation. The reviewer 

should independently confirm that the derived bias is valid in the extrapolated range and should 

ensure that the extrapolation is not large. NUREG/CR-6698 states that critical experiments 

should be added if the data must be extrapolated more than 10%. There is no corresponding 

guidance given for interpolation; however, if the gap represents a significant fraction of the total 

range of the data (e.g., more than 20% of the range of the data), then the reviewer should 

consider this to be a wide interpolation. If the extrapolation or interpolation is too large, new 

factors that could affect the bias may be introduced as the physical phenomena in the system 

change. The reviewer should not view validation as a purely mathematical exercise, but should 

bear in mind the neutron physics and underlying physical phenomena when interpreting the 

results. 

Discarding an unusually large number of critical experiments as outliers (i.e., more than 1-2%) 

should also be viewed with some concern. Apparent outliers should not be discarded based 

purely upon judgement or statistical grounds (such as causing the data to fail tests for 

normality), because they could be providing valuable information on the method’s validity for a 

particular application. The reviewer should verify that there are specific defensible reasons, 

such as reported inconsistencies in the experimental data, for discarding any outliers. If any of 
June 2015 5-B-11 NUREG-1520, Revision 2 

the critical experiments from a particular data set are discarded, the reviewer should examine 

other experiments included to determine whether they may be subject to the same systematic 

errors. Outliers should be examined carefully especially when they have a lower calculated keff

than the other experiments included. 

NUREG-1520 states that the MoS should be large compared to the uncertainty in the bias. The 

observed spread of the data about the mean keff should be examined as an indicator of the 

overall precision of the calculational method. The reviewer should ascertain whether the 

statistical method of validation considers both the observed spread in the data and the 

experimental and calculational uncertainty in determining the USL. The reviewer should also 

evaluate whether the observed spread in the data is consistent with the reported uncertainty 

(e.g., whether χ2/N ~1). If the spread in the data is larger than, or comparable to, the MMS, then 

the reviewer should consider whether additional margin (i.e., a larger MMS) is needed. 

As a final test of the code’s accuracy, the bias should be relatively small (i.e., bias ~2 percent), 

or else the reason for the bias should be determined. No credit should be taken for positive bias, 

because this could result in making changes in a non-conservative direction without having a 

clear understanding of those changes. If the absolute value of the bias is very large–and 

especially if the reason for the large bias cannot be determined–this may indicate that the 

calculational method is not very accurate, and a larger MMS may be appropriate. 

Some questions that the reviewer may ask in evaluating the rigor of the criticality code validation 

methodology as justification for the MMS include: 

 Are the results from use of the methodology consistent with the data (e.g., normally 

distributed)? 

 Is the normality of the data confirmed prior to performing statistical calculations? If the 

data does not pass the tests for normality, is a non-parametric method used? 

 Does the assumed functional form of the bias represent a good fit to the critical 

experiments? Is a goodness-of-fit test performed? 

 Does the method determine a pooled bias across disparate types of critical experiments, 

or does it consider variations in the bias for different types of experiments? Are there 

discrete clusters of experiments for which the bias appears to be non-conservative? 

 Has additional margin been applied to account for extrapolation or wide interpolation? Is 

this done based on an established mathematical methodology? 

 Have critical experiments been discarded as apparent outliers? Is there a valid reason 

for doing so? 

Performing an adequate criticality code validation is not by itself sufficient justification for any 

specific MMS. The reason for this is that the validation analysis determines the bias and its 

uncertainty, but not the MMS. The MMS is added after the validation has been performed to 

provide added assurance of subcriticality. However, having a validation methodology that either 
June 2015 5-B-12 NUREG-1520, Revision 2 

exceeds or falls short of accepted practices for validation may be a basis for either reducing or 

increasing the MMS. 

Statistical Conservatism 

In addition to having conservatism in keff due to modeling practices, licensees may also provide 

conservatism in the statistical methods used to calculate the USL. For example, NUREG/CR6698 states that an acceptable method for calculating the bias is to use the single-sided 

tolerance limit approach with a 95/95 confidence (i.e., 95% confidence that 95% of all future 

critical calculations will lie above the USL). If the licensee decides to use the single-sided 

tolerance limit approach with a 95/99.9 confidence, this would result in a more conservative USL 

than with a 95/95 confidence. This would be true of other methods for which the licensee’s 

confidence criteria exceed the minimum accepted criteria. Generally, the NRC has accepted 

95% confidence levels for criticality code validation results, so using more stringent confidence 

levels may provide conservatism. In addition, there may be other reasons a larger bias and/or 

bias uncertainty than necessary has been used (e.g., because of the inclusion of inapplicable 

critical experiments that have a lower calculated keff). 

The reviewer may credit this conservatism towards having an adequate MoS if: (1) the licensee 

demonstrates that this translates into a specific ∆keff; and (2) the licensee demonstrates that the 

margin will be dependably present, based on license or other commitments. 

(3) Additional Risk-Informed Considerations 

Besides modeling conservatism and the criticality code validation results, other factors may 

provide added assurance of subcriticality. These factors should be considered in evaluating 

whether there is adequate MoS and are discussed below. 

System Sensitivity and Uncertainty 

The sensitivity of keff to changes in system parameters can be used to assess the potential effect 

of errors on the calculation of keff. If the calculated keff is especially sensitive to a given 

parameter, an error in that parameter could have a correspondingly large contribution to the 

bias. Conversely, if keff is very insensitive to a given parameter, then an error may have a 

negligible effect on the bias. This is of particular importance when assessing whether the 

chosen critical experiments are sufficiently similar to applications to justify a small MMS. 

The reviewer should not consider the sensitivity in isolation, but should also consider the 

magnitude of uncertainties in the parameters. If keff is very sensitive to a given parameter, but 

the value of that parameter is known with very high accuracy (and its variations are wellcontrolled), the potential contribution to the bias may still be very small. Thus, the contribution to 

the bias is a function of the product of the the keff sensitivity with the uncertainty. To illustrate 

this, suppose that keff is a function of a large number of variables, x1, x2,..., xN. Then the 

uncertainty in keff may be expressed as follows, if all the individual terms are independent: 

ߜ݇ଶ ൌ ෍൬

߲݇

௜ݔ߲

൰

ଶ

௜ݔߜ

ଶ

ே

௜ୀଵ
June 2015 5-B-13 NUREG-1520, Revision 2 

where the partial derivatives ∂k/∂xi are proportional to the sensitivity and the terms δxi represent 

the uncertainties, or likely variations, in the parameters. (If not all variables are dependent, then 

there may be additional terms.) Each term in this equation then represents the contribution to 

the overall uncertainty in keff. 

There are several tools available to the reviewer to ascertain the sensitivity of keff to changes in 

the underlying parameters. Some of these are listed below: 

1. Analytical tools that calculate the sensitivity for each nuclide-reaction pair present in the 

problem may be used. One example of this is the TSUNAMI code in the SCALE 5 code 

package. TSUNAMI calculates both an integral sensitivity coefficient (i.e., summed over all 

energy groups) and a sensitivity profile as a function of energy group. The reviewer should 

recognize that TSUNAMI only calculates the keff sensitivity to changes in the underlying nuclear 

data, and not to other parameters that could affect the bias and should be considered. (See 

section on Critical Experiment Similarity for caveats about using TSUNAMI.) 

2. Direct sensitivity calculations may be used, in which system parameters are perturbed and 

the resulting impact on keff determined. Perturbation of atomic number densities can also be 

used to confirm the sensitivity calculated by other methods (e.g., TSUNAMI). Such techniques 

are not limited to considering the effect of the nuclear data. 

There are also several sources available to the reviewer to ascertain the uncertainty associated 

with the underlying parameters. For process parameters, these sources of uncertainty may 

include manufacturing tolerances, quality assurance records, and experimental and/or 

measurement results. For nuclear data parameters, these sources of uncertainty may include 

published data, uncertainty data distributed with the cross section libraries, or the covariance 

data used in methods such as TSUNAMI. 

Some systems are inherently more sensitive to changes in the underlying parameters than 

others. For example, high-enriched uranium systems typically exhibit a greater sensitivity to 

changes in system parameters (e.g., mass, moderation) than low-enriched systems. This has 

been the reason that HEU (i.e., >20wt% 235U) facilities have been licensed with larger MMS 

values than LEU (≤10wt% 235U) facilities. This greater sensitivity would also be true of weaponsgrade Pu compared to low-assay mixed oxides (i.e., with a few percent Pu/U). However, it is 

also true that the uncertainties associated with measurement of the 235U cross sections are 

much smaller than those associated with measurement of the 238U cross sections. Both the 

greater sensitivity and smaller uncertainty would need to be considered in evaluating whether a 

larger MMS is needed for high-enriched systems. 

Frequently, operating limits that are more conservative than safety limits determined using keff 

calculations may beestablished to prevent those safety limits from being exceeded. For systems 

in which keff is very sensitive to the system parameters, more margin between the operating and

safety limits may be needed. Systems in which keff is very sensitive to the process parameters

may need both a larger margin between operating and safety limits and a larger MMS. This is

because the system is sensitive to any change, whether it be caused by normal process

variations or caused by unknown errors. Because of this, the assumption is often made that the 

MMS is meant to account for variations in the process or the ability to control the process

parameters. However, the MMS is meant only to allow for unknown (or difficult to quantify)

uncertainties in the calculation of keff. The reviewer should recognize that determination of an
June 2015 5-B-14 NUREG-1520, Revision 2 

appropriate MMS is not dependent on the ability to control process parameters within safety

limits (although both may depend on the system sensitivity).

Some questions that the reviewer may ask in evaluating the system sensitivity as justification for 

the MMS include: 

 How sensitive is keff to changes in the underlying nuclear data (e.g., cross sections)? 

 How sensitive is keff to changes in the geometric form and material composition? 

 Are the uncertainties associated with these underlying parameters well-known? 

 How does the MMS compare to the expected magnitude of changes in keff resulting from 

uncertainties in these underlying parameters? 

Knowledge of the Neutron Physics 

Another important consideration that may affect the appropriate MMS is the extent to which the 

physical behavior of the system is known. Fissile systems which are known to be subcritical with 

a high degree of confidence do not require as much MMS as systems where subcriticality is less 

certain. An example of a system known to be subcritical with high confidence is a light-water 

reactor fuel assembly. The design of these systems is such that they can only be made critical 

when highly thermalized. Due to extensive analysis and reactor experience, the flooded isolated 

assembly is known to be subcritical. In addition, the thermal neutron cross sections for materials 

in finished reactor fuel have been measured with a very high degree of accuracy (as opposed to 

cross sections in the resonance region). Other examples of systems in which there is 

independent corroborating evidence of subcriticality may include systems consisting of very 

simple geometric shapes, or other idealized situations, in which there is strong evidence that the 

system is subcritical based on comparison with highly similar systems in published sources 

(e.g., standards and handbooks). In these cases, the MMS may be significantly reduced due to 

the fact that the calculation of keff is not relied on alone to provide assurance of subcriticality. 

Reliance on independent knowledge that a given system is subcritical necessarily requires that 

the configuration of the system be fixed. If the configuration can change from the reference 

case, there will be less knowledge about the behavior of the changed system. For example, a 

finished fuel assembly is subject to strict quality assurance checks and would not reach final 

processing if it were outside specifications. In addition, it has a form that has both been 

extensively studied and is highly stable. For these reasons, there is a great deal of certainty that 

this system is well-characterized and is not subject to change. A typical solution or powder 

system (other than one with a simple geometric arrangement) would not have been studied with 

the same level of rigor as a finished fuel assembly. Even if they were studied with the same 

level of rigor, these systems have forms that are subject to change into forms whose neutron 

physics has not been as extensively studied. 

Some questions that the reviewer may ask in evaluating the knowledge of the neutron physics 

as justification for the MMS include: 
June 2015 5-B-15 NUREG-1520, Revision 2 

 Is the geometric form and material composition of the system fixed and very unlikely to 

change? 

 Is the geometric form and material composition of the system subject to strict quality 

assurance, such that tolerances have been bounded? 

 Has the system been extensively studied in the nuclear industry and shown to be 

subcritical (e.g., in reactor fuel studies)? 

 Are there other reasons besides criticality calculations to conclude that the system will 

be subcritical (e.g., handbooks, standards, published data)? 

 How well-known is the nuclear data (e.g., cross sections) in the energy range of 

interest? 

Likelihood of the Abnormal Condition 

Some facilities have been licensed with different sets of keff limits for normal and abnormal 

conditions. Separate keff limits for normal and abnormal conditions are permissible, but are not 

required. There is some low likelihood that processes calculated to be subcritical will, in fact, be 

critical, and this likelihood increases as the MMS is reduced (though it cannot in general be 

quantified). NUREG-1718, “Standard Review Plan for the Review of an Application for a Mixed 

Oxide (MOX) Fuel Fabrication Facility,” states that abnormal conditions should be at least 

unlikely from the standpoint of the double contingency principle. Then, a somewhat higher 

likelihood that a system calculated to be subcritical is, in fact, critical is more permissible for 

abnormal conditions than for normal conditions, because of the low likelihood of the abnormal 

condition being realized. The reviewer should verify that the licensee has defined abnormal 

conditions such that achieving the abnormal condition requires at least one contingency to have 

occurred, that the system will be closely monitored so that it is promptly detected, and that it will 

be promptly corrected upon detection. Also, there is generally more conservatism present in the 

abnormal case, because the parameters that are assumed to have failed are analyzed at their 

worst-case credible condition. 

The increased risk associated with having a smaller MMS for abnormal conditions should be 

commensurate with, and offset by, the low likelihood of achieving the abnormal condition. That 

is, if the normal case keff limit is judged to be acceptable, then the abnormal case limit will also 

be acceptable, provided the increased likelihood (that a system calculated to be subcritical will 

be critical) is offset by the reduced likelihood of realizing the abnormal condition because of the 

controls that have been established. Note that if two or more contingencies must occur to reach 

a given condition, there is no requirement to ensure that the resulting condition is subcritical. If a 

single keff limit is used (i.e., no credit for unlikelihood of the abnormal condition), then the limit 

must be found acceptable to cover both normal and credible abnormal conditions. The reviewer 

should always make this finding considering specific conditions and controls in the process(es) 

being evaluated. 

 
June 2015 5-B-16 NUREG-1520, Revision 2 

(4) Statistical Justification for the MMS 

The NRC does not consider statistical justification an appropriate basis for a specific MMS. 

Previously, some licensees have attempted to justify specific MMS values based on a 

comparison of two statistical methods. For example, the USLSTATS code issued with the 

SCALE code package contains two methods for calculating the USL: (1) the Confidence Band 

with Administrative Margin approach (calculating USL-1), and (2) the Lower Tolerance Band 

approach (calculating USL-2). The value of the MMS is an input parameter to the Confidence 

Band approach, but is not included explicitly in the Lower Tolerance Band approach. In this 

particular justification, adequacy of the MMS is based on a comparison of USL-1 and USL-2 

(i.e., the condition that USL-1, including the chosen MMS, is less than USL-2). However, the 

reviewer should not accept this justification. 

The condition that USL-1 (with the chosen MMS) is less than USL-2 is necessary, but is not 

sufficient, to show that an adequate MMS has been used. These methods are both statistical 

methods, and a comparison can only demonstrate whether the MMS is sufficient to bound any 

statistical uncertainties included in the Lower Tolerance Band approach but not included in the 

Confidence Band approach. There may be other statistical or systematic errors in calculating keff 

that are not included in either statistical treatment. Because of this, an MMS value should be 

specified regardless of the statistical method used. Therefore, the reviewer should not consider 

such a statistical approach an acceptable justification for any specific value of the MMS. 

(5) Summary 

Based on a review of the licensee’s justification for its chosen MMS, taking into consideration 

the aforementioned factors, the staff should make a determination as to whether the chosen 

MMS provides reasonable assurance of subcriticality under normal and credible abnormal 

conditions. The staff’s review should be risk-informed, in that the review should be 

commensurate with the MoS and should consider the specific facility and process 

characteristics, as well as the specific modeling practices used. As an example, approving an 

MMS value greater than 0.05 for processes typically encountered in enrichment and fuel 

fabrication facilities should require only a cursory review, provided that an acceptable criticality 

code validation has been performed and modeling practices at least as conservative as those in 

NUREG-1520 have been utilized. The approval of a smaller MMS will require a somewhat more 

detailed review, commensurate with the MMS that is requested. However, the MMS should not 

be reduced below 0.02 due to inherent uncertainties in the cross section data and the 

magnitude of code errors that have been discovered. Quantitative arguments (such as modeling 

conservatism) should be used to the extent practical. However, in many instances, the reviewer 

will need to make a judgement based at least partly on qualitative arguments. The staff should 

document the basis for finding the chosen MMS value to be acceptable or unacceptable in the 

Safety Evaluation Report (SER), and should ensure that any factors upon which this 

determination rests are ensured to be present over the facility lifetime (e.g., through license 

commitment or condition). 

 
June 2015 5-B-17 NUREG-1520, Revision 2 

Technical Review Guidance 

Determination of an adequate MMS is strongly dependent upon specific processes, conditions, 

and calculational practices at the facility being licensed. Judgement and experience must be 

employed in evaluating the adequacy of the proposed MMS. In the past, an MMS of 0.05 has 

generally been found acceptable for most typical low-enriched fuel cycle facilities without a 

detailed technical justification. A smaller MMS may be acceptable but will require some level of 

technical review.2

 However, for reasons stated previously, the MMS should not be reduced 

below 0.02. 

An MMS of 0.05 should be found acceptable for low-enriched fuel cycle processes and facilities 

if: 

1. A criticality code validation study has been performed that meets accepted industry 

guidelines (e.g., meets the requirements of ANSI/ANS-8.24, NUREG/CR-6361, and/or 

NUREG/CR-6698). 

2. There is an acceptable number of critical experiments with similar geometric forms, 

material compositions, and neutron energy spectra to applications. These experiments 

cover the range of parameters of applications, or else margin is provided to account for 

extensions to the AOA. 

3. The processes to be evaluated include materials and process conditions similar to those 

that occur in low-enriched fuel cycle applications (i.e., no new fissile materials, unusual 

moderators or absorbers, or technologies new to the industry that can affect the types of 

systems to be modeled). 

The reviewer should consider any factors, including those enumerated in the discussion above, 

that could result in applying additional margin (i.e., a larger MMS) or may justify reducing the 

MMS. The reviewer must then exercise judgement in arriving at an MMS that provides for 

adequate assurance of subcriticality. 

Some of the factors that may serve to justify reducing the MMS include: 

1. There is a predictable and dependable amount of conservatism in modeling practices, in 

terms of keff, that is assured to be maintained (in both normal and abnormal conditions) 

over the facility lifetime. 

2. Critical experiments have nearly identical geometric forms, material compositions, and 

neutron energy spectra to applications, and the criticality code validation is specific to 

this type of application. 

 

2

 For high-enriched and plutonium or other fuel cycle facilities, no general guidance on the appropriate MMS is 

given. The reviewer should consider any relevant differences between these facilities and low-enriched uranium 

facilities (e.g., generally increased sensitivity of keff, generally reduced cross section uncertainty) on a case-by-case 

basis. 
June 2015 5-B-18 NUREG-1520, Revision 2 

3. The criticality code validation methodology substantially exceeds accepted industry 

guidelines (e.g., it uses a very conservative statistical approach, considers an unusually 

large number of trending parameters, or analyzes the bias for a large number of 

subgroups of critical experiments). 

4. The system keff is demonstrably much less sensitive to uncertainties in cross sections or 

variations in other system parameters than typical low-enriched fuel cycle processes. 

5. There is reliable information besides results of calculations that provides assurance that 

the evaluated applications will be subcritical (e.g., experimental data, historical evidence, 

industry standards or widely-accepted handbooks). 

6. The MMS is only applied to abnormal conditions, which are at least unlikely to be 

achieved, based on credited controls. 

Some of the factors that may necessitate increasing (or not approving) the MMS include: 

1. The technical practices employed by the licensee are less conservative than standard 

industry modeling practices (e.g., do not adequately bound reflection or the full range of 

credible moderation, do not take geometric tolerances into account). 

2. There are few similar critical experiments of benchmark quality that cover the range of 

parameters of applications. 

3. The criticality code validation methodology substantially falls below accepted industry 

guidelines (e.g., it uses less than a 95% confidence in the statistical approach, fails to 

consider trends in the bias, fails to account for extensions to the AOA). 

4. The criticality code validation results otherwise tend to cast doubt on the accuracy of the 

bias and its uncertainty (i.e., the critical experiments are not normally distributed, there is 

a large number of outliers discarded (≳2%), there are distinct subgroups of experiments 

with lower keff than the experiments as a whole, trending fits do not pass goodness-of-fit 

tests, etc.). 

5. The system keff is demonstrably much more sensitive to uncertainties in cross sections or 

other system parameters than typical low-enriched fuel cycle processes. 

6. There is reliable information that casts doubt on the results of the calculational method 

or the subcriticality of evaluated applications (e.g., experimental data, reported concerns 

with the nuclear data). 

The purpose of asking the questions in the individual discussion sections is to ascertain the 

degree to which these factors either provide justification for reducing the MMS or necessitate 

increasing the MMS. These lists are not all-inclusive, and any other technical information that 

demonstrates the degree of confidence in the calculational method should be considered. 
June 2015 5-BB-1 NUREG-1520, Revision 2 

ANNEX TO APPENDIX B 

ANSI/ANS-8.17 CALCULATION OF MAXIMUM keff

American National Standards Institute (ANSI)/American Nuclear Society (ANS)-8.17-2004, 

“Criticality Safety Criteria for the Handling, Storage, and Transportation of LWR Fuel Outside 

Reactors,” contains a detailed discussion of the various factors that should be considered in 

setting keff limits. This is consistent with, but more detailed than, the discussion in ANSI/ANS8.1-1998 and ANSI/ANS-8.24-2007. 

The subcriticality criterion from Section 5.1 of ANSI/ANS-8.17-2004 is: 

݇௦ ൑ ݇௖ െ ∆݇௦ െ ∆݇௖ െ ∆݇௠

where ks is the calculated keff corresponding to the application, ∆ks is its uncertainty, kc is the 

mean keff resulting from the calculation of critical experiments, ∆kc is its uncertainty, and ∆km is 

the MMS. The types of uncertainties included in each of these “delta” terms is provided, and 

includes the following: 

∆ks = (1) statistical uncertainties in computing ks; (2) convergence uncertainties in computing ks, 

(3) material tolerances; (4) fabrication tolerances; (5) uncertainties due to limitations in the 

geometric representation used in the method; and (6) uncertainties due to limitations in the 

material representations used in the method. 

∆kc = (7) uncertainties in the critical experiments; (8) statistical uncertainties in computing kc; (9) 

convergence uncertainties in computing kc; (10) uncertainties due to extrapolating kc outside the 

range of experimental data; (11) uncertainties due to limitations in the geometric representations 

used in the method; and (12) uncertainties due to limitations in the material representations 

used in the method. 

∆km = an allowance for any additional uncertainties (MMS). 

To the extent that not all 12 sources of uncertainty listed above have been explicitly taken into 

account, they may be allowed for by increasing the value of ∆km. The more of these sources of 

uncertainty that have been taken into account, the smaller the necessary additional margin ∆km. 

As a general principle, however, the MMS should be large compared to known uncertainties in 

the nuclear data and limitations of the methodology. However, a value of the MMS below 0.02 

should not be used. 

Frequently, the terms in the above equation relating to the application are grouped on the lefthand side of the equation, so that the equation is rewritten as follows: 

݇௦ ൅ ∆݇௦ ൑ ݇௖ െ ∆݇௖ െ ∆݇௠

where the terms on the right-hand side of the equation are often lumped together and termed 

the Upper Subcritical Limit (USL), so that the USL = kc - ∆kc - ∆km. 

 
June 2015 5-BB-2 NUREG-1520, Revision 2 

Relation to the Minimum Subcritical Margin (MMS) 

The MoS has been defined as the difference between the actual value of keff and the value of keff 

at which the system is expected to be critical. The expected (best estimate) critical value of keff is 

the mean keff value of all critical experiments analyzed (i.e., kc), including consideration of the 

uncertainty in the bias (i.e., ∆kc). The calculated value of keff for an application generally exceeds 

the actual (physical) keff value due to conservative assumptions in modeling the system. In terms 

of the above USL equation, the MoS may be expressed mathematically as: 

݋ܯܵ ൌ ݇௖ െ ∆݇௖ െ ሺ݇௦ െ ∆݇௦௔ሻ െ ∆݇௦

where the term in parentheses is equal to the actual (physical) keff of the application, ksa. A term, 

∆ksa, has been added to represent the difference between the actual and calculated value of keff 

for the application (i.e., ∆ksa = change in keff resulting from modeling conservatism). In terms of 

the USL: 

݋ܯܵ ൌ ܷܵܮ∆ ൅ ݇ ௠െ ݇௦ ൅ ∆݇௦௔ െ ∆݇௦

The minimum allowed value of the MoS is reached when the calculated keff for the application, ks 

+ ∆ks, is equal to the USL. When this occurs, the minimum value of the MoS is: 

௔௦݇௠ ൅ ∆݇ ൒ ∆ܵ݋ܯ

Thus, adequate margin (MoS) may be assured either by conservatism in modeling practices or 

in the explicit specification of ∆km (MMS). This is discussed in the appendix section on modeling 

conservatism. 
June 2015 5-C-1 NUREG-1520, Revision 2 

APPENDIX C 

EXAMPLE PROCEDURE FOR SUBCRITICALITY EVALUATION 

Purpose 

This appendix provides the U.S. Nuclear Regulatory Commission (NRC) reviewer with an 

example of one method for licensees to perform an integrated safety analysis (ISA) for a nuclear 

process that meets the requirements of Title 10, “Energy,” of the Code of Federal Regulations

(10 CFR) 70.61, “Performance Requirements,” for criticality safety hazards. The purpose of this 

appendix is to provide an example of an acceptable method to perform this evaluation of 

subcriticality. It employs a conservative, deterministic method for demonstrating that a process 

will be subcritical under normal and credible abnormal conditions. This example is an 

illustration of the use of the criticality hazard evaluation method discussed in Appendix 5-A to 

this SRP. This method is applicable only to criticality safety, whereas other hazards at facilities, 

such as chemical hazards, may be evaluated in accordance with the risk-index method of 

Appendix A to Chapter 3 of this SRP. 

Introduction 

The appendix presents an example of how the deterministic method can be applied to a 

uranium solvent-extraction process. It describes one method of evaluating compliance with the 

subcriticality requirement of 10 CFR 70.61(d) and discusses the 10 CFR 70.64(a)(9) 

baseline-design criterion, under which the designs of new facilities, and the design of new 

processes at existing facilities, must provide for 6criticality control by adherence to the 

double-contingency principle. In this regard, the method described here of evaluating 

compliance with these requirements is intended to show how subcriticality may be 

demonstrated in accordance with use of the double-contingency principle. This method should 

not be interpreted as a requirement that the applicant use any particular methodology to meet 

the regulatory requirements. Note that most existing fuel facilities have committed to follow the 

double-contingency principle as the historically preferred means of ensuring subcriticality under 

normal and credible abnormal conditions. 

This appendix is not a “format and content guide” for either the criticality safety evaluation (CSE) 

or the ISA summary. It simply presents one method of analysis of credible abnormal conditions 

leading to criticality. If the applicant evaluates normal and abnormal conditions using a different 

method, the method should produce similar results in terms of conditions identified. However, 

once the upset conditions are identified, the applicant has choices as to (a) which of the various 

parameters (as listed in Section 5.4.3.1.7.3) are most advantageous to control, (b) the means of 

controlling those parameters and (c) to what values to control those parameters. Therefore, the 

specific controls and limits associated with a similar solvent-extraction process may differ 

significantly from those provided in this example. The example should be regarded as 

illustrative of the method, and not as a definitive statement of the adequacy of a particular set of 

controls for a similar solvent-extraction operation. 

Process Description 

Solvent-extraction processes are frequently used in uranium recovery operations to recover 

purified uranyl nitrate for fuel-fabrication purposes. The main process control used in this 

example is geometry control, normally by means of favorable geometry process equipment. 

The process for this example is pictured below. 
June 2015 5-C-2 NUREG-1520, Revision 2 

A single-pass solvent-extraction process typically consists of a set of three favorable geometry 

column: an extraction column, a scrubbing column, and a stripping column. Uranium is 

dissolved (e.g., in tray dissolvers) with nitric acid (HNO3) and piped into the extraction process, 

in which it is mixed with an organic and diluent mixture (such as tributyl phosphate (TBP) and 

kerosene) to separate any impurities from the uranium. This process does not exist in isolation, 

but rather is connected to both upstream and downstream processes, utilities, and waste 

processes. These include: 

Connected processes: Utilities: Waste processes:

 Tray dissolution 

 Wet conversion 

 Electrical power

 Process water 

 Nitric acid supply 

 Chemical makeup 

 Organic conditioning 

 Raffinate storage

 Wastewater storage 

NOTE: This list is not meant to be exhaustive, and neither is the list of upset conditions or 

controls; it is merely illustrative of the approach. 

Criticality Safety Hazard Identification 

As the first step in performing an ISA for the solvent-extraction process described above, an 

applicant typically determines the extent of the system to be analyzed. As stated above, the 

process does not exist in isolation, but interacts with connected processes through the flow of 

matter and energy, and possibly through neutron interaction, between adjacent systems. The 

part of the process to be covered by the CSE is pictured above, and consists of a set of three 

columns, the connected piping, and the surrounding room. The floor of the room is sloped and 

drains to a favorable geometry collection tank. The process is neutronically isolated from other 

processes by thick concrete walls. 

Next, an applicant typically considers the initial process design and identifies an initial set of 

controlled parameters and criticality controls. This is only the initial set of controls because, in 

general, the performance of the CSE is an iterative process. The columns individually have 

diameters less than the subcritical diameter limits in ANSI/ANS-8.1, so they are considered to 

have favorable geometry. However, the entire system should be shown to be subcritical and so 

the columns cannot be considered only in isolation, because of the possibility of neutron 

interaction. An applicant would therefore construct a normal condition of the three columns 

together with the floor and walls. Under normal conditions, the material in the columns consists 

of uranyl nitrate solution (consisting of uranyl nitrate, water, and nitric acid) at various 

concentrations, TBP, and kerosene, in various proportions. The applicant may choose to model 

Drain to 

safe 

geometry

Level 

sensor

Extractio

n
June 2015 5-C-3 NUREG-1520, Revision 2 

the fissionable material without consideration for the TBP and kerosene, based on a sensitivity 

study showing that a pure uranyl nitrate solution is the most reactive. The applicant may then 

perform another sensitivity study to determine the optimal concentration of the uranyl nitrate 

solution (~1100 gU/l (grams of uranium per liter) for low-enriched solution and ~500 gU/l for high 

enriched solution). 

Having decided on the fissionable material involved, the applicant may then make several 

choices about how to model the geometric configuration of the system. Initially, the applicant 

may model the three columns with solution to the outer diameter, taking tolerances in diameter 

and spacing between columns into account. The columns may also be modeled as infinitely 

long columns resting on a concrete floor 60 cm thick, 12 inches away from concrete walls that 

are 30 cm thick. The model will also necessarily make certain simplifying assumptions, such as 

ignoring small-diameter piping, flanges on the columns, the roughness of the concrete walls, 

etc. Small piping in particular is typically ignored, based on an analyst’s professional judgment 

and experience and the fact that the piping is less than 1⁄2 inch in diameter and runs at right 

angles to the axis of each column, so neutron interaction is negligible. The applicant may 

perform a sensitivity analysis for interstitial moderation and determine that a 50% water density 

is the most reactive. The applicant may perform a calculation using this model and determine 

that it cannot meet the keff limit submitted in its license application. 

An applicant may choose to construct the most conservative model it can, which generally 

minimizes the number of process characteristics that need to be controlled as well as the 

number of IROFS. In this example, however, it is assumed that the applicant is unable to 

demonstrate subcriticality for the system as originally envisioned. The applicant now has 

several choices, such as taking credit for the borosilicate glass in the columns, taking credit for 

concentration or excess acid in the solution, taking credit for the distance of the column from the 

floor, etc. In this example, it is supposed that the applicant then decides to shorten the column, 

raise the column off the floor, and model the solution to the inner diameter which maintaining an 

optimal material composition (modeling the void between the inner and outer diameter). It is 

then supposed that the resulting model is indeed subcritical. 

An applicant then generally determines what parameters need to be controlled and what the 

controls on those parameters should be, to ensure subcritical for the normal condition. One 

common way to do this is to go through the list of controlled parameters, as in the following list 

(for illustrative purposes): 

Concentration and density: not controlled, because the columns have been demonstrated to be 

subcritical with an optimal mixture. 

Mass and volume: not controlled, because the columns have sufficient mass and volume to 

attain criticality (if geometry control is lost). 

Enrichment: if solution is high-enriched, enrichment is not controlled; if solution is low-enriched, 

it might technically be being controlled, but if the maximum facility enrichment is used, this will 

be a global limit and there might be no credible way of exceeding it (especially in a 

non-enrichment facility). It is therefore generally unnecessary for an applicant to identify 

enrichment as a separate contingency in a non-enrichment facility. 

Geometry: several of the dimensions included in the model are evaluated for whether they 

should be turned into geometry controls. The most crucial of these is the inner diameter of the 

column, which is controlled by specifying a maximum outer diameter and minimum thickness. 

The length of the columns, while shortened in the model, is such that their height-to-diameter 
June 2015 5-C-4 NUREG-1520, Revision 2 

(H/D) ratio is ~15, and therefore effectively infinite (keff being insensitive to the actual length). 

Thus, it is not necessary in this example to designate the column height as a control. 

Interaction: the spacing between columns, the distance between the columns and the floor, and 

the distance of the columns from the concrete walls are all used in the normal-condition model 

and therefore are potentially interaction controls. The most significant of these is spacing 

between the columns, which is identified as a criticality control. By professional judgment, the 

applicant may consider the distance of the columns from the walls to be the more significant, 

and the distance from the floor to most likely be insignificant. The applicant could choose to 

make these all criticality controls, but instead it is supposed that the applicant performs a 

sensitivity analysis showing that there is a minimum distance from the walls necessary for 

subcriticality, but that the columns are subcritical even when resting on the floor. Therefore, the 

spacing between columns and distance of the columns from the walls are designated as 

criticality controls in this example. 

Reflection: not controlled. Rather than model each column with a one-inch tight-fitting water 

reflector, the applicant chooses to model the entire space surrounding the columns with varying 

densities of water, from a void to fully flooded conditions. Assuming the flooded condition is 

subcritical, it is not necessary to control water reflection. The concrete walls also provide some 

reflection. The floor thickness is not significant because keff has been shown to be insensitive to 

the columns’ distance from the floor and 60-cm of concrete provides full reflection. The wall 

thickness is not significant based on the sensitivity analysis for interaction. 

Moderation: not controlled. The applicant models the solution as an optimal mixture, and the 

columns are subcritical with optimal interstitial moderation. 

Absorber: not controlled, because the applicant is presumed to have demonstrated 

subcriticality without taking credit for the material composition of the glass columns. If the 

applicant had explicitly modeled the glass, it would then have had to determine whether the 

glass should be a neutron-absorber control. Not making the glass a neutron-absorber control 

could be justified based on whether a sensitivity analysis demonstrated that none of the glass is 

needed for subcriticality. If only half the glass were needed, the applicant would then have to 

either make the glass an absorber control or decide whether it is credible that the composition 

could be reduced by such a large proportion. 

Heterogeneity: not controlled, if the solution is highly enriched. If the solution is low-enriched, 

consideration would be given to flocculation and precipitation. Precipitation in this example is 

not a concern, because it will only result in achieving a less-reactive under-moderated condition. 

Suspended flocculates could result in a modest increase in reactivity, but the applicant 

determined that the margin of safety resulting from use of a higher-than-normal concentration 

and neglecting free acid is sufficient to account for any uncertainty caused by the homogeneity 

of the fissile mixture. 

Physicochemical form: While the solution as modeled is presumed to have the most reactive 

composition for a uranyl nitrate solution, a change to a more reactive form needs to be 

considered. The applicant is presumed to have determined that a UO2-water mixture is the 

most reactive physicochemical form that could exist in the columns (there being no credible way 

to form a metal-water mixture). Process deviations resulting from incomplete dissolution could 

lead to such a condition. In this example, the applicant therefore identified two upstream filters 

between the dissolution and extraction processes as criticality controls. No chemical reagents 

resulting in a more reactive form are presumed to have been identified. 
June 2015 5-C-5 NUREG-1520, Revision 2 

Process variables: These mainly control the efficiency of the extraction process. Incomplete 

extraction could lead to the presence of concentrated uranium in the raffinate stream. Process 

variables that can affect extraction efficiency include temperature, acidity (pH), flow rate of TBP, 

power output of the pulsing pump, etc. For simplicity, because there is a downstream sodium 

iodide detector between the favorable geometry raffinate columns and wastewater tanks, it is 

assumed there are no additional process variable controls are needed. 

Based on the above consideration of parameters associated with the normal-condition model, 

the applicant is presumed to have identified the following controlled parameters: geometry, 

interaction, and physicochemical form (and possibly enrichment). Not controlling other 

parameters is justified in the CSE. Based on the normal-condition model, the following criticality 

controls could be identified: 

GEOMETRY: INTERACTION: PHYSICOCHEMICAL FORM:

 Outer column diameter

 Column wall thickness 

 Column spacing

 Distance between 

columns and walls 

 Upstream dual filters

NOTE: This list of controls is for illustrative purposes only and should not be considered an 

exhaustive list. 

Criticality Safety Hazard Evaluation 

The applicant must also demonstrate subcriticality under credible abnormal conditions. Once 

the initial suite of criticality controls is determined, an applicant should have demonstrated that 

all foreseeable ways they could fail so as to result in criticality have been considered. The 

following contingencies were identified. Again, this is an illustrative and not an exhaustive list. 

(Other scenarios 1

 have already been discussed and dismissed above, such as precipitation, 

and are not considered further below.) 

GEOMETRY 

GEO-01: A column or pipe leaks, ruptures, corrodes, or overflows onto the floor

GEO-02: A column leaks into the recirculation pumps 

GEO-03: A column bulges beyond a safe diameter

GEO-04: A column overflows to unfavorable supply tanks

GEO-05: A transfer of solution to raffinate columns and unfavorable wastewater tanks

INTERACTION 

INT-01: A seismic event reduces spacing between columns or between columns and walls 

INT-02: A container bearing fissile material is placed adjacent to a column

 

1

 The term “scenario” is deliberately chosen, to distinguish the concept here from the idea of identifying an “accident 

sequence.” A “scenario” is a hypothetical event that could result in a change in process conditions (i.e., a 

“contingency”); a “sequence” is a string of events that eventually can result in an accident. The former is focused 

on the conditions achieved, while the latter is focused on how such conditions may be achieved. 
June 2015 5-C-6 NUREG-1520, Revision 2 

PHYSICOCHEMICAL FORM 

PC-01: Incomplete upstream dissolution of scrap material 

ENRICHMENT 

[No identified scenarios that can credibly lead to criticality] 

Each of these possible scenarios would typically be considered in turn, and the conditions 

resulting therefrom shown to be subcritical, in accordance with the double-contingency principle. 

(An alternate but equally permissible approach is to combine some or all of these abnormal 

conditions into a single conservative model, which is then shown to be subcritical. As in the 

selection of how detailed a model to construct, the tradeoff is between analytic simplicity and 

safety margin.) The following table provides the results of an example evaluation and several 

additional controls that could be identified during this iterative process. Some of these controls 

(e.g., siphon breaks) may result in a design change, whereas others (e.g., floor drains) may 

result in existing features now being credited as controls. 

Double-Contingency Discussion Associated Criticality Controls 

GEOMETRY Scenarios

Normal-condition controls: Configuration (dimensions, spacing, and arrangement) of 

process equipment as modeled ensures subcriticality under normal conditions. Specific 

geometry attributes are the column outer diameter and wall thickness. 

GE0-01: Column or pipe leaks, ruptures, corrodes, or overflows onto the floor 

If the column’s ability to contain fissile 

material within safe dimensions is 

compromised, solution will drain to the 

floor. The floor is sized in such a way that 

the full volume of any single column and 

all associated piping will accumulate to 

less than a safe depth. The floor is sloped 

and drains to a favorable geometry 

collection tank. In addition, a level sensor 

will alarm and alert operators that the 

solution level is unacceptably low; the 

operators are required to stop the process. 

1st

 Control: Outer diameter and wall 

thickness of the columns. 

2nd Control: Area and slope of the floor, 

diameter of the drain and collection tank. 

Defense-in-Depth (DID): Level sensors 

with alarms 
June 2015 5-C-7 NUREG-1520, Revision 2 

Double-Contingency Discussion Associated Criticality Controls 

GEO-02: Column leaks into recirculation pumps

In the event a favorable geometry column 

leaks, solution may enter the recirculation 

pumps. These pumps have been 

evaluated to be subcritical when filled with 

optimally moderated solution. 

1st Control: Outer diameter and wall 

thickness of the columns. 

2nd Control: Oil reservoir of pumps is safe 

volume, pumps are separated by 

18 inches center-to-center. 

Additional Safety Margin (SM): Pump 

internals displace some of the pump 

volume. 

GEO-03: Column bulges beyond a safe diameter 

Based on sensitivity analysis, there is no 

credible way that a column will bulge 

sufficiently to exceed the keff limit. 

Columns are hydrostatically tested to 

ensure they will not bulge to beyond the 

subcritical diameter. There are also no 

credible ways of pressurizing a column 

because the columns are vented.

1st Control: Outer diameter of the column; 

column composed of stainless steel of 

specified minimum thickness; verified by 

hydrostatic testing. 

2nd Control: Columns are vented; vents 

consist of 1-inch diameter transparent 

tubing. 

DID: Operators are frequently if not 

continuously present in the area, and 

would notice conditions leading to column 

bulging within one shift. Braces and other 

supports credited for seismic events also 

would protect against column bulging. 

GEO-04: Column overflows to unfavorable supply tanks 

As stated for Scenario GEO-03, no 

credible means of pressurizing a column 

have been identified. In addition, a siphon 

break has been installed on each column. 

Control: Siphon breaks on all columns. 

GEO-05: Transfer to raffinate columns and unfavorable wastewater tanks
June 2015 5-C-8 NUREG-1520, Revision 2 

Double-Contingency Discussion Associated Criticality Controls 

The chemistry of the extraction process 

primarily protects against getting 

concentrated uranium in the raffinate 

storage columns. Dual independent 

samples are taken on the storage columns 

before authorization is granted to transfer 

their contents to unfavorable geometry 

wastewater treatment tanks. In the event, 

concentrated solution is inadvertently 

transferred, an active interlock making use 

of a sodium iodide detector will close 

valves on the transfer line and trip the 

transfer pump before an unsafe mass can 

be transferred. 

1st Control: Dual independent sampling of 

raffinate storage columns before transfer 

may be granted. 

2nd Control: In-line sodium iodide detector 

shuts the isolation valves and trips the 

transfer pump. 

DID: Chemistry of the extraction process 

is closely monitored (temperature, pH, 

TBP proportion, etc.). Operators trained to 

notice yellow liquid in raffinate storage 

columns. 
June 2015 5-C-9 NUREG-1520, Revision 2 

Double-Contingency Discussion Associated Criticality Controls 

INTERACTION Scenarios 

Normal-condition controls: Configuration of process equipment as modeled ensures 

subcriticality under normal conditions. Specific interaction attributes are the spacing 

between columns and distance between the columns and walls. 

INT-01: Seismic event reduces spacing between columns or between columns 

and walls

The building is designed in accordance 

with the Uniform Building Code in effect at 

the time of its construction, so as to 

withstand a design-basis earthquake. The 

supports are reinforced and a structural 

analysis shows that they will withstand 

greater than a 100-year earthquake. In 

addition, if the column supports fail, it 

would require more than two columns to 

come to rest against each other along their 

entire length, or more than one such 

column to rest flat against the wall. It is far 

more likely that an energetic seismic event 

would cause the columns to be randomly 

arranged. In addition, moving the columns 

more than 18 inches would almost 

certainly cause the piping to break, and 

the solution would therefore likely drain to 

the floor, as analyzed in GEO-01 above. 

Sub-scenario INT-01a: Supports fail but 

columns remain intact. 

External Event (EE)): A seismic event 

capable of causing structural supports of 

the columns to fail is judged to be at least 

unlikely (as used in the Double 

Contingency Principle). 

1st Control: Design of column supports to 

withstand specified load is credited in IC 

likelihood. 

Natural and Credible Course of Events 

(NCCE): It is at least unlikely for columns 

to come to rest in such a way as to exceed 

the keff limit. 

Sub-scenario INT-01b: Supports fail and 

columns or piping leak to the floor. 

Upon further evaluation, this scenario is 

bounded by GEO-01 (so same controls 

apply). 

NCCE: Displacement of columns by 

18 inches or more would almost certainly 

result in failure of the piping and column 

connections, leading to a leak. 

INT-02: Container bearing fissile material placed adjacent to a column
June 2015 5-C-10 NUREG-1520, Revision 2 

Double-Contingency Discussion Associated Criticality Controls 

Calculations show that a geometrically 

controlled 5-gallon mop bucket, vacuum 

cleaner, etc., placed next to a column can 

exceed the keff limit (if placed on the 

midline between two columns, or between 

a column and the wall). (Containers with 

volumes larger than 5 gallons are 

prohibited in the solution area unless 

specifically evaluated to be subcritical). 

Administrative controls prohibit the 

introduction of solution-bearing equipment 

closer than 12 inches to the columns. 

There is no reason for an operator to raise 

such a necessarily heavy container off the 

floor, and it is unlikely (because of the 

location of flanges, small-diameter piping, 

etc.) that such a container would be placed 

against a column. However, a design 

change is being made so that a mesh 

barrier will be affixed to prevent placing 

such a container between the columns or 

between a column and the wall. 

1st Control: Operators are prohibited from 

placing solution-bearing equipment closer 

than 12 inches to the extraction columns. 

2nd Control: Mesh barrier affixed to the 

columns to prevent placing a container 

between the columns or between a column 

and the wall. 

3rd Control: Containers larger than 

5 gallons are prohibited in solution areas. 

DID: Location of flanges, piping, etc., is 

such that it is very impractical to place a 

container against the columns. Columns 

are raised 12 inches above the floor, so 

the scenario would require manually lifting 

a container weighing a minimum of 40 lb 

(5 gallons of pure water) off the floor. 

PHYSICOCHEMICAL Scenarios 

Normal-condition controls: The nature of the process. 

PC-01: Incomplete upstream dissolution of scrap material

The failure to use sufficient nitric acid, 

achieve the right temperature, properly 

agitate the scrap-acid mixture, or wait the 

required time period could result in 

incomplete dissolution, which can result in 

piping a heterogeneous UO2-water mixture 

into the extraction columns. 

Double-contingency protection is provided 

by dual filters to prevent the introduction of 

undissolved solids into the extraction 

process. The filters must be installed by 

separate individuals and their correct 

installation independently verified. They 

will be subject to monthly surveillance to 

detect degradation. 

1st

 Control: Filter to prevent undissolved 

UO2 from reaching the extraction process 

subject to independent verification. 

2nd Control: Second independently verified 

filter to prevent undissolved UO2 from 

reaching the extraction process. 

DID: Procedural controls on nitric acid and 

mixing time in the dissolution process. 

Temperature alarm on the acid bath. Any 

undissolved solids will tend to settle at the 

bottom of the columns. 
June 2015 5-C-11 NUREG-1520, Revision 2 

Double-Contingency Discussion Associated Criticality Controls 

ENRICHMENT Scenarios 

Normal-condition controls: Facility-wide limit on enrichment is used in evaluating this 

process. 

[There are no identified enrichment scenarios; the highest facility enrichment is used, 

and this is not an enrichment facility.] 

The example double-contingency discussion is necessarily abbreviated, because it neglects any 

number of complicating factors that could arise in actual plant conditions. Such an evaluation 

would also generally be supported by criticality calculations demonstrating abnormal-condition 

subcriticality, system drawings, piping and instrumentation diagrams, specifications, 

test/operating data, supporting technical evaluations, and other information that comprises the 

ISA documentation for this process. Defense-in-depth controls and additional safety margin are 

discussed in this table; while a good practice, they are ordinarily not tabulated along with the 

criticality controls but would rather be embedded in the calculations and other supporting 

information. 

After several iterations resulting in the above double-contingency table, a final list of criticality 

controls for such a process is given below (new controls in italics): 

GEOMETRY: INTERACTION: PHYSICOCHEMICAL FORM:

 Outer column diameter

 Column wall thickness 

 Area of the floor/room 

 Floor is sloped ≥5° 

 Floor drain less than 

4 inches in diameter 

 Floor drain leads to an 

8-inch collection tank 

 Oil reservoirs less than 

a safe volume 

 Columns composed of 

borosilicate glass 2

 Columns must be 

hydrostatically tested 

(to specified pressure) 

 Columns are vented 

 Columns equipped 

with siphon breaks

 Dual independent 

sampling on raffinate 

before transfer

 In-line active interlock 

on wastewater tanks

 Column spacing

 Distance between 

columns and walls 

 Spacing between 

pumps 

 Column supports 

 Containers not to be 

placed against column 

 Mesh barrier around 

columns 

 Containers must be < 

5 gallons 

 Upstream dual filters

 

2

 Not for, as is typically done, neutron absorption (which is not controlled), but to ensure that the materials of 

composition are consistent with the chemical environment to prevent corrosion. 
June 2015 5-C-12 NUREG-1520, Revision 2 

The description of controls has been simplified, such as by not specifying specific associated 

subcritical limits or measures required to ensure that failure is unlikely (e.g., surveillance or 

maintenance, etc.). In addition, defense-in-depth controls have not been included in this list. 

(For example, the overflow lines will also prevent backflow, but only the siphon break is needed 

to satisfy double contingency.) The following are also noted: (1) the large number of controls 

needed to prevent a change in fissile-material geometry and (2) the number of choices the 

analyst had at several junctions as to what controls to put in place (e.g., the analyst could have 

credited the dissolution temperature alarm rather than two filters, could have chosen to limit 

interstitial moderator, or could have established an absorber control rather than install a mesh 

barrier around the columns). Some such choices would be made in accordance with the 

preferred control hierarchy—engineered over administrative, passive over active—and some 

would typically be made out of convenience or operational necessity. 

Demonstration of Satisfaction of ISA Requirements 

The above evaluation of hazards associated with a hypothetical solvent extraction process was 

based on demonstrating subcriticality under both normal and credible abnormal conditions. The 

double contingency principle was applied throughout, establishing criticality controls and taking 

credit for process characteristics and the natural and credible course of events as needed. The 

choice of controls was also done largely in adherence to the preferred control hierarchy, as a 

majority of controls in the above list are engineered controls, and in that preference is strongly 

for geometry over other less desirable means of control. (It is noted that each scenario listed 

above contains at least one passive engineered control (e.g., fixed geometry or neutron 

absorption).) 

As stated in Appendix 5-A to this SRP, adherence to the double-contingency principle may be 

presumed to meet the performance requirements of 10 CFR 70.61(b) if application of double 

contingency is in accordance with the guidance in Appendix 5-A and Chapter 5 of the SRP, and 

if controls relied on to demonstrate double contingency are designated as items relied on for 

safety in the ISA summary, with sufficient management measures applied to render changes in 

process conditions “unlikely.” Assuming that this is the complete set of criticality scenarios and 

necessary controls to meet double contingency, consistent with the guidance for being unlikely, 

independent, etc., all that remains is to designate these controls as items relied on for safety 

and to apply management measures appropriate to the types and characteristics of those 

controls. The applicant has already made the choice of what system features need to be 

designated as “controls”, such as in choosing to control interaction over absorption or justifying 

why keff is not sensitive to certain system dimensions. Such a set would represent the minimum 

set of items relied on for safety required to comply with 10 CFR 70.61(e). In addition, the 

applicant identified no controls that are the sole item preventing or mitigating an accident 

sequence leading to criticality, because (1) the design adheres in all cases to the 

double-contingency principle, and (2) the analysis was based on a consideration of normal and 

abnormal conditions, rather than a consideration of individual accident sequences. 

 

The example in this appendix illustrates the essential difference between a parameter-based 

and sequence-based approach to demonstrating safety and compliance with the performance 

requirements of 10 CFR 70.61. In a parameter-based approach—which is the traditional way of 

evaluating criticality safety—the normal condition is described in terms of parameters and limits 

on those parameters, and the focus is on whether deviations from those conditions will result in 

criticality. This can be thought of as a top-down approach, because one starts by asking what 

parameters are necessary to control to prevent criticality from occurring, and then establishing 

controls on those parameters. A sequence-based approach can be thought of as a bottom-up 

approach, because an applicant starts by considering all credible deviations from normal 
June 2015 5-C-13 NUREG-1520, Revision 2 

conditions and then determining what sequences of events result and whether they lead to 

criticality. Both of these approaches may in principle be used, but the parameter-based 

approach tends to be the most conservative and gives greater assurance with less work of 

having considered everything. If the most reactive credible change in a controlled parameter 

still results in the system being subcritical, it is not necessary for the applicant to explicitly 

enumerate all the possible ways that such a change in the parameter could occur. Because it is 

also a deterministic approach, based on assuming that the optimal or most reactive credible 

conditions occur, it also eliminates the uncertainty that is associated with trying to estimate the 

likelihood of all of the possible sequences. It recognizes the historical fact that it is not the 

identification of sequences or estimation of likelihood that has led to the low incidence of 

criticality, but rather the defense-in-depth and safety margin associated with this very 

conservative approach. The difficulty with applying a sequence-based approach to criticality is 

two-fold: (1) the large number of physical variables upon which system reactivity depends can 

make the number of possible events that should be considered voluminous; and (2) many of 

these physical variables are interrelated to such an extent that it can be nearly impossible to 

identify discrete items relied on for safety. 

It is this second difficulty with which an applicant must contend in designating the items relied on 

for safety. While pertinent column dimensions have been identified as criticality controls in the 

example, geometry is not independent from interaction or physicochemical form. There is no 

single control listed above that ensures subcriticality, but it is rather the entire interlocking 

system of controls that performs this overarching safety function. The individually safe columns 

are only subcritical because they are spaced a certain distance apart. They are only 

geometrically safe assuming they contain one fissile medium and not another. What ensures 

subcriticality is therefore the configuration of the system as a whole. As stated in Appendix 5-A, 

it is not the configuration of the system as it exists in the plant, but the configuration of the 

system as modeled, that is used to demonstratesubcriticality. Further, only those inputs to the 

model that have a significant effect on system reactivity (based on a sensitivity analysis or other 

justification)may need to be designated as controls. Recognizing this distinction is the key to 

avoiding the extreme of labeling every section of pipe and every nut and bolt as an item relied 

on for safety. The list of items relied on for safety in the example therefore includes: 

SX-01: Configuration of the solvent-extraction process contained in Room XYZ. The following 

specific dimensions of equipment shall be limited: 

 Outer diameter of the extraction, scrubbing, and stripping columns shall be < 10 inches 

 Wall thickness of the extraction, scrubbing, and stripping columns shall be > 0.25 inches 

 Columns shall be spaced in a single row > 18 inches apart center-to-center 

 Columns shall be spaced > 12 inches from the concrete walls 

 The floor area of Room XYZ shall be greater than 100 square feet 

 The floor of Room XYZ will be sloped ≥ 5° towards the corner 

 The diameter of the floor drain shall be < 4 inches 

 The diameter of the drain collection tank shall be < 8 inches 

 Pumps will be spaced in a single row > 18 inches apart center-to-center 

 Pump oil reservoirs shall have volumes of < 5 gallons 

 Fissile solution piping shall be < 1⁄2 inch in diameter, and shall be run perpendicular to 

the column axes for at least a distance of 6 inches from the column surface. 

No single item listed ensures subcriticality alone. Rather, these are—with the exception of the 

last item—the dimensions of process equipment that are included in the model and together are 

limited to ensure subcriticality. An applicant could also choose to define “the configuration of 

the system” (which must already be under configuration control) generically as an item relied on 
June 2015 5-C-14 NUREG-1520, Revision 2 

for safety. The definition of the system includes all equipment included in the model, which is 

the equipment in Room XYZ subject to neutron interaction. The specific attributes of this item 

relied on for safety are as enumerated. The safety function is to keep fissile material within 

specified dimensions to ensure subcriticality. The last item, restricting the configuration of the 

piping associated with the solvent-extraction process, was added by the hypothetical applicant 

in recognition that it pertains to the conditions under which something does not need to be 

included in the model. All of the above attributes are needed to ensure that the models 

demonstrating subcriticality will remain bounding. It is noted that the configuration of the system 

is an item relied on for safety, but is not the sole item preventing or mitigating an accident 

sequence, because there is no credible failure that can lead to criticality. In addition, because 

minimum and maximum dimensions are specified, a change that keeps the system within the 

description above (e.g., a change to the outer column diameter that does not exceed 10 inches) 

does not alter its safety function. 

Other items relied on for safety would also generally exist (e.g., restriction on portable 

containers, siphon break, or upstream filters). Some of these could also in principle be included 

in “the configuration of the system” because they ensure the conservative nature of the models 

demonstrating subcriticality under normal and abnormal conditions. The combining or 

separation into one, two, or multiple items relied on for safety is arbitrary because they all have 

the same underlying safety function. 

The final step by an applicant is typically to specify sufficient management measures to ensure 

that changes in process conditions will be subcritical. Management measures appropriate to 

passive engineered components include configuration management (includingchange control) 

and surveillance. If the columns are presumed to be composed of a material that is consistent 

with the chemical environment, corrosion would not be a concern and the periodic surveillance 

committed to as part of the NCS Program in the license application would be sufficient. This 

periodic surveillance would not be to ensure the reliability of any specific item relied on for 

safety, but rather to verify that no design changes have been made that could negatively affect 

criticality safety. Quality-assurance measures, such as use of procurement specifications for 

attributes important to criticality safety, may also be specified by an applicant. Items such as 

the in-line filters might need more frequent surveillance and specific maintenance instructions. 

For the active interlock, periodic maintenance and functional testing would also generally be 

required. For administrative controls (mainly restrictions on container movement), management 

measures would generally consist of operator training, procedures, postings, and periodic audits 

and inspections. Conspicuous labeling of permitted containers may also be used to enhance 

the reliability of this control. 

For this example, the following additional items relied on for safety are presumed to have been 

specified, in addition to “the configuration of the system,” SX-01: 

Passive Engineered 

NOTE: Configuration of the raffinate storage columns (dimensions, spacing, arrangement in a 

line) are presumed to be covered by another CSE. They are in another room and do not 

interact with process equipment in Room XYZ. This is established as RAF-01 in the other CSE. 

SX-02: Physical integrity of the extraction, scrubbing, and stripping columns, and associated 

piping. Columns will be composed of borosilicate glass, and piping of stainless steel 316, of 

sufficient thickness to withstand a hydrostatic pressure of at least 300 psig. 

SX-03: Each column will be equipped with transparent overflowsof diameter > 1 inch, at or 

below the elevation of piping leading to the unfavorable geometry supply or wastewater tanks. 
June 2015 5-C-15 NUREG-1520, Revision 2 

SX-04: Piping leading to each column will be equipped with a siphon break, placed between the 

columns and their common supply header. 

SX-05: Column supports shall be shown to be capable of withstanding a 100-year seismic 

event without failing catastrophically (i.e., allowing the column to become detached from its 

support). 

SX-06: A mesh barrier shall be affixed to the columns to prevent portable containers from being 

placed between the columns or between a column and the wall. 

SX-07: Dual metal filters shall be installed on the header from the dissolution trays to the 

extraction process. They will be installed by different individuals and their installation 

independently verified. They will be inspected monthly. 

Active Engineered 

SX-08: In-line sodium iodide detector closes isolation valves between the raffinate storage 

columns and unfavorable geometry wastewater treatment tanks and trips the transfer pump 

upon detection of > 0.05 gU/l. 

Administrative 

SX-09: Dual independent sampling on raffinate storage columns before authorizing transfer to 

wastewater treatment tanks. 

SX-10: Portable containers with volumes > 5 gallons are prohibited from Room XYZ, with the 

exception of movable equipment with dedicated CSEs (e.g., vacuum cleaners). 

SX-11: Portable containers are prohibited from being placed adjacent to a column. 

Based on the foregoing subcriticality analysis, such a system of controls may be designated as 

items relied on for safety in the ISA summary, with appropriate management measures 

specified. The performance requirements would therefore then be satisfied. 

June 2015 6-1 NUREG-1520, Revision 2 

6. CHEMICAL PROCESS SAFETY 

6.1 Purpose of Review 

The primary purpose of the review is to determine whether the applicant’s proposed facility 

design and operations adequately protects the health and safety of workers and the public from 

chemical hazards. Such hazards are those that are related to the storage, handling, and 

processing of licensed materials which are within the NRC’s regulatory jurisdiction. The 

proposed facility design and operations must adequately protect the health and safety of 

workers and the public from the chemical risks in the facility during normal operations and 

credible accident conditions. The applicant must ensure that its facility is adequately protected 

against conditions that could affect the safety of licensed materials and thus present an 

increased radiation or chemical risk (e.g., a chemical that incapacitates operators and prevents 

their entry into an area of the facility where licensed materials are handled). “Hazardous 

chemicals produced from licensed materials” is a defined term in 10 CFR 70.4, “Definitions.” As 

indicated in the wording of this definition, an example of such a hazardous chemical is hydrogen 

fluoride that is produced by the reaction of uranium hexafluoride and water. 

Chemical safety issues are evaluated as part of the applicant’s integrated safety analysis (ISA) 

summary. As required in 10 CFR 70.65, “Additional Contents of Applications,” the ISA summary 

must include the evaluation of credible accident sequences at the facility, identification of items 

relied on for safety (IROFS) where necessary to reduce the likelihood of accident occurrence or 

to mitigate the consequences of accidents, and identification of the management measures that 

provide reasonable assurance of the availability and reliability of IROFS when needed. 

To begin the chemical safety review, the reviewer should examine the license application, the 

facility and process description discussed in Chapter 1 of this standard review plan (SRP), and 

the ISA summary discussed in Chapter 3 of the SRP to gain familiarity with the following: 

 process information and accident sequences leading to conditions that could pose 

chemical hazards 

 IROFS and sole IROFS1

 used to reduce the likelihood or consequences of accidents 

involving chemical hazards 

 proposed procedures to protect public health and safety and the environment 

(e.g., a high-level programmatic description of how the licensee or applicant proposes to 

operate, maintain, or manage the facility) 

 the definitions of “unlikely,” “highly unlikely,” and “credible” as used in the ISA 

evaluations 

 quantitative standards used to assess the consequences to an individual from acute 

chemical exposure to licensed material or a chemical produced from licensed materials 

that are onsite or expected to be onsite 

 

1

 Sole IROFS are those that are the sole item preventing or mitigating an accident for which the consequences could 

exceed the performance requirements of 10 CFR 70.61, “Performance Requirements.” 
June 2015 6-2 NUREG-1520, Revision 2 

 management measures proposed for ensuring that the IROFS will be available and 

reliable when required 

6.2 Responsibility for Review 

Primary: Chemical Process Safety Reviewer (all sections of this chapter) 

Supporting: Licensing Project Manager 

Fuel Cycle Facility Inspection Staff (as needed) 

Health Physicist (for uranium and transuranic toxicity issues) 

Primary Reviewers of Chapters 1, 3, 8, 9, and 11 of this SRP 

6.3 Areas of Review

Regulations in 10 CFR 70.62(a) require an applicant to establish and maintain a safety program 

that will adequately protect worker and public health and safety and the environment from the 

chemical hazards from licensed material. Although it is not required to establish a separate 

chemical process safety program, the applicant must demonstrate that it has considered 

chemical hazards and accident sequences that could affect licensed material and has 

adequately prevented or mitigated them in accordance with 10 CFR 70.61, “Performance 

Requirements.” Applicants must conduct an ISA and provide an ISA summary that meets the 

requirements of 10 CFR 70.65. 

The staff’s chemical process safety review should focus on the chemical safety-related accident 

sequences described in the ISA summary (SRP Chapter 3), the proposed IROFS, and the 

corresponding management measures (SRP Chapter 11). The review should determine 

whether the applicant’s equipment, facilities, and management measures are adequate to 

protect against releases and chemical exposures of licensed material, hazardous chemicals 

produced from licensed material, and chemical risks of plant conditions that affect the safety of 

licensed material. The review must verify that classification of IROFS important to safety or 

grading of management measures proposed by the applicant in accordance with 

10 CFR 70.62(a) is appropriate to the accident risk that the IROFS are designed to reduce. 

The 2013 memorandum of understanding between the NRC and the Occupational Safety and 

Health Administration (OSHA) states that the NRC oversees chemical safety issues related to 

(1) radiation risks of licensed materials, (2) chemical risks of licensed materials, and (3) plant 

conditions that affect or may affect the safety of licensed materials and thus present an 

increased radiation risk to workers. OSHA oversees plant conditions that do not affect or 

involve the safety of licensed materials. 

The staff’s review should cover the following topics which are required to be in the 

ISA summary: 

1. description of the site, facility, and chemical processes with respect to chemical safety 

for normal operations. The information should include a discussion of process 

chemistry, flow diagrams, discussion of major process steps, and identification of major 

pieces of equipment 

2. chemical hazards and chemical accident sequences, including unmitigated accident 

sequences involving hazardous chemicals and licensed materials
June 2015 6-3 NUREG-1520, Revision 2 

3. chemical accident likelihood and consequences of accident sequence, including the 

applicant’s interpretation of the qualitative chemical risk levels and the assumptions, 

bases, and methods the applicant used to estimate the accident likelihood and 

consequences to workers and the public 

4. IROFS and sole IROFS relied on for chemical safety and a description of their safety 

function 

5. management measures, including those management measures to ensure the reliability 

and availability of chemical safety IROFS

Review Interfaces 

In addition to Chapter 6 of the application, the chemical reviewer should examine information in 

the following other areas to ensure that it is consistent with the information in Chapter 6: 

 facility and process description applied to chemical safety, as described in Chapter 1 of 

this SRP 

 safety program, ISA commitments, and ISA documentation applied to chemical safety 

under SRP Chapter 3 

 emergency plan applied to chemical safety under SRP Chapter 8 

 dispersion models used for consequence modeling under SRP Chapter 9 as appropriate 

 configuration management, maintenance, training and qualifications, procedures, audits 

and assessments, incident investigations, record management, and other quality 

assurance elements, as described in SRP Chapter 11 

6.4 Acceptance Criteria

6.4.1 Regulatory Requirements 

Acceptance criteria are based on meeting the relevant requirements of the following regulations: 

1. The general and additional contents of an application with respect to chemical process 

safety are in 10 CFR 70.22, “Contents of Applications,” and 10 CFR 70.65 respectively. 

General information that must be included in the license application appears in 

10 CFR 70.22. Information that must be included in the ISA summary appears in 

10 CFR 70.65. 

2. The requirements for the approval of the application are in 10 CFR 70.23, 

“Requirements for the Approval of Applications,” and 10 CFR 70.66, “Additional 

Requirements for Approval of License Application.” 

3. The chemical process safety review should provide reasonable assurance of compliance 

with the performance requirements in 10 CFR 70.61. 
June 2015 6-4 NUREG-1520, Revision 2 

4. Requirements to maintain and establish a safety program appear in 10 CFR 70.62, 

“Safety Program and Integrated Safety Analysis.” 

5. The requirements for new facilities or new processes at existing facilities are in 

10 CFR 70.64, “Requirements for New Facilities or New Processes at Existing 

Facilities.” 

6.4.2 Regulatory Guidance 

The following regulatory guidance is relevant to chemical process safety: 

1. NUREG-1391, “Chemical Toxicity of Uranium Hexafluoride Compared to Acute Effects 

of Radiation,” February 1991 

2. NUREG-1513, “Integrated Safety Analysis Guidance Document,” May 2001 

3. NUREG-1601, “Chemical Process Safety at Fuel Cycle Facilities,” August 1997 

4. NUREG/CR-6410, “Nuclear Fuel Cycle Facility Accident Analysis Handbook,” 

March 1998 

5. NUREG/CR-6481, “Review of Models Used for Determining Consequences of 

UF6 Release,” November 1997 

6.4.3 Regulatory Acceptance Criteria 

The reviewer should find the applicant’s chemical process safety information acceptable if there 

is reasonable assurance that it adequately addresses and satisfies the acceptance criteria 

presented below. The applicant may elect to incorporate some or all of the requested chemical 

process information in the facility and process description (SRP Section 1.1) or the 

ISA summary. Either approach is acceptable, as long as adequate information is presented. 

6.4.3.1 Chemical Process Description 

The regulation in 10 CFR 70.65(b)(3) requires the ISA summary to include a description of each 

process in the facility. The applicant’s descriptions of the chemical processes are acceptable if 

they meet the following conditions: 

1. Process descriptions are sufficiently detailed to allow an understanding of the chemical 

process hazards (including radiological hazards caused by or involving chemical 

accidents) and to allow the development of potential accident sequences. 

2. Process descriptions are sufficiently detailed to allow an understanding of the theory of 

operation. 

6.4.3.2 Chemical Hazards and Accident Sequences 

The identification of chemical hazard and accident sequences in the ISA summary is acceptable 

in the following circumstances: 
June 2015 6-5 NUREG-1520, Revision 2 

1. The applicant identifies hazardous chemical inventory and location and describes the 

hazards and accident sequences involving hazardous chemicals produced from licensed 

material. The applicant also identifies chemical risks that could affect the safety of 

licensed materials.

2. The applicant identifies the chemical accident sequences that could result in a high- or 

intermediate-consequence event. Each accident sequence identified by the applicant 

should include a description of how the hazardous chemical could come in contact with 

facility personnel and offsite personnel. The hazard evaluation should use appropriate 

accepted methods.

6.4.3.3 Chemical Accident Sequence Likelihood and Consequences 

A. The reviewer should consider the following criteria in evaluating whether the applicant’s 

chemical accident likelihood and consequence estimates are acceptable: 

1. The applicant estimates the accident likelihood in a manner that is consistent 

with the definitions of likelihood presented in the ISA summary and reviewed 

under Chapter 3 of this SRP. 

2. The applicant identifies and uses appropriate techniques and appropriate 

assumptions in estimating the concentrations of released hazardous chemicals 

produced from licensed material or by abnormal plant conditions that could affect 

the safety of licensed materials. 

3. The applicant provides evidence that the dispersion models used to determine 

whether a release of chemicals might affect worker or public health and safety 

are appropriate to the process and the physical setting. The applicant should 

demonstrate that the models used for chemical reaction and dispersion analysis 

lead to a conservative estimate of potential consequences.2

4. The applicant develops consequence estimates using, where appropriate, the 

guidance on atmospheric and consequence modeling in NUREG/CR-6410. The 

applicant may also use alternative methods if accompanied by adequate 

supporting information. 

5. The application describes the quantitative standards used to assess the 

unmitigated and mitigated consequences to an individual outside the control area 

(public) or to a worker from acute chemical exposure to licensed material, 

chemicals produced from licensed materials, or chemicals in contact with 

licensed materials that are onsite or expected to be on-site. 

6. Acceptable exposure standards include, but are not limited to, the Emergency 

Response Planning Guidelines established by the American Industrial Hygiene 

Association, the Acute Exposure Guideline Levels established by the National 

Advisory Committee for Acute Guideline Levels for Hazardous Substances, and 

 

2

 Source term and vapor dispersion models used to calculate the concentration of uranium hexafluoride (UF6) and its 

reaction products conform to any relevant guidance in NUREG/CR-6481.
June 2015 6-6 NUREG-1520, Revision 2 

the exposure limits established by OSHA. The applicant needs to verify that the 

selected standard applies to the worker or the individual outside the control area. 

Note that all the standards mentioned above apply to airborne exposure to 

gases, vapors, and particulates. Those limits are not intended to evaluate 

consequences for chemical exposures through other exposure paths. 

7. The applicant may propose alternate exposure standards if accompanied by 

supporting documentation to justify its use.3

 

To ensure compliance with the performance requirements in 10 CFR 70.61, consideration 

should be given to multiple exposure pathways (e.g., inhalation and dermal) of the hazardous 

chemicals. In addition to the standards mentioned above, the Material Safety Data Sheets 

contain useful information about toxicity and health effects as well as first aid, reactivity, 

protective equipment, and spill or leak procedures. Therefore, it is recommended that the the 

Material Safety Data Sheets of the hazardous chemicals at the facility be reviewed when 

accessing chemical consequences. 

B. The reviewer should confirm the following: 

1. Consequence categorization is consistent with the performance requirements in 

10 CFR 70.61(b) and 10 CFR 70.61(c). 

2. The application includes definitions of “unlikely,” “highly unlikely,” and “credible,” 

as used in the evaluations in the ISA. 

6.4.3.4 Chemical Process IROFS and Sole IROFS 

The applicant must provide in the ISA summary a list of chemical process safety controls 

(i.e., IROFS) that are necessary to meet the performance requirements of 10 CFR 70.61. The 

applicant should identify IROFS for any unmitigated hazardous chemical accident sequences 

that would lead to consequences that exceed the performance requirements. The applicant 

should describe the IROFS in sufficient detail to permit an understanding of their safety 

functions. 

The applicant must demonstrate, pursuant to 10 CFR 70.61(b), that any identified IROFS 

reduces the likelihood of each credible high-consequence event involving hazardous chemicals 

so that, upon implementation of IROFS, the event will be “highly unlikely” to occur. 

Alternatively, any such IROFS must make the event’s consequences less severe than those 

specified in 10 CFR 70.61(b)(4). 

The applicant must demonstrate, pursuant to 10 CFR 70.61(c), that any identified IROFS 

reduces the likelihood of each credible intermediate-consequence event involving hazardous 

chemicals so that, upon implementation of IROFS, the event will be “unlikely” to occur. 

Alternatively, any such IROFS must make the event’s consequences less severe than those 

specified in 10 CFR 70.61(c)(4). 

 

3

 Note that 10 CFR 70.61 requirements are for “acute chemical exposures,” and OSHA permissible exposure limits 

are typically time-weighted average values. Consequently, for ISA purposes, acute chemical release limits may not 

be adjusted by the time-weighted average calculation (which involves concentration and duration of exposure) 

unless the ISA summary provides a rational basis for doing so. 
June 2015 6-7 NUREG-1520, Revision 2 

If the applicant takes a graded approach to safety, in accordance with 10 CFR 70.62(a), the 

reviewer should establish that the grading of management measures applied to IROFS is 

appropriate and sufficient to protect against chemical process risks. For example, the applicant 

should consider reliance on passive controls of active systems and defense in depth, in 

accordance with 10 CFR 70.64(b). To reduce common-mode failures in critical safety areas, 

the applicant should consider the use of independent sources of motive force for items such as 

control actuators, jet pumps, eductors, and ejectors. The applicant should also consider failsafe controls wherever practical. 

6.4.3.5 Chemical Process Management Measures 

The applicant must describe the management measures proposed to ensure the availability and 

reliability of IROFS and sole IROFS when they are required to perform their safety functions. 

Management measures may be graded, commensurate with the safety significance of the 

IROFS to which they are applied. 

The application should meet the following criteria: 

1. The application should describe the engineering approach, basis, or schemes employed 

to maintain safety during normal operations. 

2. The ISA summary should identify the administrative and engineered controls selected to 

prevent or mitigate a chemical risk, the hazard being mitigated, and the risk category. 

The applicant should also explain how IROFS have been classified, how management 

measures have been graded, and how such classification and grading is commensurate 

with the reduction in risk that the IROFS are designed to achieve. 

3. The application should demonstrate that the management measures ensure that IROFS 

are available and reliable by briefly describing the following: 

a. procedures to ensure the reliable operation of engineered controls 

(e.g., inspection and testing procedures and frequencies, calibration programs, 

functional tests, corrective and preventive maintenance programs, and criteria for 

acceptable test results) 

b. procedures to ensure that administrative controls will be correctly implemented, 

when required (e.g., employee training and qualification in operating procedures, 

refresher training, safe work practices, development of standard operating 

procedures, and training program evaluation) 

6.4.3.6 Requirements for New Facilities or New Processes at Existing Facilities 

10 CFR 70.64(a) states that the application must address the baseline design criteria (BDC) for 

new facilities or new processes at existing facilities that require a license amendment under 

10 CFR 70.72, “Facility Changes and Change Process.” 10 CFR 70.64(c) further states that the 

applicant must apply the BDC to the design of new processes, but is not required to retrofit 

existing facilities or existing processes; however, all facilities and processes must comply with 

the performance requirements in 10 CFR 70.61. Section 2.4 of NUREG-1601 contains a list of 

items that should be considered during facility design. Additionally, regarding chemical safety in 
June 2015 6-8 NUREG-1520, Revision 2 

particular, 10 CFR 70.64(a)(5) states that the design must provide for adequate protection 

against chemical risk from licensed material, facility conditions that affect the safety of licensed 

material, and hazardous chemicals produced from licensed material. With respect to chemical 

process safety, the application should be considered acceptable if it includes the following 

information (or references other sections of the application that include this information): 

1. A description of how the applicant performed the ISA for the new process and how the 

ISA satisfies the principles of the BDC of 70.64(a) for chemical safety hazards and the 

performance requirements in 10 CFR 70.61. The applicant also explains how it applies 

defense-in-depth requirements of 70.64(b), particularly higher risk accident sequences 

with chemical hazards. Acceptable defense-in-depth principles for the chemical process 

safety design are those that support a hierarchy of controls: prevention, mitigation, and 

operator intervention, in order of preference. 

2. A description of any proposed facility-specific or process-specific relaxations or additions 

to BDC, along with justifications for relaxations. 

3. The ISA summary describes how the applicant applied the chemical safety BDC in 

establishing the design principles, features, and control systems of the new process. 

6.5 Review Procedures 

6.5.1 Acceptance Review 

During the acceptance review of a license application, the reviewer should examine the 

submittals to identify major deficiencies in the information provided for each area of review 

specified in SRP Section 6.3. Reviewers must decide whether they have enough information to 

proceed with a detailed review. Less significant errors or deficiencies that can be addressed in 

a single request for additional information should be accepted. However, before the NRC 

performs a detailed review, the applicant should correct major deficiencies that would require 

several requests for additional information to resolve. 

Reviewers should record whether each area of review is adequately addressed in the 

application, is adequately addressed in a referenced document, is not applicable to the 

application, or has a major deficiency. 

6.5.2 Safety Evaluation 

During the safety evaluation, the reviewer determines whether the application comprehensively 

describes the chemical safety of the licensed activity, as identified in SRP Section 6.3. For 

deviations from the specific acceptance criteria, the staff should review the applicant’s 

explanation of how the proposed alternatives to the SRP criteria provide an acceptable method 

of complying with the relevant NRC requirements identified in Section 6.4. 

During the license application and ISA summary review, the reviewer should identify and note 

any items or issues that should be inspected during an operational readiness review, if such a 

review will be performed. These items could include confirming that the applicant implemented 

engineered controls through procedures and operator training. 
June 2015 6-9 NUREG-1520, Revision 2 

The primary reviewer will prepare input to the safety evaluation report (SER) for the licensing 

project manager in support of the licensing action. During the initial review, the reviewer should 

draft the safety evaluation report (SER) described below. A request for additional information 

(RAI) will be prepared when clarification and additional information are needed to determine 

whether the licensee’s submittals comply with the regulations. For an existing facility, the 

reviewer may consult NRC inspectors to identify and resolve any issues related to the licensing 

review. For a planned facility, the reviewers may wish to consult with the facility design team to 

gain a better understanding of the process, its potential hazards, and its safety approaches. 

The reviewers should coordinate these interactions through the licensing project manager as 

well as in preparing RAIs. Additional information submitted by the applicant will be evaluated 

and a final SER will be provided to the licensing project manager. 

6.5.2.1 Chemical Process Description 

The results of the ISA are the basis for the chemical process safety evaluation. The reviewer 

should establish that the applicant’s facility design, operations, and IROFS for chemical safety 

provide reasonable assurance that they will function as intended and ensure the safe handling 

of licensed material at the facility. The reviewer must verify that the applicant’s proposed 

equipment and facilities are adequate to protect public health and safety and the environment. 

The reviewer should examine the mechanisms that will allow the applicant to identify and 

correct potential problems. 

6.5.2.2 Chemical Hazard and Accident Sequences 

The ISA summary shall contain the potential accident sequences caused by process deviations 

or other events internal to the facility and credible external events, including natural phenomena. 

Whenever possible, a licensee should use its own experience to supplement the identification of 

potential chemical hazards. The review may cover a selected number of lower risk chemical 

safety-related accident sequences not identified in the ISA summary. 

6.5.2.3 Chemical Accident Likelihood and Consequences 

The reviewer must verify that the estimation of event likelihood is developed in a manner that is 

consistent with the methods and definitions reviewed and approved under Chapter 2 of this 

SRP. 

The reviewer must verify that the proposed quantitative standards used to assess the 

consequences to an individual from acute chemical exposure are acceptable. Events with high 

and intermediate consequences should be identified as well as the IROFS proposed to reduce 

the likelihood or the consequences of the event. The reviewer needs to ensure that the 

selected standards are correctly applied to the worker or the member of the public. 

6.5.2.4 Chemical Process IROFS and Sole IROFS 

The staff reviews the chemical process safety IROFS to ensure their adequacy in protecting 

against all unmitigated sequences identified in the ISA summary. The reviewer should establish 

that the applicant’s proposed controls (IROFS) for chemical safety provide reasonable 

assurance that they will function as intended and ensure the safe handling of licensed material 

at the facility. 
June 2015 6-10 NUREG-1520, Revision 2 

6.5.2.5 Chemical Process Management Measures

The staff review should verify that the application describes the management measures that the 

licensee will take to provide reasonable assurance that the chemical safety IRFOS are available 

and reliable to perform their function. The technical reviewer should verify the applicant’s 

commitment to retaining records for chemical-process safety compliance and reporting 

commitments for chemical releases. In addition, the reviewer should verify the applicant’s 

commitment to refer any unacceptable performance deficiency to those responsible for the 

facility’s corrective action function, in accordance with Chapter 11 of this SRP. 

If the applicant has applied a graded approach to safety, the reviewer should establish that the 

grading of management measures and classification of IROFS is appropriate and sufficient to 

protect against chemical process risks (see Chapter 11 of this SRP). 

6.5.2.6 Requirements for New Facilities or New Processes at Existing Facilities 

The staff reviews the applicant’s commitments to adhere to the BDC according to 

10 CFR 70.64(a) and to the defense-in-depth requirements of 70.64(b) for the design of new 

facilities or new processes at an existing facility that require a license amendment under 

10 CFR 70.72. 

6.6 Evaluation Findings

The regulations in 10 CFR 70.23 and 70.66 state that an application for a license will be 

approved if the Commission can make the general findings listed in those sections. The basis 

for the general findings is an evaluation of whether the application adequately addresses all of 

the applicable regulatory requirements. More specifically, the staff’s evaluation should 

determine whether the licensing submittals provide sufficient information to satisfy the regulatory 

requirements listed in Section 6.4.1 of this SRP, and whether the applicant has appropriately 

addressed the regulatory acceptance criteria in SRP Section 6.4.3. The SER should state how 

the applicable regulatory requirements have been met based on the acceptance criteria 

described in this chapter of the SRP. If the applicant chooses to use an alternative approach, 

the reviewer should discuss in the SER whether the proposed approach satisfies the applicable 

regulatory requirements. The reviewers should use the following approach to document their 

evaluation: 

1. State a specific regulatory requirement that applies to the application. Detailed 

acceptance criteria may be included where appropriate or necessary. 

2. Identify the areas where the regulatory requirement is addressed in the application, 

including the areas where the specific acceptance criteria described in this SRP are 

addressed. 

3. Describe your evaluation of the application, the basis for your conclusion, and whether 

regulatory requirements are met. 

4. Repeat these steps for every regulatory requirement that applies to the application. 

There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

application or amendment request, (2) denial of the application or request, or (3) approval with 
June 2015 6-11 NUREG-1520, Revision 2 

conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

reviewer may consider proposing a license condition. Absent an NRC order, license conditions 

must be agreed upon with the licensee or applicant before becoming part of the license. 

A license condition should only be proposed if there is reasonable assurance that, if the 

licensee meets the condition, all regulatory requirements will be satisfied. Thus, license 

conditions should not be used to cover major deficiencies in an application. License conditions 

should be unambiguous, inspectable, and enforceable. They should only require those actions 

necessary to ensure compliance with applicable regulations. The basis for license conditions 

must be documented in the SER. 

The SER should include a summary statement of what the NRC staff evaluated and the basis 

for the reviewer’s conclusions that is similar to the following: 

The staff has evaluated the application using the criteria listed previously. Based 

on the review of the license application, the NRC staff has concluded that the 

applicant has adequately described and assessed accident consequences that 

could result from the handling, storage, or processing of licensed materials and 

that could have potentially significant chemical consequences and effects. The 

applicant has constructed a hazard analysis that identified and evaluated those 

chemical-process hazards and potential accidents and established safety 

controls to provide reasonable assurance of safe facility operation. To ensure 

that the performance requirements in 10 CFR Part 70, “Domestic Licensing of 

Special Nuclear Material,”4

 are met, the applicant has provided reasonable 

assurance that controls are available and reliable when required to perform their 

safety functions. The staff has reviewed these safety controls and the applicant’s 

plan for managing chemical-process safety and finds them acceptable. 

The staff concludes that both the applicant’s plan for managing chemical-process 

safety and the chemical-process safety controls meet the requirements of 

10 CFR Part 70 and provide reasonable assurance that the health and safety of 

the public will be protected. 

6.7 References

American Industrial Hygiene Association, “Emergency Response Planning Guidelines,” as 

revised. The latest available list of approved guidelines, dated May 31, 2013, is available at 

http://www.aiha.org/get-involved/AIHAGuidelineFoundation/ 

EmergencyResponsePlanningGuidelines/Documents/2013ERPGValues.pdf (accessed on 

5/12/14). 

U.S. Environmental Protection Agency, “Acute Exposure Guideline Levels (AEGLs),” 

http://www.epa.gov/oppt/aegl/pubs/chemlist.htm (accessed on 5/12/2014). 

U.S. Nuclear Regulatory Commission, “Inspection of the Nuclear Chemical Process Safety 

Program at Fuel Cycle Facilities,” Inspection Manual Chapter 2603, as revised. 

U.S. Nuclear Regulatory Commission, “Chemical Toxicity of Uranium Hexafluoride Compared to 

 

4

 The title of 10 CFR Part 70 may be omitted if the title has already been stated in the same chapter of the SER. 
June 2015 6-12 NUREG-1520, Revision 2 

Acute Effects of Radiation,” NUREG-1391, February 1991. 

U.S. Nuclear Regulatory Commission, “Integrated Safety Analysis Guidance Document,” 

NUREG-1513, May 2001. 

U.S. Nuclear Regulatory Commission, “Chemical Process Safety at Fuel Cycle Facilities,” 

NUREG-1601, August 1997. 

U.S. Nuclear Regulatory Commission, “Nuclear Fuel Cycle Facility Accident Analysis 

Handbook,” NUREG/CR-6410, March 1998. 

U.S. Nuclear Regulatory Commission, “Review of Models Used for Determining Consequences 

of UF6 Release,” NUREG/CR-6481, November 1997. 

U.S. Nuclear Regulatory Commission/Occupational Safety and Health Administration, 

“Memorandum of Understanding between the U.S. Nuclear Regulatory Commission and the 

Occupational Safety and Health Administration,” September 6, 2013. 
June 2015 7-1 NUREG-1520, Revision 2 

7. FIRE SAFETY

7.1 Purpose of Review

The purpose of this review is to determine with reasonable assurance that the applicant has 

designed a facility that provides adequate protection against fires and explosions that could 

affect the safety of licensed materials and thus present an increased radiological or chemical 

risk. The review should also establish that the applicant has considered the radiological and 

chemical consequences of the fires and will institute suitable safety controls to protect workers, 

the public, and the environment. 

Fire-safety issues are initially evaluated as part of the applicant’s integrated safety analysis 

(ISA) summary. The ISA summary must evaluate credible accident sequences at the facility; 

identify items relied on for safety (IROFS) to prevent the occurrence or to mitigate the 

consequences of accidents; and include the management measures that provide reasonable 

assurance of the availability and reliability of IROFS when needed. Reviewers assess the 

applicant’s approach to protecting against fire and explosion hazards by examining the license 

application and the ISA summary to gain familiarity with the following: 

1. process information and accident sequences leading to conditions that could pose fire 

hazards 

2. IROFS and sole IROFS used to prevent or mitigate such fire hazards 

3. management measures applied to ensure that IROFS will be available and reliable when 

required 

7.2 Responsibility for Review

Primary: Fire Safety Specialist 

Secondary: Criticality Safety Specialist 

 Environmental Specialist 

 Chemical Safety Specialist 

 Physical Security Specialist 

 Licensing Project Manager 

Supporting: Regional, Resident, and Fuel Cycle Inspection Staff 

7.3 Areas of Review

Title 10 of the Code of Federal Regulations (10 CFR) 70.62(a) requires an applicant to develop, 

implement, and maintain a safety program that will reasonably protect public health and safety 

and the environment from the fire and explosive hazards associated with processing, handling, 

and storing licensed materials during normal operations, anticipated operational occurrences, 

and credible accidents. The fire protection program must address these process-specific risks 

and general fire prevention, protection, and management issues. Although 10 CFR Part 70, 

“Domestic Licensing of Special Nuclear Material,” does not require a separate fire safety 
June 2015 7-2 NUREG-1520, Revision 2 

program, an applicant should provide commitments pertaining to fire safety in the following 

areas: 

1. Fire safety management includes safety organization, engineering review, and fire 

prevention; inspection, testing, and maintenance; prefire plans; and personnel 

qualifications, drills, and training. 

2. Fire risk identification includes the fire hazards analysis (FHA) and the ISA summary. 

3. Facility design includes information on building construction, fire areas, life safety, 

ventilation, and electrical system design. The facility design should also consider 

competing requirements among fire safety and security, criticality, and environmental 

concerns. 

4. Process fire safety involves design considerations to prevent an accident or to mitigate 

the consequences of an accident resulting from the use of process chemicals, 

combustible metals, flammable and combustible liquids and gases, high-temperature 

equipment, hot cells and glove boxes, and laboratories. 

5. Fire protection systems include fire detection, alarm, and suppression systems; portable 

extinguishers; water supplies; and emergency response organizations. 

Review Interfaces 

In addition to Chapter 7 of the application, the reviewer should examine information in the 

following other areas to ensure that it is consistent with the information in Chapter 7: 

 Review information about the facility and process descriptions related to fire safety as 

required under Chapter 1 of this Standard Review Plan (SRP). 

 Review information on the safety program, ISA commitments, and ISA documentation 

applied to fire safety as required under SRP Chapter 3. 

 Review information on controls applied to chemical processes for fire safety as required 

under SRP Chapter 6. 

 Review information on configuration management, maintenance, training and 

qualifications, procedures, audits and assessments, incident investigations, record 

management, and other quality assurance (QA) elements as required under SRP 

Chapter 11 as related to fire safety. 

7.4 Acceptance Criteria

An applicant that meets the acceptance criteria defined in this section or that has provided an 

acceptable alternative should be considered as having provided reasonable assurance of an 

acceptable fire protection program. 
June 2015 7-3 NUREG-1520, Revision 2 

7.4.1 Regulatory Requirements 

The regulatory basis for the fire safety review should be the requirements of 10 CFR 70.22, 

“Contents of Applications,” and 10 CFR 70.65, “Additional Content of Applications.” In addition, 

the fire safety review should focus on providing reasonable assurance of compliance with 

10 CFR 70.61, “Performance Requirements”; 10 CFR 70.62, “Safety Program and Integrated 

Safety Analysis”; and 10 CFR 70.64, “Requirements for New Facilities or New Processes at 

Existing Facilities.” 

7.4.2 Regulatory Guidance 

The relevant regulatory guidance for fire safety includes the following U.S. Nuclear Regulatory 

Commission (NRC) and industrial standards: 

1. National Fire Protection Association (NFPA) 801, “Standard for Fire Protection for 

Facilities Handling Radioactive Materials,” latest edition 

2. NUREG-1513, “Integrated Safety Analysis Guidance Document,” May 2001 

3. NUREG/CR-6410, “Nuclear Fuel Cycle Facility Accident Analysis Handbook,” 

March 1998 

7.4.3 Regulatory Acceptance Criteria 

Partial acceptability of the application and the ISA summary will be contingent on the NRC 

staff’s review of the applicant’s commitments to control and mitigate fire hazards. The staff will 

focus on whether the application is risk informed, addresses the applicant’s procedures for 

maintaining an acceptable level of fire safety, and demonstrates that the applicant is prepared to 

react quickly and safely to extinguish fires. An applicant may use a graded approach to define 

fire safety, but it must provide sufficient documentation and commitments to ensure that it will 

adequately protect workers, the public, and the environment from fire events. 

The applicant may incorporate these acceptance criteria in the information supplied to satisfy 

SRP Chapter 3 (regarding ISA) or other SRP chapters as long as it provides clear crossreferences (information need not be repeated). The staff’s fire safety specialist will review the 

application, ISA summary and other documentation, as needed, regarding these acceptance 

criteria. 

The reviewer(s) will use nationally recognized codes and standards, as appropriate, in 

evaluating a reasonable assurance of fire safety. These codes and standards include, but are 

not limited to, the NFPA “National Fire Codes”; Factory Mutual Research Corporation data 

sheets and approval guide; Underwriters Laboratories, Inc., standards and building material 

directory; American National Standards Institute standards; and American Society for Testing 

and Materials standards. Commitments to specified standards will normally be considered an 

acceptable means of meeting the acceptance criteria. 

The NRC staff will review the application to ensure that it meets the acceptance criteria 

discussed below. 
June 2015 7-4 NUREG-1520, Revision 2 

7.4.3.1 Fire Safety Management Measures 

An adequate application documents how the applicant will administer and ensure fire safety at 

the licensed facility. The application should reflect a commitment to ensure that the IROFS, as 

identified in the ISA Summary, are available and reliable and that the facility maintains fire 

safety awareness among employees, controls transient ignition sources and combustibles, and 

maintains a readiness to extinguish the fire or limit its consequences. These measures are 

unique to fire safety and, therefore, are not included in the acceptance criteria for SRP 

Chapter 11. 

An adequate application identifies a senior-level manager who has the authority and staff to 

ensure that fire safety receives appropriate priority. A facility safety committee or fire safety 

review committee staffed by managers of different disciplines should integrate facility 

modifications. (The facility safety committee can do the work of a fire safety review committee.) 

As described in the application, an individual with sufficient practical fire safety experience in 

nuclear facilities should supervise day-to-day fire safety. 

NFPA 801 specifies the following fire safety management measures: 

1. fire prevention 

2. inspection, testing, and maintenance of fire protection systems 

3. emergency response organization qualifications, drills, and training 

4. prefire plans 

An adequate application documents the fire safety management measures in sufficient detail to 

identify their relationship to, and functions in, normal operations, anticipated (off-normal) events, 

and accident safety (i.e., IROFS). The staff recognizes NFPA 801 as one acceptable standard 

for fire safety management measures; however, the applicant may use other nationally 

recognized codes and standards if appropriate. 

7.4.3.2 Fire Hazards Analysis 

7.4.3.2.1 Development of a Fire Hazard Analysis as a Tool for Evaluating Fire Hazards 

Knowing the fire risk allows an applicant to apply the appropriate level of fire protection to 

ensure the safety of workers, the public, and the environment from fire-induced radiological or 

chemical hazards. To be risk informed, a licensee should conduct an FHA for each facility or 

part thereof that, if totally consumed by fire, could release special nuclear material (SNM) in 

quantity and form that could cause at least an intermediate consequence, as defined in 

10 CFR 70.61. The FHA should develop bounding credible fire scenarios for each fire area 

containing significant fire loading and then assess the consequences of an unmitigated fire. 

The staff recognizes NFPA 801 as one standard that provides guidance for conducting FHAs; 

however, the applicant may use other nationally recognized codes and standards if appropriate. 

The FHA should include a description, by fire area, of the fuel loading, fire scenarios, methods 

of consequence analysis, and potential consequences, as well as a description of the mitigative 

or preventive controls or both. 
June 2015 7-5 NUREG-1520, Revision 2 

The FHA should also contain an inventory of IROFS that are susceptible to fire damage from 

credible fires (taking into account transient and temporary conditions) within each fire area. 

Loss of systems such as ventilation, cooling, or electrical power that could cause failures 

elsewhere in the facility should be evaluated. The FHA should also consider the improper 

operation of equipment and IROFS due to spurious signals induced by fire damage. In addition, 

the effects of combustion products, manual firefighting efforts, and the activation of automatic 

fire suppression systems should be assessed. 

The FHA is used to identify possible fire initiators and accident sequences leading to 

radiological consequences or toxic chemical consequences resulting from interaction with SNM. 

In developing accident sequences that will be reported in the ISA summary, the ISA team will 

consider the FHA results and assign likelihoods to the various events in the accident 

sequences. With respect to fire safety, the ISA summary is acceptable if it identifies the credible 

fire hazards (e.g., from the FHA) for each process fire and if it provides details as to how the 

applicant considered and addressed (i.e., the management measures and IROFS) each fire 

hazard for each process accident sequence whose consequence could exceed the performance 

requirements in 10 CFR 70.61. Thus, the FHA is a fundamental tool for evaluating fire hazards 

as input to the ISA evaluation. 

7.4.3.2.2 Deviations from National Fire Protection Association Codes and Standards 

When the applicant or licensee states that its design “meets the NFPA code(s)” or “meets the 

intent of the NFPA codes” and does not identify any deviations from such codes, the NRC 

expects that the design conforms to the codes and is subject to inspection against the NFPA 

code of record. A design that “meets the intent of the code” should specify those sections of the 

code with which it does not conform. A licensee may apply the equivalency concept in meeting 

the provisions of the NFPA codes or standards. Nothing in the NFPA codes or standards is 

intended to prevent the use of methods, systems, or devices of equivalent or superior quality, 

strength, fire resistance, durability, and safety as alternatives to those prescribed by the codes 

or standards, provided that technical documentation demonstrates equivalency and that the 

method, system, or device is listed or approved for the intended purpose. Recent editions of the 

NFPA codes require submittal of technical documentation to the “authority having jurisdiction” to 

demonstrate equivalency of an alternative system, method, or device. The NRC does not 

require review and approval of equivalency evaluations before their implementation during 

construction. However, the licensee should document these evaluations and make them 

available for NRC inspection. The NRC recognizes that fire protection systems and controls 

may be required to meet State or local codes and may need to be approved by code 

enforcement officials. Where such systems and controls are not required to meet the 

performance requirements of 10 CFR 70.61 (i.e., not designated as IROFS), a State or local 

code enforcement official may be designated as the authority having jurisdiction (as described in 

NFPA documents). However, the NRC must review and inspect IROFS and any code 

deviations relative to their effect on nuclear safety. The authority having jurisdiction refers to the 

NRC Director of the Office of Nuclear Material Safety and Safeguards (or his or her designee). 

7.4.3.3 Facility Design 

Building construction, fire area determination, electrical installation, life safety, ventilation, 

drainage, and lightning protection are all facility design features that affect fire safety. The staff 

recognizes NFPA 801 as one standard that specifies acceptable facility fire safety design 

criteria; however, the applicant may use other nationally recognized codes and standards, if 
June 2015 7-6 NUREG-1520, Revision 2 

appropriate. An adequate application documents the fire safety considerations used in the 

general design of fuel cycle facilities. 

A. The NRC normally reviews the following design information related to fire safety in a 

license application: 

1. the type of construction (as required under NFPA 220, “Standard on Types of 

Building Construction,” for a new building) and applicable building codes (for an 

existing building) with a comparison to NFPA 220 building types 

2. the identification of building material, the fire duration rating (if known), and a 

description of exterior openings 

3. the overall description of the fire detection system, including the degree of 

compliance with NFPA 72, “National Fire Alarm and Signaling Code,” for design, 

installation, surveillance, testing, and maintenance 

4. the overall description of the automatic fire suppression system, applicable 

design standards, the system design basis, and identification of standards for 

surveillance, testing, and maintenance procedures 

5. the description of the water distribution system, including descriptions of fire 

pumps, fire mains, the location of sectionalizing valves, maximum fire demand, 

and compliance with applicable NFPA standards 

B. In addition to standard industrial fire safety concerns, the application should also 

address the following nuclear safety, environmental protection, and physical security 

issues: 

1. Criticality concerns may exclude water extinguishing systems from process 

areas. However, during major fire events, the fire may easily overcome the 

extinguishing capability of portable extinguishers, and hose lines may be needed 

to extinguish the fire. Consequently, applicants should consider using total 

flooding gaseous systems in water-exclusion areas with significant fire risks. An 

adequate application addresses the methodology for extinguishing fires in waterexclusion areas. 

2. Environmental concerns include the potential for thousands of gallons of fire 

water to be contaminated with nuclear material during a fire event. 

Consequently, diked areas and drainage of process facilities may be needed. 

NFPA 801 provides guidance on how to calculate the potential amount of runoff 

to properly size drainage and containment systems. An adequate application 

documents any measures used to control fire water runoff.

3. Physical security concerns include the need to design buildings and facilities to 

provide safe egress in case of fire. Physical security requirements for SNM may 

inadvertently delay worker egress and firefighter access. Physical security 

procedures should allow offsite fire departments quick and efficient access to fire 

emergencies. An adequate application documents the design criteria used for 
June 2015 7-7 NUREG-1520, Revision 2 

worker egress and procedures for firefighter access. The staff recognizes 

NFPA 801 as one standard that specifies acceptable worker egress design 

criteria; however, the applicant may use other nationally recognized codes and 

standards, if appropriate.

The design and construction should be consistent with the guidance provided in NFPA 801 or 

other appropriate nationally recognized fire protection codes and standards.

7.4.3.4 Process Fire Safety 

Many hazardous chemicals and processes used by fuel cycle facilities contribute to the fire 

hazards. In areas that have fire hazards that may threaten licensed material, the application 

should identify the hazardous chemicals, processes, and design standards used to ensure fire 

safety. The staff recognizes NFPA 801 as one standard that provides acceptable design criteria 

for radiological process areas that may contain hazardous material, laboratories, hightemperature equipment, hot cells, and glove boxes. However, the applicant may use other 

nationally recognized codes and standards, if appropriate. 

The following are a few of the more common hazardous materials used at fuel cycle facilities: 

1. Anhydrous ammonia is an explosive, flammable, and toxic gas used to make hydrogen. 

2. Fluorine reacts violently with organic material or metal powders and water vapor. 

3. Hydrogen is an explosive and flammable gas used in reduction processes. 

4. Hydrogen peroxide off-gases hydrogen and oxygen and is incompatible with some 

extinguishers. 

5. Nitric acid nitrates organic material, which lowers the ignition temperature of 

combustibles. 

6. Sulfuric acid absorbs water from organic material in an exothermic reaction, thereby 

causing ignition. 

7. Zirconium is a combustible metal that burns at elevated temperatures. 

8. Calciners and incinerators are sources of heat that have initiated fires at fuel cycle 

facilities. 

The applicant should identify fire and explosion hazards, fire and explosion parameters of 

hazardous materials, and the degree of compliance with applicable codes (e.g., NFPA 30, 

“Flammable and Combustible Liquids Code”; NFPA 69, “Standard on Explosion Prevention 

Systems”; and NFPA 86, “Standard for Ovens and Furnaces”). 

In addition to participating in the integrated review of the ISA summary performed in accordance 

with Chapter 3 of this SRP, the reviewer should also examine in detail the fire-initiated release 

scenarios provided in the ISA summary to demonstrate compliance with 10 CFR 70.61. This 

review should follow the guidance provided in applicable subsections of SRP Chapter 3 to 

include a detailed evaluation of these scenarios, including a review of fire initiators, fire-induced 
June 2015 7-8 NUREG-1520, Revision 2 

consequences, the likelihoods of such consequences, and IROFS chosen to prevent or mitigate 

those consequences. 

7.4.3.4.1 Fire-Initiated Accident Sequences 

The review should consider the following factors in determining the acceptability of the 

applicant’s descriptions of fire-initiated accident sequences: 

1. The applicant provided enough detail in its fire hazard descriptions to permit an 

understanding of the fire hazards sufficient to allow an evaluation of potential accident 

sequences. 

2. The applicant adequately described the consequences and likelihoods of accident 

sequences identified in the ISA summary involving fire, including risks from hazardous 

chemicals produced from licensed material and risks from radioactive materials. 

3. The applicant provided enough detail in its justification of the initiation probability for the 

reviewer to make an independent verification for those scenarios in which the initiation 

probability appears to be nonconservative. If a facility relies on controls to achieve this 

initiation probability, the applicant should identify these controls as IROFS, as 

appropriate. 

4. Controls that are used to mitigate or prevent the scenario are identified as IROFS or as 

defense-in-depth measures. For those controls that are IROFS, reliability and 

associated management measures must be indicated. 

5. Analyses that the applicant has performed as part of the evaluation are part of the ISA 

and referenced. 

7.4.3.4.2 Items Relied on for Safety and the Associated Management Measures 

Based on a comparison of the unmitigated fire protection accident sequence consequences with 

the performance criteria of 10 CFR 70.61, the applicant should identify (in the ISA summary) fire 

protection safety controls suitable to prevent or mitigate potential accidents. If the applicant 

takes a graded approach to safety in accordance with 10 CFR 70.62(a), the reviewer should 

establish that the classification of IROFS and grading of the associated management measures 

are appropriate and sufficient to protect against fire-related risks. A minimum acceptable level 

of requirements for management measures (e.g., QA for fire protection systems) is the level that 

NFPA codes require, such as the use of equipment listed by an acceptable organization 

(e.g., Underwriters Laboratories, Inc., or Factory Mutual Global). Installation and initial testing 

should also be that specified by the appropriate code. 

The NRC staff should also review those management measures that ensure the availability and 

reliability of such IROFS when they are required to perform safety functions. The ISA summary 

should demonstrate that the proposed management measures ensure that IROFS are available 

and reliable when required by briefly describing the following: 

1. measures to ensure the reliable operation of engineered controls (e.g., inspection and 

testing procedures and frequencies, calibration programs, functional tests, corrective 

and preventive maintenance programs, and criteria for acceptable test results) 
June 2015 7-9 NUREG-1520, Revision 2 

2. measures to ensure that administrative controls will be correctly implemented when 

required (e.g., employee training and qualification in operating procedures, refresher 

training, safe work practices, development of standard operating procedures, and 

training program evaluations) 

3. the compliance of IROFS with all applicable NFPA or industry consensus fire codes and 

standards 

At minimum, IROFS should comply with those sections of the codes or standards affecting the 

reliability and effectiveness of the IROFS. For example, fire protection systems do not need to 

be seismically designed beyond what is required by the applicable NFPA code if they are not 

intended to function during a seismic event. 

7.4.3.5 Fire Protection and Emergency Response 

The application should document the fire protection systems and fire emergency response 

organizations provided for licensed facilities. The ISA summary should identify the fire 

protection IROFS. An adequate application describes the fire protection for areas in which 

licensed material is present. The application should describe which standards the fire protection 

systems and equipment meet. The staff recognizes NFPA’s national fire codes as acceptable 

standards for the design, installation, testing, and maintenance of the fire protection systems 

and equipment. However, the applicant may use other nationally recognized codes and 

standards, if appropriate. 

Facilities with the potential for rapidly developing fires that do not have an adequate nearby 

emergency responder may need an onsite fire emergency response team. One acceptable 

standard is NFPA 600, “Standard on Industrial Fire Brigades.” However, the applicant may use 

other nationally recognized codes and standards, if appropriate. If offsite fire departments are 

needed for facility fire safety, periodic training with the fire departments is necessary so that 

offsite departments will become familiar with facility access procedures, facility layout, and 

prefire plans. A memorandum of understanding between the applicant and the fire departments 

is recommended to define the required protection. The staff’s fire safety specialist will review 

the adequacy of the applicant’s fire protection and emergency response commitments. 

7.4.3.6 Requirements for New Facilities or New Processes at Existing Facilities 

10 CFR 70.64(a) states that the application must address the baseline design criteria (BDC) for 

new facilities or new processes at existing facilities that require a license amendment under 

10 CFR 70.72, “Facility Changes and Change Process.” 10 CFR 70.64(a) further states that the 

applicant must apply the BDC to the design of new processes, but is not required to retrofit 

existing facilities or existing processes; however, all facilities and processes must comply with 

the performance requirements in 10 CFR 70.61. With respect to fire safety in particular, 

10 CFR 70.64(a)(3) states that the design must provide for adequate protection against fires 

and explosions. 

10 CFR 70.64(b) states that facility and system design must be founded on defense-in-depth 

practices and must incorporate, to the extent practicable: (1) preference for engineered controls 

over administrative controls and (2) reduction of challenges to IROFS. Thus, facility and system 

designs relying only on administrative controls, or relying on IROFS that are frequently or 
June 2015 7-10 NUREG-1520, Revision 2 

continuously challenged, are not acceptable, unless the application provides a justification 

showing that alternatives to achieve the design criteria are not practicable. 

In accordance with the above requirements, the application should be considered acceptable if 

it includes the information listed below (or references other sections of the application that 

include this information): 

1. The application should briefly describe how the ISA was performed for the new process, 

including its use and relationship to the performance requirements in 10 CFR 70.61, the 

BDC, and a defense-in-depth strategy for higher risk accident sequences. Acceptable 

principles for defense in depth of the fire safety design would be those that support the 

hierarchy of controls with preference for prevention of releases (over mitigation of 

consequences) and engineered controls over administrative controls. 

2. The ISA summary should describe how the applicant applied 10 CFR 70.64(a)(3) in 

establishing the design principles, features, and control systems of the new process. 

This will normally involve a commitment to follow appropriate codes and standards for 

design, testing, surveillance, and maintenance of fire protection systems, including those 

that are not IROFS but may involve nuclear processes or buildings housing nuclear 

material. 

7.5 Review Procedures

7.5.1 Acceptance Review 

During the acceptance review of a license application, the reviewer should examine the 

submittals to identify major deficiencies in the information provided for each area of review 

specified in SRP Section 7.3. Reviewers must decide whether they have enough information to 

proceed with a detailed review. Less significant errors or deficiencies that can be addressed in 

a request for additional information should be accepted. However, before the NRC performs a 

detailed review, the applicant should correct major deficiencies that would require several 

requests for additional information to resolve. 

Reviewers should record whether each area of review is adequately addressed in the 

application, is adequately addressed in a referenced document, is not applicable to the 

application, or has a major deficiency. 

7.5.2 Safety Evaluation 

During the safety evaluation, the primary and secondary reviewers determine whether the 

application comprehensively describes the fire safety of the licensed activity as identified in SRP 

Section 7.3 and assess the commitments made in response to the criteria specified in 

SRP Section 7.4. During the initial review, the reviewer should draft the safety evaluation report 

(SER) described below. A request for additional information (RAI) will be prepared when 

clarification and additional information are needed to determine whether the licensee’s 

submittals comply with the regulations. The primary reviewer should coordinate with the 

licensing project manager in preparing a RAI. Additional information submitted by the applicant 

will be evaluated and a final SER will be provided to the licensing project manager. 
June 2015 7-11 NUREG-1520, Revision 2 

Reviewers should note that NFPA 801 uses “administrative control” in a different sense than 

how the term is used in 10 CFR Part 70 and elsewhere in this SRP. In 10 CFR Part 70, an 

administrative control is an IROFS if it is the human action necessary to meet safety 

performance requirements and if it is supported by management measures (e.g., training, QA, 

and procedures) that ensure that the action will be taken if needed. In NFPA 801, 

“administrative controls” refer to the training, qualifications, and procedures behind the human 

action; however, these elements are referred to as “management measures” in 10 CFR Part 70 

and in this SRP. 

For an existing facility, the reviewer may consult with cognizant NRC inspectors to identify and 

resolve any issues related to the licensing review. For a planned facility, the reviewers may 

wish to consult with the facility design team to gain a better understanding of the process, its 

potential hazards, and safety approaches. 

7.5.2.1 Fire-Related Risks and Accident Sequences 

The results of the ISA are the basis for the fire safety evaluation. The reviewer should assess 

the fire risks identified in the ISA summary and ensure that the level of safety is reflected in the 

design and the operational plans for the facility. The reviewer should establish that the 

applicant’s facility design, operations, and IROFS for fire and explosion safety provide 

reasonable assurance that they will function as intended and will provide for the safe handling of 

licensed material at the facility. 

7.5.2.2 Items Relied on for Safety and Management Measures 

The staff reviews the fire and explosion IROFS to ensure their adequacy in protecting against all 

unmitigated sequences identified in the ISA summary. 

If the applicant has applied a graded approach to safety, the reviewer should establish that the 

classification of IROFS or grading of management measures is appropriate and sufficient to 

protect against fire and explosion risks. 

7.5.2.3 Requirements for New Facilities or New Processes at Existing Facilities 

The staff reviews the applicant’s commitments as required to satisfy the BDC in 

10 CFR 70.64(a) for the design of new facilities or new processes at an existing facility that 

require a license amendment under 10 CFR 70.72. 

7.6 Evaluation Findings

The regulations in 10 CFR 70.23 and 10 CFR 70.66, “Additional Requirements for Approval of 

License Application,” state that an application for a license will be approved if the Commission 

can make the general findings listed in those sections. The basis for the general findings is an 

evaluation of whether the application adequately addresses all of the applicable regulatory 

requirements. More specifically, the staff’s evaluation should determine whether the licensing 

submittals provide sufficient information to satisfy the regulatory requirements listed in 

Section 7.4.1 of this SRP and whether the applicant has appropriately addressed the regulatory 

acceptance criteria in SRP Section 7.4.3. The SER should state how the applicable regulatory 

requirements have been met based on the acceptance criteria described in this chapter of the 

SRP. If the applicant chooses to use an alternative approach, the reviewer should discuss in 
June 2015 7-12 NUREG-1520, Revision 2 

the SER whether the proposed approach satisfies the applicable regulatory requirements. The 

reviewers should use the following approach to document their evaluation: 

1. State a specific regulatory requirement that applies to the application. Detailed 

acceptance criteria may be included where appropriate or necessary to clarify the 

requirement. 

2. Identify the areas where the regulatory requirement is addressed in the application, 

including the areas where the specific acceptance criteria described in this SRP are 

addressed. 

3. Describe your evaluation of the application, the basis for your conclusion, and whether 

regulatory requirements are met. 

4. Repeat these steps for every regulatory requirement that applies to the application. 

There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

application or amendment request, (2) denial of the application or request, or (3) approval with 

conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

reviewer may consider proposing a license condition. Absent an NRC order, license conditions 

must be agreed upon with the licensee or applicant before becoming part of the license. 

License conditions should only be proposed if there is reasonable assurance that, if the licensee 

meets the condition, all regulatory requirements will be satisfied. Thus, license conditions 

should not be used to cover major deficiencies in an application. License conditions should be 

unambiguous, inspectable, and enforceable. They should only require those actions necessary 

to ensure compliance with applicable regulations. The basis for license conditions must be 

documented in the SER. 

 

The SER should include summary statements of what was evaluated and the basis for the 

reviewers’ conclusions that are similar to the following: 

 The applicant has established a fire-protection function meeting the acceptance 

criteria in SRP Chapter 7. The function includes a facility safety review 

committee responsible for integrating modifications to the facility and a fire-safety 

manager responsible for day-to-day program implementation. Fire prevention; 

inspection, testing, and maintenance of fire-protection systems; and the 

qualification, drills, and training of facility personnel are in accordance with 

applicable NFPA codes and standards. (Note that SER Section 11.3 describes 

fire-protection training requirements.) 

 The applicant has conducted risk analyses in accordance with NFPA 801. The 

FHAs identified credible fire scenarios that bound the fire risk. The ISA used 

these scenarios and identified fire-protection IROFS (in particular, wet pipe 

sprinkling in the process areas, isolation of the high-temperature equipment 

within fire barriers, and a fire brigade meeting NFPA 600). A memorandum of 

understanding with the fire department documents the required assistance and 

the annual exercises. Procedures are in place to allow the fire department 

efficient access to process areas during fire emergencies. Worker egress is 

designed and maintained in accordance with NFPA 101, “Life Safety Code.” 
June 2015 7-13 NUREG-1520, Revision 2 

 The applicant has demonstrated that it incorporated appropriate fire-safety 

considerations in the design of its facilities. The applicant has also demonstrated that 

the facility has appropriate active fire-protection systems. 

 The staff concludes that the applicant’s submittals provide sufficient information in 

accordance with the requirements of 10 CFR 30.33 and 10 CFR 40.32, both entitled 

“General Requirements for Issuance of Specific Licenses,” and with the requirements of 

10 CFR 70.22 and 10 CFR 70.65 regarding potential fire hazards, consequences, and 

required controls for the proposed processes. The NRC staff determined that the 

applicant demonstrated compliance with the performance requirements of 10 CFR 70.61 

for fire protection related to postulated accident scenarios. The design that the applicant 

proposes also satisfies the requirements of 10 CFR 70.64(a)(3) and the 

defense-in-depth requirements of 10 CFR 70.64(b) (as required).1

7.7 References

U.S. Code of Federal Regulations, “Domestic Licensing of Special Nuclear Material,” Part 70, 

Chapter I, Title 10, “Energy.” 

National Fire Protection Association (NFPA), “Flammable and Combustible Liquids Code,” 

NFPA 30, Quincy, MA, 2008. 

NFPA, “Standard on Explosion Prevention Systems,” NFPA 69, Quincy, MA, 2008. 

NFPA, “National Fire Alarm and Signaling Code,” NFPA 72, Quincy, MA, 2010. 

NFPA, “Standard for Ovens and Furnaces,” NFPA 86, Quincy, MA, 1999. 

NFPA, “Life Safety Code®,” NFPA 101, Quincy, MA, 2007. 

NFPA, “Standard on Types of Building Construction,” NFPA 220, Quincy, MA, 2009. 

NFPA, “Standard on Industrial Fire Brigades,” NFPA 600, Quincy, MA, 2010. 

U.S. Nuclear Regulatory Commission, “Uranium Oxide Fires at Fuel Cycle Facilities,” 

Information Notice 92-14, February 21, 1992. 

U.S. Nuclear Regulatory Commission, “Integrated Safety Analysis Guidance Document,” 

NUREG-1513, May 2001. 

U.S. Nuclear Regulatory Commission, “Nuclear Fuel Cycle Facility Accident Analysis 

Handbook,” NUREG/CR-6410, March 1998. 

 

1

 Add the titles of 10 CFR 70.22, 70.61, and/or 70.65 to this paragraph if this is the first time one of these regulatory 

sections is cited in this chapter of the SER. 

May 2014 8-1 NUREG-1520, Revision 2 

8. EMERGENCY MANAGEMENT 

8.1 Purpose of Review

The purpose of reviewing the applicant’s emergency management plan is to determine if the 

applicant has established, before the start of operations, adequate emergency management 

facilities and procedures to protect workers, the public, and the environment. In preparing its 

emergency plan, the applicant may use either this standard review plan (SRP) or Regulatory 

Guide 3.67, “Standard Format and Content for Emergency Plans for Fuel Cycle and Materials 

Facilities,” issued January 1992. The applicant may provide the information requested for the 

emergency plan once and then cross-reference it in other sections. 

Regulations in Title 10 of the Code of Federal Regulations (10 CFR) 70.22, “Contents of 

Application,” impose a special content requirement on any application to possess (1) enriched 

uranium or plutonium for which a criticality accident alarm system is required, (2) uranium 

hexafluoride in excess of 50 kilograms (kg) (110 pounds (lb)) in a single container or a total of 

1,000 kg (2,200 lb), or (3) plutonium in excess of 2 curies in unsealed form or on foils or plated 

sources. Section 70.22(i) states that such applications must contain either an emergency plan 

or an evaluation showing that the maximum dose to a member of the public due a release of 

radioactive material would not exceed 0.01-sievert (Sv) (1-rem) effective dose equivalent or an 

intake of 2 milligrams (mg) of soluble uranium. 

The baseline design criteria (BDC) of 10 CFR Part 70, “Domestic Licensing of Special Nuclear 

Material,” incorporate emergency capability. The criteria are intended to ensure the control of 

licensed material, the evacuation of personnel, and the availability of emergency facilities. 

8.2 Responsibility for Review

Primary: Emergency Preparedness Specialist 

Secondary: Licensing Project Manager 

Supporting: Regional Emergency Preparedness Inspector 

 ISA Reviewer 

 Fuel Facility Inspection Staff 

8.3 Areas of Review

The U.S. Nuclear Regulatory Commission (NRC) staff should review the applicant’s submittal to 

determine if the special content requirement in 70.22(i) applies. If it does, the emergency 

plan/evaluation should be reviewed using the requirements and guidance specified below to 

determine if the application contains sufficient information to proceed with a detailed review, as 

described in Section 8.3.1 and 8.3.2 below: 

8.3.1 Emergency Plan 

If the applicant submits an emergency plan, the staff should evaluate the emergency plan 

against 10 CFR 70.22(i)(1)(ii), 70.22(i)(3), 70.22(i)(4), and Regulatory Guide 3.67, which 
May 2014 8-2 NUREG-1520, Revision 2 

provides a standard format and content for an emergency plan. Elements in the emergency 

plan to be reviewed include the following: 

1. a facility description (including both onsite and offsite emergency facilities) 

2. the types of accidents 

3. the classification of accidents (alert or site area emergency) 

4. the detection of accidents 

5. the mitigation of consequences 

6. the assessment of releases 

7. the responsibilities of licensee personnel 

8. notification and coordination 

9. information to be communicated and parties to be contacted 

10. training 

11. safe shutdown (recovery and facility restoration) 

12. exercises and drills 

13. certification of compliance with the Emergency Planning and Community Right-to-Know 

Act 

14. comments from offsite response organizations 

8.3.2 Evaluation that No Emergency Plan Is Required 

If the applicant submits an evaluation to demonstrate that an emergency plan is not required, 

the staff should review the information against 10 CFR 70.22(i)(1)(i) and 70.22(i)(2). It should 

be consistent with evaluations in NUREG-1140, “A Regulatory Analysis on Emergency 

Preparedness for Fuel Cycle and Other Radioactive Material Licensees” dated January 1, 1988. 

NUREG/CR-6410, “Nuclear Fuel Cycle Facility Accident Analysis Handbook,” issued 

March 1998, also contains methods considered acceptable for evaluating accidents. Areas 

evaluated should include the following: 

1. a description of the facility 

2. the types of materials used, including both radioactive material and hazardous chemicals 

3. the types of accidents 

4. the detection of accidents 

5. site-specific information used to support the evaluation 

6. an evaluation of the consequences 

Review Interfaces 

In addition to Chapter 8 of the application, the reviewer should examine information in the 

following other areas to ensure that it is consistent with the information in Chapter 8: 

 Review information about the facility, process description, geography, and demographics 

as applied to emergency planning under SRP Chapter 1. 

 Review information on the safety program, ISA commitments, and ISA documentation 

applied to emergency planning under SRP Chapter 3. 

 Review information about radiological releases under SRP Chapter 4. 

 Review information about response to criticality alarms under SRP Chapter 5. 
May 2014 8-3 NUREG-1520, Revision 2 

 Review information about chemical releases under SRP Chapter 6. 

 Review information about fire response under SRP Chapter 7. 

 Review information on configuration management, maintenance, training and 

qualifications, procedures, audits and assessment, incident investigations, record 

management, and other quality assurance elements under SRP Chapter 11. 

8.4 Acceptance Criteria 

8.4.1 Regulatory Requirements 

The regulation at 10 CFR 70.22(i)(1) states when a special content requirement applies to an 

applications. If the requirement applies, the additional content should be reviewed against the 

provisions in 10 CFR 70.22(i)(2) – (i)(4). In addition, 10 CFR 70.64(a)(6) requires some 

applicants to address the control of licensed material, the evacuation of personnel, and the 

availability of emergency facilities for the design of new facilities. 

8.4.2 Regulatory Guidance 

Regulatory guidance for evaluating accidents and preparing an emergency plan includes the 

following sources: 

1. Regulatory Guide 3.67 

2. NUREG-1140 

3. NUREG/CR-6410 

There is no formal guidance for evaluating the baseline design criteria in 10 CFR 70.64(a)(6). 

Reviewers should refer to the acceptance criteria in Section 8.4.3.3. 

8.4.3 Regulatory Acceptance Criteria 

8.4.3.1 Emergency Plan

The reviewer should evaluate the adequacy of the proposed emergency plan against the 

requirements in 10 CFR 70.22(i)(3) and the specific acceptance criteria provided in 

Sections 8.4.3.1.1 through 8.4.3.1.14 of this SRP. The reviewer should find the applicant’s 

emergency plan acceptable if it meets the regulatory requirements and the acceptance criteria 

described below. 

8.4.3.1.1 Facility Description 

The emergency plan should describe the facility and site, the area near the site, and the 

licensed activities. These descriptions should include the following: 

1. a detailed drawing of the site showing the following features: 
May 2014 8-4 NUREG-1520, Revision 2 

a. onsite and near offsite (within 1.61 kilometers (km) (1 mile (mi))) structures with 

building numbers and labels 

b. roads and parking lots onsite and main roads near the site 

c. site boundaries showing fences and gates 

d. major site features 

e. water bodies within approximately 1.61 km (1 mi) 

2. a general area map covering a radius of approximately 16.1 km (10 mi), a 

U.S. Geological Survey topographical quadrangle (71⁄2-minute series, including the 

adjacent quadrangle(s) if the site is located less than 1.61 km (1 mi) from the edge of the 

quadrangle), and a map or aerial photograph indicating onsite and near-site structures 

within a radius of approximately 1.61 km (1 mi)1

3. stack heights, typical stack flow rates, and efficiencies of any emission control devices 

4. a general description of licensed and other major activities conducted at the facility and 

the type, form, and quantities of radioactive and other hazardous materials that are 

normally onsite, by location (use and storage) and building, and hazardous 

characteristics (exposure rates, pH, temperature, and other characteristics) that are 

important to emergency management. 

5. description of the area near the site. On maps or photographs, indicate the following: 

a. locations of population centers (towns, cities, office buildings, factories, schools, 

arenas, stadiums, etc.) 

b. locations of facilities that could present potential protective action problems 

(schools, arenas, stadiums, prisons, nursing homes, hospitals) 

c. identification of primary routes for access of emergency equipment or for 

evacuation, as well as potential impediments to traffic flow (rivers, draw bridges, 

railroad crossings, etc.) 

d. locations of fire stations, police stations, hospitals, and other emergency support 

organizations 

e. the sites of potential emergency significance (liquefied petroleum gas terminals, 

chemical plants, pipelines, electrical transformers, and underground cables) 

f. identification of the types of terrain and the land-use patterns around the site. 

 

 

1

 The map should include the location of sensitive facilities near the site, such as hospitals, schools, nursing homes, 

nearest residents, fire departments, prisons, environmental sampling locations, and other structures and facilities 

that are important to emergency management.
May 2014 8-5 NUREG-1520, Revision 2 

8.4.3.1.2 Onsite and Offsite Emergency Facilities 

The emergency plan should list and describe onsite and offsite facilities that could be relied on 

in an emergency. The emergency plan should include the following: 

1. a list and description of both onsite and offsite emergency facilities, by location and 

purpose 

2. a description of emergency monitoring equipment that is available for personnel and 

area monitoring and for assessing the release to the environment of radioactive or 

hazardous chemicals incident to the processing of licensed material 

3. a description of the onsite and offsite services that support emergency response 

operations, including the following: 

a. decontamination facilities 

b. medical treatment facilities 

c. first-aid personnel 

d. fire fighters 

e. law enforcement assistance 

f. ambulance services 

8.4.3.1.3 Types of Accidents 

For each general type of accident identified in the ISA summary for which protective actions 

may be needed, the emergency plan should describe the following: 

1. the process and physical location(s) where the accidents could occur 

2. complicating factors and possible onsite and offsite consequences, including releases of 

nonradioactive hazardous chemicals incident to the processing of licensed material that 

could impact emergency response efforts 

3. the accident sequence that has the potential for the greatest radiological or toxic 

chemical impact 

4. figure(s) projecting doses and toxic substance concentrations as a function of distance 

and time for various meteorological stability classes, including a description of how the 

applicant projected such doses or concentrations (e.g., computer models and 

assumptions) 

8.4.3.1.4 Classification of Accidents 

The emergency plan should classify accidents as follows: 

1. The emergency plan classification system should include the following two 

classifications: 
May 2014 8-6 NUREG-1520, Revision 2 

a. Alert: Events that may occur, are in progress, or have occurred that could lead to 

a release of radioactive material or hazardous chemicals incident to the 

processing of licensed material; however, the release is not expected to require a 

response by an offsite response organization to protect persons offsite. 

b. Site area emergency: Events that may occur, are in progress, or have occurred 

that could lead to a significant release of radioactive material or hazardous 

chemicals incident to the processing of licensed material and that could require a 

response by offsite emergency response organizations to protect persons offsite. 

2. The emergency plan should identify the classification (alert or site area emergency) 

expected for each accident identified in the emergency plan. 

3. The emergency plan should specify emergency action levels (EALs) at which an alert or 

site area emergency will be declared. EALs are specific conditions that require the 

performance of emergency response measures. The applicant’s EALs should be 

consistent with Appendix A to Regulatory Guide 3.67 and should be comparable to the 

U.S. Environmental Protection Agency (EPA) Protective Action Guides described in 

EPA 400-R-92-001, “Manual of Protective Action Guides and Protective Actions for 

Nuclear Incidents,” issued May 1992. Transportation accidents more than 1.61 km 

(1 mi) from the facility should not be classified. 

4. The emergency plan should designate the personnel positions and alternates with the 

responsibility for accident classification during normal operations and back shifts. 

8.4.3.1.5 Detection of Accidents 

For each type of accident identified, the emergency plan should describe the following: 

1. the means of detecting the accident 

2. the means of detecting any release of radioactive material or hazardous chemicals 

incident to the processing of licensed material 

3. the means of alerting the operating staff 

4. the anticipated response of the operating staff 

8.4.3.1.6 Mitigation of Consequences 

For each accident identified in the ISA summary, the emergency plan should briefly describe 

measures and equipment to be used for safe shutdown and the mitigation of consequences to 

workers onsite and offsite and to the public offsite. 

8.4.3.1.7 Assessment of Releases 

The emergency plan should describe the following aspects of the applicant’s procedures to be 

used to promptly and effectively assess the release of radioactive material or hazardous 

chemicals incident to the processing of licensed material: 
May 2014 8-7 NUREG-1520, Revision 2 

1. procedures for estimating or measuring the release rate or source term 

2. valid computer codes used to project doses or concentrations to the public or 

environment and their associated assumptions, along with adequate justifications to 

show the validity of the assumptions 

3. types, methods, frequencies, implementation times, and other details of onsite and 

offsite sampling and monitoring that will be performed to assess a release of radioactive 

materials or hazardous chemicals incident to the processing of licensed material 

4. the method for assessing collateral damage to the facility (especially items relied on for 

safety) 

The emergency plan should describe the applicant’s procedure for validating any code used to 

assess releases of radioactive material or hazardous chemicals incident to the processing of 

licensed material. 

8.4.3.1.8 Responsibilities 

The emergency plan should describe the emergency response organization and administration 

that ensure effective planning, implementation, and control of emergency preparedness 

activities. Reviewers should evaluate whether the description addresses the following issues: 

1. Procedures clearly define the organizational structure and chain of command. 

2. Staffing and resources are sufficient to accomplish all assigned tasks. 

3. Procedures clearly define responsibilities and authority for each management, 

supervisory, and professional position. Responsibility is assigned for the coordination of 

onsite and offsite emergency response preparedness. 

4. Procedures clearly define interfaces with supporting groups, both onsite and offsite. 

5. Mutual cooperation agreements exist or will be entered into with local agencies, such as 

fire, police, ambulance and rescue, and medical units. 

6. Plant management measures audit and assess emergency preparedness to ensure site 

readiness to handle emergencies and to identify and correct problems. 

7. 

The onsite emergency response organization provides effective command and control of the 

site during the assessment, mitigation, and recovery phase of an accident. 

8. A system provides timely information to the media and public on subjects that would be 

discussed during an emergency, such as radiation hazards, chemical hazards, site 

operation, and site emergency plans. 

9. Emergency preparedness procedures are available to support startup and operation of 

new processes and facilities onsite. 
May 2014 8-8 NUREG-1520, Revision 2 

8.4.3.1.9 Notification and Coordination 

A. The emergency plan should provide reasonable assurance that emergency notification 

procedures will enable the emergency organization to correctly classify emergencies, 

notify emergency response personnel, and initiate or recommend appropriate actions in 

a timely manner, on the basis of the following: 

1. A commitment to and a brief description of the means to promptly notify offsite 

response organizations and request offsite assistance, including medical 

assistance for the treatment of contaminated injured onsite workers when 

appropriate. 

2. A commitment to establish a control point. 

3. Emergency action levels are established to quickly classify events. 

4. Notification procedures include concise, preformatted messages. 

5. Information on the nature and magnitude of the hazards is made available to the 

appropriate emergency response personnel. 

6. Radiological and chemical source term data are made available to offsite 

response organizations and the NRC. 

7. Recommendations for protective actions offsite have been prepared using 

Protective Action Guides and will be communicated with the initial notification to 

offsite response organizations. 

8. A system is established to provide the public with timely information. 

9. The notification and coordination is planned so that unavailability of some 

personnel, parts of the facility, and some equipment will not prevent the 

notification and coordination. The licensee commits to notify the NRC operations 

center immediately after notification of the appropriate offsite response 

organizations and not later than one hour after the licensee declares an 

emergency. 

B. The emergency plan should describe who will take the following actions and how he or 

she will act promptly and effectively: 

1. the decision to declare an alert or site area emergency 

2. the activation of the onsite emergency response organization during all shifts 

3. the prompt notification of offsite response authorities that an alert or site area 

emergency has been declared, including the licensee’s initial recommendation 

for offsite protective actions (normally within 15 minutes of classification) 

4. the notification to the NRC Operations Center (as soon as possible and, in any 

case, no later than 1 hour after a declared emergency) 
May 2014 8-9 NUREG-1520, Revision 2 

5. the decision regarding which onsite protective actions to initiate 

6. the decision regarding which offsite protective actions to recommend 

7. the decision to request support from offsite organizations 

8. the decision to terminate the emergency or enter recovery mode 

8.4.3.1.10 Information To Be Communicated 

The emergency plan should describe the information to be communicated during an emergency, 

including the following: 

1. a standard reporting checklist to facilitate timely notification 

2. the types of information to be provided concerning facility status, radioactive releases or 

hazardous chemicals incident to the processing of licensed material, and protective 

action recommendations 

3. a description of preplanned protective action recommendations to be made to each 

appropriate offsite organization 

4. the offsite officials to be notified as a function of the classification of the event 

5. the recommended actions to be taken by offsite organizations for each accident treated 

in the emergency plan 

8.4.3.1.11 Training 

The emergency plan should describe the frequency, performance objectives, and plans for the 

emergency response training that the licensee will provide to workers. The plan should 

describe the following: 

1. the topics and general content of training programs for the licensee’s onsite and offsite 

emergency response personnel to satisfy the objectives described above 

2. the administration of the training program, including responsibility for training, the 

positions to be trained, the schedules for training, the frequency of retraining, the use of 

team training, and the estimated number of hours of initial training and retraining 

3. the training to be provided on the use of protective equipment, such as respirators, 

protective clothing, monitoring devices, and other equipment used in emergency 

response 

4. the training program for onsite personnel who are not members of the emergency 

response staff 

5. any special instructions and orientation tours that the licensee would offer to fire, police, 

medical, and other nonlicensee emergency personnel who may be required to respond 
May 2014 8-10 NUREG-1520, Revision 2 

to an emergency to ensure that they know the emergency plan, assigned duties, and 

effective response to an actual emergency 

8.4.3.1.12 Safe Shutdown (Recovery and Facility Restoration) 

The emergency plan should describe the following aspects of the applicant’s plans for 

adequately restoring the facility to a safe status after an accident and recovery after an 

emergency: 

1. the methods and responsibilities for assessing the damage to and status of the facility’s 

capabilities to safely control radioactive material or hazardous chemicals associated with 

the process 

2. the procedures for promptly determining the actions necessary to reduce any ongoing 

releases of radioactive material or hazardous chemicals incident to the processing of 

licensed material and to prevent further incidents 

3. the provisions for promptly and effectively accomplishing required restoration actions 

4. key positions in the recovery organization including the person responsible for compiling 

evaluating, and retaining records associated with the incident. 

8.4.3.1.13 Exercises and Drills 

The emergency plan should state the applicant’s commitment to conduct exercises and drills to 

test the adequacy of implementing procedures and emergency equipment, and to ensure that 

emergency personnel are familiar with their duties. An adequate plan should describe 

provisions for the following objectives: 

1. Qualified individuals for each position in the emergency response organization 

demonstrate task-related knowledge through periodic participation. 

2. Drill performance is assessed against specific scenario objectives using postulated 

accidents that adequately test personnel, equipment, and resources, including 

previously identified weaknesses. 

3. Effective player, controller, evaluator, and observer predrill briefings are conducted. 

4. Scenario data and exercise messages provided by the controllers effectively maintain 

the timeline and do not interfere with the emergency organization’s response to exercise 

scenario events, except where safety considerations are involved. 

5. Trained evaluators are used to identify and record participant performance, scenario 

strengths and deficiencies, and equipment problems. 

6. The prestaging of equipment and personnel is minimized to realistically test the 

activation and staffing of emergency facilities. 

7. Critiques are conducted promptly and include a followup plan for correcting any 

identified weaknesses and improving training effectiveness. 
May 2014 8-11 NUREG-1520, Revision 2 

8. Emergency drills demonstrate that resources are effectively used to control the site, 

mitigate further damage, control radiological releases, perform required onsite activities 

under simulated radiation/airborne and other emergency conditions, accurately assess 

the facility’s status during an accident, and initiate recovery. 

9. Emergency drills demonstrate personnel protection measures, including controlling and 

minimizing hazards to individuals during fires, medical emergencies, mitigation activities, 

search and rescue, and other similar events. 

10. The emergency drills demonstrate that onsite communications effectively support 

emergency response activities. 

11. The emergency drills demonstrate that the emergency organization provides the public 

with accurate, reliable, timely, and understandable information. 

12. Provisions are made for conducting quarterly communications checks with offsite 

response organizations. 

13. Offsite organizations are invited to participate in the biennial onsite exercise, which tests 

the major elements of the emergency plan and response organizations. 

14. Certification by the plant manager (or the individual authorized by the applicant) that the 

applicant has met all responsibilities under the Emergency Planning and Community 

Right To Know Act of 1986, Title III, Public Law 99-499, in accordance with 

10 CFR 70.22(i)(3)(xiii) 

8.4.3.1.14 Responsibilities for Developing and Maintaining the Emergency Program and Its 

Procedures 

The emergency plan should describe the following aspects of the responsibilities for developing 

and maintaining the emergency program and its procedures: 

1. the means for ensuring that revisions to the emergency plan and the procedures used to 

implement the emergency plan are adequately prepared, kept up to date (normally within 

30 days of any changes), and distributed to all affected parties, including the NRC 

2. the provisions for approving the implementing emergency procedures, making and 

distributing changes to the procedures, and ensuring that each person responsible for an 

emergency response function has immediate access to a current copy of the emergency 

procedures 2

3. procedures for allowing offsite response organizations 60 days to comment on an 

emergency plan before it is submitted to the NRC. Any comments received within the 60 

days shall be provided to NRC with the emergency plan. 

 

2

 Provisions for approving changes to the emergency plan and the procedures and the individuals authorized to 

make those changes should be clearly stated.
May 2014 8-12 NUREG-1520, Revision 2 

8.4.3.2 Evaluation that No Emergency Plan Is Required 

The staff should review the adequacy of the evaluation that no emergency plan is required 

against the 10 CFR 70.22(i)(1)(i) and 10 CFR 70.22(i)(2) requirements, and the acceptance 

criteria given below. 

8.4.3.2.1 Facility Description 

The evaluation should describe the facility and site, the area near the site, and the licensed 

activities conducted at the facility. To be considered sufficient to support the evaluation, these 

descriptions should include the following: 

1. a detailed drawing of the site showing (1) onsite and near offsite (within 1.61 km (1 mi)) 

structures, with building numbers and labels; (2) roads and parking lots onsite and main 

roads near the site; (3) site boundaries, including fences and gates; (4) major site 

features, (5) water bodies within approximately 1.61 km (1 mi); and (6) the location(s) of 

the nearest residents 

2. the stack heights, typical stack flow rates, and efficiencies of any emission control 

devices 

3. a general description of licensed and other major activities conducted at the facility and 

the type, form, and quantities of radioactive material used 

8.4.3.2.2 Types of Accidents 

The evaluation should describe each type of accident that has maximum offsite consequences 

that exceed the limit specified in 10 CFR 70.22(i)(1)(i). In addition, the following information 

should be available for review: 

1. the process and physical location where the accident could occur 

2. complicating factors and offsite consequences, including the release of nonradioactive 

hazardous chemicals incident to the processing of licensed material 

3. the accident sequence that has the potential for the greatest radiological and toxic 

chemical impact 

8.4.3.2.3 Detection of Accidents 

To support the use of factors such as engineered safety features and operating procedures, the 

evaluation should describe the following: 

1. the means of detecting the accident 

2. the means of detecting any release of radioactive or hazardous chemicals incident to the 

processing of licensed material 

3. the means of alerting the operating staff 
May 2014 8-13 NUREG-1520, Revision 2 

4. the anticipated response of the operating staff 

8.4.3.2.4 Evaluation of Maximum Public Exposure 

In addition to the information discussed above, the evaluation should make available the 

following information sufficient to allow for independent verification: 

1. the maximum source term 

2. the solubility of material 

3. the facility design or items relied on for safety and the proposed release fraction 

4. the location and distance of the nearest member of the public to the facility 

5. the dose model and process used to verify the reliability of the model and the validity of 

the assumptions 

6. the assumed worst case weather condition 

7. the maximum calculated exposure to a member of the public at the facility boundary 

The evaluation should list and describe the factors in 10 CFR 70.22(i)(2) that the applicant 

considered in evaluating the maximum dose to members of the public. The applicant should 

demonstrate why the factors used in the evaluation are appropriate when compared with the 

factors in NUREG-1140. If the factors and evaluation show that the maximum dose to a 

member of the public offsite from a release of radioactive materials could not exceed a 0.01-Sv 

(1-rem) effective dose equivalent or the intake of 2 mg of soluble uranium, no emergency plan is 

required in accordance with 10 CFR 70.22(i)(1)(i). 

8.4.3.3 Requirements for New Facilities or New Processes at Existing Facilities 

The application should address the BDC for new facilities or new processes at existing facilities 

that require a license amendment under 10 CFR 70.72, “Facility Changes and Change 

Process.” Regulations in 10 CFR 70.64(a) state that the BDC must be applied to the design of 

new processes but do not require retrofits to existing facilities or existing processes; however, 

all facilities and processes must comply with the performance requirements in 10 CFR 70.61, 

“Performance Requirements.” In accordance with 10 CFR 70.64(a)(6)(i-iii), the licensee or 

applicant must show that the design of the facility or process provides for the emergency 

capability to maintain control of the following: 

1. licensed material and hazardous chemicals produced from licensed material. In this 

regard, an application should include: 

a. how the facility design prevents or mitigates releases during an emergency 

b. how the facility design helps licensee emergency workers (fire brigades, etc.) 

respond to emergencies 
May 2014 8-14 NUREG-1520, Revision 2 

2. evacuation of onsite personnel. In this regard, an application should includethe criteria 

used in designing the facility to allow personnel to evacuate (e.g., time, dose, and ease 

of egress). 

3. onsite emergency facilities and services that facilitate the use of available offsite 

services. In this regard, an application should include: 

a. the offsite services that will be needed in an emergency at the facility 

b. the criteria used to design the facility to detect accidents 

c. the criteria used to design the facility to alert facility staff of an accident 

d. the criteria used to design the facility to notify and coordinate with both onsite and 

offsite personnel 

e. the criteria used to design the facility to allow for the transportation of injured 

personnel to onsite and offsite medical facilities 

10 CFR 70.64(b) states that facility and system design must be founded on defense-in-depth 

practices and must incorporate, to the extent practicable: (1) preference for engineered controls 

over administrative controls and (2) reduction of challenges to IROFS. Thus, facility and system 

designs relying only on administrative controls, or relying on IROFS that are frequently or 

continuously challenged, are not acceptable, unless the application provides a justification 

showing that alternatives to achieve the design criteria are not practicable. 

8.5 Amendments or Changes to the Emergency Plan

The applicant may make changes to the approved emergency plan without NRC approval if the 

changes do not decrease the effectiveness of the plan and the applicant submits copies of the 

changes to the NRC and appropriate organizations within 6 months of making the changes in 

accordance with 10 CFR 70.32(i). The applicant may not implement proposed changes that 

decrease the effectiveness of the emergency plan without prior application to and approval of 

the NRC. 

8.6 Review Procedures

8.6.1 Acceptance Review 

During the acceptance review of a license application, the reviewer should examine the 

submittals to identify major deficiencies in the information provided for each area of review 

specified in SRP Section 8.3. Reviewers must decide whether they have enough information to 

proceed with a detailed review. Less significant errors or deficiencies that can be addressed in 

a request for additional information should be accepted. However, before the NRC performs a 

detailed review, the applicant should correct major deficiencies that would require several 

requests for additional information to resolve. 
May 2014 8-15 NUREG-1520, Revision 2 

Reviewers should record whether each area of review is adequately addressed in the 

application, is adequately addressed in a referenced document, is not applicable to the 

application, or has a major deficiency. 

8.6.2 Safety Evaluation 

After determining that the application is acceptable for review in accordance with Section 8.6.1 

above, the primary reviewer should perform a safety evaluation against the acceptance criteria 

described in Section 8.4 above. During the initial review, the reviewer should draft the safety 

evaluation report (SER) described below. A request for additional information (RAI) will be 

prepared when clarification and additional information are needed to determine whether the 

licensee’s submittals comply with the regulations. The primary reviewer should coordinate with 

the licensing project manager in preparing RAIs. Additional information submitted by the 

applicant will be evaluated and a final SER will be provided to the licensing project manager. 

8.6.2.1 Emergency Plan 

After the NRC staff receives an acceptable application from the applicant, the primary reviewer 

should conduct a complete review of the applicant’s emergency plan and assess its 

acceptability in accordance with Section 8.4.3.1 above. The reviewer should verify that 

emergency planning is consistent with the potential accident sequences described in the 

ISA summary. The ISA summary reviewer and emergency plan reviewer should coordinate 

their efforts to ensure the resolution of any issues concerning the emergency plan relative to 

ISA summary information. 

Although the section of the licensee’s submittal entitled “Emergency Management Program” 

should contain the bulk of this information, the primary and secondary reviewers should gain 

familiarity with the site, including its demography, land use, facility design and layout, and major 

accidents postulated by the applicant, as presented in relevant sections of the application. The 

primary and secondary reviewers should also become familiar with proposed radiation 

protection activities and other operational matters that interface with emergency plans 

(particularly the functions reviewed using SRP Chapters 4 and 11). The reviewers should 

consult draft and final environmental statements for the proposed facility. This information may 

be supplemented by a personal visit to the site by the reviewer and meetings with the applicant. 

As the final step, the primary reviewer should prepare a safety evaluation report (SER) section 

in accordance with Section 8.7 below. 

8.6.2.2 Evaluation that No Emergency Plan Is Required 

The primary reviewer should verify that the evaluation is consistent with the potential accident 

sequences described in the ISA summary, historical information in NUREG-1140 and guidance 

in NUREG/CR-6410. The ISA summary reviewer and the primary reviewer should coordinate 

their efforts to ensure the resolution of any issues concerning the evaluation relative to ISA 

information. Significant concerns with the evaluation should be raised early to allow the 

applicant to resolve the issues or submit an emergency plan. As the final step, the primary 

reviewer should prepare an SER section in accordance with SRP Section 8.7 below. 
May 2014 8-16 NUREG-1520, Revision 2 

8.7 Evaluation Findings

The regulations in 10 CFR 70.23, “Requirements for the Approval of Applications,” and 70.66, 

“Additional Requirements for Approval of License Application,” state that an application for a 

license will be approved if the Commission can make the general findings listed in those 

sections. The basis for the general findings is an evaluation of whether the application 

adequately addresses all of the applicable regulatory requirements. More specifically, the staff’s 

evaluation should determine whether the licensing submittals provide sufficient information to 

satisfy the regulatory requirements listed in Section 8.4.1 of this SRP and whether the applicant 

has appropriately addressed the regulatory acceptance criteria in SRP Section 8.4.3. The SER 

should state how the applicable regulatory requirements have or have not been met based on 

the acceptance criteria described in this chapter of the SRP. If the applicant chooses to use an 

alternative approach, the reviewer should discuss in the SER whether the proposed approach 

satisfies the applicable regulatory requirements. The reviewers should use the following 

approach to document their evaluation: 

1. State a specific regulatory requirement that applies to the application. Detailed 

acceptance criteria may be included where appropriate or necessary. 

2. Identify the areas where the regulatory requirement is addressed in the application, 

including the areas where the specific acceptance criteria described in this SRP are 

addressed. 

3. Describe your evaluation of the application, the basis for your conclusion, and whether 

regulatory requirements are met. 

4. Repeat these steps for every regulatory requirement that applies to the application. 

There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

application or amendment request, (2) denial of the application or request, or (3) approval with 

conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

reviewer may consider proposing a license condition. Absent an NRC order, license conditions 

must be agreed on with the licensee or applicant before becoming part of the license. A license 

condition should only be proposed if there is reasonable assurance that, if the licensee meets 

the condition, all regulatory requirements will be satisfied. Thus, license conditions should not 

be used to cover major deficiencies in an application. License conditions should be 

unambiguous, inspectable, and enforceable. They should only require those actions necessary 

to ensure compliance with applicable regulations. The basis for license conditions must be 

documented in the SER.

The report includes a summary statement describing what was evaluated and why the reviewer 

finds the submittal acceptable that is similar to one of the following statements: 

The staff has evaluated the application dated [insert dates including any 

supplements]. The requested possession limits are less than the threshold 

quantities specified in 10 CFR 70.22(i). Therefore, neither an emergency plan 

nor an evaluation of the dose to a member of the public from a release of 

radioactive material is required. 

OR 
May 2014 8-17 NUREG-1520, Revision 2 

The staff has evaluated the application dated [insert dates including any 

supplements]. Based on it review of the evaluation as documented above, the 

staff finds that the evaluation meets the requirement in 10 CFR 70.22(i)(1)(i) and 

is acceptable. Specifically, the evaluation demonstrates that the dose to a 

member of the public from a release of radioactive material would not exceed 1 

rem effective dose equivalent or an intake of 2 milligrams of soluble uranium. 

Therefore, no emergency plan is required. 

OR 

The staff has evaluated the application dated [insert dates including any 

supplements]. Based on its review of the emergency plan as documented 

above, the staff finds that it meets the requirements on 10 CFR 70.22(i) and 10 

CFR 70.32(i); and therefore, the plan is acceptable. 

8.8 References

U.S. Code of Federal Regulations, “Domestic Licensing of Special Nuclear Material,” Part 70, 

Chapter I, Title 10, “Energy.” 

U.S. Environmental Protection Agency, “Manual of Protective Action Guides and Protective 

Actions for Nuclear Incidents,” EPA 400-R-92-001, Washington, DC, May 1992. 

U.S. Nuclear Regulatory Commission, “Emergency Preparedness for Fuel Cycle and Other 

Radioactive Material Licensees, Final Rule” Federal Register, Vol. 54, No. 66, April 7, 1989, 

pp. 14051–14059 (54 FR 14051). 

U.S. Nuclear Regulatory Commission, “Response Technical Manual (RTM) 96,” 

NUREG/BR-0150, Vol. 1, Revision 4, March 1996. 

U.S. Nuclear Regulatory Commission, “A Regulatory Analysis on Emergency Preparedness for 

Fuel Cycle and Other Radioactive Material Licensees,” NUREG-1140, August 1991. 

U.S. Nuclear Regulatory Commission, “Nuclear Fuel Cycle Accident Analysis Handbook,” 

NUREG/CR-6410, March 1998. 

June 2015 9-1 NUREG-1520, Revision 2 

9. ENVIRONMENTAL PROTECTION 

9.1 Purpose of Review

The purpose of this review is to determine whether the applicant’s proposed 

environmental-protection measures are adequate to protect the environment and public health 

and safety and to comply with the regulatory requirements imposed by the U.S. Nuclear 

Regulatory Commission (NRC) in Title 10 of the Code of Federal Regulations (10 CFR) Part 20, 

“Standards for Protection against Radiation,” and 10 CFR Part 70, “Domestic Licensing of 

Special Nuclear Material.” If the environmental-protection information of the safety evaluation 

report (SER) is to be used in the preparation of an environmental document pursuant to the 

separate requirements of the National Environmental Policy Act (NEPA) and under the 

requirements of 10 CFR Part 51, “Environmental Protection Regulations for Domestic Licensing 

and Related Regulatory Functions,” the staff preparing the NEPA document is responsible for 

independently evaluating whether the information in the SER can also to be used for that 

independent purpose. 

Accordingly, this chapter does not address the specific requirements of 10 CFR Part 51. 

NUREG-1748, “Environmental Review Guidance for Licensing Actions Associated with NMSS 

Programs,” issued August 2003, which provides general procedures for the environmental 

review of licensing actions regulated by the Office of Nuclear Material Safety and Safeguards 

(NMSS). The staff of the Division of Fuel Cycle Safety, Safeguards, and Environmental Review 

(FCSE) should coordinate the preparation of an environmental assessment (EA) and finding of 

no significant impact (FONSI) or an environmental impact statement (EIS) with the 

Environmental Review Branch in FCSE. If the licensee proposes that a requested action is a 

categorical exclusion under the provisions of 10 CFR 51.22, “Criterion for Categorical Exclusion; 

Identification of Licensing and Regulatory Actions Eligible for Categorical Exclusion or 

Otherwise Not Requiring Environmental Review,” the FCSE staff should confirm that the action 

meets the applicable criteria in 10 CFR 51.22(c). 

9.2 Responsibility for Review

Primary: Environmental Engineer/Scientist 

Secondary: Licensing Project Manager 

Supporting: Fuel Cycle Facility Inspector 

 Radiation Safety Reviewer 

 Integrated Safety Analysis (ISA) Primary Reviewer 

 Fire Protection Reviewer 

 Criticality Safety Reviewer 

Chemical Safety Reviewer 

NEPA Reviewer or Project Manager 

9.3 Areas of Review

The environmental safety program should address the environmental protection measures, 

including the control and monitoring of gaseous and liquid effluents and the management of 

solid waste. The environmental program should also provide for the monitoring of the facility 
June 2015 9-2 NUREG-1520, Revision 2 

environment, including ambient air, surface water, ground water, soils, and vegetation that can 

be affected by facility effluents. This SRP chapter addresses the areas of review for 

environmental protection measures, and for environmental monitoring measures, which should 

be contained in Chapter 9 of the application. Although information regarding environmental 

monitoring may be used by the staff as part of a larger set of information considered in the 

preparation of an EIS, this SRP chapter is not intended to satisfy the independent information 

needs of the staff to prepare an EIS or EA under the separate requirements of NEPA. The 

Environmental Project Manager or designee should coordinate its review with the FCSE safety 

and safeguards reviewer to assure consistency of their respective reviews and information 

needs from the applicant (e.g., RAIs). 

If the application includes an ISA summary as required by Subpart H, “Additional Requirements 

for Certain Licensees Authorized To Possess a Critical Mass of Special Nuclear Material,” of 

10 CFR Part 70, the environmental reviewer will review the ISA summary accident sequences 

that could result in high or intermediate consequences to an individual located outside the 

controlled area or that could result in a 24-hour averaged release of radioactive material outside 

the restricted area in concentrations exceeding 5,000 times the values in Table 2 of Appendix B, 

“Annual Limits on Intake (ALIs) and Derived Air Concentrations (DACs) of Radionuclides for 

Occupational Exposure; Effluent Concentrations; Concentrations for Release to Sewerage,” to 

10 CFR Part 20. Section 9.3.2.3 below addresses areas of review for the ISA summary specific 

to environmental protection. 

The regulatory requirements for environmental protection appear in 10 CFR Part 20 and 

10 CFR Part 70. The NRC staff focuses its environmental review on that part of the plant wide 

safety program that the applicant establishes to control and assess the level of radioactive and 

nonradioactive releases (gaseous, liquid, and solid) to the environment. Therefore, the staff 

reviews the effluent control portion of the applicant’s radiation protection program and the 

applicant’s effluent and environmental monitoring practices from a safety, not NEPA-related, 

perspective. 

If the application is for authorization to perform an activity identified in 10 CFR 70.60, then an 

applicant must also perform an ISA and prepare an ISA summary in accordance with Subpart H 

of 10 CFR Part 70. SRP Chapter 3 presents guidance on the ISA. The environmental safety 

review of the ISA summary will examine the identified potential accident sequences that result in 

radiological and non-radiological releases to the environment, the items relied on for safety 

(IROFS) that the applicant specifies to reduce the environmental risk of those accidents, and the 

associated management measures that provide reasonable assurance that the IROFS will 

perform their designated safety functions. It is critical for SRP Chapter 3 to specify that offsite 

impacts of accidents have been considered in its evaluation and to provide an assessment of 

those impacts, if any. The environmental-specific information in Chapter 3 is to be used to 

support the review for Section 9.3.2 below. 

Thus, environmental protection encompasses three main components, as necessary: 

(1) effluent and environmental controls and monitoring, (2) the ISA summary and other 

ISA documentation as described in Sections 9.3.1 and 9.3.2 below, and (3) management 

measures in the license application. 
June 2015 9-3 NUREG-1520, Revision 2 

9.3.1 Effluent and Environmental Controls and Monitoring 

A. The staff’s review of the environmental radiation protection program described in the 

application encompasses the following areas: 

1. as low as reasonably achievable (ALARA) goals for effluent control 

2. effluent controls to maintain public doses ALARA 

3. ALARA reviews and reports to management 

4. waste minimization practices and, for new operations, design plans for waste 

minimization

B. The staff’s review of the applicant’s effluent and environmental monitoring program 

described in the application encompasses the following areas: 

1. in-place filter-testing procedures for air-cleaning systems 

2. known or expected concentrations of radionuclides in effluents 

3. physical and chemical characteristics of radionuclides in discharges 

4. discharge locations 

5. environmental media to be monitored and the sample locations 

6. sampling collection and analysis procedures, including the minimum detectable 

concentrations of radionuclides 

7. action levels and actions to be taken when the levels are exceeded 

8. permits, including air discharge and National Pollutant Discharge Elimination 

System permits 

9. leak detection systems for ponds, lagoons, and tanks 

10. pathways analysis methods to estimate public doses 

11. recording and reporting procedures 

12. solid waste handling and disposal programs 

9.3.2 Integrated Safety Analysis Summary 

The staff’s review of the applicant’s ISA summary related to environmental protection includes 

the following areas: 

1. accident sequences (and associated facility processes) that, if unmitigated, would result 

in releases to the environment 
June 2015 9-4 NUREG-1520, Revision 2 

2. likelihood and environmental consequences of these accident sequences 

3. controls relied on to reduce the unmitigated risk from high or intermediate risk to an 

acceptable level 

4. availability and reliability of controls 

9.3.3 Environmental Protection Management Measures 

The staff’s review of the applicant’s management measures related to environmental protection 

includes the following areas: 

1. a method for grading management measures commensurate with the reduction in risk 

attributable to each control or control system 

2. a commitment to design, implement, and maintain the controls and control systems to 

ensure that they are available and reliable to perform their functions when needed 

Review Interfaces 

In addition to the information contained in Chapter 9 of the application, the environmental 

reviewer should also examine information in the following other areas to ensure that it is 

consistent with the information in Chapter 9. Note that the staff assessment of the information 

identified below is to be found in the respective chapters of the SER, not in Chapter 9: 

 facility and process descriptions applied to environmental protection as described in 

SRP Chapter 1 

 the safety program, ISA commitments, and ISA documentation applied to environmental 

protection as described in SRP Chapter 3 

 the radiation safety program as described in SRP Chapter 4 

 chemical processes applied to environmental protection as described in SRP Chapter 6 

 fire-initiated accident sequences that have the potential to result in high or intermediate 

consequences as described in SRP Chapter 7 

 configuration management, maintenance, training and qualifications, procedures, audits 

and assessments, incident investigations, record management, and other quality 

assurance elements as described in SRP Chapter 11

 

1

 Section 9.3.3 addresses areas of review for management measures applied to environmental protection. 
June 2015 9-5 NUREG-1520, Revision 2 

9.4 Acceptance Criteria

Sections 9.4.3.1 through 9.4.3.3 describe acceptance criteria for the effluent and environmental 

controls and monitoring, the ISA summary, and management measures. If the acceptance 

criteria for the other sections of the SER have been met, then the information is also acceptable 

under Chapter 9. 

9.4.1 Regulatory Requirements 

To be considered acceptable, the application must satisfy the following regulatory requirements 

for environmental protection: 

1. Subpart B, “Radiation Protection Programs”; Subpart D, “Radiation Dose Limits for 

Individual Members of the Public”; and Subpart F, “Surveys and Monitoring,” of 10 CFR 

Part 20 specify the effluent control and treatment measures necessary to meet the dose 

limits and dose constraints for members of the public. Subpart F also states the survey 

requirements. Subpart K, “Waste Disposal,” specifies the waste disposal requirements; 

Subpart L, “Records,” specifies the records requirements; and Subpart M, “Reports,” 

specifies the reporting requirements. 

2. 10 CFR 70.21(f) requires that an application for an activity which the Commission has 

determined requires an EIS, listed in 10 CFR 51.20, must be accompanied by an 

Environmental Report required under Subpart A of part 51. The application must be filed 

at least 9 months prior to commencement of construction, as defined in 10 CFR 70.4. 

3. 

4. 10 CFR Part 70 requires the applicant to demonstrate that proposed facilities and 

equipment, including measuring and monitoring instruments and devices for the disposal 

of radioactive effluents and wastes, are adequate to protect the environment and public 

health and safety, as specified in 10 CFR 70.22(a)(7). 

5. 10 CFR Part 70 also provides that the applicant for a license to possess and use SNM 

in a plutonium processing and fuel fabrication plant (as defined in 10 CFR 70.4, 

“Definitions”) must submit a safety assessment of the design basis of the principal 

structures, systems, and components of the plant, including provisions for protection 

against natural phenomena, as specified in 10 CFR 70.22(f). 

6. 10 CFR Part 70 also provides that an applicant for authorization for an activity listed in 

10 CFR 70.60 must provide an ISA summary that includes a list of the IROFS 

established by the applicant and other elements, as described in 10 CFR 70.65(b). 

7. 10 CFR 70.59, “Effluent Monitoring Reporting Requirements,” outlines the reporting 

requirements for radiological-effluent monitoring for a 10 CFR Part 70 licensee. 

8. 10 CFR 70.21(f) requires that an application for an activity which the Commission has 

determined requires an EIS, listed in 10 CFR 51.20, must be accompanied by an 

Environmental Report required under Subpart A of part 51. The application must be filed 

at least 9 months prior to commencement of construction, as defined in 10 CFR 70.4. 

Environmental Reports are also required for actions listed in 10 CFR 51.60. The 

Environmental Report must contain the information specified in section 51.45, 

Additional guidance for Environmental Reports is contained in NUREG-1748, 
June 2015 9-6 NUREG-1520, Revision 2 

“Environmental Review Guidance for Licensing Actions Associated with NMSS 

Programs.” 

9.4.2 Regulatory Guidance 

The regulatory guidance for environmental protection appears in the following NRC and industry 

documents:

1. NRC Regulatory Guide 4.15, “Quality Assurance for Radionuclide Monitoring Programs 

(Inception through Normal Operations to License Termination)—Effluent Streams and 

the Environment,” Revision 2, July 2007 

2. NRC Regulatory Guide 4.16, “Monitoring and Reporting Radioactivity in Releases of 

Radioactive Materials in Liquid and Gaseous Effluents from Nuclear Fuel Processing 

and Fabrication Plants and Uranium Hexafluoride Production Plants,” December 1985 

3. NRC Regulatory Guide 4.20, “Constraint on Releases of Airborne Radioactive Materials 

to the Environment for Licensees Other Than Power Reactors,” December 1996 

4. NRC Regulatory Guide 8.37, “ALARA Levels for Effluents from Materials Facilities,” 

July 1993 

5. NRC Information Notice 94-07, “Solubility Criteria for Liquid Effluent Releases to 

Sanitary Sewerage under the Revised 10 CFR Part 20,” January 28, 1994 

6. NRC Information Notice 94-23, “Guidance to Hazardous, Radioactive, and Mixed Waste 

Generators on the Elements of a Waste Minimization Program,” March 25, 1994 

7. American National Standards Institute (ANSI) N13.1-1982, “Guide to Sampling Airborne 

Radioactive Materials in Nuclear Facilities” 

8. ANSI N42.18-1980, “Specification and Performance of On-Site Instrumentation for 

Continuously Monitoring Radioactive Effluents” 

9. National Council on Radiation Protection and Measurements (NCRP) Report No. 123, 

“Screening Models for Releases of Radionuclides to Atmosphere, Surface Water, and 

Ground,” Volumes I and II, January 1996 

10. NUREG-1513, “Integrated Safety Analysis Guidance Document,” May 2001 

11. NUREG-1748, “Environmental Review Guidance for Licensing Actions Associated with 

NMSS Programs,” August 2003 

12. NUREG/CR-6410, “Nuclear Fuel Cycle Accident Analysis Handbook,” March 1998 
June 2015 9-7 NUREG-1520, Revision 2 

9.4.3 Regulatory Acceptance Criteria 

9.4.3.1 Environmental Report or Categorical Exclusion 

An environmental report is required for actions listed in 10 CFR 51.60(b). NUREG-1748 

discusses the acceptance criteria for the environmental report to satisfy NEPA requirements. 

An environmental report is not required for licensing actions that meet the requirements for a 

categorical exclusion, as defined in 10 CFR 51.22(c). 10 CFR 51.22(c) lists 25 actions that the 

Commission has declared to be categorical exclusions. A licensing ction can be categorically 

excluded under any one of the listed actions. Some of the categorical exclusions commonly 

used for fuel cycle licensing actions include the following: 

a. An updated decommissioning funding plan may be excluded under 51.22(c)(10). 

b. Administrative, organizational, or procedural changes may be excluded under 10 CFR 

51.22(c)(11), as well as or changes in process operations or equipment that meet the 

four criteria in 10 CFR 51.22(c)(11). 

c. A revised physical security plan, or fundamental nuclear material control plan, may be 

excluded under 51.22(c)(12). 

d. Use of SNM for research and development may be excluded under 51.22(c)(14). 

e. Approvals of direct or indirect license transfers are excluded under 51.22(c)(21). 

f. Granting exemptions may be excluded under 51.22(c)(25). 

If under 10 CFR 51.22(c)(11) the action involves an amendment to licenses for fuel cycle plants, 

radioactive waste disposal sites, and other materials licenses identified in 10 CFR 51.60(b)(1) 

for changes in process operations or equipment, the applicant must demonstrate that the action 

will not result in significant effects on the environment. NUREG-1748 gives the acceptance 

criteria for this categorical exclusion. 

If a license application indicates a significant increase in the potential for, or consequences of, 

radiological accidents, then the licensing action is NOT categorically excluded from review 

under the National Environmental Policy Act. The application must include an environmental 

report and the staff must prepare an EA. 

9.4.3.2 Effluent and Environmental Controls and Monitoring 

An applicant’s proposed environmental protection measures are acceptable if they provide for 

qualified and trained staff, effluent control, and effluent and environmental monitoring in 

accordance with the NRC’s requirements. Using the acceptance criteria defined in Standard 

Review Plan (SRP) Chapter 11, the NRC staff will review qualifications and training that the 

applicant has established for plant personnel who are associated with environmental protection. 

This review will include the qualification and training of managers, supervisors, technical staff, 

operators, technicians, and maintenance personnel whose levels of knowledge are important to 
June 2015 9-8 NUREG-1520, Revision 2 

the environment and protect public health and safety. The NRC will expect managers and staff 

to have levels of education and experience commensurate with the responsibilities of their 

positions. 

9.4.3.2.1 Effluent Controls and Waste Minimization 

In accordance with 10 CFR 20.1101, “Radiation Protection Programs,” each licensee must 

implement a radiation protection program, which is discussed in detail in SRP Chapter 4. The 

environmental review of the radiation protection program focuses on the applicant’s methods to 

maintain public doses ALARA in accordance with 10 CFR 20.1101. NRC guidance on 

compliance with these regulations appears in Regulatory Guide 8.37. 

Specifically, 10 CFR 20.1101(d) requires the applicant to establish constraints on airborne 

emissions of radioactive material to the environment, excluding radon-222 and its decay 

products. Such constraints must ensure that the individual member of the public who is likely to 

receive the highest dose will not be expected to receive a total effective dose equivalent (TEDE) 

in excess of 0.1 millisievert (10 millirem) per year from these emissions. To meet the reporting 

requirements of 10 CFR 20.2203, “Reports of Exposures, Radiation Levels, and Concentrations 

of Radioactive Material Exceeding the Constraints or Limits,” the applicant must have (and 

describe) procedures for reporting to the NRC when these dose constraints are exceeded and 

must take prompt appropriate corrective action to prevent recurrence. NRC guidance on 

compliance with this regulation can be found in Regulatory Guide 4.20. 

The environmental review of the radiation protection program also focuses on the applicant’s 

waste minimization practices. Applicants for new licenses are required to comply with 

10 CFR 20.1406, “Minimization of Contamination,” which states that the applicant must describe 

how facility design procedures for operation will, to the extent practicable, minimize 

contamination of the facility and the environment, facilitate eventual decommissioning, and 

minimize the generation of radioactive waste. Applicants requesting amendment or renewal of 

existing licenses must minimize and control waste generation during operations as part of the 

radiation protection program, in accordance with 10 CFR 20.1101 (Volume 62 of the 

Federal Register, page 39,082 (62 FR 39082); July 21, 1997). 

NRC Information Notice 94-23 offers guidance for waste minimization programs. SRP 

Chapter 10 offers more information on compliance with the decommissioning aspects of the 

waste minimization regulations. 

The proposed radiation protection program is acceptable if it satisfies the following criteria: 

1. Radiological (ALARA) Goals for Effluent Control 

ALARA goals are set at a modest fraction (10 to 20 percent) of the values in Table 2, 

Columns 1 and 2, and Table 3 of Appendix B to 10 CFR Part 20 and the external 

exposure limit in 10 CFR 20.1302(b)(2)(ii), or the dose limit for members of the public, if 

the applicant proposes to demonstrate compliance with 10 CFR 20.1301, “Dose Limits 

for Individual Members of the Public,” through a calculation of the TEDE to the individual 

likely to receive the highest dose. 

An applicant’s constraint approach is acceptable if it is consistent with guidance found in 

Regulatory Guide 4.20 and if the applicant’s description of the constraint approach 
June 2015 9-9 NUREG-1520, Revision 2 

provides sufficient detail to demonstrate specific application of the guidance to proposed 

routine and nonroutine operations, including anticipated events. 

2. Effluent Controls to Maintain Public Doses ALARA 

 The applicant describes and commits to the use of effluent controls (e.g., procedures, 

engineering controls, and process controls) to maintain public doses ALARA. Common 

control practices include filtration, encapsulation, adsorption, containment, recycling, 

leakage reduction, and storage of materials for radioactive decay. Practices for large, 

diffuse sources (such as contaminated soils or surfaces) include covers, wetting during 

operations, and the application of stabilizers. The applicant must demonstrate a 

commitment to reduce unnecessary exposure to members of the public and releases to 

the environment. 

Engineering options that do not substantially reduce the collective dose and require 

unreasonable costs are not required. “Reasonableness” can be founded on qualitative 

or quantitative cost/benefit analyses. Quantitative analyses may use a value of 

2,000 per person-rem (person-centisievert), as discussed in NUREG-1530, 

“Reassessment of the NRC’s Dollar per Person-Rem Conversion Factor Policy,” issued 

December 1995. 

3. ALARA Reviews and Reports to Management 

The applicant commits to an annual review of the content and implementation of the 

radiation protection program, which includes the ALARA effluent control program. This 

review includes analysis of trends in release concentrations, environmental monitoring 

data, and radionuclide usage; determines whether operational changes are needed to 

achieve the ALARA effluent goals; and evaluates all designs for system installations or 

modifications. The applicant also commits to reporting the results to senior 

management, along with recommendations for changes in facilities or procedures that 

are necessary to achieve ALARA goals. 

4. Waste Minimization 

To comply with 10 CFR 20.1406, applications for new licenses must describe how the 

facility’s design procedures for operation will minimize, to the extent practicable, the 

contamination of the facility and the environment and the generation of radioactive 

waste. Waste minimization programs proposed by applicants for both new and existing 

licenses are acceptable if the programs include the following: 

a. top management support 

b. the methods used to characterize waste generation (including types and 

amounts) and waste management costs (including costs of regulatory 

compliance, paperwork, transportation, treatment, storage, and disposal) 

c. periodic waste minimization assessments to identify waste minimization 

opportunities and solicit employee or external recommendations 
June 2015 9-10 NUREG-1520, Revision 2 

d. provisions for technology transfer to seek and exchange technical information on 

waste minimization 

e. the methods used to implement and evaluate waste minimization 

recommendations 

9.4.3.2.2 Effluent and Environmental Monitoring 

A. The applicant’s effluent monitoring is considered acceptable, for purposes of the SER, if 

it meets the following criteria. However, the applicant’s environmental monitoring 

program must be independently assessed to determine whether the information is also 

acceptable for NEPA documentation purposes: 

1. The known or expected concentrations of radioactive materials in airborne and 

liquid effluents are ALARA and are below the limits specified in Table 2 of 

Appendix B to 10 CFR Part 20 or the site-specific limits established in 

accordance with 10 CFR 20.1302(c). 

If, in accordance with 10 CFR 20.1302(c), the applicant proposes to adjust the 

effluent concentrations in Appendix B to 10 CFR Part 20 to account for the actual 

physical and chemical characteristics of the effluents, the applicant must provide 

information on aerosol size distributions, solubility, density, radioactive decay 

equilibrium, and chemical form. This information must be complete and accurate 

to justify the derivation and application of the alternative concentration limits for 

the radioactive materials. 

2. If the applicant proposes to demonstrate compliance with 10 CFR 20.1301 using 

a calculation of the TEDE to the individual who is likely to receive the highest 

dose in accordance with 10 CFR 20.1302(b)(1), it must support the calculation of 

the TEDE by pathway analyses with appropriate models, codes, and 

assumptions that accurately represent the facility, site, and the surrounding area. 

In addition, the assumptions must be reasonable, input data must be accurate, all 

applicable pathways must be considered, and the results must be interpreted 

correctly. 

 NCRP Report No. 123 provides acceptable methods for calculating the dose 

from radioactive effluents. The use of computer codes is acceptable for pathway 

analyses if the applicant can demonstrate that any code it has used has 

undergone validation and verification to demonstrate the validity of estimates 

developed using the codes for established input sets. Dose conversion factors 

are acceptable for use in the pathway analyses if they are based on the 

methodology described in International Commission on Radiological 

Protection 30, “Limits for Intakes of Radionuclides by Workers,” 1982, as 

reflected in the U.S. Environmental Protection Agency’s Federal Guidance 

Report No. 11, “Limiting Values of Radionuclide Intake and Air Concentration and 

Dose Conversion Factors for Inhalation, Submersion, and Ingestion,” issued 

September 1988. Such methods are acceptable for determining the dose to the 

maximally exposed individual during normal facility operations and anticipated 

events. 
June 2015 9-11 NUREG-1520, Revision 2 

3. The applicant identifies and monitors all liquid and airborne effluent discharge 

locations and identifies monitoring locations. For those effluent discharge points 

that have input from two or more contributing sources within the facility, sampling 

each contributing source is considered necessary for effective process and 

effluent control. 

4. The applicant continuously samples airborne effluents from all routine and 

nonroutine operations and from anticipated events associated with the plant, 

including effluents from areas that are not used for processing SNM, such as 

laboratories, experimental areas, storage areas, and fuel element assembly 

areas. 

Effluents are sampled unless the applicant has established (by periodic sampling 

or other means) that radioactivity in the effluent is insignificant and will remain so. 

In such cases, the effluent is sampled at least quarterly to confirm that its 

radioactivity is not significant. For the purposes of this SRP, radioactivity in an 

effluent is significant if the concentration averaged over a calendar quarter is 

equal to 10 percent or more of the appropriate concentration listed in Table 2 of 

Appendix B to 10 CFR Part 20. 

5. The sample collection and analysis methods and frequencies are appropriate for 

the effluent medium and the radionuclide(s) being sampled. Sampling methods 

ensure that the applicant obtains representative samples using appropriate 

sampling equipment and sample collection and storage procedures. For liquid 

effluents, the applicant collects representative samples at each release point to 

determine the concentrations and quantities of radionuclides that are released to 

an unrestricted area, including discharges to sewage systems. For continuous 

releases, the applicant collects samples continuously at each release point. For 

batch releases, the applicant collects a representative sample of each batch. If 

the applicant uses periodic sampling in lieu of continual sampling, it shows that 

the samples are representative of actual releases. Monitoring instruments are 

calibrated at least annually, or more frequently if suggested by the manufacturer. 

6. The applicant performs radionuclide-specific analyses on selected composite 

samples unless either of the following criteria exists: 

a. The gross alpha and beta activities are so low that individual 

radionuclides could not be present in concentrations greater than 10 

percent of the concentrations specified in Tables 2 or 3 of Appendix B to 

10 CFR Part 20. 

b. The radionuclide composition of the sample is known through operational 

data, such as the composition of the feed material. 

Monitoring reports in which the quantities of individual radionuclides are 

estimated on the basis of methods other than direct measurement include 

an explanation and justification of how the results were obtained. 

Operational data may not be adequate for determining radionuclide 

concentration in certain cases. Such cases include, but are not limited to: 
June 2015 9-12 NUREG-1520, Revision 2 

(1) plants that process uranium in which extraction, ammonium diuranate 

precipitation, ion exchange, or other separation process could result in 

the concentration of thorium isotopes (principally thorium-234); (2) plants 

that process uranium of varying enrichments; and (3) plants that process 

plutonium in which significant variation in the plutonium-238/plutonium239 ratio among batches and the continuous ingrowth of americium-241 

would preclude the use of feed material data to determine the 

radionuclide composition of effluents. 

The applicant performs radionuclide analyses more frequently than usual 

(1) at the beginning of the monitoring program (until it establishes a 

predictable and consistent radionuclide composition in effluents); 

(2) whenever there is a significant, unexplained increase in gross 

radioactivity in effluents; and (3) whenever a process change or other 

circumstance might cause a significant variation in the radionuclide 

composition. 

7. The minimum detectable concentration (MDC) for sample analyses is not more 

than 5 percent of the concentration limits listed in Table 2 of Appendix B to 

10 CFR Part 20. If the actual concentrations of radionuclides in samples are 

known to be higher than 5 percent of the 10 CFR Part 20 limits, the analysis 

methods need only be adequate to measure the actual concentration. However, 

in such cases, the MDC must be low enough to accommodate fluctuations in the 

concentrations of the effluent and the uncertainty of the MDC. 

8. The laboratory quality control procedures are adequate to validate the analytical 

results. These procedures include the use of established standards, such as 

those provided by the National Institute of Standards and Technology, and 

standard analytical procedures, such as those established by the National 

Environmental Laboratory Accreditation Conference. 

9. The proposed action levels and actions to be taken if the action levels are 

exceeded are appropriate. The action levels are incremental, such that each 

increasing action level results in a more aggressive action to ensure effluent 

control. A slightly higher than normal concentration of a radionuclide in an 

effluent triggers an investigation into the cause of the increase. The specified 

action level will result in the shutdown of an operation if the specified level is 

exceeded. These action levels are selected on the basis of the likelihood that a 

measured increase in concentration could indicate potential violation of the 

effluent limits. 

10. The applicant completely and accurately describes all applicable Federal and 

State standards for discharges and any permits issued by Federal, State, or local 

governments for gaseous and liquid effluents. 

11. The systems for detecting leakage from ponds, lagoons, and tanks are adequate 

to detect and ensure against any unplanned releases to groundwater, surface 

water, or soil. 
June 2015 9-13 NUREG-1520, Revision 2 

12. The applicant controls and maintains releases to sewer systems to meet the 

requirements of 10 CFR 20.2003, “Disposal by Release into Sanitary Sewerage,” 

including the following: 

a. The material is water soluble. 

b. Known or expected discharges meet the effluent limits specified in 

Table 3 of Appendix B to 10 CFR Part 20. 

c. The known or expected total quantity of radioactive material released into 

the sewer system in a year does not exceed 5 curies (Ci) (185 

gigabecquerels (GBq)) of hydrogen-3, 1 Ci (37 GBq) of carbon-14, and 1 

Ci (37 GBq) of all other radioactive materials combined. 

d. Solubility is determined in accordance with the procedure described in 

NRC Information Notice 94-07. 

13. Reporting procedures comply with the requirements of 10 CFR 70.59 and the 

guidance in Regulatory Guide 4.16. The applicant provides reports that include 

the concentrations of principal radionuclides released to unrestricted areas in 

liquid and gaseous effluents and the MDC for the analysis and the error for each 

data point. 

14. The applicant’s procedures and facilities for solid and liquid waste handling, 

storage, and monitoring result in safe storage and timely disposition of the 

material. 

B. The scope of the applicant’s environmental monitoring is acceptable (for purposes of the 

SER) if it is commensurate with the scope of activities at the facility and the expected 

impacts from operations as identified in the environmental report and if it meets the 

following criteria: 

1. Background and baseline concentrations of radionuclides in environmental media 

have been established through sampling and analysis. 

2. Monitoring includes sampling and analyses for monitoring air, surface water, 

groundwater, soil, sediments, and vegetation, as appropriate. 

3. The description of monitoring identifies adequate and appropriate sampling 

locations and frequencies for each environmental medium, the frequency of 

sampling, and the analyses to be performed on each medium. 

4. Monitoring procedures employ acceptable analytical methods and 

instrumentation. The applicant commits to an instrument maintenance and 

calibration program that is appropriate to the given instrumentation. If the 

applicant proposes to use its own analytical laboratory for the analysis of 

environmental samples, the applicant commits to providing third-party verification 

of the laboratory’s methods (such as that obtained by participation in a 

round-robin measurement program). 
June 2015 9-14 NUREG-1520, Revision 2 

5. Appropriate action levels and actions to be taken if the levels are exceeded are 

specified for each environmental medium and radionuclide. 

 Action levels are selected on the basis of a pathway analysis that demonstrates 

that, below those concentrations, doses to the public will be ALARA and below 

the limits specified in Subpart B to 10 CFR Part 20. The action levels specify the 

concentrations at which an investigation would be performed and levels at which 

process operations would be shut down. 

6. MDCs are specified for sample analyses and are at least as low as those 

selected for effluent monitoring in air and water. MDCs for sediment, soil, and 

vegetation are selected on the basis of action levels to ensure that sampling and 

analytical methods are sensitive and reliable enough to support the application of 

the action levels. 

7. Data analysis methods and criteria that the applicant will use to evaluate and 

report the environmental sampling results are appropriate and will indicate when 

an action level is being approached in time to take corrective actions. 

8. The description of the status of all licenses, permits, and other approvals of 

facility operations required by Federal, State, and local authorities is complete 

and accurate. 

9. Environmental monitoring is adequate to assess impacts to the environment from 

potential radioactive and nonradioactive releases, as identified in high- and 

intermediate-consequence accident sequences in the ISA. 

9.4.3.3 Integrated Safety Analysis Summary

A. In accordance with 10 CFR 70.60, “Applicability,” applicants requesting authorization to 

possess greater than a critical mass of SNM and to engage in the listed activities are 

required to perform an ISA and submit an ISA summary to the NRC for approval. The 

applicant’s treatment of environmental protection in the ISA is acceptable if it fulfills the 

following criteria: 

1. The ISA provides a complete list of accident sequences that result in radiological 

and nonradiological releases to the environment. 

2. The ISA uses acceptable methods to estimate environmental effects that may 

result from accident sequences and to determine whether the effects are high or 

intermediate consequences as defined in 10 CFR 70.61, “Performance 

Requirements.” NUREG/CR-6410 describes acceptable methods for estimating 

environmental effects from accident sequences. 

3. The ISA provides a reasonable estimate of the likelihood and consequences of 

each accident sequence identified. 

4. The ISA identifies adequate engineering or administrative controls or both for 

each accident sequence of environmental significance. These controls will 

prevent or mitigate high- and intermediate-consequence accident sequences to 
June 2015 9-15 NUREG-1520, Revision 2 

an acceptable level. (Consequence categories are defined in 10 CFR 70.61 and 

in SRP Chapter 3.) IROFS provide the indicated level of protection. 

5. The ISA affords adequate levels of assurance so that IROFS will satisfactorily 

perform their safety functions. Configuration management, training, and 

maintenance activities contribute to achieving this assurance. 

6. For an ISA summary of a facility that has not yet been constructed, the 

specifications for IROFS may not be complete at the time the ISA summary is 

submitted. The IROFS functions should be described in sufficient detail for the 

reviewer to determine their adequacy to prevent or mitigate the accident 

sequence. For example, the description of an in-line gamma monitor used to 

alert an operator of an off-normal condition should define the range of gamma 

activity that the monitor needs to detect. A description of a ventilation system 

that controls the consequences of an enclosure spill should include its air-moving 

capacity. The description of a stack sampler that detects excessive airborne 

releases should include the capacities of the sampler. 

In addition to participating in the integrated review of the ISA performed in accordance 

with SRP Chapter 3, the reviewer should also examine, in detail, the fire-initiated release 

scenarios provided in the ISA summary to demonstrate compliance with 10 CFR 70.61, 

because fire-initiated accident scenarios have the potential for environmental 

consequences. This review should follow the guidance provided in applicable sections 

of SRP Chapter 3 to give a detailed evaluation of these scenarios, including a review of 

fire-induced consequences to the environment, the likelihood of such consequences, 

and IROFS chosen to prevent or mitigate those consequences. 

B. The reviewer should consider the following factors in determining the acceptability of the 

applicant’s descriptions of fire-initiated accident sequences: 

1. Scenario descriptions are sufficiently detailed to allow an understanding of the 

fire hazards that permits an evaluation of potential accident sequences. 

2. The applicant has adequately described the environmental consequences and 

likelihood of accident sequences identified in the ISA summary involving fire, 

including risks from hazardous chemicals produced from licensed material and 

risks from radioactive materials. 

3. All controls that are used to mitigate or prevent the scenario are identified as 

IROFS or as defense-in-depth measures. For those controls that are IROFS, 

reliability and associated management measures should be indicated. 

4. Analyses that the applicant has performed as part of the evaluation should be 

part of the ISA and should be referenced or identified for potential further review 

by the NRC staff. 
June 2015 9-16 NUREG-1520, Revision 2 

9.4.3.4 Environmental Protection Management Measures 

The management measures applied to IROFS designated to prevent or mitigate accident 

sequences in which the IROFS are needed are acceptable for purposes of the SER if they meet 

the acceptance criteria in SRP Chapter 11. 

9.5 Review Procedures

9.5.1 Review Procedures 

The staff will review the environmental report, environmental protection measures, 

ISA summary, and management measures to verify that they meet the acceptance criteria 

defined in SRP Section 9.4. During the acceptance review of a license application, the reviewer 

should examine the submittals to identify major deficiencies in the information provided for each 

area of review specified in SRP Section 9.3. Reviewers must decide whether they have enough 

information to proceed with a detailed review. Less significant errors or deficiencies that can be 

addressed in a request for additional information should be accepted. However, before the 

NRC performs a detailed review, the applicant should correct major deficiencies that would 

require several requests for additional information to resolve. 

Reviewers should record whether each area of review is adequately addressed in the 

application, is adequately addressed in a referenced document, is not applicable to the 

application, or has a major deficiency. 

9.5.2 Effluent and Environmental Controls and Monitoring 

An environmental specialist will review the applicant’s environmental protection measures in 

coordination with the Environmental Project Manager and the fuel cycle facility inspector 

responsible for environmental protection. Any comments or concerns that the environmental 

reviewer or inspector identifies will be addressed and resolved, and the safety evaluation report 

(SER) (described in Section 9.6) for the licensing action will contain a statement indicating 

whether the inspection staff has any objections to the approval of the proposed licensing action. 

In addition, the review will include an evaluation of inspection reports and semiannual effluent 

reports, submitted in accordance with 10 CFR 70.59, to ensure licensee performance in 

environmental protection. 

9.5.3 Integrated Safety Analysis Summary 

As part of the environmental protection review, the environmental specialist will review the 

ISA summary, including all identified accident sequences that can have significant 

environmental consequences, to determine whether the list completely and properly identifies all 

potential accidents. The environmental specialist will coordinate this review with the ISA 

reviewer who is responsible for assuring that the required information is contained in Chapter 3 

of the SER. A detailed review will be conducted of (1) the accident sequences that, when left 

unmitigated, are rated as “high” consequence to an individual located outside the controlled 

area, (2) approximately 10 percent of the “intermediate” consequence sequences, and (3) a 

smaller number of accident sequences in which the consequences are less than intermediate. 

However, additional intermediate and low consequence sequences may be evaluated on the 

basis of the results of the initial review. 
June 2015 9-17 NUREG-1520, Revision 2 

An evaluation of the ISA summary requires coordination with other technical reviewers. The 

environmental review of the IROFS will be coordinated with the reviewers for the specific 

assurance functions, such as training and maintenance. The review of the ISA summary may 

require the examination of the ISA and of detailed supporting ISA documents located at the 

facility. On the basis of these reviews, the reviewer should decide what supporting documents 

need to be reviewed. The reviewer will clearly identify in the SER either the materials examined 

and the descriptions and commitments considered and relied on or the basis for the staff’s 

safety decision. 

9.5.4 Management Measures 

The environmental reviewer should review the classification assigned to the IROFS to ensure 

that the management measures described in SRP Chapter 11 are used to determine whether 

the licensee has established adequate management measures to apply to all IROFS designated 

to prevent or mitigate high or intermediate accident consequences to a member of the public or 

intermediate consequences to the environment in accordance with 10 CFR 70.61(b)(2), 

10 CFR 70.61(c)(2), and 10 CFR 70.61(c)(3). The environmental reviewer should review the 

classification assigned to the IROFS to ensure that the management measures are graded 

commensurate with the reduction of risk attributable to the IROFS. 

During the application and ISA summary review, the reviewer should identify and communicate 

to the inspection staff any items or issues that should be inspected during an operational 

readiness review, if such a review will be performed. These items could include confirming that 

the engineered controls installed in the process actually meet the capabilities described in the 

ISA summary and that administrative controls are implemented through procedures and 

operator training. 

9.5.2 Environmental Report 

The NEPA reviewer should review the environmental report, if one was included in the 

application and follow the guidance in NUREG-1748 for preparation of and EIS or EA and 

finding of no significat impact. If no environmental report was provided in the application, the 

NEPA Reviewer should review the application to determine whether the requested action – 

licensing, renewal, amendment – meets any of the criteria in 51.22 for a categorical exclusion. 

9.6 Evaluation Findings

An SER documents the evaluation findings of the environmental protection review of the 

application, including the review of the environmental protection program and the ISA summary. 

The regulations in 10 CFR 70.23, “Requirements for the Approval of Applications,” and 70.66, 

“Additional Requirements for Approval of License Application,” state that an application for a 

license will be approved if the Commission can make the general findings listed in those 

sections. The basis for the general findings is an evaluation of all the detailed regulatory 

requirements that apply to application. The staff’s evaluation should verify that the license 

application provides sufficient information to satisfy the regulatory requirements of Section 9.4.1 

of this SRP and that the applicant has appropriately considered the regulatory acceptance 

criteria in Section 9.4.3 in satisfying the requirements. The staff reviewers will verify that the 

information submitted by the applicant is in accordance with 10 CFR Part 20, 10 CFR Part 51, 

and 10 CFR Part 70 and is consistent with the guidance in this SRP as it applies to 
June 2015 9-18 NUREG-1520, Revision 2 

environmental protection. The SER should state how the applicable regulatory requirements 

have been met based on the acceptance criteria described in this chapter. If the applicant 

chooses to suggest an alternative approach, the reviewer should identify in the SER how the 

proposed approach satisfies the applicable regulatory requirements. The reviewers should use 

the following approach to document their evaluation: 

1. State a specific regulatory requirement that applies to the application. Detailed 

acceptance criteria may be included where appropriate or necessary. 

2. Identify the areas where the regulatory requirement is addressed in the application, 

including the areas where the specific acceptance criteria described in this SRP are 

addressed. 

3. Describe your evaluation of the application, the basis for your conclusion, and whether 

regulatory requirements are met. 

4. Repeat these steps for every regulatory requirement that applies to the application. 

The environmental report and EA or EIS do not become part of the license, and license 

conditions should not contain references to information in the environmental report, EA, or EIS. 

If an EA or EIS is prepared for the licensing action prior to issuing the SER, then the 

environmental safety section of the SER should report the date the NEPA document was 

issued. If the EA results in a FONSI, the SER should include the publication date of the FONSI 

in the Federal Register. If an EIS is prepared, the SER would include the Federal Register 

publication date for the record of decision. When applicable, the SER will also document the 

determination that an action meets the requirements for a categorical exclusion. 

As discussed in Section 3.4.9 of NUREG-1748, the environmental PM should consult with the 

affected State before the final EA is prepared. Appendix D to NUREG-1748 contains a 

suggested procedure to follow in consulting with the State. After the State has been consulted, 

the EA is finalized with text noting that the State was consulted along with a summary of the 

State’s comments. 

In certain circumstances, a draft EA and FONSI may be prepared. Circumstances include those 

where a FONSI appears warranted for the proposed action but the proposed action is similar to 

one which normally requires an EIS, the proposed action is without precedent, or the 

appropriate NRC staff director determines preparation of a draft FONSI will further the purposes 

of NEPA [10 CFR 51.33(b)]. The draft FONSI should be clearly marked "draft" and should be 

published in the Federal Register and distributed as described in 10 CFR 51.74(a). The Federal 

Register notice must include a request for comments and specify where the comments should 

be submitted and when the comment period ends (10 CFR 51.119(a)). 

The following language would be appropriate for a licensing action that requires an 

environmental review: 

The applicant has committed to adequate environmental-protection measures, 

including (1) environmental and effluent monitoring and (2) effluent controls to 

maintain public doses ALARA as part of the radiation protection program. The 

NRC staff concludes, with reasonable assurance, that the applicant’s 

conformance to the application and license conditions is adequate to protect the 

environment and public health and safety and to comply with the regulatory 
June 2015 9-19 NUREG-1520, Revision 2 

requirements imposed by the Commission in 10 CFR Part 20, 10 CFR Part 51, 

and 10 CFR Part 70. The bases for these conclusions are as follows: 

[State the bases for the conclusion, including any recommended license 

conditions. A recommended license condition should not include a reference to a 

NEPA document, such as the Environmental Report submitted under 70.21(f), 

51.45, or 51.60, or a reply to an RAI related to the NEPA document. 

If the action requires preparation of an EIS, the SER should include the following language: 

The NRC staff prepared [or is preparing] an environmental impact statement (EIS) 

[publication date, if available] for this licensing action as required by 10 CFR 51.20. In 

accordance with 10 CFR 70.23(a)(7), the Director of Nuclear Material Safety and 

Safeguards or his/her designee, before commencement of construction of the plant or 

facility in which the activity will be conducted, on the basis of information filed and 

evaluations made pursuant to subpart A of part 51 of this chapter, has concluded, after 

weighing the environmental, economic, technical, and other benefits against 

environmental costs and considering available alternatives, that the action called for is 

the issuance of the proposed license, with any appropriate conditions to protect 

environmental values. Commencement of construction prior to this conclusion is grounds 

for denial to possess and use special nuclear material in the plant or facility. 

Commencement of construction as defined in section 70.4 may include non-construction 

activities if the activity has a reasonable nexus to radiological safety and security. 

If the action requires preparation of an EA and results in a FONSI, the SER 

should include the following language: 

The NRC staff prepared an environmental assessment (EA) for this action 

as required by 10 CFR 51.21. On the basis of the EA, the staff has 

reached a finding of no significant impact, published in the Federal 

Register on [publication date and FR citation]. [If staff published a draft 

EA for public comment, the SER should include the FR citation and 

publication date of the draft EA. The final EA should contain a list of 

significant comments received on the draft EA and how they were 

addressed in the final EA.] 

If the staff determines that the action was categorically excluded from environmental review 

under 10 CFR 51.22, the SER should include language similar to the following : 

The staff has determined that the requested action [state whether the action is issuance, 

renewal, amendment, or termination of license, or other action] belongs to a category of 

actions which the Commission, by rule or regulation, has declared to be a categorical 

exclusion, after first finding that the category of actions does not individually or 

cumulatively have a significant effect on the human environment. Therefore, in 

accordance with 10 CFR 51.22(c) [Insert applicable categorical exclusion citation here] 

neither an environmental impact statement nor an EIS is required for this action. 

If the requested action involves a change in process operations and equipment, then the 

categorical exclusion should also include a brief discussion of how the action meets the 

following four criteria in 51.22(c)(11)
June 2015 9-20 NUREG-1520, Revision 2 

(1) There is no significant change in the types or significant increase in the 

amounts of any effluents that may be released offsite. 

(2) There is no significant increase in individual or cumulative occupational 

radiation exposure. 

(3) There is no significant construction impact. 

(4) There is no significant increase in the potential for, or consequences 

from, radiological accidents. 

[State the bases for the conclusion.] 

9.7 References

U.S. Code of Federal Regulations, “Standards for Protection against Radiation,” Part 20, 

Chapter I, Title 10, “Energy.” 

U.S. Code of Federal Regulations, “Environmental Protection Regulations for Domestic 

Licensing and Related Regulatory Functions,” Part 51, Chapter I, Title 10, “Energy.” 

U.S. Code of Federal Regulations, “Domestic Licensing of Special Nuclear Material,” Part 70, 

Chapter I, Title 10, “Energy.” 

American National Standards Institute (ANSI), “Specification and Performance of On-Site 

Instrumentation for Continuously Monitoring Radioactivity in Effluents,” ANSI N42.18-1980, 

Washington, DC, 1980 (reaffirmed 2004). 

American National Standards Institute (ANSI)/Health Physics Society (HPS), “Sampling and 

Monitoring Releases of Airborne Radioactive Substances from the Stacks and Ducts of Nuclear 

Facilities,” ANSI/HPS N13.1-2011, McLean, VA, 2011. 

National Council on Radiation Protection and Measurements, “Screening Models for Releases 

of Radionuclides to Atmosphere, Surface Water, and Ground,” NCRP Report No. 123, 

Volumes I and II, Bethesda, MD, January 1996. 

U.S. Environmental Protection Agency, “Limiting Values of Radionuclide Intake and Air 

Concentration and Dose Conversion Factors for Inhalation, Submersion, and Ingestion,” Federal 

Guidance Report No. 11, Washington, DC, September 1988. 

U.S. Nuclear Regulatory Commission, “Solubility Criteria for Liquid Effluent Releases to Sanitary 

Sewerage under the Revised 10 CFR Part 20,” Information Notice 94-07, January 28, 1994. 

U.S. Nuclear Regulatory Commission, “Guidance to Hazardous, Radioactive, and Mixed Waste 

Generators on the Elements of a Waste Minimization Program,” Information Notice 94-23, 

March 25, 1994. 
June 2015 9-21 NUREG-1520, Revision 2 

U.S. Nuclear Regulatory Commission, “Integrated Safety Analysis Guidance Document,” 

NUREG-1513, May 2001. 

U.S. Nuclear Regulatory Commission, “Environmental Review Guidance for Licensing Actions 

Associated with NMSS Programs,” NUREG-1748, August 2003. 

U.S. Nuclear Regulatory Commission, “Nuclear Fuel Cycle Accident Analysis Handbook,” 

NUREG/CR-6410, March 1998. 

U.S. Nuclear Regulatory Commission, “Quality Assurance for Radiological Monitoring Programs 

(Inception through Normal Operations to License Termination)—Effluent Streams and the 

Environment,” Regulatory Guide 4.15, Revision 2, July 2007. 

U.S. Nuclear Regulatory Commission, “Monitoring and Reporting Radioactivity in Releases of 

Radioactive Materials in Liquid and Gaseous Effluents from Nuclear Fuel Cycle Facilities,” 

Regulatory Guide 4.16, Revision 2, December 2010. 

U.S. Nuclear Regulatory Commission, “Constraint on Releases of Airborne Radioactive 

Materials to the Environment for Licensees Other Than Power Reactors,” Regulatory 

Guide 4.20, Revision 1, April 2012. 

U.S. Nuclear Regulatory Commission, “ALARA Levels for Effluents from Materials Facilities,” 

Regulatory Guide 8.37, July 1993. 

June 2015 10-1 NUREG-1520, Revision 2 

10. DECOMMISSIONING 

10.1 Purpose of Review

The purpose of the review of the applicant’s decommissioning plans is to determine with 

reasonable assurance that the applicant will be able to decommission the facility safely and in 

accordance with the requirements of the U.S. Nuclear Regulatory Commission (NRC). 

At the time of the initial application and at license renewal, the applicant or licensee should 

discuss its conceptual approach for meeting the decommissioning requirements in Title 10, 

“Energy,” of the Code of Federal Regulations (10 CFR) Part 20, “Standards for Protection 

against Radiation,” Subpart E, “Radiological Criteria for License Termination.” The applicant or 

licensee should discuss its plans for minimizing contamination. 

At the time of the initial license application and again at license renewal, the applicant or 

licensee may be required to submit a decommissioning funding plan (DFP) in accordance with 

10 CFR 70.25(b). The purpose of the NRC’s evaluation of the DFP is to determine whether the 

applicant or licensee has taken the following actions: 

1. considered decommissioning activities that may be needed in the future 

2. performed a credible site-specific cost estimate for those activities 

3. presented the NRC with financial assurance to cover the cost of those activities in the 

future 

Therefore, the DFP should contain the following: 

a. an overview of the proposed decommissioning activities 

b. the methods used to determine the cost estimate 

c. the financial assurance mechanism 

This overview must contain sufficient detail to enable the reviewer to determine whether the 

decommissioning cost estimate is reasonably accurate. 

In the application, the applicant or licensee should discuss its plans for meeting the 

decommissioning recordkeeping requirements in 10 CFR 70.25(g). Under the regulations, a 

licensee must keep records important for decommissioning. These records include records of 

spills or unusual occurrences involving the spread of contamination, as-built drawings and 

modifications to structures and equipment in restricted areas, a list of areas designated or 

formerly designated as restricted areas, and records pertaining to the financial-assurance 

requirements. 

If required by 10 CFR 70.38(g), the licensee must also submit, for NRC approval, a 

decommissioning plan (DP) before beginning its decommissioning actions. The DP must detail 

the specific decommissioning activities that the licensee will perform and describe the 

radiation-protection procedures that the licensee will use to protect workers, the public, and the 

environment during decommissioning. 
June 2015 10-2 NUREG-1520, Revision 2 

This information must be sufficient to enable the reviewer to assess the appropriateness of the 

decommissioning activities and the adequacy of the procedures to protect the health and safety 

of workers, the public, and the environment. It must also update the cost estimate originally 

presented in the DFP to undertake the facility decommissioning. The licensee can generally 

obtain approval of a DP by submitting an application for a license amendment. The reviewer 

must determine that the applicant understands the decommissioning requirements and 

procedures and that it commits to protecting the health and safety of workers, the public, and 

the environment during decommissioning. 

10.2 Responsibility for Review

Primary: Health Physics Reviewer 

Secondary: Environmental Reviewer 

 Technical and Financial Specialists in the Division of Waste Management and 

 Environmental Protection 

 Licensing Project Manager 

 

Supporting: Fuel Facility Inspection Staff 

10.3 Areas of Review

Before beginning to review the DFP or DP, the reviewer should first evaluate the applicant’s 

proposed environmental protection measures (see Chapter 9 of this standard review plan 

(SRP)) and, specifically, the commitments to minimize waste associated with decommissioning. 

In addition, the reviewer should evaluate the applicant’s radiation-protection program (see SRP 

Chapter 4) as it applies to radiological decontamination and the management of radiological 

effluents. 

The staff review should cover the following areas: 

1. conceptual decontamination and decontamination plan, including the decommissioning 

program and steps, management and organization, health and safety, radiological 

decommissioning criteria, waste management, security and nuclear-material control, 

recordkeeping, the decontamination process, and the minimization of contamination 

2. decommissioning costs and financial assurance (i.e., the decommissioning cost 

information should be consistent with the recommendations in NUREG-1757, 

“Consolidated Decommissioning Guidance,” issued September 2006) 

The reviewer will evaluate the applicant’s DFP or DP or both in accordance with NUREG-1757. 

10.4 Acceptance Criteria

10.4.1 Regulatory Requirements 

 

The following NRC regulations require planning, financial assurance, and recordkeeping for 

decommissioning, as well as procedures and activities to minimize waste and contamination: 
June 2015 10-3 NUREG-1520, Revision 2 

1. Subpart E of 10 CFR Part 20 

2. 10 CFR 30.35, “Financial Assurance and Recordkeeping for Decommissioning” 

3. 10 CFR 30.36, “Expiration and Termination of Licenses and Decommissioning of Sites 

and Separate Buildings or Outdoor Areas” 

4. 10 CFR 40.14, “Specific Exemptions” 

5. 10 CFR 40.36, “Financial Assurance and Recordkeeping for Decommissioning” 

6. 10 CFR 40.42, “Expiration and Termination of Licenses and Decommissioning of Sites 

and Separate Buildings or Outdoor Areas” 

7. 10 CFR 70.17, “Specific Exemptions” 

8. 10 CFR 70.22(a)(9) 

9. 10 CFR 70.25, “Financial Assurance and Recordkeeping for Decommissioning” 

10. 10 CFR 70.38, “Expiration and Termination of Licenses and Decommissioning of Sites 

and Separate Buildings or Outdoor Areas” 

10.4.2 Regulatory Guidance 

NUREG-1757 is relevant to the decommissioning of fuel cycle facilities. 

10.5 Review Procedures

During the acceptance review of a license application, the reviewer should examine the 

submittals to identify major deficiencies in the information provided for each area of review 

specified in SRP Section 10.3. Reviewers must decide whether they have enough information 

to proceed with a detailed review. Less significant errors or deficiencies that can be addressed 

in a request for additional information should be accepted. However, before the NRC performs 

a detailed review, the applicant should correct major deficiencies that would require several 

requests for additional information to resolve. 

Reviewers should record whether each area of review is adequately addressed in the 

application, is adequately addressed in a referenced document, is not applicable to the 

application, or has a major deficiency. 

The primary reviewer will evaluate the application against the NRC requirements and 

acceptance criteria identified in NUREG-1757. A detailed review of any contamination- and 

waste minimization plans that the applicant submits in response to 10 CFR 20.1406, 

“Minimization of Contamination,” will supplement this review (as appropriate). The reviewer will 

also coordinate with the principal reviewers for environmental protection listed in SRP 

Chapter 9 to confirm the review of a new applicant’s plans to minimize waste and the plans for 

existing licensees to minimize contamination and reduce exposures and effluents as part of the 

radiation protection program established under 10 CFR Part 20. The purpose of this 
June 2015 10-4 NUREG-1520, Revision 2 

coordination is to ensure that any issues that are relevant to the environmental review are 

properly conveyed to the primary reviewer for consideration and resolution as part of the review 

discussed in SRP Chapter 9 and that any decommissioning issues that arise in the 

environmental review that are best suited for review using guidance in this chapter are 

conveyed to the primary reviewer for consideration and resolution. 

If the decommissioning review identifies the need for the applicant to submit information that 

has not already been included in the application, the reviewer will document these additional 

information needs in a request for additional information (RAI). The RAI transmitted to the 

applicant will specify a reasonable amount of time (e.g., 30 to 60 days) for the applicant to reply. 

Failure of the applicant to provide the requested information by the specified date, or on an 

alternative schedule that is mutually agreeable, could be grounds for terminating or suspending 

the application review. 

The primary reviewer should coordinate with the Division of Waste Management and 

Environmental Protection to obtain the appropriate technical assistance in reviewing proposed 

DPs and financial assurance measures. The primary reviewer will coordinate with reviewers 

assigned by the Division of Waste Management and Environmental Protection to incorporate, as 

appropriate, RAIs and review findings in licensing correspondence and safety evaluation reports 

(SERs) related to decommissioning.

The reviewer should perform a safety review using the acceptance criteria in NUREG-1757 to 

ensure that the proposed decommissioning methodology, principal remediation activities, and 

worker and environmental radiation protection programs are acceptable. 

10.5.1 Safety Evaluation 

The primary reviewer will perform a safety evaluation with respect to the acceptance criteria in 

Section 10.4. During the initial review, the reviewer should draft the safety evaluation report 

(SER) described below. A request for additional information (RAI) will be prepared when 

clarification and additional information are needed to determine whether the licensee’s 

submittals comply with the regulations. The primary reviewer should coordinate with the 

licensing project manager in preparing RAIs. Additional information submitted by the applicant 

will be evaluated and a final SER will be provided to the licensing project manager. 

10.6 Evaluation Findings

The regulations in 10 CFR 70.23, “Requirements for the Approval of Applications,” and 70.66, 

“Additional Requirements for Approval of License Application,” state that an application for a 

license will be approved if the Commission can make the general findings listed in those 

sections. The basis for the general findings is an evaluation of whether the application 

adequately addresses all of the applicable regulatory requirements. More specifically, the staff’s 

evaluation should determine whether the licensing submittals provide sufficient information to 

satisfy the regulatory requirements listed in Section 4.4 of this SRP and whether the applicant 

has appropriately addressed the regulatory acceptance criteria also described in SRP 

Section 4.4. This SER should address each topic area reviewed and discuss why the NRC has 

reasonable assurance that the DFP or DP should be considered acceptable, explaining the 

bases for the reviewers’ conclusions. The SER should state how the applicable regulatory 

requirements have been met based on the acceptance criteria described in this chapter of the 
June 2015 10-5 NUREG-1520, Revision 2 

SRP. If the applicant chooses to use an alternative approach, the reviewer should discuss in 

the SER whether the proposed approach satisfies the applicable regulatory requirements. The 

reviewers should use the following approach to document their evaluation: 

1. State a specific regulatory requirement that applies to the application. Detailed 

acceptance criteria may be included where appropriate or necessary to clarify the 

requirement. 

2. Identify the areas where the regulatory requirement is addressed in the application, 

including the areas where the specific acceptance criteria described in this SRP are 

addressed. 

3. Describe your evaluation of the application, the basis for your conclusion, and whether 

regulatory requirements are met. 

4. Repeat these steps for every regulatory requirement that applies to the application. 

There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

application or amendment request, (2) denial of the application or request, or (3) approval with 

conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

reviewer may consider proposing a license condition. Absent an NRC Order, license conditions 

must be agreed upon with the licensee or applicant before becoming part of the license. A 

license condition should only be proposed if there is reasonable assurance that, if the licensee 

meets the condition, all regulatory requirements will be satisfied. Thus, license conditions 

should not be used to cover major deficiencies in an application. License conditions should be 

unambiguous, inspectable, and enforceable. They should only require those actions necessary 

to ensure compliance with applicable regulations. The basis for license conditions must be 

documented in the SER. 

If the submittal is acceptable, the final SER input should conclude with a statement similar to the 

following: 

The NRC staff has evaluated the applicant’s/licensee’s plans and financial 

assurance for decommissioning in accordance with NUREG-1757, “Consolidated 

Decommissioning Guidance,” issued September 2006. On the basis of this 

evaluation, the NRC staff has determined that the applicant’s/licensee’s plans 

and financial assurance for decommissioning comply with the NRC’s regulations 

and provide reasonable assurance of protection for workers, the public, and the 

environment. 

10.7 References

U.S. Code of Federal Regulations, “Standards for Protection against Radiation,” Part 20, 

Chapter I, Title 10, “Energy.” 

U.S. Code of Federal Regulations, “Rules of General Applicability to Domestic Licensing of 

Byproduct Material,” Part 30, Chapter I, Title 10, “Energy.” 
June 2015 10-6 NUREG-1520, Revision 2 

U.S. Code of Federal Regulations, “Domestic Licensing of Source Material,” Part 40, Chapter I, 

Title 10, “Energy.” 

U.S. Code of Federal Regulations, “Domestic Licensing of Special Nuclear Material,” Part 70, 

Chapter I, Title 10, “Energy.” 

U.S. Nuclear Regulatory Commission, “Consolidated Decommissioning Guidance,” 

NUREG-1757, September 2006. 
June 2015 11-1 NUREG-1520, Revision 2 

11. MANAGEMENT MEASURES 

11.1 Purpose of Review 

Management measures are activities performed by a licensee, generally on a continuing basis, 

that are applied to IROFS to provide reasonable assurance that the items relied on for safety 

(IROFS) will perform their intended safety function when needed to prevent accidents or 

mitigate the consequences of accidents to an acceptable level. The purpose of management 

measures is to provide reasonable assurance of compliance with Title 10 of the Code of Federal 

Regulations (10 CFR) 70.61, “Performance Measures.” Reasonable assurance is established 

by considering factors such as necessary maintenance, operating limits, common-cause 

failures, and the likelihood and consequences of failure or degradation of the IROFS and the 

measures. As defined in 10 CFR 70.4, “Definitions,” management measures include 

configuration management (CM), maintenance, training and qualification, procedures, audits 

and assessments, incident investigations, records management, and other quality assurance 

(QA) elements. 

11.2 Responsibility for Review 

Primary: Quality Assurance Reviewer 

Secondary: Licensing Project Manager 

Supporting: Primary Reviewers of Chapters 3 through 10 of this Standard review plan (SRP) 

 Fuel Cycle Facility Inspector 

Technical Staff knowledgeable in equipment/facility design, construction, 

installation, and maintenance (e.g., digital instrumentation and control, structural 

integrity, etc.) 

 

11.3 Areas of Review 

In accordance with 10 CFR 70.62(d), each applicant must establish management measures to 

ensure that IROFS, as documented in the integrated safety analysis (ISA) summary, provide 

reasonable assurance that they will be designed, implemented, and maintained in such a way 

as to ensure that they are available and reliable to perform their intended functions, when 

needed, to comply with the performance requirements of 10 CFR 70.61. The degree to which 

measures are applied may be a function of the item’s importance in meeting the performance 

requirements. 

If a “graded” application of a particular management measure is used for IROFS of differing 

importance, the applicant should describe the variations and the reviewer should determine 

whether the measures are commensurate with the importance to safety of the IROFS. The 

application of a graded program for management measures should not result in either intended 

or effective changes to the design, configuration, or technical requirements of IROFS that would 

result in a loss of confidence that the IROFS’ designated safety function would be performed. 

The guidance contained in this Chapter may be used in the development of a graded 

management measures program, or alternate graded controls may be proposed by the 

applicant. Exceptions and alternatives to these acceptance criteria may be adopted provided 

the applicant or licensee can demonstrate that it satisfies the management measures 
June 2015 11-2 NUREG-1520, Revision 2 

requirements in 10 CFR Part 70. A program of graded management measures may be 

implemented by new applicants, licensees proposing new facilities or new processes at existing 

facilities, or by existing licensees provided that the applicant or licensee describes the 

application of the ranking system and graded management measures in a license application or 

license amendment that is reviewed and approved by the NRC staff. Guidance for graded 

management measures in this chapter will refer to the “applicant,” to include applicants for new 

licenses or applicants for license amendments. 

The specific areas of review are as follows: 

1. Configuration Management—The U.S. Nuclear Regulatory Commission (NRC) staff 

review will determine whether the applicant has proposed a CM program that ensures 

consistency in the facility design and operational requirements, the physical 

configuration, and the facility documentation. The review should determine that the 

applicant’s CM program captures formal documentation governing the design and 

continued modification of the site, structures, processes, systems, components, 

computer programs, personnel activities, and supporting management measures. The 

review should also ensure that the CM program is adequately coordinated and 

integrated with other management measures. 

 The NRC staff should review the applicant’s descriptions and commitments for CM, 

including descriptions of the organizational structure responsible for CM activities; 

descriptions of the process, procedures, and documentation required by the applicant for 

modifying the site; and descriptions of the various levels of CM to be applied to IROFS 

designated in the ISA summary. The staff’s review should focus on the applicant’s CM 

measures that provide reasonable assurance of the documentation of engineering, 

procurement, installation, and modifications; the training and qualification of affected 

staff; the revision and distribution of operating, test, calibration, surveillance, and 

maintenance procedures and drawings; and the postmodification testing. The review of 

the overall approach to implementing CM should include the evaluation of the CM 

program, design requirements, document control, change control, assessments, and 

design reconstitution for existing facilities. 

2. Maintenance—The NRC staff’s review should evaluate the applicant’s description of its 

maintenance program. The staff will examine the applicant’s commitments to inspect, 

calibrate, test, and maintain IROFS to a level commensurate with the items’ importance 

to safety. The staff will review the applicant’s description of how the site organization 

implements (1) corrective maintenance, (2) preventive maintenance (PM), 

(3) surveillance and monitoring, and (4) functional testing. Not every aspect of each of 

the four maintenance functions is necessarily required. The applicant should justify the 

assignment of differing degrees of maintenance to individual IROFS based on the item’s 

contribution to risk reduction. 

3. Training and Qualification—The regulations at 10 CFR Part 70, “Domestic Licensing of 

Special Nuclear Material,” require that all personnel who perform activities relied on for 

safety be trained and tested so as to provide reasonable assurance that they 

understand, recognize the importance of, and are qualified to perform these activities in 

a manner that adequately protects public health and safety and the environment. As 

appropriate for their authority and responsibilities, these personnel should have the 

knowledge and skills necessary to design, operate, and maintain the facility safely. 
June 2015 11-3 NUREG-1520, Revision 2 

Therefore, the application should describe the training, testing, and qualification of these 

personnel, and the NRC staff should review this description. The review should examine 

the applicant’s experience and capabilities to provide this training for its personnel who 

will perform activities relied on for safety. The review of the training and qualification 

should address the following areas: 

 

a. organization and management of the training function 

b. analysis and identification of functional areas requiring training 

c. position training requirements 

d. development of the basis for training, including objectives 

e. organization of instruction and use of lesson plans and other training guides 

f. evaluation of trainee learning 

g. conduct of on-the-job training 

h. evaluation of training effectiveness 

i. personnel qualification 

j. provisions for continuing quality assurance, including the needs for retraining or 

reevaluation of qualification 

4. Procedures—The NRC staff review should examine the applicant’s process for the 

preparation, use, and management control of written procedures. This process should 

include the basic elements of identification, development, verification, review and 

comment resolution, approval, validation, issuance, change control, and periodic review. 

5. The actual operating procedures are not part of the license, and the NRC staff would not 

normally review them for technical adequacy since the inspection function addresses 

this aspect. The NRC staff should review the license application to ensure that the 

applicant’s process for establishing procedures adequately addresses the following 

areas: 

a. method for identifying procedures that are needed plantwide 

b. essential elements that are generic to all procedures 

c. method for creating and controlling procedures within plant management control 

systems 

d. method for verifying and validating procedures before use 

e. method for periodically reverifying and revalidating procedures 
June 2015 11-4 NUREG-1520, Revision 2 

f. method for ensuring that current procedures are available to personnel and those 

personnel are qualified to use the latest procedure 

g. the commitments to audit and assessment activities 

h. the use of qualified and independent audit and assessment personnel 

i. the general structure of typical audits and assessments 

j. the facility procedures to be used to direct and control the audit and assessment 

activities 

k. the planned use of the results of the audit and assessment activities 

l. the documentation to record and distribute the findings and recommendations of 

these audits and assessments 

m. the planning and implementation of corrective actions based on the findings and 

recommendations 

6. Incident Investigations—The NRC staff should review the applicant’s program, 

procedures, and management structure for investigating abnormal events and 

completing appropriate corrective actions. The review should include the provisions for 

establishing investigating teams, the methods for determining root causes, and the 

procedures for tracking and completing corrective actions and for documenting the 

process for the purpose of applying the “lessons learned” to other operations. The 

applicant may describe a corrective action program, which includes the functions of 

audits and assessment as well as incident investigations. This approach is acceptable 

and the reviewer should, in that case, review the applicant’s description and 

commitments with regard to the acceptance criteria in this SRP chapter for audits and 

assessments as well as incident investigations. 

7. Records Management—The requirements for the management of records vary 

according to the nature of the facility and the hazards and risks it poses. The staff 

should review areas related to the handling and storage of health and safety records and 

the records generated or needed in the design, construction, operation, and 

decommissioning phases of the facility. The review should provide reasonable 

assurance that the records management function is adequately coordinated and 

integrated with other management measures. The staff should review the following: 

a. the process whereby records (i.e., training records, dosimetry records, effluents 

records, records of classified information, records concerning facility IROFS and 

their failures) are created, selected, verified, categorized, indexed, inventoried, 

protected, stored, maintained, distributed, deleted, or preserved 

b. the handling and control of various kinds of records (including contaminated and 

classified records) and the media in which the records are captured 

c. the physical characteristics of the records storage area(s) with respect to the 

preservation and protection of the records for their designated lifetimes 
June 2015 11-5 NUREG-1520, Revision 2 

8. Other Quality Assurance Elements—The application should address other QA elements 

that will be applied to IROFS and other management measures. The NRC staff should 

evaluate whether the application of other QA elements is adequately described. The 

staff’s review objective is to obtain reasonable assurance that the design, procurement, 

construction, operation, maintenance, inspection, testing, and modification phases of a 

facility’s life cycle implement accepted QA principles. The NRC staff should examine the 

applicant’s commitment to overall QA, the selection of quality criteria and quality level, 

and the proposed method for implementation. Application of graded QA and quality 

levels commensurate with the risk involved should parallel the same risk levels 

established for maintenance and other management measures. 

The reviewer should recognize that facility safety may not be the only area at a fuel cycle 

facility requiring QA elements. The applicant’s customers and the NRC, under 

10 CFR Part 50, “Domestic Licensing of Production and Utilization Facilities,” may 

impose product-related QA criteria. This SRP limits the focus of the review of QA 

measures to ensuring the safety of workers and the public and protecting the 

environment (i.e., in relation to the performance requirements of 10 CFR 70.61). 

Review Interfaces 

Other sections of the license application may include information on CM, maintenance, training 

and qualification, procedures, audits and assessments, incident investigations, record 

management, or other QA elements applied to management measures. The NRC staff should 

focus its review activities on management measures associated with IROFS of high risk 

importance. The reviewer of this SRP chapter should coordinate with the reviewers of SRP 

Chapters 3 through 10 to inform the selection of management measures for more detailed 

review. 

11.4 Acceptance Criteria 

11.4.1 Regulatory Requirements 

Acceptance criteria are based on meeting the relevant requirements of the regulations 

described in this section. 

The regulatory basis for the review is 10 CFR 70.22, “Contents of Applications,” and 

10 CFR 70.65, “Additional Content of Applications.” In addition, the management measures 

review should provide reasonable assurance of compliance with the following regulations: 

1. 10 CFR 70.4 states that management measures include CM, maintenance, training and 

qualification, procedures, audits and assessments, incident investigations, records 

management, and other QA elements. 

2. 10 CFR 70.22(a)(8) requires that each application for a license must contain proposed 

procedures to protect health and minimize danger to life or property. 

3. 10 CFR 70.62(a)(3) states that records must be kept for all IROFS failures, describes 

required data to be reported, and sets time requirements for updating the records. 
June 2015 11-6 NUREG-1520, Revision 2 

4. 10 CFR 70.62(d) requires an applicant to establish management measures for 

engineered and administrative controls and control systems that are identified as IROFS, 

in accordance with 10 CFR 70.61(e), so that they are available and reliable to perform 

their functions when needed. 

5. 10 CFR 70.64(a)(1) states that, in accordance with management measures, IROFS 

must be designed, implemented, and maintained to provide reasonable assurance that 

they will be available and reliable to perform their safety function when needed. 10 CFR 

70.64(a)(1) further states that appropriate records of IROFS must be maintained by the 

licensee throughout the life of the facility. 

6. Facility change and change processes must conform to 10 CFR 70.72, “Facility Changes 

and Change Process.” 

7. 10 CFR 70.74(a) and 10 CFR 70.74(b) require incident investigation and reporting. 

11.4.2 Regulatory Guidance 

Regulatory guidance for compliance with Appendix B to 10 CFR Part 50 appears in American 

National Standards Institute/American Society of Mechanical Engineers (ANSI/ASME) NQA-1- 

2008 and the NQA-1a-2009 Addenda, “Quality Assurance Requirements for Nuclear Facility 

Applications,” as endorsed by Regulatory Guide 1.28, “Quality Assurance Program 

Requirements (Design and Construction),” Revision 4, issued June 2010. This guidance 

applies to applications for plutonium processing and fuel fabrication facilities because these 

facilities are required to comply with Appendix B in order to comply with the requirements of 10 

CFR 70.23(b). 

11.4.3 Regulatory Acceptance Criteria 

The reviewer should find the applicant’s management measures acceptable if the applicant has 

met the acceptance criteria described in the following sections or has identified and justified an 

alternative approach. 

Applicants may propose a system of management measures that are graded commensurate 

with the safety significance of the IROFS to which they are applied. In proposing to reduce 

controls, however, certain acceptance criteria must be met: (1) the system of graded 

management measures must be sufficient to ensure the IROFS’ design integrity and the 

availability and reliability of an IROFS to successfully perform its safety function, and (2) 

applicants choosing to apply a graded system of management measures must describe how the 

proposed graded system will ensure that the performance requirements of §70.61 will be met 

and that public health and safety will be protected. This description should include an 

explanation of the process used to assign IROFS to categories based on their safety 

significance as well as a description of how each management measure will be graded for the 

defined categories. 

When considering the application of graded management measures, applicants should consider 

the essential elements of the process (such as assigning IROFS to categories based on their 

safety significance and identification of graded management measures) to be high safetysignificant activities that are not subject to grading. Consequently, applicants should note that it 

is necessary to consider feedback information from performance monitoring mechanisms (such 
June 2015 11-7 NUREG-1520, Revision 2 

as surveillances performed as part of the maintenance function) and corrective action elements 

that may necessitate the reinstatement of controls that had been previously relaxed. Due to the 

importance of the performance monitoring and corrective action elements in assuring the 

effectiveness of graded management measures, these activities should be treated as highly 

safety-significant and should not be subject to graded controls. As described in this NUREG, 

the following management measures may be subject to grading: configuration management, 

maintenance, training and qualification, procedures, audits and assessments, incident 

investigations, records management, and other QA elements. 

The Quality Assurance Reviewer will review the graded controls based on the categorization of 

IROFS using the review guidance in this SRP Chapter. The categorization process developed 

to enable the ranking of IROFS according to their significance will be reviewed by technical staff 

using the guidance in Chapter 3 of this SRP. The reviewer should coordinate with the Chapter 

3 reviewer as needed to evaluate the applicant’s selection of IROFS for the application of 

graded management measures. Criteria that should be considered include: function or end use 

of the IROFS; consequence of failure of the IROFS to public health and safety or worker 

protection; reliability of the IROFS; complexity of the design or fabrication of the IROFS; 

uniqueness of the item, and/or history of supply and performance. 

11.4.3.1 Configuration Management

The regulation at 10 CFR 70.4 defines CM as a management measure that provides oversight 

and control of design information, safety information, and records of modifications that might 

impact the ability of IROFS to perform their functions when needed. The applicant’s description 

of CM is acceptable if it meets the following conditions: 

1. The application describes the CM program, design requirements, document control, 

change control, assessments, and design reconstitution (for existing facilities only). 

2. The application describes the CM program and defines the specific attributes of CM that 

will be applied to select IROFS. 

3. The ISA summary clearly defines the IROFS to be listed under CM along with the 

assignment of any grades or quality levels. The applicant should indicate in the ISA 

summary the CM attributes that will be applied to a particular IROFS. However, in the 

ISA summary, this indication may consist of only an index or category designation. 

 

4. The application describes a design process leading to drawings and other statements of 

requirements that proceeds logically from the design basis. 

5. The application describes how design requirements and associated design bases are 

established and are maintained through control of the design process. It also describes 

technical management review and approval functions. 

6. The application describes an acceptable method to create and control documents that 

are relied on for safety. These documents include design requirements, ISAs, as-built 

drawings, specifications, all procedures that are IROFS, procedures involving training, 

QA, maintenance, audits and assessments, emergency operating procedures, 

emergency response plans, system modification documents, assessment reports, and 

others that the applicant deems part of CM. 
June 2015 11-8 NUREG-1520, Revision 2 

7. The application describes how the CM function will maintain strict consistency among 

the design requirements, the physical configuration, and the facility documentation. 

8. The application contains a commitment to evaluate, implement, and track each change 

to the site, structures, processes, systems, equipment, components, computer 

programs, and activities of personnel. 

9. The application describes an acceptable process for providing reasonable assurance 

that the ISA is systematically reviewed and modified to reflect design or operational 

changes from an established safety basis and that all documents outside the ISA that 

are affected by safety-basis changes are properly modified, authoritatively approved, 

and made available to personnel. 

10. The application describes the documentation process following changes made in 

accordance with 10 CFR 70.72. Changes to the affected onsite documentation should 

be made promptly to avoid inadvertent access by facility personnel to outdated design 

and other specifications for IROFS. 

11. The application confirms that initial and periodic assessments of the CM function are 

conducted to determine the program’s effectiveness and to correct deficiencies. The 

application indicates that such assessments are systematically planned and conducted 

in accordance with an overall facility audit and assessment function. 

12. For existing facilities, the application may describe whatever design reconstitution has 

been done for the purpose of the application. The applicant has available the current 

design bases, including design requirements, supporting analyses, and documentation 

supporting all IROFS. 

13. For new facilities or new processes at existing facilities, the application describes facility 

and system design and facility layout based on defense-in-depth practices, in 

accordance with 10 CFR 70.64, “Requirements for New Facilities or New Processes at 

Existing Facilities.” Specifically, 10 CFR 70.64(b) states that facility and system design 

must be founded on defense-in-depth practices and must incorporate, to the extent 

practicable: (1) preference for engineered controls over administrative controls and (2) 

reduction of challenges to IROFS. Thus, facility and system designs relying only on 

administrative controls, or relying on IROFS that are frequently or continuously 

challenged, are not acceptable, unless the application provides a justification showing 

that alternatives to achieve the design criteria are not practicable. Defense-in-depth 

practices should be applied early through the completion of design by providing 

successive levels of protection such that health and safety will not wholly depend on any 

single element of the design, construction, maintenance, or operation of the facility. 

The process of evaluating facility changes through the configuration management program is 

important to ensure the availability and reliability of IROFS, all of which must be described in 

the ISA summary pursuant to 10 CFR 70.65(b)(6). ). Applicants choosing to apply a graded 

system of management measures for configuration management activities must describe 

elements of configuration management that will be applied in a graded manner to IROFS based 

on their safety significance. Any change to site, structures, processes, systems, equipment, 

components, computer programs, and activities of personnel must be evaluated by the licensee 

as specified in 10 CFR 70.72(a) before the change is implemented. Therefore, the configuration 
June 2015 11-9 NUREG-1520, Revision 2 

management process must be applied to all IROFS regardless of their safety significance. 

However, measures associated with configuration management may be suitable for graded 

application. Grading of configuration management may include a system in which the level of 

configuration management applied to items, processes, equipment, software, and personnel 

activities is based on the importance of the item or activity to safety. For example, graded 

configuration management controls may entail a less intensive review process for changes 

associated with items of lower safety significance (e.g., less rigorous scope of review, review 

performed by a skilled design engineer versus design manager, etc.). 

11.4.3.2 Maintenance 

As required by 10 CFR 70.62(d), engineered and administrative controls that are identified as 

IROFS must be designed, implemented, and maintained to ensure that they are available and 

reliable when needed. 

The regulation at 10 CFR 70.64(a)(8) requires that IROFS for new facilities or new processes at 

existing facilities receive adequate inspection, testing, and maintenance to ensure their 

availability and reliability when needed. 

A. The reviewers should find the applicant’s submittal acceptable if the application includes 

the following information: 

1. descriptions of corrective maintenance, PM, surveillance and monitoring, and 

functional testing 

2. description of how the maintenance function will be designed to ensure that the 

objective of preventing failures through maintenance is appropriately balanced 

against the objective of minimizing unavailability of IROFS because of monitoring 

or PM 

3. discussion of how the maintenance function uses, interfaces with, or is linked to 

the various management measures

4. justifications for assignment of differing degrees of maintenance to individual 

IROFS, based on the item’s contribution to the reduction of risk 

5. for IROFS identified in the ISA summary, description of the surveillance function 

and its conduct at a specified frequency 

6. description of how the surveillance activity supports the determination of 

performance trends for IROFS, thus providing data useful in determining PM 

frequencies 

7. description of the applicant’s retention of records of the current surveillance 

schedule, performance criteria, and test results for all IROFS 

8. for surveillance tests that can be done only while IROFS are out of service, 

description of the proper compensatory measures that will be prescribed for the 

continued normal operation of a process 
June 2015 11-10 NUREG-1520, Revision 2 

9. description of how the results of incident investigations, the review of failure 

records required by 10 CFR 70.62(a)(3), and identified root causes are used to 

modify the affected maintenance function and eliminate or minimize the root 

cause 

10. documentation of the approach to performing corrective actions or repairs on 

IROFS 

11. description of how the maintenance function provides a planned, systematic, 

integrated, and controlled approach for the repair and replacement activities 

associated with identified unacceptable performance deficiencies of IROFS 

12. description of the PM function that demonstrates a commitment to conducting 

preplanned and scheduled periodic refurbishing, or partial or complete overhaul, 

of IROFS to minimize occurrences of their unanticipated losses 

13. description of the applicant’s retention of records showing the PM schedule and 

results for all IROFS subject to this maintenance component 

14. general description of the methods used and the commitment to perform 

functional testing, as needed, of IROFS after PM or corrective maintenance 

15. as necessary, a commitment to conduct functional tests designed to include all 

operational aspects of the IROFS that are important to safety during startup of 

new processes

16. description of how the applicant will maintain records showing the functional test 

schedule and results for all IROFS subject to this maintenance component 

17. general discussion of how the applicant will verify that the administrative controls 

identified as IROFS are available and reliable to perform their intended safety 

function over extended periods of operation 

B. Applicants choosing to apply a graded system of management measures for 

maintenance activities must describe elements of maintenance that will be applied in a 

graded manner to IROFS based on their safety significance. 

Grading of maintenance activities may include elements such as the following: 

1. Reduced frequency for surveillance and monitoring activities used to ensure the 

continued integrity and functionality of the IROFS; 

2. Implementation of preventative maintenance activities commensurate with the 

reliability of the item (lower importance of the item to safety and lower 

susceptibility of the item to failure allows reduced frequency or rigor for PM); and 

3. Extended calibration intervals (not to exceed manufacturer recommendations or 

accepted industry standards or practice). 

 
June 2015 11-11 NUREG-1520, Revision 2 

11.4.3.3 Training and Qualification 

The application should be acceptable regarding personnel training and qualification if it satisfies 

the criteria described below. In addition to the regulatory acceptance criteria, the SRP provides 

additional specific criteria for (1) training and qualification for radiation safety personnel in 

Section 4.4.5, (2) criticality safety in Section 5.4.3.2, and (3) emergency planning in 

Section 8.4.3.1.11. Similarly, some of the information specified below may appear in other 

sections of the application and may be incorporated by reference. 

A. Review criteria include the following: 

1. The application should include the following commitments regarding organization 

and management of training: 

a. Line management is responsible for the content and effective conduct of 

the training. 

b. The application clearly defines job function, responsibility, authority, and 

accountability of personnel involved in managing, supervising, and 

implementing training. 

c. The applicant uses performance-based training as the primary 

management tool for analyzing, designing, developing, conducting, and 

evaluating training. 

d. The applicant documents and implements procedures to provide 

reasonable assurance that all phases of training are conducted reliably 

and consistently. 

e. The applicant ensures that training documents are linked to the CM 

system to provide reasonable assurance that the training reflects design 

changes and modifications. 

f. The applicant grants exemptions from training to trainees and incumbents 

only when justified, documented, and approved by management. 

g. The applicant maintains both programmatic and individual training 

records. These records support management information needs and 

provide required data on each individual’s training and qualification. 

2. The applicant should provide formal training for each position or activity that is 

relied on for safety. Training may be classroom or on-the-job training or both. 

The application should state what training will be conducted and which personnel 

will be required to complete it. The application should also demonstrate the 

following: 

a. The applicant ensures that each activity selected for training (initial or 

continuing) from the facility-specific activities is correlated with supporting 

procedures and training materials. 
June 2015 11-12 NUREG-1520, Revision 2 

b. The applicant reviews facility-specific activities selected for training and 

compares training materials on an established schedule, updating them 

as necessitated by changes in procedures, facility systems and 

equipment, or job scope. The applicant monitors and evaluates change 

actions (e.g., procedure changes, equipment changes, facility 

modifications) for their impact on the development or modification of initial 

and continuing training and incorporates such change actions in a timely 

manner. 

3. The application should contain commitments regarding personnel qualification for 

managers, supervisors, designers, technical staff, construction personnel, facility 

operators, technicians, maintenance personnel, and other staff who perform 

regulated activities. 

4. The application should contain commitments regarding minimum qualifications 

for personnel. Minimum qualifications should be commensurate with the 

assigned functional responsibility and authority of the respective personnel as 

detailed below: 

a. Managers should have a bachelor of science (B.S.), bachelor of art 

(B.A.), or equivalent degree. Each manager should have either 

management or technical experience in a facility similar to the facility 

identified in the application. 

b. Supervisors should have at least the qualifications required of personnel 

being supervised. 

c. Technical professional staff whose actions or judgments are critical to 

satisfying the performance requirements identified in 10 CFR Part 70 

should have a B.S., B.A., or equivalent degree in the appropriate 

technical field. 

d. Construction personnel, facility operators, technicians, maintenance 

personnel, and other staff whose actions are required to comply with NRC 

regulations should have completed the applicant’s training process or 

have equivalent experience or training. 

e. The applicant should require candidates for process operators to meet 

the minimum qualifications described in the application. The applicant 

should require candidates for job functions other than process operators 

to meet minimum qualifications, but the application need not describe 

these minimum qualifications. 

5. Training objectives should state the knowledge, skills, and abilities that the 

trainee should acquire; the conditions under which required actions will take 

place; and the standards of performance the trainee should achieve upon 

completion of the training activity. 
June 2015 11-13 NUREG-1520, Revision 2 

6. Lesson plans and other training guides should provide guidance to ensure the 

consistent conduct of training activities and should be based on required learning 

objectives derived from specific job performance requirements. 

7. The applicant should use lesson plans or guides for all training, and these lesson 

plans or guides should include standards for evaluating acceptable trainee 

performance. The evaluation of trainee accomplishment is acceptable if the 

applicant evaluates trainees periodically during training to determine their 

progress toward full capability to perform the job requirements and at the 

completion of training to determine their capability to perform the job 

requirements. 

8. The applicant should establish review and approval requirements for all lesson 

plans or guides and other training materials before their issue and use. 

9. The application should describe any on-the-job training used for activities relied 

on for safety. 

10. The applicant should conduct on-the-job training using well-organized and 

current training materials. Designated personnel who are competent in the 

program standards and training methods should conduct the training. 

11. Completion of on-the-job training should be by actual task performance. When 

the actual task cannot be performed and is, therefore, “walked down,” the 

conditions of task performance, references, tools, and equipment should reflect 

the actual task to the extent possible. 

12. Provisions for continuing assurance of personnel training and qualification are 

acceptable if the application addresses periodic requalification of personnel by 

training or testing or both, as necessary, to provide reasonable assurance that 

personnel continue to understand, recognize the importance of, and be qualified 

to perform activities that are relied on for safety. 

13. An evaluation of training effectiveness and its relation to job performance is 

acceptable if it provides reasonable assurance that the training conveys all 

required skills and knowledge and is used to revise the training, where 

necessary, based on the performance of trained personnel in the job setting. 

The application should also demonstrate the following: 

a. Qualified individuals should periodically conduct a comprehensive 

evaluation of individual training to identify strengths and weaknesses. 

The applicant should use feedback from trainee performance during 

training and from former trainees and their supervisors to evaluate and 

refine the training. 

b. The applicant should initiate, evaluate, track, and incorporate 

improvements and changes to initial and continuing training to correct 

training deficiencies and performance problems. 
June 2015 11-14 NUREG-1520, Revision 2 

B. Applicants choosing to apply a graded system of management measures for training and 

qualification activities must describe the elements of training and qualification that will be 

applied in a graded manner to IROFS based on their safety significance. 

Grading of training and qualification activities may include elements such as the 

following: 

1. Qualifications for personnel performing activities associated with graded IROFS 

may be subject to a different set of minimum training, education, and/or 

qualification requirements compared to personnel performing activities 

associated with IROFS determined to be of high significance. 

Graded training and qualification requirements should be designated commensurate with 

the functional responsibility and authority assigned to personnel and the importance of 

the skill or activity to safety. Training and qualification activities, even when applied in a 

graded manner, should be documented; performed in accordance with procedures, 

lesson plans, and/or written guidance; assessed periodically to determine continued 

effectiveness; and should include measures for evaluating trainee performance. 

11.4.3.4 Procedures 

The regulation at 10 CFR 70.22(a)(8) requires that the application contain procedures to protect 

public health and safety. The application is acceptable in this regard if it describes the 

applicant’s process for developing and implementing procedures and satisfies the following: 

1. The applicant provides information regarding the procedure categories used at the 

facility. The categories typically include management control, operating, maintenance, 

and emergency procedures. 

2. The applicant writes or plans procedures for the operation of IROFS and for all 

management measures supporting those IROFS. 

3. The applicant includes the following commitment regarding procedure adherence: 

“Activities involving licensed SNM and/or IROFS will be conducted in accordance with 

approved procedures.” 

4. The applicant develops procedures for sitewide safe work practices to control processes 

and operations with licensed special nuclear material (SNM) and/or IROFS and/or 

hazardous chemicals incident to the processing of licensed material. 

5. The applicant has existing or planned procedures to direct the following activities: 

(1) design, (2) CM, (3) procurement, (4) construction, (5) radiation safety, 

(6) maintenance, (7) QA elements, (8) training and qualification, (9) audits and 

assessments, (10) incident investigations, (11) records management, (12) criticality 

safety, (13) fire safety, (14) chemical process safety, and (15) reporting requirements. 

6. Procedures are required for operator actions that are necessary to prevent or mitigate 

accidents identified in the ISA summary. The applicant provides a listing of the types of 

activities that are covered, or are planned to be covered, by written procedures. The 

listing includes the topics of administrative procedures; system procedures that address 
June 2015 11-15 NUREG-1520, Revision 2 

startup, operation, and shutdown; abnormal operation or alarm response; maintenance 

activities that address system repair, calibration, inspection, and testing; and emergency 

procedures. Appendix A to this SRP chapter provides an acceptable listing of the items 

to be included under each topic. 

7. The applicant describes the method for identifying, developing, approving, implementing, 

and controlling operating procedures as follows: 

a. The applicant considers the ISA in identifying needed procedures. 

b. The procedure specifies operating limits and IROFS. 

c. Procedures include required actions for off-normal conditions of operation, as 

well as normal operations. 

d. If needed, procedures identify safety checkpoints, as appropriate. 

e. The applicant uses field tests to validate procedures. 

f. The management personnel who are responsible and accountable for the 

operation approve the procedures. 

g. The applicant specifies a mechanism for revising and reissuing procedures in a 

controlled manner. 

h. QA elements and CM functions at the facility provide reasonable assurance that 

current procedures are available and used at all work locations. 

i. The training program instructs the required personnel in the use of the latest 

procedures. 

8. Procedures should incorporate the following elements: 

a. title and identifying information, such as number, revision, and date 

b. statement of applicability and purpose 

c. prerequisites 

d. precautions (including warnings, cautions, and notes) 

e. important human actions 

f. limitations and actions 

g. acceptance criteria 

h. checkoff lists 

i. reference material 
June 2015 11-16 NUREG-1520, Revision 2 

9. Maintenance procedures involving IROFS commit to the topics listed below for corrective 

and preventive maintenance and functional testing after maintenance and surveillance 

activities: 

a. Premaintenance activities involve reviews of the work to be performed, including 

procedure reviews for accuracy and completeness. 

b. Steps require notification of all affected parties (operators and supervisors) 

before performance of work and on completion of maintenance work. The 

discussion includes potential degradation of IROFS during the planned 

maintenance. 

c. Control of work is ensured by comprehensive procedures to be followed by 

maintenance technicians. The various safety disciplines, including criticality, fire, 

radiation, industrial, and chemical process safety, review maintenance 

procedures. The procedures describe the following: 

i. qualifications of personnel authorized to perform the maintenance 

or surveillance 

ii. controls on and specification of any replacement components or materials 

to be used (should be controlled by the CM function to ensure like-kind 

replacement and adherence to 10 CFR Part 21, “Reporting of Defects 

and Noncompliance”) 

iii. postmaintenance testing to verify operability of the equipment 

iv. tracking and records management of maintenance activities 

v. safe work practices (e.g., moderation control or exclusion area; radiation 

or hot work permits; and criticality, fire, chemical, and environmental 

issues) 

 

10. The applicant has formal requirements governing the use of temporary procedures. 

Temporary procedures may be issued only when permanent procedures do not exist to 

(1) direct operations during testing, maintenance, and modifications, (2) provide 

guidance in unusual situations not within the scope of permanent procedures, and 

(3) provide assurance of orderly and uniform operations for short periods when the 

facility, system, or component is performing in a manner not covered by permanent 

procedures. The discussion establishes a timeframe for use of the temporary procedure 

and sets the same level of review and approval as for permanent procedures. 

11. The applicant verifies that the procedures are technically accurate and can be performed 

as written. The applicant periodically reviews the procedures to ensure their continued 

accuracy and usefulness and establishes the timeframe for reviews of the various types 

of procedures. 
June 2015 11-17 NUREG-1520, Revision 2 

12. The applicant describes the use and control of procedures. Provisions allow for 

operations to stop and place the process in a safe condition if a step of a procedure 

cannot be performed as written. 

13. The applicant reviews procedures after unusual incidents, such as an accident, 

unexpected transient, significant operator error, or equipment malfunction, or after any 

modification to a system and revises procedures as needed. 

14. The applicant need not control program and administrative procedures and other 

nonoperational procedures that do not impact IROFS or other environmental, safety, and 

health concerns with the stringency applied to operating procedures or management 

control procedures associated with IROFS specified by the ISA summary. The applicant 

should specify the applicability of less stringent procedure control to avoid 

misunderstandings in implementation. 

Applicants choosing to apply a graded system of management measures for activities 

associated with the development, implementation, and maintenance of procedures must 

describe the elements of procedure-related activities that will be applied in a graded manner to 

IROFS based on their safety significance. Because activities involving licensed SNM and/or 

IROFS must be conducted in accordance with approved procedures, no detailed guidance is 

provided on grading procedures. Procedures and written guidance should be sufficiently 

detailed in nature to describe expectations for the conduct of activities associated with IROFS to 

ensure their availability and reliability. Such procedures should be subject to a review and 

approval process and periodic reviews to ensure their continued effectiveness and suitability for 

the activities to which they apply. 

11.4.3.5 Audits and Assessments 

A. The NRC reviewers should find the application acceptable in terms of audits and 

assessments if it provides reasonable assurance that the following are adequately 

addressed and satisfied: 

1. The application describes program directives covering the audit and assessment 

function (i.e., the activities to be audited, audit frequency, guidance in conducting 

the audit or assessment, assigned responsibilities for each phase of the work, 

and procedures for recording the results and recommending actions to be taken). 

2. The application contains a commitment to conduct internal audits and 

independent assessments of activities significant to facility safety and 

environmental protection. 

3. The application states that audits will be performed to verify that operations are 

being conducted in accordance with regulatory requirements and license 

commitments. 

4. The application states that independent assessments will be conducted by offsite 

groups or individuals not involved in the licensed activity to verify that the health, 

safety, and environmental compliance functions are effectively achieving their 

designed purposes. 
June 2015 11-18 NUREG-1520, Revision 2 

5. The application states that audits and assessments will be conducted for the 

areas of radiation safety, nuclear criticality safety, chemical safety, fire safety, 

environmental protection, emergency management, QA, CM, maintenance, 

training and qualification, procedures, incident investigation, and records 

management. 

6. The application states that qualified personnel without direct responsibility for the 

function and area being audited or assessed will perform the audits and 

assessments. The application specifies the staff positions and committees 

responsible for audits and assessments and describes the levels of management 

to which results are reported. The systems to provide corrective actions are also 

described. 

B. Applicants choosing to apply a graded system of management measures for audit and 

assessment activities must describe the elements of audits and assessments that will be 

applied in a graded manner to IROFS based on their safety significance. 

Grading of audits and assessments may include elements such as the following: 

1. Reduced audit and assessment frequency for graded IROFS; and 

2. Performance of assessment activities associated with graded IROFS by 

personnel knowledgeable of the trade or skill involved in conduct of the activity in 

lieu of personnel with specific training in the conduct of assessments. 

11.4.3.6 Incident Investigations 

The applicant’s description of its incident investigations activities and commitments in the 

application will be acceptable if the reviewer finds reasonable assurance of the following: 

1. The applicant will establish a formal procedure to investigate abnormal events that may 

occur during operation of the facility to determine their specific or generic root cause(s), 

generic implications, and risk significance; to recommend corrective actions; and to 

report to the NRC as required by 10 CFR 70.50, “Reporting Requirements,” and 

10 CFR 70.74, “Additional Reporting Requirements.” Appendix B to this SRP chapter 

presents guidance regarding the contents of an incident investigation program or 

procedure. 

2. The applicant will monitor and document corrective actions through completion and 

ensure that corrective actions are taken within a reasonable period to resolve findings 

from abnormal event investigations. 

3. The applicant will maintain documentation related to abnormal events for the life of the 

operation so that “lessons learned” may be applied to future operations of the facility. 

Details of the event sequence will be compared with accident sequences already 

considered in the ISA, and the ISA summary will be modified to include evaluation of the 

risk associated with accidents of the type actually experienced. 

Applicants choosing to apply a graded system of management measures for incident 

investigation activities must describe the elements of incident investigations that will be applied 
June 2015 11-19 NUREG-1520, Revision 2 

in a graded manner to IROFS based on their safety significance. Because it is important to 

investigate abnormal events occurring at a licensed facility to ensure that reporting requirements 

are met and public health and safety is ensured, no detailed guidance is provided on grading 

incident investigation activities. Rather, the management measures program should take into 

account risk significance of an incident as part of the investigation process, thereby providing a 

means of grading the incident investigation process in relation to the IROFS significance. 

11.4.3.7 Records Management 

The reviewer will find the applicant’s records management system acceptable if the application 

describes the following criteria: 

1. The applicant prepares, verifies, characterizes, and maintains records. 

2. The applicant ensures that records are legible, identifiable, and retrievable for their 

designated lifetimes. 

3. The applicant categorizes records by relative safety importance to identify record 

protection and storage needs and to designate the retention period for individual kinds of 

records. 

4. The applicant protects records against tampering, theft, loss, unauthorized access, 

damage, or deterioration while in storage. 

5. The applicant establishes and documents procedures specifying the requirements and 

responsibilities for record selection, verification, protection, transmittal, distribution, 

retention, maintenance, and disposition. 

6. The applicant implements procedures that (1) assign responsibilities for records 

management, (2) specify the authority needed for records retention or disposal, 

(3) specify which records must have controlled access and provide the controls needed, 

(4) provide for the protection of records from loss, damage, tampering, and theft or 

during an emergency, and (5) specify procedures for ensuring that the records 

management system remains effective. 

7. The applicant puts procedures in place to promptly detect and correct any deficiencies in 

the records management system or its implementation. 

8. The applicant must maintain and update records of IROFS failures in accordance with 

10 CFR 70.62(a)(3). The applicant must make record revisions necessitated by 

postfailure investigation conclusions promptly after completion of the investigation. 

9. For computer codes and computerized data used for activities relied on for safety, as 

specified in the ISA summary, the applicant establishes procedure(s) for maintaining 

readability and usability of older codes and data as computing technology changes. The 

procedures could include transfer of the older forms of information and codes for older 

computing equipment to contemporary computing media and equipment. 

Appendix C to this SRP chapter lists the types of records that the system should include. 
June 2015 11-20 NUREG-1520, Revision 2 

Applicants choosing to apply a graded system of management measures for records 

management activities must describe the elements of records management will be applied in a 

graded manner to IROFS based on their safety significance. It is expected that records 

management functions will be applied to all IROFS regardless of their safety significance. 

Further, the preparation, issuance, and modification of quality-affecting documents must be 

performed in accordance with a controlled system for all IROFS. However, certain aspects of 

recordkeeping may be subject to grading for IROFS of low safety significance. For example, 

unless required by other regulation, record retention times may be lower for IROFS of lower 

safety significance. Similarly, design and procurement records may be less detailed for IROFS 

with less complex designs and low safety significance. 

In all cases, measures for the designation, protection, storage, maintenance, and retention of 

records should be applied to IROFS in a manner appropriate to ensure the capability to (1) 

maintain plant design and configuration control, and (2) evaluate failures, perform root cause 

analyses, and determine appropriate corrective actions. 

11.4.3.8 Other Quality Assurance Elements 

To be acceptable, the applicant’s QA elements should be structured to apply appropriate 

measures to IROFS. The NRC staff expects applicant and licensee QA elements to differ 

based on the purpose and complexity of the facility and processes. 

A. Other QA may include some or all of the following elements: 

1. Organization—The applicant may describe the organizational structure, 

functional responsibilities, lines of authority, and lines of communication for 

control of activities affecting quality. The organization responsible for ensuring 

that appropriate QA has been established should have sufficient authority, 

access to work areas, and organizational independence to perform its 

responsibilities. 

2. QA Program—The applicant may describe its application of QA elements in the 

form of a QA program, in which the applicant commits to meet the relevant 

requirements of applicable standards. The commitment may describe the 

applicant’s graded approach to QA, in which measures are implemented 

commensurate with an item’s importance to safety, or the commitment may 

describe a QA program applied to all IROFS. The applicant should fully 

document, plan, implement, and maintain QA elements to provide reasonable 

assurance that, together with other management measures, IROFS will be 

available and reliable when needed. 

3. Design Control—The applicant should define, control, and verify its design 

controls. The applicant should specify and correctly translate design inputs to 

design documents. Controlled measures, commensurate with those applied to 

the original design, should govern the adequacy of design and design changes. 

(See Sections 11.3, 11.4.3.1, 11.5.1, and 11.6.1 of this SRP for details on CM.) 

4. Procurement Document Control—Documents associated with the procurement of 

items and services include or reference the applicable 10 CFR Part 21 

(“Reporting of Defects and Noncompliance”) reporting requirements, and other 
June 2015 11-21 NUREG-1520, Revision 2 

design, technical, regulatory, and administrative requirements, (such as 

specifications, codes, standards, tests, inspections, and special processes) 

necessary to ensure adequate quality. Procurement documents identify 

requirements applicable to suppliers of items and services relied on for safety, 

such as QA program requirements. 

5. Instructions, Procedures, and Drawings—The applicant should ensure that 

activities affecting the quality of IROFS are prescribed by and performed in 

accordance with documented instructions, procedures, or drawings appropriate 

for the circumstances and reference appropriate quantitative or qualitative 

acceptance criteria. (See Sections 11.3, 11.4.3.4, 11.5.4, and 11.6.4 of this SRP 

for details on procedures.) 

6. Document Control—The applicant’s document control system describes the 

preparation, issuance, and modification of documents that specify quality 

requirements or prescribe activities affecting quality. The document control 

system is controlled in a manner that ensures that authorized personnel review 

documents and changes thereto for adequacy and approve them for release. 

(See Sections 11.3, 11.4.3.1, 11.5.1, and 11.6.1 of this SRP for details on CM 

and Sections 11.3, 11.4.3.4, 11.5.4, and 11.6.4 for details on procedures.) 

7. Control of Purchased Material, Equipment, and Services—The applicant may 

describe controls for the procurement of items and services to ensure that they 

conform to procurement requirements and/or design documents and 

specifications. Descriptive controls of purchased items and services include, as 

appropriate, source evaluation and selection, source inspection, audit, the 

examination of items or services upon delivery or completion, mechanisms for 

control of changes in items or services, commercial-grade item requirements, 

and control of supplier nonconformance. 

8. Identification and Control of Items—The applicant establishes controls to ensure 

that only the correct items are used or installed. The applicant may describe 

provisions to identify and maintain traceability of items. 

9. Control of Special Processes—The applicant establishes controls of processes 

affecting the safety of IROFS or related services. Qualified personnel using 

qualified procedures in accordance with specified requirements perform special 

processes that control activities, such as welding, heat treating, and 

nondestructive examination. 

10. Inspection—When inspections are used to verify conformance of an IROFS item 

or activity, the applicant should specify the characteristics to be inspected and 

the inspection methods to be used and plan and execute the inspection. The 

applicant should then document the inspection results. Qualified personnel other 

than those who performed or directly supervised the work being inspected should 

perform the inspections. (See Sections 11.3, 11.4.3.4, 11.5.4, and 11.6.4 of this 

SRP for details on procedures and Sections 11.3, 11.4.3.3, 11.5.3, and 11.6.3 for 

details on training and qualification.) 
June 2015 11-22 NUREG-1520, Revision 2 

11. Test Control—The applicant should conduct tests performed to verify 

conformance of an IROFS or computer program to specified requirements and 

demonstrate availability and reliability of performance. The applicant should 

specify the characteristics to be tested and test methods to be used. Test results 

should be documented and evaluated against the test requirements and 

acceptance criteria. (See Sections 11.3.1, 11.4.3.4, 11.5.4, and 11.6.4 of this 

SRP for details on procedures and Sections 11.3, 11.4.3.3, 11.5.3, and 11.6.3 for 

details on training and qualification.) 

12. Control of Measuring and Test Equipment—The applicant should establish 

controls for tools, gauges, instruments, and other measuring and test equipment 

used for IROFS and activities affecting IROFS. Controls of measuring and test 

equipment should consider methods and frequency of calibration, and the 

applicant should adjust such controls to maintain accuracy within specified limits. 

13. Handling, Storage, and Shipping—The applicant should consider methods to 

ensure that handling, storage, cleaning, packaging, shipping, and preservation of 

IROFS are controlled to prevent damage or loss and to minimize deterioration. 

14. Inspection, Test, and Operating Status—The applicant should identify the status 

of inspection and test activities for IROFS, either in the item or in documents 

traceable to IROFS. The applicant should specify the use of status-indicating 

devices such as tags, markings, shop travelers, stamps, and inspection records. 

The applicant should establish provisions to ensure that required inspections and 

tests are performed and ensure that items that have not passed the required 

inspections and tests are not inadvertently installed, used, or operated. 

15. Control of Nonconforming Items—The applicant should describe provisions that 

specify when IROFS do not conform to specified requirements. The applicant 

should control items that do not conform to prevent inadvertent installation or use 

of nonconforming material, parts, equipment, or services. The applicant should 

specify provisions for identification, documentation, evaluation, segregation, and 

disposition of nonconforming IROFS and for appropriate notification to affected 

organizations. 

16. Corrective Action—The applicant should specify provisions for promptly 

identifying conditions adverse to quality and correcting them as soon as 

practicable. (See Sections 11.3, 11.4.3.5, 11.5.5, and 11.6.5 of this SRP for 

details on audits and assessments and Sections 11.3, 11.4.3.6, 11.5.6, and 

11.6.6 for details incident investigations.) 

17. Quality Assurance Records—QA records and records management systems may 

be used in lieu of or in conjunction with each other. In either case, the applicant 

should describe the methods used to document, prepare, maintain, and manage 

records. The applicant should describe the methods used to protect records 

against damage, deterioration, or loss. In addition, the applicant should establish 

and document the requirements and responsibilities for record transmittal, 

distribution, retention, maintenance, and disposition. (See Sections 11.3, 

11.4.3.7, 11.5.7, and 11.6.7 of this SRP for details on records management.) 
June 2015 11-23 NUREG-1520, Revision 2 

18. Audits—The applicant should plan and schedule audits and assessments to 

verify compliance with, and to determine the effectiveness of, its QA elements. 

The applicant should identify responsibilities and procedures for assessing, 

auditing, documenting, and reviewing results. (See Sections 11.3, 11.4.3.5, 

11.5.5, and 11.6.5 of this SRP for details on audits and assessments.) 

Pursuant to 10 CFR 70.65(b)(6), the ISA summary must briefly describe each IROFS in 

sufficient detail to understand its functions relative to the 10 CFR 70.61 performance 

requirements. In this regard, the ISA summary should identify the IROFS, the degree of their 

importance to safety, and related activities that are required for safety. An applicant may 

choose to apply all QA elements at the highest level to all IROFS or may grade the application 

in proportion to the item’s importance to the achievement of safety. The application should 

describe quality assurance elements that will be applied in a graded manner to IROFS based on 

their safety significance. 

B. Grading of other quality assurance elements for IROFS determined to be of lower 

significance may include features such as the following: 

1. QA Program – An applicant’s description of their QA program may describe a 

program in which quality assurance elements and management measures are 

applied to IROFS in a manner commensurate with the IROFS’ safety 

significance. 

2. Design Control – Design inputs must be correctly selected and incorporated into 

the design for all IROFS, and changes to final designs (including field changes 

and modifications) and dispositions of nonconforming items to use-as-is or repair 

are subject to design control measures commensurate with those applied to the 

original design for all IROFS. However, IROFS of lower safety significance may 

lend themselves to a greater reliance on nationally accepted codes and 

standards as part of the design input selection or use of certain accredited bodies 

as input to the design verification process. 

3. Procurement Document Control – Procurement documents issued for items and 

services must contain all applicable technical, regulatory, administrative, and 

reporting requirements necessary to ensure the quality of the item or service; for 

IROFS of lower safety significance, there may be a smaller population of 

requirements needed in procurement documents to ensure the quality of the item 

or service. 

4. Instructions, Procedures, and Drawings – It is necessary to develop and 

implement documented guidance for the conduct of activities affecting the quality 

of IROFS. The level of detail in instructions, procedures, and drawings should be 

commensurate with the complexity of the IROFS or activity being described. 

5. Document Control – The preparation, issuance, and modification of qualityaffecting documents must be performed in accordance with a controlled system 

for all IROFS. While a document control system must be applied to all 

documents that provide evidence of the availability and reliability of IROFS, 

document control measures may differ depending on the safety significance of 

the documents being controlled. For example, documents associated with 
June 2015 11-24 NUREG-1520, Revision 2 

IROFS of lower safety significance may be less detailed or may require a lower 

level of review for issuance or modification. 

6. Control of Purchased Material, Equipment, and Services – For IROFS of lower 

safety significance, procurement-related activities such as auditing, qualifying 

suppliers, and receipt inspection may be graded as appropriate. Within this area, 

compliance with 10 CFR Part 21 is mandatory for items designated as basic 

components and not subject to grading; however, certain activities performed in 

relation to procurement and commercial grade dedication may be graded. This 

would exclude the designation of critical characteristics but may include grading 

of verification activities (e.g., by use of reduced sampling plans or alternative 

testing techniques). If grading is applied to procurement activities, licensees 

should be vigilant in ensuring that they adequately evaluate the ability of graded 

controls to ensure the availability and reliability of IROFS, the quality of procured 

services affecting quality, and the extent to which items and activities are 

credited in preventing common cause failures. 

7. Inspection— When inspections are used to verify conformance of an IROFS item 

or activity, the applicant may apply graded controls for IROFS of lower safety 

significance. Graded application of inspection activities may include reduced 

frequency or scope of inspections paired, as appropriate, with use of monitoring 

or surveillance to demonstrate IROFS availability and reliability, and use of peer 

inspectors. It is noted that, although the use of peer inspectors may be 

acceptable for lower safety significant IROFS, the inspectors must still be 

qualified to perform inspections and be independent of the work activity being 

inspected. Additionally, periodic oversight of peer inspectors is necessary in 

order to ensure their capability to perform inspection activities to the appropriate 

skill level. Documented guidance should specify the characteristics to be 

inspected and the inspection methods to be used. The results of any inspections 

performed to verify conformance or acceptability of IROFS must be documented. 

8. Test Control—Tests should be performed as appropriate on all IROFS, 

regardless of quality level, to verify that IROFS conform to specified requirements 

and will be available and reliable to perform their safety function when called 

upon. The applicant should specify the characteristics to be tested and test 

methods to be used. Test results should be documented and evaluated against 

the test requirements and acceptance criteria. Identification of characteristics to 

be tested, delineation of test methods, and documentation recorded in 

association with tests should be adequate to ensure suitable testing of items is 

performed and sufficient documentation is available to attest to test methods and 

results. Grading of test control activities may include use of trained, skilled 

personnel as appropriate for test activities. Grading may also include performing 

testing on a sample basis in accordance with accepted sampling guidelines (i.e., 

EPRI guidance). 

9. Control of Measuring and Test Equipment—The applicant should establish 

controls to ensure that the accuracy of tools, gauges, instruments, and other 

measuring and test equipment used for IROFS and activities affecting IROFS is 

maintained regardless of the risk significance of the IROFS. However, the 

frequency of periodic activities such as calibration may be adjusted as 
June 2015 11-25 NUREG-1520, Revision 2 

appropriate, but not to exceed manufacturer’s specifications or accepted industry 

practices, in a graded management measures program. Graded programs may 

entail the use of commercial-grade calibration services based, in part, on a 

supplier’s accreditation status (i.e., accreditation from laboratory accreditation 

programs administered by the National Institute of Standards and Technology 

and by the American Association for Laboratory Accreditation, as recognized 

through the mutual recognition arrangement of the International Laboratory 

Accreditation Program (ILAC) (See NRC Safety Evaluation (Accession No. 

ML052710224). 

10. Handling, Storage, and Shipping—The applicant should control the handling, 

storage, cleaning, packaging, shipping, and preservation of all IROFS to prevent 

damage or loss and to minimize deterioration. Controls for handling, storage, and 

shipping should be established commensurate with the susceptability of the item 

to deterioration, damage, or loss and may take into consideration the safety 

function of the item. Graded controls may be applied as long as they do not 

result in a detrimental effect on the availability or reliability of an IROFS. 

11. Corrective Action— Corrective actions may be applied to IROFS in a graded 

manner and prioritized commensurate with the safety significance of the IROFS 

and the adverse condition. The applicant’s corrective action program or process 

should result in the prompt identification of conditions adverse to quality, 

regardless of the IROFS significance. The correction of adverse conditions may 

be graded to allow the application of corrective actions in a timeframe 

commensurate with the significance of the IROFS to safety. Documentation 

associated with corrective actions should be sufficiently detailed to describe the 

condition(s) and action(s) taken to enable appropriate follow-up, regardless of 

significance. 

12. Quality Assurance Records— Records associated with IROFS should be 

sufficiently detailed in order to provide a complete record of the facility design 

and to enable effective configuration management. QA records associated with 

IROFS of lower risk significance may be less detailed than those records 

associated with IROFS of higher significance due to the nature of the items 

(lower complexity, less failure mechanisms, etc.); however, the applicant should 

ensure that appropriate records are maintained to enable the evaluation of 

failures and determination of corrective actions. The applicant’s records 

management program should describe (1) the methods used to protect records 

against damage, deterioration, or loss; (2) the requirements and responsibilities 

for record transmittal, distribution, retention, maintenance, and disposition; and 

(3) the extent to which graded controls will be applied to these activities. 

13. Audits—The applicant should plan and schedule audits and assessments to 

verify compliance with, and to determine the effectiveness of, its QA elements. 

For IROFS of lower significance, audit activities may be graded by reducing the 

frequency of audit activities as appropriate. The applicant may also develop a 

program in which surveillances, performance monitoring, assessments, and trend 

data are used in lieu of or in combination with periodic audits. The applicant 

should ensure that the results of audit, assessment, and other oversight activities 
June 2015 11-26 NUREG-1520, Revision 2 

are evaluated periodically to determine if the frequency, scope, or depth of the 

oversight needs to be adjusted to ensure the availability and reliability of IROFS. 

C. There are some QA elements that are not conducive to grading due to their 

programmatic nature or generic applicability to all IROFS. Examples include: 

1. Organization – It is unlikely that multiple organizational structures would be 

applied to activities based on the significance of IROFS associated with the 

activities. 

2. Identification and Control of Items - The applicant must establish controls to 

ensure that only the correct items (e.g., equipment, components) are used or 

installed. These controls must be applied to all IROFS in order to provide 

reasonable assurance that the performance requirements of §70.61 will be met. 

While controls may vary for different IROFS, practices must be sufficient to 

ensure proper identification of IROFS and prevent unintended/improper 

installation or use of IROFS. 

3. Control of Special Processes - Where used, special processes such as welding, 

heat treating, and nondestructive examination should be performed by qualified 

personnel using qualified procedures. Given the specialized nature of these 

activities, grading is not appropriate in this area due to the need to use specially 

trained personnel and procedures appropriate to the task. 

4. Inspection, Test, and Operating Status—The status of inspection and test 

activities for each IROFS should be clearly indicated either on the item or in 

documents traceable to the item. Mechanisms for grading this QA element are 

not readily apparent as the element pertains to using measures to indicate the 

status of inspections and tests performed on IROFS in order to ensure that 

inspections and tests are performed as required (and not inadvertently 

bypassed). These measures can include stamps, tags, labels, routing cards, 

inspection/test records, or other suitable means; the means selected for 

indication of necessary inspections and tests should be appropriate to the IROFS 

(i.e., use of tags for valves) and robust enough to stay in place and perform the 

indication function. 

5. Control of Nonconforming Items—The applicant should establish measures to 

control items that do not conform to specified requirements in order to prevent 

inadvertent installation or use of nonconforming material, parts, equipment, or 

services. Because it is necessary to appropriately control any IROFS that does 

not conform to specified requirements, this element is not conducive to grading 

because relaxed controls for identifying, segregating, and controlling 

nonconforming items may be less effective in ensuring the availability and 

reliability of IROFS. 

 
June 2015 11-27 NUREG-1520, Revision 2 

11.5 Review Procedures 

11.5.1 Acceptance Review 

During the acceptance review of a license application, the reviewer should examine the 

submittals to identify major deficiencies in the information provided for each area of review 

specified in SRP Section11.3. Reviewers must decide whether they have enough information to 

proceed with a detailed review. Less significant errors or deficiencies that can be addressed in 

a request for additional information should be accepted. However, before the NRC performs a 

detailed review, the applicant should correct major deficiencies that would require several 

requests for additional information to resolve. 

Reviewers should record whether each area of review is adequately addressed in the 

application, is adequately addressed in a referenced document, is not applicable to the 

application, or has a major deficiency. 

11.5.2 Safety Evaluation 

For each area of review specified in Section 11.3, the review procedure is identified below. 

These review procedures are based on the identified SRP acceptance criteria. For deviations 

from these specific acceptance criteria, the staff should review the applicant’s evaluation of how 

the proposed alternatives to the SRP criteria provide an acceptable method of complying with 

the relevant NRC requirements identified in Section 11.4. 

During the review of the license application and ISA summary for a planned facility, the reviewer 

should identify and note any items or issues that should be inspected during an operational 

readiness review, if such a review will be performed. These items could include confirming that 

the engineered controls are implemented through procedures and operator training. 

For an existing facility, the reviewer may consult NRC inspectors to identify and resolve any 

issues related to the licensing review. For a planned facility, the reviewer may wish to consult 

with the facility design team to gain a better understanding of the process, its potential hazards, 

and safety approaches. The reviewer should coordinate these interactions through the licensing 

project manager. 

The primary reviewer will prepare safety evaluation report (SER) input for the licensing project 

manager in support of the licensing action. 

11.5.3 Configuration Management 

The reviewer should evaluate the six areas of CM described in the next sections. 

11.5.3.1 Configuration Management Program 

The reviewer should consider whether the CM plan acceptably states management 

commitments, gives the program directive, and defines key responsibilities, terminology, and 

equipment scope. 

The reviewer should determine whether the applicant’s description of overall CM functions 

covers the following topics: (1) the scope of the IROFS and management measures to be 
June 2015 11-28 NUREG-1520, Revision 2 

included (coordinating with the reviewer of Chapter 3 of this SRP as necessary), (2) the 

description and objectives of each CM activity, and (3) the organizational structure and staffing 

interfaces. 

The reviewer should determine that IROFS identified in the ISA summary are subject to the CM 

function. 

The reviewer should check for appropriate interfaces both within the CM function and with 

external organizations and functions. In particular, the review should examine functional 

interfaces with QA, maintenance, and training (including qualification). 

The reviewer should look for the applicant’s identification of necessary databases and the rules 

for their maintenance. 

11.5.3.2 Design Control Requirements 

The reviewer should confirm that the design process leading to drawings and other statements 

of requirements proceeds logically from the design basis. The design basis is a set of facts 

about the systems covered by CM which an appropriate authority within the organization has 

reviewed and approved. 

The reviewer should verify that specific personnel are assigned the responsibility for maintaining 

the design bases and requirements. 

The reviewer should verify that the requirements documents clearly define the IROFS to be 

listed under CM, along with the assignment of any grades or quality levels. The reviewer should 

coordinate this part of the review with the ISA primary reviewer. 

Note that the reviewer, in conjunction with the appropriate technical reviewers, is responsible for 

determining the adequacy of the reduced levels the applicant would apply to IROFS for accident 

sequences with lesser consequences. 

11.5.3.3 Document Control 

The reviewer should evaluate the application to determine whether the CM system captures 

documents that are relevant and important to safety. These documents should include the 

design requirements, the ISA, the ISA summary, as-built drawings, specifications, all operating 

procedures important to safety, procedures involving training, maintenance, audits and 

assessments, emergency operating procedures, emergency response plans, system 

modification documents, assessment reports, and other documents that the applicant deems 

pertinent to the CM function. 

The reviewer should examine information describing a controlled document database used to 

control documents and track document change status. 

The reviewer should confirm that rules of storage for originals or master copies of documents 

within the scope of the CM function follow the guidance of records management. 

 
June 2015 11-29 NUREG-1520, Revision 2 

11.5.3.4 Change Control 

The reviewer should verify that the description of change control within the CM function commits 

to acceptable methods for (1) the identification of changes in configurations that are IROFS, 

(2) technical and management review of changes, and (3) tracking and implementing changes, 

including placement of documentation in a document control center and dissemination to 

affected functions such as training, engineering, operations, maintenance, and other QA 

elements. 

11.5.3.5 Assessments 

The reviewer should verify that both document assessments and physical assessments (system 

walk-downs) will be conducted periodically to check the adequacy of the CM functions. The 

reviewer should also confirm that the applicant will document all assessments and followups. 

11.5.3.6 Design Reconstitution (Existing Facilities Only) 

Design reconstitution may be necessary for existing facilities if current design information is not 

adequate. 

The reviewer should examine the applicant’s description of work to establish, organize, and 

document design requirements and design bases for items for which design information was not 

available before the application was submitted. This includes the methods used to evaluate, 

verify, and validate reconstituted design data for IROFS. 

The reviewer will seek evidence that the applicant (1) investigated the need for design-bases 

reconstitution, (2) accomplished reconstitution as necessary, and (3) properly incorporated the 

new or revised documentation into the CM function. 

11.5.4 Maintenance 

The reviewer will evaluate the applicant’s description of how the maintenance function will 

coordinate with and use the other management measures listed in this chapter. The primary 

reviewer should consult with supporting reviewers to identify common weaknesses in the 

applicant’s approach and consider these in the review. 

11.5.5 Training and Qualification 

Recognizing that the training objectives and methods and the required personnel qualifications 

may be graded to correspond to the hazard potential of the facility, the reviewer performs a 

safety evaluation against the acceptance criteria described in Section 11.4. In particular, the 

review should accomplish the following: 

1. The review should evaluate the adequacy of training and qualification on the basis of 

how well it fulfills the applicant’s training objectives, especially when human factors are 

relied on for safety. 

2. The review should determine whether the applicant has adequately planned for the 

training and personnel qualification to be accomplished and whether necessary policies, 
June 2015 11-30 NUREG-1520, Revision 2 

procedures, and instructions will be in place and appropriate training and qualification 

will be accomplished before personnel begin activities relied on for safety. 

3. The reviewer should focus on the training and qualification of personnel who will perform 

activities relied on for safety. 

 

4. The supporting reviewers should become familiar with the applicant’s personnel training 

and qualification commitments and determine whether ongoing activities correspond to 

them. 

5. The review should determine whether there is reasonable assurance that the applicant’s 

personnel training and qualification will result in only properly trained and qualified 

personnel performing activities relied on for safety. 

11.5.6 Procedures 

The reviewer will evaluate whether the applicant has adequately addressed the acceptance 

criteria listed in Section 11.4. The reviewer will document in an SER that the applicant has 

committed to the following: 

1. The applicant includes a statement to follow approved procedures while processing 

licensed SNM. 

2. Procedures important to safety are independently verified and validated before use, and 

this is documented in a program on procedures. 

3. Procedures exist for the notification of operations personnel before and after 

maintenance is performed on IROFS, and procedures are in place to control activities. 

4. An independent, multidisciplinary safety review team reviews and approves changes to 

operating, management measure, or maintenance procedures controlled by the CM 

function. 

 

11.5.7 Audits and Assessments 

The reviewer will determine whether the applicant has adequately planned for audits and 

assessments to be accomplished and whether necessary programs, personnel, and procedures 

will be established. 

If the applicant refers to other sections of the application when describing its audits and 

assessments, the reviewer should examine these other sections of the application to determine 

the applicant’s overall commitment to audits and assessments and the proposed method for 

implementation. The reviewer should confirm that the applicant’s audit and assessment 

commitments are consistent with other sections of the submittal. 

11.5.8 Incident Investigations 

The reviewer will verify that the applicant has described a comprehensive incident investigation 

function based on the areas of review in Section 11.3 and the acceptance criteria in 

Section 11.4 of this SRP. For existing facilities, the reviewer should consult with the NRC 
June 2015 11-31 NUREG-1520, Revision 2 

inspection staff and review any historical information regarding the adequacy of the applicant’s 

incident investigation process. 

11.5.9 Records Management 

The review should determine whether the applicant has adequately implemented a records 

management system. For fuel cycle facilities that are parts of larger organizations, certain 

documents may be retained or stored at a site other than the facility site. For example, master 

drawings for structures might be kept in the engineering department of the headquarters of the 

parent company. The reviewer may choose to review the physical characteristics of these 

offsite record storage areas, particularly the storage areas for records related to IROFS for highconsequence accident sequences. 

11.5.10 Other Quality Assurance Elements 

The reviewer should evaluate the applicant’s submittal with regard to QA elements against the 

acceptance criteria in Section 11.4. Supporting reviewers should determine whether IROFS 

within their areas of review are specified to be within the appropriate QA elements and level. 

The reviewer should measure the effectiveness of the QA elements design, rather than just 

verifying the existence of appropriate QA elements. 

The reviewer will document in the SER the results of the following: 

1. The reviewer should determine whether there is reasonable assurance that the 

applicant’s QA elements, maintenance, and CM are coordinated and that the QA 

elements are an integral part of everyday work activities. 

2. The reviewer should determine whether there is reasonable assurance that the applicant 

will be able to monitor the effectiveness of the implementation of QA elements and will 

make needed adjustments promptly. 

3. The reviewer should determine that the applicant has specified the QA elements criteria, 

the basis for choosing the criteria, and the proposed method for implementation. 

4. The reviewer should determine that the applicant’s QA elements are sufficient, in 

combination with the other seven management measures, to ensure the availability and 

reliability of IROFS. For example, other QA elements address the design, selection, 

procurement, installation, and testing of IROFS. 

5. If the applicant refers to other sections of the application when describing its QA 

elements, the reviewer should examine these sections to determine the applicant’s 

commitment to the QA elements and the proposed method for implementation. 

11.6 Evaluation Findings 

The regulations in 10 CFR 70.23 and 70.66 state that an application for a license will be 

approved if the Commission can make the general findings listed in those sections. The basis 

for the general findings is an evaluation of whether the application adequately addresses all of 

the applicable regulatory requirements. More specifically, the staff’s evaluation should 

determine whether the licensing submittals provide sufficient information to satisfy the regulatory 
June 2015 11-32 NUREG-1520, Revision 2 

requirements of Section 11.4.1 of this SRP and whether the applicant has appropriately 

addressed the regulatory acceptance criteria in SRP Section 11.4.3. On the basis of this 

information, the reviewers should write material suitable for inclusion in the SER prepared for 

the entire application. The SER should state how the applicable regulatory requirements have 

or have not been met based on the acceptance criteria described in this chapter of the SRP. If 

the applicant chooses to use an alternative approach, the reviewer should discuss in the SER 

whether the proposed approach satisfies the applicable regulatory requirements. The 

reviewers should use the following approach to document their evaluation: 

1. State a specific regulatory requirement that applies to the application. Detailed 

acceptance criteria may be included where appropriate or necessary. 

2. Identify the areas where the regulatory requirement is addressed in the application, 

including the areas where the specific acceptance criteria described in this SRP are 

addressed. 

3. Describe your evaluation of the application, the basis for your conclusion, and whether 

regulatory requirements are met. 

4. Repeat these steps for every regulatory requirement that applies to the application. 

Where the graded application of management measures has been requested by the applicant or 

licensee, the staff’s evaluation findings should include a comprehensive assessment of the 

graded controls, the basis for the controls, provisions for adjusting the graded controls based on 

implementation feedback, and the extent and limitations of the graded measures. The staff’s 

evaluation should also include a comprehensive assessment of the IROFS categorization 

process and its basis, which will be performed by reviewers in accordance with SRP Chapter 3. 

Applications seeking to apply graded QA controls without sufficient basis should not be granted. 

There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

application or amendment request, (2) denial of the application or request, or (3) approval with 

conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

reviewer may consider proposing a license condition. Absent an NRC order, license conditions 

must be agreed upon with the licensee or applicant before becoming part of the license. A 

license condition should only be proposed if there is reasonable assurance that, if the licensee 

meets the condition, all regulatory requirements will be satisfied. Thus, license conditions 

should not be used to cover major deficiencies in an application. License conditions should be 

unambiguous, inspectable, and enforceable. They should only require those actions necessary 

to ensure compliance with applicable regulations. The basis for license conditions must be 

documented in the SER. 

If the submittal is acceptable, the final SER input should conclude with statements similar to the 

following: 

11.6.1 Configuration Management 

The staff has reviewed the CM function for [name of facility] according to Chapter 11 of 

the SRP (NUREG-1520). [Insert a summary statement of what was evaluated and why 

the reviewer finds the submittal acceptable.] 
June 2015 11-33 NUREG-1520, Revision 2 

The applicant has suitably and acceptably described its commitment to a proposed CM 

system, including the method for managing changes in procedures, facilities, activities, 

and equipment for IROFS. Management-level policies and procedures, including an 

analysis and independent safety review of any proposed activity involving IROFS, are 

described and will provide reasonable assurance that consistency among design 

requirements, physical configuration, and facility documentation is maintained as part of 

a new activity or change in an existing activity involving licensed material. The 

management measures will include (or do include) the following elements of CM: 

1. Configuration Management 

The applicant has put in place or committed to the organizational structure, 

procedures, and responsibilities necessary to implement CM. 

2. Design Control Requirements 

The applicant has documented, and supported by analysis, design requirements 

and bases. Furthermore, the applicant has ensured that the documentation 

remains current. 

3. Document Control 

The applicant has stored documents, including drawings, in an appropriate and 

accessible manner. Drawings and related documents captured by the system 

are those necessary and sufficient to adequately describe IROFS. 

4. Change Control 

Responsibilities and procedures adequately describe how the applicant will 

achieve and maintain strict consistency among the design requirements, the 

physical configuration, and the facility documentation. The applicant has put in 

place methods for suitable analysis, review, approval, and implementation of 

identified changes to IROFS. This includes appropriate CM controls to ensure 

configuration verification, functional tests, and accurate documentation for 

equipment or procedures that have been modified. 

5. Assessments 

The applicant has committed to an adequate function that includes both initial 

and periodic assessments, as described in the acceptance criteria in the SRP. 

The assessments are expected to verify and ensure the adequacy of the CM 

function. 

6. Design Reconstitution (Existing Facilities Only) 

The applicant has adequately described the design reconstitution performed. 

Current design bases are available and verified for all IROFS, such that the 

configuration is consistent with the as-built facility documentation. 

 
June 2015 11-34 NUREG-1520, Revision 2 

11.6.2 Maintenance 

The applicant has committed to maintenance of IROFS. The applicant’s maintenance 

commitments contain the basic elements to maintain availability and reliability: 

corrective maintenance, PM, functional testing, equipment calibration, and work control 

for maintenance of IROFS. The applicant’s maintenance function is proactive, using 

maintenance records, PM records, and surveillance tests to analyze equipment 

performance and to seek the root causes of repetitive failures. 

The surveillance and monitoring, PM, and functional testing activities described in the 

license application provide reasonable assurance that the IROFS identified in the ISA 

summary will be available and reliable to prevent or mitigate accident consequences. 

The maintenance function (1) is based on approved procedures, (2) employs work 

control methods that properly consider personnel safety, awareness of facility operating 

groups, QA, and the rules of CM, (3) uses the ISA summary to identify IROFS that 

require maintenance and determine the level of maintenance needed, (4) justifies the 

PM intervals in terms of the equipment reliability goals, (5) provides for training that 

emphasizes the importance of IROFS identified in the ISA summary, regulations, codes, 

and personnel safety, and (6) creates documentation that includes records of all 

surveillance, inspections, equipment failures, repairs, and replacements of IROFS. 

The staff concludes that the applicant’s maintenance functions meet the requirements of 

10 CFR Part 70 and provide reasonable assurance of public health and safety and the 

protection of the environment. 

11.6.3 Training and Qualification 

Based on its review of the license application [insert a summary statement of what was 

evaluated and why the reviewer finds the submittal acceptable], the NRC staff concludes 

that the applicant has adequately described and assessed its personnel training and 

qualification in a manner that satisfies the regulatory requirements and is consistent with 

the guidance in this SRP. 

Reasonable assurance exists that implementation of the described training and 

qualification will result in personnel who are qualified and competent to design, 

construct, start up, operate, maintain, modify, and decommission the facility safely. The 

staff concludes that the applicant’s plan for personnel training and qualification meets 

the requirements of 10 CFR Part 70. 

11.6.4 Procedures 

The application describes a suitably detailed process for the development, approval, and 

implementation of procedures. It has addressed IROFS, as well as items important to 

the health of facility workers and the public and to the protection of the environment. 

The staff concludes that the applicant’s plan for procedures meets the requirements of 

10 CFR Part 70. 

 
June 2015 11-35 NUREG-1520, Revision 2 

11.6.5 Audits and Assessments 

Based on its review of the license application [insert a summary statement of what was 

evaluated and why the reviewer finds the submittal acceptable], the NRC staff concludes 

that the applicant has adequately described its audits and assessments. The staff has 

reviewed the applicant’s plan for audits and assessments and finds it acceptable. 

 

The staff concludes that the applicant’s plan for audits and assessments meets the 

requirements of 10 CFR Part 70 and provides reasonable assurance of protection of the 

health and safety of the public, workers, and the environment. 

11.6.6 Incident Investigations 

The applicant has committed to and established an organization responsible for 

(1) performing incident investigations of abnormal events that may occur during 

operation of the facility, (2) determining the root cause(s) and generic implications of the 

event, and (3) recommending corrective actions for ensuring a safe facility and safe 

facility operations, in accordance with the acceptance criteria of Section 11.4 of the SRP. 

The applicant has committed to monitoring and documenting corrective actionsthrough 

to completion. 

The applicant has committed to the maintenance of documentation so that “lessons 

learned” may be applied to future operations of the facility. 

Accordingly, the staff concludes that the applicant’s description of the incident 

investigation process complies with applicable NRC regulations and is adequate. 

11.6.7 Records Management 

The staff has reviewed the applicant’s records management system against the 

acceptance criteria and concludes that the system (1) will be effective in collecting, 

verifying, protecting, and storing information about the facility and its design, operations, 

and maintenance and will be able to retrieve the information in readable form for the 

designated lifetimes of the records, (2) will provide a records storage area(s) with the 

capability to protect and preserve health and safety records that are stored there during 

the mandated periods, including protection of the stored records against loss, theft, 

tampering, or damage during and after emergencies, and (3) will provide reasonable 

assurance that any deficiencies in the records management system or its 

implementation will be detected and corrected promptly. 

11.6.8 Other Quality Assurance Elements 

The SER should include a summary statement of what the NRC evaluated and the basis for the 

reviewer’s conclusions. The review should demonstrate the adequacy of the applicant’s use of 

other QA elements, as applied to IROFS, for design, construction, and operations. The SER 

should include statements like the following: 
June 2015 11-36 NUREG-1520, Revision 2 

The NRC staff concludes that the applicant has adequately described the application of 

other QA elements (and the applicable QA elements of its principal contractors). The 

staff also concludes the following: 

 The applicant has established and documented a commitment to an organization 

responsible for developing, implementing, and assessing the management 

measures for providing reasonable assurance of safe facility operations, in 

accordance with the criteria in Section 11.4 of the SRP. 

 The applicant has established and documented a commitment to QA elements, 

and the administrative measures for staffing, evaluating performance, assessing 

findings, and implementing corrective action are in place. 

 The applicant has developed a process for preparation and control of written 

administrative plant procedures, including procedures for evaluating changes to 

procedures, IROFS, and tests. The applicant has committed to implement and 

maintain a process for review, approval, and documentation of procedures. 

 The applicant has established and documented surveillances, tests, and 

inspections to provide reasonable assurance of satisfactory in-service 

performance of IROFS. 

 The applicant will ensure that periodic independent audits are conducted to 

determine the effectiveness of the management measures. Management 

measures will provide for documentation of audit findings and implementation of 

corrective actions. 

 The applicant has established and documented training requirements to provide 

employees with the skills to perform their jobs safely. The applicant has also 

provided management measures for the evaluation of the effectiveness of 

training against predetermined objectives and criteria. 

 The organizations and persons performing QA element functions have the 

required independence and authority to effectively carry out their QA element 

functions without undue influence from those directly responsible for process 

operations. 

 QA elements cover the IROFS, as identified in the ISA summary, and the 

applicant has established measures to prevent hazards from becoming pathways 

to higher risks and accidents. 

Accordingly, the staff concludes that the applicant’s use of other QA elements meets the 

requirements of 10 CFR Part 70 and provides reasonable assurance that public health 

and safety and the environment are protected. 

 
June 2015 11-37 NUREG-1520, Revision 2 

11.7 References 

American National Standards Institute/American Society of Mechanical Engineers Standard, 

“Quality Assurance Requirements for Nuclear Facility Applications,” ANSI/ASME NQA-1a-2009. 

U.S. Code of Federal Regulations, Chapter I, Title 10, “Energy,” Part 50, “Domestic Licensing of 

Production and Utilization Facilities.” 

U.S. Code of Federal Regulations, Chapter I, Title 10, “Energy,” Part 70, “Domestic Licensing of 

Special Nuclear Material.” 

U.S. Code of Federal Regulations, Chapter I, Title 10, “Energy,” Part 21, “Reporting of Defects 

and Noncompliance.” 

U.S. Nuclear Regulatory Commission, “Guidance on Management Controls/Quality Assurance, 

Requirements for Operation, Chemical Safety, and Fire Protection for Fuel Cycle Facilities,” 

Federal Register, Vol. 54, No. 53, pp. 11590−11598, March 21, 1989. 

U.S. Nuclear Regulatory Commission, “Suggested Guidance Relating to Development and 

Implementation of Corrective Action,” Information Notice 96-28, May 1966. 

U.S. Nuclear Regulatory Commission, “Human Factors Engineering Program Review Model,” 

NUREG-0711, Revision 2, February 2004. 

June 2015 11-A-1 NUREG-1520, Revision 1 

APPENDIX A 

CHECKLIST FOR PROCEDURES 

Written procedures should cover all activities listed below. This list is not intended to be allinclusive or to imply that procedures must be developed with the same titles as those on the list. 

1. Management Control Procedures 

 training 

 audits and assessments 

 incident investigation 

 records management 

 configuration management 

 quality assurance 

 equipment control (lockout/tagout) 

 shift turnover 

 work control 

 procedure management 

 nuclear criticality safety 

 fire protection 

 radiation protection 

 radioactive waste management 

 maintenance 

 environmental protection 

 chemical process safety 

 operations 

 calibration control 

 preventive maintenance 

2. Operating Procedures 

 system procedures that address startup, operation, shutdown, control of process 

operations, and recovery after a process upset 

– ventilation 

– criticality alarms 

– shift routines, shift turnover, and operating practices 

– decontamination operations 

– uranium recovery 

– facility utilities (air, other gases, cooling water, fire water, steam) 

– temporary changes in operating procedures 

 abnormal operation/alarm response 

– loss of cooling water 

– loss of instrument air 
June 2015 11-A-2 NUREG-1520, Revision 1 

– loss of electrical power 

– loss of criticality alarm system 

– fires 

– chemical process releases 

3. Maintenance Activities That Address System Repair, Calibration, Surveillance, and 

Functional Testing 

 repairs and preventive repairs of items relied on for safety (IROFS) 

 testing of criticality alarm units 

 calibration of IROFS 

 high-efficiency particulate air filter maintenance 

 functional testing of IROFS 

 relief valve replacement/testing 

 surveillance/monitoring 

 pressure vessel testing 

 nonfired pressure vessel testing 

 piping integrity testing 

 containment device testing 

4. Emergency Procedures 

 response to a criticality 

 hazardous process chemical releases (including uranium hexafluoride) 
June 2015 11-B-1 NUREG-1520, Revision 2 

APPENDIX B 

INCIDENT INVESTIGATION PROGRAMS AND PROCEDURES 

The following eight items are good practices to incorporate in incident investigation programs or 

procedures or both: 

(1) The investigation of an abnormal event should begin as soon as possible after the event 

has been brought under control. 

(2) The incident investigation program contains a documented procedure for investigating 

an abnormal event. This procedure is separate from any required emergency plan. 

(3) The program includes a description of the functions, qualifications, and responsibilities of 

the manager who would lead the investigative team and those of the other team 

members; the scope of the team’s authority and responsibilities; and an assurance of 

management cooperation. 

(4) Qualified internal or external investigators are appointed to serve on investigating teams 

when required. The teams should include at least one process expert and at least one 

team member trained in root cause analysis. 

(5) The program contains guidance for personnel conducting the investigation on how to 

apply a reasonable, systematic, structured approach to determine the specific or generic 

root cause(s) and generic implications of the problem. The level of investigation should 

be based on a graded approach relative to the severity of the incident. 

(6) The incident investigation team has assurance of the team’s authority to obtain all 

information considered necessary and is independent from the functional area involved 

in the incident under investigation. 

(7) The investigation process and investigating teams are independent of the line 

management. 

(8) Auditable records and documentation related to abnormal events, investigations, and 

root cause analysis are maintained. For each abnormal event, the incident report should 

include a description, contributing factors, a root cause analysis, and findings and 

recommendations. Relevant findings are reviewed with all affected personnel. 

June 2015 11-C-1 NUREG-1520, Revision 2 

APPENDIX C 

RECORDS 

The requirements for records management vary according to the nature of the facility 

and the hazards and risks it poses. Examples of the records required by Title 10 of the 

Code of Federal Regulations (10 CFR) Part 19, “Notices, Instructions and Reports to 

Workers: Inspection and Investigations”; 10 CFR Part 20, “Standards for Protection 

against Radiation”; 10 CFR Part 21, “Reporting of Defects and Noncompliance”; 

10 CFR Part 25, “Access Authorization”; and 10 CFR Part 70, “Domestic Licensing of 

Special Nuclear Material,” are listed below. The records are listed under the chapter 

headings of the Standard Review Plan (SRP). The list is not intended to be exhaustive 

or prescriptive. Different or additional records may be required in certain 

circumstances. The applicant may also choose to organize the records in other ways. 

Examples of Records 

SRP Chapter 

1. General Information 

 construction records 

 facility and equipment descriptions and drawings 

 design criteria, requirements, and bases for items relied on for safety 

(IROFS), as specified by the facility configuration management (CM) 

function 

 records of facility changes and associated integrated safety analyses, as 

specified by the facility CM function 

 safety analyses, reports, and assessments 

 records of site characterization measurements and data 

 records pertaining to onsite disposal of radioactive or mixed wastes in 

surface landfills 

 procurement records, including specifications for IROFS 

2. Organization and Administration 

 administrative procedures with safety implications 
June 2015 11-C-2 NUREG-1520, Revision 2 

 change control records for material control and accounting program 

 organization charts, position descriptions, and qualification records 

 safety and health compliance records, medical records, personnel 

exposure records 

 quality assurance records 

 safety inspections, audits, assessments, and investigations 

 safety statistics and trends 

3. Integrated Safety Analysis 

4. Radiation Safety 

 bioassay data 

 exposure records 

 radiation protection (and contamination control) records 

 radiation training records 

 radiation work permits 

5. Nuclear Criticality Safety 

 nuclear criticality control written procedures and statistics 

 nuclear criticality safety analyses 

 records pertaining to nuclear criticality inspections, audits, investigations, 

and assessments 

 records pertaining to nuclear criticality incidents, unusual occurrences, or 

accidents 

 records pertaining to nuclear criticality safety analyses 

6. Chemical Safety 

 chemical process safety procedures and plans 

 records pertaining to chemical process inspections, audits, investigations, 

and assessments 

 diagrams, charts, and drawings 
June 2015 11-C-3 NUREG-1520, Revision 2 

 records pertaining to chemical process incidents, unusual occurrences, or 

accidents 

 chemical process safety reports and analyses 

 chemical process safety training 

7. Fire Safety 

 fire hazard analysis 

 fire prevention measures, including hot-work permits and fire watch records 

 records pertaining to inspection, maintenance, and testing of fire protection 

equipment 

 records pertaining to fire protection training and retraining of response 

teams 

 prefire emergency plans 

8. Emergency Management 

 emergency plan(s) and procedures 

 comments on emergency plan from outside emergency response 

organizations 

 emergency drill records 

 memoranda of understanding with outside emergency response 

organizations 

 records of actual events 

 records pertaining to the training and retraining of personnel involved in 

emergency preparedness functions 

 records pertaining to the inspection and maintenance of emergency 

response equipment and supplies 

9. Environmental Protection 

 environmental release and monitoring records 
June 2015 11-C-4 NUREG-1520, Revision 2 

 environmental report and supplements to the environmental report, as 

applicable 

10. Decommissioning 

 decommissioning records 

 financial assurance documents 

 decommissioning cost estimates 

 site characterization data 

 final survey data 

 decommissioning procedures 

11. Management Measures 

11.1 Configuration Management 

 safety analyses, reports, and assessments that support the physical 

configuration of process designs and changes to those designs 

 validation records for computer software used for safety analysis or 

material control and accounting 

 integrated safety analysis documents, including process descriptions, plant 

drawings and specifications, and purchase specifications for IROFS 

 approved current operating procedures and emergency operating 

procedures 

11.2 Maintenance 

 record of IROFS failures (required by 10 CFR 70.62, “Safety Program and 

Integrated Safety Analysis”) 

 preventive maintenance records, including trending and root cause 

analysis 

 calibration and testing data for IROFS 

 corrective maintenance records 

11.3 Training and Qualification 

 personnel training and qualification records 

 procedures 
June 2015 11-C-5 NUREG-1520, Revision 2 

11.4 Procedures 

 standard operating procedures 

 functional test procedures 

11.5 Audits and Assessments 

 audits and assessments of safety and environmental activities 

11.6 Incident Investigations 

 investigation reports 

 changes recommended by investigation reports and how and when 

implemented 

 summary of reportable events for the term of the license 

 incident investigation policy 

11.7 Records Management 

 policy 

 material storage records 

 records of receipt, transfer, and disposal of radioactive material 

June 2015 12-1 NUREG-1520, Revision 2 

12. MATERIAL CONTROL AND ACCOUNTING 

12.1 Purpose of Review 

The purpose of this review is to determine whether the applicant’s material control and 

accounting (MC&A) program is adequate to detect and protect against the loss, theft, or 

diversion of special nuclear material (SNM) that the applicant will possess, store, and utilize at 

its facility, and to comply with the regulatory requirements in Title 10 of the Code of Federal 

Regulations (10 CFR) Part 74, “Material Control and Accounting of Special Nuclear Material,” 

and 10 CFR Part 70, “Domestic Licensing of Special Nuclear Material.” 

The MC&A regulations in 10 CFR Part 74 distinguishes between licensees authorized to 

possess different types and quantities of SNM. These designations are also used to describe 

the facilities at which the licensees may possess the material. The categories of licensees or 

facilities are: 

1. Category I – Fuel facilities/licensees authorized to possess 5 formula kilograms, or more, 

of strategic special nuclear material (SSNM), as defined in 10 CFR 74.4, “Definitions.” 

2. Category II – Fuel facilities/licensees authorized to possess SNM of moderate strategic 

significance, as defined in 10 CFR 74.4. 

3. Category III – Fuel facilities/licensees authorized to possess SNM of low strategic 

significance, as defined in 10 CFR 74.4. This category includes low-enriched 

fuel-fabrication facilities and enrichment facilities. 

Correspondingly greater (graded) MC&A program capabilities are required for activities and 

processes involving categories of SNM of increasing strategic significance, from Category III to 

Category II and Category I, depending on the amounts and forms of SNM under safeguards. 

Therefore, this chapter will discuss the review required by safeguards category and facility type. 

As indicated above, for applications regarding Category I facilities, the reviewer will need to 

become familiar with the terms “strategic special nuclear material,” “formula kilogram,” “formula 

quantity,” and “category 1A material,” each of which is defined in 10 CFR 74.4. For applications 

regarding Category II facilities, the reviewer will need to become familiar with the term “special 

nuclear material of moderate strategic significance.” For applications regarding Category III 

facilities, the reviewer will need to become familiar with the term “special nuclear material of low 

strategic significance.” 

There are additional defined terms in part 74 that are more generally applicable. These include 

“special nuclear material,” “low enriched uranium,” “high enriched uranium,” “item,” 

“measurement,” and “physical inventory.” 

12.2 Responsibility for Review 

Primary: MC&A License Reviewer 

Secondary: MC&A Technical Staff 

Supporting: Licensing Project Manager 

Fuel Cycle Facility MC&A Inspector 
June 2015 12-2 NUREG-1520, Revision 2 

12.3 Areas of Review 

As specified in 10 CFR 70.22(b), an applicant must submit a full description of its program for 

control and accounting of the SNM in its possession under license to demonstrate how 

compliance with the requirements in 10 CFR Part 74 will be accomplished. This MC&A program 

description is provided to the U.S. Nuclear Regulatory Commission (NRC) in the form of a 

Fundamental Nuclear Material Control (FNMC) plan. Guidance for the format and content of an 

FNMC plan is provided in the following documents, depending on the safeguards category and 

facility type: 

1. Category I Facility – NUREG-1280, “Standard Format and Content Acceptance Criteria 

for the Material Control and Accounting (MC&A) Reform Amendment.” 

2. Category II Facility –There are presently no Category II facilities, and there is no 

guidance for a Category II facility. 

3. Category III Fuel Fabrication Facility – NUREG-1065, “Acceptable Standard Format and 

Content for the Fundamental Nuclear Material Control (FNMC) Plan Required for 

Low-Enriched Uranium Facilities.” 

4. Category III Enrichment Facility – NUREG/CR-5734, “Recommendations to the NRC on 

Acceptable Standard Format and Content for the Fundamental Nuclear Material Control 

(FNMC) Plan Required for Low-Enriched Uranium Enrichment Facilities.” 

The guidance documents listed above are also used by the MC&A license reviewer to 

determine the acceptability of the applicant’s proposed MC&A program. The specific areas of 

review are different depending on the type of facility and safeguards category. These areas are 

listed in Sections 12.3.1 through 12.3.4 below. 

12.3.1 Category I Facility 

For a Category I facility, the staff will review the applicant’s commitments regarding the following 

MC&A program areas: 

10. abrupt loss detection from process units (Process Monitoring) 

11. timely detection of loss of items (Item Monitoring) 

12. timely resolution of MC&A alarms (Alarm Resolution) 

13. management structure and personnel qualification and training 

14. measurements systems 

15. measurement-control system 

16. use of statistics to ensure requirements are met 

17. conduct of periodic physical inventories and reconciliation of book records to the results 

of the physical inventories 

18. identification and measurement of shipments and receipts 
June 2015 12-3 NUREG-1520, Revision 2 

19. scrap-control program 

20. independent assessment of the MC&A program 

21. designation of material balance areas, item-control areas, and custodians 

22. tamper-safing 

23. resolving indications of loss, theft, diversion, or misuse of SNM/SSNM 

24. assisting in the investigation and recovery of missing SNM/SSNM 

25. recordkeeping system 

12.3.2 Category II Facility 

Although is no guidance for a Category II facility available at this time, if the staff were to 

received an application from a Category II facility, the staff will review the applicant’s 

commitments regarding the following MC&A program areas: 

1. management structure and personnel qualification and training 

2. measurements systems 

3. measurement-control system 

4. use of statistics to ensure requirements are met 

5. conduct of periodic physical inventories and reconciliation of book records to the results 

of the physical inventories 

6. item-control system 

7. shipper/receiver comparisons 

8. independent assessment of the MC&A program 

9. tamper-safing 

10. designation of material balance areas, item-control areas, and custodians 

11. resolving indications of loss, theft, diversion, or misuse of SNM 

12. assisting in the investigation and recovery of missing SNM 

13. recordkeeping system 
June 2015 12-4 NUREG-1520, Revision 2 

12.3.3 Category III Fuel Fabrication Facility 

For a Category III fuel-fabrication facility, the staff will review the applicant’s commitments 

regarding the following MC&A program areas: 

1. management structure and personnel qualification and training 

2. measurements systems 

3. measurement-control system 

4. use of statistics to ensure requirements are met 

5. conduct of periodic physical inventories and reconciliation of book records to the results 

of the physical inventories 

6. item-control system 

7. shipper/receiver comparisons 

8. independent assessment of the MC&A program 

9. tamper-safing 

10. designation of material balance areas, item-control areas, and custodians 

11. resolving indications of loss, theft, diversion, or misuse of SNM 

12. assisting in the investigation and recovery of missing SNM 

13. recordkeeping system 

12.3.4 Category III Enrichment Facility 

For a Category III enrichment facility, the staff will review the applicant’s commitments regarding 

the following MC&A program areas: 

1. management structure and personnel qualification and training 

2. measurements systems 

3. measurement-control system 

4. use of statistics to ensure requirements are met 

5. conduct of periodic physical inventories and reconciliation of book records to the results 

of the physical inventories 

6. program for precluding and detecting unauthorized production of enriched uranium 

7. item-control system 

8. shipper/receiver comparisons 
June 2015 12-5 NUREG-1520, Revision 2 

9. independent assessment of the MC&A program 

10. tamper-safing 

11. designation of material balance areas, item-control areas, and custodians 

12. resolving indications of missing uranium and of unauthorized production of enriched 

uranium 

13. assisting in the investigation and recovery of missing uranium or the investigation of 

unauthorized enrichment 

14. recordkeeping system 

Review Interfaces 

In addition to the MC&A Plan, the reviewer should examine information in the following other 

areas to ensure that it is consistent with the information in the MC&A Plan: 

 physical security plan applicable to physical protection under SRP Chapter 13 

12.4 Acceptance Criteria 

The acceptance criteria for an applicant’s MC&A program are contained in the NUREGs listed in 

Section 12.3 above. Specifics for each safeguards category and facility type are described 

below. 

12.4.1 Category I Facility 

12.4.1.1 Regulatory Requirements 

Regulations in Subpart B, “General Reporting and Recordkeeping Requirements,” and 

Subpart E, “Formula Quantities of Strategic Special Nuclear Material,” of 10 CFR Part 74 apply 

to the establishment of an MC&A program for Category I facilities. The Subpart E requirements 

contain the specific MC&A program capabilities needed to establish an acceptable MC&A 

program. 

12.4.1.2 Regulatory Guidance 

The NRC regulatory guidance for an acceptable MC&A program applicable to Category I 

facilities is NUREG-1280, “Standard Format and Content Acceptance Criteria for the Material 

Control and Accounting (MC&A) Reform Amendment.” In addition to the specific guidance in 

NUREG-1280, general reporting and recordkeeping guidance for all facilities is contained in: 

1. NUREG/BR-0006, “Instructions for Completing Nuclear Material Transaction Reports.” 

2. NUREG/BR-0007, “Instructions for the Preparation and Distribution of Material Status 

Reports.” 

3. NUREG/BR-0096, “Instructions and Guidance for Completing Physical Inventory 

Summary Reports.” 
June 2015 12-6 NUREG-1520, Revision 2 

12.4.1.3 Regulatory Acceptance Criteria 

Acceptance criteria are contained in NUREG-1280. This NUREG is divided into separate 

chapters for each of the program areas listed in Section 12.3.1 above, and commitments and 

acceptance criteria are listed for each program area. The applicant’s MC&A program is 

acceptable if the license application provides data and information that meet the commitments 

and acceptance criteria listed in NUREG-1280 for each of the program areas. 

12.4.2 Category II Facility 

12.4.2.1 Regulatory Requirements 

Regulations in Subpart B and Subpart D, “Special Nuclear Material of Moderate Strategic 

Significance,” of 10 CFR Part 74 apply to the establishment of an MC&A program for Category II 

facilities. The Subpart D requirements contain the specific MC&A program capabilities needed 

to establish an acceptable MC&A program. 

12.4.2.2 Regulatory Guidance 

There is currently no specific guidance for Category II facilities. General reporting and 

recordkeeping guidance for all facilities is contained in: 

1. NUREG/BR-0006 

2. NUREG/BR-0007 

3. NUREG/BR-0096 

12.4.2.3 Regulatory Acceptance Criteria 

There are currently no specific acceptance criteria for Category II facilities. 

12.4.3 Category III Fuel Fabrication Facility 

12.4.3.1 Regulatory Requirements 

Regulations in Subpart B of 10 CFR Part 74 and in 10 CFR 74.31, “Nuclear Material Control and 

Accounting for Special Nuclear Material of Low Strategic Significance,” apply to the 

establishment of an MC&A program for Category III fuel fabrication facilities. The requirements 

in 10 CFR 74.31 cover the specific MC&A program capabilities needed to establish an 

acceptable MC&A program. 

12.4.3.2 Regulatory Guidance 

The NRC regulatory guidance for an acceptable MC&A program applicable to Category III fuel 

fabrication facilities is NUREG-1065, “Acceptable Standard Format and Content for the 

Fundamental Nuclear Material Control (FNMC) Plan Required for Low-Enriched Uranium 

Facilities.” In addition to the specific guidance in NUREG-1065, general reporting and 

recordkeeping guidance for all facilities is contained in: 
June 2015 12-7 NUREG-1520, Revision 2 

1. NUREG/BR-0006 

2. NUREG/BR-0007 

3. NUREG/BR-0096 

12.4.3.3 Regulatory Acceptance Criteria 

Acceptance criteria are contained in NUREG-1065. This NUREG is divided into separate 

chapters for each of the program areas listed in Section 12.3.3 above, and commitments and 

acceptance criteria are listed for each program area. The applicant’s MC&A program is 

acceptable if the license application provides data and information that meet the commitments 

and acceptance criteria listed in NUREG-1065 for each of the program areas. 

 

12.4.4 Category III Enrichment Facility 

12.4.4.1 Regulatory Requirements 

Regulations in Subpart B of 10 CFR Part 74 and in 10 CFR 74.33, “Nuclear Material Control and 

Accounting for Uranium Enrichment Facilities Authorized to Produce Special Nuclear Material of 

Low Strategic Significance,” apply to the establishment of an MC&A program for Category III 

enrichment facilities. The requirements in 10 CFR 74.33 contain the specific MC&A program 

capabilities needed to establish an acceptable MC&A program. 

12.4.4.2 Regulatory Guidance 

The NRC regulatory guidance for an acceptable MC&A program applicable to Category III 

enrichment facilities is NUREG/CR-5734, “Recommendations to the NRC on Acceptable 

Standard Format and Content for the Fundamental Nuclear Material Control (FNMC) Plan 

Required for Low-Enriched Uranium Enrichment Facilities.” In addition to the specific guidance 

in NUREG/CR-5734, general reporting and recordkeeping guidance for all facilities is contained 

in: 

1. NUREG/BR-0006. 

2. NUREG/BR-0007. 

3. NUREG/BR-0096. 

12.4.4.3 Regulatory Acceptance Criteria 

Acceptance criteria are contained in NUREG/CR-5734. This NUREG is divided into separate 

chapters for each of the program areas listed in Section 12.3.4 above, and commitments and 

acceptance criteria are listed for each program area. The applicant’s MC&A program is 

acceptable if the license application provides data and information that meet the commitments 

and acceptance criteria listed in NUREG/CR-5734 for each of the program areas. 
June 2015 12-8 NUREG-1520, Revision 2 

12.5 Review Procedures 

12.5.1 Acceptance Review 

During the acceptance review of a license application, the reviewer should examine the 

submittals to identify major deficiencies in the information provided for each area of review 

specified in SRP Section 12.3. Reviewers must decide whether they have enough information 

to proceed with a detailed review. Less significant errors or deficiencies that can be addressed 

in a request for additional information should be accepted. However, before the NRC performs 

a detailed review, the applicant should correct major deficiencies that would require several 

requests for additional information to resolve. 

Reviewers should record whether each area of review is adequately addressed in the 

application, is adequately addressed in a referenced document, is not applicable to the 

application, or has a major deficiency. 

12.5.2 Safeguards Evaluation 

During the safeguards evaluation, the reviewer determines whether the application 

comprehensively describes the MC&A program areas/capabilities, as identified in SRP 

Section 12.3, and whether the program meets the objectives and capabilities specified in 

10 CFR Part 74. For deviations from the specific acceptance criteria, the staff should review the 

applicant’s explanation of how the proposed alternatives to the SRP criteria provide an 

acceptable method of complying with the relevant NRC requirements identified in Section 12.4. 

During the initial review, the reviewer should draft the safety evaluation report (SER) described 

below. A request for additional information (RAI) will be prepared when clarification and 

additional information are needed to determine if the licensee’s submittals comply with the 

regulations. The primary reviewer should coordinate with the licensing project manager in 

preparing RAIs. Additional information submitted by the applicant will be evaluated and a final 

SER will be provided to the licensing project manager. 

For an existing facility, the reviewer may consult NRC MC&A inspectors to identify and resolve 

any issues related to the licensing review. For a planned facility, the reviewer may wish to 

consult with the facility MC&A team to gain a better understanding of the process and its MC&A 

program. The reviewer should coordinate these interactions through the licensing project 

manager. 

The reviewer will prepare a safeguards evaluation report (SER) for the licensing project 

manager in support of the licensing action. 

12.6 Evaluation Findings 

The regulations in 10 CFR 70.23, “Requirements for the Approval of Applications,” and 70.66, 

“Additional Requirements for Approval of License Application,” state that an application for a 

license will be approved if the Commission can make the general findings listed in those 

sections. The basis for the general findings is an evaluation of whether the application 

adequately addresses all of the applicable regulatory requirements. More specifically, the staff’s 

evaluation should determine whether the licensing submittals provide sufficient information to 

satisfy the regulatory requirements listed in SRP Section 12.4, and that the applicant has 

appropriately addressed the regulatory acceptance criteria discussed there. The SER should 

state how the applicable regulatory requirements have or have not been met based on the 

acceptance criteria. If the applicant chooses to use an alternative approach, the reviewer should 
June 2015 12-9 NUREG-1520, Revision 2 

discuss in the SER whether the proposed approach satisfies the applicable regulatory 

requirements. The reviewers should use the following approach to document their evaluation: 

1. State a specific regulatory requirement that applies to the application. Detailed 

acceptance criteria may be included where appropriate or necessary.. 

2. Identify the areas where the regulatory requirement is addressed in the application, 

including the areas where the specific acceptance criteria described in this SRP are 

addressed. 

3. Describe your evaluation of the application, the basis for your conclusion, and whether 

regulatory requirements are met. 

4. Repeat these steps for every regulatory requirement that applies to the application. 

There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

application or amendment request, (2) denial of the application or request, or (3) approval with 

conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

reviewer may consider proposing a license condition. Absent an NRC order, license conditions 

must be agreed upon with the licensee or applicant before becoming part of the license. 

A license condition should only be proposed if there is reasonable assurance that, if the 

licensee meets the condition, all regulatory requirements will be satisfied. Thus, license 

conditions should not be used to cover major deficiencies in an application. License conditions 

should be unambiguous, inspectable, and enforceable. They should only require those actions 

necessary to ensure compliance with applicable regulations. The basis for license conditions 

must be documented in the SER. 

The SER should include a summary statement of what the NRC staff evaluated and the basis 

for the reviewer’s conclusions similar to the following (this is an example for a Category III 

facility): 

The staff has evaluated the application using the criteria listed previously. Based 

on the review of the license application, the NRC staff concludes that the 

applicant provided an acceptable FNMC plan for the proposed facility, and that 

the 10 CFR 70.23(a)(6) requirement for approving applications has therefore 

been met. The FNMC plan describes acceptable methods for achieving the 

performance objectives in 10 CFR 74.31(a) and the system capabilities of 

10 CFR 74.31(c). As a result, the staff has determined that the applicant meets 

the MC&A requirements in 10 CFR Part 74. The staff therefore finds there is 

reasonable assurance that the MC&A program will detect and protect against the 

loss, theft, or diversion of SNM that the applicant will possess, store, and utilize 

at its facility. 

In accordance with 10 CFR 70.32(c), each license authorizing the use of uranium 

source material at a uranium enrichment facility, or authorizing the use of special 

nuclear material in a quantity exceeding one effective kilogram, must contain a 

license condition to ensure that such material is adequately controlled and 

accounted for within the licensed facility. The license will therefore contain the 

following license condition: 

“The licensee shall follow its FNMC plan with respect to all activities involving 

special nuclear material. The approved plan consists of [identify revision], or as it 

may be further revised pursuant to 10 CFR 70.32(c). 
June 2015 12-10 NUREG-1520, Revision 2 

12.7 References

U.S. Code of Federal Regulations, “Domestic Licensing of Special Nuclear Material,” Part 70, 

Chapter I, Title 10, “Energy.” 

U.S. Code of Federal Regulations, “Material Control and Accounting of Special Nuclear 

Material,” Part 74, Chapter I, Title 10, “Energy.” 

U.S. Nuclear Regulatory Commission, “Instructions for Completing Nuclear Material Transaction 

Reports,” NUREG/BR-0006. 

U.S. Nuclear Regulatory Commission, “Instructions for the Preparation and Distribution of 

Material Status Reports,” NUREG/BR-0007. 

U.S. Nuclear Regulatory Commission, “Instructions and Guidance for Completing Physical 

Inventory Summary Reports,” NUREG/BR-0096. 

U.S. Nuclear Regulatory Commission, “Acceptable Standard Format and Content for the 

Fundamental Nuclear Material Control (FNMC) Plan Required for Low-Enriched Uranium 

Facilities,” NUREG-1065. 

U.S. Nuclear Regulatory Commission, “Standard Format and Content Acceptance Criteria for 

the Material Control and Accounting (MC&A) Reform Amendment,” NUREG-1280. 

U.S. Nuclear Regulatory Commission, “Recommendations to the NRC on Acceptable Standard 

Format and Content for the Fundamental Nuclear Material Control (FNMC) Plan Required for 

Low-Enriched Uranium Enrichment Facilities,” NUREG/CR-5734.
June 2015 13-1 NUREG-1520, Revision 2

13. PHYSICAL PROTECTION 

13.1 Purpose of Review 

 

The purpose of this review is to determine if the applicant has committed to establish and 

maintain a physical protection system, as required by Title 10, “Energy,” of the Code of Federal 

Regulations (10 CFR) Part 73, “Physical Protection of Plants and Materials,” and 10 CFR 

Part 70, “Domestic Licensing of Special Nuclear Material.” The review should establish that the 

applicant’s physical protection system provides reasonable assurance that its activities involving 

the protection of special nuclear material (SNM) are not inimical to the common defense and 

security and do not constitute an unreasonable risk to the public health and safety. Certain 

10 CFR Part 73 requirements, such as the 10 CFR 73.20(a) general performance objectives, 

require “high assurance” that licensed activities involving formula quantities of strategic special 

nuclear material (SSNM) are not inimical to the common defense and security and do not 

constitute an unreasonable risk to the public health and safety. 

13.2 Responsibility for Review 

Primary: Physical Protection Specialist 

Secondary: Licensing Project Manager 

Supporting: Regional Physical Protection Inspector 

The licensing project manager will receive information from the applicant and coordinate the 

review by the various technical disciplines involved. The physical protection specialist is 

responsible for reviewing all materials submitted in response to 10 CFR Part 73 requirements 

and determining the adequacy of the proposed physical protection system. 

13.3 Areas of Review 

As specified in 10 CFR 70.22, “Contents of Application,” an applicant may need to submit one or 

more plans to demonstrate compliance with physical security requirements. The specific 

physical security requirements for the contents of applications for facilities regulated under 

10 CFR Part 70 include the following: 

 10 CFR 70.22(g)—Physical Protection of SNM in Transit 

 10 CFR 70.22(h)—Physical Security Plan for Formula Quantities 

 10 CFR 70.22(j)—Safeguards Contingency Plan for Formula Quantities 

 10 CFR 70.22(k)—Physical Security Plan for SNM of Moderate Strategic Significance 

and Low Strategic Significance 

Each of the requirements listed above references more detailed requirements in 10 CFR 

Part 11, “Criteria and Procedures for Determining Eligibility for Access to or Control over Special 

Nuclear Material,” and 10 CFR Part 73 regarding the physical security of SNM at fixed sites and 

in transit. The application must contain or reference the plans which demonstrate compliance 

with all of the requirements that apply to the authorization being requested in the license 

application. 
June 2015 13-2 NUREG-1520, Revision 2

Table 13.1 Categories of Materials 

Material Isotopic 

Composition 

Category I 

Formula 

Quantities

Category II 

Moderate Strategic 

Significance

Category III 

Low Strategic 

Significance

Plutonium 

All plutonium 

(element) 

2,000 gram

s or more 

Less than 

2,000 grams, but 

more than 500 grams 

500 grams or 

less, but more 

than 15 grams 

Uranium-233 All U-233 

enrichments 

2,000 gram

s or more 

Less than 

2,000 grams, but 

more than 500 grams 

500 grams or 

less, but more 

than 15 grams 

Uranium-235 

Uranium 

enriched to 

20% or more 

in isotope 

U-235 

5,000 gram

s or more 

Less than 

5,000 grams, but 

more than 

1,000 grams 

1,000 grams or 

less, but more 

than 15 grams 

Uranium 

enriched to 

10%, but less 

than 20%, in 

isotope U-235 

N/A 10,000 grams or 

more 

Less than 

10,000 grams, 

but more than 

1,000 grams 

Uranium 

enriched 

above 0.711%, 

but less than 

10%, in 

isotope U-235 

N/A N/A 10,000 grams or 

more 

13.3.1 Formula Quantity of Strategic Special Nuclear Material 

For a Category I facility, the staff will review the applicant’s physical protection plan in 

accordance with the applicable regulations. The applicant may choose to have one physical 

protection plan addressing all the applicable requirements or have separate plans for each 

specific area described in the regulations. When applicable, the reviewer will review the 

applicant’s commitments regarding the following physical protection program areas: 

1. Plan for Protection of Formula Quantities in Transit—The license application includes a 

plan addressing the detailed requirements in 10 CFR Part 73 (including those in 

10 CFR 73.1, “Purpose and Scope”; 73.20, “General Performance Objective and 

Requirements”; 73.25, “Performance Capabilities for Physical Protection of Strategic 

Special Nuclear Material in Transit”; and 73.26, “Transportation Physical Protection 

Systems, Subsystems, Components, and Procedures”). Note that 10 CFR 73.6(d) 

exempts licensees from transportation security requirements if the SNM is transported 

by the United States Department of Energy (DOE) transport system. Most high enriched 

uranium is moved by the DOE system. If the application states that the DOE transport 

system is used, no transportation security plan is required. 
June 2015 13-3 NUREG-1520, Revision 2

2. Plan for Protection of Formula Quantities at Fixed Sites—The license application 

includes a plan addressing the detailed access authorization requirements in 10 CFR 

Part 11 (including those in 10 CFR 11.11, “General Requirements”; and 11.15, 

“Application for Special Nuclear Material Access Authorization”) and the applicable 

10 CFR Part 73 requirements (including those in 10 CFR 73.1; 73.20; 73.45, 

“Performance Capabilities for Fixed Site Physical Protection Systems”; and 73.46, “Fixed 

Site Physical Protection Systems, Subsystems, Components, and Procedures”). 

3. Security Training and Qualification Plan—The license application includes a plan 

addressing the detailed training and qualification requirements in Part 73 for security 

personnel (see Appendix B, “General Criteria for Security Personnel,” to Part 73). 

Applicants often address these requirements in a separate training and qualification 

plan. 

4. Safeguards Contingency Plan—The application must include a plan addressing how the 

licensee will engage and impede adversaries. Such plans are subject to the 

requirements in Appendix C, “Nuclear Power Plant Safeguards Contingency Plans,” to 

Part 73, unless 10 CFR 73.55 (“Requirements for Physical Protection of Licensed 

Activities in Nuclear Power Reactors against Radiological Sabotage”) is applicable, in 

which case those requirements are applicable. 

Associated guidance and reference documents are listed in SRP Section 13.4. 

13.3.2 Moderate Strategic or Low Strategic Special Nuclear Material 

For Category II and Category III facilities, the staff will review the applicant’s physical-protection 

plan in accordance with the applicable regulations and will review the applicant’s physical 

protection program commitments associated with moderate strategic or low strategic SNM. 

Review Interfaces 

The reviewer should examine information in the following other areas to ensure that it is 

consistent with the information provided for physical protection: 

 Coordinate with the reviewer of the Material Control and Accounting plan applicable to 

physical protection under SRP Chapter 12. 

 Proposed quantities of SNM to be possessed, used or produced by the applicant as 

stated in the Part 70 application or existing license. 

13.4 Acceptance Criteria 

Acceptance criteria for an applicant’s physical security plan are based on meeting the relevant 

requirements of the regulations described in this section. Separate NUREGs have been 

developed for each facility type. 
June 2015 13-4 NUREG-1520, Revision 2

13.4.1 Formula Quantity of Strategic Special Nuclear Material 

13.4.1.1 Regulatory Requirements 

Acceptance criteria are based on meeting the relevant physical protection requirements of the 

following regulations: 

1. 10 CFR 73.1 defines the design basis threat a safeguards system must be designed to 

protect against. 

2. 10 CFR 73.20 defines the general performance objective and requirements for fixed-site 

physical protection systems. 

3. 10 CFR 73.45 defines the performance capabilities for fixed-site physical protection 

systems. 

4. 10 CFR 73.46 describes the specific measures for fixed-site physical protection systems, 

subsystems, components, and procedures. 

5. Appendices B; C; G, “Reportable Safeguards Events”; and H, “Weapons Qualification 

Criteria,” to Part 73 provide additional requirements applicable to applicants possessing 

formula quantities of SSNM. 

6. 10 CFR 73.1; 73.20; 73.25; 73.26; and 73.70, “Records,” describe in detail the 

requirements for transportation of formula quantities of SSNM. 

13.4.1.2 Regulatory Guidance 

The following documents contain some of the regulatory guidance that is relevant to physical 

protection of formula quantities of SSNM: 

1. International Atomic Energy Agency (IAEA), “The Physical Protection of Nuclear Material 

and Nuclear Facilities,” Information Circular 225, Rev. 5 (corrected), Vienna, Austria, 

June 1999. 

2. U.S. Nuclear Regulatory Commission, “User's Guide to Physical Protection Documents 

Published by the NRC,” NUREG/BR-0252, November 1998. 

3. U.S. Nuclear Regulatory Commission, “Standard Review Plan for Training and 

Qualifications Plans for Security Personnel at Category I Fuel Facilities,” 

NUREG/CR-6668, May 2000. 

4. U.S. Nuclear Regulatory Commission, " Safeguards Contingency Response Standard 

Review Plan,” May, 2000. 

5. U.S. Nuclear Regulatory Commission, “Training, Equipping, and Qualifying of Guards 

and Watchmen,” Regulatory Guide (RG) 5.20, September 2011. 

6. U.S. Nuclear Regulatory Commission, “Perimeter Intrusion Alarm Systems,” RG 5.44, 

October 1997. 
June 2015 13-5 NUREG-1520, Revision 2

7. U.S. Nuclear Regulatory Commission, “Standard Format and Content of a Licensee 

Physical Protection Plan for Strategic Special Nuclear Material at Fixed Sites (Other than 

Nuclear Power Plants),” RG 5.52, Rev. 3, December 1994. 

8. U.S. Nuclear Regulatory Commission, “Standard Format and Content of Safeguards 

Contingency Plans for Fuel Cycle Facilities (for Comment),” RG 5.55, March 1978. 

9. U.S. Nuclear Regulatory Commission, “Standard Format and Content of Safeguards 

Contingency Plans for Transportation (for Comment),” RG 5.56, March 1978. 

10. U.S. Nuclear Regulatory Commission, “Shipping and Receiving Control of Strategic 

Special Nuclear Material,” RG 5.57, June 1980. 

11. U.S. Nuclear Regulatory Commission, “Standard Format and Content of a Licensee 

Physical Protection Plan for SSNM in Transit,” RG 5.60, September 2011. 

13.4.1.3 Regulatory Acceptance Criteria 

The primary reviewer will find the applicant's physical protection system acceptable if the 

applicant’s commitments are consistent with the regulations identified above and with security 

orders issued by the Commission. With respect to any physical-protection plan regarding 

formula quantities of SSNM, the primary reviewer will confirm that such a plan contains 

inspectable commitments. 

13.4.2 Moderate Strategic or Low Strategic Special Nuclear Material 

13.4.2.1 Regulatory Requirements 

Acceptance criteria for possession, use, or transport of moderate strategic or low strategic SNM 

are based on meeting the relevant requirements of the following regulations: 

1. 10 CFR 73.67(a) contains the general performance objectives that are applicable to 

applicants who plan to possess, use, or transport SNM of moderate or low strategic 

significance. 

2. 10 CFR 73.67(c)(1) requires a licensee who possess, uses, trasponrts, or delivers to a 

carrier for transport SNM of moderate strategic significance or low strategic significance 

to submit a security plan addressin the applicable requirements contained in 10 CFR 

73.67. 

3. 10 CFR 73.67(d) and (e) contain the fixed-site and in-transit requirements applicable to 

SNM of moderate or low strategic significance. 

4. 10 CFR 73.67(f) and (g) contain the fixed-site and in-transit requirements applicable to 

SNM of low strategic significance. 

5. Compliance with Commission-issued orders, if applicable. 

13.4.2.2 Regulatory Guidance 

The following documents contain some of the regulatory guidance that is relevant to physical 

protection of moderate- or low-significance SSNM: 
June 2015 13-6 NUREG-1520, Revision 2

1. IAEA, “The Physical Protection of Nuclear Material and Nuclear Facilities,” Information 

Circular 225, Rev. 5 (corrected), Vienna, Austria, June 1999. 

2. U.S. Nuclear Regulatory Commission, “User's Guide to Physical Protection Documents 

Published by the NRC,” NUREG/BR-0252, November 1998. 

3. U.S. Nuclear Regulatory Commission, “Standard Format and Content for a Licensee 

Physical Security Plan for the Protection of Special Nuclear Material of Moderate or Low 

Strategic Significance,” RG 5.59, Rev. 1, February 1983. 

13.4.2.3 Regulatory Acceptance Criteria 

The reviewer will find the applicant's physical protection system acceptable if the physical 

protection plan meets the requirements of 10 CFR 73.67, “Licensee Fixed Site and In-Transit 

Requirements for the Physical Protection of Special Nuclear Material of Moderate and Low 

Strategic Significance,” as well as the requirements of any Commission security orders. The 

physical protection plan for applicants possessing moderate- or low-significance quantities of 

SNM should contain inspectable commitments that shall be the basis for the NRC 

physical-protection inspection program. Therefore, it is imperative that commitments be 

expressed in unambiguous terms. Specific topics required by regulation are delineated in more 

detail in the current version of Regulatory Guide 5.59. 

13.5 Review Procedures 

13.5.1 Acceptance Review 

The applicant is expected to provide one or more plans to demonstrate compliance with 

the physical-security requirements specified in 10 CFR 70.22, “Contents of 

Applications.” During the acceptance review of a license application, the reviewer 

should examine the submittals to identify major deficiencies in the information provided 

for each area of review specified in SRP Section 13.3. Reviewers must decide whether 

they have enough information to proceed with a detailed review. Less significant errors 

or deficiencies that can be addressed in a single request for additional information 

should be accepted. However, before the NRC performs a detailed review, the 

applicant should correct major deficiencies that would require several requests for 

additional information to resolve. 

Reviewers should record whether each area of review is adequately addressed in the 

application, is adequately addressed in a referenced document, is not applicable to the 

application, or has a major deficiency. 

13.5.2 Safety Evaluation 

During the safety evaluation, the reviewer determines whether the physical security plan (or 

“plans” if the applicant chose to separate them) included in the application establishes physical 

protection systems meeting the objectives and capabilities specified in 10 CFR 70.22, 10 CFR 

Part 73, and applicable security orders. The primary reviewer will perform a safety evaluation 

with respect to the acceptance criteria in Section 13.4. During the initial review, the reviewer 

should draft the safety evaluation report (SER) described below. A request for additional 
June 2015 13-7 NUREG-1520, Revision 2

information (RAI) will be prepared when clarification and additional information are needed to 

determine whether the licensee’s submittals comply with the regulations. The primary reviewer 

should coordinate with the licensing project manager in preparing RAIs. Additional information 

submitted by the applicant will be evaluated and a final SER will be provided to the licensing 

project manager. 

13.6 Evaluation Findings 

 

The regulations in 10 CFR 70.23, “Requirements for the Approval of Applications,” and 70.66, 

“Additional Requirements for Approval of License Application,” state that an application for a 

license will be approved if the Commission can make the general findings listed in those 

sections. The basis for the general findings is an evaluation of whether the application 

adequately addresses all of the applicable regulatory requirements. More specifically, the staff’s 

evaluation should determine whether the licensing submittals provide sufficient information to 

satisfy the regulatory requirements referenced in this SRP Chapter. The SER should state how 

the applicable regulatory requirements have or have not been met based on the acceptance 

criteria described in this chapter of the SRP. If the applicant chooses to use an alternative 

approach, the reviewer should discuss in the SER whether the proposed approach satisfies the 

applicable regulatory requirements. The reviewers should use the following approach to 

document their evaluation: 

1. State a specific regulatory requirement that applies to the application. Detailed 

acceptance criteria may be included where appropriate or necessary. 

2. Identify the areas where the regulatory requirement is addressed in the application, 

including the areas where the specific acceptance criteria described in this SRP are 

addressed. 

3. Describe your evaluation of the application, the basis for your conclusion, and whether 

regulatory requirements are met. 

4. Repeat these steps for every regulatory requirement that applies to the application. 

There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

application or amendment request, (2) denial of the application or request, or (3) approval with 

conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

reviewer may consider proposing a license condition. Absent an NRC order, license conditions 

must be agreed upon with the licensee or applicant before becoming part of the license. 

A license condition should only be proposed if there is reasonable assurance that, if the 

licensee meets the condition, all regulatory requirements will be satisfied. Thus, license 

conditions should not be used to cover major deficiencies in an application. License conditions 

should be unambiguous, inspectable, and enforceable. They should only require those actions 

necessary to ensure compliance with applicable regulations. The basis for license conditions 

must be documented in the SER. 

If the submittal is acceptable, the final SER security input should conclude with a statement 

similar to the following: 

Based on the evaluation described above, the NRC staff finds that the plan(s) for 

physical protection of SNM provide reasonable assurance [or “high assurance” if 

the application pertains to formula quantities of strategic SNM] that the licensee 
June 2015 13-8 NUREG-1520, Revision 2

will provide adequate protection during the term of the license. The staff 

concludes that the applicant provided an acceptable physical protection plan for 

the proposed facility that will meet the applicable requirements specified in 

10 CFR Part 73. 

13.7 References 

U.S. Code of Federal Regulations, “Criteria and Procedures for Determining Eligibility for 

Access to or Control over Special Nuclear Material,” Part 11, Chapter I, Title 10, “Energy.” 

U.S. Code of Federal Regulations, “Access Authorization for Licensee Personnel,” Part 25, 

Chapter I, Title 10, “Energy.” 

U.S. Code of Federal Regulations, “Physical Protection of Plants and Materials,” Part 73, 

Chapter I, Title 10, “Energy.” 

U.S. Code of Federal Regulations, “Security Facility Approval and Safeguarding of National 

Security Information and Restricted Data,” Part 95, Chapter I, Title 10, “Energy.” 

U.S. Nuclear Regulatory Commission, “Entry/Exit Control for Protected Areas, Vital Areas, and 

Material Access Areas,” Regulatory Guide (RG) 5.7, Rev. 1, May 1980. 

U.S. Nuclear Regulatory Commission, “Perimeter Intrusion Alarm Systems,” RG 5.44, Rev. 3, 

October 1997. 

U.S. Nuclear Regulatory Commission, “Standard Format and Content of a Licensee Physical 

Protection Plan for Strategic Special Nuclear Material at Fixed Sites (Other than Nuclear Power 

Plants),” RG 5.52, Rev. 3, December 1994. 

U.S. Nuclear Regulatory Commission, "Standard Format and Content of Safeguards 

Contingency Plans for Fuel Cycle Facilities," RG 5.55, March 1978. 
June 2015 14-1 NUREG-1520, Revision 2 

14. GLOSSARY 

This glossary defines technical/industry terms that are used consistently throughout this 

standard review plan (SRP) or references the related definitions in either Title 10 of the Code of 

Federal Regulations (10 CFR) 20.1003 or 10 CFR 70.4, both titled “Definitions.” This glossary 

does not define terms that may have different connotations in different contexts; such terms are 

defined in the various chapters of this SRP. 

Many of these definitions state that they are specifically relevant to nuclear criticality safety. 

Abnormal condition When applied to nuclear criticality safety, an event or 

condition not intended as a desirable or regularly occurring 

condition in the facility or process design, but which is 

anticipated as a contingency in criticality safety evaluations. 

A condition that is reached by exceeding the safety limit(s) of 

one or more controlled parameters. 

Accident sequence An unintended sequence of events that, given the failure of 

certain items relied on for safety identified in the sequence, 

would result in environmental contamination, radiation 

exposure, release of radioactive material, inadvertent 

nuclear criticality, or exposure to hazardous chemicals 

(provided that the chemicals are produced from licensed 

radioactive material). The term “accident” may be used 

interchangeably with “accident sequence.” 

Active engineered control A physical device that uses active sensors, electrical 

components, or moving parts to maintain safe process 

conditions without any required human action. 

Acute (This term is defined in 10 CFR 70.4.) 

Administrative control Either an augmented administrative control or a simple 

administrative control, as defined herein. When applied to 

nuclear criticality safety, a human action [comprising either 

simple or augmented administrative controls, as defined 

herein], whether required or prohibited, relied on to prevent 

or mitigate a specific accident sequence or to maintain 

subcriticality, and established in formal plant procedures. 

Analytical limit (See “safety limit”). 
June 2015 14-2 NUREG-1520, Revision 2 

Area(s) of applicability When applied to nuclear criticality safety, the range of 

physical parameters (isotopic abundance, moderation, 

neutron energy, absorbers, etc.) that (1) characterizes a 

fissile material system over which a given calculational 

method has been validated; (2) is covered by the chosen 

benchmark experiments, and (3) for which a bias has been 

determined. 

Augmented administrative 

control 

A procedurally required or prohibited human action, 

combined with a physical device that alerts the operator that 

the action is needed to maintain safe process conditions or 

that otherwise adds substantial assurance of the required 

human performance. 

Available and reliable to 

perform their function when 

needed 

(This term is defined in 10 CFR 70.4.) 

Baseline design criteria A set of criteria specifying design features and management 

measures that are required and acceptable under certain 

conditions for new processes or facilities specified in 

10 CFR 70.64, “Requirements for New Facilities or New 

Processes at Existing Facilities.” In general, these criteria 

are the acceptance criteria that apply to safety design for 

new facilities and new processes, as described in this SRP. 

Benchmark When applied to nuclear criticality safety, a critical 

experiment which is widely accepted and whose physical 

characteristics and their uncertainties have been wellcharacterized, so that it is suitable for validation. 

Bias The numerical difference between the calculated and 

experimental values of keff for a set of benchmark 

experiments covering a particular area of applicability (often 

expressed as a function of system parameters). 

Concurrent When applied to nuclear criticality safety and in the context 

of double contingency, two changes in process conditions 

are concurrent if the effect of the first change persists until 

the second change occurs. This does not mean 

simultaneous (where both upsets occur at the same time), 

but rather that the system is affected by both changes during 

some time interval. 

Configuration management (This term is defined in 10 CFR 70.4.) 
June 2015 14-3 NUREG-1520, Revision 2 

Consequence Any result of interest caused by an event or sequence of 

events. In this context, “adverse consequence” refers to 

adverse health or safety effects on workers, the public, or 

the environment. When applied to nuclear criticality safety, 

(1) Occurrence of an accidental criticality; (2) the energy 

released in an accidental criticality, normally expressed in 

terms of the number of fissions or dose to workers. 

Contingency In the context of double contingency, a change in process 

conditions or loss of a criticality control that could result in 

one or more parameters exceeding their safety limits. 

Controlled area (This term is defined in 10 CFR 20.1003.) 

Controlled parameter A measurable parameter that is maintained within a 

specified range by one or more specific controls to ensure 

the safety of an operation. When applied to nuclear 

criticality safety, is a parameter of a system that is 

maintained within a specified range to ensure subcriticality. 

Credible abnormal condition As used in meeting the requirements of 10 CFR 70.61(d), 

one of the spectrum of abnormal conditions resulting from 

credible single failures and related sequences of events, up 

to those that must be considered in the context of 

demonstrating compliance with the double-contingency 

principle (see Appendix 5-A for more information). 

Critical (1) Having an actual keff value ≥ 1; (2) Having a calculated 

keff value ≥ the Upper Subcritical Limit. 

Critical mass A quantity of fissionable material capable of supporting a 

self-sustained nuclear chain reaction; sometimes, the 

minimum quantity of such material given spherical geometry, 

optimum moderation, and full water reflection (also referred 

to as the minimum critical mass). 

Critical mass of special nuclear 

material 

(This term is defined in 10 CFR 70.4.) 

Criticality control When applied to nuclear criticality safety, a control used to 

ensure subcriticality. 
June 2015 14-4 NUREG-1520, Revision 2 

Criticality safety evaluation When applied to nuclear criticality safety, a structured 

analysis demonstrating criticality safety for a given process, 

including a demonstration that processes will be subcritical 

under normal and credible abnormal conditions, and the 

specification of controls and limits to achieve that goal (also 

often referred to as a nuclear criticality safety evaluation, 

analysis, assessment, etc.). 

Degraded When applied to nuclear criticality safety, a control, control 

system, or controlled parameter is considered to be 

degraded when the parameter is kept within its safety limits 

but its reliability and availability has been reduced in such a 

way that it is no longer unlikely that those limits will be 

exceeded. 

Double-contingency principle When applied to nuclear criticality safety , process designs 

should incorporate sufficient factors of safety to require at 

least two unlikely, independent, and concurrent changes in 

process conditions before a criticality accident is possible. 

Double-contingency protection A characteristic or attribute of a process that has 

incorporated sufficient safety factors so that at least two 

unlikely, independent, and concurrent changes in process 

conditions are required before a nuclear criticality accident is 

possible. The condition of requiring at least two unlikely, 

independent, and concurrent changes in process conditions 

before a criticality accident is possible. 

Engineered control (See “active engineered control” and “passive engineered 

control.”) 

Event (1) A change in process conditions that has the potential to 

adversely affect safety; (2) one of several occurrences that 

constitute an accident sequence. 

External event An event for which the likelihood cannot be altered by 

changes to the regulated facility or its operation. This would 

include all natural phenomena events, plus airplane crashes, 

explosions, toxic releases, fires, etc., occurring near or on 

the plant site. 

Favorable geometry Characteristic of structures, systems, devices, or equipment 

such that fissile material maintained within specified 

dimensions will be subcritical under the most reactive 

credible conditions (defined for a given isotopic composition 

and physicochemical form). 

Hazardous chemicals produced 

from licensed materials 

(This term is defined in 10 CFR 70.4.) 
June 2015 14-5 NUREG-1520, Revision 2 

Independent In the context of double contingency, two changes in 

process conditions are considered independent if the 

occurrence of one does not cause, or affect the probability of 

occurrence of, the other, so that the probability that both 

occur is independent of the order in which they occur(i.e., 

there are no identifiable common-mode failures that can lead 

to criticality). 

Integrated safety analysis (This term is defined in 10 CFR 70.4.) 

Integrated safety analysis 

summary 

(This term is defined in 10 CFR 70.4.) 

Isolated Describes (1) the condition whereby the flow of matter and 

energy between a system and surrounding systems can be 

neglected for the purpose of performing a safety analysis or 

(2) the condition of being separated by a sufficient distance 

from other systems or materials that their presence has a 

negligible effect on the system’s keff. 

Items relied on for safety This item is defined in 10 CFR 70.4 

keff The effective neutron multiplication factor of a nuclear fission 

reaction; that is, the average number of neutrons from each 

fission that cause another fission. 

Lost When applied to nuclear criticality safety, a control, control 

system, or controlled parameter is considered to be lost

when the measures that keep the parameters within their 

safety limits cease to function as designed, or cannot be 

verified to function as designed, whether or not the affected 

parameters actually exceed their safety limits. 

Management measures (This term is defined in 10 CFR 70.4.) 

Margin of safety When applied to nuclear criticality safety, the difference 

between the actual value of a parameter and the value of the 

parameter at which the system is expected to be critical 

(taking bias and bias uncertainty into account). 

Margin of subcriticality (1) The difference between the actual value of keff and the 

value at which the system is expected to be critical (taking 

bias and bias uncertainty into account); (2) the difference 

between the calculated value of keff (including uncertainties) 

and the value at which the system is expected to be critical 

(taking bias and bias uncertainty into account), plus any 

margin in keff resulting from conservative modeling of system 

parameters. 
June 2015 14-6 NUREG-1520, Revision 2 

[Approved] margin of 

subcriticality for safety 

The minimum allowable value of the margin of subcriticality, 

including the minimum margin of subcriticality and any 

margin resulting from conservative modeling practices. 

Minimum margin of subcriticality Margin in keff beyond the bias and uncertainty in the bias, to 

allow for any unknown or difficult-to-quantify uncertainties in 

calculating keff (frequently referred to as the arbitrary margin

or administrative margin). 

Mitigative control A control intended to reduce the consequences of an 

accident sequence, not to prevent it. When a mitigative 

control works as intended, the results of the sequence are 

called the mitigated consequences. 

Natural-phenomenon events Earthquakes, floods, tornadoes, tsunamis, hurricanes, and 

other events that occur in the natural environment and could 

adversely affect safety. Natural-phenomenon events may be 

credible or incredible, depending on their likelihood of 

occurrence. 

New processes at existing 

facilities 

Systems-level or facility-level design changes to process 

equipment, process technology, facility layout, or types of 

licensed material possessed or used. Generally, this 

definition does not include component-level design changes 

or equipment replacement. 

Normal condition A condition specifically anticipated or allowed for as part of 

the normal operation of the facility. A condition in which all 

controlled parameters are within their safety limits. 

Nuclear criticality safety An approach to a facility’s design, operation, and other 

activities that is chiefly concerned with preventing the 

occurrence of events involving an inadvertent and 

self-sustaining nuclear chain reaction. 

Operating limit A limiting value (or range of values) for a process parameter 

at which the plant operators normally operate the facility. 

Optimum When applied to nuclear criticality safety, the value of a 

parameter that produces the highest keff. 

Parameter When applied to nuclear criticality safety, a measurable or 

observable characteristic of a system that affects the value 

of keff. The parameters normally are mass, geometry, 

density, enrichment/isotopics, reflection, moderation, 

concentration, interaction, absorption, volume, 

heterogeneity, physicochemical form, and process variables. 
June 2015 14-7 NUREG-1520, Revision 2 

Passive engineered control A device that uses only fixed physical design features to 

maintain safe process conditions without any required 

human action. 

Preventive control A control intended to prevent an accident (i.e., any of the 

radiological or chemical consequences described in 

10 CFR 70.61, “Performance Requirements”). 

Process condition In the context of double contingency, the set of all 

characteristics or attributes of a process important to safety 

(a change in the value of a parameter, or loss or degradation 

of a control affecting the ability to maintain a parameter, 

etc.). 

Reactivity Loosely used synonymously with keff. The adjective form 

reactive is used most frequently in the phrase most reactive 

credible to mean the physical conditions that produce the 

highest credible value of keff. 

Safe mass The quantity of fissile material that is safely subcritical under 

the most reactive credible conditions (defined for a given 

isotopic composition and physicochemical form), including 

allowance for overbatching. 

Safe process conditions The defined ranges or sets of acceptable values of one or 

more controlled parameters. 

Safety control A system, device, or procedure that is intended to regulate a 

device, process, or human activity in order to maintain a safe 

state. Controls may be engineered controls or administrative 

(procedural) controls, and they may be either preventive or 

mitigative, as defined herein. 

Safety limit A limit chosen to maintain the integrity of physical barriers 

that protect against exceeding the performance 

requirements of 10 CFR 70.61. When applied to nuclear 

criticality safety, the safety limit is the value of a controlled 

parameter established by a criticality safety evaluation to 

which the process will be controlled. This can be equal to 

the subcritical limit, but can include additional margin 

because of uncertainty and variability in the process (also 

referred to as the “analytical limit”). 

Safety margin Same as margin of safety. 

Setpoint A predetermined value for actuation of the final setpoint 

device to initiate a protective action. 
June 2015 14-8 NUREG-1520, Revision 2 

Simple administrative control A procedural human action that is prohibited or required to 

maintain safe process conditions. 

Subcritical Demonstrated not to be critical; having a value of keff no 

greater than the upper subcritical limit. 

Subcritical limit (1) The bounding value of a controlled parameter that has 

been demonstrated to maintain a system subcritical in plant 

criticality safety evaluations; (2) the upper subcritical limit. 

Subcritical margin Same as margin of subcriticality. 

System When applied to nuclear criticality safety, discrete part of a 

fissile material operation that can be separated from other 

systems for the purpose of conducting a safety analysis, and 

that is the subject of a criticality safety evaluation. 

Unacceptable performance 

deficiencies 

(This term is defined in 10 CFR 70.4.) 

Upper subcritical limit The maximum value of keff that is considered to be subcritical 

with an acceptable degree of confidence (taking bias and 

bias uncertainty into account, and including a minimum 

margin of subcriticality). 

Validation (criticality code) The process of quantifying the suitability of a computer code 

system (or other methodology) for use in nuclear criticality 

safety analyses. 

Verification (criticality code) The process of confirming that the computer code system 

correctly performs intended numerical calculations. 

Worker (This term is defined in 10 CFR 70.4.) 






NUREG-1520, Rev. 2

Final

Standard Review Plan for Fuel Cycle Facilities License Applications