Standard Review Plan 

for License Applications 

for Fuel Cycle Facilities

Draft Report for Comment

Office of Nuclear Material Safety and Safeguards

NUREG-1520, Rev. 2
NRC Reference Material 

As of November 1999, you may electronically access 

NUREG-series publications and other NRC records at 

NRC’s Public Electronic Reading Room at 

http://www.nrc.gov/reading-rm.html. Publicly released 

records include, to name a few, NUREG-series 

publications; Federal Register notices; applicant, 

licensee, and vendor documents and correspondence; 

NRC correspondence and internal memoranda; bulletins 

and information notices; inspection and investigative 

reports; licensee event reports; and Commission papers 

and their attachments. 

NRC publications in the NUREG series, NRC 

regulations, and Title 10, “Energy,” in the Code of

Federal Regulations may also be purchased from one 

of these two sources. 

1. The Superintendent of Documents

 U.S. Government Printing Office

Mail Stop SSOP

Washington, DC 20402–0001

Internet: bookstore.gpo.gov

Telephone: 202-512-1800

Fax: 202-512-2250 

2. The National Technical Information Service 

Springfield, VA 22161–0002

www.ntis.gov

1–800–553–6847 or, locally, 703–605–6000 

A single copy of each NRC draft report for comment is 

available free, to the extent of supply, upon written 

request as follows:

Address: U.S. Nuclear Regulatory Commission

 Office of Administration 

Publications Branch

 Washington, DC 20555-0001

E-mail: DISTRIBUTION.RESOURCE@NRC.GOV

Facsimile: 301–415–2289 

Some publications in the NUREG series that are 

posted at NRC’s Web site address 

http://www.nrc.gov/reading-rm/doc-collections/nuregs 

are updated periodically and may differ from the last 

printed version. Although references to material found on 

a Web site bear the date the material was accessed, the 

material available on the date cited may subsequently be 

removed from the site.

Non-NRC Reference Material 

Documents available from public and special technical 

libraries include all open literature items, such as books, 

journal articles, transactions, Federal Register notices, 

Federal and State legislation, and congressional reports. 

Such documents as theses, dissertations, foreign reports 

and translations, and non-NRC conference proceedings 

may be purchased from their sponsoring organization. 

Copies of industry codes and standards used in a 

substantive manner in the NRC regulatory process are 

maintained at—

The NRC Technical Library

Two White Flint North

11545 Rockville Pike

Rockville, MD 20852–2738 

These standards are available in the library for reference 

use by the public. Codes and standards are usually 

copyrighted and may be purchased from the originating 

organization or, if they are American National Standards, 

from—

American National Standards Institute

11 West 42nd Street

New York, NY 10036–8002

www.ansi.org

212–642–4900 

AVAILABILITY OF REFERENCE MATERIALS

IN NRC PUBLICATIONS

Legally binding regulatory requirements are stated only 

in laws; NRC regulations; licenses, including technical 

specifications; or orders, not in NUREG-series 

publications. The views expressed in contractorprepared publications in this series are not necessarily 

those of the NRC.

The NUREG series comprises (1) technical and 

administrative reports and books prepared by the staff 

(NUREG–XXXX) or agency contractors (NUREG/CR–

XXXX), (2) proceedings of conferences (NUREG/CP–

XXXX), (3) reports resulting from international 

agreements (NUREG/IA–XXXX), (4) brochures 

(NUREG/BR–XXXX), and (5) compilations of legal 

decisions and orders of the Commission and Atomic and 

Safety Licensing Boards and of Directors’ decisions

under Section 2.206 of NRC’s regulations (NUREG–

0750).

DISCLAIMER: This report was prepared as an account 

of work sponsored by an agency of the U.S. 

Government. Neither the U.S. Government nor any 

agency thereof, nor any employee, makes any warranty, 

expressed or implied, or assumes any legal liability or 

responsibility for any third party’s use, or the results of 

such use, of any information, apparatus, product, or 

process disclosed in this publication, or represents that 

its use by such third party would not infringe privately 

owned rights.
Standard Review Plan 

for License Applications 

for Fuel Cycle Facilities

Draft Report for Comment

Manuscript Completed: May 2014

Date Published: May 2014

Office of Nuclear Materials Safety and Safeguards

NUREG-1520, Rev. 2

 
COMMENTS ON DRAFT REPORT

Any interested party may submit comments on this report for consideration by the NRC staff. 

Comments may be accompanied by additional relevant information or supporting data. Please 

specify the report number NUREG-1520 in your comments, and send them by the end of the 

comment period specified in the Federal Register notice announcing the availability of this 

report. 

Addresses: You may submit comments by any one of the following methods. Please include 

Docket ID NRC-2012-0220 in the subject line of your comments. Comments submitted in 

writing or in electronic form will be posted on the NRC website and on the Federal rulemaking 

website http://www.regulations.gov. 

Federal Rulemaking Website: Go to http://www.regulations.gov and search for documents 

filed under Docket ID NRC-2012-0220. Address questions about NRC dockets to Carol 

Gallagher at 301-287-3422 or by e-mail at Carol.Gallagher@nrc.gov.

Mail comments to: Cindy Bladey, Chief, Rules, Announcements, and Directives Branch

(RADB), Division of Administrative Services, Office of Administration, Mail Stop: 

3WFN-06-A44MP, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001.

For any questions about the material in this report, please contact: Soly I. Soto, Project 

Manager, at 301-287-9076 or by e-mail at Soly.Soto@nrc.gov. 

Please be aware that any comments that you submit to the NRC will be considered a public 

record and entered into the Agencywide Documents Access and Management System 

(ADAMS). Do not provide information you would not want to be publicly available.
May 2014 iii NUREG-1520, Revision 2

ABSTRACT

1 NUREG-1520, “Standard Review Plan (SRP) for License Applications for Fuel Cycle Facilities” 

2 (hereinafter referred to as the SRP), provides guidance to the staff reviewers in the U.S. Nuclear 

3 Regulatory Commission’s (NRC’s) Office of Nuclear Material Safety and Safeguards who 

4 perform safety and environmental impact reviews of applications to construct or modify and 

5 operate nuclear fuel cycle facilities. This SRP addresses the longstanding health, safety, and 

6 environmental-protection requirements of Title 10, “Energy,” of the Code of Federal Regulations

7 (10 CFR) Part 20, “Standards for Protection against Radiation,” and 10 CFR Part 70, “Domestic 

8 Licensing of Special Nuclear Material,” as well as the accident-safety requirements reflected in 

9 Subpart H, “Additional Requirements for Certain Licensees Authorized To Possess a Critical 

10 Mass of Special Nuclear Material,” of 10 CFR Part 70.

11

12 The SRP is intended to be a comprehensive and integrated document that provides the 

13 reviewer with guidance that describes methods or approaches that the staff has found 

14 acceptable for meeting NRC requirements. Separate chapters of this SRP discuss the major 

15 topics addressed within the safety program description of a facility license application, including 

16 general information, organization and administration, ISA and ISA summary, radiation 

17 protection, nuclear criticality safety, chemical process safety, fire safety, emergency 

18 management, environmental protection, decommissioning, and management measures. This 

19 SRP also makes information about licensing acceptance criteria widely available to interested

20 members of the public and the regulated industry and is intended to improve industry and public 

21 stakeholder understanding of the staff review process. Each SRP section addresses the 

22 responsibilities of the staff reviewers, the matters that they review, the Commission's regulations 

23 pertinent to specific technical matters, the acceptance criteria used by the staff, the process and 

24 procedures used to accomplish the review, and the conclusions that are appropriate to 

25 summarize the review.

26

27 This SRP is not a substitute for NRC regulations and compliance is not required. The 

28 approaches and methods in this report are provided for information only. Methods and solutions 

29 different from those described in this report will be acceptable if they provide a basis for the staff 

30 to make the determination needed to issue or continue a license.

31

May 2014 v NUREG-1520, Revision 2

CONTENTS

 Page

1

2

3 ABSTRACT................................................................................................................................iii

4 ACRONYMS AND ABREVIATIONS......................................................................................... xiii

5 GLOSSARY.............................................................................................................................xvii

6

7 INTRODUCTION ........................................................................................................................1

8

9 1. GENERAL INFORMATION................................................................................................. 1-1

10 1.1 Facility and Process Overview ..................................................................................... 1-1

11 1.1.1 Purpose of Review ................................................................................................ 1-1

12 1.1.2 Responsibility for Review....................................................................................... 1-1

13 1.1.3 Areas of Review .................................................................................................... 1-1

14 1.1.4 Acceptance Criteria ............................................................................................... 1-2

15 1.1.5 Review Procedures ............................................................................................... 1-3

16 1.1.6 Evaluation Findings ............................................................................................... 1-4

17 1.2 Institutional Information ................................................................................................ 1-6

18 1.2.1 Purpose of Review ................................................................................................ 1-6

19 1.2.2 Responsibility for Review....................................................................................... 1-6

20 1.2.3 Areas of Review .................................................................................................... 1-6

21 1.2.4 Acceptance Criteria ............................................................................................... 1-7

22 1.2.5 Review Procedures ............................................................................................... 1-9

23 1.2.6 Evaluation Findings ............................................................................................... 1-9

24 1.3 Site Description.......................................................................................................... 1-11

25 1.3.1 Purpose of Review .............................................................................................. 1-11

26 1.3.2 Responsibility for Review..................................................................................... 1-11

27 1.3.3 Areas of Review .................................................................................................. 1-11

28 1.3.4 Acceptance Criteria ............................................................................................. 1-13

29 1.3.5 Review Procedures ............................................................................................. 1-13

30 1.3.6 Evaluation Findings ............................................................................................. 1-14

31 1.4 References................................................................................................................. 1-15

32

33 2. ORGANIZATION AND ADMINISTRATION ......................................................................... 2-1

34 2.1 Purpose of Review ....................................................................................................... 2-1

35 2.2 Responsibility for Review ............................................................................................. 2-1
May 2014 vi NUREG-1520, Revision 2

1 2.3 Areas of Review........................................................................................................... 2-1

2 2.4 Acceptance Criteria...................................................................................................... 2-2

3 2.4.1 Regulatory Requirements...................................................................................... 2-2

4 2.4.2 Regulatory Guidance............................................................................................. 2-2

5 2.4.3 Regulatory Acceptance Criteria ............................................................................. 2-2

6 2.5 Review Procedures ...................................................................................................... 2-4

7 2.5.1 Acceptance Review............................................................................................... 2-4

8 2.5.2 Safety Evaluation................................................................................................... 2-4

9 2.6 Evaluation Findings...................................................................................................... 2-4

10 2.7 References................................................................................................................... 2-6

11

12 3. INTEGRATED SAFETY ANALYSIS AND INTEGRATED SAFETY ANALYSIS SUMMARY 3-1

13 3.1 Purpose of Review ....................................................................................................... 3-1

14 3.2 Responsibility for Review ............................................................................................. 3-3

15 3.3 Areas of Review........................................................................................................... 3-3

16 3.3.1 License Application and Safety Program ............................................................... 3-3

17 3.3.2 Integrated Safety Analysis Summary..................................................................... 3-5

18 3.4 Acceptance Criteria...................................................................................................... 3-7

19 3.4.1 Regulatory Requirements...................................................................................... 3-7

20 3.4.2 Regulatory Guidance............................................................................................. 3-8

21 3.4.3 Regulatory Acceptance Criteria ............................................................................. 3-9

22 3.5 Review Procedures .................................................................................................... 3-31

23 3.5.1 Acceptance Review............................................................................................. 3-31

24 3.5.2 Safety Evaluation................................................................................................. 3-32

25 3.6 Evaluation Findings.................................................................................................... 3-36

26 3.7 References................................................................................................................. 3-38

27 APPENDIX A: EXAMPLE PROCEDURE FOR ACCIDENT SEQUENCE EVALUATION.....3-A-1

28 ANNEX TO APPENDIX A: USE OF APPENDIX A RISK INDEX METHODOLOGY ...........3-AA-1

29 APPENDIX B: QUALITATIVE CRITERIA FOR EVALUATION OF LIKELIHOOD ...............3-B-1

30 APPENDIX C: INITIATING EVENT FREQUENCY..............................................................3-C-1

31 APPENDIX D: NATURAL PHENOMENA HAZARDS ..........................................................3-D-1

32 ANNEX TO APPENDIX D: EXAMPLE OF NATURAL PHENOMENA HAZARD 

33 REVIEW FOR COMPLIANCE WITH 10 CFR 70.61............... 3-AD-1

34 APPENDIX E: HUMAN FACTORS ENGINEERING FOR PERSONNEL ACTIVITIES.........3-E-1

35

36 4. RADIATION PROTECTION ................................................................................................ 4-1

37 4.1 Purpose of Review ....................................................................................................... 4-1

38 4.2 Responsibility for Review ............................................................................................. 4-1

39 4.3 Areas of Review........................................................................................................... 4-1

40 4.4 Acceptance Criteria ..............................................................................................4-3
May 2014 vii NUREG-1520, Revision 2

1 4.4.1 Commitment to Radiation-Protection Program Implementation.............................. 4-3

2 4.4.2 Commitment to ALARA Program ..............................................................................4-3

3 4.4.3 Organization and Personnel Qualifications ............................................................ 4-5

4 4.4.4 Commitment to Written Procedures....................................................................... 4-5

5 4.4.5 Radiation Safety Training ...................................................................................... 4-6

6 4.4.6 Ventilation and Respiratory Protection Programs .................................................. 4-8

7 4.4.7 Radiation Surveys and Monitoring Programs......................................................... 4-9

8 4.4.8 Control of Radiological Risk Resulting from Accidents......................................... 4-13

9 4.4.9 Additional Program Commitments ....................................................................... 4-15

10 4.5 Review Procedures .................................................................................................... 4-16

11 4.5.1 Acceptance Review............................................................................................. 4-16

12 4.5.2 Safety Evaluation................................................................................................. 4-17

13 4.6 Evaluation Findings.................................................................................................... 4-17

14 4.7 References................................................................................................................. 4-19

15

16 5. NUCLEAR CRITICALITY SAFETY ..................................................................................... 5-1

17 5.1 Purpose of Review ....................................................................................................... 5-1

18 5.2 Responsibility for Review ............................................................................................. 5-1

19 5.3 Areas of Review........................................................................................................... 5-1

20 5.4 Acceptance Criteria...................................................................................................... 5-3

21 5.4.1 Regulatory Requirements...................................................................................... 5-3

22 5.4.2 Regulatory Guidance............................................................................................. 5-4

23 5.4.3 Regulatory Acceptance Criteria ............................................................................. 5-4

24 5.5 Review Procedures .................................................................................................... 5-28

25 5.5.1 Acceptance Review............................................................................................. 5-28

26 5.5.2 Safety Evaluation ................................................................................................. 5-28

27 5.6 Evaluation Findings.................................................................................................... 5-30

28 5.7 References................................................................................................................. 5-31

29 APPENDIX A: NUCLEAR CRITICALITY SAFETY PERFORMANCE REQUIREMENTS

30 AND DOUBLE CONTINGENCY PRINCIPLE ...................................................5-A-1

31 APPENDIX B: JUSTIFICATION FOR MINIMUM MARGIN OF SUBCRITICALITY FOR 

32 SAFETY........................................................................................................5-B-1

33 ANNEX TO APPENDIX B: ANSI/ANS-8.17 CALCULATION FOR MAXIMUM Keff ........... 5-AB-1

34 APPENDIX C: EXAMPLE PROCEDURE FOR SUBCRITICALITY EVALUATION ..............5-C-1

35

36 6. CHEMICAL PROCESS SAFETY ........................................................................................ 6-1

37 6.1 Purpose of Review ....................................................................................................... 6-1

38 6.2 Responsibility for Review ............................................................................................. 6-2

39 6.3 Areas of Review........................................................................................................... 6-2
May 2014 viii NUREG-1520, Revision 2

1 6.4 Acceptance Criteria...................................................................................................... 6-3

2 6.4.1 Regulatory Requirements...................................................................................... 6-3

3 6.4.2 Regulatory Guidance............................................................................................. 6-4

4 6.4.3 Regulatory Acceptance Criteria ............................................................................. 6-4

5 6.5 Review Procedures ...................................................................................................... 6-8

6 6.5.1 Acceptance Review............................................................................................... 6-8

7 6.5.2 Safety Evaluation................................................................................................... 6-9

8 6.6 Evaluation Findings.................................................................................................... 6-10

9 6.7 References................................................................................................................. 6-12

10

11 7. FIRE SAFETY..................................................................................................................... 7-1

12 7.1 Purpose of Review ....................................................................................................... 7-1

13 7.2 Responsibility for Review ............................................................................................. 7-1

14 7.3 Areas of Review........................................................................................................... 7-1

15 7.4 Acceptance Criteria...................................................................................................... 7-2

16 7.4.1 Regulatory Requirements...................................................................................... 7-2

17 7.4.2 Regulatory Guidance............................................................................................. 7-3

18 7.4.3 Regulatory Acceptance Criteria ............................................................................. 7-3

19 7.5 Review Procedures .................................................................................................... 7-10

20 7.5.1 Acceptance Review............................................................................................. 7-10

21 7.5.2 Safety Evaluation................................................................................................. 7-10

22 7.6 Evaluation Findings.................................................................................................... 7-11

23 7.7 References................................................................................................................. 7-13

24

25 8. EMERGENCY MANAGEMENT........................................................................................... 8-1

26 8.1 Purpose of Review ....................................................................................................... 8-1

27 8.2 Responsibility for Review ............................................................................................. 8-1

28 8.3 Areas of Review........................................................................................................... 8-1

29 8.3.1 Emergency Plan .................................................................................................... 8-2

30 8.3.2 Evaluation that No Emergency Plan Is Required ................................................... 8-2

31 8.4 Acceptance Criteria...................................................................................................... 8-3

32 8.4.1 Regulatory Requirements...................................................................................... 8-3

33 8.4.2 Regulatory Guidance............................................................................................. 8-3

34 8.4.3 Regulatory Acceptance Criteria ............................................................................. 8-3

35 8.5 Amendments or Changes to the Emergency Plan ...................................................... 8-15

36 8.6 Review Procedures .................................................................................................... 8-15

37 8.6.1 Acceptance Review............................................................................................. 8-15
May 2014 ix NUREG-1520, Revision 2

1 8.6.2 Safety Evaluation................................................................................................. 8-15

2 8.7 Evaluation Findings.................................................................................................... 8-16

3 8.8 References................................................................................................................. 8-17

4

5 9. ENVIRONMENTAL PROTECTION................................................................................... 9-19

6 9.1 Purpose of Review ..................................................................................................... 9-19

7 9.2 Responsibility for Review ........................................................................................... 9-19

8 9.3 Areas of Review......................................................................................................... 9-19

9 9.3.1 Effluent and Environmental Controls and Monitoring ........................................... 9-20

10 9.3.2 Integrated Safety Analysis Summary................................................................... 9-21

11 9.3.3 Environmental Protection Management Measures............................................... 9-22

12 9.4 Acceptance Criteria.................................................................................................... 9-23

13 9.4.1 Regulatory Requirements.................................................................................... 9-23

14 9.4.2 Regulatory Guidance........................................................................................... 9-23

15 9.4.3 Regulatory Acceptance Criteria ........................................................................... 9-24

16 9.5 Review Procedures .................................................................................................... 9-33

17 9.5.1 Review Procedures ............................................................................................. 9-33

18 9.5.2 Effluent and Environmental Controls and Monitoring ........................................... 9-33

19 9.5.3 Integrated Safety Analysis Summary................................................................... 9-33

20 9.5.4 Management Measures....................................................................................... 9-34

21 9.6 Evaluation Findings.................................................................................................... 9-34

22 9.7 References................................................................................................................. 9-37

23

24 10. DECOMMISSIONING ..................................................................................................... 10-1

25 10.2 Responsibility for Review ......................................................................................... 10-2

26 10.3 Areas of Review....................................................................................................... 10-2

27 10.4 Acceptance Criteria.................................................................................................. 10-2

28 10.4.1 Regulatory Requirements .................................................................................. 10-2

29 10.4.2 Regulatory Guidance......................................................................................... 10-3

30 10.5 Review Procedures .................................................................................................. 10-3

31 10.5.1 Safety Evaluation............................................................................................... 10-4

32 10.6 Evaluation Findings.................................................................................................. 10-4

33 10.7 References............................................................................................................... 10-5

34

35 11. MANAGEMENT MEASURES.......................................................................................... 11-1

36 11.1 Purpose of Review ................................................................................................... 11-1

37 11.2 Responsibility for Review ......................................................................................... 11-1

38 11.3 Areas of Review....................................................................................................... 11-1
May 2014 x NUREG-1520, Revision 2

1 11.4 Acceptance Criteria.................................................................................................. 11-5

2 11.4.1 Regulatory Requirements .............................................................................. 11-5

3 11.4.2 Regulatory Guidance ..................................................................................... 11-6

4 11.4.3 Regulatory Acceptance Criteria...................................................................... 11-6

5 11.5 Review Procedures ................................................................................................ 11-26

6 11.5.1 Acceptance Review ..................................................................................... 11-26

7 11.5.2 Safety Evaluation......................................................................................... 11-26

8 11.5.3 Configuration Management.......................................................................... 11-26

9 11.5.4 Maintenance ................................................................................................ 11-28

10 11.5.5 Training and Qualification ............................................................................ 11-28

11 11.5.6 Procedures .................................................................................................. 11-29

12 11.5.7 Audits and Assessments.............................................................................. 11-29

13 11.5.8 Incident Investigations ................................................................................. 11-29

14 11.5.9 Records Management.................................................................................. 11-30

15 11.5.10 Other Quality Assurance Elements................................................................ 11-30

16 11.6 Evaluation Findings................................................................................................ 11-30

17 11.6.1 Configuration Management.......................................................................... 11-31

18 11.6.2 Maintenance ................................................................................................ 11-33

19 11.6.3 Training and Qualification ............................................................................ 11-33

20 11.6.4 Procedures .................................................................................................. 11-33

21 11.6.5 Audits and Assessments.............................................................................. 11-34

22 11.6.6 Incident Investigations ................................................................................. 11-34

23 11.6.7 Records Management.................................................................................. 11-34

24 11.6.8 Other Quality Assurance Elements .............................................................. 11-34

25 11.7 References............................................................................................................. 11-36

26 APPENDIX A: CHECKLIST FOR PROCEDURES ............................................................11-A-1

27 APPENDIX B: INCIDENT INVESTIGATION PROGRAMS AND PROCEDURES.............. 11-B-1

28 APPENDIX C: RECORDS.................................................................................................11-C-1

29

30 12. MATERIAL CONTROL AND ACCOUNTING................................................................... 12-1

31 12.1 Purpose of Review ................................................................................................... 12-1

32 12.2 Responsibility for Review ......................................................................................... 12-2

33 12.3 Areas of Review....................................................................................................... 12-2

34 12.3.1 Category I Facility.............................................................................................. 12-2

35 12.3.2 Category II Facility............................................................................................. 12-3

36 12.3.3 Category III Fuel Fabrication Facility.................................................................. 12-4

37 12.3.4 Category III Enrichment Facility ......................................................................... 12-5

38 12.4 Acceptance Criteria.................................................................................................. 12-5
May 2014 xi NUREG-1520, Revision 2

1 12.4.1 Category I Facility.............................................................................................. 12-6

2 12.4.2 Category II Facility............................................................................................. 12-6

3 12.4.3 Category III Fuel Fabrication Facility.................................................................. 12-7

4 12.4.4 Category III Enrichment Facility ......................................................................... 12-8

5 12.5 Review Procedures .................................................................................................. 12-8

6 12.5.1 Acceptance Review........................................................................................... 12-8

7 12.5.2 Safeguards Evaluation ...................................................................................... 12-9

8 12.6 Evaluation Findings.................................................................................................. 12-9

9 12.7 References............................................................................................................. 12-10

10

11 13. PHYSICAL PROTECTION.............................................................................................. 13-1

12 13.1 Purpose of Review ................................................................................................... 13-1

13 13.2 Responsibility for Review ......................................................................................... 13-1

14 13.3 Areas of Review....................................................................................................... 13-1

15 13.3.1 Formula Quantity of Strategic Special Nuclear Material..................................... 13-2

16 13.3.2 Moderate Strategic or Low Strategic Special Nuclear Material........................... 13-3

17 13.4 Acceptance Criteria.................................................................................................. 13-3

18 13.4.1 Formula Quantity of Strategic Special Nuclear Material..................................... 13-4

19 13.4.2 Moderate Strategic or Low Strategic Special Nuclear Material........................... 13-5

20 13.5 Review Procedures .................................................................................................. 13-6

21 13.5.1 Acceptance Review........................................................................................... 13-6

22 13.5.2 Safety Evaluation............................................................................................... 13-6

23 13.6 Evaluation Findings.................................................................................................. 13-6

24 13.7 References............................................................................................................... 13-8

May 2014 xiii NUREG-1520, Revision 2

ACRONYMS AND ABBREVIATIONS

1 ACGIH American Conference of Governmental Industrial Hygienists

2

3 AEC active engineered control

4

5 AEGL Acute Exposure Guideline Level

6

7 ALARA as low as is reasonably achievable

8

9 ANS American Nuclear Society

10

11 ANSI American National Standards Institute

12

13 ASME (formerly the American Society of Mechanical Engineers)

14

15 ASTM (formerly the American Society for Testing and Materials)

16

17 B.A. Bachelor of Arts [degree]

18

19 B.S. Bachelor of Science [degree]

20

21 BDC baseline design criterion/criteria

22

23 CAAS criticality accident alarm system

24

25 CD chemical dose

26

27 CFR Code of Federal Regulations

28

29 Ci curie(s)

30

31 CM configuration management

32

33 DFP decommissioning funding plan

34

35 DOE U.S. Department of Energy

36

37 DP decommissioning plan

38

39 EA environmental assessment

40

41 EAL emergency action level

42

43 EIS environmental impact statement

44

45 ERDA Energy Research and Development Administration

46

47 ERPG Emergency Response Planning Guidelines
May 2014 xiv NUREG-1520, Revision 2

1 FCSS Division of Fuel Cycle Safety and Safeguards [in the Office of Nuclear Material Safety 

2 and Safeguards]

3

4 FHA fire-hazards analysis/analyses

5

6 FONSI finding(s) of “no significant impact”

7

8 FR Federal Register

9

10 GBq gigabecquerel(s)

11

12 HFE human-factors engineering

13

14 HPS Health Physics Society

15

16 HS&E health, safety, and environment

17

18 HSI human/systems interface

19

20 ICRP International Commission on Radiological Protection

21

22 IEF initiating-event frequency

23

24 IROFS item(s) relied on for safety

25

26 ISA integrated safety analysis/analyses

27

28 ISO International Organization for Standardization

29

30 kg kilogram(s)

31

32 km kilometer(s)

33

34 MDC minimum detectable concentration

35

36 mg milligram(s)

37

38 mi mile(s)

39

40 MTTF mean time to failure

41

42 MTTR mean time to repair

43

44 NCRP National Council on Radiation Protection and Measurements

45

46 NCS nuclear criticality safety

47

48 NFPA National Fire Protection Association

49

50 NMSS Office of Nuclear Material Safety and Safeguards [in the U.S. Nuclear Regulatory 

51 Commission]
May 2014 xv NUREG-1520, Revision 2

1 NRC U.S. Nuclear Regulatory Commission

2

3 OCB oxide-conversion building

4

5 OER operating-experience review

6

7 ORR operational readiness review

8

9 OSHA Occupational Safety and Health Administration

10

11 PEC passive engineered control

12

13 PFOD probability of failure on demand

14

15 PHA process hazard analysis/analyses

16

17 PM preventive maintenance

18

19 PMF probable maximum flood

20

21 QA quality assurance

22

23 RAI request(s) for additional information

24

25 RD radiological dose

26

27 RWP radiation work permits

28

29 SBC Standard Building Code

30

31 SER safety-evaluation report

32

33 SNM special nuclear material

34

35 SRP standard review plan

36

37 SSE safe-shutdown earthquake

38

39 Sv sievert

40

41 TEDE total effective dose equivalent(s)

42

43 UF6 uranium hexafluoride

44

45 UO2 uranium dioxide

46

47 V&V verification and validation

48

49 yr year(s)

May 2014 xvii NUREG-1520, Revision 2

GLOSSARY

This glossary defines technical/industry terms that are used consistently throughout this 

standard review plan (SRP) or references the related definitions in either Title 10 of the Code of 

Federal Regulations (10 CFR) 20.1003 or 10 CFR 70.4, both titled “Definitions.” This glossary 

does not define terms that may have different connotations in different contexts; such terms are 

defined in the various chapters of this SRP.

Many of these definitions state that they are specifically relevant to nuclear criticality safety. 

Abnormal condition When applied to nuclear criticality safety, an event or 

condition not intended as a desirable or regularly occurring 

condition in the facility or process design, but which is 

anticipated as a contingency in criticality safety evaluations. 

A condition that is reached by exceeding the safety limit(s) 

of one or more controlled parameters.

Accident sequence An unintended sequence of events that, given the failure of 

certain items relied on for safety identified in the sequence, 

would result in environmental contamination, radiation 

exposure, release of radioactive material, inadvertent 

nuclear criticality, or exposure to hazardous chemicals 

(provided that the chemicals are produced from licensed 

radioactive material). The term “accident” may be used 

interchangeably with “accident sequence.”

Active engineered control A physical device that uses active sensors, electrical 

components, or moving parts to maintain safe process 

conditions without any required human action.

Acute (This term is defined in 10 CFR 70.4.)

Administrative control Either an augmented administrative control or a simple 

administrative control, as defined herein. When applied to 

nuclear criticality safety, a human action [comprising either 

simple or augmented administrative controls, as defined 

herein], whether required or prohibited, relied on to prevent 

or mitigate a specific accident sequence or to maintain 

subcriticality, and established in formal plant procedures.
May 2014 xviii NUREG-1520, Revision 2

Analytical limit A limit of measured or calculated variables established by 

the licensee’s safety analysis to ensure that safety limits are 

not exceeded. The safety analysis establishes an analytical 

limit in terms of a measured or calculated variable and a 

specific time after the value is reached to begin protective 

action. The analysis should account for the dynamic and 

transient nature of certain process variables and ensures 

these variables do not exceed the safety limit as a result of 

this transient behavior.

Area(s) of applicability When applied to nuclear criticality safety, the range of 

physical parameters (isotopic abundance, moderation, 

neutron energy, absorbers, etc.) that (1) characterizes a 

fissile material system over which a given calculational 

method has been validated; (2) is covered by the chosen 

benchmark experiments, and (3) for which a bias has been 

determined.

Augmented administrative 

control

A procedurally required or prohibited human action, 

combined with a physical device that alerts the operator that 

the action is needed to maintain safe process conditions or 

that otherwise adds substantial assurance of the required 

human performance.

Available and reliable to 

perform their function when 

needed

(This term is defined in 10 CFR 70.4.)

Baseline design criteria A set of criteria specifying design features and management 

measures that are required and acceptable under certain 

conditions for new processes or facilities specified in 

10 CFR 70.64, “Requirements for New Facilities or New 

Processes at Existing Facilities.” In general, these criteria 

are the acceptance criteria that apply to safety design for 

new facilities and new processes, as described in this SRP.

Benchmark When applied to nuclear criticality safety, a critical 

experiment which is widely accepted and whose physical 

characteristics and their uncertainties have been wellcharacterized, so that it is suitable for validation.

Bias The numerical difference between the calculated and 

experimental values of keff for a set of benchmark 

experiments covering a particular area of applicability (often 

expressed as a function of system parameters).
May 2014 xix NUREG-1520, Revision 2

Concurrent When applied to nuclear criticality safety and in the context 

of double contingency, two changes in process conditions 

are concurrent if the effect of the first change persists until 

the second change occurs. This does not mean 

simultaneous (where both upsets occur at the same time), 

but rather that the system is affected by both changes 

during some time interval.

Configuration management (This term is defined in 10 CFR 70.4.)

Consequence Any result of interest caused by an event or sequence of 

events. In this context, “adverse consequence” refers to

adverse health or safety effects on workers, the public, or 

the environment. When applied to nuclear criticality safety, 

(1) Occurrence of an accidental criticality; (2) the energy 

released in an accidental criticality, normally expressed in 

terms of the number of fissions or dose to workers.

Contingency In the context of double contingency, a change in process 

conditions or loss of a criticality control that could result in 

one or more parameters exceeding their safety limits.

Controlled area (This term is defined in 10 CFR 20.1003.)

Controlled parameter A measurable parameter that is maintained within a 

specified range by one or more specific controls to ensure 

the safety of an operation. When applied to nuclear

criticality safety, is a parameter of a system that is 

maintained within a specified range to ensure subcriticality.

Credible abnormal condition As used in meeting the requirements of 10 CFR 70.61(d), 

one of the spectrum of abnormal conditions resulting from 

credible single failures and related sequences of events, up 

to those that must be considered in the context of 

demonstrating compliance with the double-contingency 

principle (see Appendix 5-A for more information).

Critical (1) Having an actual keff value ≥ 1; (2) Having a calculated

keff value ≥ the Upper Subcritical Limit.

Critical mass A quantity of fissionable material capable of supporting a 

self-sustained nuclear chain reaction; sometimes, the 

minimum quantity of such material given spherical 

geometry, optimum moderation, and full water reflection 

(also referred to as the minimum critical mass).

Critical mass of special nuclear 

material

(This term is defined in 10 CFR 70.4.)
May 2014 xx NUREG-1520, Revision 2

Criticality control When applied to nuclear criticality safety, a control used to 

ensure subcriticality.

Criticality safety evaluation When applied to nuclear criticality safety, a structured 

analysis demonstrating criticality safety for a given process, 

including a demonstration that processes will be subcritical 

under normal and credible abnormal conditions, and the 

specification of controls and limits to achieve that goal (also 

often referred to as a nuclear criticality safety evaluation, 

analysis, assessment, etc.).

Degraded When applied to nuclear criticality safety, a control, control 

system, or controlled parameter is considered to be 

degraded when the parameter is kept within its safety limits

but its reliability and availability has been reduced in such a 

way that it is no longer unlikely that those limits will be

exceeded.

Double-contingency principle When applied to nuclear criticality safety , process designs 

should incorporate sufficient factors of safety to require at 

least two unlikely, independent, and concurrent changes in 

process conditions before a criticality accident is possible.

Double-contingency protection A characteristic or attribute of a process that has 

incorporated sufficient safety factors so that at least two 

unlikely, independent, and concurrent changes in process 

conditions are required before a nuclear criticality accident is 

possible. The condition of requiring at least two unlikely, 

independent, and concurrent changes in process conditions 

before a criticality accident is possible.

Engineered control (See “active engineered control” and “passive engineered 

control.”)

Event (1) A change in process conditions that has the potential to 

adversely affect safety; (2) one of several occurrences that 

constitute an accident sequence.

External event An event for which the likelihood cannot be altered by 

changes to the regulated facility or its operation. This would 

include all natural phenomena events, plus airplane 

crashes, explosions, toxic releases, fires, etc., occurring 

near or on the plant site.
May 2014 xxi NUREG-1520, Revision 2

Favorable geometry Characteristic of structures, systems, devices, or equipment 

such that fissile material maintained within specified 

dimensions will be subcritical under the most reactive 

credible conditions (defined for a given isotopic composition 

and physicochemical form).

Hazardous chemicals produced 

from licensed materials

(This term is defined in 10 CFR 70.4.)

Independent In the context of double contingency, two changes in 

process conditions are considered independent if the 

occurrence of one does not cause, or affect the probability 

of occurrence of, the other; if the probability that both occur 

is independent of the order in which they occur; and if there 

are no identifiable common-mode failures that can lead to 

criticality.

Integrated safety analysis (This term is defined in 10 CFR 70.4.)

Integrated safety analysis 

summary

(This term is defined in 10 CFR 70.4.)

Isolated Describes (1) the condition whereby the flow of matter and 

energy between a system and surrounding systems can be 

neglected for the purpose of performing a safety analysis or

(2) the condition of being separated by a sufficient distance 

from other systems or materials that their presence has a 

negligible effect on the system’s keff.

Items relied on for safety This item is defined in 10 CFR 70.4

keff The effective neutron multiplication factor of a nuclear 

fission reaction; that is, the average number of neutrons 

from each fission that cause another fission.

Lost When applied to nuclear criticality safety, a control, control 

system, or controlled parameter is considered to be lost

when the measures that keep the parameters within their 

safety limits cease to function as designed, or cannot be 

verified to function as designed, whether or not the affected 

parameters actually exceed their safety limits.

Management measures (This term is defined in 10 CFR 70.4.)

Margin of safety When applied to nuclear criticality safety, the difference 

between the actual value of a parameter and the value of 

the parameter at which the system is expected to be critical 

(taking bias and bias uncertainty into account).
May 2014 xxii NUREG-1520, Revision 2

Margin of subcriticality (1) The difference between the actual value of keff and the 

value at which the system is expected to be critical (taking 

bias and bias uncertainty into account); (2) the difference 

between the calculated value of keff (including uncertainties) 

and the value at which the system is expected to be critical 

(taking bias and bias uncertainty into account), plus any 

margin in keff resulting from conservative modeling of system 

parameters.

[Approved] margin of 

subcriticality for safety

The minimum allowable value of the margin of subcriticality, 

including the minimum margin of subcriticality and any 

margin resulting from conservative modeling practices.

Minimum margin of subcriticality Margin in keff beyond the bias and uncertainty in the bias, to 

allow for any unknown or difficult-to-quantify uncertainties in 

calculating keff (frequently referred to as the arbitrary margin

or administrative margin).

Mitigative control A control intended to reduce the consequences of an 

accident sequence, not to prevent it. When a mitigative 

control works as intended, the results of the sequence are 

called the mitigated consequences.

Natural-phenomenon events Earthquakes, floods, tornadoes, tsunamis, hurricanes, and 

other events that occur in the natural environment and could 

adversely affect safety. Natural-phenomenon events may 

be credible or incredible, depending on their likelihood of 

occurrence.

New processes at existing 

facilities

Systems-level or facility-level design changes to process 

equipment, process technology, facility layout, or types of 

licensed material possessed or used. Generally, this 

definition does not include component-level design changes 

or equipment replacement.

Normal condition A condition specifically anticipated or allowed for as part of 

the normal operation of the facility. A condition in which all 

controlled parameters are within their safety limits.

Nuclear criticality safety An approach to a facility’s design, operation, and other 

activities that is chiefly concerned with preventing the 

occurrence of events involving an inadvertent and 

self-sustaining nuclear chain reaction.

Operating limit A limiting value (or range of values) for a process parameter 

at which the plant operators normally operate the facility.

Optimum When applied to nuclear criticality safety, the value of a 

parameter that produces the highest keff.
May 2014 xxiii NUREG-1520, Revision 2

Parameter When applied to nuclear criticality safety, a measurable or 

observable characteristic of a system that affects the value 

of keff. The parameters normally are mass, geometry, 

density, enrichment/isotopics, reflection, moderation, 

concentration, interaction, absorption, volume, 

heterogeneity, physicochemical form, and process variables.

Passive engineered control A device that uses only fixed physical design features to 

maintain safe process conditions without any required 

human action.

Preventive control A control intended to prevent an accident (i.e., any of the 

radiological or chemical consequences described in 

10 CFR 70.61, “Performance Requirements”).

Process condition In the context of double contingency, the set of all 

characteristics or attributes of a process important to safety 

(a change in the value of a parameter, or loss or 

degradation of a control affecting the ability to maintain a 

parameter, etc.).

Reactivity Loosely used synonymously with keff. The adjective form 

reactive is used most frequently in the phrase most reactive 

credible to mean the physical conditions that produce the 

highest credible value of keff.

Safe mass The quantity of fissile material that is safely subcritical under 

the most reactive credible conditions (defined for a given 

isotopic composition and physicochemical form), including 

allowance for overbatching.

Safe process conditions The defined ranges or sets of acceptable values of one or 

more controlled parameters.

Safety control A system, device, or procedure that is intended to regulate a 

device, process, or human activity in order to maintain a 

safe state. Controls may be engineered controls or 

administrative (procedural) controls, and they may be either 

preventive or mitigative, as defined herein.

Safety limit A limit chosen to maintain the integrity of physical barriers 

that protect against exceeding the performance 

requirements of 10 CFR 70.61. When applied to nuclear 

criticality safety, the safety limit is the value of a controlled 

parameter established by a criticality safety evaluation to 

which the process will be controlled. This can be equal to 

the subcritical limit, but can include additional margin 

because of uncertainty and variability in the process (also 

referred to as the “analytical limit”).
May 2014 xxiv NUREG-1520, Revision 2

Safety margin Same as margin of safety.

Setpoint A predetermined value for actuation of the final setpoint 

device to initiate a protective action.

Simple administrative control A procedural human action that is prohibited or required to 

maintain safe process conditions.

Subcritical Demonstrated not to be critical; having a value of keff no 

greater than the upper subcritical limit.

Subcritical limit (1) The bounding value of a controlled parameter that has 

been demonstrated to maintain a system subcritical in plant 

criticality safety evaluations; (2) the upper subcritical limit.

Subcritical margin Same as margin of subcriticality.

System When applied to nuclear criticality safety, discrete part of a 

fissile material operation that can be separated from other 

systems for the purpose of conducting a safety analysis, and 

that is the subject of a criticality safety evaluation.

Unacceptable performance 

deficiencies

(This term is defined in 10 CFR 70.4.)

Upper subcritical limit The maximum value of keff that is considered to be 

subcritical with an acceptable degree of confidence (taking 

bias and bias uncertainty into account, and including a 

minimum margin of subcriticality).

Worker (This term is defined in 10 CFR 70.4.)
May 2014 1 NUREG-1520, Revision 2

INTRODUCTION

1 NUREG-1520, “Standard Review Plan (SRP) for the Review of a License Application for a Fuel 

2 Cycle Facility” (hereinafter referred to as the SRP), provides U.S. Nuclear Regulatory 

3 Commission (NRC) guidance for reviewing and evaluating the health, safety, and environmental 

4 protection aspects of applications for licenses to possess and use special nuclear material 

5 (SNM) to produce nuclear reactor fuel. This guidance is specific to fuel cycle facilities regulated 

6 under Title 10, “Energy,” of the Code of Federal Regulations (10 CFR) Part 70, “Domestic 

7 Licensing of Special Nuclear Material”; that is, facilities that are authorized for or are seeking a 

8 license to possess and use more than a critical mass of SNM. This guidance also applies to the 

9 review and evaluation of proposed amendments and license renewal applications for nuclear 

fuel cycle facilities. This guidance does not apply to conversion facilities,

1 10 gaseous diffusion 

plants,

2 reprocessing facilities, or plutonium processing facilities.3 11

12

13 The principal purpose of this SRP is to ensure the quality and uniformity of reviews conducted 

14 by the staff of the NRC’s Office of Nuclear Material Safety and Safeguards (NMSS). This SRP 

15 also provides a well-defined foundation from which to evaluate proposed changes in the scope, 

16 level of detail, and acceptance criteria of reviews. It also provides information and guidance to 

17 assist the licensing staff and the applicant in understanding the underlying objectives of the 

18 regulatory requirements, the relationships among NRC requirements, the licensing process, the 

19 major guidance documents that the NRC staff has prepared for licensing fuel cycle facilities, and 

20 information about aspects of the staff review process set out in individual SRP sections. 

21 Another important purpose of this SRP is to make information about regulatory reviews widely 

22 available and to improve communication and understanding of the staff review process. In 

23 addition, because this SRP describes the scope, level of detail, and acceptance criteria for 

24 reviews, it contains regulatory guidance for applicants who need to determine what information 

25 to present in a license application and related documents. This SRP does not preclude 

26 licensees or applicants from suggesting alternative approaches to those specified in the SRP to 

27 demonstrate compliance with applicable regulations.

28

29 This SRP addresses the longstanding health, safety, and environmental-protection 

30 requirements of 10 CFR Part 20, “Standards for Protection against Radiation,” and 10 CFR 

31 Part 70, as well as the accident safety requirements reflected in Subpart H, “Additional 

32 Requirements for Certain Licensees Authorized To Possess a Critical Mass of Special Nuclear 

33 Material,” of 10 CFR Part 70. The NRC review criteria applicable to the safeguards sections of 

34 license applications are published in NUREG-1280, “Standard Format and Content Acceptance 

35 Criteria for the Material Control and Accounting (MC&A) Reform Amendment: 10 CFR Part 74, 

36 Subpart E,” issued April 1995 (for high-enriched uranium facilities), and NUREG-1065, 

37 “Acceptable Standard Format and Content for the Fundamental Nuclear Material Control 

38 (FNMC) Plan Required for Low-Enriched Uranium Facilities,” issued December 1995.

 1 The NRC regulates conversion facilities under the provisions of 10 CFR Part 40, “Domestic Licensing of 

Source Material.” 2 The NRC regulates gaseous diffusion plants under 10 CFR Part 76, “Certification of Gaseous Diffusion 

Plants.” This regulation specifically applies to those portions of the Portsmouth and Paducah Gaseous 

Diffusion Plants located in Piketon, OH, and Paducah, KY, respectively, that are leased by the United States

Enrichment Corporation. 3 Guidance for the review of a license application for a Mixed Oxide (MOX) Fuel Fabrication Facility is 

provided in NUREG-1718, “Standard Review Plan for the Review of a License Application for a MOX Fuel 

Fabrication Facility,” issued August 2000.
May 2014 2 NUREG-1520, Revision 2

1 Subpart H of 10 CFR Part 70 identifies risk-informed performance requirements and requires 

2 applicants and existing licensees to conduct an integrated safety analysis (ISA) and submit an 

3 ISA Summary, as well as other information. Specific requirements for ISA Summaries are 

4 described in 10 CFR 70.65, “Additional Contents of Applications.” For new facilities that have 

5 not already been designed, built, licensed and operated, Subpart H also requires adherence to 

6 baseline design criteria, as specified in 10 CFR 70.64, “Requirements for New Facilities or New 

7 Processes at Existing Facilities.”

8

9 In reviewing a license application, renewal application, or license amendment for a fuel cycle 

10 facility, the staff must determine whether there is reasonable assurance that the facility can and 

11 will be operated in a manner that will not be inimical to the common defense and security and 

12 will adequately protect the health and safety of workers, the public, and the environment. The 

13 staff uses a “reasonable assurance” paradigm and focuses on the programmatic provisions of 

14 the applicant’s proposed activities. To carry out this responsibility, the staff focuses on the 

15 descriptive commitments of the safety program in the license application and the description of 

16 processes, hazards, controls, and management measures in its ISA Summary and onsite ISA 

17 documentation. The staff evaluates the information that the applicant provides and, through 

18 independent assessments, determines whether the applicant has proposed an adequate safety 

19 program that is compliant with regulatory requirements. To assist the staff in carrying out this 

20 responsibility, this SRP clearly states and identifies those standards, criteria, and bases that the 

21 staff will use in reaching licensing decisions.

22

23 An application for a 10 CFR Part 70 license must satisfy the requirements described in 

24 10 CFR 70.22, “Contents of Application,” including specific information on the proposed 

25 equipment and facility in accordance with 10 CFR 70.22(a)(7), which states that each 

26 application shall contain the following:

27

28 A description of equipment and facilities which will be used by the applicant to 

29 protect health and minimize danger to life or property (such as handling devices, 

30 working areas, shields, measuring and monitoring instruments, devices for the 

31 disposal of radioactive effluents and wastes, storage facilities, criticality accident 

32 alarm systems, etc.).

33

34 Consequently, the licensing decision is ultimately based on information with a sufficient level of 

35 detail that permits reviewers to understand process system functions and, functionally, how 

36 items relied on for safety (IROFS) can perform as intended and be reliable. This staff review 

37 method is intended to ensure that the staff decision is based on a reasonable assurance that 

38 the submitted ISA Summary is complete, that the licensee will comply with the ISA and maintain

39 it consistent with the regulations, and that the applicant’s programs will be adequate to design 

40 and operate a facility that complies with all applicable regulations and provides for adequate 

41 protection of public health and safety. For new facilities or new processes at existing facilities, 

42 there may not be complete detail or a final design available at the time of licensing. However, 

43 sufficient information must be available to permit the staff to understand the theory of operation 

44 and function of each IROFS, to have reasonable assurance that all credible accident sequences 

45 have been identified, that a sufficient set of IROFS has been defined, and that management 

46 measures will be sufficient to ensure IROFS will be available and reliable to perform their 

47 intended functions in the context of 10 CFR 70.61, “Performance Requirements.”
May 2014 3 NUREG-1520, Revision 2

1 For uranium enrichment facilities, to ensure that the applicant’s programs have been sufficiently

2 implemented and commitments have been properly applied in the final facility design and in the

3 constructed facility, 10 CFR 70.32(k) states:

4

5 No person may commence operation of a uranium enrichment facility until the

6 Commission verifies through inspection that the facility has been constructed in

7 accordance with the requirements of the license.

8

9 This requirement applied through inspections, and not by licensing reviews, will ensure that the

10 programmatic commitments made by licensee are properly applied in the as built facility. This

11 inspection is intended to inspect the final design of the facility and the procedures that have

12 been prepared to implement the licensee’s commitments that are reflected in the license. 

13 Furthermore, for significant modifications to existing fuel cycle facilities, such as the licensing 

14 and construction of new processes, the staff may impose a license condition that specifies that 

15 an operational readiness review (ORR) inspection be conducted before operation to verify that 

16 the new part of the facility has been constructed in accordance with the requirements of the 

17 license. To facilitate the planning and accomplishment of a risk-informed ORR, the staff relies 

18 upon the licensee to provide a complete set of information. This complete set of information has 

been referred to in some projects as IROFS boundary packages.4 19 For simplicity they will be 

20 referred to hereinafter in this document as IROFS boundary packages. Regardless of what they 

21 are called in a license application, the key point is that they provide information to the reviewers 

22 and inspectors about supporting systems that directly affect the effectiveness of the IROFS and 

23 the reliability and availability of the IROFS as required by 10 CFR 70.62(d). Inspectors use this

24 information during the ORR inspection to determine if the licensee meets the requirements in 

25 10 CFR 70.23(a)(3)–(4) and in 10 CFR 70.61(e).

26

27 In developing the performance requirements in 10 CFR Part 70, the NRC anticipated that, in the 

28 future, changes would be made to the facility design and processes and, therefore, described a

29 process for addressing these changes is described in 10 CFR 70.72, “Facility Changes and 

30 Change Processes.” For a uranium enrichment facility, the licensee may make changes to its 

 4 IROFS boundary packages are documents that contain the physical descriptions and parameters of 

structures, systems, and components that are used to meet the performance requirements of 10 CFR 70.61. 

IROFS boundary definition packages are also prepared for administrative procedures or worker actions that

are defined as IROFS. The boundary packages identify the specific functions to be performed by an IROFS 

and identify any items that may affect the function of the IROFS. The boundary packages also identify the 

facility areas in which the IROFS is used, its design and functional attributes, management measures related 

to it, any open items about it, and its supporting documentation (e.g., piping and instrumentation diagrams 

and schematics).

Design and functional attributes should include safety functions such as separation from other IROFS,

redundancy and diversity, fail-safe design, set points, environmental qualification, seismic qualification, and 

fire protection. System interfaces such as instrumentation, electrical, cooling, and lubrication requirements

should also be included under design and functional attributes.

Management measures should address all of the management measures required to be applied to IROFS 

under 10 CFR 70.4, “Definitions,” and should include summary descriptions; references to maintenance, 

training, and procedures documents; or both, as appropriate for the IROFS. The references should be 

adequate to identify the actual working-level training or procedures document.

Open items that affect the reliability, the effectiveness, or both of the IROFS should be closed by the time of 

the ORR. The open items section should identify open items associated with the IROFS during the review 

and describe how the open items were resolved.
May 2014 4 NUREG-1520, Revision 2

1 design, after receiving its license, during the construction phase, and after operations begin. 

2 These changes, therefore, need to be submitted and reviewed in accordance with 

3 10 CFR 70.72.

4

5 The requirements in 10 CFR 70.22; 10 CFR 70.23, “Requirements for the Approval of 

6 Applications”; and Subpart H to 10 CFR Part 70 specify, in general terms, the information to be 

7 supplied in a safety program description. As such, this SRP identifies the specific information 

8 that an applicant should submit for staff evaluation. Prospective applicants should study the

9 topic areas treated in this SRP and the sections within each chapter (particularly those 

10 regarding areas of review and acceptance criteria). To facilitate the staff’s review, a license 

11 application should contain a safety program description that addresses the contents of this SRP 

12 in the same order as presented in this document. Applicants may reference material submitted 

13 in one location in a license application at another location to avoid unnecessary duplication. In 

14 addition, 10 CFR 70.61 requires each applicant to evaluate, in an ISA performed in accordance 

15 with 10 CFR 70.62, “Safety Program and Integrated Safety Analysis,” its compliance with the 

16 performance requirements in 10 CFR 70.61(b), 10 CFR 70.61(c), and 10 CFR 70.61(d).

17

18 Based on the information in the ISA Summary provided in accordance with 10 CFR 70.65, the 

19 NRC makes licensing decisions as required under 10 CFR 70.21, “Filing”; 10 CFR 70.22;

20 10 CFR 70.23; and 10 CFR 70.60, “Applicability,” through 10 CFR 70.66, “Additional 

21 Requirements for Approval of License Application.” These decisions include compliance with 

22 the performance requirements, the baseline design criteria, defense in depth, and the adequacy 

23 of management measures. Staff analyses are intended to provide regulatory confirmation of 

24 reasonable assurance of safe design and operation. A staff determination of reasonable 

25 assurance leads to a decision to issue or renew a license or to approve an amendment. If the 

26 staff determines that an application contains inadequate descriptions or commitments, the staff 

27 will inform the applicant of what is needed and the basis on which the determination was made.

28

29 An applicant should tailor its safety program to the particular features of its facility. If an 

30 applicant chooses approaches other than those presented in this SRP, the applicant should 

31 identify the portions of its license application that differ from the design approaches and 

32 acceptance criteria of the SRP and should document how the proposed alternatives provide an 

33 acceptable method of complying with the Commission's regulations. The staff retains the 

34 responsibility to make an independent determination concerning the adequacy of the applicant’s

35 proposed approaches.

36

37 Each SRP chapter is structured as follows:

38

39 Purpose of Review

40

41 This section presents a brief statement of the purpose and objectives of reviewing the subject 

42 areas. It emphasizes the staff’s evaluation of the ways in which the applicant will achieve 

43 identified performance objectives and ensures (through the review) that the applicant has used 

44 a multidisciplinary, systems-oriented approach to establish designs, controls, and procedures 

45 within individual technical areas.

46 Responsibility for Review

47

48 This section identifies the NRC organization and individuals (by function) who are responsible 

49 for evaluating the specific subject or functional area. In general, the licensing project manager 

50 has responsibility for the total review product, which is referred to as a safety evaluation report 
May 2014 5 NUREG-1520, Revision 2

1 (SER). However, an identified technical specialist will have primary responsibility for a particular 

2 review topic (usually an SRP chapter) and one or more specialists may have supporting 

3 responsibility.

4

5 Areas of Review

6

7 This section describes the topics, functions, systems, components, analyses, applicant 

8 commitments, data, or other information that should be reviewed as part of the given subject 

9 area of the license application. Because this section identifies information to be reviewed in 

10 evaluating the adequacy of the application, it identifies the acceptable content of an applicant's 

11 submittal in the areas discussed.

12

13 The topics identified in this section also set the content of the next two sections of the SRP, 

14 covering the acceptance criteria and review procedures. Applications should address, in the 

15 same order, the topics set forth as areas of review.

16

17 Acceptance Criteria

18

19 This section defines a set of applicable NRC acceptance criteria on the basis of regulatory 

20 requirements, and these collectively establish the basis for assessing the acceptability of the 

21 applicant’s commitments relative to the design, programs, or functions within the scope of the 

22 particular SRP section. Technical bases consist of specific criteria, such as NRC regulations, 

23 regulatory guides, NUREG reports, and industry codes and standards. As such, the acceptance 

24 criteria present positions and approaches that are acceptable to the staff. As noted above, the 

25 NRC does not consider them to be the only acceptable positions or approaches, and the 

26 applicant may propose others.

27

28 The requirements for approval of an application are listed in 10 CFR 70.23(a)(1) through (12). 

29 As a technical matter, NMSS will determine how final the design must be to make this finding. 

30 The NRC staff will interpret applicant commitments to follow an industry standard as a 

31 commitment to adhere to all “shall” statements in the standard. The staff will not consider 

32 suggestions and recommendations in the standards (so-called “should” statements) as binding 

33 commitments by the applicant, unless the applicant specifically states an intent to treat the 

34 “should” statements as binding commitments (i.e., to treat them as if they are “shall” 

35 statements). The applicant may make such commitments as part of its description of the safety 

36 program basis. If the staff finds that a definitive commitment to a “should” statement is 

37 necessary to provide adequate protection, the reviewer will raise this as an issue in any request 

38 for additional information on specific licensing actions. However, applicants should note that 

39 some industry or consensus standards specifically direct users to provide justifications for not 

40 abiding by recommendations contained in the standards. For example, American National 

41 Standards Institute/American Nuclear Society Standard 8.1, “Nuclear Criticality Safety in 

42 Operations with Fissionable Materials Outside Reactors,” states that “when recommendations 

43 are not implemented, justification shall be provided,” thus effectively mixing “should” and “shall” 

44 statements. In such instances, applicants should be prepared to justify any decisions not to 

45 abide by recommendations contained in the standards.

46 Review Procedures

47

48 This section describes procedures that the reviewer should follow to achieve an acceptable 

49 scope and depth of review and to obtain reasonable assurance that the applicant has provided 

50 appropriate commitments to ensure that it will operate the facility safely. This could include 
May 2014 6 NUREG-1520, Revision 2

1 identifying which licensee commitments the reviewer needs to verify, and could include directing 

2 the reviewer to coordinate with others having review responsibilities for other portions of the 

3 application than those assigned to the reviewer. This section should provide whatever 

4 procedural guidance is necessary to evaluate the applicant’s level of achievement of the 

5 acceptance criteria.

6

7 Evaluation Findings

8

9 This section presents the type of positive conclusion that is sought, for the particular review 

10 area, to support a decision to grant a license or amendment. The review must be adequate to 

11 permit the reviewer to support this conclusion. For each section, the staff SER publishing the 

12 results of the review will include a conclusion of this type. The SER will also contain a 

13 description of the review, including aspects that received special emphasis, matters that the 

14 applicant modified during the review, matters that require additional information or will be 

15 resolved in the future, aspects where the facility’s design or the applicant’s proposals deviate 

16 from the criteria in the SRP, and the bases for any deviations from the SRP or proposed 

17 exemptions from the regulations.

18

19 In the SER, the staff may recommend license conditions to address any issues that were not 

20 previously resolved by an applicant’s commitments. Such conditions are discussed with an 

21 applicant before issuing the license (or license amendment) and become commitments to 

22 performance in addition to those commitments that the applicant presented in the application.

23

24 References

25

26 This section lists references that the staff should consult during the review process. However, 

27 depending on the action and approaches proposed by the applicant, they may not always be 

28 relevant to the review.
May 2014 1-1 NUREG-1520, Revision 2

1. GENERAL INFORMATION

1 1.1 Facility and Process Overview

2

3 1.1.1 Purpose of Review 

4

5 The purpose of this review is to ascertain whether an application for a new, renewed, or 

6 amended license includes an overview of the facility layout and a summary description of its 

7 manufacturing processes. All reviewers, U.S. Nuclear Regulatory Commission (NRC) 

8 managers, and the public may use this overview to gain a general understanding of the purpose 

9 of the facility and an overview of the design of its processes. The integrated safety analysis 

10 (ISA) summary describes the facility and its manufacturing processes in more detail.

11

12 1.1.2 Responsibility for Review 

13

14 Primary: Licensing Project Manager

15

16 Secondary: ISA Reviewer, Environmental Reviewer, Emergency Protection Reviewer, other 

17 Technical Reviewers

18

19 Supporting: None

20

21 1.1.3 Areas of Review

22

23 The staff should review the general facility and process descriptions provided in the license 

24 application. The areas of review should include the following:

25

26 1. Facility Layout Description—This area includes a description of the purpose of each 

27 feature and the interrelationships between features.

28

29 2. Process Overview—The process description should be a narrative description of the 

30 different processes at the facility involving licensed material.

31

32 3. Site Overview—The description includes the proximity of facility buildings to the site 

33 boundary and nearby populations, including the most recent census data available when 

34 the license application was submitted.

35

36 4. Descriptive Summary of Licensed Material—The summary should include the name, 

37 amount, and specification (including chemical and physical forms) of the special nuclear 

38 material (SNM). The license application also should include a list of raw materials, 

39 byproducts, wastes, moderators, and finished products of the facility. 

40

41 The facility and process description in the license application must be consistent with the 

42 information presented in the ISA summary and in Chapter 8, which addresses emergency 

43 management, of this standard review plan (SRP).
May 2014 1-2 NUREG-1520, Revision 2

1

2 Review Interfaces

3

4 In addition to the general information in the application, the reviewer should examine information 

5 in the following areas to ensure that it is consistent with the general information section in the 

6 license application:

7

8 • information about the facility and site and the different processes that will involve SNM in 

9 Chapter 3 of this SRP

10

11 • the facility and process descriptions in Chapter 8 of this SRP

12

13 1.1.4 Acceptance Criteria

14

15 1.1.4.1 Regulatory Requirements 

16

17 The regulations applicable to the areas of review in this SRP are Title 10, “Energy,” of the Code 

18 of Federal Regulations (10 CFR) 70.22, “Contents of Applications,” and 10 CFR 70.65(b)(1) 

19 and (2).

20

21 1.1.4.2 Regulatory Guidance

22

23 No regulatory guides apply to a general facility description for a fuel cycle facility.

24

25 1.1.4.3 Regulatory Acceptance Criteria

26

27 The reviewer should find the applicant’s general information acceptable if it provides reasonable 

28 assurance that the acceptance criteria presented below are adequately addressed and satisfied.

29

30 1.1.4.3.1 Facility Layout Description

31

32 The applicant’s overview of the facility is acceptable if it meets the following conditions:

33

34 1. The application presents information at a level of detail that is appropriate for general 

35 familiarization with and understanding of the proposed facility. This information should 

3637 be consistent with that presented in the ISA summary but may be less detailed.

38

39 2. The overview should describe the relationship of specific facility features to the major 

40 processes that will be ongoing at the facility.

41

42 3. This description should include the building locations of major process components; 

43 drawings illustrating the layout of the buildings and structures within the controlled area 

44 boundary should be used to support the description.

45

46 4. If applicable, the applicant has marked portions of the application to identify any 

47 proprietary or sensitive information related to the facility (e.g., the location of certain 

48 enrichment processes).
May 2014 1-3 NUREG-1520, Revision 2

1 1.1.4.3.2 Process Overview

2

3 The process overview is acceptable if it summarizes the major chemical or mechanical 

4 processes involving licensable quantities of radioactive material based, in part, on information 

5 presented in the ISA summary. This description should include the building locations of major 

6 process components and brief accounts of the process steps.

7

8 1.1.4.3.3 Site Overview

9

10 The license application summarizes the site information contained in the ISA summary. This 

11 includes descriptions of the overall facility layout and the drawings to support such descriptions. 

12 The license application describes the site’s geographical characteristics and facility structural 

13 features (such as buildings, towers, and tanks), transportation rights of way, and proximity to 

14 nearby populations. The license application fully describes the facility location. These 

15 descriptions are consistent with the information in Chapter 8 of this SRP.

16

17 If applicable, the applicant has portion-marked the application to identify any proprietary or 

18 sensitive information (e.g., the location of the controlled area boundary).

19

20 1.1.4.3.4 Descriptive Summary of Licensed Material

21

22 The summary is acceptable if it includes the following:

23

24 1. The summary should describe chemical and physical forms of SNM in process; the 

25 maximum amounts of SNM in process in various building locations; and the types, 

26 amounts, and discharge points of waste materials discharged to the environment from 

27 the processes.

28

29 2. The application presents a summary identification of the raw materials byproducts, 

30 wastes, and finished products of the facility. This information should include data on 

31 expected levels of trace impurities or contaminants (particularly fission products or 

32 transuranic elements) characterized by identity and concentration. In addition, this 

33 summary should identify the proposed possession at the facility of any moderator or 

34 reflector with special characteristics, such as beryllium or graphite.

35

36 3. If applicable, the applicant has marked portions of the application to identify any 

37 proprietary or sensitive information (e.g., possession limits).

38

39 1.1.5 Review Procedures

40

41 1.1.5.1 Acceptance Review

42

43 During the NRC staff’s acceptance review, the staff should screen the submittals to identify 

44 major deficiencies in the information provided in each review area in Section 1.1.3. Reviewers 

45 must decide whether they have enough information to proceed with a detailed technical review. 

46 Less significant errors or deficiencies that can be addressed in a request for additional 

47 information should be accepted. However, before the NRC performs a detailed review, the 

48 applicant should correct major deficiencies that would require several requests for additional 

49 information to resolve.
May 2014 1-4 NUREG-1520, Revision 2

1 Reviewers should record whether each area of review is adequately addressed in the 

2 application, is adequately addressed in a referenced document, is not applicable to the 

3 application, or has a major deficiency.

4

5 1.1.5.2 Safety Evaluation

6

7 The information submitted by the applicant in this section is informational in nature and no 

8 technical analysis is required. In addition, the reviewers use the information in this section only 

9 as background for the more detailed descriptions in later sections of the application. Therefore, 

10 the primary reviewer ascertains whether the descriptive information presented is consistent with 

11 the information presented in the ISA summary and the emergency management plan. During 

12 the initial review, the reviewer should draft the safety evaluation report (SER) described below. 

13 A request for additional information (RAI) will be prepared when clarification and additional 

14 information are needed to determine whether the licensee’s submittals comply with the 

15 regulations. The primary reviewer should coordinate with the licensing project manager in 

16 preparing RAIs. Additional information submitted by the applicant will be evaluated and a final 

17 SER will be provided to the licensing project manager.

18

19 1.1.6 Evaluation Findings

20

21 The regulations in 10 CFR 70.23, “Requirements for the Approval of Applications,” and

22 10 CFR 70.66, “Additional Requirements for Approval of License Application,” state that an 

23 application for a license will be approved if the Commission can make the general findings listed 

24 in those sections. The basis for the general findings is an evaluation of whether the application 

25 adequately addresses all of the applicable regulatory requirements. More specifically, the staff’s 

26 evaluation should determine whether the licensing submittals provide sufficient information to 

27 satisfy the regulatory requirements listed in Section 1.1.4.1 of this SRP and whether the 

28 applicant has appropriately addressed the regulatory acceptance criteria in SRP 

29 Section 1.1.4.3. The SER should state how the applicable regulatory requirements have or 

30 have not been met based on the acceptance criteria described in this chapter of the SRP. If the 

31 applicant chooses to use an alternative approach, the reviewer should discuss in the SER 

32 whether the proposed approach satisfies the applicable regulatory requirements. The reviewers 

33 should use the following approach to document their evaluation:

34

35 1. State a specific regulatory requirement that applies to the application. Detailed 

36 acceptance criteria may be included where appropriate or necessary to clarify the 

37 requirement.

38

39 2. Identify the areas where the regulatory requirement is addressed in the application, 

40 including the areas where the specific acceptance criteria described in this SRP are 

41 addressed.

42

43 3. Describe your evaluation of the application, the basis for your conclusion, and whether 

44 the application meets the regulatory requirement.

45

46 4. Repeat these steps for every regulatory requirement that applies to the application.

47

48 There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

49 application or amendment request, (2) denial of the application or request, or (3) approval with 

50 conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 
May 2014 1-5 NUREG-1520, Revision 2

1 reviewer may consider proposing a license condition. Absent an NRC Order, license conditions 

2 must be agreed upon with the licensee or applicant before becoming part of the license. 

3 A license condition should only be proposed if there is reasonable assurance that, if the 

4 licensee meets the condition, all regulatory requirements will be satisfied. Thus, license 

5 conditions should not be used to cover major deficiencies in an application. License conditions 

6 should be unambiguous, inspectable, and enforceable. They should only require those actions 

7 necessary to ensure compliance with applicable regulations. The basis for license conditions 

8 must be documented in the SER.

9

10 The report should include a statement, summarizing what was reviewed and why the reviewer 

11 finds the submittal acceptable, such as the following:

12

13 The staff has reviewed the general facility description for [name of facility] 

14 according to Section 1.1 of the Standard Review Plan. [Name of facility] has 

15 adequately described (1) the facility and its processes so that the staff has an 

16 overall understanding of the relationships of the facility features and (2) the 

17 function of each feature. [Name of facility] has cross-referenced its general 

18 description with the more detailed descriptions elsewhere in the application. The 

19 staff also confirmed that the information provided in the license application is 

20 consistent with the ISA summary and the emergency management plan. 

21 Therefore, the NRC staff concludes that [name of facility] has complied with the 

22 general requirements of 10 CFR 70.22, “Contents of Applications,” and 

23 10 CFR 70.65(b)(1) and (2), as applicable to this section.
May 2014 1-6 NUREG-1520, Revision 2

1 1.2 Institutional Information 

2

3 1.2.1 Purpose of Review

4

5 The purpose of this review is to establish whether the license application includes adequate 

6 information identifying the applicant, the applicant’s characteristics, and the proposed activity.

7

8 1.2.2 Responsibility for Review 

9

10 Primary: Licensing Project Manager

11

12 Secondary: None

13

14 Supporting: Office of the General Counsel

15 Office of Federal and State Materials and Environmental Management

16 Programs/Division of Waste Management and Environmental Protection

17 Office of Nuclear Reactor Regulation/Division of Policy and Rulemaking

18

19 1.2.3 Areas of Review 

20

21 The staff should review the institutional information provided by the applicant or licensee in the 

22 license application. Information provided for review should include the following:

23

24 1. Corporate Identity and Ownership—This section should include the identity and physical 

25 address of the applicant’s facility and corporate headquarters, corporate information 

26 sufficient to show the relationship of the applicant’s organization to other corporate 

27 entities, and the existence and extent of foreign ownership or influence.

28

29 2. Financial Qualifications—Information provided for review in this section should include 

30 the applicant’s financial qualifications to pursue the activities for which the license is 

31 sought.

32

33 3. Characteristics of the Material—This information should include the type, quantity, and 

34 form(s) of material(s) proposed for use at the licensed facility.

35

36 4. Authorized Uses—The application should clearly describe each proposed licensed 

37 activity in the form of requested authorized uses and the type of license the applicant is 

38 requesting.

39

40 5. Special Exemptions or Special Authorizations—The application should clearly describe 

41 any special exemptions and authorizations the applicant is requesting and the regulatory 

42 requirements for which the applicant is seeking approval or exemption.

43

44 6. Protection of Safeguard Information— The application should describe how safeguards 

45 information will be protected against unauthorized disclosure.

46

47 7. Security of Classified Information—The license application will include this section only if 

48 the applicant or licensee has requested and received a facility security clearance in 

49 accordance with 10 CFR Part 95, “Facility Security Clearance and Safeguarding of

50 National Security Information and Restricted Data.”
May 2014 1-7 NUREG-1520, Revision 2

1 8. Period of Time for Which the License Is Requested—The license application should 

2 specify the period of time for which the applicant is seeking approval.

3

4 Review Interfaces

5

6 None

7

8 1.2.4 Acceptance Criteria 

9

10 1.2.4.1 Regulatory Requirements

11

12 The regulations applicable to the areas of review in this SRP are 10 CFR 70.22; 10 CFR 70.23, 

13 “Requirements for the Approval of Applications”; 10 CFR 70.33, “Renewal of Licenses”; and 

14 10 CFR Part 95.

15

16 1.2.4.2 Regulatory Guidance 

17

18 No regulatory guides apply to institutional information for a fuel cycle facility.

19

20 1.2.4.3 Regulatory Acceptance Criteria 

21

22 The application is acceptable if it meets the criteria below.

23

24 1.2.4.3.1 Corporate Identity

25

26 The applicant has furnished its full name and physical address and the address of the fuel cycle 

27 facility if it is different from that of the applicant. If the application is for license renewal, the 

28 applicant has identified the number of the license to be renewed. The application indicates the 

29 State where the applicant is incorporated or organized and the location of the principal office. 

30 The application should include any information known to the applicant concerning the control or 

31 ownership, if any, exercised over the applicant by any alien, foreign corporation, or foreign 

32 government. Primary ownership and relationships to other components of the same ownership 

33 are explicitly described. The presence and operations of any other company on the site to be 

34 licensed are fully described.

35

36 1.2.4.3.2 Financial Qualifications

37

38 A description of financial qualifications demonstrates the applicant’s current and continuing 

39 access to the financial resources necessary to engage in the proposed activity in accordance 

40 with 10 CFR 70.22(a)(8) and 10 CFR 70.23(a)(5). For new facilities, the description includes 

41 sufficient details demonstrating that the applicant has adequate financial resources to support 

42 the safe siting, construction, operation, maintenance, and eventual decommissioning of the 

43 proposed facility.

44

45
May 2014 1-8 NUREG-1520, Revision 2

1 1.2.4.3.3 Characteristics of the Material

2

3 The application identifies the elemental name, maximum quantity, and specifications, including 

4 the chemical and physical form(s), of the licensable material that the applicant proposes to 

5 acquire, deliver, receive, possess, produce, use, transfer, or store. For each SNM, the 

6 specifications include the isotopic content and amount of enrichment by weight percent.

7 1.2.4.3.4 Authorized Uses

8

9 The application includes a summary, nontechnical narrative description for each activity or 

10 process in which the applicant proposes to acquire, deliver, receive, possess, produce, use, 

11 process, transfer, or store SNM. The authorized uses of SNM proposed for the facility are 

12 described and are consistent with the Atomic Energy Act of 1954, as amended. The description 

13 is consistent with more detailed process descriptions submitted as part of the ISA summary 

14 reviewed in Chapter 3 of this SRP.

15

16 If the application is for a license renewal, the applicant has clearly stated the time period for 

17 which renewal is sought.

18

19 Applicants seeking authorization to possess and use byproduct material or source material are

20 subject to additional regulations and guidance is not provided in this SRP. For byproduct 

21 materials, regulations in 10 CFR Part 30, “Rules of General Applicability to Domestic Licensing 

22 of Byproduct Material,” through 10 CFR Part 39, “Licenses and Radiation Safety Requirements 

23 for Well Logging,” would apply; guidance is provided in NUREG-1556, “Consolidated Guidance 

24 About Materials Licenses.” The requirements described in 10 CFR Part 40, “Domestic 

25 Licensing of Source Material,” would apply if applicants are seeking to receive, possess, use, 

26 transfer, or deliver source and byproduct materials.

27

28 1.2.4.3.5 Special Exemptions or Special Authorizations

29

30 The license application clearly describes any exemptions or authorizations of an unusual nature 

31 and adequately justifies them for the NRC’s consideration. The applicant has explained any 

32 cross-reference to other sections in the license application supporting such justifications. The 

33 license application clearly discusses special authorizations and/or exemptions already granted 

34 by the NRC.

35

36 1.2.4.3.6 Protection of Safeguards and Classified Information

37

38 The license application describes how the requirements to protect safeguards information from 

39 unauthorized disclosure have been satisfied in accordance with 10 CFR 70.22(l), and how the 

40 requirements to protect classified information have been met in accordance with 10 CFR 

41 Part 25, “Access Authorization,” and 10 CFR Part 95.

42

43 1.2.4.3.7 Information Security at Uranium Enrichment Facilities

44

45 For license applications regarding authorization to enrich uranium, the application describes 

46 how the requirements in 10 CFR 70.22(m) have been satisfied as well as the applicable 

47 regulations described in 10 CFR Part 25 and Part 95.

48
May 2014 1-9 NUREG-1520, Revision 2

1 The applicant has requested and received a facility security clearance in accordance with 

2 10 CFR Part 95, if this is applicable.

3

4 1.2.5 Review Procedures 

5

6 1.2.5.1 Acceptance Review

7

8 The primary reviewer should determine whether the license application is complete and 

9 addresses each issue in Section 1.2.3. Reviewers must decide whether they have enough 

10 information to proceed with a detailed review. Less significant errors or deficiencies that can be 

11 addressed in a request for additional information should be accepted. However, before the 

12 NRC performs a detailed review, the applicant should correct major deficiencies that would 

13 require several requests for additional information to resolve.

14

15 Reviewers should record whether each area of review is adequately addressed in the 

16 application, is adequately addressed in a cited document, is not applicable to the application, or 

17 has a major deficiency.

18

19 1.2.5.2 Safety Evaluation

20

21 The information submitted by the applicant in this section is, for the most part, informational in 

22 nature, and detailed technical analysis is generally not required beyond the acceptance criteria. 

23 For new facilities, the reviewer requests review assistance, as needed, from the Office of the 

24 General Counsel, the Office of Federal and State Materials and Environmental Management 

25 Programs/Division of Waste Management and Environmental Protection, and the Office of 

26 Nuclear Reactor Regulation/Division of Policy and Rulemaking in the review of corporate and 

27 financial information. During the initial review, the reviewer should draft the SER described 

28 below. A request for additional information (RAI) will be prepared when clarification and 

29 additional information are needed to determine whether the licensee’s submittals comply with 

30 the regulations. The primary reviewer should coordinate with the licensing project manager in 

31 preparing RAIs. Additional information submitted by the applicant will be evaluated and a final 

32 SER will be provided to the licensing project manager.

33

34 1.2.6 Evaluation Findings 

35

36 The regulations in 10 CFR 70.23 and 70.66 state that an application for a license will be 

37 approved if the Commission can make the general findings listed in those sections. The basis 

38 for the general findings is an evaluation of whether the application adequately addresses all of 

39 the applicable regulatory requirements. More specifically, the staff’s evaluation should 

40 determine whether the licensing submittals provide sufficient information to satisfy the regulatory 

41 requirements listed in Section 1.2.4.1 of this SRP and whether the applicant has appropriately 

42 addressed the regulatory acceptance criteria in SRP Section 1.2.5.4.3. The SER should state 

43 how the applicable regulatory requirements have or have not been met based on the 

44 acceptance criteria described in this chapter of the SRP. If the applicant chooses to use an 

45 alternative approach, the reviewer should discuss in the SER whether the proposed approach 

46 satisfies the applicable regulatory requirements. The reviewers should use the following 

47 approach to document their evaluation:

48
May 2014 1-10 NUREG-1520, Revision 2

1 1. State a specific regulatory requirement that applies to the application. Detailed 

2 acceptance criteria may be included where appropriate or necessary to clarify the 

3 requirement.

4 2. Identify the areas where the regulatory requirement is addressed in the application, 

5 including the areas where the specific acceptance criteria described in this SRP are 

6 addressed.

7

8 3. Describe your evaluation of the application and the bases for your conclusion. State 

9 whether the application meets the regulatory requirement.

10

11 4. Repeat these steps for every regulatory requirement that applies to the application.

12

13 There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

14 application or amendment request, (2) denial of the application or request, or (3) approval with 

15 conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

16 reviewer may consider proposing a license condition. Absent an NRC Order, license conditions 

17 must be agreed on with the licensee or applicant before becoming part of the license. A license 

18 condition should only be proposed if there is reasonable assurance that, if the licensee meets 

19 the condition, all regulatory requirements will be satisfied. Thus, license conditions should not 

20 be used to cover major deficiencies in an application. License conditions should be 

21 unambiguous, inspectable, and enforceable. They should only require those actions necessary 

22 to ensure compliance with applicable regulations. The basis for license conditions must be 

23 documented in the SER.

24

25 If the submittal is acceptable, the final SER input should conclude with a statement similar to the 

26 following:

27

28 The staff has reviewed the institutional information for [name of facility] according 

29 to Section 1.2.of the Standard Review Plan. On the basis of the review, the NRC 

30 staff has determined that [name of facility] has adequately described and 

31 documented its corporate structure and financial information, and is in 

32 compliance with those requirements in 10 CFR 70.22 and 10 CFR 70.65 related 

33 to other institutional information. In addition, in accordance with 

34 10 CFR 70.22(a)(2), (3), and (4), [name of facility] has adequately described: 

35 (1) the period of time for which the license is requested and the (2) types, 

36 (3) forms, (4) quantities, and (5) proposed authorized uses of licensed materials 

37 to be permitted at this facility as follows:

38

39 Material Form Quantity Authorized Use(s)

40

41 [name of facility]’s proposed activities are consistent with the Atomic Energy Act 

42 of 1954, as amended. [Name of facility] has provided all institutional information 

43 necessary to understand the ownership, financial qualifications, and location of 

44 the facility to be licensed, as well as the planned activities at the facility and the 

45 nuclear materials to be handled in connection with the requested license.
May 2014 1-11 NUREG-1520, Revision 2

1 1.3 Site Description 

2

3 1.3.1 Purpose of Review 

4

5 The purpose of this review is to determine whether the information provided by an applicant 

6 adequately describes the geographic, demographic, meteorological, hydrologic, geologic, and 

7 seismologic characteristics of the site and the surrounding area. The site description is a 

8 summary of the information that the applicant used in preparing the environmental report, 

9 emergency plan, and ISA summary.

10

11 1.3.2 Responsibility for Review 

12

13 Primary: Licensing Project Manager

14

15 Secondary: ISA Reviewer, Environmental Protection Reviewer, Emergency Plan 

16 Reviewer

17

18 Supporting: None

19

20 1.3.3 Areas of Review 

21

22 The information in this section of the application is summarized from the information presented 

23 in more detail in the applicant’s environmental report, emergency-management plan, and ISA 

24 summary. The information that the NRC staff will review includes the following (as appropriate 

25 for the facility being reviewed):

26

27 1. Site geography

28

29 a. Site location: State, county, municipality, topographic quadrangle (in eight 

30 7-1/2-minute quadrants), site boundary, and controlled-area boundary

31

32 b. Major nearby highways

33

34 c. Nearby bodies of water

35

36 d. Any other significant geographic feature that may affect accident analysis within 

37 1.6 kilometers (1 mile) of the site (e.g., ridges, valleys, specific geologic 

38 structures)

39

40 2. Demographics

41

42 a. Latest census results for area of concern

43

44 b. Description, distance, and direction to nearby population centers

45

46 c. Description of and distance and direction to nearby public facilities (e.g., schools, 

47 hospitals, and parks)

48

49 d. Description, distance, and direction to nearby industrial areas or facilities that 

50 may present potential hazards (including other nearby nuclear facilities)
May 2014 1-12 NUREG-1520, Revision 2

1 e. Uses of land within the licensed facility or its proposed boundaries 

2 (i.e., residential, industrial, commercial, or agricultural)

3

4 f. Description of nearby bodies of water and their uses

5

6 3. Meteorology

7

8 a. Primary wind directions and average windspeeds

9

10 b. Annual amount and forms of precipitation, as well as the design-basis values for 

11 accident analysis of maximum snow or ice load and probable maximum 

12 precipitation

13

14 c. Type, frequency, and magnitude of severe weather (e.g., lightning, tornado, and 

15 hurricane) and design-basis event summary descriptions for accident analysis

16

17 4. Hydrology

18

19 a. Characteristics of nearby rivers, streams, and bodies of water as appropriate

20

21 b. Depth to the water table and potentiometric surface map

22

23 c. Groundwater flow direction and velocity for the site

24

25 d. Characteristics of the uppermost aquifer and any hydrogeological connections to 

26 other aquifers in the region

27

28 e. Design-basis flood events used for accident analysis

29

30 5. Geology

31

32 a. Onsite characteristics of soil types and bedrock 

33

34 b. Design-basis earthquake magnitudes and return periods used for accident 

35 analysis

36

37 c. Description of other geologic hazards (e.g., mass wasting)

38

39 Review Interfaces

40

41 To ensure consistency, the listed SRP sections and documents interface with this section as 

42 follows:

43

44 • Review information about the facility and site and the different processes that will involve 

45 licensable material in Chapter 3 of the SRP.

46

47 • Review the facility and process descriptions in Chapter 8 of the SRP.

48
May 2014 1-13 NUREG-1520, Revision 2

1 • Review information in the applicant’s environmental report about the site’s geography, 

2 demographics, meteorology, hydrology, and geology.

3 1.3.4 Acceptance Criteria 

4

5 1.3.4.1 Regulatory Requirements

6

7 The regulations applicable to the areas of review in this SRP are 10 CFR 70.22 and 

8 10 CFR 70.65(b)(1) and (2).

9

10 1.3.4.2 Regulatory Guidance

11

12 No regulatory guides apply to site descriptions for a fuel cycle facility.

13

14 1.3.4.3 Regulatory Acceptance Criteria

15

16 The reviewer should find the site description—including the site geography, demographics, 

17 meteorology, hydrology, and geology (see Section 1.3.3) —acceptable if it meets the following 

18 acceptance criteria:

19

20 1. The summary briefly describes site geography, including its location relative to 

21 prominent natural and manmade features (such as mountains, rivers, airports, 

22 population centers, schools, and commercial and manufacturing facilities). The 

23 summary also describes the site boundary and the controlled area.

24

25 2. The summary provides population information on the basis of the most current available 

26 census data. To the extent possible, data reflect observations and measurements made

27 over a period of years, especially for conditions that are expected to vary seasonally 

28 (e.g., precipitation, windspeed, wind direction, and groundwater levels).

29

30 3. The application addresses appropriate meteorological data, including a summary of 

31 design-basis values for accident analysis of maximum snow or ice load and probable 

32 maximum precipitation, as may be developed by the applicant and presented in the ISA 

33 summary. The applicant presents appropriate design-basis values for lightning, high 

34 winds, tornado, hurricane, and other severe weather conditions that are applicable to the 

35 site.

36

37 4. The application includes a summary description of the hydrology and geology (including 

38 seismicity) for the area and cites the design-basis flood event for which the facility may 

39 be safely shut down.

40

41 5. The applicant’s descriptions are consistent with the more detailed information presented 

42 in the ISA summary, the environmental report, and the emergency plan, if these are 

43 applicable.

44

45 1.3.5 Review Procedures 

46

47 1.3.5.1 Acceptance Review 

48
May 2014 1-14 NUREG-1520, Revision 2

1 The staff will initially determine whether the application is complete and addresses all topics 

2 discussed in Section 1.3.3. Reviewers must decide whether they have enough information to 

3 proceed with a detailed review. Less significant errors or deficiencies that can be addressed in 

4 a request for additional information should be accepted. However, before the NRC performs a 

5 detailed review, the applicant should correct major deficiencies that would require several 

6 requests for additional information to resolve.

7

8 Reviewers should record whether each area of review is adequately addressed in the 

9 application, is adequately addressed in a cited document, is not applicable to the application, or 

10 has a major deficiency.

11

12 1.3.5.2 Safety Evaluation

13

14 The material in this section of the SRP is informational, because it summarizes material in the 

15 ISA summary, environmental report, emergency plan, and other documents cited by the 

16 applicant. No technical analysis is required because the primary reference for the information is 

17 the ISA summary. The applicant may also need to update this section to verify any information 

18 changes made in response to the staff’s environmental, emergency-management, and ISA 

19 summary reviews. During the initial review, the reviewer should draft the SER described below. 

20 A request for additional information (RAI) will be prepared when clarification and additional 

21 information are needed to determine whether the licensee’s submittals comply with the 

22 regulations. The primary reviewer should coordinate with the licensing project manager in 

23 preparing RAIs. Additional information submitted by the applicant will be evaluated and a final 

24 SER will be provided to the licensing project manager.

25

26 1.3.6 Evaluation Findings 

27

28 The regulations in 10 CFR 70.23 and 70.66 state that an application for a license will be 

29 approved if the Commission can make the general findings listed in those sections. The basis 

30 for the general findings is an evaluation of whether the application adequately addresses all of 

31 the applicable regulatory requirements. More specifically, the staff’s evaluation should 

32 determine whether the licensing submittals provide sufficient information to satisfy the regulatory 

33 requirements listed in Section 1.3.4.1 of this SRP and whether the applicant has appropriately 

34 addressed the regulatory acceptance criteria in SRP Section 1.3.4.3. The SER should state 

35 how the applicable regulatory requirements have or have not been met based on the 

36 acceptance criteria described in this chapter of the SRP. If the applicant chooses to use an 

37 alternative approach, the reviewer should discuss in the SER whether the proposed approach 

38 satisfies the applicable regulatory requirements. The reviewers should use the following 

39 approach to document their evaluation:

40

41 1. State a specific regulatory requirement that applies to the application. Detailed 

42 acceptance criteria may be included where appropriate or necessary to clarify the 

43 requirement.

44

45 2. Identify the areas where the regulatory requirement is addressed in the application, 

46 including the areas where the specific acceptance criteria described in this SRP are 

47 addressed.

48

49 3. Describe your evaluation of the application and the bases for your conclusion. State 

50 whether the application meets the regulatory requirement.
May 2014 1-15 NUREG-1520, Revision 2

1

2 4. Repeat these steps for every regulatory requirement that applies to the application.

3

4 There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

5 application or amendment request, (2) denial of the application or request, or (3) approval with 

6 conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

7 reviewer may consider proposing a license condition. Absent an NRC order, license conditions 

8 must be agreed on with the licensee or applicant before becoming part of the license. A license 

9 condition should only be proposed if there is reasonable assurance that, if the licensee meets 

10 the condition, all regulatory requirements will be satisfied. Thus, license conditions should not 

11 be used to cover major deficiencies in an application. License conditions should be 

12 unambiguous, inspectable, and enforceable. They should only require those actions necessary 

13 to ensure compliance with applicable regulations. The basis for license conditions must be 

14 documented in the SER.

15

16 If the license application provides sufficient information and is consistent with the guidance in 

17 this SRP, the staff will conclude that this evaluation is complete and that the applicant’s site 

18 description is acceptable with statements similar to the following:

19

20 The staff has reviewed the site description for [name of facility] in accordance 

21 with Section 1.3 of the Standard Review Plan. [Name of facility] has adequately 

22 described and summarized general information pertaining to (1) the site 

23 geography, including its location relative to prominent natural and manmade 

24 features such as mountains, rivers, airports, population centers, schools, and 

25 commercial and manufacturing facilities; (2) population information using the 

26 most current available census data; (3) meteorology, hydrology, and geology for 

27 the site; and (4) applicable design-basis events. The review verified that the site 

28 description is consistent with the information used as a basis for the 

29 environmental report, emergency-management plan, and ISA Summary.

30

31 1.4 References

32

33 U.S. Code of Federal Regulations, “Domestic Licensing of Special Nuclear Material,” Part 70, 

34 Chapter I, Title 10, “Energy.”

35

36 U.S. Code of Federal Regulations, “Facility Security Clearance and Safeguarding of National

37 Security Information and Restricted Data,” Part 95, Chapter I, Title 10, “Energy.”

38

May 2014 2-1 NUREG-1520, Revision 2

2. ORGANIZATION AND ADMINISTRATION

1 2.1 Purpose of Review

2

3 The purpose of the review of the applicant’s organization and administration is to ensure that 

4 the proposed management hierarchy and policies will provide reasonable assurance that the 

5 licensee plans, implements, and controls site activities in a manner that ensures the safety of 

6 workers, the public, and the environment. The review also ensures that the applicant has 

7 identified and provided adequate qualification descriptions for key management positions.

8

9 2.2 Responsibility for Review

10

11 Primary: Licensing Project Manager

12

13 Secondary: None

14

15 Supporting: Primary Reviewers for Other Standard Review Plan (SRP) Chapters

16 (e.g., technical-area chapters and management-measures chapters);

17 Fuel Facility Inspection Staff

18

19 2.3 Areas of Review

20

21 The organizational structure and associated administrative program proposed by the applicant 

22 should include administrative policies, procedures and management policies, and qualifications 

23 of key management positions and describe how these will provide reasonable assurance that 

24 the health, safety, and environmental (HS&E) protection functions will be effective.

25

26 For new facilities, or currently licensed facilities undergoing major modifications, the applicant 

27 should describe the comprehensive management policies and procedures that will be used to 

28 manage and closely monitor the facility design, engineering, construction, and modifications.

29

30 The application should address how the management policies ensure the establishment and 

31 maintenance of design and operations. The administrative and management policies should 

32 describe the relationships among major facility safety functions and programs, such as the 

33 integrated safety analysis, management measures for items relied on for safety (IROFS), 

34 radiation safety, nuclear criticality safety, fire safety, chemical safety, environmental monitoring, 

35 and emergency planning. The applicant should also describe its qualification criteria with regard 

36 to education (i.e., degree and field), training, and experience for key management positions. 

37 Management positions for which such criteria should be described include the facility manager, 

38 operations manager, shift supervisor, and managers for various safety and environmental 

39 disciplines. Alternative named management positions could be proposed. Qualification criteria 

40 should be described generally, in terms of academic credentials, formal continuing education, 

41 and work experience. For example, “bachelor’s degree in nuclear engineering or related 

42 scientific or engineering field, with 5 years of experience managing the operations of a nuclear 

43 fuel manufacturing facility.”

44

45 Review Interfaces

46

47 None
May 2014 2-2 NUREG-1520, Revision 2

1 2.4 Acceptance Criteria

2

3 2.4.1 Regulatory Requirements

4

5 The regulations in Title 10 of the Code of Federal Regulations (10 CFR) 70.22(a)(6), 

6 70.23(a)(2), and 70.62(d) require a management system and administrative procedures for the 

7 effective implementation of HS&E functions concerning the applicant’s corporate organization, 

8 qualifications of the staff, and adequacy of the proposed equipment, facilities, and procedures to 

9 provide adequate safety for workers, the public, and the environment.

10

11 2.4.2 Regulatory Guidance

12

13 There are no regulatory guides specific to the description of the organization and administration 

14 of fuel cycle facilities.

15

16 2.4.3 Regulatory Acceptance Criteria

17

18 The application is acceptable if it meets the criteria identified below. The applicant’s safety 

19 program description should include appropriate commitments relevant to these criteria.

20

21 A. The following criteria apply to new facilities or facilities undergoing major modifications 

22 (in addition to the criteria listed below for existing facilities):

23

24 1. The applicant has identified and functionally described the specific organizational 

25 groups that are responsible for managing the design, construction, operations, 

26 and modifications of the facility or licensed activities. The application also 

27 includes organizational charts.

28

29 2. Clear, unambiguous management controls and communications exist among the 

30 organizational units responsible for managing the design, construction, 

31 operations, and modifications of the facility or licensed activities.

32

33 3. The personnel responsible for managing the design, construction, operation, and 

34 modifications of the facility or licensed activities have substantive breadth and 

35 level of experience and are appropriately available. The qualifications, 

36 responsibilities, and authorities for key supervisory and management positions 

37 with HS&E responsibilities are clearly defined in position descriptions that are 

38 accessible to all affected personnel and to the U.S. Nuclear Regulatory 

39 Commission (NRC), upon request.

40

41 4. The applicant has described specific plans to commission the facility’s startup 

42 and operation, including the transition from the startup phase to operations, 

43 under the direct supervision of the applicant’s personnel responsible for safe 

44 operations. The application clearly describes the roles and responsibilities of the 

45 different functions engaged in these commissioning activities.

46
May 2014 2-3 NUREG-1520, Revision 2

1 B. The following criteria apply to existing facilities:

2

3 1. The applicant has identified and functionally described the specific organizational 

4 groups responsible for operating the facility and managing the development of 

5 design changes to the facility. The application also includes organizational 

6 charts.

7

8 2. The qualifications, responsibilities, and authorities of key supervisory and 

9 management positions with HS&E responsibilities are clearly defined in position 

10 descriptions that are accessible to affected persons and to the NRC, upon 

11 request.

12

13 3. In the organizational hierarchy, the HS&E organization(s) is independent of the

14 operations organization(s), allowing it to provide objective HS&E audit, review, or 

15 control activities. “Independent” means that neither organization reports to the 

16 other in an administrative sense. (However, both may report to a common 

17 manager.) Lines of responsibility and authority are clearly drawn.

18

19 4. The individual delegated overall responsibility for the HS&E functions has the 

20 authority to shut down operations if they appear to be unsafe and, in that case, 

21 must approve restart of shutdown operations or licensed activities.

22

23 5. The activities essential for effective implementation of the HS&E functions are 

24 documented in formally approved, written procedures, prepared in compliance 

25 with a formal document-control program.

26

27 6. The applicant should commit to a simple mechanism, available for use by any 

28 person in the plant, for reporting potentially unsafe conditions or activities to the 

29 HS&E organization. Reported concerns should be promptly investigated, 

30 assessed, and resolved.

31

32 7. The application clearly defines effective lines of communication and authority 

33 among the organizational units involved in the engineering, HS&E, and 

34 operations functions of the facility.

35

36 8. The applicant has committed to establishing the formal management measures 

37 required to ensure the availability and reliability of IROFS. Chapter 11 of this 

38 SRP discusses management measures.

39

40 9. Written agreements exist with offsite emergency resources such as fire, police, 

41 ambulance and rescue units, and medical services. Chapters 7 and 8 of this 

42 SRP address these agreements in more detail.

43

44 The applicant’s safety program description includes commitments relevant to meeting the 

45 acceptance criteria described above.

46

47
May 2014 2-4 NUREG-1520, Revision 2

1 2.5 Review Procedures

2

3 2.5.1 Acceptance Review 

4

5 During the acceptance review of a license application, the reviewer should examine the 

6 submittals to identify major deficiencies in the information provided for each area of review 

7 specified in SRP Section 2.3. Reviewers must decide whether they have enough information to 

8 proceed with a detailed review. Less significant errors or deficiencies that can be addressed in 

9 a request for additional information should be accepted. However, before the NRC performs a 

10 detailed review, the applicant should correct major deficiencies that would require several 

11 requests for additional information to resolve.

12

13 Reviewers should record whether each area of review is adequately addressed in the 

14 application, is adequately addressed in a referenced document, is not applicable to the 

15 application, or has a major deficiency.

16

17 2.5.2 Safety Evaluation

18

19 The primary reviewer should perform a safety evaluation with respect to the acceptance criteria 

20 described in Section 2.4. The objective of the review is to ensure that the corporate-level 

21 management and technical support structure, as demonstrated by organizational charts and 

22 descriptions of functions and responsibilities, is clear with respect to assignments of primary 

23 responsibility. If necessary, the primary reviewer consults with the NRC inspection staff to verify 

24 that the applicant’s management positions are adequately defined in terms of both numbers of 

25 persons and their responsibilities, authorities, and required qualifications. If necessary, the 

26 reviewer may visit the site to discuss and verify implementation of the acceptance criteria with 

27 facility management.

28

29 On the basis of the foregoing, the supporting staff reviewers determine the overall acceptability 

30 of the applicant’s management system, management qualifications, organizational structure, 

31 and administrative procedures. The reviewers should determine whether the application 

32 satisfies the acceptance criteria of Section 2.4 and then prepare a safety evaluation report 

33 (SER) in accordance with Section 2.6. During the initial review, the reviewer should draft the 

34 safety evaluation report (SER) described below. A request for additional information (RAI) will 

35 be prepared when clarification and additional information are needed to determine if the 

36 licensee’s submittals comply with the regulations. The primary reviewer should coordinate with 

37 the licensing project manager in preparing RAIs. Additional information submitted by the 

38 applicant will be evaluated and a final SER will be provided to the licensing project manager.

39

40 2.6 Evaluation Findings

41

42 The regulations in 10 CFR 70.23, “Requirements for the Approvals of Applications,” and 70.66, 

43 “Additional Requirements for Approval of License Application,” state that an application for a 

44 license will be approved if the Commission can make the general findings listed in those 

45 sections. The basis for the general findings is an evaluation of whether the application 

46 adequately addresses all of the applicable regulatory requirements. More specifically, the staff’s 

47 evaluation should determine whether the licensing submittals provide sufficient information to 

48 satisfy the regulatory requirements listed in SRP Section 2.4.1 and whether the applicant has 

49 appropriately addressed the regulatory acceptance criteria in SRP Section 2.4.3. The SER 
May 2014 2-5 NUREG-1520, Revision 2

1 should state how the applicable regulatory requirements have or have not been met based on 

2 the acceptance criteria described in this chapter of the SRP. If the applicant chooses to use an 

3 alternative approach, the reviewer should discuss in the SER whether the proposed approach 

4 satisfies the applicable regulatory requirements. The reviewers should use the following 

5 approach to document their evaluation:

6

7 1. State a specific regulatory requirement that applies to the application. Detailed 

8 acceptance criteria may be included where appropriate or necessary to clarify the 

9 requirement.

10 2. Identify the areas where the regulatory requirement is addressed in the application, 

11 including the areas where the specific acceptance criteria described in this SRP are 

12 addressed.

13

14 3. Describe your evaluation of the application, the basis for your conclusion, and whether 

15 the application meets the regulatory requirement.

16

17 4. Repeat these steps for every regulatory requirement that applies to the application.

18

19 There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

20 application or amendment request, (2) denial of the application or request, or (3) approval with 

21 conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

22 reviewer may consider proposing a license condition. Absent an NRC Order, license conditions 

23 must be agreed upon with the licensee or applicant before becoming part of the license. 

24 A license condition should only be proposed if there is reasonable assurance that, if the 

25 licensee meets the condition, all regulatory requirements will be satisfied. Thus, license 

26 conditions should not be used to cover major deficiencies in an application. License conditions 

27 should be unambiguous, inspectable, and enforceable. They should only require those actions 

28 necessary to ensure compliance with applicable regulations. The basis for license conditions 

29 must be documented in the SER.

30

31 If the submittal is acceptable, the final SER input should conclude with a statement similar to the 

32 following:

33

34 The staff has reviewed the organization and administration for [name of facility] 

35 according to Chapter 2 of the Standard Review Plan.

36

37 (a) For new facilities

38

39 [Name of facility] described: (1) clear responsibilities and associated resources 

40 for the design, construction, operations, and modifications of the facility, and 

41 (2) its plans for managing the project. [Insert a summary statement of what was

42 evaluated and why the reviewer finds the submittal acceptable.] The staff has 

43 reviewed these plans and commitments and concludes that they provide 

44 reasonable assurance that an acceptable organization, administrative policies, 

45 and sufficient qualified resources have been established or are committed to 

46 satisfy [name of facility]’s commitments for the design, construction, operations, 

47 and modifications of the facility.

48
May 2014 2-6 NUREG-1520, Revision 2

1 (b) For operating and new facilities 

2

3 [Name of facility] described its organization and management policies for 

4 providing adequate safety management and management measures for the safe 

5 operation of the facility. [Insert a summary statement of what was evaluated and 

6 why the reviewer finds the submittal acceptable.] The staff has reviewed this 

7 information and concluded that [name of facility] has an acceptable organization, 

8 administrative policies, and sufficient qualified resources to provide for the safe 

9 operation of the facility under both normal and abnormal conditions.

10

11 2.7 References

12

13 U.S. Code of Federal Regulations, “Domestic Licensing of Special Nuclear Material,” Part 70, 

14 Chapter I, Title 10, “Energy.”

15

16 U.S. Nuclear Regulatory Commission, “Proposed Methods for Regulating Major Materials 

17 Licensees,” NUREG-1324, Sections 3.1, “Organization Plan,” and 3.2, “Managerial Controls and 

18 Oversight,” February 1992.
May 2014 3-1 NUREG-1520, Revision 2

1

3. INTEGRATED SAFETY ANALYSIS 

AND INTEGRATED SAFETY ANALYSIS SUMMARY

2 3.1 Purpose of Review

3

4 The primary purpose of an integrated safety analysis (ISA) review is to attain reasonable 

5 assurance that the applicant has established an ISA program that is, and will continue to be, in 

6 compliance with Title 10, “Energy,” of the Code of Federal Regulations (10 CFR) Part 70, 

7 “Domestic Licensing of Special Nuclear Material.” More specifically, the ISA requirements are 

8 part of the safety program requirements of Subpart H, “Additional Requirements for Certain 

9 Licensees Authorized to Possess a Critical Mass of Special Nuclear Material,” of 10 CFR

10 Part 70. The staff‘s review should confirm that the applicant‘s ISA Program is compliant with the

11 applicable regulations and is acceptable to provide reasonable assurance that its equipment, 

12 facilities, and management measures are adequate to protect against releases and exposures 

13 of licensed material. The facility design must adequately protect the health and safety of 

14 workers and the public from the risk of credible high and intermediate consequences events.

15

16 Apart from an ISA review, an operational readiness review is conducted in accordance with 

17 10 CFR 70.32(k). An operational readiness review is an assessment review inspection 

18 performed by a multidisciplinary inspection team to ensure that a plutonium or enrichment 

19 facility has been completed in accordance with the application or license, and so can be 

20 operated safely within the intended safety basis. For new facilities other than plutonium or 

21 enrichment facilities regulated under Subpart H of 10 CFR Part 70, or for major modifications to 

22 existing facilities, such reviews, though not strictly required, are normally conducted.

23

24 In performing ISA reviews, the staff should review information provided in the license 

application, the ISA,1 and ISA summary.2 25 These three reviews are discussed below. The 

26 content of the ISA summary is only one set of elements to be evaluated in performing ISA

27 reviews. Neither the ISA nor the ISA summary is incorporated as part of the license. The 

28 required contents of an ISA summary are specified in 10 CFR 70.65(b)(1) through (9).

29

30 1. Review of the license application and Safety Program

31

32 The purpose of the review of the license application is to determine if programmatic 

33 commitments regarding the safety program, including the ISA, are adequate to meet the 

34 regulatory requirements of 10 CFR 70.62, “Safety Program and Integrated Safety 

35 Analysis.” The term “programmatic” is used here to refer to the organization, criteria, 

36 methods, and practices for conducting activities important to safety, such as the ISA 

37 program, criticality and other safety discipline programs, and the management-measures 

38 programs addressed in Chapter 11 of this SRP.

 1 An ISA identifies potential accident sequences in the facility’s operations, designates IROFS to either 

prevent such accidents or mitigate their consequences to an acceptable level, and describes management 

measures to provide reasonable assurance of the availability and reliability of IROFS. 2 Applicants for new licenses and persons holding licenses under 10 CFR Part 70 on September 18, 2000, 

must perform an ISA and submit an ISA summary to the NRC for approval. The ISA summary focuses on 

higher-risk accident sequences with consequences that could exceed the criteria of 10 CFR 70.61, 

“Performance Requirements.” The ISA summary is a synopsis of the results of the ISA and contains 

information specified in 10 CFR 70.65(b). Although the ISA summary is not part of the license application, it 

is placed on the public docket. Neither the ISA nor the ISA summary is incorporated as part of the license.
May 2014 3-2 NUREG-1520, Revision 2

1 2. ISA Summary Review

2

3 As discussed further below in Section 3.3.2, an applicant may submit, for NRC approval, 

4 one ISA summary for the entire facility, or multiple ISA summaries for individual 

5 processes (or groups of processes) in the facility as they are completed. The purpose of 

6 the review of the ISA summary is to establish reasonable assurance that the applicant 

7 has:

8

9 − Conducted an ISA of appropriate detail for each applicable process, using 

10 methods and staff adequate to achieve the requirements of 10 CFR 70.62(c)(1) 

11 and (2).

12

13 − Identified and evaluated, in the ISA, all credible events (accident sequences) 

14 involving process deviations or other events internal to the facility 

15 (e.g., explosions, spills, and fires) and credible external events that could result in 

16 facility-induced consequences to workers, the public, or the environment that 

17 could exceed the performance requirements of 10 CFR 70.61, “Performance 

18 Requirements.”

19

20 − Designated engineered and administrative items relied on for safety (IROFS) and 

21 correctly evaluated the set of IROFS addressing each accident sequence as 

22 providing reasonable assurance, through preventive or mitigative measures and 

23 through application of supporting management measures (discussed in 

24 Chapter 11 of this SRP) that the performance requirements of 10 CFR 70.61 are 

25 met.

26

27 − Satisfied the requirements pertaining to performance of an ISA 

28 (e.g., 10 CFR 70.61).

29

30 − Adequately addressed all the requirements of 10 CFR 70.65, “Additional Content 

31 of Applications.”

32

33 3. Vertical and horizontal slice review of the ISA documentation and supporting 

34 documentation

35

36 This is a review of documentation generated in performing the ISA beyond what was 

37 submitted in the license application and ISA summary. The horizontal slice review has 

38 the purpose of verifying that the ISA covered all required plant processes, hazards, 

39 accidents, and IROFS. The purpose of the vertical slice review is to confirm the 

40 adequacy of the applicant’s ISA methods and implementation by examining the ISA of a 

41 select subset of processes in detail. As indicated, these horizontal and vertical slice 

42 reviews are performed onsite, and are discussed further in Section 3.5.2.3 below.
May 2014 3-3 NUREG-1520, Revision 2

1 3.2 Responsibility for Review

2

3 Primary: Assigned Licensing Reviewer

4

5 Secondary: Technical Specialists in Specific Areas

6

7 Supporting: Fuel Facility Inspectors

8

9 3.3 Areas of Review

10

11 In accordance with 10 CFR 70.62(c), each applicant or licensee must conduct an ISA that is of 

12 appropriate detail for the complexity of the process being analyzed. An ISA summary presents 

13 the ISA results. The safety program and ISA commitments and descriptions to be reviewed 

14 consist of (1) process safety information (10 CFR 70.62(b)), (2) methods used to perform the 

15 ISA, (3) qualifications of the team performing the ISA (10 CFR 70.62(c)(2)), (4) methods of 

16 documenting and implementing the results of the ISA, (5) procedures to maintain the ISA 

17 current when changes are made to the facility, and (6) management measures 

18 (10 CFR 70.62(d)). The descriptive commitments for the safety program should be found in 

19 license applications, renewals, and amendments. ISA summaries may be submitted for an 

20 entire existing facility, a new facility, a new process, or altered processes requiring revision of 

21 the ISA, but is not to be incorporated as part of the license. The staff will review the ISA 

22 summary submitted to the NRC and the portions of the ISA and ISA documentation maintained 

23 onsite to determine the adequacy of the applicant’s ISA.

24

25 3.3.1 License Application and Safety Program 

26

27 The sections of the license application (typically an ISA chapter in the license application) 

28 describe the licensee’s or applicant’s programmatic commitments regarding the safety program. 

29 In the following, the phrase “process node” or “process” refers to a single, reasonably compact 

30 piece of equipment or workstation where a single unit process or processing step is conducted. 

31 A typical fuel cycle facility is divided into several major process lines or areas, each consisting of 

32 many process nodes.

33

34 A. For a new license application or a license renewal application, the specific areas of 

35 review are as follows:

36

37 1. The applicant’s description of, and commitments to, a method for maintaining a 

38 current and accurate set of process safety information, including information on 

39 the hazardous materials, technology, and equipment used in each process. The 

40 applicant should explain this activity in detail in the description of its configuration 

41 management program (Section 11.1).

42

43 2. The applicant’s description of, and commitments to, requirements for ISA team 

44 training and qualifications (Section 11.4) for those individuals who will conduct 

45 and maintain the ISA and ISA summary.

46

47 3. The applicant’s description of, and commitments to, ISA methods, 

48 method-selection criteria, or specific methods to be used for particular classes of 

49 process nodes (usually process workstations). The review of the ISA method 

50 includes evaluating the applicant’s methods in the following specific areas:
May 2014 3-4 NUREG-1520, Revision 2

1 a. hazard identification

2

3 b. process hazard analysis (accident identification)

4

5 c. accident-sequence construction and evaluation

6

7 d. consequence determination and comparability to 10 CFR 70.61

8

9 e. likelihood categorization for determining compliance with 10 CFR 70.61

10

11 4. The applicant’s description of, and commitments to, management procedures for 

12 conducting and maintaining the ISA. Specific review areas include the following 

13 applicant procedures:

14

15 i. performance of, and updates to, the ISA

16

17 ii. review responsibility

18

19 iii. ISA documentation

20

21 iv. reporting of ISA summary changes in accordance with

22 10 CFR 70.72(d)(1) and (3)

23

24 v. maintenance of ISA records in accordance with10 CFR 70.62(a)(2)

25

26 B. For a license amendment, the specific areas of review are as follows:

27

28 1. Those sections of the license application affected by the change. The reviewer 

29 should ensure that the effectiveness of any programmatic commitments is not 

30 reduced, or that the licensee has provided an adequate justification that there is 

31 still adequate protection for the public and the environment.

32

33 2. Those sections of the ISA and ISA summary affected by the change. The 

34 reviewer should verify that any changes in facility operations will still comply with 

35 the performance requirements of 10 CFR 70.61. This includes examining any 

36 changes to process descriptions, new or changed assumptions, controlled 

37 parameters, safety limits, controls, or safety margin, as well as new or changed 

38 accident sequences and items relied on for safety.

39

40 3. Any portions of the quality-assurance plan (if applicable), emergency plan, or 

41 validation report affected by the change.

42

43 4. Justification for the change, including revised safety-basis documents (process 

44 hazard analyses, calculations, and other supporting technical documents) that 

45 are needed to demonstrate adequate protection to the public and the 

46 environment.
May 2014 3-5 NUREG-1520, Revision 2

1 3.3.2 Integrated Safety Analysis Summary

2

3 The regulations in 10 CFR 70.65(b) list the types of information required to be submitted in an 

4 ISA summary. The NRC reviewer should confirm that credible accidents that result in a release 

5 of radioactive material, a nuclear criticality event, or any other exposure to radiation resulting 

6 from use of licensed material that exceeds the exposure limits stated in 10 CFR 70.61 are 

7 “highly unlikely” or “unlikely,” as appropriate. In addition, the NRC reviews accidents involving 

8 hazardous chemicals produced from licensed materials. Hazardous chemicals include

9 (1) chemicals that are licensed materials or have licensed materials as precursor compounds, or 

10 (2) substances that physically or chemically interact with licensed materials and that are toxic, 

11 explosive, flammable, corrosive, or reactive to the extent that they endanger life or health (see 

12 Chapter 6 of this SRP for additional information).

13

14 The areas of review of an ISA summary are as follows:

15

16 1. Site: The site description in the ISA summary (see Section 1.3) focuses on those factors 

17 that could affect safety, such as geography, meteorology (e.g., high winds and flood 

18 potential), seismology, demography, and nearby industrial facilities and transportation 

19 routes.

20

21 2. Facility: The facility description in the ISA summary focuses on features that could affect 

22 potential accidents and their consequences. Examples of these features are facility 

23 location, facility design information, and the location and arrangement of buildings on the 

24 facility site.

25

26 3. Processes, Hazards, and Accident Sequences: The process description in the 

27 ISA summary addresses each process that was analyzed as part of the ISA. Specific 

28 areas reviewed include basic process function and theory, functions of major 

29 components and their operation, process design and equipment, and process operating 

30 ranges and limits. This description must also include a list of the hazards (and 

31 interactions of hazards) for each process and the accident sequences that could result 

32 from such hazards and for which unmitigated consequences could exceed the 

33 performance requirements of 10 CFR 70.61.

34

35 4. Demonstration of Compliance with 10 CFR 70.61: For each applicable process, this 

36 section presents the following information that should be developed in the ISA to 

37 demonstrate compliance with the performance criteria of 10 CFR 70.61:

38

39 a. Postulated consequences and comparison to the consequence levels identified 

40 in 10 CFR 70.61, as well as information such as inventory and release-path 

41 factors supporting the results of the consequence evaluation

42

43 b. Information showing how the applicant established the likelihoods of accident 

44 sequences that could exceed the performance requirements of 10 CFR 70.61

45

46 c. Information describing how designated IROFS protect against accident 

47 sequences that could exceed the performance requirements of 10 CFR 70.61

48

49 d. Information on management measures applied to the IROFS (addressed in 

50 greater detail in Chapter 11)
May 2014 3-6 NUREG-1520, Revision 2

1 e. Information on how the criticality monitoring requirements of 10 CFR 70.24, 

2 “Criticality Accident Requirements,” are met

3

4 f. if applicable, ways that the baseline design criteria of 10 CFR 70.64, 

5 “Requirements for New Facilities or New Processes at Existing Facilities,” are 

6 addressed

7

8 5. Team Qualifications and ISA Methods: This section should discuss the applicant’s 

9 ISA team qualifications and ISA methods. (If methods are adequately described in the 

10 license application, the applicant will not need to duplicate this information in the 

11 ISA summary. The ISA summary should include specific examples of the application of 

12 ISA methods to enable the reviewer to understand their selection and use.)

13

14 6. List of IROFS: This list describes the IROFS for all intermediate- and high-consequence 

15 accidents in sufficient detail to permit an understanding of their safety function.

16

17 7. Chemical Consequence Standards: This discussion identifies the applicant’s 

18 quantitative standards for assessing the chemical consequence levels specified in 

19 10 CFR 70.61.

20

21 8. List of Sole IROFS: This list identifies those IROFS that are the sole item preventing or 

22 mitigating an accident for which the consequences could exceed the performance 

23 requirements of 10 CFR 70.61.

24

25 Definitions of “Unlikely,” “Highly Unlikely,” and “Credible”: The applicant must define the 

26 terms “unlikely,” “highly unlikely,” and “credible,” as used in the ISA summary.

27

28 To evaluate the effectiveness of the applicant’s likelihood and consequence evaluation 

29 methods, the reviewer should also examine the analyses of some accident sequences that are 

30 not reported in the ISA summary for which the applicant established that consequences will not 

31 exceed the performance requirements of 10 CFR 70.61. In some simple cases, the information 

32 normally contained in the ISA summary process descriptions and list of IROFS might be 

33 sufficient to enable the reviewer to understand how compliance is achieved when considered 

34 with the description of ISA likelihood evaluation methods and criteria. However, in general, the 

35 applicant should describe how its ISA team evaluated a credible accident likelihood to be “highly 

36 unlikely” or “unlikely.”

37

38 The reviewer should evaluate the efficacy of the applicant’s ISA methods. To do this, in addition 

39 to reviewing the description of the ISA methods, the reviewer will need to understand how these 

40 methods have been applied in practice to the wide diversity of process safety designs in the 

41 facility. Examples in the ISA summary of how the methods are applied to a representative 

42 sample of processes would help the reviewer to understand the applicant’s ISA methods. 

43 However, if the ISA summary does not include examples providing details of how the methods 

44 were applied, such information may be available at the applicant’s site, as part of the overall 

45 safety information records.

46

47 The NRC review of the applicant’s example accident sequence evaluations included in the 

48 ISA summary is not a substitute for the “vertical slice” and “horizontal” reviews that should be 

49 performed using detailed information at the site. The NRC must select this onsite evaluation of 

50 ISA documentation and processes to confirm that the ISA was actually performed as described 

51 in the ISA summary.
May 2014 3-7 NUREG-1520, Revision 2

1 Review interfaces

2

3 The listed SRP sections interface with this section as follows:

4

5 • Review facility and process description under SRP Chapter 1.

6

7 • Review organization structure and qualifications and responsibilities of key personnel 

8 under SRP Chapter 2.

9

10 • Review criticality accident sequences and associated IROFS under SRP Chapter 5.

11

12 • Review chemical hazards, accident sequences, and associated IROFS under SRP 

13 Chapter 6.

14

15 • Review fire hazards, accident sequences, and associated IROFS under SRP Chapter 7.

16

17 • Review management measures applied to IROFS under SRP Chapter 11.

18

19 The specific acceptance criteria and review procedures are contained in the referenced SRP 

20 sections.

21

22 3.4 Acceptance Criteria

23

24 3.4.1 Regulatory Requirements

25

26 Acceptance criteria are based on meeting the relevant requirements of the following regulations:

27

28 1. The regulation in 10 CFR 70.62 specifies the requirement to establish and maintain a 

29 safety program, including performance of an ISA. Paragraph (c) of 10 CFR 70.62 

30 specifies requirements for conducting an ISA.

31

32 2. The performance requirements are in 10 CFR 70.61.

33

34 3. The requirements to prepare and submit an ISA summary for NRC approval are stated 

35 in 10 CFR 70.65(b).

36

37 4. The regulation in 10 CFR 70.72, “Facility Changes and Change Process,” sets forth 

38 requirements for maintaining a current ISA, ISA summary, and other safety-program 

39 documentation when changes are made to the site, structures, processes, systems, 

40 equipment, components, computer programs, and activities of personnel; however, the 

41 ISA summary needs to be updated only annually.

42

43 Table 3.2 summarizes the information requirements of each category, the corresponding 

44 regulatory citation, and the section of this chapter that describes the expectations for such 

45 information.
May 2014 3-8 NUREG-1520, Revision 2

Table 3.2 Information Requirements for the ISA Summary

1 3.4.2 Regulatory Guidance 

2

3 The following additional guidance may be used to supplement the review:

4

5 1. NUREG-1513, “Integrated Safety Analysis Guidance Document,” issued May 2001, 

6 contains guidance applicable to performing an ISA and documenting the results.

Information Category and Requirement 10 CFR Part 70 

Regulatory Citation

NUREG-1520, Chapter 3 

Section Reference

Site and Facility Characteristics:

Site description 70.65(b)(1) 3.4.3.2(1)

Facility description 70.65(b)(2) 3.4.3.2(2)

Criticality monitoring and alarms 70.65(b)(4) 3.4.3.2(4c)

Compliance with baseline design criteria, 

criticality monitoring, and alarms

70.64 (if applicable)

70.65(b)(4) 3.4.3.2(4d) 

ISA Methods

ISA method(s) description 70.65(b)(5) 3.4.3.2(5)

ISA team description 70.65(b)(5) 3.4.3.2(5)

Quantitative standards for acute chemical 

exposures

70.65(b)(7) 3.4.3.2(7)

Definition of “unlikely,” “highly unlikely,” and 

“credible” 70.65(b)(9) 3.4.3.2(9)

Hazards and Accident Analysis

Description of processes analyzed 70.65(b)(3) 3.4.3.2(3a)

Identification of hazards 70.65(b)(3) 3.4.3.2(3b)

Description of accident sequences 70.65(b)(3) 3.4.3.2(3c)

Characterization of high- and 

intermediate-consequence accident sequences 70.65(b)(3) 3.4.3.2(3c)

Items Relied on for Safety

List and description of IROFS 70.65(b)(6) 3.4.3.2(6)

Description of IROFS’ link to accident sequences 

to show 10 CFR 70.61 compliance 70.65(b)(6) 3.4.3.2(4) and (6)

IROFS management measures 70.65(b)(4) 3.4.3.2(4b) and (6)

List of sole IROFS 70.65(b)(8) 3.4.3.2(8)
May 2014 3-9 NUREG-1520, Revision 2

1 2. NUREG/CR-6410, “Nuclear Fuel Cycle Facility Accident Analysis Handbook,” issued 

2 March 1998, provides guidance on acceptable methods for evaluating the chemical and 

3 radiological consequences of potential accidents.

4

5 3. NUREG-1601, “Chemical Process Safety at Fuel Cycle Facilities,” issued August 1997, 

6 provides guidance on chemical safety practices acceptable for compliance with the 

7 regulations.

8

9 4. NRC Regulatory Guide 3.74, “Guidance for Fuel Cycle Facility Change Process,” issued 

10 January 2012, discusses requirements in 10 CFR 70.72 and describes the types of 

11 changes for which licensees are to seek prior approval from the NRC before their 

12 implementation.

13

14 3.4.3 Regulatory Acceptance Criteria 

15

16 The acceptance criteria for an ISA are derived from and support compliance with the relevant 

17 requirements of 10 CFR Part 70. The acceptance criteria are intended to support the ultimate 

18 finding of the NRC staff’s review (i.e., that, based on the information submitted, there is 

19 reasonable assurance that the proposed facility, IROFS, safety programs, and management 

20 measures comply with the applicable regulations and provide adequate protection of public 

21 health and safety). Attainment of reasonable assurance that the ISA program is and will be 

22 effective does not usually require that all safety elements and IROFS be reviewed in full detail, 

23 nor is it required that the applicant’s description of IROFS and process designs be at the level of 

24 detail that will eventually exist at the time of operations (see the discussion of vertical slice 

25 review in Section 3.5). The requisite level of detail to achieve reasonable assurance may vary 

26 among processes, depending on factors such as use of established technology, commitment to 

27 standards, applicant expertise, industry experience, safety margins, and inherent difficulty in 

28 achieving the safety function. However, the underlying requirements for the descriptions are 

29 equivalent for each process and IROFS; namely, “...a description of each process...in sufficient 

30 detail to understand the theory of operation...” (10 CFR 70.65(b)(3)); and “a description of 

31 IROFS...in sufficient detail to understand their functions in relation to the performance 

32 requirements...” (10 CFR 70.65(b)(6)). Thus, the requirements for new technology are no 

33 different than those for old technology, but more explanatory detail may be necessary to meet 

34 the requirements related to “sufficient detail to understand.”

35

36 The SRP is not a substitute for the NRC's regulations, and compliance with it is not required. 

37 The SRP provides one acceptable method for demonstrating compliance with the regulatory 

38 requirements for obtaining a materials license for a fuel cycle facility, though it may not apply in 

39 every case The reviewer should consider the applicant’s commitments in a given area to be 

40 acceptable if the applicant has met the following acceptance criteria or has identified and 

41 justified an acceptable alternative approach.

42

43 3.4.3.1 License-Application and Safety-Program Acceptance Criteria

44

45 This section discusses the acceptance criteria for license commitments pertaining to the 

46 facility’s safety program, including the performance of an ISA. For each component of the 

47 safety program, several elements may be necessary, including organization, assignment of 

48 responsibilities, management policies, required activities, written procedures for activities, use of 

49 industry consensus standards, and technical safety practices, among others.

50
May 2014 3-10 NUREG-1520, Revision 2

1 Procedures and industry standards for hardware safety controls vary according to the type of 

2 equipment and by the degree of reliability and performance required in specific applications. 

3 For this reason, blanket commitments to apply all standards in all cases may not appear in the 

4 license application. However, some standards for engineering practices and hardware and 

5 software design or analysis are generic. Hence, an applicant may specify a general 

6 commitment to such a generic standard or may make conditional commitments to standards, 

7 subject to specified applicability criteria, to support likelihood or other performance evaluations 

8 for compliance with the regulations. NRC guidance has endorsed some standards, possibly 

9 with exceptions. Such commitments to standards are acceptable if they are consistent with their 

10 use in demonstrating compliance and with specific NRC guidance.

11

12 Among those engineering practices and standards that are generically applicable to IROFS and 

13 safety controls are those that apply to personnel activities relevant to administrative controls, 

14 management measures, or human/machine interfaces. This area is called human-factors 

15 engineering. Human-factors engineering should generally be part of the safety program. 

16 Human-factors practices should be incorporated in the applicant’s safety program sufficiently to 

17 ensure that IROFS and management measures perform their functions in meeting the 

18 requirements of 10 CFR Part 70. Appendix E to this chapter describes areas of review and 

19 acceptance criteria for human factors engineering in the context of 10 CFR Part 70 for fuel cycle 

20 facilities.

21

22 The applicant’s commitments for each of the three elements of the safety program defined in 

23 10 CFR 70.62(a) should be acceptable if the applicant does the following:

24

25 (1) Process Safety Information

26

27 a. The applicant commits to compiling and maintaining an up-to-date database of 

28 process safety information. Written process safety information will be used in 

29 updating the ISA and in identifying and understanding the hazards associated 

30 with the processes. The compilation of written process safety information should 

31 include information pertaining to the following:

32

33 i. The description of hazards of all materials used or produced in the 

34 process, which should include information on those chemical and physical 

35 properties (such as toxicity, acute exposure limits, reactivity, and 

36 chemical and thermal stability) that are included on Material Safety Data 

37 Sheets (meeting the requirements of 29 CFR 1910.1200(g)).

38

39 ii. The discussion of the technology of the process should include a block 

40 flow diagram or simplified process flow diagram, a brief outline of the 

41 process chemistry, safe upper and lower limits for controlled parameters 

42 (e.g., temperature, pressure, flow, and concentration), and evaluation of 

43 the health and safety consequences of process deviations.

44

45 iii. The description of the equipment used in the process should include 

46 general information on topics such as the materials of construction, piping 

47 and instrumentation diagrams, ventilation, design codes and standards 

48 employed, material and energy balances, IROFS (e.g., interlocks, 

49 detection, or suppression systems), electrical classification, and relief 

50 system design and design basis.

51
May 2014 3-11 NUREG-1520, Revision 2

1 b. The applicant commits to engage personnel with appropriate experience and 

2 expertise in engineering and process operations to maintain the ISA. The ISA 

3 team for a process should consist of individuals who are knowledgeable in the 

4 facility’s ISA methods and the operation, hazards, and safety design criteria of 

5 the particular process.

6

7 (2) ISA

8

9 a. The applicant conducts and commits to maintaining an ISA of appropriate 

10 complexity for each process, such that it identifies (i) radiological hazards, 

11 (ii) chemical hazards that could increase radiological risk, (iii) facility hazards that 

12 could increase radiological risk, (iv) potential accident sequences, 

13 (v) consequences and likelihood of each accident sequence, and (vi) IROFS,

14 including the assumptions and conditions under which they support compliance 

15 with the performance requirements of 10 CFR 70.61. The application is 

16 acceptable if it describes sufficiently specific methods and criteria that would be 

17 effective in accomplishing each of these tasks. Such effective methods and 

18 criteria are described in NUREG-1513, NUREG/CR-6410, item (5) of 

19 Section 3.4.3.2 of this SRP, and Appendix A to this chapter.

20

21 b. The applicant commits to keeping the ISA and its supporting documentation 

22 accurate and up to date by means of a suitable configuration-management 

23 system and to submitting changes to the ISA summary to the NRC, in 

24 accordance with 10 CFR 70.72(d)(1) and (3). The ISA must account for any 

25 changes made to the facility or its processes (e.g., changes to the site, operating 

26 procedures, or control systems). Management policies, organizational 

27 responsibilities, revision timeframe, and procedures to perform and approve 

28 revisions to the ISA should be outlined succinctly.

29

30 c. The applicant commits to training personnel in the facility’s ISA methods and/or 

31 using suitably qualified personnel to update and maintain the ISA and ISA 

32 summary. For any revisions to the ISA, the applicant commits to using personnel 

33 with qualifications similar to those of ISA team members who conducted the 

34 original ISA.

35

36 d. The applicant commits to evaluating proposed changes to the facility or its 

37 operations by means of the ISA methods and to designating new or additional 

38 IROFS and appropriate management measures as required. The applicant also 

39 agrees to promptly evaluate the adequacy of existing IROFS and associated 

40 management measures and to make any required changes that may be affected 

41 by changes to the facility and/or its processes. If a proposed change results in a 

42 revised accident sequence in the ISA summary or increases the consequences 

43 and/or likelihood of a previously analyzed accident sequence within the context 

44 of 10 CFR 70.61, the applicant commits to promptly evaluating the adequacy of 

45 existing IROFS and associated management measures and to making necessary 

46 changes, if required.

47

48 e. The applicant commits to addressing any unacceptable performance deficiencies

49 in the IROFS that are identified through updates to the ISA.

50
May 2014 3-12 NUREG-1520, Revision 2

1 f. The applicant commits to maintaining written procedures onsite. The applicant 

2 also includes procedures and criteria for changing the ISA, along with a 

3 commitment to design and implement a facility-change mechanism that meets 

4 the requirements of 10 CFR 70.72.

5

6 g. The applicant commits to establishing all IROFS (if not already established) and 

7 to maintaining them so that they are available and reliable when needed.

8

9 h. In citing industry consensus standards, the applicant should delineate specific 

10 commitments in the standards that will be adopted. The applicant should provide 

11 justification if it has not adopted all of the required elements of a standard.

12

13 (3) Management Measures

14

15 The applicant commits to establishing management measures (which are evaluated 

16 using SRP Chapter 11) that constitute the principal mechanism for ensuring the reliability 

17 and availability of each IROFS. Management measures applied to an IROFS may be 

18 graded commensurate with the safety significance of their safety function.

19

20 When evaluating the safety significance of an IROFS and its safety function in order to 

21 enable the graded application of management measures, the staff review should 

22 consider the risk characteristics, likelihood, and consequences of both the IROFS and 

23 the accident sequence that the IROFS is included in, as described below.

24

25 a. Typical likelihood criteria could include items such as:

26

27 i. The frequency of the initiating event of the accident sequence 

28 containing the IROFS.

29

30 ii. The individual reliability of the IROFS.

31

32 iii. The surveillance and maintenance of the IROFS.

33

34 iv. The safety margin from normal operations to the safety limit of the 

35 parameters controlled by the IROFS.

36

37 b. The consequence criteria could evaluate:

38

39 i. The monitoring versus controlling function of the IROFS to prevent 

40 possible consequences.

41

42 ii. The consequences associated with the individual IROFS safety function

43 failure and whether there is single failure criteria or double contingency 

44 requirements.

45

46 iii. The safety margin from the safety limit to the event consequences.

47

48 iv. Any additional protection features or defense in depth associated with the 

49 accident sequence.
May 2014 3-13 NUREG-1520, Revision 2

1 3.4.3.2 Acceptance Criteria for the Integrated Safety Analysis Summary

2

3 The following acceptance criteria address each of the content elements of the ISA summary 

4 required by 10 CFR 70.65(b). For new facilities, the reviewer should also evaluate those 

5 aspects of the design that address the baseline design criteria of 10 CFR 70.64 applicable to 

6 individual processes. Information in the ISA summary should provide the basis for the reviewer 

7 to conclude that there is reasonable assurance that the applicant’s ISA program has the 

8 capability to identify appropriate IROFS and that IROFS identified in the ISA summary are 

9 adequate to control the potential accidents of concern at the facility so that the performance 

10 requirements of 10 CFR 70.61 can be met. The accidents of concern are those that would have

11 consequences at the high and intermediate levels, absent any preventive or mitigative controls. 

12 To support such a review, the ISA summary must include sufficient information about an 

13 accident sequence and the proposed IROFS to allow the reviewer to assess the contributions of 

14 the IROFS to prevention or mitigation.

15

16 Detailed acceptance criteria for each element of the ISA summary are described below:

17

18 (1) Site. The description in the ISA summary of the site for processing nuclear material, as 

19 required by 10 CFR 70.65(b)(1), is considered acceptable if the applicant includes or 

20 references, the following safety-related information, with emphasis on those factors that 

21 could affect safety:

2223

24 a. A description of the site geography (including its location, taking into account 

25 prominent natural and manmade features such as mountains, rivers, reservoirs, 

26 airports, population centers, possibly hazardous commercial and manufacturing 

27 facilities, transportation routes, etc.) that is adequate to permit evaluation of 

28 (i) the likelihoods of accidents caused by external factors and (ii) the 

29 consequences of potential accidents.

30

31 b. Population information, based on the most recent census data, that shows 

32 population distribution as a function of distance from the facility, adequate to 

33 permit evaluation of regulatory requirements, including exposure of the public to 

34 consequences listed in 10 CFR 70.61.

35

36 c. Characterization of natural phenomena (e.g., tornadoes, hurricanes, floods, and 

37 earthquakes) and other external events that is sufficient to allow assessment of 

38 their impact on facility safety and their likelihood of occurrence.

39

40 (2) Facility. The description of the facility, as required by 10 CFR 70.65(b)(2), is considered 

41 acceptable if the applicant identifies and describes the general features that affect the 

42 reliability or availability of IROFS. If such information is available elsewhere in the 

43 application, reference to the appropriate sections is considered acceptable. The 

44 information provided should adequately support an overall understanding of the facility 

45 structure and its general arrangement. At a minimum, the applicant should adequately 

46 identify and describe the following:

47

48 a. the facility location and the distance from the site boundary in all directions, 

49 including the distance to the nearest resident and distance to boundaries in the 

50 prevailing wind directions

51

52 b. restricted-area and controlled-area boundaries
May 2014 3-14 NUREG-1520, Revision 2

1

2 c. design information regarding the resistance of the facility to failures caused by 

3 credible external events, when those failures may produce consequences 

4 exceeding those identified in 10 CFR 70.61

56

7 d. the location and arrangement of buildings on the facility site

8

9 e. local site information such as elevations and soil types and depths, if needed to 

10 support safety evaluations

11

12

13 (3) Processes, Hazards, and Accident Sequences. The description of the processes, 

14 hazards, and accident sequences, as required by 10 CFR 70.65(b)(3), are acceptable if 

15 the following criteria are met:

16

17 a. Processes. The descriptions of processes in the ISA summary must include all 

18 processes in which upset conditions could credibly lead to accidents with high or 

19 intermediate consequences. No areas or processes can be omitted, unless 

20 screened out because the accidents are non-credible. The description in the 

21 ISA summary of the processes analyzed as part of the ISA 

22 (10 CFR 70.62(c)(1)(i) through (vi)) is considered acceptable if it describes the 

23 following features in sufficient detail to permit an understanding of the theory of 

24 operation and to assess compliance with the performance requirements of 

25 10 CFR 70.61. A description at a systems level is acceptable, provided that it 

26 permits the NRC reviewer to adequately evaluate (1) the completeness of the 

27 hazard and accident identification tasks and (2) the likelihood and consequences 

28 of the accidents identified. The descriptions of processes must permit an 

29 understanding of how the set of IROFS in that process could reliably perform 

30 their safety function for each high- and intermediate-consequence accident 

31 sequence. If the information is available elsewhere in the application and is 

32 adequate to support the purposes of the ISA summary, reference to the 

33 appropriate sections is considered acceptable.

34

35 The level of detail in process safety documentation held at the site would 

36 normally be greater than the descriptions in the ISA summary and may include 

37 some or all of the information listed as items i through iv below, as needed.

38

39 i. Basic process function and theory includes a general discussion of the 

40 basic theory of the process. Normally, this would include the following:

41

42 • parameters to be controlled and strategy for complying with 

43 10 CFR 70.61

44

45 • chemical or mechanical theory principles, materials, and quantities 

46 needed to understand the hazards and safety functions

47

48 • normal and potential transport and changes in materials in the 

49 process

50

51 ii. Major components include the general arrangement, function, and 
May 2014 3-15 NUREG-1520, Revision 2

1 operation of major components in the process. If appropriate, it could 

2 also include arrangement drawings and process schematics showing the 

3 major components and instrumentation, and flowsheets showing 

4 compositions of the various process streams.

5

6 iii. Process design and equipment include a discussion of process design, 

7 equipment, and instrumentation that is sufficiently detailed to permit an 

8 adequate understanding of the results of the ISA. As appropriate, it 

9 includes schematics indicating safety interrelationships of parts of the 

10 process. In particular, it is usually necessary for criticality safety to 

11 diagram the location and geometry of the fissile and other materials in the 

12 process, for both normal and bounding abnormal conditions. This can be 

13 done using either schematic drawings or textual descriptions indicating 

14 the location and geometry of fissile materials, moderators, etc., sufficient 

15 to permit an understanding of how the IROFS limit the mass, geometry, 

16 moderation, reflection, and other factors.

17

18 iv. Process safety limits and margins on variables (e.g., temperatures, 

19 pressures, flows, fissile mass, enrichment, and composition) that are 

20 controlled by IROFS to ensure safe operations of the process should be 

21 specified, because these limits and margins would be needed to 

22 understand the likelihood of failure assigned by the applicant to the 

23 IROFS. For example, if a process is designed, and an IROFS procedure 

24 specified, to ensure critical mass control by double-batching proof, the 

25 margin from a single batch to the subcritical limit should be specified. 

26 Traditionally, the single batch is 45 percent of the subcritical limit.

27

28 b. Hazards. The description of process hazards provided in the ISA summary is 

29 acceptable if it identifies, for each process, all types of hazards that are relevant 

30 to determining compliance with the performance criteria of 10 CFR 70.61. 

31 For the reviewer to be able to determine completeness of the description of 

32 process hazards information, the applicant should identify all hazards that could 

33 result in an accident sequence in which the consequences could exceed the 

34 performance requirements of 10 CFR 70.61 should be listed, even if later 

35 analysis of a particular hazard shows that resulting accident sequences do not 

36 exceed these limits. General exclusion from consideration of certain hazards for 

37 an entire facility can be justified by bounding case analyses showing that, for the 

38 conditions or credible inventories onsite, the performance requirements of 

39 10 CFR 70.61 cannot be exceeded. In this case, the bounding inventories or 

40 conditions, if under the control of the applicant, become IROFS.

41

42 Any locations where hazardous regulated material, including fissile material, 

43 could accidentally be located should also be considered. Improper screening out 

44 of locations and processes that are not normally hazardous, but that could 

45 become so in upset conditions, can lead to a failure to apply IROFS to prevent 

46 such upsets and potential accidents arising from them.

47

48 The list of process hazards is acceptable if the ISA summary provides the 

4950 following information:

51

52 i. a list of materials (radioactive, fissile, flammable, and toxic) or conditions 
May 2014 3-16 NUREG-1520, Revision 2

1 that could result in hazardous situations (e.g., loss of containment of 

2 licensed nuclear material), including the maximum intended inventory 

amounts and locations of the hazardous materials at the facility 3 3

4

5 ii. potential interactions among materials or conditions that could result in 

6 hazardous situations

7

8 c. Accident Sequences. The general description of types of accident sequences in 

9 the ISA summary is acceptable if the reviewer can determine the following:

10

11 i. The applicant has identified all types of accidents for which the 

12 consequences could exceed the performance requirements of 

13 10 CFR 70.61. The level of detail required in describing accidents is 

14 closely related to the level of detail in describing IROFS, as many events 

15 leading to consequences of concern in 10 CFR 70.61 are failures of 

16 IROFS. It is not usually necessary to specify all modes and mechanisms 

17 by which the IROFS failure could occur in order to understand the role 

18 that the IROFS plays in preventing or mitigating the accident.

19

20 ii. The applicant has identified how the IROFS listed in the ISA Summary 

21 protect against each such type of accident. 

22

23 To satisfy the requirement that all accidents be identified, the applicant should 

24 describe the process design in sufficient detail to demonstrate how each 

25 category of high- and intermediate-consequence events are made highly unlikely 

26 or unlikely. In particular, all IROFS need to be specified.

27

28 It is not generally acceptable as a description of an accident to merely list the 

29 type of hazard, or the controlled parameters, without referencing the items relied 

30 on to control the parameters or hazard. The description of general types of 

31 accident sequences is acceptable if it covers all types of sequences, initiating 

32 events, and IROFS failures. Initiating events can be (1) an external event such 

33 as a hurricane or earthquake, (2) a facility event external to the process being 

34 analyzed (e.g., fires, explosions, failures of other equipment, or flooding from 

35 facility water sources), (3) deviations from normal operations of the process 

36 (credible abnormal events), or (4) failures of an IROFS in the process. Human 

37 errors that are initiating events would generally be administrative IROFS failures. 

38 The description of a general type of accident sequence is acceptable if it permits 

39 the reviewer to determine how each accident sequence for which the 

40 consequences could exceed the performance requirements of 10 CFR 70.61 is 

41 protected against by IROFS or a system of IROFS.

42

43 One acceptable way to do this is to show a fault tree on which the basic events 

44 are IROFS failures. Another acceptable method is to provide a table in which 

45 each row displays the events in an accident sequence, such as in Appendix A to 

46 this chapter, Table A-7, where, in general, each event is a failure of an IROFS. 

 3 At a minimum, the inventory list should include the following hazardous materials if they are present onsite: 

ammonia, fines (uranium oxide dust, beryllium), flammable liquids and gases, fluorine, hydrofluoric acid, 

hydrogen, nitric acid, organic solvents, propane, uranium hexafluoride, and Zircaloy.
May 2014 3-17 NUREG-1520, Revision 2

1 Another acceptable way is to provide a narrative summary for each process 

2 describing the sequence of events in each type of accident.

3

4 To demonstrate completeness, the process hazard analysis identifying general 

5 types of accident sequences must use systematic methods and consistent 

6 references. Therefore, each description of a general type of accident sequence 

7 is acceptable if it meets the following criteria:

89

10 − An acceptable method of hazard identification and process hazard 

11 analysis is used in accordance with the criteria of NUREG-1513.

12

13 − The selected method is correctly applied.

14

15 − The applicant does not overlook any type of accident sequence for which 

16 the consequences could exceed the performance requirements of 

17 10 CFR 70.61. A key test of whether a type of accident has been 

18 overlooked is whether IROFS have been identified to meet the 

19 performance requirements.

20

21 − The applicant uses a method of identifying facility processes that ensures

22 identification of all processes.

23

24 During the early phases of an ISA, accidents will be identified for which the 

25 consequences may initially be unknown. These accidents will later be analyzed 

26 and may be shown to have consequences that are less than the levels identified 

27 in 10 CFR 70.61.

28

29 General types of accident sequences differ if they consist of a different set of 

30 IROFS failures. The ISA summary need not list as a separate type of accident 

31 sequence, every conceivable permutation of an accident. Several processes, 

32 each using a set of IROFS that is functionally of the same type (e.g., having the 

33 same mechanical, physical, and/or electrical principle of operation) and fall in the 

34 same categories, can be grouped as a single type of accident in the 

35 ISA summary provided that the following conditions are met:

36

37 − The initiating IROFS failures or events have the same effect on the 

38 system.

39

40 − They all consist of failures of the same IROFS or system of IROFS.

41

42 − They all result in violation of the safety limit on the same parameter.

43

44 − They all result in the same type and severity categories of consequences. 

4546

47 (4) Information Demonstrating Compliance with the Performance Requirements of 

48 10 CFR 70.61, as required by 10 CFR 70.65(b)(4), is considered acceptable if the 

49 following criteria are met.

50

51 a. Accident Sequence Evaluation and IROFS Designation. Because the 

52 requirements of 10 CFR 70.61 are expressed in terms of consequences and 
May 2014 3-18 NUREG-1520, Revision 2

1 likelihoods of events, the ISA summary should provide sufficient information to 

2 demonstrate that credible high-consequence events are highly unlikely, credible 

3 intermediate-consequence events are unlikely, and under normal and credible 

4 abnormal conditions, all nuclear processes are subcritical.

5

6 The performance requirements of 10 CFR 70.61 have three elements, including 

7 completeness, consequences, and likelihood. To be acceptable, the information 

8 provided must correspond to the ISA methods, consequence, and likelihood 

9 definitions described in the submittal. The information must also show the basis 

10 for and results of applying these methods to each process. In addition, the 

11 information must show that the methods have been properly applied in each 

12 case.

13

14 The information showing completeness, consequences, and likelihood for 

15 accident sequences can be presented in various formats, including logic 

16 diagrams, fault trees, or tabular summaries. Appendix A to this chapter shows 

17 one example of how an application can present this information.

18

19 Each of these performance requirements (completeness, consequences, and 

20 likelihood) is discussed below.

21

22 i. Completeness refers to the requirement that the ISA address each

23 credible event. It is demonstrated by correctly applying an appropriate 

24 accident identification method, as described in NUREG-1513. 

25 Completeness can be effectively displayed by using an appropriate 

26 diagram or description of the identified accidents.

27 ii. Consequence refers to the magnitude of the chemical and radiological 

28 doses of the accident and is the basis for classification of an accident as 

29 a high- or intermediate-consequence event. The information in the 

30 ISA summary is acceptable for showing compliance with 10 CFR 70.61 

31 provided that the following conditions are met:

32

33 • For each accident for which the consequences could exceed the 

34 performance requirements of 10 CFR 70.61, the ISA summary 

35 includes an estimate of its quantitative consequences (doses, 

36 chemical exposures, criticality) in a form that can be directly 

37 compared with the consequence levels in 10 CFR 70.61 or 

38 includes a reference to a value documented elsewhere in the 

39 ISA summary that applies to or bounds that accident.

40

41 • The consequences were calculated using a method and data 

42 consistent with NUREG/CR-6410, or another method described 

43 and justified in the methods description section of the 

44 ISA summary.

45

46 • All consequences that could result from the accident sequence 

47 have been evaluated. That is, if an accident can result in a range 

48 of consequences, all possibilities must be considered, including 

49 the maximum source term and most adverse weather that could 

50 occur. In other words, because of possible variations in weather 

51 or other conditions, the consequences of a type of potential 
May 2014 3-19 NUREG-1520, Revision 2

1 accident may vary. If, for some such conditions, the 

2 consequences will be high, then the subset of such accidents 

3 resulting in high consequences are a “high consequence accident 

4 sequence” in the ISA, even though for average conditions, such 

5 high consequences would not result. If such conditions are 

6 unlikely to occur, credit can be taken for this in the evaluation of 

7 likelihood.

8

9 • The ISA summary correctly assigns each type of accident to one 

10 of the consequence categories of 10 CFR 70.61 (namely, high or 

11 intermediate).

12

13 Unshielded nuclear criticality accidents are considered to be 

14 high-consequence events, because the radiation exposure that an 

15 individual could receive exceeds the acute 1-sievert (Sv) 

16 (100-rem) dose established by 10 CFR 70.61(b)(1). 

17 For processes with effective engineered shielding, criticalities may 

18 actually produce doses below the intermediate consequences of 

19 10 CFR 70.61. As stated in 10 CFR 70.61(d), such processes 

20 must nevertheless be subcritical for all normal and credible 

21 abnormal conditions, and primary reliance must be on prevention. 

22 This applies notwithstanding shielding or other mitigative features. 

23 If needed, NUREG/CR-6410 and NUREG/CR-6504 provide 

24 methods for estimating the magnitudes of criticality events that 

25 can be applied for workers or members of the public at varying 

26 distances from the event.

27

28 iii. Likelihood refers to the requirement in 10 CFR 70.61 that 

29 intermediate-consequence events be “unlikely” and high-consequence 

30 events be “highly unlikely. The information in the ISA summary is 

31 acceptable if the following conditions are met:

3233

34 • The ISA summary specifies the likelihood of each general type of 

35 accident sequence that could exceed the performance 

36 requirements of 10 CFR 70.61.

37

38 • The likelihoods are derived using an acceptable method described 

39 in the ISA summary’s section on methods.

40

41 • The likelihoods comply with acceptable definitions of the terms 

42 “unlikely” and “highly unlikely,” as described in this SRP chapter. 

43 When interpreted as required accident frequencies, these terms 

44 refer to long-run average frequencies, not instantaneous values. 

45 That is, a system complies with the performance requirements of 

46 10 CFR 70.61 as a long-run average. Otherwise, failure of any 

47 IROFS, even for a very short period, would violate the 

48 requirement, which is not the intent.

4950

51 b. Management Measures. The ISA summary must include a description of the

52 management measures to be applied to IROFS, as well as information necessary 
May 2014 3-20 NUREG-1520, Revision 2

1 to demonstrate compliance with the performance requirements of 10 CFR 70.61. 

2 Chapter 11 of this SRP provides detailed criteria for use in evaluating the 

3 adequacy of such management measures.

4

5 c. Criticality Monitoring. The ISA summary must include the requirements for 

6 criticality monitoring and alarms in 10 CFR 70.24. The regulation in 

7 10 CFR 70.24 defines specific sensitivity and coverage requirements for criticality 

8 monitors. Chapter 5 of this SRP describes the acceptance criteria and review of 

9 information supporting a demonstration of compliance with 10 CFR 70.24.

10

11 Specific emergency preparations are also required by 10 CFR 70.24. The 

12 application should provide information to demonstrate that the applicant’s 

13 equipment and procedures are adequate to meet these requirements.

14

15 d. Requirements for New Facilities or New Processes at Existing Facilities. The 

16 baseline design criteria specified in 10 CFR 70.64 must be used, as applicable, 

17 for new facilities and new processes at existing facilities. If the application 

18 involves such new facilities or processes, the ISA summary should explain how

19 the design of the facility addresses each baseline design criterion. For 

20 deterministic design criteria such as double contingency, the process-specific 

21 information may be provided, along with the other process information in the 

22 ISA summary. The application should also describe the design-basis events and 

23 safety-parameter limits. In addition, the application should provide methods, 

24 data, and results of analysis showing compliance with these design bases for 

25 individual processes and facilities.

26

27 The regulation in 10 CFR 70.64 states that the design process must be founded 

28 on defense-in-depth principles and must incorporate, to the extent practicable, 

29 preference for engineered controls over administrative controls and reduction of 

30 challenges to IROFS. Because of this regulation, new facilities with system 

31 safety designs lacking defense-in-depth practices, consisting of purely 

32 administrative controls, or relying on IROFS that are frequently or continuously 

33 challenged, are not acceptable, unless the application provides a justification 

34 showing that alternatives to achieve the design criteria are not feasible.

35

36 (5) ISA Team Qualifications and ISA Methods.

37

38 a. The description of the ISA team and qualifications, as required by 

39 10 CFR 70.65(b)(5), is acceptable if the following criteria are met:

40

41 i. The ISA team has a leader who is formally trained and knowledgeable in 

42 the ISA methods chosen for the hazard and accident evaluations. In 

43 addition, the team leader should have an adequate understanding of all 

44 process operations and hazards under evaluation but should not be the 

45 responsible, cognizant engineer or expert for that process.

46

47 ii. At least one member of the ISA team has thorough, specific, and detailed 

48 experience in the type of process design under evaluation.

49

50 iii. The team has a variety of process design and safety experience in the 

51 particular safety disciplines relevant to hazards that could credibly be 
May 2014 3-21 NUREG-1520, Revision 2

1 present in the process, including, if applicable, radiation safety, nuclear 

2 criticality safety, fire protection, and chemical safety disciplines.

3

4 iv. A manager provides overall administrative and technical direction for the 

5 ISA.

6

7 b. The description of the ISA methods is acceptable if the following criteria are met:

8

9 i. Hazard Identification Method. The hazard identification method selected 

10 is considered acceptable if it meets the following criteria:

11

12 • The description includes a list of materials (radioactive, fissile, 

13 flammable, and toxic) and conditions that could result in 

14 hazardous situations (e.g., loss of containment of licensed nuclear 

15 material). The list should include maximum intended inventory 

16 amounts and the location of the hazardous materials at the facility.

17

18 • The method has determined potential interactions between 

19 materials or upset conditions that could result in hazardous 

20 situations where not normally present.

21

22 ii. Process Hazard Analysis Method. The process hazard analysis method 

23 is acceptable if it involves selecting one of the methods described in 

24 NUREG-1513 in accordance with the selection criteria established in that 

25 document. Methods not described in NUREG-1513 may be acceptable 

26 provided that they fulfill the following conditions:

27

28 • Criteria are provided for their use for an individual process and are 

29 consistent with the principles of the selection criteria in 

30 NUREG-1513.

31

32 • The method adequately addresses all the hazards identified in the 

33 hazard identification task. If an identified hazard is eliminated 

34 from further consideration, such action is justified.

35

36 • The method provides reasonable assurance that the applicant can 

37 identify all significant accident sequences (including the IROFS 

38 used to prevent or mitigate the accidents) that could exceed the 

39 performance requirements of 10 CFR 70.61.

40

• The method considers the interactions of identified hazards 4 41 and 

42 proposed IROFS, including system interactions that could result in 

43 an accident sequence for which the consequences could exceed 

44 the performance requirements of 10 CFR 70.61.

45

 4 The release of hazardous chemicals is within the NRC’s jurisdiction to the extent that such hazardous 

releases have a nexus to the processing of licensed nuclear material or have the potential to adversely 

affect radiological safety.
May 2014 3-22 NUREG-1520, Revision 2

1 • The method addresses all modes of operation, including startup, 

2 normal operation, shutdown, and maintenance.

3

4 • The method addresses hazards resulting from process deviations 

5 (e.g., high temperature and high pressure), initiating events 

6 internal to the facility (e.g., fires or explosions), and hazardous 

7 credible external events (e.g., floods, high winds, earthquakes, 

8 and airplane crashes). The applicant provides justification for 

9 determinations that certain events are not credible and, therefore, 

10 not subject to the likelihood requirements of 10 CFR 70.61.

11

12 • The method adequately considers initiation of or contribution to 

13 accident sequences by human error through the use of human

14 and systems interface analysis or other appropriate methods.

15

16 • The method adequately considers common-mode failures and 

17 system interactions in evaluating systems that rely on redundant 

18 controls.

19

20 • The ISA summary provides justification that the individual method 

21 would comply with conditions (ii) through (viii) above.

22

23 c. Consequence Analysis Method. The methods used for ISA consequence 

24 evaluation, as described in the ISA summary, are acceptable, provided that the 

25 following conditions are met:

26

27 i. The methods are consistent with the approaches described in 

28 NUREG/CR-6410.

29

30 ii. The use of generic assumptions and data is reasonably 

31 conservative for the types of accidents analyzed.

32

33 d. Likelihood Evaluation Method. The method for evaluating the likelihood of 

34 accident sequences, as described in the ISA summary, is considered acceptable, 

35 provided that it meets the following conditions:

36

37 i. The method clearly shows how each designated IROFS acts to prevent or 

38 mitigate the consequences (to an acceptable level) of the accident 

39 sequence being evaluated.

40

41 ii. When multiple IROFS are designated for an accident sequence, the 

42 method considers the interaction of all such IROFS, as in a logic diagram 

43 or tabulation that accounts for the impact of redundancy, independence, 

44 and surveillance on the likelihood of occurrence of the accident.

45

46 iii. The method has objective criteria for evaluating, at least qualitatively, the 

47 likelihood of failure of individual IROFS. When applicable, such likelihood 

48 criteria should include the means to limit potential failure modes, the 

49 magnitude of safety margins, the type of engineered equipment (active or 

50 passive) or human action that constitutes the IROFS, and the types and 
May 2014 3-23 NUREG-1520, Revision 2

1 safety grading (if any) of the management measures applied to the 

2 IROFS.

3

4 iv. The method evaluates the likelihood of each accident sequence as 

5 “unlikely,” “highly unlikely,” or neither, as defined by the applicant, in 

6 accordance with Section 3.4.3.2, item (9), of this chapter.

7

8 v. For nuclear criticality accident sequences, the method evaluates 

9 compliance with 10 CFR 70.61(d). That is, even in a facility with 

10 engineered shielding to limit the consequences of nuclear criticalities, 

11 preventive controls must be in place that are sufficient to ensure that the 

12 process is subcritical for all credible abnormal conditions. Compared to 

13 unshielded processes, a moderately higher likelihood may be permitted in 

14 preventing such events that is consistent with American National 

15 Standards Institute/American Nuclear Society (ANSI/ANS) Standard 8.10, 

16 “Criteria for Nuclear Criticality Safety Controls in Operations with 

17 Shielding and Confinement,” reaffirmed in 2005. In particular, criticality 

18 cannot result from any credible failure of a single IROFS. In addition, 

19 potential criticality accidents must meet an approved margin of 

20 subcriticality for safety. Acceptance criteria for such margins are 

21 reviewed as programmatic commitments.

22

23 Appendix A to this chapter provides an example of one acceptable method for evaluating 

24 likelihood that is based on a likelihood index. Appendix B offers additional guidance on 

25 acceptable methods for qualitative evaluation of likelihood. Appendix C discusses 

26 issues relating to the use of initiating event frequencies in demonstrating compliance 

27 with the likelihood requirements. Appendix D discusses acceptable ways for the ISA to 

28 address natural phenomena.

29

30 (6) Descriptive List of All IROFS. The list describing items relied on for safety required by 

31 10 CFR 70.65(b)(6) is acceptable, provided that it meets the following conditions:

32

33 a. The list includes all IROFS in the identified high- and intermediate-consequence 

34 accident sequences.

35

36 b. The description of the IROFS may include management measures applied to the 

37 IROFS (including grading of management measures commensurate with the 

38 reduction in risk); should include the characteristics of its preventive, mitigative, 

39 or other safety function; and may include assumptions and conditions, such as 

40 safety limits or margins.

41

42 The above acceptance criteria are explained in greater detail below.

4344

45 1. The primary function of the list describing each IROFS is to document the safety 

46 basis of all processes in the facility. This list assists in ensuring that the items 

47 (IROFS) are not degraded without a justifying safety review. Thus, the key 

48 feature of this list is that it includes all IROFS. To be acceptable, no item, 

49 control, or control system of a process that is needed to show compliance with 

50 the safety performance requirements of the regulation may be omitted from this 

51 list (see 10 CFR 70.61(e)). However, sets of hardware or procedures that 

52 perform the same safety function may be referred to as a single set of IROFS 
May 2014 3-24 NUREG-1520, Revision 2

1 and do not need to be individually identified. The list of IROFS may erroneously 

2 be incomplete in a number of ways: (1) an ineffective method of identifying 

3 accident sequences may have been used; (2) in applying the method to identify 

4 accidents, something was overlooked; (3) a whole area or process subject to 

5 accidents was improperly screened out or simply omitted from the ISA;

6 (4) IROFS were not applied to an identified accident; or (5) the list of accidents 

7 was incomplete because of incompleteness in the process design itself. The 

8 reviewer should attempt, in the horizontal slice review, to determine if any of 

9 these errors has occurred.

10

11 2. IROFS may be hardware with a dedicated safety function or hardware with a 

12 property that is relied on for safety. Thus, IROFS may be the dimension, shape, 

13 capacity, or composition of hardware. The ISA summary need not provide a 

14 breakdown of hardware IROFS by component or identify all support systems. 

15 However, the ISA documentation maintained onsite, such as system schematics 

16 and/or descriptive lists, should contain sufficient detail about items within 

17 hardware IROFS that it is clear to the reviewer and the applicant what structure, 

18 system, equipment, or component is included within the hardware IROFS’ 

19 boundary and would, therefore, be subject to management measures specified 

20 by the applicant. Some examples of items within a hardware IROFS are 

21 detectors, sensors, electronics, cables, valves, piping, tanks, and dikes. In 

22 addition, ISA documentation should also identify essential utilities and support 

23 systems on which the IROFS depends to perform its intended function. Some 

24 examples of these are backup batteries, air supply, and steam supply. In some 

25 processes, the frequency of demands made on IROFS must be controlled or 

26 limited to comply with 10 CFR 70.61. In such processes, whatever features are 

27 needed to limit the frequency of demands are themselves IROFS.

28

29 3. Sufficient information should be provided about engineered hardware controls to 

30 permit an evaluation verifying that, in principle, controls of this type will have 

31 adequate reliability. Because the likelihood of failure of items often depends on 

32 safety margins, descriptions of the safety parameter controlled by the item, the 

33 safety limit on the parameter, and the margin to true failure may be needed. For 

34 IROFS that are administrative controls, the nature of the action or prohibition 

35 involved must be described sufficiently to permit an understanding that, in 

36 principle, adherence to it should be reliable. Features of the IROFS that affect its 

37 independence from other IROFS, such as reliance on the same power supplies, 

38 should be indicated.

39

40 The description of each IROFS should identify its expected function, conditions 

41 needed for the IROFS to reliably perform its function, and the effects of its failure. 

42 The description of each IROFS within an ISA summary should identify the

43 management measures (such as maintenance, training, and configuration 

44 management) that are applied to it.

45

46 If a system of graded management measures is used, the grade applied to each 

47 control should be determinable from information in the ISA summary. The 

48 reliability required for an IROFS is proportionate to the amount of risk reduction it 

49 is expected to supply. The management measures should ensure that IROFS 

50 are designed, implemented, and maintained, as necessary, to be available and 

51 reliable to perform their function when needed. The degree of reliability and 
May 2014 3-25 NUREG-1520, Revision 2

1 availability of IROFS ensured by these measures should be consistent with the 

2 evaluations of accident likelihoods. In particular, for redundant IROFS, all 

3 information necessary to establish the average vulnerable outage time is 

4 required in order to maintain acceptable availability. Otherwise, failures must be 

5 assumed to persist for the life of the facility. In particular, for IROFS whose 

6 availability is to be relied on, the time interval between surveillance observations 

7 or tests of the item should be stated, since restoration of a safe state cannot 

8 occur until the failure is discovered.

9

10 Table A-13 in Appendix A to this chapter is one example of a tabular description of 

11 IROFS meeting these criteria.

12

13 (7) Quantitative Standards for Chemical Consequences. The applicant’s description in the 

14 ISA summary of proposed quantitative standards used to assess consequences from 

15 acute chemical exposure to licensed material or chemicals incident to the processing of

16 licensed material, as required by 10 CFR 70.65(b)(7), is acceptable provided that the 

17 following criteria are met:

1819

20 a. Unambiguous quantitative standards exist for each of the applicable hazardous 

21 chemicals that meet the criteria on site and for each exposure pathway,

22 corresponding to, and consistent with, the quantitative standards in 

23 10 CFR 70.61(b)(4) and 70.61(c)(4).

24

25 b. The quantitative standard of 10 CFR 70.61(b)(4)(i) addresses exposures that 

26 could endanger the life of a worker. The applicant is appropriately conservative 

27 in applying the language “could endanger,” so as to include exposures that could 

28 result in death for some workers, consistent with the methods used in the 

29 U.S. Environmental Protection Agency’s acute exposure guidelines in 

30 Appendix A, “Table of Toxic Endpoints,” to 40 CFR Part 68, “Chemical Accident 

31 Prevention Provisions.”

3233

34 c. The quantitative standards for 10 CFR 70.61(b)(4)(ii) and 10 CFR 70.61(c)(4)(i) 

35 will correctly categorize all exposures that could lead to irreversible or other 

36 serious, long-lasting health effects to individuals. As with criterion (b) above, the 

37 standard selected should have appropriate conservatism.

38

39 d. The quantitative standard for 10 CFR 70.61(c)(4)(ii) will correctly categorize all 

40 exposures that could cause mild transient health effects to an individual.

41

42 The NRC finds the use of the Emergency Response Planning Guidelines (ERPGs) 

43 established by the American Industrial Hygiene Association, the Acute Exposure 

44 Guideline Levels (AEGLs) established by the National Advisory Committee for Acute 

45 Guideline Levels for Hazardous Substances, and exposure limits established by the 

46 Occupational Safety and Health Administration or contained in International Organization 

47 for Standardization (ISO) standards to be acceptable. If the applicant does not use a 

48 published exposure standard, or if a chemical has an unknown exposure standard, the 

49 ISA summary must describe how an alternative exposure standard was established for 

50 use in the ISA. The ISA summary must list the actual exposure values for each 

51 chemical, specify the source of the data (e.g., ERPG, AEGL, or ISO), and provide 

52 information or a reference supporting the claim that they meet the acceptance criteria 

53 stated above. (See also Section 6.4.3.1 of this SRP.)
May 2014 3-26 NUREG-1520, Revision 2

1

2 (8) List of Sole IROFS. The descriptive list in the ISA summary that identifies all IROFS that 

3 are the sole item credited as such for demonstrating compliance with 10 CFR 70.61, as 

4 required by 10 CFR 70.65(b)(8), is acceptable if it includes the following:

5

6 a. the descriptive title of the IROFS

7

8 b. an unambiguous and clear reference to the process to which the item applies

9

10 c. clear and traceable references to the description of the item as it appears in the 

11 full list of all IROFS and the list of accident sequences

1213

14 (9) Definitions of “Unlikely,” “Highly Unlikely,” and “Credible.” The regulation in 

15 10 CFR 70.65(b)(9) requires that the applicant’s ISA summary must define the terms 

16 “unlikely,” “highly unlikely,” and “credible.” The applicant’s definitions of these terms are 

17 acceptable if, when used with the applicant’s method of assessing likelihoods, they 

18 provide reasonable assurance that the performance requirements of 10 CFR 70.61 can 

19 be met. The applicant’s method of likelihood evaluation and the definitions of the 

20 likelihood terms are closely related. Qualitative methods require qualitative definitions. 

21 Such a qualitative definition would identify the qualities of IROFS controlling an accident 

22 sequence that would qualify that sequence as “unlikely” or “highly unlikely.”

23

24 An applicant may use quantitative methods and definitions for evaluating compliance 

25 with 10 CFR 70.61, but nothing in this SRP should be construed as an interpretation that 

26 such methods are required. The reviewer should focus on objective qualities and 

27 information provided concerning accident likelihoods.

28

29 As stated in 10 CFR 70.61, credible high-consequence events must be “highly unlikely.” 

30 Thus, the meaning of the phrase “highly unlikely” is on a per-event basis. The same is 

31 true for the terms “unlikely” and “credible.” Hence, applicant definitions should be on a 

32 per-event basis. The events referred to are occurrences of consequences, which are 

33 synonymous with the phrase “accident sequence” in this context. This is important to 

34 recognize, since an ISA may identify hundreds of potential accident sequences. Thus, 

35 the likelihood of each individual sequence must be quite low.

36

37 a. Acceptance Criteria for the Definition of “Credible”

38

39 This term is used in 10 CFR 70.61, which requires that all credible accident 

40 sequences for which the consequences could exceed the performance 

41 requirements of 10 CFR 70.61 must be controlled to be unlikely or highly unlikely, 

42 as appropriate. If an event is not credible, IROFS are not required to prevent or 

43 mitigate the event. Thus, to be “not credible” could be used as a criterion for 

44 exemption from use of IROFS. This raises a danger of circular reasoning. In the 

45 safety program embodied in Subpart H to 10 CFR Part 70, the “not credible”

46 nature of an event must not depend on any facility feature that could credibly fail 

47 to function or be rendered ineffective as a result of a change to the system. Each

48 facility feature that is needed to ensure that accident events are sufficiently 

49 unlikely is an IROFS. Management measures must offer high assurance that 

50 such features are not removed or rendered ineffective during system changes. 

51 One cannot claim that a process does not need IROFS because it is “not 

52 credible” due to characteristics provided by some other controls or features of the 
May 2014 3-27 NUREG-1520, Revision 2

1 plant that are not IROFS. Such an evaluation would be inconsistent with 

2 10 CFR 70.61. However, although an accident sequence may not meet a 

3 definition of “not credible,” it may meet the standards for “highly unlikely” or 

4 “unlikely” because of an infrequent external initiating event without the use of 

5 IROFS. In such a case, IROFS are not necessary, but information is needed to 

6 show that the event does qualify as “highly unlikely” or “unlikely.”

7

8 Any one of the following three independent acceptable sets of qualities could 

9 define an event as not credible:

1011

12 i. An external event has a frequency of occurrence that can conservatively 

13 be estimated as less than once in a million years.

14

15 ii. A process deviation consists of a sequence of many unlikely events or 

16 errors for which there is no reason or motive. In determining that there is 

17 no reason for such errors, a wide range of possible motives, short of 

18 intent to cause harm, must be considered. Complete ignorance of safe 

19 procedures is possible for untrained personnel, which should be 

20 considered a credible possibility. Obviously, no sequence of events 

21 should be categorized as not credible if it has actually occurred in any fuel 

22 cycle facility.

23

24 iii. A convincing argument exists that, given physical laws, process 

25 deviations are not possible, or are extremely unlikely. The validity of the 

26 argument must not depend on any feature of the design or materials 

27 controlled by the facility’s system of IROFS or management measures.

28

29 Such a demonstration of “not credible” must be convincing despite the absence 

30 of designated IROFS. Typically, this can be achieved only for external events 

31 known to be extremely unlikely.

32

33 b. Acceptance Criteria for Qualitative Definitions of “Likelihood”

34

35 If the applicant’s definitions are qualitative, they are acceptable if they meet all of 

36 the following criteria:

3738

39 i. They are reasonably clear and based on objective criteria.

40

41 ii. They can reasonably be expected to consistently distinguish accidents 

42 that are “highly unlikely” from those that are merely “unlikely.”

43

44 iii. Their categorization of events as “highly unlikely” or “unlikely” yields 

45 results reasonably consistent with quantitative information and 

46 quantitative criteria such as those given in the example here.

47

48 The phrase “objective criteria” means the extent to which the method relies on 

49 specific identifiable characteristics of a process design, rather than subjective 

50 judgments of adequacy. Objective criteria are needed to achieve consistency. 

51 “Consistency” means the degree to which different analysts obtain the same 

52 results when they apply the method. This is important in maintaining an 

53 adequate standard of safety because the ISAs of future facility modifications may 
May 2014 3-28 NUREG-1520, Revision 2

1 be performed by individuals not involved in conducting the initial ISA. An 

2 acceptable qualitative method of likelihood evaluation should yield results 

3 comparable to the examples of evaluation methods given in the appendices to 

4 this chapter.

5

6 c. Reliability and Availability Qualities

7

8 Qualitative methods of evaluating the likelihood of an accident sequence involve 

9 identifying the reliability and availability qualities of each of the events that 

10 constitute the sequence. The following lists of qualities are not necessarily 

11 complete, but they do contain many of the factors most commonly encountered. 

12 Some of these qualities relate to the characteristics of individual IROFS:

1314

15 i. safety margin in the controlled parameter, compared with process 

16 variation and uncertainty

17

18 ii. whether the IROFS is an active engineered control, a passive engineered 

19 control, an administrative control, or an enhanced administrative control

20

21 iii. the type and safety grading, if any, of management measures applied to 

22 the control

23

24 iv. fail-safe, self-announcing, or surveillance measures to limit downtime

25

26 v. failure modes

27

28 vi. demand rate

29

30 vii. failure rate

31

32 Other reliability qualities relate to characteristics of the IROFS or system of 

33 IROFS that protect against the following accident sequences as a whole, among 

34 others:

35

36 − defense in depth

37 − degree of redundancy

38 − degree of independence

39 − diversity

40 − vulnerability to common-cause failure

41

42 Methods of likelihood evaluation and definitions of the likelihood terms “unlikely” 

43 and “highly unlikely” may mix qualitative and quantitative information. Certain 

44 types of objective quantitative information may be available concerning specific 

45 processes in a facility. Examples of such objective quantitative information 

46 include the following:

4748

49 − reports of failure modes of equipment or violations of procedures 

50 recorded in maintenance records or corrective-action programs

51
May 2014 3-29 NUREG-1520, Revision 2

1 − the time intervals at which surveillance is conducted to detect failed 

2 conditions

3

4 − the time intervals at which functional tests or configuration audits are held

5

6 − for a fail-safe, monitored, or self-announcing IROFS, the time it takes to 

7 render the system safe

8

9 − demand rates (i.e., the frequency of the demands on an IROFS to 

10 perform) (some situations amount to effectively continuous demand)

11

12 Such items of quantitative information should be considered in evaluating the 

13 likelihood of accident sequences, even in purely qualitative evaluations. For 

14 example, knowing the value to which downtime is limited by surveillance can 

15 indicate that a system’s availability is extremely high. For redundant systems, 

16 such high availability can virtually preclude concurrent independent failures of 

17 multiple IROFS.

18

19 d. Acceptance Criteria for Likelihood Indexing Methods 

20

21 One acceptable definition for the likelihood terms “unlikely” and “highly unlikely”

22 could be based on a risk-indexing method. The example in Appendix A to this 

23 chapter shows the use of such a method, which primarily relies on a qualitative 

24 evaluation of reliability and availability factors. In such methods, qualitative 

25 characteristics of the system of IROFS, such as those listed above, are used to 

26 estimate a quantitative likelihood index for each accident sequence. Then, the 

27 definitions of “highly unlikely” and “unlikely” would be acceptable limiting values

28 of this likelihood index. For example, “highly unlikely” could be defined as 

29 “having a risk-index value less than or equal to minus 5,” and “unlikely” could be 

30 defined as “having a risk-index value less than or equal to minus 4.”

31

32 e. Acceptance Criteria for Purely Qualitative Methods

33

34 A purely qualitative method of defining “unlikely” and “highly unlikely” is 

35 acceptable if it incorporates all of the applicable reliability and availability qualities 

36 to an appropriate degree. For example, one statement of applicable qualities is 

37 double-contingency protection, the quality of a process design that incorporates 

38 sufficient factors of safety to require at least two unlikely, independent, and 

39 concurrent changes in process conditions before a criticality accident is possible.

40

41 Double contingency explicitly addresses several reliability and availability 

42 qualities:

43

44 i. factors of safety: safety margins

45 ii. at least two: redundancy

46 iii. unlikely: low failure rate, low downtime of one of two controls

47 iv. concurrent: low downtime

48 v. independent: independence

49 vi. process conditions: physical events, not virtual human errors

50
May 2014 3-30 NUREG-1520, Revision 2

1 One acceptable definition of “highly unlikely” is a system of IROFS that 

2 possesses double-contingency protection, where each of the applicable qualities 

3 is present to an appropriate degree. For example, as implied by the modifier “at 

4 least” in the phrase “at least two unlikely, independent and concurrent changes,”

5 sometimes more than two-fold redundancy may be appropriate.

6

7 A qualitative method may also be proposed for defining “unlikely.” Such a 

8 qualitative method might simply list various combinations of reliability qualities for 

9 a system of IROFS that would qualify as “unlikely.” For example, a single 

10 high-reliability IROFS, such as an engineered hardware control with a high grade 

11 of applicable management measures, might qualify to be considered “unlikely to 

12 fail.” Systems relying on administrative controls would normally have to use 

13 enhancing qualities, such as large safety margins and redundancy, to qualify as 

14 “unlikely to fail.” A single simple administrative control regularly challenged and 

15 without any special safety margin or enhancement, where a single simple error 

16 would lead to an accident, would not qualify as “unlikely to fail.” Likewise, two 

17 simple administrative controls without special margins or enhancements, 

18 particularly of their independence, would not normally qualify as “highly unlikely 

19 to fail.”

20

21 f. Acceptance Criteria for Quantitative Definitions of Likelihood

22

23 An applicant may choose to provide quantitative definitions of the terms “unlikely” 

24 and “highly unlikely.” One example of acceptable quantitative guidelines is given 

25 in the next paragraph. These guidelines serve two purposes. Specifically, these 

26 guidelines can be used as acceptance criteria for quantitative definitions of 

27 “highly unlikely” and “unlikely,” if provided by an applicant.

28

29 Quantitative Guidelines

30

31 A discussion of quantitative guidelines here does not imply that quantitative 

32 demonstration of compliance with 10 CFR 70.61 is required. The NRC has 

33 provided various guidance documents, including a strategic plan, pertinent to 

34 ensuring that exposures of individuals to NRC-regulated hazards, such as 

35 radiation, are acceptably infrequent. For example, the NRC Strategic Plan has a 

36 performance goal of “no inadvertent nuclear criticalities.” The quantitative 

37 guidelines given below for definitions of “highly unlikely” and “unlikely”, as used in 

38 10 CFR 70.61, were developed so as to be reasonably consistent with other 

39 relevant NRC guidance.

40

41 Highly Unlikely

42

43 Among other considerations, the guideline for acceptance of the definition of 

44 “highly unlikely” has been derived as the highest acceptable frequency that is 

45 consistent with the performance goal of having no inadvertent nuclear criticality 

46 accidents. This guideline is thus applied in considering the 10 CFR 70.61 

47 requirement that high-consequence events be highly unlikely, because such 

48 events may involve high radiation doses, as is often true for criticality accidents. 

49 To within an order of magnitude, this is taken to mean a definition that translates 

50 to a frequency limit of less than one such accident in the industry every 

51 100 years. This results in a guideline limiting the frequency of any individual 
May 2014 3-31 NUREG-1520, Revision 2

accident to 10-5 1 per event per year. As the goal is to have no such accidents, the 

2 expectation is that most accidents would have frequencies substantially below 

3 this guideline when feasible.

4

5 Unlikely

6

7 Intermediate-consequence events include significant radiation exposures to 

8 workers (those exceeding 0.25 Sv or 25 rem). The NRC has a strategic goal that

9 there be no increase in the rate of such significant exposures. This guideline has 

been interpreted here to correspond to a range between 10-4 and 10-5 10 per event 

11 per year.

12

13 Quantitative Guidelines for Use with Acceptance Criteria

14

15 The applicant’s quantitative definitions of the terms “unlikely” and “highly 

16 unlikely,” as applied to individual accident sequences identified in the ISA, are 

17 acceptable to show compliance with 10 CFR 70.61 if they are reasonably 

18 consistent with the following quantitative guidelines:

19

20

Likelihood Term of 10 CFR 70.61 Guideline

Unlikely Less than 10-4 per event per year

Highly Unlikely Less than 10-5 per event per year

21

22 The stated quantitative guidelines are used to define the largest likelihood values 

23 that would be acceptable limits. Definitions based on lower limits are also 

24 acceptable. Note that the word “unlikely” as it appears in 10 CFR 70.61(c) does 

25 not have the same meaning as it does in the definition of double contingency. 

26 (See Chapter 5 of this SRP.)

27

28 3.5 Review Procedures 

29

30 Organization of the reviews addressed by this chapter of the SRP will differ depending on the 

31 scope of the documents submitted. For a license application, renewal, or amendment 

32 application containing a new or revised chapter addressing the applicant’s safety program and 

33 ISA commitments, there may be only a primary ISA reviewer. However, for an initial 

34 ISA summary submittal, specialists in the various safety disciplines and management measures

35 will assist the primary ISA reviewer. An ISA summary update submitted as part of an 

36 amendment for a process that has hazards in multiple disciplines would also require a team 

37 approach. In general, a primary ISA reviewer will evaluate generic methods, risk, and reliability 

38 criteria used in the ISA and generic information about individual processes. Assisting this 

39 primary reviewer will be secondary reviewers, who will evaluate selected individual accidents 

40 and advise on the completeness of the accident list for specific safety disciplines.

41

42 3.5.1 Acceptance Review 

43

44 During the acceptance review of a license application, the reviewer should examine the 

45 submittals to identify major deficiencies in the information provided for each area of review 

46 specified in SRP Section 3.3. Reviewers must decide whether they have enough information to 

47 proceed with a detailed review. Less significant errors or deficiencies that can be addressed in 
May 2014 3-32 NUREG-1520, Revision 2

1 a request for additional information should be accepted. However, before the NRC performs a 

2 detailed review, the applicant should correct major deficiencies that would require several 

3 requests for additional information to resolve.

4

5 Reviewers should record whether each area of review is adequately addressed in the 

6 application, is adequately addressed in a referenced document, is not applicable to the 

7 application, or has a major deficiency.

8

9 For an ISA summary, the primary ISA reviewer will also conduct an acceptance review to 

10 determine whether the document submitted contains sufficient information addressing the areas 

11 of review noted in Section 3.3.2, including specifically each of the elements required by 

12 10 CFR 70.65(b), to permit an evaluation of safety for compliance with the regulations. If 

13 sufficient information is not present, the ISA summary will not be accepted for review.

14

15 3.5.2 Safety Evaluation 

16

17 The primary reviewer will perform a safety evaluation with respect to the acceptance criteria in 

18 Section 3.4. During the initial review, the reviewer should draft the safety evaluation report 

19 (SER) described below. A request for additional information (RAI) will be prepared when 

20 clarification and additional information are needed to determine if the licensee’s submittals 

21 comply with the regulations. The primary reviewer should coordinate with the licensing project 

22 manager in preparing RAIs. Additional information submitted by the applicant will be evaluated 

23 and a final SER will be provided to the licensing project manager.

24

25 3.5.2.1 Evaluation of License-Application and Safety-Program Commitments

26

27 The reviewer examines the descriptions and commitments to program elements in the 

28 application or other documents for the areas of review described in Section 3.3.1 to ascertain 

29 whether the program elements are sufficient to meet the acceptance criteria of Section 3.4.3.1. 

30 The ISA reviewer must coordinate his or her review with reviews being conducted under other 

31 chapters of this SRP.

32

33 3.5.2.2 Evaluation of ISA Summary

34

35 A team consisting of a primary reviewer together with specialists in each category of accidents 

36 would normally perform an evaluation of the ISA summary to determine if it meets the 

37 acceptance criteria of Section 3.4.3.2. These categories of accidents depend on the facility, but 

38 in general, they are nuclear criticality, fires, chemical accidents, and radiological accidents. If 

39 external-event analysis is complex, specialists may be employed to review these separately as 

40 well. The primary ISA reviewer would normally evaluate the acceptability of the generic 

41 elements of the ISA summary as described in 10 CFR 70.65, such as site and facility 

42 descriptions, ISA methods, criteria, and consequence and likelihood definitions. However, each 

43 specialist should also review these elements to obtain information in support of his or her own 

44 evaluations.

45

46 In contrast to these generic ISA elements, process-specific information is needed by, and must 

47 be acceptable to, all of the specialists. Thus, all team members should evaluate the process 

48 descriptions in the ISA summary.

49

50 Separate specialists for each category of accidents (i.e., nuclear criticalities, fires, radiological 

51 releases, and chemical accidents) should undertake the reviews of accident-sequence 
May 2014 3-33 NUREG-1520, Revision 2

1 descriptions and the likelihood and consequence information showing compliance with 

2 10 CFR 70.61. As indicated in Appendix A to this chapter, one acceptable format for the 

3 ISA summary is to separately tabulate or give logic diagrams for accident sequences in each 

4 accident category.

5

6 After a preliminary team review of the ISA summary, the team should visit the facility to become 

7 familiar with the three-dimensional geometry of process equipment, to review components of the 

8 ISA, and to address any issues that arose during review of the ISA summary.

9

10 To select a subset of the accident sequences reported in the ISA summary for more detailed 

11 review, the reviewer should look at the applicant’s tabulation of high- and 

12 intermediate-consequence accident sequences and the types of IROFS designated for each. 

13 High-consequence accident sequences protected by administrative controls should be 

14 examined very carefully, whereas intermediate-consequence accident sequences protected by 

15 redundant passive engineered controls warrant less scrutiny.

16

17 To select specific accident sequences and IROFS for more detailed evaluation, the reviewer 

18 should evaluate potential accidents using information supplied in the ISA summary. The 

19 applicant’s method for identifying and establishing the consequences and likelihood of an 

20 accident sequence may provide information sufficient for this purpose. The NRC reviewer may 

21 evaluate the accidents using qualitative screening criteria analogous to those in Table A-6 in 

22 Appendix A to this chapter. Other, more rigorous reliability or consequence analyses may be 

23 performed as deemed necessary. On the basis of this analysis, accidents will be categorized. 

24 The reviewer may elect to examine in greater detail the engineered and administrative controls 

25 for accidents in the category of highest consequences. While onsite, the reviewer should also 

26 select for specific evaluation a small sample of accident sequences determined by the applicant 

27 either to result in less-than-intermediate consequences or to be not credible.

28

29 From the list of the IROFS, the reviewer should categorize IROFS so that similar items are 

30 grouped together. The reviewer should then ensure that he or she has fully understood one or 

31 more prototype IROFS selected from each category. For these selected prototypes, the 

32 reviewer may, if necessary, request additional information needed to completely understand a 

33 particular IROFS. For complex processes, the reviewer may need to visit the facility to reach an 

34 adequate understanding of how the IROFS work for the process.

35

36 3.5.2.3 Onsite Integrated Safety Analysis Review

37

38 The reviewer should plan on visiting the applicant’s facility at least once as part of the 

39 application review process. This visit should be scheduled after the applicant’s ISA summary 

40 has received a preliminary review. The visits will enable the reviewer to confirm through 

41 detailed examination of the ISA and ISA documentation that the ISA methods were selected and 

42 applied in a reasonable and thorough manner to all facility processes, that all credible high- and 

43 intermediate-consequence accident sequences were correctly identified, that 

44 accident-sequence consequences and likelihoods were reasonably determined, and that 

45 appropriate IROFS and supporting management measures have been proposed. By means of 

46 a “horizontal” review and several “vertical” slice reviews (defined below) of processes selected 

47 by the reviewer, the NRC staff can establish the completeness and adequacy of the applicant’s 

48 ISA method. The reviewer may use the ISA documentation to perform independent evaluations 

49 of process hazards and accident sequences using methods selected from NUREG-1513, 

50 Appendix A to this SRP chapter, or other NRC guidance.

51
May 2014 3-34 NUREG-1520, Revision 2

1 The reviewer should not attempt a comprehensive, all-encompassing review of every facility 

2 process and every accident sequence on the site visit. Rather, the reviewer should use the site 

3 visit to confirm the appropriateness and adequacy of the applicant’s ISA method and the 

4 completeness of the ISA and accuracy of analysis of accident sequences by means of a 

5 horizontal review and several vertical slice reviews of selected processes. The site visit will also 

6 afford the reviewer an opportunity to seek answers to questions from the applicant (or possibly 

7 the ISA team) that may have arisen in the preliminary review of the ISA summary.

8

9 The following discusses each of the three facets of the onsite ISA review:

10

11 (1) ISA Methods Review

12

13 The purpose of the ISA methods review is to ensure that: (a) the applicant selected 

14 appropriate ISA methods for each facility process and (b) the methods were correctly 

15 applied in conducting the ISA. The ISA summary should describe the ISA methods and 

16 give a few examples of the application of the ISA methods. The ISA methods review 

17 should answer any questions that a reviewer may have concerning ISA methods and 

18 procedures after completion of the preliminary review of the ISA summary. In reviewing 

19 process-specific information in the ISA summary and ISA documentation maintained 

20 onsite, the reviewer should select a few processes and accident sequences to examine

21 the adequacy of the selected ISA methods and their application. The reviewer should 

22 examine any procedures, checklists, or guidance documents that the applicant may 

23 have onsite as guidance to ISA team members to ensure a complete understanding of 

24 the applicant’s ISA methods. The reviewer should then examine the ISA documentation, 

25 including the selected processes and accident sequences, showing how the ISA 

26 methods were applied as part of the horizontal and vertical slice reviews discussed 

27 below.

28

29 (2) Horizontal Review

30

31 The basic purpose of the horizontal review is to ensure completeness of the ISA of 

32 facility processes. This does not require an absolute checkoff of ISA documentation 

33 against the full list of processes to be covered, but it does mean that a substantial 

34 fraction of the processes should receive a brief examination.

35

36 The reviewer should consult the ISA and ISA documentation to answer questions or to 

37 resolve outstanding issues resulting from the preliminary review of the ISA summary. In 

38 particular, the reviewer should examine safety information that is not included in the 

39 ISA summary. For example, ISA documentation related to hardware IROFS, such as 

40 system schematics and/or descriptive lists, should contain sufficient detail about 

41 hardware IROFS so that it is clear to the reviewer what components (such as cables, 

42 detectors, alarms, valves, and piping) are included within the boundary of the hardware 

43 IROFS system and would therefore be subject to management measures specified by 

44 the applicant. In addition, such documentation should also identify support systems 

45 (such as backup batteries, air supply, and steam supply) on which the IROFS depends 

46 to perform its intended function. The reviewer should also examine a few processes to 

47 confirm that all accident sequences were considered and that the ISA summary includes 

48 those having potential consequences exceeding the performance requirements of 

49 10 CFR 70.61.

50
May 2014 3-35 NUREG-1520, Revision 2

1 (3) Vertical Slice Review

2

3 The purpose of the vertical slice review is to examine the application of the ISA methods

4 to a selected subset of facility processes. For this subset of facility processes, the 

5 reviewer should examine the underpinnings of calculations, conclusions, and the design 

6 of safety programs that result from the ISA, as well as safety information that is not 

7 identified in the ISA summary. The reviewer should examine accident sequences for 

8 this subset of processes to determine the adequacy of the applicant’s consequence and 

9 likelihood determinations. In addition, the reviewer should examine the appropriateness 

10 and robustness of designated IROFS and the suitability of proposed management 

11 measures.

12

13 The ISA summary will have categorized accidents according to their consequences, 

14 likelihoods, and IROFS. While onsite, the reviewer may confirm the adequacy of sample 

15 accident analyses that the applicant included in the ISA summary. The reviewer should 

16 select a subset of processes for vertical slice review of these categories. The subset 

17 should include accident sequences with relatively high levels of consequence and 

18 likelihood and accident sequences for which IROFS of different types and relatively low 

19 robustness are designated. For ISAs where the index method of Appendix A is used, 

20 and where the index scoring for all accident sequences is readily available to the 

21 reviewer, in principle, these index scores could be used to establish sequences of 

22 relatively higher risk. However, if the ISA declares as IROFS only a set of controls that 

23 are minimally necessary to demonstrate compliance with 10 CFR 70.61 likelihood 

24 requirements, then such index scores would be misleading. Instead, in selecting 

25 processes or sequences for the vertical slice reviews, one may need to use other 

26 objective qualities of the processes. For example, the selection might be based on 

27 experience or potential consequences as in (1) criticality accidents in solution systems, 

28 solvent extraction process upsets, or using plutonium or high-enriched uranium or 

29 (2) chemical processes involving large quantities of toxic chemicals that are highly 

30 reactive, flammable, or volatile or are exceptionally toxic. Vertical slice reviews should 

31 examine processes for which less robust IROFS are designated (e.g., those with greater 

32 reliance on administrative rather than engineered controls). Again, if only a minimal set 

33 of IROFS is declared, it may be supported by more robust controls that are not IROFS 

34 and hence are not documented in the ISA summary. Still, a review of sets of IROFS that 

35 are purely administrative, or are otherwise known from experience to be unreliable, may 

36 be advisable.

37

38 The vertical slice review should address any specific questions the reviewer may have 

39 related to the ISA methods. If the applicant’s methods are evaluated as effective in 

40 these selected cases, there is greater assurance that they will be effective for other 

41 processes. If questions or weaknesses are discovered that may be generic, the 

42 reviewer may have to perform vertical slice analyses on several additional processes. 

43 However, a specific question on the ISA of one process may not imply that there is a 

44 generic question requiring further examination. While performing vertical slice reviews, 

45 the reviewer should focus on the application of the ISA methods, not to complete 

46 verification of ISA implementation.

47

48 The total number of vertical slice reviews to be conducted will depend on the facility’s 

49 total number of accident sequences for which the consequences could exceed the 

50 performance requirements of 10 CFR 70.61, the diversity of the types of processes and 

51 types of IROFS at the facility, and the results of initial reviews of the ISA summary and 
May 2014 3-36 NUREG-1520, Revision 2

1 the horizontal and vertical slice reviews. For most fuel fabrication facilities, the reviewer 

2 should plan on conducting vertical slice reviews for 5 to 10 processes significant to 

3 nuclear criticality safety; 1 to 3 fire-significant processes; and 1 to 3 

4 chemical/radiological/environmental-significant processes. However, if the initial reviews 

5 of the ISA summary and the horizontal and vertical slice reviews identify significant 

6 issues, then additional vertical slice reviews may be warranted. Ultimately, to approve 

7 the ISA and ISA program, the reviewer must attain reasonable assurance that the 

8 applicant has implemented them in compliance with the regulations.

9

10 Each vertical slice review should include: (1) familiarization of the reviewer with the 

11 safety design of the selected process and (2) examination of all onsite documentation 

12 related to the ISA of that process. If the content of the documentation leaves certain 

13 issues unclear, interviews with facility personnel may be necessary. The review should 

14 focus on the onsite information that is not provided in the ISA summary but is key to 

15 determining compliance with 10 CFR 70.61 requirements.

16

17 Following the horizontal and vertical slice reviews, if outstanding questions remain about 

18 compliance with the performance requirements of 10 CFR 70.61, the reviewer may conduct an 

19 independent evaluation using appropriate methods selected from NUREG-1513, Appendix A, to 

20 this chapter, or other agency guidance. The purpose of such an independent review is to 

21 identify strengths and weaknesses in the applicant’s ISA methods or implementation practices, 

22 not simply to check compliance in this one case.

23

24 The reviewer should take care to document findings and evaluations made during this process.

25

26 3.6 Evaluation Findings 

27

28 The regulations in 10 CFR 70.23, “Requirements for the Approval of Applications,” and 

29 10 CFR 70.66, “Additional Requirements for Approval of License Application,” state that an 

30 application for a license will be approved if the Commission can make the general findings listed 

31 in those sections. The basis for the general findings is an evaluation of whether the application 

32 adequately addresses all of the applicable regulatory requirements. More specifically, the staff’s 

33 evaluation should determine whether the licensing submittals provide sufficient information to 

34 satisfy the regulatory requirements listed in Section 3.4.1 of this SRP and whether the applicant 

35 has appropriately addressed the regulatory acceptance criteria in SRP Section 3.4.3. On the 

36 basis of this information, the reviewers should write material for inclusion in the SER. In 

37 general, the review findings should state that the requirements of 10 CFR 70.64 for a new 

38 facility, 10 CFR 70.65 for content, and 10 CFR 70.66 have been met, and should include the 

39 reasons for this finding. A finding statement should follow the evaluation of each specific area 

40 of review, stating how and why the information submitted in that area complies with the related 

41 regulatory requirement, if it does so. The SER should state how the applicable regulatory 

42 requirements have been met based on the acceptance criteria described in this chapter of the 

43 SRP. If the applicant chooses to use an alternative approach, the reviewer should discuss in 

44 the SER whether the proposed approach satisfies the applicable regulatory requirements. The 

45 reviewers should use the following approach to document their evaluation:

46

47 1. State a specific regulatory requirement that applies to the application. Detailed 

48 acceptance criteria may be included where appropriate or necessary to clarify the 

49 requirement.

50
May 2014 3-37 NUREG-1520, Revision 2

1 2. Identify the areas where the regulatory requirement is addressed in the application, 

2 including the areas where the specific acceptance criteria described in this SRP are 

3 addressed.

4

5 3. Describe your evaluation of the application, the basis for your conclusion, and whether it 

6 meets the regulatory requirement.

7

8 4. Repeat these steps for every regulatory requirement that applies to the application.

9

10 There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

11 application or amendment request, (2) denial of the application or request, or (3) approval with 

12 conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

13 reviewer may consider proposing a license condition. Absent an NRC order, license conditions 

14 must be agreed upon with the licensee or applicant before becoming part of the license. 

15 A license condition should only be proposed if there is reasonable assurance that, if the 

16 licensee meets the condition, all regulatory requirements will be satisfied. Thus, license 

17 conditions should not be used to cover major deficiencies in an application. License conditions 

18 should be unambiguous, inspectable, and enforceable. They should only require those actions 

19 necessary to ensure compliance with applicable regulations. The basis for license conditions 

20 must be documented in the SER.

21

22 If the submittal is acceptable, the final SER input should conclude with statements similar to the 

23 following:

24

25 • general conclusion resulting from the reviewer’s evaluation of safety program 

26 commitments:

27

28 The NRC staff concludes that the applicant’s safety program, if 

29 established and maintained pursuant to 10 CFR 70.62, is adequate to 

30 provide reasonable assurance that IROFS will be available and reliable to 

31 perform their intended safety function when needed and in the context of 

32 the performance requirements of 10 CFR 70.61.

33

34 General findings for each of the areas of review should state how the applicant’s 

35 information demonstrates compliance with the acceptance criteria of Section 3.4.3.1. If 

36 the reviewer finds that the acceptance criteria are not met and the applicant is not in 

37 compliance with the regulations, then the situation must be rectified before approval can 

38 be given. If the applicant has submitted an adequate explanation of an alternative way 

39 of complying with the regulations, the NRC’s safety evaluation report should contain a 

40 finding that the alternative is acceptable to meet the basic regulatory requirement 

41 addressed.

42

43 • general conclusions resulting from the staff’s evaluation of an ISA summary:

44

45 Many hazards and potential accidents can result in unintended exposure 

46 of persons to radiation, radioactive materials, or toxic chemicals incident 

47 to the processing of licensed materials. The NRC staff finds that the 

48 applicant has performed an ISA to identify and evaluate those hazards 

49 and potential accidents as required by the regulations. The NRC staff 

50 has reviewed the ISA summary and other information and finds that it 

51 provides reasonable assurance that the applicant has identified IROFS 
May 2014 3-38 NUREG-1520, Revision 2

1 and established engineered and administrative controls to ensure 

2 compliance with the performance requirements of 10 CFR 70.61. 

3 Specifically, the NRC staff finds that the ISA results, as documented in 

4 the ISA summary, provide reasonable assurance that the IROFS, the 

5 management measures, and the applicant’s programmatic commitments 

6 will, if properly implemented, make all credible intermediate-consequence 

7 accidents unlikely and all credible high-consequence accidents highly 

8 unlikely.

9

10 Findings should be made concerning any specific requirement in 10 CFR Part 70 that 

11 addresses the nine elements in the ISA summary. In particular, these findings should 

12 include statements concerning compliance with the requirements of 10 CFR 70.64 

13 (regarding new facilities and new processes at existing facilities).

14

15 The review should result in findings concerning the compliance of specific processes 

16 with the requirements of 10 CFR 70.61, or other parts of the regulation, for those 

17 processes that receive specific detailed review. However, such findings should be 

18 limited to a finding of reasonable assurance that a process having the IROFS described 

19 in the ISA summary is capable of meeting the requirements if properly implemented, 

20 operated, and maintained.

21

22 3.7 References 

23

24 U.S. Code of Federal Regulations, “Domestic Licensing of Special Nuclear Material,” Part 70, 

25 Chapter I, Title 10, “Energy.”

26

27 U.S. Code of Federal Regulations, “Air Contaminants,” Section 1910.100, Chapter XVII, 

28 Title 29, “Labor.”

29

30 U.S. Code of Federal Regulations, “Table of Toxic Endpoints,” Appendix A to “Chemical 

31 Accident Prevention Provisions,” Part 68, Chapter I, Title 40, “Protection of Environment.”

32

33 American Institute of Chemical Engineers, “Guidelines for Hazard Evaluation Procedures, 

34 Second Edition with Worked Examples,” New York, NY, September 1992.

35

36 American National Standards Institute/American Nuclear Society, “Nuclear Criticality Safety in 

37 Operations with Fissionable Materials Outside Reactors,” ANSI/ANS-8.1-1983, La Grange Park, 

38 IL, 1983.

39

40 U.S. Department of Commerce, Bureau of the Census, “Statistical Abstract of the 

41 United States,” Table No. 688, Washington, DC, 1995.

42 U.S. Nuclear Regulatory Commission, “Integrated Safety Analysis Guidance Document,” 

43 NUREG-1513, May 2001.

44

45 U.S. Nuclear Regulatory Commission, “Chemical Process Safety at Fuel Cycle Facilities,” 

46 NUREG-1601, August 1997.

47

48 U.S. Nuclear Regulatory Commission, “Nuclear Fuel Cycle Facility Accident Analysis 

49 Handbook,” NUREG/CR-6410, March 1998.

50
May 2014 3-A-1 NUREG-1520, Revision 2

APPENDIX A

1 EXAMPLE PROCEDURE FOR ACCIDENT SEQUENCE EVALUATION

2

3 This appendix provides the U.S. Nuclear Regulatory Commission (NRC) reviewer with an 

4 example of one method of evaluating accident sequences for compliance with the likelihood 

5 requirements of Title 10 of the Code of Federal Regulations (10 CFR) 70.61, “Performance 

6 Requirements.” It employs a semiquantitative risk index method for categorizing accident 

7 sequences in terms of their likelihood of occurrence and their consequences of concern. The 

8 risk index method framework will enable the applicant to identify, and the NRC reviewer to 

9 confirm, which accident sequences have consequences that exceed the performance 

10 requirements of 10 CFR 70.61 and, therefore, require designation of items relied on for safety 

11 (IROFS) and supporting management measures. The integrated safety analysis (ISA) summary 

12 should include descriptions of these general types of higher consequence accident sequences.

13

14 This appendix presents an example of how the risk index method can be applied to a uranium 

15 powder blender. It describes one method of evaluating compliance with the consequence and 

16 likelihood performance requirements of 10 CFR 70.61. The method is intended to permit any 

17 available quantitative information to be considered. For consistency, the NRC reviewer’s 

18 approach could also include assigning quantitative values to any qualitative likelihood 

19 assessments made by an applicant, since likelihoods are inherently quantitative. This method 

20 should not be interpreted as a requirement that an applicant use quantitative evaluation. 

21 However, evaluation of a particular accident should be consistent with any facts available, which 

22 may include quantitative information concerning the availability and reliability of IROFS involved.

23

24 This appendix is not a “format and content guide” for either the ISA or the ISA summary. It 

25 simply presents one method of analysis and categorization of credible accident sequences for 

26 facility processes. The method described in this appendix uses both qualitative and quantitative 

27 criteria for evaluating frequency indices of safety controls. These criteria for assigning indices, 

28 particularly the descriptive criteria provided in some tables of this appendix, are intended to be 

29 examples, not universal criteria. It is preferable that each applicant develop such criteria based 

30 on particular types of IROFS and management measure programs. The applicant should 

31 modify and improve such criteria as insights are gained during performance of the ISA.

32

33 If the applicant evaluates accidents using a different method, the method should produce similar 

34 results in terms of how accidents are categorized. The method should be regarded as a 

35 screening method, not as a definitive method of proving the adequacy or inadequacy of the 

36 IROFS for any particular accident. Because methods can rarely be universally valid, an 

37 evaluation using other methods may be justified for individual accidents for which this method 

38 does not appear applicable. The method does have the benefit that it evaluates, in a consistent 

39 manner, the characteristics of IROFS used to limit accident sequences. This will permit 

40 identification of accident sequences with defects in the combination of IROFS used. Such 

41 IROFS can then be further evaluated or improved to establish adequacy. The procedure also 

42 ensures the consistent evaluation of similar IROFS by different ISA teams. Sequences or 

43 IROFS that are risk significant and are evaluated as marginally acceptable are good candidates 

44 for more detailed evaluation by the applicant and the reviewer.

45

46 For each sequence, the tabular accident summary resulting from the ISA should identify the 

47 engineered or administrative IROFS that must fail to allow the occurrence of consequences that 

48 exceed the levels identified in 10 CFR 70.61. Chapter 3 of this Standard Review Plan (SRP) 
May 2014 3-A-2 NUREG-1520, Revision 2

1 specifies acceptance criteria for these IROFS and for meeting the performance requirements of 

2 10 CFR 70.61. These criteria require that IROFS be sufficiently unlikely to fail. However, the 

3 acceptance criteria do not explicitly mandate any particular method for assessing likelihood. 

4 The purpose of this appendix is to provide an example of an acceptable method to perform this 

5 evaluation of likelihood.

6

7 A.1 Risk Matrix Development

8

9 Consequences 

10

11 The regulation in 10 CFR 70.61 specifies two categories for accident sequence consequences: 

12 “high consequences” and “intermediate consequences.” Implicitly, there is a third category for 

13 accidents that produce consequences less than “intermediate.” This category will be referred to 

14 as “low-consequence” accident sequences. The primary purpose of process hazard analysis 

15 (PHA) is to identify all uncontrolled and unmitigated accident sequences. These accident 

16 sequences can then be categorized into one of these three consequence categories (high, 

17 intermediate, or low) based on their predicted radiological, chemical, and/or environmental 

18 impacts. Although the subsequent ISA analysis focuses only on those accident sequences 

19 having high or intermediate consequences, by examining low-consequence events identified 

20 and tabulated in the ISA, the reviewer can evaluate the completeness of the PHA and ISA 

21 analyses. Table A-1 presents the radiological and chemical consequence severity limits of 

22 10 CFR 70.61 for each of the three accident consequence categories.

23

24 Table A-1 Consequence Severity Categories Based on 10 CFR 70.61

25

Workers Offsite Public Environment

Category 3

High

Consequence

*RD > 1 sievert (Sv) 

(100 rem)

**CD = endanger life

RD > 0.25 Sv (25 rem)

30 milligrams (mg) sol 

U intake

CD = long-lasting

health effects

Category 2 

Intermediate 

Consequence 

0.25 Sv (25 rem) 

< RD ≤ 1 Sv (100 rem)

CD = long-lasting

health effects

0.05 Sv (5 rem) 

< RD ≤ 0.25 Sv 

(25 rem)

CD = mild transient

health effects

Radioactive release 

> 5,000 x Table 2 of 

10 CFR Part 20, 

Appendix B

Category 1 

Low 

Consequence 

Accidents with lower 

radiological and 

chemical exposures 

than those above in 

this column 

Accidents with lower 

radiological and 

chemical exposures 

than those above in 

this column

Radioactive releases 

producing lower 

effects than those 

referenced above in 

this column

26 * RD = Radiological Dose

27 ** CD = Chemical Dose

28

29 Likelihood 

30

31 The regulation in 10 CFR 70.61 also specifies the permissible likelihood of occurrence of 

32 accident sequences of different consequences. High-consequence accident sequences must 
May 2014 3-A-3 NUREG-1520, Revision 2

1 be “highly unlikely” and intermediate-consequence accident sequences must be “unlikely.” 

2 Implicitly, accidents in the low-consequence category can have a likelihood of occurrence less 

3 than “unlikely” or simply “not unlikely.” Table A-2 shows the likelihood of occurrence limits of 

4 10 CFR 70.61 for each of the three likelihood categories.

5

6 Table A-2 Likelihood Categories Based on 10 CFR 70.61

7

Qualitative Description

Likelihood Category 1 Consequence Category 3 accidents must be 

“highly unlikely.”

Likelihood Category 2 Consequence Category 2 accidents must be 

“unlikely.”

Likelihood Category 3 Consequence Category 1 accidents may be 

“not unlikely.”

8

9 Risk Matrix 

10

11 The three categories of consequence and likelihood can be displayed as a 3x3 risk index matrix. 

12 By assigning a number to each category of consequence and likelihood, a qualitative risk index 

13 can be calculated for each combination of consequence and likelihood. The risk index equals 

14 the product of the integers assigned to the respective consequence and likelihood categories. 

15 Table A-3 illustrates the risk index matrix, along with computed risk index values. The shaded 

16 blocks identify accidents for which the consequences and likelihoods yield an unacceptable risk 

17 index and to which IROFS must be applied.

18

19 Table A-3 Risk Matrix with Risk Index Values

20

Severity of

Consequences

Likelihood of Occurrence

Likelihood Category 1 

Highly Unlikely 

(1)

Likelihood Category 2 

Unlikely 

(2)

Likelihood Category 3 

Not Unlikely

(3)

Consequence 

Category 3 High

(3)

Acceptable Risk

3

Unacceptable Risk

6

Unacceptable Risk

9

Consequence 

Category 2 

Intermediate (2)

Acceptable Risk

2

Acceptable Risk

4

Unacceptable Risk

6

Consequence 

Category 1 Low (1)

Acceptable Risk

1

Acceptable Risk

2

Acceptable Risk

3

21

22 The risk indices can initially be used to examine whether the consequences of an uncontrolled 

23 and unmitigated accident sequence (i.e., without any IROFS) could exceed the performance 

24 requirements of 10 CFR 70.61. If the performance requirements could be exceeded, the 

25 applicant must designate IROFS to prevent the accident or to mitigate its consequences to an 
May 2014 3-A-4 NUREG-1520, Revision 2

1 acceptable level. A risk index value less than or equal to 4 means that the accident sequence is 

2 acceptably protected against and/or mitigated. If the applicant provides this risk index in the ISA 

3 and ISA summary, the reviewer can quickly scan these data to confirm that each accident 

4 sequence meets the performance requirements of 10 CFR 70.61.

5

6 If the risk index of an uncontrolled and unmitigated accident sequence exceeds 4, the likelihood 

7 of the accident must be reduced through designation of IROFS. In this risk index method, the 

8 likelihood index for the uncontrolled and unmitigated accident sequence is adjusted by 

9 subtracting a score corresponding to the type and number of IROFS that have been designated. 

10 Table A-4 lists the qualitative scores assigned to the four types of IROFS.

11

12 Reviewers should note that the qualitative scores assigned in Table A-4 are for illustrative 

13 purposes only. IROFS meeting the criteria for a particular score in Table A-4 could have a wide 

14 range of availability or reliability. Such coarse criteria are useful for screening purposes, but 

15 when the total evaluated likelihood score for an accident sequence lies near the acceptance 

16 guideline value, a more careful evaluation should be done. Such evaluations should consider 

17 the management measures applied to all the reliability and availability qualities of the IROFS, or 

18 system of IROFS, protecting against the accident, as explained in the likelihood acceptance 

19 criteria of Section 3.4.3.2 of this SRP.

20

21 Table A-4 Qualitative Categorization of IROFS

22

Numeric

Value

Description of IROFS

1 Protection by a single trained operator with adequate response time

(Administrative lROFS)

2 Protection by a single, active engineered IROFS, functionally tested on a

regular basis

(Active Engineered lROFS)

3 Protection by a single, passive engineered IROFS, functionally tested on a

regular basis, or by an active engineered IROFS with a trained operator for 

backup

(Passive Engineered IROFS or Combined Engineered and Administrative 

IROFS)

4 Protection by two independent and redundant engineered IROFS, as

appropriate, functionally tested on a regular basis

(Combination of Two Active or Passive Engineered IROFS)

23

24 To demonstrate compliance with the performance requirements of 10 CFR 70.61, the ISA 

25 should assign a consequence category to each identified accident sequence. The likelihood of 

26 occurrence of those accident sequences identified as high- or intermediate-consequence events 

27 must then be assigned to one of the three likelihood categories. To be acceptable, the 

28 controlled and/or mitigated accident consequences and likelihoods must have valid bases, and 

29 the applicant must include the bases for all general types of high- and intermediate30 consequence accident sequences in the ISA summary.
May 2014 3-A-5 NUREG-1520, Revision 2

1 A.2 Consequence Category Assignment

2

3 Categorization of an accident sequence as a high-consequence event or an intermediate4 consequence event, or neither, is based on the estimated consequences of prototype accidents. 

5 Although accident consequences can be determined by actual calculations, calculations need 

6 not be performed for each individual accident sequence listed for a process. Accident 

7 consequences may also be estimated by comparison to similar events for which reasonably 

8 bounding conservative calculations have been made. Categorization also requires 

9 consideration of acute chemical exposures that an individual could receive from licensed 

10 material or hazardous chemicals incident to the processing of licensed material. The applicant 

11 must select appropriate acute chemical exposure data and relate these data to the performance 

12 requirements of 10 CFR 70.61(b)(4) and (c)(4). This appendix uses the Acute Exposure 

13 Guideline Level (AEGL) and Emergency Response Planning Guideline (ERPG). AEGL-3 and 

14 ERPG-3 exposure levels are life threatening.

15

16 Consequence Category 3 (High Consequences) includes accidents resulting in any 

17 consequence specified in 10 CFR 70.61(b). These include (1) acute worker exposures of 

18 (a) radiation doses greater than 1 Sv (100 rem) total effective dose equivalent (TEDE), and 

19 (b) chemical exposures that could endanger life (above AEGL-3 or ERPG-3), and (2) acute 

20 exposures to members of the public outside the controlled area to (a) radiation doses greater 

21 than 0.25 Sv (25 rem) TEDE, (b) soluble uranium intakes greater than 30 mg, and (c) chemical 

22 exposures that could lead to irreversible or other serious long-lasting health effects (exceeding 

23 AEGL-2 or ERPG-2). An unshielded nuclear criticality would normally be considered a high24 consequence event because of the potential for producing a high radiation dose to a worker.

25

26 Consequence Category 2 (Intermediate Consequences) includes accidents resulting in any 

27 consequence specified in 10 CFR 70.61(c). These include (1) acute exposures of workers to 

28 (a) radiation doses between 0.25 Sv (25 rem) and 1 Sv (100 rem) TEDE, and (b) chemical 

29 exposures that could lead to irreversible or other serious long-lasting health effects above 

30 AEGL-2 or ERPG-2), and (2) acute exposures of members of the public outside the controlled 

31 area to (a) radiation doses between 0.05 Sv (5 rem) and 0.25 Sv (25 rem) TEDE, (b) chemical 

32 exposures that could cause mild transient health effects (exceeding AEGL-1 or ERPG-1), and 

33 (3) release of radioactive material outside the restricted area that would, if averaged over a 

34 24-hour period, exceed 5,000 times the values specified in Table 2 of Appendix B, “Annual 

35 Limits on Intake (ALIs) and Derived Air Concentrations (DACs) of Radionuclides for 

36 Occupational Exposure; Effluent Concentrations; Concentrations for Release to Sewerage,” to 

37 10 CFR Part 20, “Standards for Protection against Radiation.”

38

39 Consequence Category 1 (Low Consequences) includes accidents with potential adverse 

40 radiological or chemical consequences but at exposures less than Categories 3 and 2.

41

42 Table A-5 shows this system of consequence categories.
May 2014 3-A-6 NUREG-1520, Revision 2

Table A-5 Consequence Severity Categories Based on 10 CFR 70.61

Workers Offsite Public Environment

Category 3

High 

Consequence 

*RD > 1 Sv 

(100 rem)

**CD > AEGL-3, 

ERPG-3

RD > 0.25 Sv (25 rem)

30 mg sol U intake

CD > AEGL-2, 

ERPG-2

Category 2 

Intermediate 

Consequence 

0.25 Sv (25 rem) 

< RD ≤ 1 Sv (100 rem)

AEGL-2, ERGP-2 

< CD ≤ AEGL-3, 

ERPG-3

0.05 Sv (5 rem) 

< RD ≤ 0.25 Sv 

(25 rem)

AEGL-1, ERGP-1 

< CD ≤ AEGL-2, 

ERPG-2

Radioactive release

> 5,000 x Table 2 in

Appendix B to

10 CFR Part 20

Category 1

Low 

Consequence 

Accidents with lower 

radiological and 

chemical exposures 

than those above in 

this column

Accidents with lower 

radiological and 

chemical exposures 

than those above in 

this column

Radioactive releases 

with lower effects than 

those referenced 

above in this column

1 * RD = Radiological Dose

2 **CD = Chemical Dose

3

4 The applicant should document the bases for bounding calculations of the consequence 

5 assignment in the ISA summary submittal. NUREG/CR-6410, “Nuclear Fuel Cycle Facility 

6 Accident Analysis Handbook,” issued March 1998, describes valid methods and data that the 

7 applicant or staff may use for confirmatory evaluations.

8

9 A.3 Likelihood Category Assignment

10

11 An assignment of an accident sequence to a likelihood category is acceptable if it is based on 

12 the record of occurrences at the facility, the record of failures of IROFS at the facility, applicable 

13 event data for similar systems, objective qualitative criteria governing system failure rates and 

14 availability, or other methods that have objective validity. Because sequences leading to 

15 accidents often involve multiple failures, the likelihood of the whole sequence will depend on the 

16 frequencies of initiating events and failure likelihoods of engineered and administrative IROFS. 

17 The method of likelihood assignment used in this appendix relies on the expert engineering 

18 judgment of the analyst and includes assessment of the number, type, independence, and 

19 observed failure history of designated IROFS. Engineered and administrative IROFS, even 

20 those of the same types, have a wide range of reliability. By requiring explicit consideration of 

21 most of the underlying events and factors that significantly affect the likelihood of the accident 

22 and explicit criteria for assigning likelihood, greater consistency in assigning likelihood to 

23 accident sequences across different systems within a facility and among different applicants 

24 should be possible.

25

26 This section provides one example of a set of acceptable semiquantitative risk guidelines for 

27 determining compliance with the likelihood requirements of 10 CFR 70.61 when using methods 

28 of evaluation that are either quantitative or use the risk index method outlined in this appendix. 

29 The performance criteria of 10 CFR 70.61 are formulated in terms of likelihood limits on each
May 2014 3-A-7 NUREG-1520, Revision 2

1 separate event sequence. The example guidelines given in Table A-6 are based on the 

2 acceptance criteria guidance on likelihood definitions given in Section 3.4.3.2 of this SRP.

3

4 Table A-6 Example Likelihood Index Limit Guidelines

5

Likelihood 

Category Event Frequency Limits* Risk Index 

Limits

Not Unlikely 3 more than 10-4 per event, 

per year

> -4

Unlikely 2 between 10-4 and 10-5 per 

event, per year -4 to -5

Highly Unlikely 1 less than 10-5 per event, 

per year

≤ -5

6

7 Any risk or risk index method of likelihood evaluation using criteria as simple as those provided 

8 in the example method in this appendix should not be relied on exclusively in deciding the 

9 acceptability of the likelihood of a given event sequence. Consideration of qualitative criteria, 

10 such as degree of defense in depth or independence of controls, may be used to alter decisions 

11 based on the example of simple semiquantitative criteria presented here. 

12

13 A.4 Assessing Effectiveness of Items Relied on for Safety

14

15 The risk of an accident sequence is reduced through application of different numbers and types 

16 of IROFS. By either reducing the likelihood of occurrence or by mitigating the consequences, 

17 IROFS can reduce the overall resulting risk. The designation of IROFS should generally be 

18 made to reduce the likelihood (i.e., prevent an accident), but the consequences may also be 

19 reduced by minimizing the potential hazards (e.g., quantity), if practical. Based on hazards 

20 identification and accident sequence analyses for which the resulting unmitigated or 

21 uncontrolled risks are unacceptable, key safety controls (administrative and/or engineered 

22 IROFS) may be designated as IROFS to reduce the likelihood of occurrence and/or mitigate the 

23 consequence severity. 

24

25 The accident evaluation method described below does not preclude the need to comply with the 

26 double-contingency principle for sequences leading to criticality (see Chapter 5 of this SRP).

27

28 A.5 Example Risk Index Evaluation Method

29

30 As previously mentioned, one acceptable way for the applicant to present the results of the ISA 

31 is a tabular summary of the identified accident sequences. Table A-7 shows an acceptable 

32 format for such a table. This table lists several example accident sequences for a powder 

33 blender at a typical facility. Table A-7 summarizes two sets of information: (1) the accident 

34 sequences identified in the ISA and (2) a risk index, calculated for each sequence, to show 

35 compliance with the regulation. This risk index is a representation of the frequency of the 

36 accident sequence in accordance with the mathematics underlying accidents resulting from 

37 sequences of events. The next section describes the underlying mathematics of this approach. 
May 2014 3-A-8 NUREG-1520, Revision 2

1 A.5.1 Mathematics of Accident Sequence Frequencies and the Risk Index Method

2

3 According to 10 CFR 70.61, controls must be applied so that high-consequence events are 

4 highly unlikely and intermediate-consequence events are unlikely. This means that each 

5 accident sequence, consisting of initiating events and subsequent events, that leads to high 

6 consequences must be highly unlikely. In quantitative terms, “highly unlikely” will be treated 

7 here in terms of annual frequency of occurrence. The purpose of this section is to explain the 

8 concepts and mathematical formulas underlying the risk index method of likelihood evaluation, 

9 which is cited in this appendix as one example of an acceptable method for such evaluations in 

10 ISAs. 

11

12 Since high-consequence events are, for workers, potentially life threatening or fatal, “highly 

13 unlikely” must be taken to mean of quite low frequency. Generally, achieving such low 

14 frequency requires either redundancy, robust passive control with large safety margin, or rare 

15 external events. Redundancy of safety controls is a method for limiting the occurrence rate of 

16 accidents by applying controls such that two coincident failure conditions must exist for a 

17 high-consequence event to occur. Use of redundant controls is common in criticality safety, 

18 where the double-contingency principle is standard. There are different types of redundant 

19 control systems. The effectiveness of each of these systems depends not just on having 

20 controls with low failure rates, but also on limiting downtime after failure occurs. Downtime, or 

21 the period of vulnerability resulting from an event, may be limited by the inherent fail-safe or 

22 failure-evident nature of the event. For events lacking these properties, failure should be 

23 detected either by hardware monitoring or by surveillance testing, which is usually part of the 

24 plant preventive maintenance program. Definition of the following symbols will aid in 

25 understanding how accident frequencies depend on frequency of failure events and downtime:

26

27 λi = rate of failure of control i or of occurrence of initiating event i (in units of per year)

28 t = mean time to failure (MTTF) = 1/λi = mean uptime

29 Ti = mean downtime of control i = 1/μi

30 ui = unavailability of control i

31 sfr = system failure rate (accident rate) 

32

33 Mean downtime is often not the same as mean time to actually repair the affected safety system 

34 (MTTR), but rather indicates the mean time that the system is vulnerable to the second failure. 

35 This may be considerably shorter than the MTTR, if there is an alternative means of placing the 

36 system in a state as safe as it was with the unfailed control. 

37

38 Unavailability, u, is defined as the probability that a control or system is not available to perform 

39 its function at a particular time. Unavailability is usually the predominant component of 

40 probability of failure of a system on demand. The normal model is that a control or system is 

41 either in an unavailable (“down”) state or an available (“up”) state. The system randomly 

42 changes from one state to the other over time, governed by the failure rate λ and the repair rate 

43 μ = 1/T. As a long-run average, the unavailability of a control is thus the fraction of the time that 

44 it is down, which is the ratio of downtime to downtime plus uptime:

45

46 u = T/(t+T)

47

48 For any reasonably available system, uptime is much greater than downtime, t >> T. 

49

50 Thus, approximately, u ≈ T/t and t = 1/λ, so that u ≈ λT.

51
May 2014 3-A-9 NUREG-1520, Revision 2

1 The three most common types of redundant control systems have the following equations for 

2 their system failure rate (accident rate):

3

4 two continuous parallel controls: sfr = λ1u2(1 - u1) + λ2u1(1 - u2) 

5 usually approximated as: sfr ≈ λ1u2 + λ2u1 ≈ λ1(λ2T2) + λ2( λ1T1) 

6 Equation (1)

7 

8 three continuous parallel controls: sfr = λ1u2 u3(1 - u1)+ λ2u1u3(1 - u2) + λ3u1u2(1 - u3)

9 usually approximated as: sfr ≈ λ1u2 u3 + λ2u1u3 + λ3u1u2 

10 Equation (2)

11

12 challenging initiating event of frequency λ1 with one control: sfr = λ1u2 

13 Equation (3)

14

15 initiating event i with two redundant standby identical controls: sfr = λi u1u2 

16 Equation (4)

17

18 The system of frequency and probability (of failure on demand) described in this appendix is 

19 based on taking the logarithm of each of the terms in the above equations. Thus, for 

20 Equation (1), in log space, two terms would correspond to the two accident sequences by which 

21 the system could fail, namely control 1 first or control 2 first:

22

23 sequence 1: log(λ2) + log(u1) 

24 sequence 2: log(λ1) + log(u2) 

25

26 If only failure rates λ and downtimes T are used, then, with the approximation u ≈ λT, the 

27 formulas corresponding to Equation (1) become the following:

28

29 sfr = λ1(λ2T2) + λ2(λ1T1)

30

31 sequence 1: log(λ2) + log(λ1) + log(T1)

32 sequence 2: log(λ1) + log(λ2) + log(T2)

33

34 Thus, for two continuous redundant controls, two accident sequences are typically scored for 

35 likelihood. One of the two will usually have a larger frequency, so it is important to evaluate 

36 both. For situations modeled by Equation (3), there would be just one term. 

37

38 Table A-9 below provides one example of criteria that might be used to assign frequency index 

39 numbers (log(frequency) = log(λ)). Table A-10 provides one example of criteria that might be 

40 used to assign index numbers for probabilities of failure on demand (log(unavailability) = log(u)). 

41 Table A-11 provides one example of criteria for assigning index numbers for downtime, that is, 

42 logarithms of durations of vulnerability, log(T). Note that when MTTF >> MTTR, u = λT 

43 approximately, so that the values λ from Table A-9 and the values T from Table A-11 can be 

44 combined to obtain u for a given control if λ and T are the known quantities.

45

46 The “average” downtime, when determined by surveillance, depends on the interval of time 

47 between scheduled system surveillance tests. If a surveillance test is done weekly, then, when 

48 the system is found to be in a failed state, the time that it could have been in this state is 

49 between zero and 1 week. Thus, the average time that the system will have been down, when 
May 2014 3-A-10 NUREG-1520, Revision 2

1 discovered by the test, is half this, or 3.5 days. In units of per year, this is 3.5/365 = 0.01 year, 

2 and log(.01) = -2. Thus, a short surveillance interval can considerably reduce the system failure 

3 rate.

4

5 A.5.2 An Example Application of a Risk Index Method of Likelihood Evaluation

6

7 Accident sequences result from initiating events, followed by failure of one or more IROFS. 

8 Thus, Table A-7 has columns for the initiating event and for IROFS. The initiating event may be 

9 failure of one of the IROFS, which may be mitigative or preventive. Mitigative IROFS are 

10 measures that reduce the consequences of an accident. In accordance with Tables A-9 through 

11 A-11, index numbers are assigned to initiating events, IROFS failure events, and mitigation 

12 failure events, based on the reliability characteristics of these items.

13

14 As an example, with two redundant IROFS, there is an accident sequence in which an initiating 

15 failure of one IROFS places the system in a vulnerable state. While the system is in this 

16 vulnerable state, the second IROFS may fail, which would result in an accident with 

17 consequences exceeding the criteria in 10 CFR 70.61. For such sequences, the frequency of 

18 the accident depends on three quantities: the frequency of the first event, the duration of 

19 vulnerability, and the frequency of the second IROFS failure. For this reason, the duration of 

20 the vulnerable state should be considered, and a duration index should be assigned. The 

21 values of all index numbers for a sequence are added to obtain a total likelihood index, T. In 

22 this risk index method of evaluation, accident sequences are then assigned to one of the three 

23 likelihood categories of the risk matrix, depending on the value of this index in accordance with 

24 Table A-8.

25

26 The values of index numbers in accident sequences are assigned considering the criteria in 

27 Tables A-9 through A-11. Each table applies to a different type of event. Table A-9 applies to 

28 events that have frequencies of occurrence, such as initiating events, which may be IROFS 

29 failures or external events. When failure probabilities are required for an event subsequent to 

30 the initiating event, Table A-10 provides the index values. Table A-11 provides index numbers 

31 for durations of failure. These are used in cases where information on probability of failure on 

32 demand is not available for the IROFS failures subsequent to the initiating event. Note the third 

33 row in Table A-7; it evaluates the reverse sequence to that in the first row. That is, the second 

34 IROFS fails first. This should be considered as a separate accident sequence, because, as 

35 shown, it may have a different frequency. 
May 2014 3-A-11 NUREG-1520, Revision 2

Table A-7 Example Accident Sequence Summary and Risk Index Assignment

Process: uranium dioxide (UO2) powder preparation (PP)

Unit Process: additive blending 

Node: blender hopper node (PPB2)

Accident

Identifier

A

Initiating 

Event

or 

IROFS 1 

Failure 

B

Preventive 

Safety 

Parameter 2

or IROFS 2

Failure/Success

C

Mitigation 

IROFS

Failure/

Success

D

Likelihood* 

Index T

E=B+C+D

Likelihood 

Category

F

Consequence 

Category 

G

Risk 

Index

H=F+G

Comments 

and

Recommendations

PPB2-1A

(Criticality 

from 

blender 

leak of 

UO2)

PPB2-C1: 

Mass 

Control

Failure:

Blender 

leaks UO2

onto floor;

critical 

mass 

exceeded

Frq1 = -1 

Dur1 = -4

PPB2-C2: 

Moderation

Failure:

Sufficient water 

for criticality 

introduced while 

UO2 on floor: 

Frq2 = -2

N/A

T = -7 1 3 4

Criticality, 

consequences = 3,

IROFS 2 fails while 

IROFS 1 is in failed 

state.

T = -1-4-2 = -7

PPB2-1B 

(Radiation 

release 

from 

blender 

leak of 

UO2)

PPB2-C1: 

Mass 

Control 

Failure: 

Mass 

control

fails but 

critical 

mass not 

exceeded

Frq1=-1

Dur1 N/A

PPB2-C2: 

N/A

Ventilation

Failure: 

Ventilated 

blender 

enclosure

Prf = -3 T = -4 1 2 3

Rad consequences, 

no criticality 

unmitigated 

sequence: IROFS 1 

and mitigation fail.

T= -1-3 = -4

PPB2-1C

(Criticality 

from 

presence 

of water 

under 

blender)

PPB2-C2: 

Moderation

Failure:

Sufficient

water for 

criticality

on floor 

under UO2

blender

Frq1 = -2 

Dur1 = -3

PPB2-C1: Mass 

Control

Failure:

Blender leaks UO2

on floor while 

water present 

Frq2 = -1

N/A

T = -6 1 3 4

Criticality by reverse 

sequence of 

PPB2-1A.

Moderation fails first. 

Note different 

likelihood. T = -6

Table A-8 Likelihood Category Assignment 

Likelihood Category Likelihood Index T* (= sum of index numbers)

1 T ≤ -5

2 -5 < T ≤ -4

3 -4 < T
May 2014 3-A-12 NUREG-1520, Revision 2

Table A-9 Failure Frequency Index Numbers

Frequency 

Index No.

Based on 

Evidence

Based on Type of IROFS** Comments

-6* External event 

with frequency < 

10-6

/yr

If initiating event, no 

IROFS needed.

-4* No failures in 

30 years for 

hundreds of 

similar IROFS in 

industry

Exceptionally robust passive 

engineered IROFS (PEC), or an 

inherently safe process, or two 

independent active engineered 

IROFS (AECs), PECs, or 

enhanced administrative IROFS

Rarely justified by 

evidence. Further, most 

types of single IROFS 

have been observed to 

fail.

-3* No failures in 

30 years for tens 

of similar IROFS 

in industry

A single IROFS with redundant 

parts, each a PEC or AEC

-2* No failure of this 

type in this 

facility in 

30 years 

A single PEC

-1 A few failures 

may occur during 

facility lifetime

A single AEC, an enhanced 

administrative IROFS, an 

administrative IROFS with large 

margin, or a redundant 

administrative IROFS

0 Failures occur 

every 1 to 3 

years

A single administrative IROFS

1 Several 

occurrences per 

year

Frequent event, inadequate 

IROFS

Not for IROFS, just 

initiating events.

2 Occurs every 

week or more 

often

Very frequent event, inadequate 

IROFS

Not for IROFS, just 

initiating events.

* Indices less than (more negative than) -1 should not be assigned to IROFS unless the configuration 

management, auditing, and other management measures are of high quality, because without these 

measures, the IROFS may be changed or not maintained. 

** Failure frequencies based on experience for a particular type of IROFS, as described in this column, may 

differ from values in column 1; in this case, data from experience take precedence. 
May 2014 3-A-13 NUREG-1520, Revision 2

Table A-10 Failure Probability Index Numbers

Probability 

Index No.

Probability 

of Failure on 

Demand

Based on Type of IROFS Comments

-6* 10-6 If initiating event, no 

IROFS needed.

-4 or -5* 10-4–10-5 Exceptionally robust passive engineered 

IROFS (PEC), or an inherently safe 

process, or two redundant IROFS more 

robust than simple administrative IROFS 

(AEC, PEC, or enhanced administrative)

Rarely justified by 

evidence. Most types of 

single IROFS have 

been observed to fail.

-3 or -4* 10-3–10-4 A single passive engineered IROFS 

(PEC) or an active engineered IROFS 

(AEC) with high availability

-2 or -3* 10-2–10-3 A single active engineered IROFS, or an 

enhanced administrative IROFS, or an 

administrative IROFS for routine planned 

operations

-1 or -2 10-1–10-2 An administrative IROFS that must be 

performed in response to a rare 

unplanned demand

* Indices less than (more negative than) -1 should not be assigned to IROFS unless the configuration 

management, auditing, and other management measures are of high quality, because without these 

measures, the IROFS may be changed or not maintained.

Table A-11 Failure Duration Index Numbers

Duration 

Index 

No.

Average Failure Duration Duration in Years Comments

1 More than 3 years 10

0 1 year 1

-1 1 month 0.1 Formal monitoring to 

justify indices less than -1

-2 A few days 0.01

-3 8 hours 0.001

-4 1 hour 10-4

-5 5 minutes 10-5
May 2014 3-A-14 NUREG-1520, Revision 2

1 As shown in Table A-11, the duration of failure, and thus the period that the system is in a state 

2 of heightened vulnerability, is accounted for in establishing the overall frequency of the accident 

3 sequence. The period of vulnerability will normally be terminated by discovery of the vulnerable 

4 condition or failure; the system will then be rendered safe, either by removing the hazardous 

5 material, or by repairing or substituting for the safety function of the failed IROFS. The duration 

6 of this period of vulnerability determines the index value to be assigned from Table A-11. 

7

8 For all these index numbers, the more negative the number, the lower the frequency of the 

9 event. Accident sequences may consist of varying numbers of events, starting with an initiating 

10 event. The total likelihood index is the sum of the indices for all the events in the sequence, 

11 including those for duration, except the initiating event, for which only the occurrence frequency 

12 index should be used. For example, a three-event sequence would correspond to an event 

13 sequence frequency of the form λ1(λ2T2) (λ3T3), or five index values, three being frequencies, 

14 and two durations. 

15

16 Consequences are assigned to one of the three consequence categories of the risk matrix, 

17 based on calculations or estimates of the actual consequences of the accident sequence. The 

18 consequence categories are based on the levels identified in 10 CFR 70.61. Multiple types of 

19 consequences can result from the same event. If there are multiple types of consequence, the 

20 consequence category is the most severe. Similarly, if a range of consequences could occur, 

21 then the highest consequence event of this range could occur, and if it falls in the high22 consequence range, it should be evaluated as such. 

23

24 Table A-12 provides a more detailed description of the accident sequences used in the example 

25 of Table A-7. Such descriptive information may be necessary for the reviewer to understand the 

26 nature of the accident sequences listed in Table A-7. 

27

28 Table A-13 is an example of one format for the descriptive list of IROFS required by the 

29 regulation. It should also include external initiating events that appear in the accident 

30 sequences and whose frequencies are relied on in demonstrating that the overall accident 

31 sequence frequency complies with the likelihood requirements. The information on IROFS in 

32 Table A-13 should have sufficient detail to permit the reviewer to understand why the initiating 

33 events and IROFS listed in Table A-7 have the frequency, unavailability, or duration indices 

34 assigned. Thus, Table A-13 may also contain such information as (1) the margins to safety 

35 limits, (2) the redundancy of an IROFS, and (3) the measures taken to ensure adequate 

36 reliability of an IROFS, if this information is necessary to understand the reliability and safety 

37 function of the IROFS with respect to the likelihood performance requirements. 
May 2014 3-A-15 NUREG-1520, Revision 2

Table A-12 Accident Sequence Descriptions

Process: UO2 powder preparation (PP)

Unit: additive blending

Node: blender hopper node (PPB2)

Accident

(see Table A-6)

Description

PPB2-1A

Blender UO2 leak 

criticality

The initial failure is a blender leak of UO2 that results in a mass sufficient for criticality on the 

floor. (This event is not a small leak.) Before the UO2 can be removed, moderator sufficient to 

cause criticality is introduced. Duration of critical mass UO2 on floor is estimated to be 1 hour.

PPB2-1B

Blender UO2 leak, 

radiological 

release

The initial failure is a blender leak of UO2 that results in a mass insufficient for criticality on the 

floor or a mass sufficient for criticality but moderation failure does not occur. Consequences are 

radiological, not a criticality. A ventilated enclosure should mitigate the radiological release of 

UO2. If it fails during cleanup or is not working, unmitigated consequences occur.

PPB2-1C The events of PPB2-1A occur in reverse sequence. The initial failure is introduction of water 

onto the floor under the blender. Duration of this flooded condition is 8 hours. During this time, 

the blender leaks a critical mass of UO2 onto the floor. Criticality occurs.

Table A-13 Descriptive List of IROFS

Process: UO2 powder preparation (PP) 

Unit: additive blending

Node: blender hopper node (PPB2)

IROFS 

Identifier

Safety 

Parameter 

and Limits

IROFS Description Max. Value of 

Other 

Parameters

Reliability 

Management 

Measures

Quality 

Assurance 

Grade

PPB2-C1 Mass outside

hopper: zero

Mass outside hopper: Hopper 

and outlet design prevent UO2

leaks, double gasket at outlet

Full water 

reflection, 

enrichment 5%

Surveillance for 

leaked UO2 each 

shift

A

PPB2-C2 Moderation:

in UO2 < 1.5 

wt.%

External water

in area: zero

Moderation in UO2: Two sample 

measurements by two persons 

before transfer to hopper

External water: Posting excluding 

water, double piping in room, floor 

drains, roof integrity

Full water 

reflection, 

enrichment 5%

Drain, roof, and 

piping under 

safety-grade 

maintenance

A

Note: In addition to IROFS, which are facility hardware and procedures, this table should describe external 

initiating events, the low likelihood of which is relied on to achieve acceptable risk, especially those that are 

assigned frequency indices lower than -4. The descriptions of these initiating events should contain 

information supporting the frequency index value selected by the applicant.

A.6 Determination of Likelihood Category in Table A-8

The likelihood category is determined by calculating the likelihood index, T, which equals the 

sum of the indices for the events in the accident sequence. Based on the calculated value of T, 

the likelihood category of each accident sequence can be determined from Table A-8.
May 2014 3-A-16 NUREG-1520, Revision 2

1 A.7 Failure Probability Index Numbers in Table A-10

2

3 Occasionally, information concerning the reliability of an IROFS may be available as a 

4 probability on demand. That is, there may be a history of tests or incidents where the system in 

5 question is demanded to function. To quantify such accident sequences, the demand 

6 frequency, the initiating event, and the demand failure probability of the IROFS must be known. 

7 This table provides an assignment of index numbers for such IROFS in a way that is consistent 

8 with Table A-9. The probability of failure on demand may be the likelihood that it is in a failed 

9 state when demanded (availability) or that it fails to remain functional for a sufficient time to 

10 complete its function.

11

12 A.8 Management Measures for Items Relied on for Safety

13

14 Table A-13 is an acceptable way of listing IROFS in all the general types of accident sequences 

15 having consequences exceeding those identified in 10 CFR 70.61. The items listed should 

16 include all IROFS and all external events whose low likelihood of occurrence is relied on to meet 

17 the performance requirements of 10 CFR 70.61. For certain IROFS or accident sequences 

18 included in this list, information on management measures that is specific to that sequence or 

19 IROFS should be presented to permit the reviewer to understand how the IROFS perform. The 

20 reviewer examines this list to determine whether adequate management measures have been 

21 applied to each IROFS to ensure its continual availability and reliability, in conformance with 

22 10 CFR 70.62(d). Management measures include such activities as maintenance, training, 

23 configuration management, audits and assessments, and quality assurance. The baseline 

24 design criteria indicate criteria for management measures; SRP Chapters 4 through 7 and 

25 Chapter 11 describe other criteria in greater detail. IROFS may have management measures 

26 applied in varying ways or to varying degrees, depending on the nature of the IROFS, and the 

27 degree of reliability assumed in demonstrating compliance with the likelihood requirements. 

28 This is the meaning of “graded management measures.” 

29

30 A.9 Risk-Informed Review of Items Relied on for Safety

31

32 Column (H) in Table A-7 gives the risk indices for each accident sequence identified in the ISA. 

33 There are two indices, uncontrolled and controlled. The controlled index is a measure of risk 

34 without credit for the IROFS. If the uncontrolled risk index is a 6 or 9, while the controlled index 

35 is an acceptable value (4 or less), the set of IROFS involved are significant in achieving 

36 acceptable risk. That is, these IROFS have high risk significance. Reviewers will use the 

37 uncontrolled risk index to identify all risk-significant systems of IROFS. These systems of 

38 IROFS will be reviewed more closely than IROFS established to prevent or mitigate accident 

39 sequences of low risk.

40

41 REFERENCES 

42

43 U.S. Code of Federal Regulations, Chapter I, Title 10, “Energy,” Part 20, “Standards for 

44 Protection Against Radiation.”

45

46 U.S. Code of Federal Regulations, Chapter I, Title 10, “Energy,” Part 70, “Domestic Licensing of 

47 Special Nuclear Material.” 

48

49 U.S. Nuclear Regulatory Commission, “Nuclear Fuel Cycle Facility Accident Analysis 

50 Handbook,” NUREG/CR-6410, March 1998.
May 2014 3-AA-1 NUREG-1520, Revision 2

ANNEX TO APPENDIX A

USE OF APPENDIX A RISK INDEX METHODOLOGY

1 Introduction

2

3 The purpose of this annex is to clarify the proper use of the semiquantitative index method as 

4 described in Appendix A to Chapter 3 of this Standard Review Plan. Several licensees and 

5 applicants have used the index method of Appendix A (or a variation thereof) in performing their 

6 integrated safety analyses (ISAs). The U.S. Nuclear Regulatory Commission (NRC) reviews of 

7 these ISA Summaries have discovered a need for additional guidance on the use of this 

8 method. Because of the method’s widespread use and a lack of common understanding about 

9 its use, guidance on the index method is appropriate. 

10

11 As stated in the introduction to Appendix A, the index method is but one method of likelihood 

12 evaluation. The index method is not strictly a qualitative method; rather, it is a semiquantitative

13 method that considers both qualitative and quantitative information (if it is available and 

14 applicable). In this method, the definition of likelihood terms (i.e., “not unlikely,” “unlikely,” and 

“highly unlikely”) is expressed quantitatively (more than 10-4 per event, per year; between 10-4 15

and 10-5 per event, per year; and less than 10-5 16 per event, per year, respectively). As a purely 

17 qualitative method would use purely qualitative definitions of likelihood and qualitative methods 

18 of evaluating likelihood, much of the quantitative discussion in this appendix would not apply. 

19 However, this method illustrates the logic that should be used in even a purely qualitative 

20 method.

21

22 The index method is one acceptable method of demonstrating compliance with the performance 

23 requirements. However, taking credit for using this method requires that the applicant follow all 

24 of the guidance contained in Appendix A. Otherwise, the applicant should provide additional 

25 justification. 

26

27 Likelihood Definitions

28

29 The likelihood definitions in Table A-6 of Appendix A are, as stated above, given in quantitative 

terms (e.g., “highly unlikely” is defined as less than 10-5 30 per event, per year). The footnote to 

31 Table A-6 indicates, however, that these are based on approximate order-of-magnitude ranges. 

32 Therefore, these values should not be regarded as strict numerical limits but as indicative of the 

33 approximate order of magnitude of likelihood. Any definition of likelihood should be stated on a 

34 per-event basis. 

35

36 Likelihood Evaluation Method

37

38 The likelihood evaluation method used should be consistent with the likelihood definitions, such 

39 that the qualitative score assigned can be compared to the likelihood definitions. In the index 

40 method, the likelihood index for the accident sequence must be no greater than -5 to meet the 

41 definition of “highly unlikely” and must be no greater than -4 to meet the definition of “unlikely.”

42 The likelihood index for the accident sequence is determined by summing likelihood indices for 

43 the initiating event and subsequent failures of items relied on for safety (IROFS). Tables A-9, 

44 A-10, and A-11 of Appendix A present criteria for the assignment of the likelihood indices.
May 2014 3-AA-2 NUREG-1520, Revision 2

1 Appendix A distinguishes between two different kinds of events that can be combined to form 

2 the accident sequences in the ISA summary. The two basic kinds of events are (1) events that 

3 are characterized by a frequency of occurrence, and (2) events that are characterized by a 

4 probability of failure on demand (PFOD). In the index method of Appendix A, the category to 

5 which an event belongs determines how it is scored by means of either Table A-9 or A-10, as 

6 explained below.

7

8 Events characterized by a frequency of occurrence (f-type events) can include external events, 

9 internal events that are not IROFS failures, or IROFS failures. IROFS failures characterized by 

10 a frequency of occurrence are those that are required to be continuously present, rather than 

11 those that are required to perform a safety function only when certain conditions are present. 

12 Examples may include favorable geometry equipment or an active engineered device 

13 monitoring a continuous process.

14

15 Events characterized by a PFOD (p-type events) typically include IROFS that are not required to 

16 be continuously present but that must perform a safety function on demand (subsequent to 

17 some process deviation or failure). Examples include active interlocks that perform some 

18 protective function when system parameters exceed preset limits, administrative controls 

19 required in response to process deviations, or certain administrative controls in batch 

20 processes. These are usually part of the subsequent failures following the initiating event but 

21 may sometimes be part of the initiating event.

22

23 In general, accident sequences may comprise many individual events. In general, accident 

24 sequences consist of an initiating event followed by the failure of one or more IROFS. Because 

25 the overall accident sequence likelihood must be consistent with the likelihood categories, it 

26 must have the same dimensional units as those of the likelihood definitions (i.e., probability per

27 event, per year). Even though qualitative indices are used instead of quantitative probabilities, 

28 this requirement imposes constraints on the ways in which individual indices may be combined.

29

30 For simplicity, the following considers only two-event sequences (in which the events are 

31 independent). The two basic kinds of events result in four basic types of two-event accident 

32 sequences, as described in the following sections.

33

34 F-Type Initiating Event with Subsequent P-Type IROFS Failure

35

36 In the index method of Appendix A, a failure frequency index may be applied to the initiating 

37 event using the criteria in Table A-9, and a failure probability index may be applied to the 

38 subsequent IROFS failure using the criteria in Table A-10. The overall likelihood index for the 

39 accident sequence is the sum of the likelihood indices for the two events. This is because the 

40 IROFS is assumed to be demanded every time the initiating event occurs.

41

42 Mathematically, this results in an accident sequence likelihood index corresponding to an 

43 accident sequence likelihood with the correct dimensional units:

44

• accident sequence likelihood (yr-1) = initiating event frequency (yr-1 45 ) × PFOD

46 accident sequence index = initiating event index + subsequent failure index

47

48 An example of this type of accident sequence is a criticality sequence consisting of a loss of 

49 concentration control in a continuous solution processing operation, followed by failure of an 
May 2014 3-AA-3 NUREG-1520, Revision 2

1 inline concentration monitor that closes an isolation valve on a transfer line upon detection of 

2 highly concentrated solution.

3

4 F-Type Initiating Event with Subsequent F-Type IROFS Failure

5

6 Using the index method of Appendix A, a failure frequency index may be applied to both the 

7 initiating event and the subsequent IROFS failure using the criteria in Table A-9. The overall 

8 likelihood index for the accident sequence is the sum of the individual likelihood indices for the 

9 two events and a duration index for the initiating event. This is because the probability of the 

10 second event occurring concurrently with the first event is dependent on the time during which 

11 the conditions caused by the first event persist. For the accident sequence likelihood to have 

the correct units (yr-1 12 ), the duration of failure for the first event must be considered.

13 

14 Mathematically, this results in an accident sequence likelihood index corresponding to an 

15 accident sequence likelihood with the correct dimensional units:

16

• accident sequence likelihood (yr-1) = initiating event frequency (yr-1 17 ) × initiating 

event duration (yr) × subsequent failure frequency (yr-1 18 )

19

20 • accident sequence index = initiating event index + initiating event duration 

21 index + subsequent failure index

22

23 An example of this type of accident sequence is a criticality sequence consisting of a loss of 

24 geometry control followed by a loss of moderation control resulting from the unrelated sprinkler 

25 activation before geometry control can be restored.

26

27 P-Type Initiating Event with Subsequent P-Type IROFS Failure

28

29 Using the index method of Appendix A, a failure probability index may be applied to both the 

30 initiating event and the subsequent IROFS failure using the criteria in Table A-10. The overall 

31 likelihood index for the accident sequence is the sum of the individual likelihood indices for the 

32 two events, which includes consideration of the demand rate associated with the initiating event. 

33 This is because the total failure frequency for the initiating event depends on the frequency with 

34 which the demand occurs, as well as the associated PFOD. The subsequent IROFS is 

35 assumed to be demanded every time the initiating event occurs. For the accident sequence 

likelihood to have the correct units (yr-1 36 ), the demand rate of the first event must be considered.

37

38 Mathematically, this results in an accident sequence likelihood index corresponding to an 

39 accident sequence likelihood with the correct dimensional units:

40

• accident sequence likelihood (yr-1) = initiating event demand rate (yr-1 41 ) × initiating 

42 event PFOD × subsequent event PFOD

43

44 • accident sequence index = initiating event index (including demand rate) 

45 + subsequent failure index

46

47 An example of this type of accident sequence is a criticality sequence consisting of the failure of 

48 an operator to sample solution before transfer in a batch operation, followed by failure of an 

49 inline concentration monitor as discussed previously.
May 2014 3-AA-4 NUREG-1520, Revision 2

1 P-Type Initiating Event with Subsequent F-Type IROFS Failure

2

3 Using the index method of Appendix A, a failure probability index may be applied to the initiating 

4 event using the criteria in Table A-10. A failure frequency index may be applied to the 

5 subsequent IROFS failure using the criteria in Table A-9. The overall likelihood index for the 

6 accident sequence is the sum of likelihood indices for the two events, which includes 

7 consideration of the demand rate associated with the initiating event and a duration index for the 

8 initiating event. This is because the failure frequency for the initiating event depends on the 

9 frequency with which the demand occurs, as well as the associated PFOD. The probability of 

10 the second event occurring concurrently with the first event is dependent on the time during 

11 which the conditions caused by the first event persist. For the accident sequence likelihood to 

have the correct units (yr-1 12 ), both the duration of failure for the first event and its demand rate 

13 must be considered. 

14

15 Mathematically, this results in an accident sequence likelihood index corresponding to an 

16 accident sequence likelihood with the correct dimensional units:

17

• accident sequence likelihood (yr-1) = initiating event demand rate (yr-1 18 ) × initiating 

event PFOD × initiating event duration (yr) × subsequent failure frequency (yr-1 19 )

20

21 • accident sequence index = initiating event index (including demand rate) + failure 

22 duration index + subsequent failure index

23

24 An example of this type of accident sequence is a criticality sequence consisting of a uranium 

25 solution spill that results from improper preventive maintenance on a pump, followed by the loss 

26 of moderation control because of inadvertent sprinkler activation before the spill can be 

27 cleaned up.

28

29 Use of Tables A-9, A-10, and A-11 in Appendix A 

30

31 As illustrated above, an accident sequence generally consists of an initiating event with a 

32 certain frequency, followed by a number of subsequent events. While the number and type of 

33 events making up the sequence may vary, the likelihood indices of the individual events are 

34 combined, with appropriate consideration for duration of failure and demand rate, to arrive at a 

35 likelihood index for the accident sequence as a whole. The basic steps in this process are 

36 outlined below:

37

38 (1) Determine the events making up the sequence (initiating event and subsequent failures).

39

40 (2) Determine whether the event is characterized by a frequency of occurrence (f-type) or a 

41 PFOD (p-type). If an f-type event, use Table A-9 to assign the indices. If a p-type event, 

42 use Table A-10 to assign the indices. 

43

44 (3) If the initiating event is a p-type event, take the demand rate into account to modify the 

45 indices from Table A-9.

46

47 (4) If the subsequent event is an f-type event, take into account the duration index for the 

48 initiating event from Table A-11.

49

50 (5) Combine the appropriate indices into an overall accident sequence likelihood index.
May 2014 3-AA-5 NUREG-1520, Revision 2

The table below summarizes the use of Tables A-9, A-10, and A-11 to determine overall 

accident sequence likelihood:

Initiator Type Subsequent 

Event Type

Initiator Index Subsequent 

Event Index

Duration 

Index

Accident 

Sequence 

Index

f-type p-type f1: Table A-9 p2: Table 

A-10

NA f1 × p2

f-type f-type f1: Table A-9 f2: Table A-9 d1: Table 

A-11

f1 × d1 × f2

p-type p-type p1: Table 

A-10*

p2: Table 

A-10

NA p1 × p2

p-type f-type p1: Table 

A-10*

f2: Table A-9 d1: Table 

A-11

p1 × d1 × f2

* To convert PFOD indices to frequency indices, use the indices of Table A-10 modified to take demand rate 

into account as follows:

Demand Rate Modify Table A-10 Index

Hundreds of times per year (daily) Increase base index by 2

Tens of times per year (monthly) Increase base index by 1

Once per year Use base index

Once every 10 years Decrease base index by 1

1 Users of these tables must be careful not to confuse frequency with probability. For example, it 

2 is often assumed that the initiating event occurs because soothe assumption is simpler and 

3 more conservative. This is not, however, equivalent to assigning an initiating event frequency 

4 of 1, which is an event that occurs once per year. The confusion of failure frequency (with units 

5 of inverse time) with probability (dimensionless) can lead to significant errors in the overall 

6 accident sequence likelihood.

7

8 Example: In this accident sequence, the initiating event is solution sampling before transfer to a 

9 tank with an unfavorable geometry. A single administrative control might have a probability 

10 index of -2 (with appropriate management measures or redundancy). Similarly, if the historical 

data indicated a PFOD of 10-2 11 , an index of -2 would be appropriate. However, if this operation is 

12 a batch process conducted 10 times per year, this results in an initiating event frequency of 

10/yr × 10-2 (PFOD) = 10-1 13 /yr (for an index of -1). If the operation is conducted 100 times per 

year, this results in an initiating event frequency of 100/yr × 10-2 (PFOD) = 100 14 /yr (for an index 

15 of 0). Use of Table A-10 without any consideration of the demand rate would result in an index 

16 of -2. 

17 Use of the incorrect table can also lead to erroneous results. A comparison of the indices in 

18 Tables A-9 and A-10 for the same type of control (although this is not the only factor that should 

19 be considered) immediately shows that use of Table A-9 results in a higher index than does use 
May 2014 3-AA-6 NUREG-1520, Revision 2

1 of Table A-10. For example, a simple administrative control (without enhancing factors such as 

2 redundancy or large margin) would have a probability index of -1 to -2 based on Table A-10, but 

3 a frequency index of 0 based on Table A-9. This is intuitively reasonable because Table A-9 is 

4 for events characterized by a frequency (which must be present on a continuous basis) and 

5 Table A-10 is for events that are demanded only under certain conditions (which must be 

6 present on occasion).

7

8 Additional Considerations in the Use of Index Tables

9

10 Assignment of a qualitative score may be based either on objective evidence of the frequency of 

11 occurrence or on certain qualitative characteristics of the process or facility (availability and 

12 reliability qualities). In accordance with this, Tables A-9 and A-10 contain two columns that 

13 represent two different methods for assigning likelihood indices. As stated in the introduction to 

14 Appendix A, this is a semiquantitative method that allows for the use of quantitative information 

15 if available. 

16

17 For initiating events that are external events or internal events other than IROFS failures, the 

18 column entitled “Based on Evidence” in Table A-9 should be used in assigning indices. For 

19 IROFS failures to which Table A-9 applies, either the column entitled “Based on Evidence” or 

20 “Based on Type of IROFS” may be used. Because the type of IROFS is only one of the 

21 availability and reliability qualities on which likelihood depends, the footnote to this table 

22 indicates that the index scores applicable to a particular type of IROFS can be one value higher 

or lower than the index shown.1 23 Thus, other specific availability and reliability qualities (as 

24 discussed in Section 3.4.3.2(9) of this SRP) should be considered in assigning the final 

likelihood index.2 25 In the absence of sufficiently detailed information about these factors, 

26 appropriate conservatism should be used in assigning indices (e.g., using the highest index in 

27 the range). Because of the large uncertainty associated with basing likelihood on the type of 

28 IROFS, historical and/or operating evidence should be used to assign indices whenever 

29 available. The same considerations discussed above should be employed when using 

30 Table A-10 to assign likelihood indices. 

31

32 The presence of two columns should not be construed to mean that the two sets of criteria may 

33 be considered equivalent except in a rough, order-of-magnitude sense (e.g., a single passive 

engineered IROFS does not necessarily have a PFOD of 10-3 to 10-4 34 ). This is because the type 

35 of IROFS is only one of the availability and reliability qualities that must be considered.

36

37 Appropriate use of Tables A-9 and A-10 to assign likelihood indices also requires that attention 

38 be given to the footnotes and comments in these tables. As indicated in the footnotes, indices 

39 less than -1 should not be used unless the management measures are of high quality. This is 

40 because even though a passive engineered control may have high inherent reliability while it is 

41 installed, this control could be easily defeated by a poor configuration management program, 

 1 The title “Based on Type of IROFS” is somewhat of a misnomer in that several of the criteria also include 

consideration of redundancy, margin, and independence. Indices based solely on the type of IROFS would 

cover an even broader range.

2 This is consistent with the caveat for Table A-4, which warns that such coarse criteria are useful only for 

screening purposes or making an initial estimate of the likelihood. Because IROFS meeting these criteria 

can have a broad range of reliability, management measures applied to all the availability and reliability 

qualities of the IROFS should be considered in assigning the likelihood indices.
May 2014 3-AA-7 NUREG-1520, Revision 2

1 which is administrative in nature (as are all management measures). Justification should be 

2 provided as to why the management measures are deemed to be of high quality. Also, the ISA 

3 summary should justify the use of a more negative index whenever a range of indices is 

4 possible. As the comments suggest, the more negative the index, the more justification is 

5 required. As indicated, indices of -4 and -5 can rarely be justified by evidence. Use of these 

6 indices requires substantial evidence that the IROFS are exceptionally robust. 

7

8 The assignment of failure duration indices using Table A-11 should also be based on objective 

9 criteria (such as documented mean time to repair or surveillance periods established in plant 

10 procedures).

11

12 When the analysis uses demand rates to modify probability indices from Table A-10, 

13 conservative estimates of the demand rate should be used and the basis for this estimate 

14 documented and, if the rates could credibly be changed, controlled. For example, the time 

15 needed to fill a cylinder may depend on inherent physical laws and would not need specific 

16 controls. However, if the maximum allowed inventory limits the number of batches, the license 

17 or plant procedures should control this inventory.

18

19 Description of Accident Sequences and IROFS

20

21 Tables A-12 and A-13 include descriptions of accident sequences and IROFS. These must be 

22 sufficiently clear to permit the reviewer to understand the sequence of events needed for an 

23 accident to occur and how the established controls prevent the sequence from occurring. The 

24 initial failure and all subsequent failures necessary for the sequence to progress to the ultimate 

25 consequences (an accident exceeding the consequence thresholds in Title 10 of the Code of 

26 Federal Regulations (10 CFR) 70.61, “Performance Requirements”) should be specified. In 

27 addition, any initial conditions credited in meeting the performance requirements should be 

28 specified. If important to the likelihood of the sequence, the order in which these events occur 

29 should be specified. For example, in Table A-12, sequence PPB2-1C is the reverse of the 

30 events in sequence PPB2-1A. When failure duration indices are considered, these pertain to 

31 the initiating event; therefore, the accident sequence likelihood is dependent on which event 

32 occurs first.

33

34 In describing IROFS, it is important that the safety function performed by the IROFS and the 

35 attributes of the IROFS necessary to perform the safety function be specified. For example, for 

36 the first IROFS in Table A-13, the safety function is to prevent mass from accumulating outside 

37 the hopper. Therefore, the only attribute of IROFS PPB2-C1 that must be specified is that it be 

38 designed to prevent leaks; such a design would include the use of a double gasket at the 

39 hopper’s outlet. Because the material of composition, size, and other attributes of the hopper 

40 have no role in preventing this accident sequence, they need not be specified. The second 

41 IROFS is an example of a system of IROFS that collectively provides for moderation control 

42 (i.e., dual sampling, administrative exclusion of water, double piping, floor drains, and roof 

43 integrity). As in the preceding example, the size of the piping is not significant; double piping is 

44 the only feature important to preventing this accident sequence. The level of detail should be 

45 sufficient to provide assurance that safety-significant aspects of the IROFS are recognized and 

46 appropriately controlled. However, excessive detail could lead to obscuring the safety47 significant aspects of IROFS and could lead to unnecessary and burdensome changes to the 

48 ISA and ISA summary. IROFS may be specified at the subcomponent level, component level, 

49 or system level, as appropriate. For example, it is not necessary to specify every geometry 

50 limited pipe in the building as an IROFS. If the safety function is to maintain geometry control, it 
May 2014 3-AA-8 NUREG-1520, Revision 2

1 would be sufficient to specify a systems-level IROFS with the description “all fissile material 

2 piping in the solution recovery area will be less than 2 inches in diameter.”

3

4 A single piece of equipment may perform several different safety functions and be credited in 

5 several different accident sequences. In such cases, the accident sequence must clearly 

6 describe the safety function and attribute of the IROFS being credited, as well as the failure 

7 mode of the IROFS that leads to the accident.

8

9 Summary Table of Accident Sequences

10

11 Table A-7 of Appendix A is a summary table showing several accident sequences for a 

12 powder-blending process. This is one way to display the information on accident sequences 

13 obtained during performance of the ISA. As shown in Appendix A to NUREG-1718, “Standard 

14 Review Plan for the Review of an Application for a Mixed Oxide Fuel Fabrication Facility,”

15 issued August 2000, a fault tree (quantitative or qualitative) is one of the other formats that may 

16 be used. The important information that must be conveyed, however, is a list of accident 

17 sequences, identification of the initiating event, the set of subsequent events leading to the 

18 accident and the IROFS that prevent them, the likelihood of the initiating event and subsequent 

19 failures, the ultimate consequence category, and the overall assessment of compliance with the 

20 performance requirements (e.g., total risk index). Any other information needed to demonstrate 

21 that the performance requirements are met should also be specified (e.g., initial conditions, 

22 demand rate, duration indices, index modification for dependent failures). Table A-7 shows two 

23 types of accident sequences: (1) two sequences initiated by IROFS failures (both f-type 

24 initiating events with f-type subsequent failures and crediting duration indices) and (2) two 

25 sequences initiated by internal events other than IROFS failures (and crediting initiating event 

26 frequency).

27

28 While this guidance follows the structure of Appendix A to this Standard Review Plan, it also 

29 applies to Appendix A to NUREG-1718.

30

31

32 REFERENCES 

33

34 U.S. Code of Federal Regulations, Chapter I, Title 10, “Energy,” Part 70, “Domestic Licensing of 

35 Special Nuclear Material.” 

36

37 U.S. Nuclear Regulatory Commission, “Standard Review Plan for the Review of an Application 

38 for a Mixed Oxide (MOX) Fuel Fabrication Facility,” NUREG-1718, August 2000.
May 2014 3-B-1 NUREG-1520, Revision 2

APPENDIX B

QUALITATIVE CRITERIA FOR EVALUATION OF LIKELIHOOD

1 Purpose

2

3 This appendix provides additional guidance on the use of qualitative criteria in methods for 

4 evaluation of likelihood. These evaluations are used in demonstrating compliance with the 

5 performance requirements of Title 10 of the Code of Federal Regulations (10 CFR) 70.61, 

6 “Performance Requirements.”

7

8 Introduction

9

10 The regulation in 10 CFR 70.61(b) requires that the risk of each credible high-consequence 

11 event be limited by ensuring that upon implementation of engineered or administrative controls, 

12 the event is made highly unlikely or its consequences reduced to less than high consequence. 

13 This regulation similarly requires that the risk of each credible intermediate-consequence event 

14 be limited by ensuring that the event is made unlikely, or its consequences reduced. Rather 

15 than defining the terms “highly unlikely,” “unlikely,” and, “credible,” 10 CFR 70.65(b)(9) instead 

16 states that the applicant must include definitions of these terms in its integrated safety analysis 

17 (ISA) summary.

18

19 As stated in Section 3.4.3.2(9) of this Standard Review Plan (SRP), the applicant’s definitions of 

20 these terms may be either quantitative or qualitative. The method used to evaluate accident 

21 sequence likelihood must be consistent with the definitions. Quantitative definitions require 

22 quantitative methods; qualitative definitions require qualitative methods. Qualitative methods 

23 are based on objective qualitative criteria and characteristics of the process or system being 

24 evaluated. In addition, some methods (semiquantitative methods) may rely on a mixture of 

25 qualitative and quantitative definitions, methods, and information. This appendix provides

26 general guidance on the use of qualitative methods for evaluation of likelihood. However, the 

27 U.S. Nuclear Regulatory Commission’s (NRC’s) review of recently submitted ISA Summaries 

28 has revealed a lack of common understanding as to what constitutes an acceptable qualitative 

29 method.

30

31 Additional guidance is provided on the acceptance criteria for qualitative methods of evaluating 

32 likelihood, both for the failure of items relied on for safety (IROFS) and for accident sequences 

33 as a whole. Either external events or internal events (which may or may not be IROFS failures)

34 may initiate these accident sequences. Appendix D to Chapter 3 of this SRP provides 

35 additional guidance on the use of initiating events that are natural phenomena. Appendix C to 

36 Chapter 3 offers additional guidance on the use of initiating events that are internal to the 

37 facility. That guidance may be used with the guidance in this appendix as an acceptable 

38 qualitative method for likelihood evaluation.
May 2014 3-B-2 NUREG-1520, Revision 2

1 Discussion

2

3 Definitions of Likelihood

4

5 According to 10 CFR 70.65(b)(9), the ISA summary must define the terms “unlikely,” “highly 

6 unlikely,” and “credible.” Section 3.4.3.2(9) of this SRP states that qualitative definitions of 

7 likelihood are acceptable if they meet two conditions: (1) they are reasonably clear and based 

8 on objective criteria and (2) they can reasonably be expected to consistently distinguish 

9 accidents that are highly unlikely from those that are merely unlikely (or not unlikely). This 

10 means that the definitions should be sufficiently clear that there is reasonable assurance that 

11 they will yield the same result when applied by different reviewers and that they can be used to 

12 make meaningful distinctions between events in different likelihood categories. Both the 

13 definitions of likelihood and the methods for likelihood determination should meet these criteria 

14 since they must work together to ensure that the performance requirements are met.

15

16 This NUREG states that “objective criteria” means that the method relies on specific identifiable 

17 characteristics of a process design, rather than subjective judgments of adequacy. Because the 

18 likelihood of an accident sequence is a function of the likelihood of the initiating event, the 

19 subsequent IROFS failures, and the relationship between the IROFS (e.g., whether the IROFS 

20 are independent), the characteristics of the process design that the method should rely on are 

21 the specific identifiable characteristics of the initiating event, IROFS failures, and other process 

22 features that affect the likelihood of the accident sequence. These features include the safety 

23 margin, type of control, type and grading of management measures, whether the system is 

24 fail-safe or failure is self-announcing, failure modes, demand rates, and failure rates for 

25 individual IROFS (whether credited as part of the initiating event or subsequent failures). These 

26 features include the degree of redundancy, independence, diversity, and vulnerability to 

27 common-cause failure for systems of IROFS. The following sections describe these features in 

28 detail. It is important that any features of the process or equipment necessary to meet the 

29 performance requirements are recognized as important to safety and appropriately maintained 

30 through the use of management measures.

31

32 Examples of acceptable qualitative definitions of likelihood are the second and third definitions

33 of “not credible” in Section 3.4.3.2(9) of this SRP:

34

35 A process deviation consists of a sequence of many unlikely human actions or 

36 errors for which there is no reason or motive....

37

38 A convincing argument exists that, given physical laws, the process deviations

39 are not possible, or are unquestionably extremely unlikely....

40

41 Similarly, the following is an example of an acceptable qualitative definition of “highly unlikely”:

42

43 a system of IROFS that possesses double-contingency protection, where each of 

44 the applicable qualities is present to an appropriate degree

45

46 In this definition, the qualities to be considered should be described in sufficient detail so that 

47 their effect on the overall likelihood can be evaluated. This is the meaning of “present to an 

48 appropriate degree.” Other definitions are acceptable provided that they meet the two criteria 

49 specified above and provide system features to ensure that the likelihood is appropriately 

50 maintained.
May 2014 3-B-3 NUREG-1520, Revision 2

1 Evaluation of Likelihood

2

3 Accident sequences, in general, consist of an initiating event followed by one or more 

4 subsequent events. The likelihood of an accident sequence is, therefore, a function of the 

5 likelihood of the individual events making up the accident sequence and the relationship 

6 between them (e.g., whether they are independent). Because the likelihood of the accident 

7 sequence must be compared to the likelihood definitions to determine whether it is “unlikely,”

8 “highly unlikely,” or “not unlikely,” qualitative methods of likelihood evaluation are acceptable if 

9 they (1) are reasonably clear and based on objective criteria and (2) can reasonably be 

10 expected to consistently distinguish accidents that are “highly unlikely” from those that are 

11 merely “unlikely.” The likelihood definitions establish the standard for what is “unlikely” and 

12 “highly unlikely,” and the assigned likelihood for the accident sequence is then compared to this 

13 standard. As mentioned above, the method must take into account all objective qualities of the 

14 system that can reasonably be considered to affect likelihood. These qualities are referred to in 

15 this NUREG as the “reliability and availability” qualities of IROFS or systems of IROFS.

16

17 Initiating Events and Initial Conditions

18

19 Each accident sequence begins with an initiating event. An initiating event may consist of an 

20 external event (including a natural phenomenon or external manmade event), an internal event 

21 other than an IROFS failure, or an IROFS failure. Natural phenomena may include heavy rains, 

22 winds, flooding, earthquakes, and fires. External manmade events may include impacts from 

23 nearby facilities, aircraft or vehicle crashes, fires, and loss of offsite utilities. Internal events 

24 other than IROFS failures may include spills, non-IROFS equipment failure, process deviations, 

25 industrial accidents, and loss of onsite utilities. In a qualitative method of likelihood 

26 determination, a qualitative score is associated with the initiating event based on its objective 

27 qualities. The score may be expressed in either numerical (e.g., -1, -2, -3) or nonnumerical 

28 (e.g., A, B, C, D) form but is still qualitative if based on qualitative criteria.

29

30 The likelihood of external initiating events (by definition, they are outside the control of the 

31 facility) does not rely on any design features of the facility or process and is thus characterized 

32 only by a frequency of occurrence. In a qualitative method for assigning likelihood to these 

33 events, a qualitative score is associated with the external event based on its frequency of 

34 occurrence. Events with the same frequency of occurrence should have the same score 

35 regardless of the type of event or severity of its consequences. The method should thus include 

36 a table of the scores assigned based on qualitative frequency criteria. These criteria may 

37 include qualitative descriptions of frequency, such as “100-year flood” or “1,000-year 

38 earthquake,” or may include other qualitative criteria that can be correlated to a frequency, such 

39 as “design-basis earthquake” or “exceeds the mean annual rainfall by a factor of x.” By 

40 contrast, quantitative or semiquantitative methods may include quantitative descriptions of 

frequency such as “having a frequency less than 10-2 41 per year.” Because these events are 

42 beyond human control, no features have to be maintained to ensure the continued validity of the 

43 assigned likelihood. However, it may be necessary to periodically reexamine the basis of these 

44 likelihoods if it is reasonably expected that the likelihood could change (e.g., following 

45 construction of a new railroad spur next to the facility). Appendix D to Chapter 3 contains 

46 additional guidance applicable to initiating events that are natural phenomena.

47

48 By contrast, the likelihood of internal initiating events other than IROFS failures depends on 

49 specific, identifiable characteristics of the facility or process design, such as those discussed in 

50 the following sections. Scores may be assigned to such events based either on objective 

51 evidence of their frequency of occurrence or on specific identifiable characteristics of the facility 
May 2014 3-B-4 NUREG-1520, Revision 2

1 or process that can affect the frequency of occurrence. If the actual frequency of occurrence is 

2 known, this information should be used as it represents objective knowledge about the event 

3 likelihood and accounts for the cumulative effect of all characteristics that can affect likelihood. 

4 Otherwise, the features of the facility or process design that can affect the likelihood should be 

5 described. Regardless of the method used to assign a likelihood score, care must be taken that 

6 all facility and process features that can affect the event likelihood (reliability and availability 

7 qualities) are recognized as such and appropriately maintained. Appendix C to Chapter 3 

8 contains additional guidance applicable to internal initiating events other than IROFS failures.

9

10 Similarly, the likelihood of internal initiating events that are IROFS failures also depends on 

11 specific, identifiable characteristics of the facility or process design. Scores may be assigned to 

12 such events based either on objective evidence of their frequency of occurrence or on specific 

13 identifiable characteristics of the IROFS that can affect the frequency of occurrence. If the 

14 actual frequency of occurrence is known, this information should be used. Otherwise, the 

15 features of the IROFS that can affect the likelihood should be described. Regardless of the 

16 method used to assign a likelihood score, care must be taken that all IROFS attributes that can 

17 affect the event likelihood (reliability and availability qualities) are recognized as such and 

18 appropriately maintained. The following provides guidance on specific reliability and availability 

19 qualities associated with individual IROFS.

20

21 For both types of internal initiating events, facility or process features (or physical and chemical 

22 phenomena) that can affect the initiating event likelihood may be identified as initial conditions 

23 or bounding assumptions. The important factor is that these initial conditions and bounding 

24 assumptions must be identified and, if susceptible to change over the lifetime of the facility 

25 (such as through process deviations or facility changes), must be appropriately maintained. For 

26 example, the maximum throughput or inventory in a process may change; thus, measures 

27 should be in place to maintain this throughput or inventory if it is relied on to meet the 

28 performance requirements, whereas the flow of gravity or maximum density may not require 

29 specific controls.

30

31 Individual IROFS

32

33 Section 3.4.3.2(9) of Chapter 3 of this NUREG states that the reliability and availability qualities 

34 of individual IROFS include (1) safety margin in the controlled parameter, (2) the type of IROFS 

35 (passive or active engineered, simple or enhanced administrative), (3) the type and safety 

36 grading of any management measures, (4) whether the system is fail-safe, failure is 

37 self-announcing, or the IROFS is subject to periodic surveillance, (5) failure modes, (6) demand 

38 rate, and (7) failure rate. It is very important that any qualitative (or quantitative) method of 

39 likelihood evaluation consider all applicable IROFS attributes that could affect the reliability and 

40 availability of the IROFS, such as those discussed below. For example, reliance should not be 

41 based solely on the type of IROFS (passive engineered, active engineered, simple 

42 administrative, or enhanced administrative).

43

44 In addition to those reliability and availability qualities discussed above, other factors may

45 require consideration. For example, environmental conditions, such as extreme temperatures 

46 and pressures, corrosive atmosphere, excessive vibration, may have a significant effect on 

47 IROFS reliability and should be appropriately considered. 

48

49 The level of detail describing the IROFS in the ISA summary is also important. It would be 

50 acceptable to describe the IROFS at the system level if that is sufficient to demonstrate 

51 compliance with the performance requirements. The regulation in 10 CFR 70.65(b)(6) states 
May 2014 3-B-5 NUREG-1520, Revision 2

1 that IROFS should be described “in sufficient detail to understand their functions in relation to 

2 the performance requirements.” It is important that the description be sufficiently detailed to 

3 identify all attributes of the IROFS that can affect its likelihood of failure, as well as everything 

4 that is within the boundary of the IROFS. It may not be necessary to specify the model number 

5 or exact design of a pump if the only attribute relied on to meet the performance requirement is 

6 the pumping capacity or oil reservoir volume. It may be sufficient to describe the pump as 

7 “centrifugal pump limited to less than 10 liters oil.” The IROFS boundary includes everything 

8 necessary for the IROFS to perform its intended safety function. For example, the boundary of 

9 an enhanced administrative IROFS includes all instrumentation (sensors, annunciators, 

10 circuitry, any controls activated by the operator) relied on to trigger the operator action; the 

11 boundary of a simple administrative control includes the equipment necessary to correctly 

12 perform the action; and the boundary of an active engineered control includes the attendant 

13 instrumentation, sensors, essential utilities, and any auxiliary equipment needed to perform its 

14 safety function. The reliability and availability qualities of every component within the IROFS 

15 boundary must be considered in evaluating the total IROFS likelihood.

16

17 Additional guidance on some of the specific reliability and availability qualities of individual 

18 IROFS is provided below.

19

20 Safety Margin in Controlled Parameter: “Safety margin” refers to the difference between the 

21 value of a parameter likely to be encountered during normal or credible abnormal conditions and 

22 the value that would allow an accident to be possible. The precise value of the margin in terms 

23 of the parameter is not meaningful; rather, for the event to be unlikely or highly unlikely based 

24 on safety margin, the margin should be several times larger than the expected process variation 

25 or uncertainty. Similarly, if the margin is much greater than the change in the parameter 

26 resulting from the worst case credible upset, this fact could be credited for ensuring that the 

27 event is unlikely or highly unlikely.

28

29 The phrase “controlled parameter” indicates that means should be provided to ensure that the 

30 safety margin is continuously present, if the margin is relied on in evaluating likelihood. 

31 Parameters that are not controlled should be considered to be at their worst case credible 

32 values. 

33

34 Type of Control: Passive engineered controls are generally considered preferable to active 

35 engineered controls, active engineered controls preferable to enhanced administrative controls, 

36 and enhanced administrative controls preferable to simple administrative controls. This is 

37 because, ordinarily, passive engineered controls are the most reliable, and simple 

38 administrative controls are the least reliable. Although this is one of the factors that should be 

39 considered, evaluations of likelihood should not rely solely on the type of control. This is 

40 because the likelihood associated with passive engineered controls, for example, can vary 

41 widely depending on specific attributes of the IROFS.

42

43 Type and Safety Grading of Management Measures: The specific management measures 

44 applied to an IROFS can have a significant effect on its overall likelihood. Of particular 

45 importance is surveillance, because this can have a direct and transparent effect on the duration 

46 of failure in a method that gives credit to duration of failure. It may not be necessary to specify 

47 the frequency of preventive maintenance, testing, and calibration quantitatively in the ISA 

48 summary. For example, to take credit for generic failure rates for a piece of equipment, it may 

49 be sufficient to specify that maintenance will be performed at a frequency and in a manner 

50 consistent with the manufacturer’s recommendations. Functional testing should be conducted 
May 2014 3-B-6 NUREG-1520, Revision 2

1 in a manner that ensures that everything within the IROFS boundary is working as needed for 

2 the IROFS to perform its safety function.

3

4 While the degree and type of management measures can increase or decrease the likelihood 

5 score associated with an IROFS, primary reliance should be on designing IROFS that have a 

6 certain reliability and then applying management measures to maintain that reliability. It should 

7 not be supposed that one can achieve any desired reliability by applying increasingly stringent 

8 management measures. 

9

10 Fail-Safe or Self-Announcing: This is the characteristic of an IROFS that determines the degree 

11 to which failure of an IROFS is detected and appropriately corrected. For the purpose of the 

12 ISA and ISA summary, an IROFS is considered to fail only when it fails to perform its intended 

13 safety function. Thus, a valve that is an IROFS is not considered to fail in the context of the 

14 accident sequence (i.e., to contribute to the progression of an accident sequence) as long as it 

15 fails in a safe configuration (fails-safe). If the valve is designed to fail closed (and closed is the 

16 safe configuration), credit may be taken for the fact that the valve is designed to fail closed. The 

17 likelihood thus is not the likelihood that the valve fails, but the likelihood that it fails in a way 

18 other than how it is designed to fail. An IROFS that is fail-safe may include within its boundary a 

19 system designed to put the process into a safe condition upon failure of a component. An 

20 IROFS whose failure is self-announcing is one in which failure is either self-revealing (e.g., by 

21 presence of solution on a floor where operators are continuously present) or results in an alarm 

22 to alert operators. The main effect for the ISA summary is to limit the duration of failure by 

23 ensuring that the upset condition is corrected essentially immediately. Similarly, surveillance 

24 may be relied on to limit the duration of failure to a specified period.

25

26 Failure Modes: In addition to specifying the safety function that an IROFS must perform, it is 

27 necessary to consider the specific failure modes of the IROFS. A particular IROFS may be 

28 credited in several different accident sequences but may have different scores in each because 

29 of the differing failure modes leading to an accident. For example, a pipe may either plug or 

30 leak. A valve may leak, fail open, or fail closed. A complex piece of equipment such as a pump 

31 may have multiple different failure modes, each with a different likelihood, leading to several 

32 different accident sequences. The description of the accident sequence should clearly specify 

33 the conditions and failures that must occur for the undesired consequences to result.

34

35 Demand Rate: Demand rate refers to the frequency with which an IROFS having a specified 

36 probability of failure on demand is required to perform its safety function. The number of times 

37 an IROFS is required to work can have a significant effect on its likelihood of failure. For 

38 example, a particular administrative control may have a certain failure likelihood. However, 

39 whether the accident sequence is “not unlikely,” “unlikely,” or “highly unlikely” will depend on the 

40 frequency with which the action is performed. If the action is required several hundred times a 

41 year, then occurrence of the initiating event will be significantly more likely than if the action is 

42 required once per year. Similarly, a passive control (such as the integrity of a storage container) 

43 may have a certain failure likelihood. However, if there are a thousand such containers in a 

44 storage array, then the likelihood that any one container will leak is much greater than if there is 

45 only one such container. Care must be taken to specify whether the initiating event is the leak 

46 of a particular container, or any one container, in the array.

47

48 Failure Rate: Failure rate refers to the frequency with which a continuously demanded item is 

49 observed to fail. In a qualitative method for likelihood evaluation, the failure rate is described in 

50 terms of qualitative descriptors (e.g., “several failures per year,” “a few failures during facility 

51 lifetime,” “no failures in 30 years for tens of similar IROFS in industry”) used in the assignment 
May 2014 3-B-7 NUREG-1520, Revision 2

1 of qualitative likelihood scores (e.g., -1, -2, -3; A, B, C). This information is often not available 

2 with any precision, but when available, it should be used along with other qualitative information 

3 in the assignment of scores. This is because the failure rate represents an objective measure of 

4 the cumulative effect of all the reliability and availability qualities of the system. (See the 

5 discussion of qualitative and quantitative information below.)

6

7 This is not intended to be a comprehensive list of all facility- or process-specific factors that can 

8 affect the failure likelihood of individual IROFS.

9

10 Accident Sequences

11

12 Section 3.4.3.2(9) of this SRP states that there are other reliability and availability qualities that 

13 relate to characteristics of the entire system of IROFS credited in the accident sequence. This 

14 is because the accident sequence likelihood is not just a function of the likelihood of failure of 

15 the individual IROFS, but also of the relationship between the IROFS.

16

17 Additional guidance on some of the specific reliability and availability qualities applicable to the 

18 accident sequence as a whole is provided below. 

19

20 Defense in Depth: Defense in depth is the degree to which multiple IROFS or systems of 

21 IROFS must fail before the undesired consequences (e.g., criticality, chemical release) can 

22 result. IROFS that provide for defense in depth may be either independent or dependent, 

23 although IROFS should be independent whenever practical because of the possibility that the 

24 reliability of any single IROFS may not be as great as anticipated. This will make the results of 

25 the risk evaluation more tolerant of error. In addition, IROFS must be independent if the method 

26 for likelihood determination assumes independence (such as methods relying on summation of 

27 indices). IROFS are independent if there is no credible single event (common-mode failure) that 

28 can cause the safety function of each IROFS to fail. Multiple independent IROFS generally 

29 provide the highest level of risk reduction. The degrees of redundancy, independence, and 

30 diversity are important factors in determining the amount of risk reduction afforded by the 

31 system of IROFS.

32

33 Degree of Redundancy: Defense in depth is provided by specifying redundant IROFS that

34 perform the same essential safety function. Redundant IROFS may be either diverse or 

35 nondiverse; it is not necessary for them to consist of identical equipment or operator actions. 

36 However, when identical equipment or operator actions provide redundancy, it is important to 

37 ensure that all credible common-mode failures have been identified.

38

39 Degree of Independence: To qualify as independent, the failure of one IROFS should neither 

40 cause the failure nor increase the likelihood of failure of another IROFS. No single credible 

41 event should be able to defeat the system of IROFS such that an accident is possible. A 

42 systematic method of hazard identification should thus be used to provide a high degree of 

43 assurance that all credible failure mechanisms that could contribute to (i.e., by initiating or failing

44 to prevent or mitigate) an accident have been identified. Methods commonly used for likelihood 

45 evaluation almost always assume that the chosen IROFS are independent. Examples of these 

46 methods include layer of protection analysis and the index method in Appendix A to this report. 

47 In a few cases, it may not be feasible to entirely eliminate the possibility of dependent failures. 

48 Methods that rely on independent IROFS should not be used to evaluate the likelihood of 

49 systems of IROFS with dependent failures. (Guidance applicable to the rare system with 

50 dependent failures is provided below.) If, however, the common-cause failure is sufficiently 

51 unlikely, it may be possible to treat IROFS as independent for purposes of the ISA and ISA 
May 2014 3-B-8 NUREG-1520, Revision 2

1 summary, as discussed below. Because of the added requirement to meet the 

2 double-contingency principle, this approach will not be valid for criticality accident sequences 

3 when the requirements of 10 CFR 70.64(a)(9) apply.

4

5 Many factors can lead to IROFS not being independent, and these factors can have a significant 

6 effect on the likelihood of an accident sequence. A partial list of conditions that will almost 

7 always lead to two or more IROFS not being independent follows:

8

9 • The same individual performs administrative actions.

10

11 • Two different individuals perform administrative actions but use the same equipment 

12 and/or procedures.

13

14 • Two engineered controls share a common hardware component or common software.

15

16 • Two engineered controls measure the same physical variable using the same model or 

17 type of hardware.

18

19 • Two engineered controls rely on the same source of essential utilities (e.g., electricity, 

20 instrument air, compressed nitrogen, water).

21

22 • Two engineered controls are collocated such that credible internal or external events 

23 (e.g., structural failure, forklift impacts, fires, explosions, chemical releases) can cause 

24 both to fail.

25

26 • Administrative or engineered controls are susceptible to failure because of the presence 

27 of credible environmental conditions (e.g., two operator actions defeated by corrosive 

28 atmosphere, sensors rendered inoperable because of high temperature).

29

30 The presence of any of these conditions does not necessarily mean that the IROFS cannot be 

31 considered independent, but the applicant should provide additional justification demonstrating 

32 the lack of common-mode failure. The likelihood of such conditions in relation to the overall 

33 likelihood of an accident should be factored into the determination of the significance of the 

34 common-mode failure.

35

36 Diversity: Diversity is the degree to which IROFS that perform different safety functions provide 

37 defense in depth. This means that different types of failures must occur before an accident is 

38 possible. Diverse controls may consist of controls on different parameters or different means of 

39 controlling the same parameter. In choosing redundant controls, preference should be given to 

40 diverse means of control, because they are generally less susceptible to common-mode failure 

41 than are nondiverse means. However, it is still necessary to consider all credible failure modes 

42 of the system when evaluating the overall likelihood of failure.

43

44 Vulnerability to Common-Cause Failure: Diverse means of control should be provided 

45 whenever practicable to minimize the potential for common-mode failure. For example, Chapter 

46 5 of this SRP states that for criticality protection, a two-parameter control should be considered 

47 preferable to two controls on one parameter. Where a two-parameter control is not practicable, 

48 diverse means of controlling a single parameter should likewise be considered preferable to two 

49 redundant controls on that single parameter.
May 2014 3-B-9 NUREG-1520, Revision 2

1 It is not always possible to provide absolute assurance that IROFS are perfectly independent. 

2 However, if the cumulative likelihood of all common-mode failures of a system of IROFS is 

3 significantly less than the independent failure of the system of IROFS, then the IROFS may be 

4 treated for all practical purposes as independent. Quantitatively, this means that the likelihood 

5 of the common-cause failure should be at least two orders of magnitude less than that of the 

6 independent failure of the system of IROFS. Qualitatively, this means that the likelihood of the 

7 common-cause failure should be sufficiently low that it does not change the score for the system 

8 of IROFS.

9

10 If credible common-mode failures cannot be neglected, as discussed above, then they must be 

11 considered in evaluating the overall accident sequence likelihood. A likelihood evaluation 

12 method (whether quantitative or qualitative) that correctly treats dependent failures should be 

13 used when such failures are present.

14

15 In general, the probability of failure of a system of two IROFS may be expressed as:

16

P(A,B) = Pind (A,B) + Pdep (A,B) = P(A)P(B) + Pdep (A,B) 17

18

19 That is, there is a component to the likelihood that is the independent failure of IROFS A and B 

20 and a component that represents the common-mode failure of IROFS A and B. Independent 

21 failure of the IROFS is represented by the product P(A)P(B). Therefore, the condition that the 

22 two IROFS be considered independent may be expressed as:

23

P(A,B) ≈ P(A)P(B) 24

25

26 or equivalently

27

Pdep (A,B) < < P(A)P(B) 28

29

30 A variety of different methods may be used to treat dependent failures when the conditions 

31 above are not met. For example, in a quantitative method, the likelihood of the common-mode 

32 event may be estimated and factored into the above equation. In a qualitative scoring method, 

33 the likelihood score may be increased to reflect the existence of a common-mode failure. (In a 

34 qualitative scoring method similar to that employed in Appendix A to Chapter 3 of this SRP, 

35 summation of individual IROFS scores to determine the overall accident sequence score is 

36 permissible only if the IROFS are independent. Such a method assumes that independence 

37 should be modified as needed to correctly treat common-mode failures.) In the layer of 

38 protection analysis method, only the independent IROFS are credited in evaluating the overall 

39 accident sequence likelihood. In a qualitative fault tree method, the common-mode failure may 

40 be included as an additional basic event in the fault tree. It is permissible then to treat the 

41 independent failure of the system of IROFS as one accident sequence and the dependent 

42 failure as another. The method used to treat dependent failures should be appropriately 

43 justified.

44

45 Qualitative criteria may be used to assess the effect of dependent failures on likelihood scores. 

46 The effect of qualitative performance-shaping factors should be considered in these criteria. For 

47 example, repeated failures of identical administrative IROFS (e.g., multiple batching, multiple 

48 valving, or spacing violations) should not be considered to be independent nor receive the same 

49 score without substantial justification, as discussed below. This is because the likelihood of 

50 subsequent human failures increases once the initial failure has occurred. The set of factors 
May 2014 3-B-10 NUREG-1520, Revision 2

1 that could contribute to multiple administrative failures may include inadequate or out-of-date 

2 procedures, poor training, environmental distractions, and poor human factors design. For the 

3 same reason, the possibility of two different administrative failures by the same individual should 

4 be carefully considered for common-mode vulnerability. In assessing the vulnerability of these 

5 actions to common-mode failure, consideration may be given to any recovery factors that may 

6 be in place to interrupt the sequence of failures (e.g., supervisory checking, inspection, 

7 independent verification). Such recovery factors should be treated as measures that enhance 

8 the reliability of the administrative IROFS or ensure that repeated failures may be considered to 

9 be independent. In particular, independent verification of one administrative IROFS should not 

10 be used as a separate IROFS in the same accident sequence. For the same reasons as cited 

11 above, verification that an action has been performed correctly would be susceptible to the 

12 same factors that caused the initial failure. In addition, verification of an action is likely to be 

13 more cursory and, therefore, less reliable than performance of the original action. Moreover, in 

14 the event that the first action was performed correctly, the independent verification of that first 

15 action would not contribute to meeting the performance requirements, and therefore, the first 

16 action would constitute a sole IROFS. Thus, independent verification should be used only to 

17 increase the reliability of an IROFS and should not be treated as a separate IROFS nor credited 

18 with the same level of risk reduction.

19

20 In addition to the above, for criticality accident sequences required to comply with the 

21 double-contingency principle (see appendix 5-A of this SRP). 

22

23 Use of Quantitative and Qualitative Information

24

25 Section 3.4.3.2(9) of this SRP acknowledges that a mix of quantitative and qualitative 

26 information is often available to an analyst performing an ISA. This SRP includes a list of some 

27 types of objective quantitative information and states that this information should be considered 

28 in evaluating likelihood, even in purely qualitative methods. The information listed includes 

29 (1) reports of equipment failures or procedural violations, (2) surveillance intervals, (3) functional 

30 testing intervals or audit frequencies, (4) time required to render the system safe, and 

31 (5) demand rates. In a purely qualitative method, such information, to the extent it is available, 

32 should be considered qualitatively. One example of this is using surveillance periods as part of 

33 the justification for qualitative duration indices (as in Appendix A to Chapter 3 of this SRP).

34

35 In using such objective data, facility-specific data are preferable to generic data, and 

36 process-specific data are preferable to facility-specific data because of the many environmental 

37 and other factors that can affect likelihood. For example, a manufacturer may have certified a 

38 particular pump with a given reliability rating, but the actual performance in process will depend 

39 on maintenance, electrical and mechanical loading, type of oil, ambient temperature, and 

40 vibration, among other factors. While more specific data are preferable, typically, the more 

41 specific the conditions, the fewer data are available. The amount and specificity of the data 

42 should be given appropriate weight in evaluating likelihood. For example, the use of generic 

43 failure data for a specific type of valve may be acceptable if an appropriately bounding value 

44 (i.e., the less conservative extreme of a range of values) is used. A less bounding value may be 

45 acceptable if information is available from the manufacturer on the specific model of valve. An 

46 even less bounding value may be acceptable if sufficient operating experience is available to 

47 support facility- or process-specific values. Sufficient margin to bound uncertainties in failure 

48 rates should be provided when relying on generic information.

49

50 Operating history may be credited in justifying likelihood scores for individual IROFS. Care 

51 must be taken that this credit is based on documented performance data and not anecdotal 
May 2014 3-B-11 NUREG-1520, Revision 2

1 evidence and that the operating history is applicable to the event being evaluated. For example, 

2 not having any criticality accidents in 30 years of operation would not be justification for a failure 

3 frequency for a particular component or initiating event (since the initiating event may have 

4 occurred several times during that time period without resulting in a criticality). It would also not 

5 be justification for a likelihood corresponding to a time between failures longer than 30 years. In 

6 addition, if significant facility changes occurred over the previous 30 years of operation, this 

7 information may not be meaningful. The limits and applicability of the operating data used to 

8 justify likelihood should be explained.

9

10 Especially for new processes or facilities, such objective quantitative data may not be available. 

11 Appropriate margin in plant operations and conservatism in likelihood scoring should be used 

12 and justified when such information is not available. Over the facility lifetime, however, 

13 information gained with regard to operational events and IROFS failures should be evaluated 

14 and fed back into the ISA process. This may be justification for reducing margins and 

15 conservatism over the facility lifetime.

16

17 Graded Approach to Integrated Safety Analysis

18

19 The performance requirements of 10 CFR 70.61(b) and (c) establish an acceptable level of risk, 

20 in that high-consequence events must be made “highly unlikely” and intermediate-consequence 

21 events must be made “unlikely.” In addition, 10 CFR 70.65(b)(4) requires that an applicant’s 

22 ISA summary contain a demonstration of compliance with the performance requirements of 

23 10 CFR 70.61. The means and the level of effort required to demonstrate compliance with 

24 10 CFR 70.61 depend on the amount of risk reduction needed to meet the likelihood thresholds 

25 in that regulation. For example, a facility that obviously has inherently low risk (even before the 

26 performance of the ISA) requires less effort to demonstrate compliance than an inherently 

27 higher risk facility. Examples would include facilities with small mass or very low enrichment of 

28 special nuclear material, low chemical inventories, or insignificant combustible loading. Thus, 

29 the ISA methods used may be graded commensurate with the risk of the facility.

30

31 The facility and process characteristics that determine inherent risk should be identified as initial 

32 conditions and/or assumptions and appropriately identified and maintained to ensure that they 

33 will be present over the lifetime of the facility, if credit is taken for them in meeting the 

34 performance requirements. For example, a possession limit on the maximum enrichment or 

35 amount of special nuclear material at the facility may be credited in ensuring low risk of 

36 criticality, because the license sets an explicit limit. Chemical inventories may be likewise 

37 credited, provided that they are limited by license or the maximum inventory is identified as 

38 important to safety and rigorously controlled. ISA methods may be graded commensurate with 

39 the amount of risk reduction required once these factors have been explicitly identified and 

40 maintained. 

41

42 The following are examples of aspects of the ISA process that may be graded commensurate 

43 with risk:

44

45 • In the selection of the hazard identification method, the what-if or what-if/checklist 

46 method would be more suitable for low-risk, simple operations; hazardous operations, 

47 fault tree, and other sophisticated methods may be appropriate for more complex or 

48 higher risk operations.

49

50 • In the evaluation of the type, number, and robustness of IROFS, lower risk facilities will 

51 not require the same level of control.
May 2014 3-B-12 NUREG-1520, Revision 2

1 • In the application of management measures, lower risk facilities will not require 

2 measures as stringent as those for higher risk facilities.

3

4 • In the evaluation of likelihood, the technical justification required to support a high 

5 degree of risk reduction is much greater than that required to support a low or moderate 

6 degree of risk reduction. Methods used to support a high degree of risk reduction should 

7 be more sophisticated, and warrant greater regulatory scrutiny, than methods used to 

8 support a lower degree of risk reduction.

9

10 In addition to the inherent risk of the facility or process, the amount of conservatism may be 

11 considered in grading ISA methods. For example, if a very conservative likelihood is assumed 

12 for all IROFS failures, then the rigor and level of detail in describing the IROFS, considering all 

13 reliability and availability qualities and treating dependent failures, would not have to be at the 

14 same level as in a facility taking more realistic credit for IROFS failures. The grading of ISA 

15 methods necessitates that the applicant demonstrate (1) that the risk is inherently low and will 

16 be maintained over the lifetime of the facility, or (2) that there is a consistent and dependable 

17 amount of conservatism in ISA methods that offsets the uncertainty arising from lack of rigor. 

18

19 Regulatory Basis

20

21 The risk of each credible high-consequence event must be limited. Engineered controls, 

22 administrative controls, or both shall be applied to the extent needed to reduce the likelihood of 

23 occurrence of the event so that, upon implementation of such controls, the event is highly 

24 unlikely or its consequences are less severe than those described in 10 CFR 70.61(b)(1–4).

25

26 The risk of each credible intermediate-consequence event must be limited. Engineered 

27 controls, administrative controls, or both shall be applied to the extent needed so that upon 

28 implementation of such controls, the event is unlikely or its consequences are less than those 

29 described in 10 CFR 70.61(c)(1–4).

30

31 Each licensee or applicant shall conduct and maintain an ISA that is of appropriate detail for the 

32 complexity of the process and that identifies “the consequences and likelihood of occurrence of 

33 each potential accident sequence...and the methods used to determine the consequences and 

34 likelihoods,” as stated in 10 CFR 70.62(c)(1)(v).

35

36 The ISA summary must contain “information that demonstrates the licensee’s compliance with 

37 the performance requirements of Section 70.61,” as stated in 10 CFR 70.65(b)(4).

38

39 The ISA summary must also include the definitions of “unlikely,” “highly unlikely,” and “credible”

40 as used in the evaluations of the ISA, as stated in 10 CFR 70.65(b)(9).

41

42 Technical Review Guidance

43

44 The reviewer should use the information contained in this appendix, as applicable, to evaluate 

45 an applicant’s or a licensee’s qualitative methods of likelihood evaluation, commensurate with 

46 the level of risk reduction required to comply with the performance requirements of 

47 10 CFR 70.61. If the applicant is using the index method defined in Appendix A to Chapter 3 of

48 this SRP, the reviewer should use the guidance in Appendix A to evaluate the adequacy of the 

49 applicant’s ISA summary. The purpose of the ISA summary review is not to verify the 
May 2014 3-B-13 NUREG-1520, Revision 2

1 correctness of the likelihood scores for every single accident sequence, but to verify that the 

2 applicant has an acceptable methodology that contributes to reasonable assurance of 

3 maintaining an adequate safety basis over the facility lifetime, by ensuring that the methodology 

4 results in assignment of appropriate likelihoods. Thus, the reviewer should primarily determine 

5 whether there is a justifiable basis for the scores, and whether there is reasonable assurance 

6 that this basis will be maintained over the facility lifetime, assuming the application of

7 appropriate management measures. 

8

9 The applicant’s qualitative method for likelihood evaluation should be acceptable if the following 

10 are true:

1112

13 • The definitions of likelihood are clear, are based on objective criteria, and can 

14 consistently distinguish events in different likelihood categories.

15

16 • The methods for likelihood evaluation are consistent with the likelihood definitions and 

17 the process being evaluated (e.g., the methods correctly treat initiating events and initial 

18 conditions, subsequent failures, and dependent failures).

19

20 • The methods for likelihood evaluation appropriately consider all availability and reliability 

21 qualities of individual IROFS and the interdependencies between them in assigning 

22 qualitative likelihood scores.

23

24 • The ISA summary describes initiating events, initial conditions, and subsequent IROFS 

25 failures in detail sufficient to demonstrate that the performance requirements will be met 

26 and maintained.

27

28 Recommendations

29

30 This guidance should be used to supplement Chapter 3 and Appendix A to this SRP.

31

32 References

33

34 U.S. Code of Federal Regulations, Title 10, “Energy,” Part 70, “Domestic Licensing of Special 

35 Nuclear Material.”

36

37 U.S. Nuclear Regulatory Commission, “Standard Review Plan for the Review of an Application 

38 for a Mixed Oxide (MOX) Fuel Fabrication Facility,” NUREG-1718, August 2000.

39

May 2014 3-C-1 NUREG-1520, Revision 2

APPENDIX C

INITIATING EVENT FREQUENCY

1 Purpose

2

3 This appendix addresses the measures needed to ensure the validity and maintenance of the 

4 initiating event frequencies (IEFs) used to demonstrate compliance with Title 10 of the Code of 

5 Federal Regulations (10 CFR) 70.61, “Performance Requirements.” 

6

7 Introduction

8

9 The purpose of this appendix is to clarify the use of IEFs for demonstrating compliance with the 

10 performance requirements of 10 CFR 70.61. NUREG-1718, “Standard Review Plan for the 

11 Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility,” issued 

12 August 2000, and this Standard Review Plan (SRP) provide methods for reviewing integrated 

13 safety analyses (ISAs) by employing a semi-quantitative risk index method. While one of these 

14 methods is described below to illustrate the use of IEFs, applicants and licensees may use other 

15 methods that would produce similar results. No particular method is explicitly mandated, and 

16 sequences that are risk significant or marginally acceptable are candidates for more detailed 

17 evaluation by the applicant or licensee and reviewer. 

18

19 Discussion

20

21 Each licensee or applicant is required to perform an ISA to identify all credible high22 consequence and intermediate-consequence events. The risk of each such credible event is to 

23 be limited through the use of appropriate engineered and/or administrative controls to meet the 

24 performance requirements of 10 CFR 70.61. Such a control is referred to as an item relied on 

25 for safety (IROFS). In turn, a safety program must be established and maintained to ensure that 

26 each IROFS is available and reliable to perform its intended function when needed. The safety 

27 program may be graded such that the management measures applied are graded 

28 commensurate with the reduction of risk attributable to that item. In addition, a configuration 

29 management system must be established pursuant to 10 CFR 70.72, “Facility Changes and 

30 Change Process,” to evaluate changes and to ensure, in part, that the IROFS are not removed 

31 without at least equivalent replacement of the safety function. 

32

33 The risk of each credible event is determined by cross-referencing the severity of the 

34 consequence of the unmitigated accident sequence with the likelihood of occurrence in a risk 

35 matrix with risk index values. The likelihood of occurrence risk index values can be determined 

36 by considering the criteria in Tables A-9 through A-11 in Appendix A to Chapter 3 of this SRP. 

37 Accident sequences result from initiating events that are followed by the failure of one or more 

38 IROFS. Initiating events can be (1) an external event such as a hurricane or earthquake, (2) a 

39 facility event external to the process being analyzed (e.g., fires, explosions, failures of other 

40 equipment, flooding from facility water sources), (3) deviations from normal operations of the 

41 process (credible abnormal events), or (4) failures of an IROFS in the process. (Appendix D to 

42 Chapter 3 offers additional guidance regarding initiating probabilities from natural phenomena 

43 hazards.) 
May 2014 3-C-2 NUREG-1520, Revision 2

1 An initiating event does not have to be an IROFS failure. An item becomes an IROFS only if the 

2 ISA credits it for mitigation or prevention per the definition in 10 CFR 70.4, “Definitions.” If an 

3 item whose failure initiates an event has strictly an operational function, it does not have to be 

4 an IROFS. This applies to external events and can apply to internal events. If the item whose 

5 failure initiates an event has solely a safety function that is credited in the ISA, then it should be 

6 an IROFS. If the item has both an operational and a safety function, the safety function should 

7 make it an IROFS (for its ISA-credited safety features only).

8

9 IEFs can play a significant role in determining whether the performance requirements of 

10 10 CFR 70.61 are met for a particular accident sequence. Whether an initiating event results 

11 from an IROFS or a non-IROFS failure, licensees should take appropriate action to ensure that 

12 any change to the basis for assigning an IEF value to that event is evaluated on a continuing 

13 basis to ensure continued compliance with the performance requirements. For example, a 

14 non-IROFS component may not be subject to the same quality assurance (QA) program 

15 controls and other management measures that an IROFS would receive (i.e., surveillance, 

16 testing, procurement). However, appropriate management controls should be considered, in a 

17 graded manner, to provide assurance that performance requirements are met over time. The 

18 ability to identify a non-IROFS component failure, similar to that for IROFS, may be needed to 

19 provide feedback on failure rates and IEFs to the ISA process. Changes to the IEF values may 

20 result from changes to a component’s design, procurement, operation, or maintenance history, 

21 as well as new or increased external plant hazards, and should be considered in a graded 

22 approach.

23

24 Regulatory Basis

25

26 This guidance relies on the following regulatory bases:

27

28 • 10 CFR 70.61

29 • 10 CFR 70.62, “Safety Program and Integrated Safety Analysis”

30 • 10 CFR 70.65, “Additional Content of Applications”

31 • 10 CFR 70.72, “Facility Changes and Change Process”

32

33 Applicability

34

35 This guidance is for use in those cases where an applicant or licensee chooses to use an 

36 IROFS or non-IROFS failure IEF for risk determination.

37

38 Technical Review Guidance

39

40 1. Initiating Event Frequency and Identification of an IROFS

41

42 Example

43

44 A licensee uses a heater/blower unit to heat a uranium hexafluoride (UF6) cylinder in a 

45 hot box to liquefy the contents before sampling. The unmitigated accident sequence 

46 involves the failure of the controller for the heater/blower resulting in overheating of the 

47 cylinder. This results in the cylinder becoming overpressurized and rupturing, which 

48 releases the UF6 to the surrounding process area. Analysis of such a release indicates 

49 that it would exceed the performance requirements of 10 CFR 70.61. The licensee has 

50 two basic choices: (1) assume that the initiating event probability equals 1 and provide 
May 2014 3-C-3 NUREG-1520, Revision 2

1 an appropriate level of mitigation or prevention solely through one or more IROFS or 

2 (2) assign a value to the initiating event (blower/heater controller failure) and provide one 

3 or more preventive or mitigative IROFS to bring the accident sequence risk within the 

4 performance requirements.

5

6 If the licensee chooses the second option and assigns an appropriate value to the IEF, 

7 the indices of Table A-9 in Appendix A to Chapter 3 of this SRP may be used. The 

8 controller for the heater/blower unit would be assigned an appropriate frequency index 

9 number. The licensee would then analyze the accident sequence and determine 

10 whether additional IROFS are necessary to meet the performance requirements. There 

11 are now two variables that feed into the risk determination: one or more IROFS 

12 controllers for the heater/blower unit in a manner that changes the licensee’s previous 

13 determination of compliance with the performance requirements must be evaluated per 

14 10 CFR 70.72(a).

15

16 2. Initiating Event Frequency Index Use

17

18 Indices may be used to determine the overall likelihood of an accident sequence. 

19 Table A-9 of Appendix A to Chapter 3 of this SRP identifies frequency index numbers 

20 based on specified evidence. The evidence used by applicants and licensees should be 

21 supportable and documented in the ISA summary as required by 10 CFR 70.65(b)(4). 

22 The evidence cited in the ISA documentation should not be limited to anecdotal 

23 accounts and must demonstrate compliance with the definitions of “unlikely,” “highly 

24 unlikely,” and “credible” as required by 10 CFR 70.65(b)(9). The rigor and specificity of 

25 the documented evidence should be commensurate with the item’s importance to safety, 

26 and the data should support the frequency chosen (e.g., data from 30 years of plant 

27 operating experience based on a single component typically could not be expected to 

support a 10-2 28 failure probability).

29

30 An item’s failure rate should be determined from actual data for that specific component 

31 or safety function in the current system design under the current environmental 

32 conditions. When specific failure data are limited or not available, the applicant or 

33 licensee may use more “generic” data with appropriate substantiation. However, when 

34 less specific failure data are available, appropriate conservatism should be exercised in 

35 assigning frequency indices. The footnote to Table A-9 that states “Indices less than 

36 (more negative than) -1 should not be assigned to IROFS unless the configuration 

37 management, auditing, and other management measures are of high quality, because 

38 without these measures, the IROFS may be changed or not maintained” should also be 

39 applied to non-IROFS IEFs. In this case, appropriate management controls should be 

40 provided to ensure that any changes to the evidence supporting IEF indices will be 

41 identified and promptly evaluated to ensure that the performance requirements of 

42 10 CFR 70.61 are met. A graded approach may be used in applying management 

43 controls based on the IEF values; however, the ISA summary should explain how this 

44 will be done.

45

46 The licensee or applicant should periodically evaluate possible changes to IEFs, failure 

47 rates, and the assumptions they are based on to ensure that the ISA process has 

48 accounted for any change to an IEF. Over time, an IEF may change because of 

49 component aging or deterioration. Maintenance and performance experience should be 

50 fed back into the IEF evaluation. IEF changes could involve, for example, the 

51 introduction of new effects or hazards from nearby processes or new materials or 
May 2014 3-C-4 NUREG-1520, Revision 2

1 changes in design, maintenance, or operation activities. The applicant or licensee 

2 should establish management measures, which may be graded, to periodically confirm 

3 that the ISA assumptions have not changed. For example, an applicant or licensee may 

4 choose to verify that there have been no changes to hazards from maintenance activities 

5 during a certain period of time based on an appropriate documented technical review or 

6 audit under the QA program.

7

8 Whatever strategy the applicant or licensee chooses should result in timely identification 

9 and periodic evaluation of failure rates, followed by a prompt evaluation of the failure 

10 rate change on the ISA assumptions. This can be accomplished in accordance with the 

11 corrective maintenance program and/or the QA problem identification and corrective 

12 action system.

13

14 Indices particularly relied on (i.e., less than -1) for overall likelihood will be examined 

15 during the ISA review process.

16

17 3. External Initiating Event Frequencies

18

19 The applicant or licensee should periodically evaluate possible changes to nonnatural 

20 phenomena external events to ensure that the ISA process has accounted for any 

21 change to an IEF. Such changes could involve, for example, the introduction of new 

22 hazards from an adjoining industrial site or changes in adjoining transportation activities. 

23 The applicant or licensee should establish management measures, which may be 

24 graded, to periodically confirm that the ISA assumptions have not changed. For 

25 example, an applicant or licensee may choose to verify that external hazards have not 

26 changed based on a 2- to 3-year review under the QA program.

27

28 4. Assurance

29

30 The safety program required by 10 CFR 70.62(a) should have provisions for 

31 implementing the appropriate management controls to maintain the validity of the IEFs. 

32 Consideration should also be given to commitments in the QA program or a specific 

33 license condition.

34

35 References

36

37 U.S. Code of Federal Regulations, Chapter I, Title 10, “Energy,” Part 70, “Domestic Licensing of 

38 Special Nuclear Material.”

39

40 U.S. Nuclear Regulatory Commission, “Standard Review Plan for the Review of an Application 

41 for a Mixed Oxide (MOX) Fuel Fabrication Facility,” NUREG-1718, August 2000.
May 2014 3-D-1 NUREG-1520, Revision 2

APPENDIX D

NATURAL PHENOMENA HAZARDS

1 Purpose

2

3 This appendix provides additional guidance addressing accident sequences that may result 

4 from natural phenomena hazards in the context of a license application or an amendment 

5 request under Title 10 of the Code of Federal Regulations (10 CFR) Part 70, “Domestic 

6 Licensing of Special Nuclear Material,” Subpart H, “Additional Requirements for Certain 

7 Licensees Authorized To Possess a Critical Mass of Special Nuclear Material.”

8

9 Introduction

10

11 This appendix provides additional guidance for reviewing the applicant’s (or licensee’s) 

12 evaluation of natural phenomena hazards up to and including “highly unlikely” events for both 

13 new and existing facilities.

14

15 Discussion

16

17 For facilities processing special nuclear materials, 10 CFR 70.61, “Performance Requirements,”

18 requires that individual accident sequences resulting in high consequences to workers and the 

19 public be “highly unlikely” and that sequences resulting in intermediate consequences to these 

20 receptors be “unlikely.” Although the regulations establish the threshold levels that differentiate 

21 high-consequence events from intermediate-consequence events, they do not define “highly 

22 unlikely” and “unlikely.” According to 10 CFR 70.65(b)(9) and subject to staff approval, the 

23 integrated safety analysis (ISA) summary submitted by applicants and licensees must include 

24 definitions of these terms. Chapter 3 of this NUREG further describes the acceptance criteria 

25 for the definitions of these terms.

26

27 The implementation of these requirements may vary somewhat because of different definitions 

of likelihood proposed by different applicants (or licensees).1 28 The regulation specifies 

29 quantitative consequence thresholds of the performance requirements (except for chemical 

30 releases). The regulation and its performance requirements pertain to existing facilities, as well 

31 as proposed facilities, and apply to manmade external hazards and natural phenomena 

32 hazards, in addition to process hazards. However, new facilities and new processes at existing 

33 facilities must also address the requirements of 10 CFR 70.64, “Requirements for New Facilities 

34 or New Processes at Existing Facilities,” which includes the baseline design criterion for natural 

35 phenomena hazards (10 CFR 70.64(a)(2)). This baseline design criterion requires that “the 

36 design must provide for adequate protection against natural phenomena with consideration of 

37 the most severe documented historical events for the site.” The Statement of Considerations 

38 describes the application of the baseline design criteria as consistent with good engineering 

39 practice, which dictates that certain minimum requirements should be applied to design and 

40 safety considerations. The baseline design criteria must be applied to the design of new 

41 facilities and new processes at existing facilities but does not require retrofits to existing facilities 

 1 For natural phenomena, deterministically defined events such as the probable maximum flood (PMF) or 

safe-shutdown earthquake (SSE), which are used as reactor design bases, can also be applied to 

10 CFR Part 70 facilities as “highly unlikely” events. The actual probability (or likelihood) of such events 

may be difficult to define quantitatively and varies from site to site. 
May 2014 3-D-2 NUREG-1520, Revision 2

1 or existing processes (e.g., those housing or adjacent to the new processes). Also included in 

2 10 CFR 70.64(b) are a requirement for incorporation of defense in depth in design and a 

3 requirement to prefer engineered controls over administrative controls.

4

5 New structures associated with facilities being reviewed, such as the gas centrifuge facilities 

6 and the mixed oxide fuel fabrication facility, will be designed and constructed to meet the 

7 seismic regulatory requirements. Hence, these facilities and additional new facilities to be 

8 licensed under 10 CFR Part 70 are not expected to present designs with seismic deficiencies. 

9 New facilities can also be expected to be sited above a “highly unlikely” flood such as the PMF 

10 and can be expected to withstand tornado winds and missiles, if necessary. 

11

12 Most structures at existing nuclear fuel cycle facilities are built to a model building code, which 

includes meeting a design-basis earthquake having an exceedance probability of 2x10-3 13 per 

year to less than 10-3 14 per year (U.S. Department of Energy (DOE) Standard-1020-2002, 

15 “Natural Phenomena Hazards Design and Evaluation Criteria for Department of Energy 

16 Facilities,” Appendix C). Existing facilities are generally sited above the 100-year flood plain 

17 and are designed for wind as well as snow and ice loading as specified in applicable building 

18 codes. Extreme natural events such as “highly unlikely” floods and/or earthquakes have not 

19 been calculated for many existing sites, and it would be expensive and time consuming to do 

20 so.

21

22 The staff believes that many existing facilities can be shown to be in compliance with, or at least 

23 near compliance with, the performance requirements of the regulation by accounting for 

24 conservatisms in the seismic, flooding, and wind design of the facility. In addition, relatively 

25 minor engineered improvements and administrative measures may further enhance safety, at 

26 least with respect to the public and other offsite receptors.

27

28 Seismic Hazards

29

30 Potential damage to and/or failure of items relied on for safety (IROFS) as the result of ground 

31 movement and/or the seismic response of adjacent or interior IROFS must be considered in the 

32 ISA and ISA summary accident sequence evaluations. Damage or failures that also should be 

33 considered include the following:

34

35 • seismic-induced failure of a facility component that is not an IROFS but that can fall and 

36 damage an IROFS (for example, a heavy load drop from a crane onto a container)

37

38 • displacement of adjacent IROFS during a seismic event causing them to pound together

39

40 • displacement of adjacent components resulting in failure of connecting pipes or cables 

41 which may cause flooding, fires, and/or releases of radiological or chemical materials

42

43 Seismic event evaluations should also consider potential multiple failure of IROFS (for example, 

44 multiple failures of tanks).

45

46 DOE has also recognized the difference between earthquake design probability and the 

47 probability that a safety component cannot perform its function. To quantify this difference, 

48 DOE has developed a risk reduction factor, R, as the ratio between the seismic hazard 

49 exceedance probability and the performance goal probability. Conservatism in nuclear facility 

50 design arising from factors such as use of prescribed analysis methods, specification of material 

51 strengths, and limits on inelastic behavior explains at least part of this apparent reduction in 

52 actual risk. Appendix C to DOE Standard-1020-2002 discusses this risk reduction factor.
May 2014 3-D-3 NUREG-1520, Revision 2

1

2 For a consequence to affect the public or external site workers, licensed material or hazardous 

3 chemicals that could affect the safety of licensed material must be released through at least 

4 one, and often two, confinement barriers, such as the following:

5

6 • storage containers, glove boxes, tanks, or handling devices

7 • ventilation system dynamic confinement and filtration

8 • building structural shell

9

10 Criticalities, on the other hand, may result from the introduction of a moderator or loss of safe 

11 geometric control of confined materials.

12

13 By using risk reduction factors calculated for a facility and its specific components and/or 

14 estimating the degree of failure by comparison with the observed behavior of similarly 

15 constructed buildings during severe earthquakes, analysts can postulate reasonable scenarios. 

16 These scenarios may not release all the material at risk or present an unimpeded leak path to 

17 receptors. For example, some facilities might be able to show that, even in the case of an 

18 earthquake that is “highly unlikely,” only certain types of containers or confinement systems are 

19 likely to be breached. If the amount of material contained in such containers is variable, then 

20 that probabilistic component may be factored into the overall likelihood of the accident 

21 sequence. If employing some of these mitigating considerations in the analysis requires 

22 reliance on special containers or procedures, then additional IROFS may also be needed. 

23 Another factor to consider is the likely rate of release based on the damage sustained. For 

24 example, some facilities may lose dynamic confinement but maintain building integrity. In some 

25 processes, radiologically and/or chemically hazardous material is held inside its primary 

26 containment at subatmospheric pressure. In these cases, even though the primary 

27 containments are inside a structure designed to withstand less than a “highly unlikely” 

28 earthquake, the subatmospheric conditions may be sufficient to limit both facility worker and 

29 offsite doses in the event of a greater earthquake. For example, an earthquake that results in 

30 limited subatmospheric containment losses may allow adequately trained workers to evacuate 

31 and/or take mitigative actions. The buildings containing cylinders of liquid uranium hexafluoride 

32 (UF6 ) at gas centrifuge facilities are designed for a “highly unlikely” earthquake. In addition, 

33 some buildings at one of the proposed facilities are equipped with a seismically activated 

34 interlock (an IROFS) that will shut off the buildings’ heating, ventilation, and air conditioning 

35 system during an event, thus limiting any leakage of UF6 to the outside.

36

37 Flooding Hazards

38

39 Most fuel cycle licensees do not require large quantities of cooling water and, therefore, do not 

40 need to be located near large bodies of water. A site licensed under 10 CFR Part 70 does not 

41 need to meet prescriptive flood protection requirements but does have to meet the performance 

42 requirements for all credible events including flooding. A site meeting the flood protection 

43 requirements of a commercial reactor should be considered as being designed or located 

44 adequately to withstand a “highly unlikely” flooding event. Section 2.4 of NUREG-1407, 

45 “Procedural and Submittal Guidance for the Individual Plant Examination of External Events 

46 (IPEEE) for Severe Accident Vulnerability,” issued June 1991, states that the design-basis flood 

47 (which for river sites is the PMF) as described in Regulatory Guide 1.59, “Design Basis Flooding 

for Nuclear Power Plants,” is estimated to have an exceedance frequency of less than 10-5 48 per 

49 year. Sites that do not meet this level of protection can still meet the 10 CFR 70.61 

50 performance requirements but must be considered on an individual basis.

51
May 2014 3-D-4 NUREG-1520, Revision 2

1 In an evaluation of the effects of flooding on existing facilities, the following flood-related 

2 hazards should be considered:

3

4 • river flooding

5

67 – inundation and hydrostatic loading

8 – dynamic forces

9 – wave action

10 – sedimentation and erosion

11 – ice loading

1213

14 • upstream dam failures

1516

17 – inundation and hydrostatic loading

18 – dynamic forces

19 – erosion and sedimentation

20

21 • precipitation/local storm runoff

22

23 – inundation (local ponding) and hydrostatic loading

24 – dynamic loads (flash flooding)

25

26 • tsunami, seiche, hurricane storm surge

2728

29 – inundation and hydrostatic loading

30 – dynamic forces

31 – wave action

32

33 American National Standards Institute/American Nuclear Society Standard 2.8, “Determining 

34 Design Basis Flooding at Power Reactor Sites,” issued July 1992, describes methods for 

35 determining these flooding and water-related effects for reactor sites. These methods can be 

36 applied to 10 CFR 70.61 analyses with less conservatism in some of these parameters.

37

38 A standard siting requirement for residential and commercial developments is to be above the 

39 100-year flood plain. For large river basins, warning time and time to secure materials and 

40 evacuate personnel will probably be available. For small streams, there may be relatively little 

41 warning in regard to thunderstorms and localized rainfall. In such cases, rapid actions may be 

42 the only administrative protection available. An evaluation of the effectiveness of proposed 

43 protection will need to consider the effects of inundation, hydrostatic loading, erosion, and 

44 sedimentation. At a minimum, this would require that criticality events be prevented and 

45 materials remain confined within site structures. 

46

47 At some sites, a delineation of the 500-year flood plain may also be available. If the site is 

above the 500-year flood plain, flooding may be considered an unlikely2 48 event, depending on 

49 the quality of the estimate. In this category, criticality events should still be prevented, but the 

 2 Even if the licensee defines “unlikely” as less than 10-3 per year for the process sequences in the ISA summary, the 

conservative assumptions inherent in most flood plain hydrologic studies, such as those performed for Federal 

Emergency Management Agency flood insurance rate maps, should justify the consideration of flooding above the 500-

year flood plain as an unlikely event.
May 2014 3-D-5 NUREG-1520, Revision 2

1 breaching of a limited number of material containers may be allowable under the performance 

2 requirements (up to 25 rem for the public, up to 100 rem for workers, and a specified release 

3 limit) for events that, in terms of likelihood, are between “unlikely” and “highly unlikely.” 

4

5 In addition to the facility’s location relative to the 100-year or 500-year flood plains, the effects of 

6 local intense precipitation and snow load should be considered. Local intense precipitation,

7 especially in the form of snow, can result in roof collapse and localized site flooding. Normally, 

8 protection from local precipitation and snow is relatively easy to achieve through roof design and 

9 local site drainage design.

10

11 Wind and Tornado Loading

12

13 Wind design for an existing facility if prescribed by an applicable building code would have an 

annual exceedance probability of greater than or equal to 2x10-2 14 . At such relatively high 

15 probabilities, tornado design criteria are not specified. However, depending on the geographic 

location of the facility, the effects of a tornado with an annual exceedance probability of 10-5 16 or 

17 greater may need to be considered.

18

19 Wind forces on walls of structures should be determined using appropriate pressure 

20 coefficients, gust factors, and other site-specific adjustments. If the wind is likely to blow inside 

21 the structure, either through design or wind-driven missile vulnerability, the effects of wind on 

22 internal IROFS requires consideration. If the winds are from a tornado, the effects of the 

23 atmospheric pressure change associated with the tornado must be considered. Normally, 

24 ventilation systems are most vulnerable to atmospheric pressure change, but windows, buried 

25 tanks, and sand filters can also be affected.

26

27 For straight winds, hurricanes, and weak tornadoes, missile criteria as specified in Table 3-3 of 

28 DOE Standard-1020-2002 may be considered. The missile specified is a 15-pound plank, 

29 measuring 2 inches by 4 inches, at a specified elevation and impact velocity. For facilities that

30 may be subjected to more severe tornado missiles, the guidance in Tables 3-4 and 3-5 of DOE

31 Standard-1020-2002 may be followed. For the tornado, a 3,000-pound automobile rolling and 

32 tumbling on the ground should also be considered. For such evaluations, the probability of the 

33 entire sequence should be considered, and missile criteria from either Table 3-4 or 3-5 of DOE

34 Standard-1020-2002 may be used as appropriate.

35

36 Considerations for Existing Processes at Existing Facilities

37

38 For existing processes at existing facilities, licensees are not required to address 10 CFR 70.64 

39 baseline design criteria. However, they must still meet the performance requirements of 

40 10 CFR 70.61, including accidents caused by natural phenomena, for which the staff may 

41 require additional IROFS to meet the performance requirements. Existing facilities can use

42 IROFS in the form of additional administrative controls to meet the performance requirements 

43 without the need for design features normally required by accepted engineering practice. When

44 near compliance can be achieved and complete compliance will be relatively costly, plants may 

45 request an exemption to the regulation.

46

47 As discussed earlier, many existing 10 CFR Part 70 facilities are not designed for an earthquake 

48 beyond that specified in applicable building codes. Although this design may provide fairly good 

49 seismic protection to the structure, it may not protect internal equipment. Also, an existing 

50 facility may not be designed to any specific seismic criteria, in which case its ability to withstand 

51 earthquakes can only be estimated based on comparison with similar structures or through 

52 complex structural analysis. In such cases, licensees may add IROFS to meet the performance 
May 2014 3-D-6 NUREG-1520, Revision 2

1 requirements. An example of such IROFS (procedures and upgrades) being effectively 

2 implemented would be a facility where the consequences of a release of licensed material to the 

3 public in a seismic event would be from fires and/or explosions. In this case, fixes such as 

4 seismically qualified flammable gas shutoff valves or electrical shutoffs might provide a large 

5 decrease in potential seismic consequences. 

6

7 In regard to flooding, flood elevations beyond that of the 100-year flood may not have been 

8 determined for the site. For sites in proximity to a river, these determinations could be 

9 expensive and time consuming. For these cases, flood warning time may allow measures such 

10 as moving material at risk and/or blocking doors and openings in the facility structure. 

11

12 A facility’s ability to withstand high winds, rain and snow loads, and exterior fires can likewise be 

13 improved through a combination of administrative procedures and engineered improvements. 

14 Removing material at risk from under walls or roofs that are not seismically designed can 

15 reduce potential releases in case of collapse from winds or roof loads. 

16

17 Exemptions to the regulation may still be required for existing facilities even with administrative 

18 and engineered improvements. In regard to consequences to the public, complete compliance 

19 with 10 CFR 70.61 using realistic assumptions should be the goal. Compliance with 

20 10 CFR 70.61 regarding consequences to facility workers may require a request for an 

21 exemption once personnel protective equipment, emergency procedures, and worker training 

22 are taken into account. In the evaluation of a request for an exemption to the regulation, the 

23 expected operational life of the facility should also be factored into the determination of risk.

24

25 Considerations for New Processes at Existing Facilities

26

27 The design of new processes at existing facilities must address natural phenomena hazards in 

28 accordance with 10 CFR 70.64(a)(2), as well as the performance requirements of 

29 10 CFR 70.61. Nevertheless, new processes at existing facilities may present the same 

30 problems in demonstrating compliance with 10 CFR 70.61 in regard to accident sequences 

31 initiated by natural phenomena as do existing facilities based on the design and/or siting of the 

32 original structures. In the case of new processes, the U.S. Nuclear Regulatory Commission 

33 staff should expect compliance with the performance requirements of 10 CFR 70.61 to the 

34 extent possible, given the existing facility design and location. New processes at existing 

35 facilities also must meet the requirements of 10 CFR 70.64(b), which requires defense in depth 

36 and a preference for engineered controls over administrative controls. However, the staff 

37 cannot require structural improvements, permanent flood barriers, and other engineered 

38 improvements that could be considered retrofits to be applied to existing structures. New 

39 structural features within existing structures to prevent breaches in containment in the event of 

40 natural phenomena hazards may be considered, however. An example might be a seismically

41 designed vault to hold radioactive materials associated with a new process. In regard to new 

42 processes, engineered controls, where feasible, are preferred over administrative procedures 

43 that might otherwise be proposed for an existing process with a limited operational lifetime. 

44 Such engineered improvements may not be required for licensing but could be scheduled to 

45 replace administrative procedures or other long-term compensatory measures on a timely basis 

46 after the start of operations. The objective is to encourage engineered safety in new processes 

47 compared to equivalent existing processes, while recognizing the restraints of the existing 

48 structures and location. Although primarily aimed at reducing risk to the public, the emphasis on 

49 engineered safety may also be applied to worker consequences in a way consistent with the 

50 method accepted at other facilities. 

51

52
May 2014 3-D-7 NUREG-1520, Revision 2

1 Regulatory Basis

2

3 The regulation in 10 CFR 70.61 specifies performance requirements associated with risks 

4 identified by an ISA.

5

6 For new facilities or new processes at existing facilities, 10 CFR 70.64 specifies requirements,

7 including Baseline Design Criterion (a)(2), “Natural Phenomena Hazards.” 

8

9 Technical Review Guidance

10

11 When examining the applicant’s evaluation of the effects of natural phenomena on its facility, 

12 reviewers should recognize that estimates of “unlikely” and “highly unlikely” natural phenomena 

13 such as the PMF or SSE may not exist for the particular site. Hence, extrapolation and/or 

14 transposition of extreme event estimates made for other relatively nearby facilities (such as 

15 power reactor sites) should be allowed where feasible and technically justifiable. In addition, 

16 sophisticated probabilistic tools such as Bayesian analysis or Monte Carlo sampling methods 

17 need not be employed to improve the estimate of likelihoods of natural phenomena event 

18 sequences unless desired by the applicant (or licensee). For the purpose of determining 

19 appropriate values of extreme events, deterministic events such as the PMF or SSE can be 

20 used in place of purely probabilistically determined “highly unlikely” events and may be 

21 preferable, depending on the quality of historical data. Where extreme events need to be 

22 coupled with other probability-driven mechanisms, such as the release fraction or transport 

23 pathway, already low likelihood combinations do not have to be made even less likely by the 

24 use of conservative parameters.

25

26 For existing facilities, due credit should be given to analysis assumptions and administrative 

27 controls, emergency procedures, and active engineered controls that do not change the design 

28 bases of the facility structures to natural phenomena. If the ISA and ISA summary demonstrate 

29 that the existing facility is near compliance (within an order of magnitude of a likelihood 

30 threshold or within 50 percent of meeting a consequence threshold, but not both), an exemption 

31 to the regulation may be considered.

32

33 The annex to this appendix presents an example of an evaluation for an amendment request.

34

35 Recommendation

36

37 This guidance should be used to supplement Chapter 3 of this SRP. 

38

39 References

40

41 American National Standards Institute/American Nuclear Society, “Determining Design Basis 

42 Flooding at Power Reactor Sites,” ANS-2.8, July 1992.

43 U.S. Code of Federal Regulations, Chapter I, Title 10, “Energy,” Part 70, “Domestic Licensing of 

44 Special Nuclear Material.”

45

46 U.S. Department of Energy, “Natural Phenomena Hazards Design and Evaluation Criteria for 

47 Department of Energy Facilities,” DOE Standard-1020-2002, 2002.

48
May 2014 3-D-8 NUREG-1520, Revision 2

1 U.S. Nuclear Regulatory Commission, “Domestic Licensing of Special Nuclear Material; 

2 Possession of a Critical Mass of Special Nuclear Material,” Federal Register, Vol. 65, No. 181, 

3 pp. 56211–562331, September 18, 2000.

4

5 U.S. Nuclear Regulatory Commission, “Procedural and Submittal Guidance for the Individual 

6 Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities,” 

7 NUREG-1407, June 1991.

8

9 U.S. Nuclear Regulatory Commission, “Design Basis Flooding for Nuclear Power Plants,” 

10 Regulatory Guide 1.59, Revision 2, August 1997.
May 2014 3-AD-1 NUREG-1520, Revision 2

ANNEX TO APPENDIX D

EXAMPLE OF NATURAL PHENOMENA HAZARD REVIEW FOR 

COMPLIANCE WITH 10 CFR 70.61

This example review is for an amendment to authorize operations in a blended low-enriched 

uranium oxide conversion building (OCB). The site is located near a river and is just above the 

100-year flood plain of a nearby creek. The effluent process building was also part of the 

amendment but was not evaluated because the quantities of radioactive material or hazardous 

chemicals (that come under U.S. Nuclear Regulatory Commission (NRC) regulation) that it 

contained are not considered sufficient to exceed the consequence threshold for “unlikely” 

events given in Title 10 of the Code of Federal Regulations (10 CFR) 70.61, “Performance 

Requirements.”

Seismic Evaluation

The OCB is of reinforced concrete construction and is built to seismic criteria in the Standard 

Building Code (SBC-1999), which is equivalent to being designed for an earthquake with a 

probability of exceedance of approximately 4x10-4 per year. Using Appendix C to

U.S. Department of Energy (DOE) Standard-1020-2002, “Natural Phenomena Hazards Design 

and Evaluation Criteria for Department of Energy Facilities,” the NRC staff determined the risk 

reduction factor to be 4, which gives the structure a likelihood of significant damage from an 

earthquake of 10-4 per year or less. Hence, the collapse or loss of building integrity from an 

earthquake may be considered to be “highly unlikely,” as the probabilistic value of “highly 

unlikely” indicated by the applicant was a probability of exceedance of 10-4 to 10-5 per year. 

Within the building, the material at risk consists of low-enriched uranyl nitrate liquid, ammonium 

diuranate slurry, and uranium dioxide powder. All of these materials are expected to be within 

containers, and spillage during a seismic event is expected to be minimal. Since the building is 

expected to retain its integrity, the leak path factor will be relatively minor even without dynamic 

confinement from the ventilation system. Facility workers are expected to take actions to limit 

personal intake of radionuclides. The staff concludes that the OCB complies with the 

performance requirements of 10 CFR 70.61 with regard to seismic events.

High-Winds Evaluation 

The OCB structure is also designed for wind loads in accordance with SBC-1999, and the 

probability of a tornado impacting the facility is less than 10-5 per year. Therefore, the facility 

needs to be evaluated only in regard to the effects of wind loads and missiles, but not for 

tornadoes. The NRC staff considers the reinforced concrete exterior walls of the OCB to be 

adequate to withstand high wind velocities, as well as the missiles (from DOE

Standard-1020-2002) that should be assumed for such events. The staff considers a collapse 

of building walls because of wind forces such that radioactive material would escape to be 

“highly unlikely.” In addition, the meteorological conditions likely to result in severe winds may 

be forecast in advance and protective measures taken. The staff concludes that the OCB 

complies with the performance requirements of 10 CFR 70.61 with regard to wind events.
May 2014 3-AD-2 NUREG-1520, Revision 2

Flooding Evaluation

The lowest floor in the OCB is 15 feet above the 100-year flood from an adjacent creek. From a 

review of the topography of the site area, it appears that flooding of the site could occur, most 

likely from flooding of the nearby river with coincident flooding of the adjacent creek, which 

could back up through the railroad culvert. This event is expected to have warning time and 

may overtop the railroad embankment to the north of the facility and flood parts of the nearby 

town. However, the facility is sufficiently removed from the main channel of the river that 

flood-induced scouring and erosion would not be expected. In addition, the hydrostatic loading 

from the flood on the exterior walls of the OCB would not be expected to cause collapse. The 

primary concern is inundation, which could float unsecured containers within the OCB but not 

remove them from the facility. A criticality event cannot be excluded, but it could occur only in 

the flooded and, therefore, evacuated section of the plant and would not affect facility workers. 

In addition, the warning time would allow the movement of material to reduce the likelihood of a 

flood-induced criticality. The staff concludes that the OCB complies with the performance 

requirements of 10 CFR 70.61 with regard to flooding.

REFERENCES

U.S. Code of Federal Regulations, Chapter I, Title 10, “Energy,” Part 70, “Domestic Licensing of 

Special Nuclear Material.”

U.S. Department of Energy, “Natural Phenomena Hazards Design and Evaluation Criteria for 

Department of Energy Facilities,” DOE Standard-1020-2002, 2002.
May 2014 3-E-1 NUREG-1520, Revision 2

APPENDIX E 

HUMAN FACTORS ENGINEERING FOR PERSONNEL ACTIVITIES

1 The purpose of this review is to establish that human factors engineering (HFE) is applied to 

2 personnel activities identified as safety significant, consistent with the findings of the integrated 

3 safety analysis (ISA), and the determination of whether an item relied on for safety (IROFS) has 

4 special or unique safety significance. A graded approach commensurate with the complexity 

5 and integration and operation of the control systems is appropriate. The application of HFE to 

6 personnel activities ensures that the potential for human error in the facility operations was 

7 addressed during the design of the facility by facilitating correct, and inhibiting wrong, decisions 

8 by personnel and by providing a means for detecting and correcting or compensating for error. 

9 Title 10 of the Code of Federal Regulations (10 CFR) 70.61(e) requires a safety program to 

10 ensure that each IROFS will be available and reliable to perform its intended function when 

needed. Therefore, the applicant should identify those “personnel activities1 11 ” that are 

12 considered IROFS and personnel activities that support safety (e.g., maintenance). An HFE 

13 review should be performed to demonstrate compliance with 10 CFR 70.61(e). Also, the 

14 applicant should demonstrate how personnel activities will enhance safety by reducing 

15 challenges to IROFS, as required in 10 CFR 70.64(b)(2). 

16 A human factors specialist and an ISA reviewer should conduct the human factors review. The 

17 review should also be coordinated with the reviewers of other technical areas and the reviewer 

18 of management measures, as necessary. 

19

20 AREAS OF REVIEW AND ACCEPTANCE CRITERIA

21 Some facilities rely heavily on automated systems employing advanced digital instrumentation 

22 and control technology. These systems may be complex, with potential negative impacts on 

23 human performance activities in both operations and maintenance. The scope of review for the 

24 HFE for personnel activities should be consistent with the results of the ISA and include the 

following, as appropriate2 25 : 

26 A. Identification of Personnel Activities—The applicant should appropriately identify the 

27 personnel activities such that the reviewer can understand the actions, the human28 systems interfaces (HSIs) involved, and the consequences. 

29

30 B. HFE Design Review Planning—The applicant’s approach for planning HFE design 

31 review should include the following: 

 1 For the purposes of this chapter, the phrase “personnel activities” represents personnel activities identified 

as IROFS and personnel activities that support safety, such as maintenance. 

2 All nine areas of review (A through I) may not be necessary for a specific application. Areas of review 

should be based on the applicant’s provisions to address personnel activities consistent with the ISA 

findings, the similarity of the associated HFE issues for similar type plants, and the determination of whether 

an IROFS has special or unique safety significance. 
May 2014 3-E-2 NUREG-1520, Revision 2

1 i. Identification of appropriate goals and scope to ensure that HFE practices and 

2 guidelines are implemented during design, construction, and operation of the 

3 facility. 

4 ii. Implementation by an HFE team that has the appropriate composition, 

5 experience, and organizational authority to ensure that HFE is considered in the 

6 design of HSI for personnel activities. The HFE team’s responsibilities include 

7 ensuring the proper development, execution, oversight, and documentation of the 

8 HFE function. Depending on the identification of personnel activities, it may be 

9 appropriate for the HFE team to consist of a single individual. 

10

11 iii. An HFE team that attains the HFE goals and scope through established 

12 processes and procedures and that tracks HFE issues. The HFE function that 

13 should ensure that all aspects of the personnel activities including the HSI are 

14 developed, designed, and evaluated on the basis of a structured approach using 

15 HFE. 

16

17 C. Operating Experience Review (OER)—To the extent possible, the applicant should 

18 identify safety-related HFE events or potential events in existing facilities that are similar 

19 to the proposed facility. The applicant should do all of the following: 

20

21 i. Review the HFE-related events or potential events for relevance.

22

23 ii. Analyze the HSI technology employed for the relevant HFE events or potential 

24 events.

25

26 iii. Conduct (or review existing) operator interviews and surveys on the HSI 

27 technology for the relevant HFE events or potential events. 

28

29 D. Functional Allocation Analysis and Task Analysis 

30 i. The functional allocation analysis should be based on the OER. Personnel 

31 activities should be functionally allocated to take advantage of human strengths 

32 and to avoid demands that are not compatible with human capabilities. 

33

34 ii. The task analysis should include the task analysis scope, identification, and 

35 analysis of critical tasks; detailed description of personnel demands (e.g., input, 

36 processing, and output); iterative nature of the analysis; and incorporation of job 

37 design issues. The task analysis should address each operating mode for each 

38 personnel activity (e.g., startup, normal operations, emergency operations, and 

39 shutdown). The task analysis results support the functional allocation. 

40

41 E. HSI Design, Inventory, and Characterization—The HSI design should incorporate the 

42 functional allocation analysis and task analysis into the detailed design of safety43 significant HSI components (e.g., alarms, displays, controls, and operator aids) through 

44 the systematic application of HFE. The HSI design should include the overall work 

45 environment, the work space layout (e.g., control room and remote shutdown facility 

46 layouts), the control panel and console design, the control and display device layout, and 

47 information and control interface design details. The HSI design process should ensure 

48 the application of HFE to the HSI required to perform personnel activities. The HSI 
May 2014 3-E-3 NUREG-1520, Revision 2

1 design process should exclude the development of extraneous controls and displays. 

2 The HSI design documentation should include a complete HSI inventory and the basis 

3 for the HSI characterization. 

4 F. Staffing—Staffing should be based on a review of the number and qualifications of 

5 personnel for each personnel activity during all plant operating conditions. The applicant 

6 should conduct this review in a systematic manner that incorporates the functional 

7 allocation and task analysis results. 

8 Categories of personnel should be based on the types of personnel activities. Staffing 

9 considerations should include issues identified in the OER, functional allocation, HSI 

10 design, procedure development, and verification and validation (V&V). 

11 G. Procedure Development—The applicant’s procedure development for personnel 

12 activities should incorporate HFE principles and criteria, along with all other design 

13 requirements, to develop procedures that are technically accurate, comprehensive, 

14 explicit, easy to use, and validated consistent with the acceptance criteria in this 

15 Standard Review Plan. Because procedures are considered an essential component of 

16 the HSI design, they should be derived from the same design process and analyses as 

17 the other components of the HSI (for example, displays, controls, operator aids) and 

18 subject to the same evaluation processes. Procedures to support the personnel activity 

19 may include generic technical guidance, plant and system operations, abnormal and 

20 emergency operations, tests (for example, preoperational, startup, and surveillance), 

21 and alarm response. 

22 H. Training Program Development—The applicant’s training program development should 

23 address all personnel activities. The training program development indicates how the 

24 knowledge and skill requirements of personnel will be evaluated, how the training 

25 program development will be coordinated with the other activities of the HFE design 

26 process, and how the training program will be implemented in an effective manner 

27 consistent with human factors principles and practices. 

28 The training program development should address the areas of review and acceptance 

29 criteria described in Chapter 11 of this SRP and should result in a training program that 

30 provides personnel with qualifications commensurate with their activities. 

31 I. Verification & Validation—V&V confirms that the design incorporates HFE to HSI in a 

32 manner that enables the successful completion of personnel activities. The V&V should 

33 be applied to personnel activities (see item A) and HSI design (see item E). The V&V 

34 process should consist of the following: 

35 i. HSI task support verification: HSI components should be appropriately provided 

36 for personnel activities through HSI task support verification. The verification 

37 should show that each HSI has identified the task analysis (see item D(ii)) and 

38 that the HSI design (see item E) is appropriately provided, yet minimizes the 

39 incorporation of information, displays, controls, and embellishments that 

40 unnecessarily complicate personnel activities. 

41

42 ii. HFE design verification: The HFE design verification should show that each HSI 

43 identified for a personnel activity has incorporated HFE into the design. 

44 Deviations from accepted HFE principles and guidelines should be justified or 

45 documented for resolution or correction. If HFE design verification does not 

46 address all HSI components, then an alternative multidimensional sampling 
May 2014 3-E-4 NUREG-1520, Revision 2

1 methodology should be used to ensure comprehensive consideration of the 

2 safety significance of HSI components. The sample size should be sufficient to 

3 identify a range of significant safety issues. 

4

5 iii. Integrated system validation: The applicant should conduct a performance6 based evaluation of the integrated design to ensure that the HFE/HSI supports 

7 safe operation of the plant. Integrated system validation is performed after HFE 

8 problems identified in HFE design activities are resolved or corrected because 

9 these may negatively affect performance and, therefore, validation results.

10 Validation is performed by evaluating personnel activities using appropriate 

11 measurement tools. All personnel activities should be tested and found to be 

12 adequately supported in the design, including personnel activities outside the 

13 control room. 

14

15 iv. Human factors issue resolution verification: The applicant should verify that HFE 

16 issues identified during the design process were addressed and resolved. Issue 

17 resolution verification should be documented in the HFE issue tracking system 

18 established by the HFE team (see item B). Issues that cannot be resolved until 

19 the HSI design is constructed, installed, and tested should be identified and 

20 incorporated into the final HFE/HSI design verification. 

21

22 v. Final HFE/HSI design verification: The applicant should commit to performing a 

23 final HFE/HSI design verification if the applicant cannot demonstrate that it has 

24 fully evaluated the actual installation of the final HSI design in the plant through 

25 the V&V activities described above. Final HFE/HSI design verification should 

26 demonstrate that in-plant HFE design implementation conforms to the HFE 

27 design (see item E) as modified by V&V activities. V&V activities should be 

28 performed in the order listed above, as necessary. However, the applicant may 

29 find that it is necessary to repeat the activities in order to address design 

30 corrections and modifications that occur during V&V. 

31

32 REFERENCES 

33 U.S. Code of Federal Regulations, Chapter I, Title 10, “Energy,” Part 70, “Domestic Licensing of 

34 Special Nuclear Material.”

35 U.S. Nuclear Regulatory Commission, “Standard Review Plan for the Review of a License 

36 Application for a Mixed Oxide Fuel Fabrication Facility,” NUREG-1718, August 2000.
May 2014 4-1 NUREG-1520, Revision 2

4. RADIATION PROTECTION

1 4.1 Purpose of Review

2

3 The purpose of this review is to determine, consistent with Title 10, “Energy,” of the Code of 

4 Federal Regulations (10 CFR) 70.23(a)(2), (3), and (4), whether the applicant’s 

5 radiation-protection program is adequate to protect the radiological health and safety of workers 

6 and to comply with the regulatory requirements in 10 CFR Part 19, “Notices, Instructions and 

7 Reports to Workers: Inspection and Investigations”; 10 CFR Part 20, “Standards for Protection 

8 Against Radiation”; 10 CFR Part 70, “Domestic Licensing of Special Nuclear Material”, and 

9 10 CFR Part 71, “Packaging and Transportation of Radioactive Material.”

10

11 The content and level of detail in this chapter are generally greater than in other chapters 

12 because this chapter provides acceptance criteria for evaluating compliance with 10 CFR

13 Part 20, which has very specific requirements. The applicant should also incorporate, and the 

14 U.S. Nuclear Regulatory Commission (NRC) reviewer should consider, insights gained from the 

15 conduct of the integrated safety analysis (ISA) and information contained in the ISA summary in 

16 developing and reviewing the acceptability of the applicant’s radiation-protection program. 

17 In addition, the reviewer should evaluate the adequacy of the ISA summary with respect to 

18 ensuring that the application meets the radiation exposure performance criteria of 

19 10 CFR 70.61(b) and (c). Chapter 9 of this Standard Review Plan (SRP), which discusses 

20 environmental protection, contains the review procedures and acceptance criteria for the 

21 applicant’s program for protecting members of the public and controlling effluent releases.

22

23 4.2 Responsibility for Review

24

25 Primary: Health Physicist

26

27 Secondary: Licensing Project Manager, Environmental Reviewer

28

29 Supporting: Fuel Cycle Facility Inspector

30

31 4.3 Areas of Review

32

33 The radiation protection program must address the occupational radiation protection measures 

34 in 10 CFR Parts 19, 20, 70, and 71. Specifically, licensees must develop, document, and 

35 implement a radiation protection program in accordance with 10 CFR 20.1101, “Radiation

36 Protection Programs.” Additionally, 10 CFR 20.2102, “Records of Radiation Protection 

37 Programs,” requires licensees to keep records of the radiation protection program, including a 

38 description of the program components, audits, and other aspects of program implementation. 

39 The reviewer should also refer to the ISA summary to identify those facility operations analyzed 

40 in the ISA that have radiological consequences and the associated items relied on for safety 

41 (IROFS) and management measures implemented to prevent or mitigate such radiological risks. 

42 The ISA review should include a judgment as to the comprehensiveness of evaluations 

43 performed by the licensee.
May 2014 4-2 NUREG-1520, Revision 2

1 The staff will review an applicant’s commitments regarding the following components of the 

2 radiation protection program:

3

4 1. Establish, maintain, and implement a radiation protection program.

5

6 2. Keep occupational exposures to radiation as low as reasonably achievable (ALARA).

7

8 3. Appoint radiological protection staff who are suitably qualified and trained in radiation

9 protection procedures.

10

11 4. Prepare written radiation protection procedures and radiation work permits (RWPs).

12

13 5. Train employees in radiation protection, including the health protection problems 

14 associated with exposure to radiation, precautions and procedures to minimize 

15 exposure, and the purposes and functions of protective devices employed.

16

17 6. Design and implement programs to control airborne concentrations of radioactive 

18 material by using ventilation systems, containment systems, and respirators.

19

20 7. Conduct radiation surveys and monitoring programs to document radiation levels, 

21 concentrations of radioactive materials in the facility, and occupational exposures to 

22 radiation by workers.

23

24 8. Evaluate the radiological risks from accidents occurring during operations; identify 

25 IROFS that limit high and intermediate consequences, consistent with regulatory 

26 performance criteria; and have appropriate management measures in place to ensure 

27 that identified IROFS are available and reliable.

28

29 9. Maintain additional programs, including (1) a records maintenance program,

30 (2) a corrective action program, and (3) a program for reporting to the NRC in 

31 accordance with requirements in 10 CFR Part 20 and 10 CFR Part 70.

32

33 Review Interfaces

34

35 In addition to Chapter 4 of the application, the reviewer should examine information in the 

36 following other areas to ensure that it is consistent with the information in Chapter 4:

37

38 • The emergency plan applicable to radiation protection under SRP Chapter 8.

39

40 • The safety program, ISA commitments, and ISA documentation applicable to radiation 

41 protection under SRP Chapter 3.

42

43 • The environmental and effluent monitoring, as well as any effluent controls applicable to 

44 radiation protection under SRP Chapter 9.

45

46 Procedural, document control, and training criteria may also be addressed in response to 

47 Chapter 11 as these may be considered management measures and/or IROFS.
May 2014 4-3 NUREG-1520, Revision 2

1 4.4 Acceptance Criteria

2

3 4.4.1 Commitment to Radiation-Protection Program Implementation

4

5 4.4.1.1 Regulatory Requirements

6

7 Regulations in 10 CFR 20.1101 apply to the establishment of a radiation protection program.

8

9 4.4.1.2 Regulatory Guidance

10

11 The NRC regulatory guide applicable to the commitment to design and implement a radiation

12 protection program is Regulatory Guide 8.2, “Administrative Practices in Radiation Surveys and 

13 Monitoring,” issued May 2011.

14

15 4.4.1.3 Regulatory Acceptance Criteria

16

17 In accordance with Subpart B, “Radiation Protection Programs,” of 10 CFR 20, the purpose of 

18 the radiation protection program is to maintain occupational and public doses below regulatory 

19 limits and ALARA. The applicant’s radiation protection program will be acceptable if it includes:

20212

23 1. A documented management commitment to keep exposures ALARA;

24

25 2. A trained and qualified radiation protection organization with independence from the 

26 facility’s operations, well-defined responsibilities, and sufficient authority to carry out 

27 those responsibilities;

28

29 3. Adequate facilities, equipment, and procedures to effectively implement the program; 

30 and

31

32 4. The review, at least annually, of the radiation protection program’s content and 

33 implementation, as required by 10 CFR 20.1101(c). The review should consider facility 

34 changes, new technologies, and other process enhancements that could improve the 

35 effectiveness of the overall program.

36

37 4.4.2 Commitment to an ALARA Program

38

39 4.4.2.1 Regulatory Requirements

40

41 Regulations in 10 CFR 20.1101 apply to the ALARA program.

42

43 4.4.2.2 Regulatory Guidance

44

45 The following NRC regulatory guides are applicable to the ALARA program:

46

47 1. Regulatory Guide 4.21, “Minimization of Contamination and Radioactive Waste 

48 Generation: Life Cycle Planning,” June 2008

49

50 2. Regulatory Guide 8.2

51

52 3. Regulatory Guide 8.10, “Operating Philosophy for Maintaining Occupational Radiation 

53 Exposures as Low as Is Reasonably Achievable,” Revision 1-R, May 1977
May 2014 4-4 NUREG-1520, Revision 2

1 4. Regulatory Guide 8.13, “Instructions Concerning Prenatal Radiation Exposure,” 

2 Revision 3, June 1999

3

4 5. Regulatory Guide 8.15, “Acceptable Programs for Respiratory Protection,” Revision 1, 

5 October 1999

6

7 6. Regulatory Guide 8.29, “Instructions Concerning Risks from Occupational Radiation 

8 Exposure,” February 1996

9

10 4.4.2.3 Regulatory Acceptance Criteria

11

12 The applicant’s ALARA program is acceptable if the license application provides data and 

13 information that meet each of the following commitments:

1415

16 1. Establish a written, comprehensive, and effective ALARA program.

17

18 2. Prepare policies and procedures to ensure that occupational radiation exposures are 

19 maintained ALARA and that such exposures are consistent with the requirements of 

20 10 CFR 20.1101.

21

22 3. Outline specific ALARA program goals, establish an ALARA program organization and 

23 structure, and include written procedures for its implementation in the plant design and 

24 operations.

25

26 4. Establish an ALARA committee or equivalent organization with sufficient staff, 

27 resources, and clear responsibilities to ensure that the occupational radiation exposure 

does not exceed the dose limits of 10 CFR Part 20 under normal operations.1 28

29

30 5. Use the ALARA program as a mechanism to facilitate interaction between radiation 

31 protection and operations personnel.

32

33 6. Regularly review and revise, when appropriate, the ALARA program goals and 

34 objectives and incorporate, when appropriate, new approaches, technologies, operating 

35 procedures, or changes that could reduce potential radiation exposures at a reasonable 

36 cost.

 1 The ALARA committee should meet at least annually, and the membership should include areas such as 

management, radiation protection, environmental safety, industrial safety, and production. The committee’s 

review of the ALARA program should include an evaluation of the results of audits made by the 

radiation-protection organization, reports of radiation levels in the facility, contamination levels, employee 

exposures, and effluent releases. The review should determine whether there are any upward trends in 

personnel exposure for identified categories of workers and types of operations. The review should identify 

any upward trends in effluent releases and contamination levels. Finally, the review should determine 

whether exposures, releases, and contamination levels are in accordance with the ALARA concept. The 

ALARA committee should document its recommendations and track them to completion.
May 2014 4-5 NUREG-1520, Revision 2

1 4.4.3 Organization and Personnel Qualifications

2

3 4.4.3.1 Regulatory Requirements

4

5 Regulations in paragraph (a)(6) of 10 CFR 70.22, “Contents of Applications,” apply to the 

6 organization and qualifications of the radiological protection staff.

7

8 4.4.3.2 Regulatory Guidance

9

10 The following are the NRC regulatory guides applicable to the organization and personnel 

11 qualifications of radiation protection program staff:

12

13 1. Regulatory Guide 8.2

14

15 2. Regulatory Guide 8.10

16

17 4.4.3.3 Regulatory Acceptance Criteria 

18

19 The applicant’s commitment to organize and staff a radiation protection program is acceptable if 

20 the license application provides data and information that meet each of the following 

21 commitments:

2223

24 1. Appoint radiation protection personnel and identify their authority and responsibilities for 

25 implementing the radiation protection program functions. 

26

27 2. Establish clear organizational relationships among the individual positions responsible 

28 for the radiation protection program and other line managers.

29

30 3. Appoint a suitably educated, experienced, and trained radiation protection program

31 director (typically referred to as the radiation safety officer) who (1) has direct access to 

32 the plant manager, (2) is skilled in the interpretation of data and regulations pertinent to 

33 radiation protection, (3) is familiar with the operation of the facility and radiation 

34 protection concerns of the site, (4) participates as a resource in radiation safety 

35 management decisions, and (5) will be responsible for establishing and implementing 

36 the radiation protection program.

37

38 4. Describe the minimum education, experience, and training requirements for the radiation

39 protection program director and staff.

40

41 4.4.4 Commitment to Written Procedures

42

43 4.4.4.1 Regulatory Requirements

44

45 The regulations in 10 CFR 70.22(a)(8) apply to radiation protection procedures and RWPs.

46

47 4.4.4.2 Regulatory Guidance

48

49 The regulatory guidance applicable to procedures and RWPs appears in Regulatory Guide 8.10, 

50 Revision 1-R.
May 2014 4-6 NUREG-1520, Revision 2

1 4.4.4.3 Regulatory Acceptance Criteria

2

3 The applicant’s commitment to prepare written radiation protection procedures and RWPs is 

4 acceptable if the license application provides data and information that meet each of the 

5 following commitments:

6

7 1. Prepare written, approved procedures to carry out activities related to the radiation

8 protection program. Procedures should address applicable radiation protection 

9 requirements found in 10 CFR 19, 20, 70, and 71 and any other applicable regulations.

10

11 2. Establish a process for procedure generation or modification, authorization, distribution, 

12 and training, such that changes in technology or practices are communicated effectively 

13 and in a timely manner. Review and revise procedures, as necessary, to incorporate 

14 any facility or operational changes, including changes in the ISA. The radiation safety 

15 officer, or an individual who has the qualifications of the radiation safety officer, should 

16 approve all procedures related to radiation protection.

17

18 3. Specify written, approved RWPs for activities involving licensed material that are not 

19 covered by written radiation protection procedures. RWPs should define the authorized 

20 activities, the level of approval required (a radiation specialist, as a minimum), 

21 information requirements, period of validity, expiration and termination times, and 

22 recordkeeping requirements.

23

24 4.4.5 Radiation Safety Training

25

26 The SRP addresses an applicant’s commitments to employee training in several places. This 

27 chapter addresses corporate radiation protection training programs, and Chapter 11 discusses 

28 training that serves as a management measure for ensuring that an administrative control 

29 IROFS is available and reliable when required.

30

31 4.4.5.1 Regulatory Requirements

32

33 The following regulations apply to the radiation safety training program:

34

35 1. 10 CFR 19.12, “Instructions to Workers”

36

37 2. 10 CFR 20.2110, “Form of Records”

38

39 3. 10 CFR 70.22, paragraph (a)(6) 

40

41 4.4.5.2 Regulatory Guidance

42

43 The following NRC regulatory guides, reports of the National Council on Radiation Protection 

44 (NCRP), and standards of the American National Standards Institute (ANSI)/Health Physics 

45 Society (HPS) and the American Society for Testing and Materials pertain to radiation protection 

46 training:

47

48 1. Regulatory Guide 8.10

49

50 2. Regulatory Guide 8.13
May 2014 4-7 NUREG-1520, Revision 2

1 3. Regulatory Guide 8.29

2

3 4. ANSI/HPS N13.36, “Ionizing Radiation Safety Training for Workers,” October 30, 2001, 

4 reaffirmed July 19, 2011

5

6 5. ASTM E1168-95, “Radiological Protection Training for Nuclear Facility Workers,” 

7 reapproved in 2008

8

9 6. NCRP Report No. 134, “Operational Radiation Safety Training,” 2000

10

11 4.4.5.3 Regulatory Acceptance Criteria

12

13 The applicant’s commitment to train its employees in radiation protection is acceptable if the 

14 license application provides data and information that meet each of the following commitments:

1516

17 1. Design and implement an employee radiation protection training program that complies 

18 with the requirements of 10 CFR Parts 19 and 20.

1920

21 2. Provide training to all personnel and visitors entering restricted areas that is 

22 commensurate with the health risk to which they may be exposed, or provide escorts 

23 who have received the appropriate training.

24

25 3. Provide a level of training commensurate with the potential radiological health risks 

26 associated with that employee’s work responsibilities.

27

28 4. Conduct refresher training, at least every 3 years that will accurately address changes in 

29 policies, procedures, requirements, and the facility ISA.

30

31 5. Incorporate into the radiation protection training program the provisions in 10 CFR 19.12 

32 and additional relevant topics, such as the following (the asterisk denotes those topics 

33 with a basis in 10 CFR 19.12):

3435

36 a. correct handling of radioactive materials

37

38 b. the storage, transfer, or use of radiation or radioactive material as relevant to the 

39 individual’s activities*

40

41 c. minimization of exposures to radiation or radioactive materials*

4243

44 d. access and egress controls and escort procedures

45

46 e. radiation safety principles, policies, and procedures*

47

48 f. monitoring for internal and external exposures

49

50 g. radiation exposure reports available to workers*

51

52 h. monitoring instruments

53

54 i. contamination control procedures, including protective clothing and equipment*
May 2014 4-8 NUREG-1520, Revision 2

1 j. ALARA and exposure limits*

2

3 k. radiation hazards and health risks*

4

5 l. emergency response*

6

7 m. responsibility to report promptly any condition that may lead to, or cause, a 

8 violation of regulations and licenses or create unnecessary exposure*

109

11 6. Review and evaluate the accuracy, effectiveness, and adequacy of the radiation 

12 protection training program curriculum and instructors, as applicable, at least every 

13 3 years.

14

15 4.4.6 Ventilation and Respiratory Protection Programs

16

17 4.4.6.1 Regulatory Requirements

18

19 Subpart H, “Respiratory Protection and Controls to Restrict Internal Exposure in Restricted 

20 Areas,” of 10 CFR Part 20 and 10 CFR 70.22(a)(7) apply to the ventilation and respiratory 

21 protection programs.

22

23 4.4.6.2 Regulatory Guidance

24

25 The following NRC regulatory guides, ANSI standards, and other publications apply to the 

26 design of the ventilation and respiratory protection programs:

27

28 1. Regulatory Guide 4.21

29

30 2. Regulatory Guide 8.15

31

32 3. Regulatory Guide 8.24, “Health Physics Surveys During Enriched Uranium-235 

33 Processing and Fuel Fabrication,” Revision 2, June 2012

34

35 4. American Conference of Governmental Industrial Hygienists (ACGIH), “Industrial 

36 Ventilation: A Manual of Recommended Practice for Design,” ACGIH 2096, 2010

37

38 5. ACGIH, “Industrial Ventilation: A Manual of Recommended Practice for Operation and 

39 Maintenance,” ACGIH 2106, 2007

40

41 6. American Glovebox Society, “Guideline for Gloveboxes,” AGS-G001, 2007

42

43 7. American National Standards Institute, “Practices for Respiratory Protection,”

44 ANSI Z88.2-1992

45

46 8. ASME AG-1, “Code on Nuclear Air and Gas Treatment,” American Society of 

47 Mechanical Engineers, New York, NY, 2009, and applicable addenda

48

49 9. AGS-G001, “Guideline for Gloveboxes,” American Glovebox Society, Santa Rosa, CA, 

50 2007
May 2014 4-9 NUREG-1520, Revision 2

1 10. Energy Research and Development Administration (ERDA) 76-21, “Nuclear Air Cleaning 

2 Handbook,” by C.A. Burchsted, A.B. Fuller, and J.E. Kahn, March 31, 1976

3

4 11. ANSI Z88.2-1992, “Practices for Respiratory Protection”

5

6 4.4.6.3 Regulatory Acceptance Criteria

7

8 The applicant’s commitment to have ventilation and respiratory protection programs is 

9 acceptable if the license application provides data and information that meet each of the 

10 following commitments:

1112

13 1. Install appropriately sized ventilation and containment systems in areas of the plant 

14 identified as having potential airborne concentrations of radionuclides that could exceed 

15 the occupational derived air concentration values specified in 10 CFR Part 20, 

16 Appendix B, “Annual Limits on Intake (ALIs) and Derived Air Concentrations (DACs) of 

17 Radionuclides for Occupational Exposure; Effluent Concentrations; Concentrations for 

18 Release to Sewerage,” during normal operations. Air flow in buildings housing these 

19 operations should be directed towards the area(s) of highest potential contamination.

20

21 2. Describe management measures, including preventive and corrective maintenance and 

22 performance testing, to ensure that the ventilation and containment systems operate 

23 when required and are within their design specifications.

2425

26 3. Describe the operations criteria for the ventilation and containment systems, including 

27 minimum flow velocity at openings in these systems, maximum differential pressure 

28 across filters, and types of filters to be used.

29

30 4. Describe the frequency and types of tests to measure the performance of ventilation and 

31 containment systems, the acceptance criteria, and the actions to be taken when the 

32 acceptance criteria are not satisfied.

33

34 5. Establish a respiratory protection program that meets the requirements of Subpart H of 

35 10 CFR Part 20.

36

37 6. Prepare written procedures for the selection, fitting, issuance, maintenance, testing, 

38 training of personnel, monitoring, and recordkeeping for individual respiratory protection 

39 equipment and for specifying when such equipment is to be used.

40

41 7. Revise the written procedures for the use of individual respiratory protection equipment, 

42 as applicable, when making changes to processing, the facility, or the equipment.

43

44 8. Maintain records of the respiratory protection program, including training in respirator 

45 use and maintenance.

46

47 4.4.7 Radiation Surveys and Monitoring Programs

48

49 Radiation surveys are conducted for two purposes: (1) to ascertain radiation levels, 

50 concentrations of radioactive material, and potential radiological hazards that could be present 

51 in the facility and (2) to detect releases of radioactive material from plant equipment and 

52 operations. Radiation surveys will focus on those areas of the plant necessary to show 

53 compliance with the dose limits and monitoring requirements of Subpart C, “Occupational Dose 
May 2014 4-10 NUREG-1520, Revision 2

1 Limits”; Subpart D, “Radiation Dose Limits for Individual Members of the Public”; and Subpart F, 

2 “Surveys and Monitoring,” of 10 CFR Part 20.

3

4 Measurements of airborne radioactive material and bioassays are used to determine internal 

5 occupational exposures to radiation. When combined with external occupational exposure data, 

6 the dose of record can be compared against the dose limits specified in Subpart C of 10 CFR

7 Part 20.

8

9 Effluent and environmental monitoring, including stack monitoring and environmental radiation 

10 monitoring, may be addressed in Chapter 9, “Environmental Protection,” of this SRP.

11

12 4.4.7.1 Regulatory Requirements 

13

14 The following NRC regulations in 10 CFR Part 20 apply to radiation surveys and monitoring 

15 programs:

16

17 1. Subpart C

18

19 2. Subpart F

20

21 3. Subpart L, “Records”

22

23 4. Subpart M, “Reports”

24

25 4.4.7.2 Regulatory Guidance

26

27 The following NRC regulatory guides, NUREG, and ANSI standards are applicable to radiation 

28 surveys and monitoring programs:

29

30 1. Regulatory Guide 8.2

31

32 2. Regulatory Guide 8.4, “Personnel Monitoring Device, Direct-Reading Pocket 

33 Dosimeters,” Revision 1, June 2011

34

35 3. Regulatory Guide 8.7, “Instructions for Recording and Reporting Occupational Radiation 

36 Exposure Data,” Revision 2, November 2005

37

38 4. Regulatory Guide 8.9, “Acceptable Concepts, Models, Equations, and Assumptions for a 

39 Bioassay Program,” Revision 1, July 1993

40

41 5. Regulatory Guide 8.24

42

43 6. Regulatory Guide 8.25, “Air Sampling in the Workplace,” Revision 1, June 1992

44

45 7. Regulatory Guide 8.34, “Monitoring Criteria and Methods To Calculate Occupational 

46 Radiation Doses,” July 1992

47

48 8. Regulatory Guide 8.40, “Methods for Measuring Effective Dose Equivalent from External 

49 Exposure,” July 2010

50

51 9. NUREG-1400, “Air Sampling in the Workplace,” September 1993
May 2014 4-11 NUREG-1520, Revision 2

1 10. ANSI N323A-1997, “American National Standard Radiation Protection Instrumentation 

2 Test and Calibration, Portable Survey Instruments,” Approved April 3, 1997

3

4 11. ANSI N13.1-2011, “Sampling and Monitoring Releases of Airborne Radioactive 

5 Substances from the Stacks and Ducts of Nuclear Facilities,” approved March 30, 2011

6

7 12. ANSI N13.6-2010, “Practice for Occupational Radiation Exposure Records Systems,” 

8 approved August 3, 2010

9

10 13. ANSI N13.30-2011, “Performance Criteria for Radiobioassay,” approved 

11 December 16, 2011

12

13 14. ANSI N13.39—2001, “Design of Internal Dosimetry Programs,” approved May 24, 2001, 

14 reaffirmed July 19, 2011

15

16 15. ANSI N13.49—2001, “Performance and Documentation of Radiological Surveys,” 

17 approved August 6, 2001, reaffirmed June 10, 2011

18

19 16. ANSI N13.6-2010, “Practice for Occupational Radiation Exposure Records Systems,” 

20 Approved August 3, 2010

21

22 4.4.7.3 Regulatory Acceptance Criteria

23

24 The applicant’s commitment to implement radiation surveys and monitoring programs is 

25 acceptable if the license application provides data and information that meet each of the 

26 following commitments:

2728

29 1. Provide radiation survey and monitoring programs that are necessary to comply with the 

30 requirements of 10 CFR Part 20 and that are reasonable to evaluate the magnitude and 

31 extent of radiation levels, the concentrations or quantities of radioactive material, and the 

32 potential radiological hazards.

33

34 2. Prepare written procedures for the radiation survey and monitoring programs that 

35 include an outline of the program objectives, sampling procedures, data-analysis 

36 methods, types of equipment and instrumentation, frequency of measurements, 

37 recordkeeping and reporting requirements, and actions to be taken when measurements 

38 exceed regulatory limits in 10 CFR Part 20 or administrative levels established by the 

39 applicant.

40

41 3. Design and implement a personnel monitoring program for external occupational 

42 radiation exposures that outlines methods or procedures to do the following:

43

44 a. Identify the criteria for worker participation in the program.

45

46 b. Identify the types of radiation to be monitored.

47

48 c. Specify how exposures will be measured, assessed, and recorded.

49

50 d. Identify the type and sensitivity of personal dosimeters to be used, when they will 

51 be used, and how they will be processed and evaluated.
May 2014 4-12 NUREG-1520, Revision 2

1 e. Identify the plant’s administrative exposure levels or the levels at which actions 

2 are taken to investigate the cause of exposures exceeding these levels.

34

5 4. Design and implement a personnel monitoring program for internal occupational 

6 radiation exposures based on the requirements of 10 CFR 20.1201, “Occupational Dose 

7 Limits for Adults”; 10 CFR 20.1204, “Determination of Internal Exposure”; and 

8 10 CFR 20.1502(b) that outlines methods or procedures to do the following:

9

10 a. Identify the criteria for worker participation in the program.

11

12 b. Identify the type of sampling to be used, the frequency of collection and 

13 measurement, and the minimum detection levels.

14

15 c. Specify how worker intakes will be measured, assessed, and recorded.

16

17 d. Specify how the data will be processed, evaluated, and interpreted.

18

19 e. Identify the plant’s administrative exposure levels or the levels at which actions 

2021 are taken to investigate the cause of exposures exceeding these levels.

22

23 5. Design and implement an air-sampling program in areas of the plant identified as 

24 potential airborne-radioactivity areas to conduct airflow studies and to calibrate and 

25 maintain the airborne sampling equipment in accordance with the manufacturers’ 

26 recommendations.

27

28 6. Implement additional procedures, as may be required by 10 CFR Part 20 and the ISA 

29 summary, to control exposure to airborne radioactive material (e.g., control of access, 

30 limitation of exposure times to licensed materials, and use of respiratory protection 

31 equipment).

32

33 7. Conduct a contamination survey program in areas of the plant most likely to be 

34 radiologically contaminated; the program must include the types and frequencies of 

35 surveys for various areas of the plant and the action levels and actions to be taken when 

36 contamination levels are exceeded.

3738

39 8. Implement the facility’s corrective action program when the results of personnel 

40 contamination monitoring exceed the applicant’s administrative personnel contamination 

4142 levels.

43

44 9. Implement the facility’s corrective action program when any incident results in either 

45 unplanned occupational exposures exceeding the facility’s administrative limits or 

46 unplanned airborne contamination exceeding the applicable concentration in Appendix B 

47 to 10 CFR Part 20.for one week. Note that applicants utilizing soluble uranium may be 

48 more restricted by the soluble uranium intake limit in 10 CFR 20.1201(e) than the values 

49 in Appendix B to 10 CFR 20.

50

51 10. Use equipment and instrumentation with sufficient sensitivity for the type or types of 

52 radiation being measured and calibrate and maintain equipment and instrumentation in 

53 accordance with the manufacturers’ recommendations or applicable ANSI standards.

54
May 2014 4-13 NUREG-1520, Revision 2

1 11. Establish policies to ensure that equipment and materials removed from restricted areas 

2 to unrestricted areas are not contaminated above the release levels presented in 

3 Appendix A, “Acceptable Surface Contamination Levels,” to Regulatory Guide 8.24.

4

5 12. Leak-test all sealed sources consistent with direction provided in Appendix C, “Leak Test 

6 Requirements,” to Regulatory Guide 8.24 or the applicable regulations for the materials 

7 involved (e.g., 10 CFR 31.5(c)(2) has direction for leak testing of certain byproduct 

8 devices).

9

10 13. Establish and implement an access control program that ensures that (1) signs, labels, 

11 and other access controls are properly posted and operative, (2) restricted areas are 

12 established to prevent the spread of contamination and are identified with appropriate 

13 signs, and (3) step-off pads, change facilities, protective clothing facilities, and personnel 

14 monitoring instruments are provided in sufficient quantities and locations.

15

16 14. Establish a reporting program that is consistent with the requirements of 10 CFR Part 19 

17 and 10 CFR Part 20.

18

19 4.4.8 Control of Radiological Risk Resulting from Accidents

20

21 To be consistent with participation in the integrated review of the ISA summary performed in 

22 accordance with Chapter 3 of the SRP, the reviewer should examine, in detail, the radiological 

23 exposure and release accident sequences provided in the ISA summary to demonstrate 

24 compliance with 10 CFR 70.61, “Performance Requirements.” This review should focus on 

25 evaluation of sequences involving radiological releases or exposures with respect to the 

26 initiators and their frequency, radiological consequences, and IROFS chosen to prevent or 

27 mitigate those consequences.

28

29 The reviewer should also identify and note any items or issues that should be inspected during 

30 an operational readiness review, if such will be performed. These items may include confirming 

31 that engineered controls meet performance specifications described in the ISA summary and 

32 that administrative controls are implemented through procedures and operator training. These 

33 may also be addressed by reviewers involved with Chapter 11 of the SRP, “Management 

34 Measures.”

35

36 The reviewer should ensure that (a) the emergency plan, if one is required, adequately 

37 addresses the licensee response to a release of radioactive materials or (b) the licensee gives a 

38 proper justification that precludes the development of an emergency plan.

39

40 Finally, the reviewer should be aware that accident sequences considered “not unlikely” in the 

41 ISA summary are constricted, under the ALARA requirement in 10 CFR Part 20, to minimize 

42 exposure to personnel and the public.

43

44 4.4.8.1 Regulatory Requirements

45

46 The following NRC regulations apply to the control of radiological risk from accidents:

47

48 1. 10 CFR 70.22(i)(1) requires either an evaluation that the maximum dose to a member of 

49 the public resulting from a release of materials would not exceed 1 rem or 2 milligrams 

50 soluble uranium intake or the submission of an emergency plan for responding to the 

51 radiological hazards of a postulated accident.
May 2014 4-14 NUREG-1520, Revision 2

1 2. Subpart H, “Additional Requirements for Certain Licensees Authorized To Possess a 

2 Critical Mass of Special Nuclear Material,” of 10 CFR Part 70 contains requirements for 

3 performing ISAs, designating IROFS, and having management measures in place, both 

4 to ensure that IROFS are readily available and reliable and to provide facility change 

5 management and configuration control.

6

7 3. 10 CFR 20.1101 states that licensees shall apply procedures and engineering controls 

8 to achieve exposures to workers and the public that are ALARA.

9

10 4. 10 CFR 20.1406, “Minimization of Contamination,” states that licensees shall design and 

11 develop procedures for operation that will minimize contamination of the facility and the 

12 environment, facilitate eventual decommissioning, and minimize the generation of 

13 radioactive waste.

14

15 5. Subpart H of 10 CFR Part 20 discusses controls to restrict internal exposures.

16

17 4.4.8.2 Regulatory Guidance

18

19 The following guidance applies to the control of radiological risk resulting from accidents:

20

21 1. NUREG-1513, “Integrated Safety Analysis Guidance Document,” May 2001

22

23 2. NUREG/CR-6410, “Nuclear Fuel Cycle Accident Analysis Handbook,” March 1998

24

25 3. Chapter 3 of this SRP

26

27 4. Chapter 11 of this SRP

28

29 4.4.8.3 Acceptance Criteria

30

31 The reviewer should consider the factors listed below in determining the acceptability of the 

32 applicant’s descriptions of radiological exposure or release accident sequences. 

33

34 1. Accident sequences should be sufficiently described and detailed to allow an 

35 understanding of the radiological hazards (e.g., radioactive materials at risk) and the 

36 release mechanism.

37

38 2. The applicant should provide adequate descriptions of the radiological consequences 

39 (i.e., exposure estimates) for the credible high and intermediate consequence events 

40 identified in the ISA summary. The reviewer should verify that the exposure estimates 

41 are reasonable, based on the sequence description and the radioactive materials 

42 involved.

43

44 3. The applicant should justify the likelihood of the initiating event, its prevention, or 

45 mitigation of the results of an accident sequence with high or intermediate 

46 consequences, if credited in a questionable or nonconservative manner. If controls are 

47 relied on to reduce the likelihood or severity of a high- or intermediate-consequence 

48 accident sequence, they should be identified as IROFS (10 CFR 70.61).

49

50 4. Analyses that the applicant has performed as part of the ISA process should be 
May 2014 4-15 NUREG-1520, Revision 2

1 referenced or identified for potential further review (vertical slice) by the NRC staff 

2 (10 CFR 70.61).

3

4 5. The application should demonstrate the management measures proposed to ensure that 

5 IROFS are available and reliable, when required, by briefly describing both of the 

6 following:

7

8 a. procedures to ensure the reliable operation of engineered controls 

9 (e.g., inspection and testing procedures and frequencies, calibration programs, 

10 functional tests, corrective and preventive maintenance programs, and criteria for 

11 acceptable test results) (10 CFR 70.62(d))

12

13 b. procedures to ensure that administrative controls will be correctly implemented 

14 when required (e.g., employee training and qualification in operating procedures, 

15 refresher training, safe work practices, development of standard operating 

16 procedures, and training program evaluations) (10 CFR 70.62(d))

17

18 6. The application shall include either of the following:

19

20 a. an evaluation that demonstrates that public exposures resulting from offsite 

21 releases of material are less than 1 rem or 2 milligrams soluble uranium intake 

22 (10 CFR 70.22(i)(1)(i))

23

24 b. an emergency plan that includes sufficient detail for responding appropriately to 

25 an offsite release of radioactive materials (10 CFR 70.22(i)(1)(ii))

26

27 4.4.9 Additional Program Commitments

28

29 4.4.9.1 Regulatory Requirements

30

31 The following regulations are applicable to the additional program commitments:

32

33 1. Subpart L of 10 CFR Part 20

34

35 2. Subpart M of 10 CFR Part 20

36

37 3. 10 CFR 20.1906, “Procedures for Receiving and Opening Packages”

38

39 4. 10 CFR 20.2006, “Transfer for Disposal and Manifests”

40

41 5. 10 CFR 70.74, “Additional Reporting Requirements”

42

43 6. 10 CFR Part 71, “Packaging and Transportation of Radioactive Material”

44

45 7. 49 CFR, “Transportation”

46

47 4.4.9.2 Regulatory Guidance

48

49 1. NUREG-1660, “U.S.-Specific Schedules of Requirements for Transport of Specified 

50 Types of Radioactive Material Consignments,” January 1999
May 2014 4-16 NUREG-1520, Revision 2

1 2. Regulatory Guide 7.4, “Leak Tests on Packages for Shipment of Radioactive Materials,” 

2 Revision 1, March 2012

3

4 3. Regulatory Guide 7.7, “Administrative Guide for Verifying Compliance with Packaging 

5 Requirements for Shipping and Receiving of Radioactive Material,” Revision 1, 

6 March 2012

7

8 4. Regulatory Guide 7.10, “Establishing Quality Assurance Programs for Packaging Used 

9 in Transport of Radioactive Material,” Revision 2, March 2005

10

11 4.4.9.3 Acceptance Criteria

12

13 The applicant’s commitment to implement additional program features is acceptable if the 

14 license application provides data and information that meet each of the following commitments:

1516

17 1. Maintain records of the radiation protection program (including program provisions, 

18 audits, and reviews of the program content and implementation), radiation survey results 

19 (air sampling, bioassays, external exposure data from monitoring of individuals, internal 

20 intakes of radioactive material), results of corrective action program referrals, RWPs, 

21 and planned special exposures.

22

23 2. Establish a program to report to the NRC, within the timeframe stated in regulations, 

24 incidents specified in 10 CFR 20.2202, “Notification of Incidents,” and safety significant 

25 events specified in 10 CFR 70.74. Refer reportable incidents or events to the facility’s 

26 corrective action program and report to the NRC both the corrective action(s) taken (or 

27 planned) to protect against a recurrence and any proposed schedule to achieve 

28 compliance with applicable license conditions.

29

30 3. Prepare and submit to the NRC an annual report of the results of individual monitoring, 

31 as required by 10 CFR 20.2206(b). Establish a program that will assure shipment and 

32 receipt of radioactive materials consistent with regulations in 10 CFR 20, 10 CFR 71, 

33 49 CFR, and others, as applicable. This includes having (a) qualified personnel 

34 performing these operations, (b) procedures to implement the program and generate 

35 and maintain appropriate records, and (c) a supporting quality assurance function.

36

37 4.5 Review Procedures

38

39 4.5.1 Acceptance Review

40

41 During the acceptance review of a license application, the reviewer should examine the 

42 submittals to identify major deficiencies in the information provided for each area of review 

43 specified in SRP Section 4.3. Reviewers must decide whether they have enough information to 

44 proceed with a detailed review. Less significant errors or deficiencies that can be addressed in 

45 a request for additional information should be accepted. However, before the NRC performs a 

46 detailed review, the applicant should correct major deficiencies that would require several 

47 requests for additional information to resolve.

48

49 Reviewers should record whether each area of review is adequately addressed in the 

50 application, is adequately addressed in a referenced document, is not applicable to the 

51 application, or has a major deficiency.
May 2014 4-17 NUREG-1520, Revision 2

1 4.5.2 Safety Evaluation

2

3 The primary reviewer will perform a safety evaluation with respect to the acceptance criteria in 

4 Section 4.4. During the initial review, the reviewer should draft the safety evaluation report 

5 (SER) described below. A request for additional information (RAI) will be prepared when 

6 clarification and additional information are needed to determine whether the licensee’s 

7 submittals comply with the regulations. The primary reviewer should coordinate with the 

8 licensing project manager in preparing RAIs. For existing facilities, the reviewer will consult with 

9 the cognizant NRC inspector for radiation protection to identify and resolve any issues of 

10 concern related to the licensing review. Additional information submitted by the applicant will be 

11 evaluated and a final SER will be provided to the licensing project manager.

12

13 4.6 Evaluation Findings

14

15 The regulations in 10 CFR 70.23, “Requirements for the Approval of Applications,” and 

16 10 CFR 70.66, “Additional Requirements for Approval of License Application,” state that an 

17 application for a license will be approved if the Commission can make the general findings listed 

18 in those sections. The basis for the general findings is an evaluation of whether the application 

19 adequately addresses all of the applicable regulatory requirements. More specifically, the basis 

20 for the general findings is an evaluation of all the detailed regulatory requirements that apply to 

21 the application. The staff’s evaluation should determine whether the licensing submittals 

22 provide sufficient information to satisfy the regulatory requirements listed in Section 4.4 of this 

23 SRP and whether the applicant has appropriately addressed the regulatory acceptance criteria 

24 in satisfying the requirements also described in this SRP section. The reviewer will write an 

25 SER addressing each topic reviewed and explaining why the NRC staff has reasonable 

26 assurance that the radiation protection part of the application is acceptable and that the health 

27 and safety of the workers are adequately protected. The SER should state how the applicable 

28 regulatory requirements have been met based on the acceptance criteria described in this 

29 chapter of the SRP. If the applicant chooses to use an alternative approach, the reviewer 

30 should discuss in the SER whether the proposed approach satisfies the applicable regulatory 

31 requirements. The reviewers should use the following approach to document their evaluation:

32

33 1. State a specific regulatory requirement that applies to the application. Detailed 

34 acceptance criteria may be included where appropriate or necessary to clarify the 

35 requirement.

36

37 2. Identify the areas where the regulatory requirement is addressed in the application, 

38 including the areas where the specific acceptance criteria described in this SRP are 

39 addressed.

40

41 3. Describe your evaluation of the application, the basis for your conclusion, and whether it 

42 meets the regulatory requirement.

43

44 4. Repeat these steps for every regulatory requirement that applies to the application.

45

46 There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

47 application or amendment request, (2) denial of the application or request, or (3) approval with 

48 conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

49 reviewer may consider proposing a license condition. Absent an NRC order, license conditions 

50 must be agreed upon with the licensee or applicant before becoming part of the license. 

51 A license condition should only be proposed if there is reasonable assurance that, if the 
May 2014 4-18 NUREG-1520, Revision 2

1 licensee meets the condition, all regulatory requirements will be satisfied. Thus, license 

2 conditions should not be used to cover major deficiencies in an application. License conditions 

3 should be unambiguous, inspectable, and enforceable. They should only require those actions 

4 necessary to ensure compliance with applicable regulations. The basis for license conditions 

5 must be documented in the SER.

6

7 The applicant has committed to an acceptable radiation protection program that includes 

8 the following:

9

10 • an effective documented program to ensure that occupational radiological 

11 exposures are ALARA

12

13 • an organization with adequate qualification requirements for the radiation 

14 protection personnel

15

16 • approved written radiation protection procedures and RWPs for radiation 

17 protection activities

18

19 • radiation protection training for all personnel who have access to 

20 restricted areas

21

22 • a program to control airborne concentrations of radioactive material with 

23 engineering controls and respiratory protection

24

25 • a radiation survey and monitoring program that includes requirements for 

26 controlling radiological contamination within the facility and monitoring 

27 external and internal radiation exposures

28

29 • other programs to maintain records; report to the NRC in accordance with 

30 10 CFR Part 20 and 10 CFR Part 70; and appropriately respond to, 

31 investigate, and prevent incidents and accidents involving radiological 

32 exposures or uncontrolled releases of radioactive material

33

34 The NRC staff concludes that the applicant’s radiation protection program is adequate 

35 and meets the requirements of 10 CFR Part 19, 10 CFR Part 20, 10 CFR Part 70, and 

36 10 CFR Part 71. Conformance to the license application and license conditions will 

37 ensure safe operation.

38

39 The applicant has accurately evaluated, in the ISA summary, those accident sequences 

40 with intermediate and high radiological consequences. The applicant has also identified 

41 controls and management measures that reduce the likelihood or consequences of 

42 accident sequences and meet the performance criteria of 10 CFR 70.61.
May 2014 4-19 NUREG-1520, Revision 2

1 4.7 References

2

3 U.S. Code of Federal Regulations, Part 19, “Notices, Instructions and Reports to Workers: 

4 Inspection and Investigations,” Part 19, Chapter I, Title 10, “Energy.”

5

6 U.S. Code of Federal Regulations, “Standards for Protection Against Radiation,” Part 20, 

7 Chapter I, Title 10, “Energy.”

8

9 U.S. Code of Federal Regulations, “Domestic Licensing of Special Nuclear Material,” Part 70, 

10 Chapter I, Title 10, “Energy.”

11

12 U.S. Code of Federal Regulations, “Packaging and Transportation of Radioactive Material,”

13 Part 71, Chapter I, Title 10, “Energy.”

14

15 U.S. Code of Federal Regulations, Title 49, “Transportation.”

16

17 American Conference of Governmental Industrial Hygienists (ACGIH), “Industrial Ventilation: 

18 A Manual of Recommended Practice for Design,” ACGIH 2096, Cincinnati, OH, 2010.

19

20 ACGIH, “Industrial Ventilation: A Manual of Recommended Practice for Operation and 

21 Maintenance,” ACGIH 2106, Cincinnati, OH, 2007.

22

23 American Glovebox Society, “Guideline for Gloveboxes,” AGS-G001, Santa Rosa, CA, 2007.

24

25 American National Standards Institute (ANSI), “Sampling and Monitoring Releases of Airborne 

26 Radioactive Substances from the Stacks and Ducts of Nuclear Facilities,” ANSI N13.1-2011, 

27 Washington, DC, 2011.

28

29 ANSI, “Practice for Occupational Radiation Exposure Records Systems,” ANSI N13.6-2010,

30 Washington, DC, 2010.

31

32 ANSI, “Performance Criteria for Radiobioassay,” ANSI N13.30-2011, Washington, DC, 2011.

33

34 ANSI, “Design of Internal Dosimetry Programs,” ANSI N13.39-2001, Washington, DC, 2001.

35

36 ANSI, “Performance and Documentation of Radiological Surveys,” ANSI N13.49-2001, 

37 Washington, DC, 2001.

38

39 ANSI, “Radiation Protection Instrumentation Test and Calibration,” ANSI N323A-1997, 

40 Washington, DC, 1997.

41

42 ANSI, “Practices for Respiratory Protection,” ANSI Z88.2-1992, Washington, DC, 1992.

43

44 ANSI and the Health Physics Society, “Ionizing Radiation Safety Training for Workers,” 

45 ANSI/HPS N13.36, McLean, VA, October 30, 2001, reaffirmed July 19, 2011.

46

47 ASME (formerly the American Society of Mechanical Engineers), “Code on Nuclear Air and Gas 

48 Treatment,” ASME AG-1 and applicable addenda, New York, NY, 2009.
May 2014 4-20 NUREG-1520, Revision 2

1 ASTM International (formerly the American Society for Testing and Materials), “Radiological 

2 Protection Training for Nuclear Facility Workers,” ASTM E1168-95, West Conshohocken, PA, 

3 reapproved 2008.

4

5 Burchsted, C.A., A.B. Fuller, and J.E. Kahn, “Nuclear Air Cleaning Handbook,” Energy 

6 Research and Development Administration (ERDA) 76-21, Washington, DC, March 31, 1976.

7

8 National Council on Radiation Protection and Measurements, “Operational Radiation Safety 

9 Training,” NCRP Report No. 134, Bethesda, MD, October 2000.

10

11 U.S. Nuclear Regulatory Commission, “Air Sampling in the Workplace,” NUREG-1400, 

12 September 1993.

13

14 U.S. Nuclear Regulatory Commission, “Integrated Safety Analysis Guidance Document,” 

15 NUREG-1513, May 2001.

16

17 U.S. Nuclear Regulatory Commission, “U.S.-Specific Schedules of Requirements for Transport 

18 of Specified Types of Radioactive Material Consignments,” NUREG-1660, January 1999

19

20 U.S. Nuclear Regulatory Commission, “Nuclear Fuel Cycle Facility Accident Analysis 

21 Handbook,” NUREG/CR-6410, March 1998.

22

23 U.S. Nuclear Regulatory Commission, “Minimization of Contamination and Radioactive Waste 

24 Generation: Life Cycle Planning,” Regulatory Guide 4.21, June 2008.

25

26 U.S. Nuclear Regulatory Commission, “Leak Tests on Packages for Shipment of Radioactive 

27 Materials,” Regulatory Guide 7.4, Revision 1, March 2012.

28

29 U.S. Nuclear Regulatory Commission, “Administrative Guide for Verifying Compliance With 

30 Packaging Requirements for Shipping and Receiving of Radioactive Material,” Regulatory 

31 Guide 7.7, Revision 1, March 2012.

32

33 U.S. Nuclear Regulatory Commission, “Establishing Quality Assurance Programs for Packaging 

34 Used in Transport of Radioactive Material,” Regulatory Guide 7.10, Revision 2, March 2005.

35

36 U.S. Nuclear Regulatory Commission, “Administrative Practices in Radiation Surveys and 

37 Monitoring,” Regulatory Guide 8.2, May 2011.

38

39 U.S. Nuclear Regulatory Commission, “Personnel Monitoring Device--Direct-Reading Pocket 

40 Dosimeters,” Regulatory Guide 8.4, Revision 1, June 2011.

41

42 U.S. Nuclear Regulatory Commission, “Instructions for Recording and Reporting Occupational 

43 Radiation Exposure Data,” Regulatory Guide 8.7, Revision 2, November 2005.

44

45 U.S. Nuclear Regulatory Commission, “Acceptable Concepts, Models, Equations, and 

46 Assumptions for a Bioassay Program,” Regulatory Guide 8.9, Revision 1, July 1993.

47

48 U.S. Nuclear Regulatory Commission, “Operating Philosophy for Maintaining Occupational 

49 Radiation Exposures as Low as Is Reasonably Achievable,” Regulatory Guide 8.10, 

50 Revision 1-R, May 1977.
May 2014 4-21 NUREG-1520, Revision 2

1 U.S. Nuclear Regulatory Commission, “Instructions Concerning Prenatal Radiation Exposure,” 

2 Regulatory Guide 8.13, Revision 3, June 1999.

3

4 U.S. Nuclear Regulatory Commission, “Acceptable Programs for Respiratory Protection,” 

5 Regulatory Guide 8.15, Revision 1, October 1999.

6

7 U.S. Nuclear Regulatory Commission, “Health Physics Surveys During Enriched Uranium-235 

8 Processing and Fuel Fabrication,” Regulatory Guide 8.24, Revision 2, June 2012.

9

10 U.S. Nuclear Regulatory Commission, “Air Sampling in the Workplace,” Regulatory Guide 8.25, 

11 Revision 1, June 1992.

12

13 U.S. Nuclear Regulatory Commission, “Instructions Concerning Risks from Occupational 

14 Radiation Exposure,” Regulatory Guide 8.29, Revision 1, February 1996.

15

16 U.S. Nuclear Regulatory Commission, “Monitoring Criteria and Methods To Calculate 

17 Occupational Radiation Doses,” Regulatory Guide 8.34, July 1992.

18

19 U.S. Nuclear Regulatory Commission, “Methods for Measuring Effective Dose Equivalent from 

20 External Exposure,” Regulatory Guide 8.40, July 2010.

21
1
May 2014 5-1 NUREG-1520, Revision 2

5. NUCLEAR CRITICALITY SAFETY

1 5.1 Purpose of Review

2

3 The primary purpose of the review is to determine, with reasonable assurance, whether the 

4 applicant has designed a facility that will provide adequate protection against criticality hazards 

5 related to the storage, handling, and processing of licensed materials, as required by Title 10, 

6 “Energy,” of the Code of Federal Regulations (10 CFR) Part 70, “Domestic Licensing of Special 

7 Nuclear Material.” The facility design must adequately protect the health and safety of workers 

8 and the public from the risk of accidental criticality during both normal and credible abnormal 

conditions.1 9

10

11 To support this primary purpose, the review should also determine, with reasonable assurance, 

12 whether the licensee’s or applicant’s Nuclear Criticality Safety (NCS) Program is adequate to 

13 meet the regulatory requirements of 10 CFR Part 70 and to support the safe possession and 

14 use of special nuclear material (SNM) at the facility. The review should therefore examine the 

15 parts of the license application that describe the NCS Program. The review should also ensure 

16 that, if applicable, the requirements pertaining to performance of an Integrated Safety Analysis 

17 (ISA) (e.g., 10 CFR 70.61, “Performance Requirements”) are satisfied, and that the contents of 

18 the ISA summary required by 10 CFR 70.65, “Additional Content of Applications,” are adequate 

19 with regard to the evaluation of NCS-related hazards.

20

21 5.2 Responsibility for Review

22

23 Primary: NCS License Reviewer / Nuclear Process Engineer (Criticality)

24

25 Secondary: NCS Inspector / Nuclear Process Engineer (Criticality)

26 Other U.S. Nuclear Regulatory Commission (NRC) staff cognizant in NCS

27

28 5.3 Areas of Review

29

30 Regulations in 10 CFR 70.62(a) require the applicant to establish and maintain a safety program 

31 that will adequately protect worker and public health and safety and the environment and that 

32 demonstrates compliance with the performance requirements of 10 CFR 70.61. As specified in 

33 10 CFR 70.22(a)(8), licensees must describe, in their license application, procedures to protect 

34 health and minimize danger to life or property, including procedures to avoid accidental 

35 criticality. Applicants must also perform an ISA and submit an ISA summary that meets the 

36 requirements of 10 CFR 70.65.

37

38 A. For a new application or a license-renewal application, the specific areas of review are 

39 as follows:

40

1. The sections of the license application describing the licensee’s or applicant’s 2 41

42 license commitments with regard to the NCS Program. This includes 

 1 Throughout Chapter 5 of this SRP, the term “credible” as used in “credible abnormal conditions” in 

10 CFR 70.61(d) should be understood in the context of meeting the double-contingency principle. This is 

not necessarily quantitatively equivalent to “credible” as used in 10 CFR 70.61(b) and (c). See 

Appendix 5-A for more details. 2 Hereinafter referred to for simplicity as “the applicant,” except where it is clear the staff is referring solely to 

an existing licensee.
May 2014 5-2 NUREG-1520, Revision 2

1 identification of the organization and administration of the NCS Program, 

2 management measures, and methodologies and technical practices.

3

4 2. The sections of the ISA summary describing how the applicant meets the 

5 performance requirements for NCS hazards. This includes the applicant’s 

6 methodology for performing the ISA, as it is applied to NCS hazards, and the 

7 results of applying that methodology to analyzing NCS hazards and scenarios 

8 and demonstrating subcriticality under normal and credible abnormal conditions.

9

10 3. The sections of the license application and ISA summary describing the 

11 applicant’s criticality accident alarm system (CAAS) and emergency response 

12 measures for protecting workers and the public from the consequences of 

13 accidental criticality events.

14

15 4. The applicant’s quality assurance plan, emergency plan, and validation report, if 

16 applicable and to the extent that they have provisions related to NCS. These 

17 items support but are not part of the license application, and the reviewer should 

18 ensure that all necessary commitments have been included, either explicitly or by 

19 reference, in the license application.

20

21 5. ISA documentation, including the applicant’s process-hazard analyses, criticality 

safety evaluations (CSEs),

3 22 and calculations and other supporting technical 

23 documents, that demonstrate the adequacy of the applicant’s license 

24 commitments and demonstrate that the applicant meets the performance 

25 requirements of 10 CFR 70.61. These will generally be examined in a sampling 

26 review as part of an in-office or onsite vertical slice review.

27

28 B. For a license amendment, the specific areas of review are as follows:

29

30 1. Those portions of the license application affected by the change. The reviewer 

31 should ensure that the effectiveness of any license commitments is not reduced, 

32 or that the licensee has provided an adequate justification that there is still 

33 adequate protection against the risk of an accidental criticality.

34

35 2. Those portions of the ISA summary affected by the change. The reviewer should 

36 verify that any changed facility operations still comply with the performance 

37 requirements of 10 CFR 70.61. This includes examining any changes to process 

38 descriptions, new or changed assumptions, controlled parameters, safety limits, 

39 controls, or safety margin, as well as new or changed criticality accident 

40 sequences and items relied on for safety.

41

42 3. Any portions of the license application and ISA summary pertaining to the 

43 licensee’s CAAS and emergency response measures affected by the change. 

44 The reviewer should verify that the applicant still complies with the requirements 

45 of 10 CFR 70.24, “Criticality Accident Requirements.”

46

47 4. Any relevant portions of the quality assurance plan, emergency plan, or 

48 validation report affected by the change, if applicable. With regard to quality 

 3 The specific terms used in each applicant’s NCS Program will vary (NCS analyses, NCS evaluations, etc.). 

The term “CSE” is used generically in this chapter for formal and structured analyses performed to 

demonstrate subcriticality for a nuclear system. This may consist of a single document or multiple 

documents.
May 2014 5-3 NUREG-1520, Revision 2

1 assurance, the reviewer should verify that criticality controls have appropriate 

2 management measures applied. With regard to the emergency plan, the 

3 reviewer should verify that it appropriately protects personnel from the 

4 consequences of a criticality accident. With regard to validation, the reviewer 

5 should verify that calculations pertaining to changed operations are still within the 

6 licensee’s validated area of applicability, or that the area of applicability has been 

7 appropriately extended, and that the licensee’s margin of subcriticality for safety 

8 remains valid.

9

10 5. Justification for the change, including revised criticality safety basis documents 

11 (process hazard analyses, CSEs, calculations, and other supporting technical 

12 documents) that are needed to demonstrate adequate protection against the risk 

13 of accidental criticality.

14

15 Review Interfaces

16

17 The criticality reviewer should examine information in the following other areas to determine 

18 whether it is consistent with Chapter 5 of the application. The listed standard review plan (SRP)

19 sections interface with this section as follows:

20

21 • Review facility and process descriptions applied to criticality safety under SRP 

22 Chapter 1.

23

24 • Review the organization structure and qualifications and responsibilities of key personnel 

25 under SRP Chapter 2.

26

27 • Review ISA methodology for applicability to criticality hazards under SRP Chapter 3.

28

29 • Review the emergency plan as applied to criticality safety under SRP Chapter 8.

30

31 • Review management measures applied to criticality-related items relied on for safety 

32 (IROFS) under SRP Chapter 11.

33

34 The specific acceptance criteria and review procedures are contained in the referenced SRP 

35 sections.

36

37 5.4 Acceptance Criteria

38

39 The applicant should provide NCS commitments and describe how the commitments will be 

40 implemented. Commitments and descriptions are expected when the acceptance criteria are 

41 relevant to the safety of special nuclear material.

42

43 5.4.1 Regulatory Requirements

44

45 Acceptance criteria are based on meeting the relevant requirements of the following regulations:

46

47 1. The general and additional contents that an application must contain are stated in 

48 10 CFR 70.22, “Contents of Applications,” and 70.65. General information that must be 

49 included in the license application is described in 10 CFR 70.22. Information that must 

50 be included in the ISA summary is described in 10 CFR 70.65.

51 2. The requirements for approval of the application are stated in 10 CFR 70.23, 

52 “Requirements for the Approval of Applications,” and 70.66, “Additional Requirements for 

53 New Facilities or New Processes at Existing Facilities.”
May 2014 5-4 NUREG-1520, Revision 2

1

2 3. The requirements for a CAAS and emergency response procedures are stated in 

345 10 CFR 70.24.

6

7 4. The requirements for demonstrating adequate protection against the risk of a nuclear 

8 criticality accident are stated in 10 CFR 70.61.

9

10 5. The requirements for establishing and maintaining a safety program are stated in 

11 10 CFR 70.62, “Safety Program and Integrated Safety Analysis.”

12

13 6. The requirements for new facilities or new processes at existing facilities requiring a 

14 license amendment under 10 CFR 70.72, “Reports of Accidental Criticality,” are stated in 

15 10 CFR 70.64, “Requirements for New Facilities or New Processes at Existing 

16 Facilities,” and include adherence to the double-contingency principle.

17

18 7. The requirements to report certain conditions affecting the safety of licensed material are 

19 in 10 CFR 70.50, “Reporting Requirements,” and Appendix A, “Reportable Safety 

20 Events,” to 10 CFR Part 70.

21

22 5.4.2 Regulatory Guidance

23

24 The following additional guidance may be used to supplement the review of the NCS Program:

25

26 1. NUREG-1513, “Integrated Safety Analysis Guidance Document,” May 2001

27

28 2. NUREG/CR-6410, “Nuclear Fuel Cycle Facility Accident Analysis Handbook,” 

29 March 1998

30

31 3. NUREG/CR-6698, “Guide for Validation of Nuclear Criticality Safety Calculational 

32 Methodology,” January 2001

33

34 4. NRC Regulatory Guide (RG) 3.71, “Nuclear Criticality Safety Standards for Fuels and 

35 Material Facilities,” December 2010

36

37 5.4.3 Regulatory Acceptance Criteria

38

39 Specific criteria acceptable to meet the relevant requirements of the NRC’s regulations identified 

40 above are as follows for each review described in subsection 5.4 of this SRP section.

41 The SRP is not a substitute for the NRC’s regulations, and compliance with it is not required. 

42 The SRP provides one acceptable method for demonstrating compliance with the regulatory 

43 requirements for obtaining a materials license for a fuel cycle facility, though it might not apply in 

44 every case. An applicant that does not meet applicable guidance in this SRP should describe 

45 and justify an acceptable alternative to meet the regulations. The reviewer should consider the 

46 applicant’s commitments in a given area to be acceptable if the applicant has met the following 

47 acceptance criteria or has identified and justified an acceptable alternative approach.

48

49 5.4.3.1 License Application

50

51 The reviewer should examine the applicant’s license commitments regarding the organization 

52 and administration of its NCS Program.

53

54 5.4.3.1.1 Use of Industry Standards

55
May 2014 5-5 NUREG-1520, Revision 2

1 RG 3.71, “Nuclear Criticality Safety Standards for Fuels and Material Facilities,” endorses 

2 American National Standards Institute (ANSI)/American Nuclear Society (ANS)-8 national 

3 standards, with some exceptions and qualifications. The NRC endorsement of these standards 

4 means that they provide methods and practices generally acceptable to the NRC staff for the 

5 prevention and mitigation of criticality accidents. However, application of a standard is not a 

6 substitute for detailed NCS analyses for specific operations.

7

8 If the applicant is requesting to conduct activities to which an NRC-endorsed standard applies, 

9 the reviewer should verify that the applicant addresses the subjects covered by the standard by 

10 satisfying the following acceptance criteria:

11

12 (1) The license application contains a commitment to follow the requirements (i.e., “shall” 

13 statements) of the standard, subject to any exceptions and qualifications taken by the 

14 NRC. The application clearly specifies the version of the standard and the specific parts 

15 of the standard to which the applicant is committing.

16

17 (2) If there are parts of the industry standard to which the applicant does not commit, the 

18 applicant provides sufficient information for the staff to determine that the parts of the 

19 standard are not applicable to the applicant’s activities or that the license application 

20 contains other commitments that achieve an equivalent safety purpose.

21

22 The applicant may also choose to demonstrate compliance with regulatory requirements by 

23 committing to follow the recommendations (i.e., “should” statements) of a standard, though 

24 committing to the recommendations is not required for compliance with a standard.

25

26 The applicant should clarify its intent in committing to requirements expressed only as general 

27 principles in the standards by more specific commitments and descriptions of how those 

28 principles will be implemented in its license application. Applicants should generally use the 

29 most current revision of the standards that have been endorsed by the NRC in the version of 

30 RG 3.71 in effect when the license application is submitted. If the applicant commits to a 

31 standard or a version of a standard that the NRC has not endorsed or is not the most current 

32 endorsed version, or commits to unendorsed portions of an otherwise endorsed standard, the 

33 license application should contain justification for the acceptability of these commitments. The 

34 use of standards other than ANS standards (e.g., International Organization for Standardization 

35 (ISO) 1709, “Nuclear Energy—Fissile Materials—Principles of Criticality Safety in Storing, 

36 Handling and Processing,” or ISO 7753, “Nuclear Energy—Performance and Testing 

37 Requirements for Criticality Detection and Alarm Systems”) may be acceptable if suitably 

38 justified.

39

40 RG 3.71 endorses the following ANSI/ANS-8 national standards in full, as of the date of 

41 publication of this SRP:

42

43 − ANSI/ANS-8.5-1996 (reaffirmed in 2007), “Use of Borosilicate-Glass Raschig Rings as a 

44 Neutron Absorber in Solutions of Fissile Material”

45

46 − ANSI/ANS-8.6-1983 (reaffirmed in 2010), “Safety in Conducting Subcritical 

47 Neutron-Multiplication Measurements In Situ”

48

49 − ANSI/ANS-8.7-1998 (reaffirmed in 2007), “Nuclear Criticality Safety in the Storage of 

50 Fissile Materials”

51 − ANSI/ANS-8.10-1983 (reaffirmed in 2005), “Criteria for Nuclear Criticality Safety Controls 

52 in Operations with Shielding and Confinement”

53
May 2014 5-6 NUREG-1520, Revision 2

1 − ANSI/ANS-8.12-1987 (reaffirmed in 2002), “Nuclear Criticality Control and Safety of 

2 Plutonium-Uranium Fuel Mixtures Outside Reactors”

3

4 − ANSI/ANS-8.14-2004, “Use of Soluble Neutron Absorbers in Nuclear Facilities Outside 

5 Reactors”

6

7 − ANSI/ANS-8.15-1981 (reaffirmed in 2005), “Nuclear Criticality Control of Special Actinide 

8 Elements”

9

10 − ANSI/ANS-8.19-2005, “Administrative Practices for Nuclear Criticality Safety”

11

12 − ANSI/ANS-8.20-1991 (reaffirmed in 2005), “Nuclear Criticality Safety Training”

13

14 − ANSI/ANS-8.21-1995 (reaffirmed in 2001), “Use of Fixed Neutron Absorbers in Nuclear 

15 Facilities Outside Reactors”

16

17 − ANSI/ANS-8.22-1997 (reaffirmed in 2006), “Nuclear Criticality Safety Based on Limiting 

18 and Controlling Moderators”

19

20 − ANSI/ANS-8.23-2007, “Nuclear Criticality Accident Emergency Planning and Response”

21

22 − ANSI/ANS-8.26-2007, “Criticality Safety Engineer Training and Qualification Program”

23

24 − RG 3.71 currently endorses the following ANSI/ANS-8 national standards in part:

25

26 − ANSI/ANS-8.1-1998 (reaffirmed in 2007), “Nuclear Criticality Safety in Operations with 

27 Fissionable Material Outside Reactors”

28

29 − ANSI/ANS-8.3-1997 (reaffirmed in 2003), “Criticality Accident Alarm System”

30

31 − ANSI/ANS-8.17-2004 (reaffirmed in 2009), “Criticality Safety Criteria for the Handling, 

32 Storage, and Transportation of LWR [Light-Water Reactor] Fuel Outside Reactors”

33

34 − ANSI/ANS-8.24-2007, “Validation of Neutron Transport Methods for Nuclear Criticality 

35 Safety Calculations”

36

37 The reviewer should consult the version of RG 3.71 in effect at the time the license application 

38 is submitted and determine whether newer versions of these standards or new standards have 

39 been endorsed, and should make note of any exceptions of qualifications.

40

41 5.4.3.1.2 Criticality Accident Alarm System (CAAS)

42

43 The reviewer should consider that the applicant’s commitment to meet the CAAS requirements 

44 in 10 CFR 70.24 is acceptable if the applicant or licensee has met the following acceptance 

45 criteria or has identified and justified an alternative in the application:

46

47 1. The applicant describes a facility CAAS that meets the requirements of 10 CFR 70.24.

48 2. The applicant commits to the current endorsed version of ANSI/ANS-8.3, with 

49 exceptions as noted in RG 3.71, or to an acceptable alternative (e.g., ISO 7753) with 

50 justification:

51
May 2014 5-7 NUREG-1520, Revision 2

1 a. For licensees authorized to possess quantities greater than the 10 CFR 70.24 

2 mass limits (e.g., special nuclear material containing more than 700 grams of 235 3 U), there shall be CAAS coverage in all areas in which such quantities of 

4 special nuclear material are handled, used, or stored (to be consistent with 

5 ANSI/ANS-8.3 as endorsed by RG 3.71). Controls are established to preclude 

6 such SNM from areas where coverage is not provided.

7

8 b. Each monitored area must be covered by two criticality detectors.

9

10 c. The monitoring system must be capable of detecting a nuclear criticality that 

11 produces an absorbed dose in soft tissue of 20 rads of combined neutron and 

12 gamma radiation at an unshielded distance of 2 meters from the material within 

13 1 minute.

14

15 With regard to commitments to follow specific industry practices described in ANSI/ANS-8.3, 

16 the applicant should provide additional details as follows:

17

18 1. The applicant describes a CAAS appropriate to the facility for the type of radiation 

19 detected, intervening shielding, and magnitude of the minimum accident of concern.

20

21 The applicant’s description of its CAAS should include the type of radiation detector and 

22 alarm; the detection threshold and minimum accident of concern; the detector logic used 

23 to provide dual alarm coverage, minimize false alarms, and detect failure; method used 

24 to determine radius of coverage; placement of alarms; and actions for maintaining and 

25 calibrating the system.

26

27 2. The applicant commits to designing a CAAS to be resistant to damage from anticipated 

28 adverse events such as a fire, explosion, corrosive atmosphere, seismic shock 

29 equivalent to the site-specific design-basis earthquake or equivalent value specified by 

30 the Uniform Building Code, or other adverse conditions that do not result in evacuation 

31 of the entire facility.

32

33 3. The applicant commits to rendering operations safe, by shutdown and quarantine if 

34 necessary, in any area where CAAS coverage has been lost and not restored within a 

35 specified number of hours. The number of hours may be determined on a 

36 process-by-process basis, because shutting down certain processes, even to make 

37 them safe, may carry a larger risk than being without a CAAS for a short time. The 

38 applicant should commit to compensatory measures (e.g., limiting access, halting 

39 movement of SNM) when the CAAS is not functional.

40

41 5.4.3.1.3 Emergency Planning and Response

42

43 The reviewer should consider the applicant’s commitments to emergency planning and 

44 response acceptable if the applicant has met the following acceptance criteria or has justified 

45 acceptable alternatives (see Chapter 8 of this SRP):

46

47 1. The applicant commits to the ANSI/ANS-8.23 standard.

48 2. The applicant has an emergency plan or satisfies the alternative requirements in 

49 10 CFR 70.22(i)(1)(i).

50

51 3. The applicant commits to fixed or personnel accident dosimeters in areas that require a 

52 CAAS. These dosimeters should be readily available to personnel responding to an 

53 emergency, and there should be a method for prompt onsite dosimeter readout.
May 2014 5-8 NUREG-1520, Revision 2

1

2 4. The applicant commits to providing emergency power for the CAAS or provides 

3 justification for the use of continuous monitoring with portable instruments.

4

5 5.4.3.1.4 Subcriticality and Double-Contingency Principle

6

7 The reviewer should consider the applicant’s commitments to demonstrating that all nuclear 

8 processes will be subcritical under normal and credible abnormal conditions to be acceptable if 

9 the applicant has met the following acceptance criteria or has justified acceptable alternatives:

10

11 1. The applicant commits to one of the following methods for determining subcritical limits 

12 on controlled parameters under normal conditions, or subcritical values under abnormal 

13 conditions:

14

15 a. The applicant commits to use the subcritical values in a currently endorsed 

16 standard (e.g., ANSI/ANS-8.1, -8.5, -8.7, -8.12, or -8.15) or ANSI/ANS-8.9, 

17 “Nuclear Criticality Safety Guide for Pipe Intersections Containing Aqueous 

18 Solutions of Enriched Uranyl Nitrate” (withdrawn as an active standard).

19

20 b. The applicant commits to use the subcritical or critical values, with appropriate 

21 margin, from widely accepted industry handbooks (e.g., Los Alamos National 

Laboratory’s LA-10860-MS, “Critical Dimensions of Systems Containing 235 22 U, 

239Pu, and 233 23 U,” or Atlantic Richfield Hanford Company’s ARH-600, “Criticality 

24 Handbook”), experimental data, or peer-reviewed publications. The specific 

25 sources used should be referenced by name in the license application.

26

27 c. The applicant commits to use industry-accepted hand-calculation methods 

28 (e.g., areal density, solid angle technique, etc.), subject to the limitations of those 

29 methods.

30

31 d. The applicant commits to use deterministic or probabilistic (e.g., discrete 

32 ordinates or Monte Carlo) computer codes to calculate the effective multiplication 

factor keff 33 . These calculational methods should be validated in accordance with 

34 the ANSI/ANS-8.24 standard.

35

36 2. For each method used to demonstrate subcriticality, the applicant commits to use the 

37 method consistent with any limitations, with an appropriate margin of subcriticality and 

38 within its area of applicability. The margin of subcriticality and area of applicability are to 

39 be described in the license application.

40

41 3. The applicant commits to determine safety limits based on one of the methods listed in 

42 paragraph (1) above. The applicant commits to evaluate controlled parameters at their 

43 safety limits (or more conservatively) and to evaluate parameters that are not controlled 

44 at their most reactive credible values.

45 4. The applicant describes a program that complies with the double contingency principle, 

46 where practicable. This principle is defined in 10 CFR 70.4, “Definitions” (and is stated 

47 in ANSI/ANS-8.1), as follows:

48

49 Process designs should incorporate sufficient factors of safety to require at least 

50 two unlikely, independent, and concurrent changes in process conditions before 

51 a criticality accident is possible.

52
May 2014 5-9 NUREG-1520, Revision 2

1 Each process that has accident sequences leading to criticality should have sufficient 

2 engineered and administrative controls in place to ensure double-contingency protection 

3 during normal operations. If double-contingency protection is lost through the failure of 

4 one or more of these controls, the process should be halted until the controls can be 

5 reestablished. This necessitates a program that incorporates prompt detection and 

6 correction of such contingencies. The term “concurrent” means that the effect of the first 

7 process change persists when the second change occurs. It does not mean that the two 

8 events must occur simultaneously. The likelihood of criticality can be markedly reduced 

9 if control failures are promptly detected and processes are promptly rendered safe.

10

11 The term “process conditions” encompasses the full spectrum of factors that can affect 

12 criticality safety, not just the set of controlled parameters. “Process condition” is not 

13 synonymous with “controlled parameter.” Thus, double contingency protection may be 

14 provided by either (1) control of two independent parameters, or (2) control of a single 

15 process parameter, such that at least two independent failures or events involving the 

16 parameter would have to happen before a criticality accident is possible. The first 

17 method, reliance on two different parameters, is preferred because of the inherent 

18 difficulty in preventing common-mode failures when controlling only one parameter.

19

20 The reviewer should note that double contingency does not necessarily mean that two 

21 controls are required. In some cases, it may be appropriate to credit the natural and 

22 credible course of events (e.g., unsintered powder cannot exceed a maximum 

theoretical density; there is no means of enriching beyond 5 wt% 235 23 U; or reliance on the 

24 low historical likelihood of flooding) without needing to establish explicit controls. Where 

25 there is no credible accident sequence leading to criticality, the double-contingency 

26 principle is met by definition. The reviewer should exercise judgment in determining 

27 whether the applicant has established sufficient measures to ensure that occurrence of 

28 the contingencies is “unlikely.”

29

30 In rare instances, double-contingency protection will not be practicable. The applicant 

31 should identify any such cases in the license application and should provide justification 

32 as to why the affected processes are acceptably safe. The justification should 

33 demonstrate that the risk is sufficiently low that an exception to the general principle is 

34 warranted. The reviewer should note that the double-contingency principle is a 

35 recommendation in ANSI/ANS-8.1 and should recall that earlier statements of the 

36 principle treated it as a general design principle, rather than expecting that it had to be 

37 met in every case (“Process designs should, in general, incorporate sufficient factors of 

38 safety....”). The more important requirement is the subcriticality requirement 

39 incorporated in 10 CFR 70.61(d) (“all nuclear processes are subcritical” under both 

40 “normal and credible abnormal conditions”). Thus, as long as the applicant meets this 

41 10 CFR 70.61(d) provision, an exception to following the double-contingency principle 

42 may be justified if the criticality risk is shown to be sufficiently low.

43

44 Additional guidance pertaining to compliance with the double-contingency principle is 

45 given in Appendix 5-A to this SRP.

46 5.4.3.1.5 Organization and Administration of the NCS Program

47

48 The reviewer should consider the applicant’s management of the NCS program acceptable if 

49 the applicant has met the following acceptance criteria or has identified and justified an 

50 alternative approach:

51

52 1. The applicant describes and commits to implement and maintain an NCS Program to 

53 meet the applicable 10 CFR Part 70 requirements, and to ensure adequate protection 
May 2014 5-10 NUREG-1520, Revision 2

1 against the consequences of accidental criticality events. The primary means of doing 

2 this should be prevention (i.e., ensuring that processes will be subcritical under normal 

3 and credible abnormal conditions).

4

5 2. The applicant describes the NCS Program’s objectives (which should include the 

6 following) and how the applicant will meet those objectives.

7

8 a. Performing and documenting criticality safety evaluations (CSEs) for new or 

9 changed processes and establishing safety limits and controls as necessary to 

10 ensure that processes will remain subcritical under normal and credible abnormal 

11 conditions

12

13 b. Establishing, as practicable, double-contingency protection and defense-in-depth 

14 measures; ensuring sufficient margins of safety and subcriticality to provide 

15 additional assurance that the likelihood of criticality will be acceptably low

16

17 c. Establishing and maintaining a CAAS system and emergency-response 

18 procedures to protect health and safety in the event criticality occurs

19 

20 d. Providing technical support to emergency response personnel in responding to 

21 and recovering from abnormal conditions and emergencies up to and including a 

22 criticality accident

23

24 e. Verifying the adequacy of criticality controls through audits and assessments, 

25 including observation of operations and verification of equipment configuration

26

27 f. Ensuring the adequacy of CSEs through peer reviews, self-assessments, and 

28 validation and verification of calculational methods

29

30 g. Training and otherwise supporting operations in procedures to ensure the safe 

31 handling of special nuclear material

32

33 h. Supporting regulatory compliance with regard to event reporting (10 CFR 70.50 

34 and Appendix A to 10 CFR 70), complying with the facility change process 

35 (10 CFR 70.72), and participating in the performance and documentation of the 

36 facility’s ISA (10 CFR 70.61 through 70.66) insofar as they pertain to criticality 

37 safety.

38

39 3. The applicant outlines an NCS Program structure that is consistent with current industry 

40 practices (e.g., ANSI/ANS-8.1 and ANSI/ANS-8.19), including establishing the roles and 

41 responsibilities of key Program personnel (e.g., NCS Manager, NCS Senior Engineers, 

42 and NCS Engineers). While the specific titles and functions of personnel may vary from 

43 one applicant to another, specific positions should have responsibility for implementing 

44 Program objectives, including designation of an NCS Program Manager who has overall 

45 responsibility for implementing the NCS Program.

46 4. The applicant describes the training and qualification of key NCS Program personnel. 

47 Experience and education levels should be specified commensurate with personnel 

48 responsibilities. Training and qualification should be consistent with ANSI/ANS-8.26 as 

49 specified in RG 3.71.

50

51 5. The applicant commits to establish and maintain NCS safety limits and operating limits, 

52 and commits to maintain management measures to ensure their continued reliability and 

53 availability. 
May 2014 5-11 NUREG-1520, Revision 2

1

2 6. The applicant commits to support operations personnel through development of training, 

3 preparation of NCS postings and other appropriate operator aids for key administrative 

4 controls (e.g., painted lines on the floor and warning lights), and review of procedures 

5 and operations to ensure they are unambiguous, easily understood, and readily 

6 achievable.

7

8 7. The applicant commits to developing postings and other markings, and criticality alarm 

9 signals that are distinctive to all facility personnel.

10

11 8. The applicant commits to evaluating modifications to the facility or safety program to 

12 ascertain their impact on criticality safety.

13

14 9. The applicant should describe a corporate structure in which the NCS Organization is 

15 independent of operations to the extent practical.

16

17 10. The applicant commits to requiring personnel to perform activities in accordance with 

18 written, approved procedures when the activity could affect NCS. If existing procedures 

19 do not cover a specific situation, personnel should be trained to take no action until NCS 

20 staff has evaluated the situation and provided recovery instructions.

21

22 11. The applicant commits to requiring its personnel to report defective NCS conditions to 

23 operations supervision and NCS Program staff. The applicant establishes management 

24 policies that reinforce operators’ stop-work authority and encourage the reporting of 

25 defective conditions.

26

27 5.4.3.1.6 Management Measures Applied to the NCS Program

28

29 The reviewer should consider the applicant’s commitments to its management measures for 

30 NCS acceptable if the applicant has met the following acceptance criteria or has identified and 

31 justified acceptable alternatives:

32

33 The applicant commits to following industry practices described in ANSI/ANS-8.19 and 

34 ANSI/ANS-8.20 as they pertain to training, procedures, and audits and assessments.

35

36 1. In addition, with regard to training:

37

38 a. The applicant commits to train personnel in the areas discussed in Section 7 of 

39 ANSI/ANS-8.20.

40

41 b. The applicant commits to train personnel with regard to procedural compliance, 

42 stop-work authority, response to alarms, and reporting of defective conditions.

43 2. In addition, with regard to audits and assessments:

44

45 a. The applicant commits to conducting and documenting walkthroughs (i.e., the 

46 observation of operations to verify compliance with criticality limits) of all 

47 operating SNM process areas, such that all areas will be reviewed at some 

48 specified frequency. The reviewer should consider the complexity of the 

49 process, the degree of process monitoring, and the degree of reliance on 

50 administrative controls in determining the appropriate frequency. Those 

51 operations that are no longer operating should also be reviewed at some reduced 

52 frequency to ensure that they remain in a safe condition.
May 2014 5-12 NUREG-1520, Revision 2

1

2 b. The applicant commits to conducting and documenting periodic NCS audits 

3 (i.e., the independent review of NCS Program work products, such as CSEs, 

4 change packages, calculations, and walkthroughs) at least once every 2 years. 

5 This should be done by staff independent of those who had performed the 

6 functions themselves, either internal or external to the NCS Organization.

7

8 c. Weaknesses identified through facility walkthroughs or program audits should be 

9 referred to the facility’s corrective-action program, which has the responsibility for 

10 promptly and effectively resolving them. A graded approach may be used to 

11 justify an alternate schedule for performing walkthroughs or audits or for taking 

12 corrective action.

13

14 5.4.3.1.7 Technical Practices for NCS

15

16 Acceptance criteria applicable to the applicant’s technical practices are as follows:

17

18 In evaluating the applicant’s technical practices, the reviewer should not only ensure that the 

19 applicant has made the necessary commitments, but should also independently review a 

20 sampling of the applicant’s analyses to confirm the adequacy of its commitments.

21

22 1. The applicant commits to perform CSEs using industry-accepted and peer-reviewed 

23 methods (e.g., in ANSI/ANS-8.1, -8.19, -8.24).

24

25 2. The applicant commits to validate calculational methods used to develop NCS safety 

26 limits, in accordance with ANSI/ANS-8.24.

27

28 3. The applicant commits to demonstrating an adequate margin of subcriticality for safety, 

29 that the staff will approve in accordance with 10 CFR 70.61(d), by ensuring that the 

margin is large compared to the uncertainty in the calculated value of keff 30 .

31

32 The minimum margin of subcriticality is an allowance for unknown or unquantified 

33 uncertainties that have not been accounted for in the validation, and is a measure of the 

34 degree of confidence that systems calculated to be subcritical are actually subcritical. 

35 The minimum margin of subcriticality may be used to define a maximum allowable value 

of keff 36 that is considered subcritical, referred to as the Upper Subcritical Limit, as follows:

37

38 Δkcalc ≤ 1 – β – Δβ – ΔkAOA – Δkm

39

40 where β = the calculational bias, Δβ = the uncertainty in the bias, ΔkAOA = the margin 

41 resulting from extending the area of applicability beyond the experimental data, and 

42 Δkm = the minimum margin of subcriticality.

43 The reviewer should use judgment in assessing whether the applicant’s overall margin of 

44 subcriticality, which includes the minimum margin of subcriticality and other factors that 

provide conservatism in the calculation of keff 45 , is sufficient to provide reasonable 

46 assurance that processes evaluated to be subcritical are actually subcritical. Additional 

47 guidance on the margin of subcriticality is provided in Appendix 5-B to this SRP.

48

49 4. The applicant commits to use the code within its validated area(s) of applicability, or, if 

50 there are insufficient benchmark experiments over the needed range of variables, that 

51 the area of applicability is extended by making use of trends in the bias, taking the 

52 uncertainty due to extrapolation appropriately into account.

53
May 2014 5-13 NUREG-1520, Revision 2

1 5.4.3.1.7.1 Calculational Method Validation

2

3 The applicant should include a summary description of a documented, reviewed, and approved 

4 (by the applicant’s NCS Function and management) validation report for each methodology that 

5 will be used to perform an NCS analysis. For methods such as experimental data, handbooks, 

6 industry standards, and hand calculations, the validation may consist of a demonstration of each 

7 method’s applicability to the applicant’s processes, including specification of any limitations or 

8 assumptions needed to ensure its validity. For methods that rely on the explicit calculation of 

keff 9 , the validation should evaluate critical benchmark experiments similar in geometry, material 

10 composition, and neutron energy spectrum to the systems to be evaluated.

11

12 For computer calculation methods, the reviewer should examine the applicant’s criticality code 

13 validation to determine whether it provides for reasonable assurance that processes evaluated 

14 to be subcritical are actually subcritical. The review should consist of a review of the applicant’s 

15 selection of benchmark experiments, statistical methodology, and results (determination of the 

16 area(s) of applicability and Upper Subcritical Limit). The methods used should be consistent 

17 with the nature of the data (e.g., quantity and distribution of benchmark experiments, normality, 

18 presence or absence of any trends, and need for extrapolation or interpolation).

19

20 Acceptance criteria applicable to the applicant’s summary description of its computer-code 

21 validation are as follows:

22

23 A. The applicant’s summary description of its validation should include:

24

25 1. A description of the methodology that is sufficiently detailed and clear that it may 

26 be independently reproduced, including the method used to select benchmark 

27 experiments, determine the bias and bias uncertainty, and determine the Upper 

28 Subcritical Limit.

29

30 2. A summary of the physical systems and area(s) of applicability covered by the 

31 validation report. It is not necessary to include the full range of numerical 

32 parameters that defines an area of applicability; a general description 

33 (e.g., “low-enriched homogeneous uranyl fluoride solutions”, “low-enriched fuel 

34 pellets”, or “rods containing gadolinia”) is sufficient.

35

36 3. A description of the methods used to justify extending the area(s) of applicability 

37 beyond the range of parameters covered by the benchmark experiments.

38

39 4. A description of the benchmark experiments used. It is not necessary to include 

40 all benchmark experiments used; a brief description of the individual benchmark 

41 sets is sufficient.

42 5. A description of the margin of subcriticality for safety and justification of its 

43 adequacy. This should include a statement of the minimum margin of 

44 subcriticality and any other factors that provide reasonable assurance of 

45 subcriticality.

46

47 6. A description of the controlled software and hardware used. It is not necessary 

48 to include specific operating systems, hardware platforms, and individual 

49 workstations, though this information should be specified in the validation report 

50 itself. A general description of the computer code, release version, cross-section 

51 libraries, and type of computer hardware is sufficient.

52
May 2014 5-14 NUREG-1520, Revision 2

1 7. A description of any limitations on use of the method (e.g., code options (such as 

2 biasing and use of albedos) or convergence criteria) necessary for validity of the 

3 method.

4

5 B. Acceptance criteria applicable to the applicant’s commitments with regard to its 

6 computer-code validation are as follows:

7

8 1. The applicant’s summary description is consistent with the ANSI/ANS-8.24 

9 standard, with exceptions and qualifications as stated in RG 3.71, or follows 

10 widely accepted industry practices with the application of an appropriate margin 

11 to account for any shortcomings (e.g., scarcity of the data, lack of normality, or 

12 extension beyond the range of benchmark experiments). This requires that the 

13 NCS reviewer remain aware of current practices in validation.

14

15 2. The applicant commits to incorporating each validation report into its 

16 configuration-management program.

17

18 3. The applicant commits to and describes its verification process, including 

19 verification upon installation, in response to changes to the calculational system,

20 and at specified periods.

21

22 4. The applicant commits to assessing the applicability of its computer-code 

23 validation for each nuclear system to be evaluated and to documenting its 

24 assessment in CSEs.

25

26 The above criteria strictly apply only to methods that explicitly calculate keff (deterministic and 

27 probabilistic computer codes). For other methods used to demonstrate subcriticality, the 

28 reviewer should use judgment in determining which of the aforementioned criteria are applicable 

29 to the particular method.

30

31 5.4.3.1.7.2 Criticality Safety Evaluations (CSEs)

32

33 The reviewer should consider the applicant’s commitments with regard to performing CSEs 

34 acceptable if the applicant has met the following acceptance criteria or identified and justified 

35 acceptable alternatives:

36

37 1. The applicant commits to performing CSEs in accordance with documented and 

38 approved administrative procedures, which incorporate the following principles:

39

40 a. NCS safety limits will be established based on analyses assuming optimum or 

41 the most reactive credible values of parameters (e.g., the most reactive 

42 conditions physically possible or bounding values limited by regulatory 

43 requirements) unless specified controls are implemented to limit parameters to a 

44 particular range of values. If less than the optimum values are used, and 

45 corresponding controls are not identified, the basis will be justified in the CSE.

46

47 b. NCS operating limits will be established to ensure that safety limits are unlikely to 

48 be exceeded. In determining operating limits, process variability and uncertainty 

49 should be considered. Additional conservatism may be applied.

50

51 c. The specific controls and management measures necessary to enforce NCS 

52 safety limits and operating limits will be specified.

53
May 2014 5-15 NUREG-1520, Revision 2

1 2. The applicant commits to providing the technical basis that demonstrates 

2 (a) subcriticality under normal and credible abnormal conditions and (b) compliance with 

3 the double-contingency principle in the CSEs.

4

5 3. The applicant commits to incorporating each CSE into its configuration-management 

6 program and its system of ISA documentation.

7

8 5.4.3.1.7.3 Evaluation and Implementation of Controlled Parameters

9

10 Parameters available for NCS control are as follows: mass, geometry, density, enrichment (or 

11 isotopics), reflection, moderation, concentration, interaction (or spacing), neutron absorption (or 

12 poison), volume, heterogeneity, physicochemical form, and process variables. The number and 

13 names of specific parameters will vary from one applicant to another.

14

15 The reviewer should consider the applicant’s commitments to technical practices associated 

16 with evaluating and implementing controlled parameters acceptable if the applicant has met the 

17 following acceptance criteria or identified and justified acceptable alternatives:

18

19 1. The applicant states that the use of a single NCS control to maintain the values of two or 

20 more controlled parameters constitutes only one component necessary to meet the 

21 double-contingency principle.

22

23 2. The applicant commits to the following preferred hierarchy of controls:

24

25 a. The applicant commits to the preferred use of passive engineered controls; in 

26 particular, passive engineered geometry control.

27

28 b. The applicant commits to the following order of preference for NCS control: 

29 (1) passive engineered, (2) active engineered, (3) enhanced administrative, and 

30 (4) simple administrative controls.

31

32 c. The applicant commits to preference for designating explicit NCS controls over 

33 reliance on the natural and credible course of events.

34

35 d. The applicant commits to preference for control of two or more parameters over 

36 multiple controls on a single parameter. If relying on two or more controls on a 

37 single parameter, the applicant commits to preference for diverse over redundant 

38 means of control.

39

40 These commitments do not mean that the applicant will follow the preferred hierarchy of 

41 controls in every case. The reviewer should examine the applicant’s sets of controls to 

42 determine whether it is following this preference in the majority of cases. In general, for 

43 example, where passive controls are readily available, they should be used rather than 

44 administrative controls. It is up to the applicant to demonstrate how it is meeting these 

45 commitments (for example, by providing justification when deviating from these criteria).

46

47 3. The use of each controlled parameter should be considered acceptable if the following 

48 general criteria, in addition to the specific criteria for individual parameters listed below, 

49 are met:

50

51 a. When a single-parameter limit is used (e.g., minimum critical mass, favorable 

52 geometry limit, or always-safe concentration), all other parameters are evaluated 

53 at their optimum or most reactive credible values. In determining 
May 2014 5-16 NUREG-1520, Revision 2

1 single-parameter limits, it is permissible to specify a particular physicochemical 

2 form and isotopic composition.

3

4 Examples: (1) minimum critical mass is based on spherical geometry, optimum 

5 moderation, and full water reflection; (2) favorable geometry is based on having 

6 equipment filled with optimally moderated material and full water reflection.

7

8 b. When process variables can affect the normal or most reactive credible values of 

9 parameters, controls to maintain them within specified ranges are established.

10

11 c. When measurement of a parameter is needed, instrumentation subject to facility 

12 management measures is used.

13

14 d. When criticality control is based on measuring a single parameter, independent 

15 means of measurement (e.g., redundant in-line monitoring or dual independent 

16 sampling) are used.

17

18 e. Safety limits on controlled parameters are established, taking any tolerances and 

19 uncertainty into account.

20

21 4. Acceptance criteria for the use of mass as a controlled parameter are as follows:

22

23 a. When mass limits are derived for a material that is modeled assuming a given 

24 weight percent of SNM, compliance with the mass limit is verified by either 

25 (1) weighing the material and ascribing the entire mass to SNM or (2) conducting 

26 physical measurements to establish the actual weight percent of SNM in the 

27 material.

28

29 b. When the dimensions of equipment or containers with a fixed geometry are used 

30 to limit the mass of SNM, a conservative process density is used to calculate the 

31 resulting mass.

32

33 c. When overbatching of SNM is credible, the largest mass resulting from a single 

34 failure is shown to be subcritical. Overbatching beyond double batching should 

35 be considered unless it requires multiple independent failures or is precluded by 

36 equipment capacity, availability of material, or other considerations.

37

38 5. Acceptance criteria for the use of geometry as a controlled parameter are as follows:

39

40 a. Before beginning operations, in response to changes to operations, and at 

41 periodic intervals, all dimensions relied on in demonstrating subcriticality are 

42 verified. Relevant dimensions and material properties are maintained in the 

43 facility’s configuration-management program.

44 b. Means of losing geometry control (e.g., corrosion, leakage, bulging, transfer to 

45 unfavorable geometry, changes to a more reactive physicochemical form) are 

46 evaluated and controls established as needed if they are credible.

47

48 c. Neutron interaction with other SNM-bearing equipment is considered as part of 

49 the demonstration of subcriticality, unless individual units meet the criteria for 

50 being considered neutronically isolated. This includes the introduction of any 

51 portable SNM-bearing containers.

52
May 2014 5-17 NUREG-1520, Revision 2

1 6. The use of density as a controlled parameter should be considered acceptable if the 

2 general criteria for controlled parameters described above are met.

3

7. Enrichment refers to the weight percent of 235 4 U in uranium. For mixtures involving other 

5 fissile nuclides, isotopics (or isotopic abundance) may refer to the weight percent of the 

fissile nuclides (e.g., 239Pu and 241 6 Pu weight percent in plutonium) and to the relative 

7 ratio of different elements in the mixture (e.g., weight percent of plutonium to the total 

8 mass of SNM). While the term enrichment is used below for simplicity, the reviewer 

9 should recognize that the criteria below can apply to more general types of SNM.

10

11 Acceptance criteria for the use of enrichment as a controlled parameter are as follows:

12

13 a. Either a method of segregating enrichments is used to ensure that differing 

14 enrichments will not be interchanged, or the most limiting enrichment is applied 

15 to all material. Use of the plant-wide maximum authorized enrichment may be 

16 relied on without the need to specify explicit enrichment controls in every CSE.

17

18 Given that mixtures of differing enrichments are indistinguishable by sight and 

19 have the same chemical properties, material of differing enrichments should be 

20 segregated in different parts of the facility or should be conspicuously marked 

21 with distinctive labels.

22

23 8. Reflection is recognized as a particularly difficult parameter to control, and is therefore 

24 one of the least-preferred methods of criticality control. The reviewer should exercise 

25 extra caution in reviewing any instances relying on reflection control.

26

27 Acceptance criteria for the use of reflection as a controlled parameter are as follows:

28

29 a. In determining subcritical limits for an individual unit, the wall thickness and all 

30 adjacent reflecting materials are considered in setting up the criticality model. 

31 Any such materials should be conservatively bounded by the modeled reflection 

32 conditions.

33

34 b. Criteria are established for determining when materials are sufficiently far away 

35 to be neglected in the criticality model. For example, in most cases materials 

36 more than 30 cm (12 inches) away may be neglected. (Care should be taken 

37 when analyzing large slabs and arrays.)

38

39 c. When reflection is not controlled, full reflection may be represented by 30 cm 

40 (12 inches) of tight-fitting water or 60 cm (24 inches) of tight-fitting concrete. In 

41 the presence of special moderators such as deuterium, beryllium, or graphite, or 

42 if large amounts of hydrogen-rich materials (e.g., hydrocarbon oil or polyethylene, 

43 etc.) are present, it should be demonstrated that the modeled reflection 

44 conditions remain bounding.

45 d. Minimum reflection conditions equivalent to a 1-inch tight-fitting water reflector

46 are assumed to account for personnel and other transient incidental reflectors not 

47 explicitly included with fixed reflectors in the model. (A 1-inch tight-fitting water 

48 reflector is generally considered sufficient to bound any amount of reflecting 

49 material more than 30 cm (12 inches) from the surface of the unit.)

50

51 e. When less than full reflection conditions are assumed in calculations, controls to 

52 limit reflection around individual units are established, preferably by means of 

53 rigid barriers.
May 2014 5-18 NUREG-1520, Revision 2

1

2 f. In evaluating subcriticality for an array of units, the maximum amount of water 

3 between units may not be the most reactive condition. Reflection should be 

4 modeled on the exterior of the array consistent with the acceptance criteria in 

5 paragraphs (8)(a) through (8)(e) above, and interstitial moderation should be 

6 considered in accordance with the criteria in paragraph (9) below.

7

8 9. Acceptance criteria for the use of moderation as a controlled parameter are as follows:

9

10 a. The applicant commits to meeting the ANSI/ANS-8.22 standard.

11

12 b. As a first preference, physical structures are designed to preclude the ingress of 

13 moderators.

14

15 c. Moderation-controlled areas may be used to exclude moderators from whole 

16 areas. Engineered means (e.g., double roof, double-sleeved pipes, exclusion of 

17 sprinklers, raised/sloped floors) are the primary means of excluding moderators 

18 from such areas. After evaluation of all credible sources of moderator intrusion 

19 into such areas, the areas are conspicuously marked and administrative controls 

20 are established to prevent the introduction of moderators.

21

22 d. Firefighting procedures for use in moderation-controlled areas are evaluated in 

23 CSEs. Restrictions on the use of moderating firefighting agents are included in 

24 procedures and training. The effects of a fire and activation of fire suppression 

25 are evaluated.

26

27 10. Concentration is recognized as one of the least-preferred methods of criticality control. 

28 The reviewer should exercise extra caution in reviewing any instances relying on 

29 concentration control.

30

31 Acceptance criteria for the use of concentration as a controlled parameter are as follows:

32

33 a. Controls are established to limit concentration of SNM unless the process has 

34 been demonstrated to be subcritical at optimum concentration.

35

36 b. When using a tank containing concentration-controlled solution, the tank is kept 

37 closed and locked to prevent unauthorized introduction of precipitating agents.

38

39 c. Precautions are taken to preclude the inadvertent introduction of precipitating 

40 agents.

41

42 d. Transfers to unfavorable geometry tanks containing concentration-controlled 

43 solutions will only be authorized based on dual independent sampling and/or 

44 in-line monitoring. No single error may result in transfer of concentrated solution 

45 to a tank with unfavorable geometry.

46

47 e. Process variables that can affect the solubility of fissile solutions are controlled 

48 and monitored. The need to ensure homogeneity of the solution is assessed in 

49 CSEs.

50

51 11. Interaction must often be controlled when relying on geometry and volume control. 

52 Acceptance criteria for the use of interaction as a controlled parameter are as follows:

53
May 2014 5-19 NUREG-1520, Revision 2

1 a. To maintain physical separation between units, engineered controls are used. If 

2 engineered controls are not feasible, administrative controls with visual aids such 

3 as painted lines and postings may be used. However, multiple procedural errors 

4 should not by themselves lead to criticality.

5

6 b. The structural integrity of spacers, storage racks, etc. is sufficient to ensure 

7 subcriticality under normal and credible abnormal conditions, including seismic 

8 events.

9

10 c. Engineered devices that are moveable (e.g., birdcage drums, 55-gallon drums) 

11 are inspected periodically for deformation.

12

13 12. Neutron absorbers are often controlled in conjunction with geometry and interaction 

14 control. Fixed neutron absorbers are recognized as among the most-preferred methods 

15 of criticality control, while soluble neutron absorbers are recognized as one of the 

16 least-preferred methods. The reviewer should therefore exercise extra caution in 

17 reviewing any instances relying on soluble absorber control.

18

19 Acceptance criteria for the use of neutron absorption as a controlled parameter are as 

20 follows:

21

22 a. The preferred method of absorber control is fixed neutron absorbers. When 

23 using fixed absorbers, the applicant commits to meeting the ANSI/ANS-8.21 

24 standard.

25

26 Whether the applicant is relying on fixed neutron absorbers does not depend on 

27 whether the absorbing materials are part of the existing structure or are added 

28 specifically for criticality control. If the material properties of the absorber must 

29 be included in the model to reduce the value of keff below the Upper Subcritical 

30 Limit (for normal or credible abnormal conditions), the material is relied on as a 

31 neutron absorber. If the material can be modeled as a void region, so that only 

32 the dimensions are needed to ensure subcriticality, it is being relied on only as a 

33 geometry control.

34

35 b. When using borosilicate glass raschig rings, the applicant commits to meet the 

36 ANSI/ANS-8.5 standard.

37

38 c. When using soluble neutron absorbers, the applicant commits to meeting the 

39 ANSI/ANS-8.14 standard.

40

41 d. In evaluating absorber effectiveness, the effect of neutron spectra on the 

42 absorption cross-section is considered (e.g., cadmium is an effective absorber for 

43 thermal neutrons but ineffective for fast neutrons).

44 13. When the total volume of a unit is limited to ensure subcriticality, irrespective of its 

45 shape, this constitutes volume control. When the specific dimensions are limited, this 

46 constitutes geometry control. Occasionally geometry and volume are lumped together 

47 as a single means of control. This is acceptable because the same acceptance criteria 

48 apply to both.

49

50 Acceptance criteria for the use of volume as a controlled parameter are as follows:

51

52 a. Fixed geometry is used to restrict the volume of SNM. The preferred method is 

53 limiting equipment and containers to less than a subcritical volume. Limiting 
May 2014 5-20 NUREG-1520, Revision 2

1 material to part of a larger geometry (e.g., by active level probes or use of 

2 overflow holes) may also be used.

3

4 b. The maximum subcritical volume is evaluated assuming the most reactive 

5 credible geometry, optimum moderation, and full water reflection. Normally, 

6 spherical geometry will be the most reactive (though this could depend on the 

7 specific boundary conditions to be applied).

8

9 14. Controlling the small-scale structure of fissile materials is particularly important at lower 

enrichments (below approximately 10 wt% 235 10 U). While normally referred to as 

11 heterogeneity control, generally the concern is maintaining homogeneity because the 

12 homogeneous case is usually less reactive.

13

14 Acceptance criteria for the use of heterogeneity as a controlled parameter are as 

15 follows:

16

17 a. Methods of causing a fissile material to become inhomogeneous are evaluated in 

18 CSEs and controls established as necessary (e.g., temperature and acidity on a 

19 solution, active stirring and blending of solutions or powders, or milling of 

20 powders or scrap). If heterogeneity is considered credible, its effect should be 

21 evaluated in criticality calculations. These calculations should be validated using 

22 critical benchmarks that display heterogeneous effects, to ensure that any bias 

23 due to resonance self-shielding is taken into account.

24

25 b. Assumptions that can affect the physical scale of heterogeneity are based on 

26 observed physical characteristics of the material; process variables that can 

27 affect the scale of heterogeneity are controlled.

28

29 15. Subcritical limits on other controlled parameters are normally derived for a particular 

30 fissile material composition by assuming a bounding physicochemical form and isotopic 

31 abundance. Physicochemical form consists of controlling the physical state (i.e., solid, 

32 liquid, or gas) and form (e.g., solution, powder, green or sintered pellets, or metal) and/or 

33 chemical composition (e.g., uranium hexafluoride, uranyl fluoride, plutonium nitrate, or 

34 mixed oxide) of a particular fissile material. The physicochemical form could indirectly 

35 affect other parameters, such as density, moderation, and neutron absorption.

36

37 Acceptance criteria for the use of physicochemical form as a controlled parameter are 

38 as follows:

39

40 a. Either the most reactive credible physicochemical form in the facility is assumed 

41 in criticality calculations or explicit controls are established to limit the material 

42 composition to a particular form. Passive controls (e.g., filters and pellet 

43 diameter gauges), active controls (e.g., temperature and pressure gauges and 

44 mass flow totalizers), and administrative controls (e.g., titration and limitations on 

45 addition of chemical reagents) may be used.

46

47 b. Both in-situ changes in physicochemical form and the migration of material 

48 between process areas are considered in evaluating credible abnormal 

49 conditions.

50

51 c. Process variables that can change the fissile material to a more reactive 

52 physicochemical form are identified as controls in CSEs.

53
May 2014 5-21 NUREG-1520, Revision 2

1 16. Process variables include those physical characteristics of a process that are relied on to 

2 control other parameters (e.g., furnace temperature to limit moderation, pressure to 

3 maintain physicochemical form of UF6, and acidity to maintain homogeneity) or to 

4 monitor them (e.g., electrical load to monitor viscosity, conductivity to detect moderators, 

5 the mechanical force of a pellet press to limit density, and radiation readings to detect 

6 solution transfers).

7

8 Acceptance criteria for the use of process variables for criticality control are as follows:

9

10 a. Process variables relied on to control or monitor other controlled parameters are 

11 identified as controls in CSEs; sufficient management measures are applied to 

12 ensure that the associated controlled parameter safety limit is not exceeded.

13

14 b. The associated controlled parameter is explicitly identified and the correlation of 

15 process variables to the associated parameter is established by experiment or 

16 plant-specific measurements.

17

18 5.4.3.1.8 Additional NCS Program Commitments

19

20 Acceptance criteria applicable to the applicant’s description of additional commitments in its 

21 NCS Program are as follows:

22

23 1. The applicant commits to assess the adequacy of engineered and administrative 

24 criticality controls as part of its facility audits and inspections, to promptly detect any 

25 NCS deficiencies, and to refer those deficiencies to the facility’s corrective-action 

26 program in order to prevent recurrence.

27

28 2. The applicant commits to suspend operations or otherwise render processes safe upon 

29 loss of double contingency protection, until such protection can be restored, and to 

30 assess the adequacy of the affected controls.

31

32 3. The applicant commits to retaining records of NCS deficiencies and documenting any 

33 corrective actions taken.

34

35 4. The applicant commits to identifying all equipment and procedures needed for criticality 

36 controls to perform their safety function (i.e., to ensure their effectiveness in keeping 

37 controlled parameters within subcritical limits), and to maintaining such equipment and 

38 procedures as part of its facility management measures, including audits and 

39 inspections.

40

41 5. Acceptance criteria applicable to the applicant’s description of measures to implement its 

42 facility change process (in compliance with 10 CFR 70.72) are as follows:

43 a. The applicant describes a change-control process that is sufficient to ensure that 

44 the safety basis of the facility will be maintained during the facility’s lifetime. The 

45 change process is documented in written procedures that specify that all 

46 changes to nuclear processes are evaluated by the NCS Organization to 

47 determine the impact on NCS, including analytic assumptions, the effectiveness 

48 of NCS controls, and the NCS of any connected processes.

49

50 b. The applicant commits to supporting the facility’s change process by evaluating 

51 whether changes are covered by existing CSEs and, if not, to performing CSEs 

52 to determine any necessary changes to processes, procedures, criticality 

53 controls, and management measures.
May 2014 5-22 NUREG-1520, Revision 2

1

2 c. The change-control process is integrated with its configuration-management 

3 system to ensure that any changes to the NCS basis are incorporated in 

4 procedures, postings, drawings, and other facility safety documentation as 

5 appropriate, as well as the ISA summary.

6

7 6. Acceptance criteria applicable to the applicant’s description of measures to implement 

8 the event reporting requirements in 10 CFR Part 70, Appendix A, “Reportable Safety 

9 Events,” are as follows:

10

11 a. The applicant’s overall event-reporting commitments are consistent with 

12 Appendix A, and:

13

14 b. The applicant’s NCS Program has a process in place for rapidly evaluating the 

15 NCS significance of events, including immediate availability of cognizant NCS 

16 staff. The evaluation of safety significance includes assessment of the event for 

17 the loss or degradation of double contingency protection. 

18

19 c. The applicant’s process for assessing NCS events is integrated with the overall 

20 apparatus for making the required notification to the NRC Operations Center, 

21 which is incorporated in the facility’s emergency procedures.

22

23 d. The applicant commits to evaluating the significance and reportability of events 

24 based on whether the controls were lost or degraded (i.e., whether they were 

25 unreliable or unavailable to perform their safety functions), not based on whether 

26 the safety limits of the associated parameters were actually exceeded.

27

28 e. The applicant commits to treating the event as a one-hour report if it cannot 

29 ascertain within one hour whether the criteria of paragraph (a) or (b) of 

30 Appendix A to Part 70 apply.

31

32 5.4.3.2 ISA and ISA Summary Review

33

34 The reviewer should examine the applicant’s ISA documentation as it pertains to the evaluation 

35 of NCS hazards. The overall review of the applicant’s ISA process is covered in Chapter 3 of 

36 this SRP. The NCS reviewer’s examination of the NCS-related aspects of the applicant’s ISA 

37 comprises three parts: (1) review of the applicant’s ISA methodology to assess its applicability 

38 to analyzing criticality hazards, (2) review of the applicant’s onsite ISA documentation related to 

39 criticality hazards as part of its onsite vertical slice review, and (3) review of the applicant’s 

40 discussion of criticality hazards, scenarios, and controls in its ISA summary. The purpose and 

41 scope of each of these aspects as it relates to NCS is discussed in the following sections.

42 The relation of the license-application review to the ISA review is that reasonable assurance of 

43 safety depends primarily on the adequacy of the applicant’s commitments to its NCS Program, 

44 because the licensee is ultimately responsible for the safe operation of its facility. The reviewer 

45 therefore performs a detailed and comprehensive review of the applicant’s commitments with 

46 regard to its NCS Program. The ISA review provides an additional demonstration of safety by 

47 assessing whether the applicant’s NCS Program has provided adequate protection against the 

48 consequences of an accidental criticality. This review consists of a risk-informed sampling of 

49 scenarios and controls to confirm the adequacy of the applicant’s implementation of its NCS 

50 Program.

51

52
May 2014 5-23 NUREG-1520, Revision 2

1 5.4.3.2.1 ISA Methodology

2

3 The reviewer should examine the applicant’s ISA methodology commitments, as described in 

4 the license application, to determine whether the methodology is being properly applied to the 

5 analysis of criticality hazards. Acceptance criteria applicable to the applicant’s application of its 

6 ISA methodology to criticality hazards are as follows:

7

8 1. Criticality is considered a high-consequence event for the purpose of complying with the 

performance requirements of 10 CFR 70.61.4 9 If criticality is considered less than a 

10 high-consequence event, the features relied on to mitigate the dose are identified as 

11 items relied on for safety. Only those mitigative controls capable of protecting against 

12 the immediate burst of radiation may be credited in this fashion, and their failure should 

13 be considered in the ISA.

14

15 If the applicant chooses to comply with the performance requirements by demonstrating 

16 subcriticality under normal and credible abnormal conditions (as discussed in 

17 Appendix 5-A of this SRP), the consequences of criticality do not need to be so 

18 characterized.

19

20 2. Nuclear processes are demonstrated to be subcritical under both normal and credible 

21 abnormal conditions. Subcriticality is based on the establishment of preventive controls 

22 that limit parameters to within specified ranges of values.

23

24 3. Protection against the consequences of an accidental criticality event is based on 

25 preventive controls, regardless of whether or not criticality is treated as a 

26 high-consequence event.

27

28 4. Subcriticality is based on methods that specify an acceptable margin of subcriticality for 

safety. For methods that rely on the explicit calculation of keff 29 , this includes a minimum 

30 margin of subcriticality and any conservative assumptions, as discussed in Appendix 5-B 

31 of this SRP.

32

33 5. Controls on controlled parameters that are relied on to demonstrate subcriticality under 

34 normal and credible abnormal conditions, and/or to demonstrate that the risk of criticality 

35 is sufficiently low, are designated as items relied on for safety.

36

37 6. The applicant provides for double-contingency protection in the selection of criticality 

38 controls, including designation of items relied on for safety.

39 5.4.3.2.2 ISA Documentation

40

41 The reviewer should examine the applicant’s onsite ISA documentation as part of its onsite 

42 vertical slice review. The onsite ISA documentation includes the safety-basis documentation 

43 used to perform the ISA and develop the ISA summary. This includes the applicant’s CSEs, 

44 calculations, process-hazard analyses, and supporting technical documents, as well as any 

45 underlying process safety information (e.g., piping and instrumentation diagrams, drawings, 

46 procedures, and specifications). The purpose of this review is to confirm, on a sampling basis, 

47 whether the applicant’s establishment and maintenance of criticality controls is adequate to 

48 protect against the consequences of an accidental criticality.

 4 This is for the purpose of meeting the performance requirements only. For determining 

emergency-response procedures, a conservative estimate of the consequences of criticality, as discussed in 

Section 5.4.3.3 of this SRP, should be used.
May 2014 5-24 NUREG-1520, Revision 2

1

2 The ISA documentation is maintained onsite for an existing facility. For an applicant seeking to 

3 license a new facility, the full level of detail concerning hardware, procedures, and programs 

4 necessary to safely operate the facility usually would not exist at the time the ISA summary is 

5 submitted. The reviewer should use judgment in determining whether there is a sufficient level 

6 of detail to make a finding of a reasonable assurance of safety. It is expected that all aspects of 

7 the facility and process design that are safety-significant would be available for inspection 

8 before operation. The reviewer may therefore identify aspects of the design that are incomplete 

9 but have bearing on the “reasonable assurance” finding as items to be followed up on during 

10 any preoperational readiness review that may occur. (See discussion of license conditions in 

11 Section 5.6, “Evaluation Findings.”)

12

13 The reviewer should use a risk-informed method to select nuclear processes and scenarios for 

14 the vertical slice review. Those areas containing high masses or concentrations of fissile 

15 material, high enrichment or fissile isotope abundance, or highly moderated materials 

16 (e.g., solutions) are normally considered areas of higher risk. Scenarios involving failures that 

17 have occurred either in criticality accidents or significant fuel facility events and those involving 

18 failures mainly of administrative controls, especially redundant controls on a single parameter 

19 (e.g., sampling before solution transfer to unfavorable geometry), are normally considered of 

20 higher risk. The reviewer should select the higher-risk scenarios from these areas for a detailed 

21 review. The reviewer should also select some lower-risk processes and scenarios to obtain a 

22 diversity of process parameters, failure mechanisms, and control strategies to thoroughly test 

23 the ISA methodology. Consideration should be given to the type and number of controls; 

24 complexity of the controls; the applicant’s familiarity with the processes, technology, and 

25 controls; whether the controls are redundant or diverse; the safety margin between normal 

26 operations and where criticality is possible; etc., in selecting scenarios for review.

27

28 The above pertains to the site-wide ISA reviewed for a new license. For a license amendment, 

29 the processes selected are limited to those affected by the amendment, and the reviewer should 

30 select those scenarios most likely to lead to accidental criticality, using criteria such as those in 

31 the previous paragraph.

32

33 Once the processes and scenarios are selected for review, the reviewer should determine, on a 

34 sampling basis, whether the applicant’s controls are adequate to ensure that processes will be 

35 subcritical under normal and credible abnormal conditions and whether the applicant has 

36 provided for double contingency protection or identified and justified an acceptable alternative. 

37 This entails determining whether the relevant scenarios have been identified based on the 

38 process design, and whether controls are appropriately flowed into procedures, configuration 

39 management, and facility management measures. Evaluating the adequacy of controls may 

40 involve reviewing the applicant’s criticality calculations and technical reports; it may also entail 

41 the reviewer performing independent criticality calculations to confirm the applicant’s results. 

42 The reviewer may wish to consider such confirmatory analyses when the validity of those results 

43 is in doubt or when the sensitivity of those results to various parameters could have an impact 

44 on NCS. To the extent practical, the reviewer should use calculational methods different from 

45 those employed by the applicant to minimize the impact of any errors in the data or methods. 

46 Confirmatory analyses may not be feasible during a vertical slice review for a site-wide ISA, but 

47 the reviewer should perform at least some simplified bounding calculations to support a license 

48 amendment that involves a change to controlled parameters or safety limits. It is expected that 

49 amendment requests of this nature include the submittal of applicable CSEs and calculations as 

50 part of their technical basis.

51

52 Lastly, the reviewer should determine whether the applicant’s criticality analysis for the selected 

53 scenarios is appropriately integrated into its ISA process. Acceptance criteria applicable to the 

54 applicant’s treatment of selected NCS scenarios in its ISA are as follows:
May 2014 5-25 NUREG-1520, Revision 2

1

2 1. The ISA Team includes facility personnel knowledgeable and experienced in NCS.

3

4 2. The CSEs, calculations, and other supporting technical information are maintained as 

5 part of the applicant’s ISA documentation by including them in the facility’s configuration 

6 management program and ISA program procedures.

7

8 3. Controls relied on to demonstrate subcriticality under normal or credible abnormal 

9 conditions and/or to demonstrate that the risk of individual criticality scenarios is 

10 sufficiently low are identified as IROFS.

11

12 4. Management measures are established to ensure that the occurrence of a contingency 

13 is “unlikely” as used in the context of the double-contingency principle. Management 

14 measures may be graded commensurate with an item’s importance to safety.

15

16 Management measures should be appropriate to the type, required reliability, and 

17 required availability of items relied on for safety. They include:

18

19 a. Procedures to ensure the reliable operation of engineered controls 

20 (e.g., surveillance and functional testing procedures and frequencies, calibration 

21 programs, and corrective and preventive maintenance programs)

22

23 b. Procedures to ensure that administrative controls will be correctly implemented 

24 (e.g., employee training and qualification in operating procedures, including 

25 refresher training; safe work practices; operating procedures; and postings)

26

27 c. Configuration management, audits and assessments, incident investigation, 

28 corrective actions, records management, and other quality-assurance elements 

29 (see Sections 11.3.1 through 11.3.8 of this SRP)

30

31 d. Management of records pertaining to the correct operation of the NCS Program; 

32 for example, training and qualification of NCS management and staff, NCS 

33 Program audits, document control of NCS safety-basis documents (including 

34 independent review of documents), maintenance of the CAAS, and tracking and 

35 resolution of NCS deficiencies

36

37 5.4.3.2.3 ISA Summary

38

39 The reviewer should examine the applicant’s ISA summary to determine whether it meets the 

40 10 CFR 70.65(b) requirements. The purpose of the review is to determine whether the 

41 applicant has complied with the applicable requirements specified in 10 CFR 70.66 for granting 

42 a license. This section of the SRP covers review of the NCS aspects of the ISA summary; 

43 detailed guidance for the balance of the review is found in Chapter 3 of this SRP.

44

45 Acceptance criteria applicable to the applicant’s documentation of the criticality hazards in its 

46 ISA summary are as follows:

47

48 1. The ISA summary contains descriptions of the site, facility, and processes with respect 

49 to criticality safety. This may include process-flow diagrams, major process steps, and 

50 major pieces of equipment, with an emphasis on aspects of facility operations that affect 

51 criticality safety. The process description should be sufficiently simple to allow the staff 

52 an understanding of how the process works and what factors are important for criticality 

53 safety.

54
May 2014 5-26 NUREG-1520, Revision 2

1 2. The ISA summary identifies the criticality safety basis for nuclear processes in sufficient 

2 detail to permit the reviewer to independently make a finding of reasonable assurance of 

3 safety. This includes a description of criticality-significant aspects of the process, the 

4 parameters controlled to prevent criticality, the engineered and administrative controls 

5 used to control them, their safety limits, and management measures.

6

7 3. The ISA summary demonstrates compliance with the performance requirements of 

8 10 CFR 70.61, either by (1) demonstrating that nuclear processes will be subcritical 

9 under normal and credible abnormal conditions, or (2) demonstrating that the risk of

10 individual criticality scenarios is sufficiently low. This includes sufficient detail to 

11 demonstrate that:

12

13 a. All credible accident sequences that could lead to accidental criticality have been 

14 identified and adequate preventive controls established.

15

16 b. All engineered features and operator actions that are relied on to demonstrate 

17 that nuclear processes will be subcritical under normal and credible abnormal 

18 conditions have been identified as items relied on for safety, the description of 

19 which includes specifying their safety function and what systems and 

20 components are needed to perform their safety function.

21

22 c. Facility management measures appropriate to the type, required reliability, and 

23 required availability of items relied on for safety have been established.

24

25 4. The ISA summary demonstrates compliance with the double-contingency principle in its 

26 selection of items relied on for safety and application of management measures.

27

28 5. The ISA summary demonstrates compliance with the CAAS requirements of 

29 10 CFR 70.24.

30

31 6. Documentation of the criticality scenarios, controls, and management measures relied 

32 on to prevent criticality complies with the applicant’s commitments pertaining to the 

33 contents of its ISA summary.

34

35 5.4.3.3 Emergency Plan

36

37 Prevention is the primary means of protection against the consequences of accidental criticality, 

38 but there is still a small but finite risk that criticality events will occur. For facilities that require a 

39 CAAS in accordance with 10 CFR 70.24, the applicant must either submit an Emergency Plan 

40 or an evaluation demonstrating that an Emergency Plan is not required, in accordance with the 

41 provisions in 10 CFR 70.22(i)(1)(i) and (ii). (See Chapter 8 of this SRP for additional detail.)

42

43 If the applicant determines that a facility CAAS is not required, the reviewer should review the 

44 applicant’s proposed activities to determine whether they meet the mass-based criteria of 

45 10 CFR 70.24(a). If the criteria apply and the applicant submitted a request for exemption from 

46 the CAAS requirements of 10 CFR 70.24(a), the reviewer should evaluate whether an 

47 exemption is justified. As stated in ANSI/ANS-8.3, “installation of an alarm system implies a 

48 nontrivial risk of criticality.” Whenever it is determined that criticality in a given area is credible 

49 and that it has the potential to adversely affect workers or the public, a criticality alarm is 

50 required unless an exemption is granted. False alarms and evacuations could pose a risk of 

51 injury to workers, and maintenance may expose workers who would not otherwise be exposed 

52 to occupational or potential criticality doses, so consideration may be given to whether 

53 installation of a CAAS results in a net risk benefit.

54
May 2014 5-27 NUREG-1520, Revision 2

1 If a facility CAAS is required, the applicant must establish emergency procedures in response to 

2 activation of the alarm, in accordance with 10 CFR 70.24(a). In addition, the applicant must 

3 submit either an Emergency Plan or an evaluation demonstrating that an Emergency Plan is not 

4 required, in accordance with 10 CFR 70.22(i)(1)(i) and (ii). Acceptance criteria applicable to the 

5 applicant’s emergency procedures and Emergency Plan, or to an evaluation that an Emergency 

6 Plan is not required, are as follows:

7

8 1. The applicant commits to the ANSI/ANS-8.3 and -8.23 standards.

9

10 2. The applicant has trained personnel to evacuate immediate upon activation of the alarm, 

11 and has designated assembly locations for personnel accountability. The designated 

12 assembly locations are located sufficiently away from fissile material so as to adequately 

13 protect personnel from excessive radiation doses. Evacuation routes are planned so as 

14 to minimize the potential for exposing evacuating personnel needlessly.

15

16 3. The applicant has provided monitoring equipment and procedures to monitor the dose 

17 rate in assembly locations, and to provide for safe reentry and recovery following the 

18 accident.

19

20 4. The applicant has provided for (a) monitoring to detect individuals with serious radiation 

21 exposures, (b) immediate decontamination of and first aid for exposed individuals, and 

22 (c) prompt and effective offsite medical attention.

23

24 5. The applicant has procedures in place to promptly notify local, State, and Federal 

25 authorities, including the NRC Operations Center, after an accident.

26

27 6. The applicant has procedures in place for coordination with offsite responders, including 

28 development of response plans and training in safety of nuclear materials (e.g., training 

29 in radiation hazards and restrictions on use of firefighting agents and methods).

30

31 7. The response to criticality events is commensurate with the onsite and offsite dose to 

32 individuals. Determination of a bounding radiation dose is done conservatively:

33

34 a. A bounding number of fissions is assumed that is commensurate with the 

35 worst-case historical accidents appropriate to the type and quantity of material 

36 that could be involved.

37

38 Estimates from historical accidents (e.g., tabulated in LA-13638, “A Review of 

39 Criticality Accidents”) or calculational methods (e.g., use of NUREG/CR-6504, 

40 “An Updated Nuclear Criticality Slide Rule,” or an empirical formula from 

41 peer-reviewed literature (Babry, Olsen, Tuck, Nomura)) may be used. 

42 Alternately, a more conservative estimate (e.g., the generic model in 

43 NUREG/CR-6410, if applicable) may be used.

44

45 b. Conservative assumptions are made regarding the rate of reactivity insertion, the 

46 quantity of fissile material, the duration of the excursion, and the potential for 

47 oscillating criticality. Secondary bursts and/or a plateau should be considered a 

48 possibility if solutions or slurries are involved.

49

50 c. Conservative assumptions are made regarding the distance from the reacting 

51 material to the site boundary, the worst credible location for fissile material, and 

52 the minimum amount of intervening shielding.

53
May 2014 5-28 NUREG-1520, Revision 2

1 d. Credit should not be taken for quenching mechanisms that are not ensured by 

2 physical law or the design of the process. In particular, credit should not be 

3 taken for termination or mitigation of an excursion by human intervention.

4

5 e. Calculation of offsite doses takes into account both direct neutron and gamma 

6 radiation as well as the dose from radioactive fission products produced, and 

7 also takes into account such effects as groundshine, skyshine, and secondary 

8 gamma production.

9

10 While the calculation of the radiation dose from criticality should be conservative, 

11 because of the uncertainty and wide variability in the severity of criticality accidents, care 

12 should be taken that calculations are not excessively conservative, which could result in 

13 personnel overreacting to an accident.

14

15 The reviewer should also coordinate with the review performed under SRP Chapter 8.

16

17 5.5 Review Procedures

18

19 For each area of review specified in subsection 5.3 of this SRP section, the review procedure is 

20 identified below. These review procedures are consistent with the identified SRP acceptance 

21 criteria. For deviations from the acceptance criteria, the staff should evaluate whether the 

22 applicant’s proposed alternatives to the SRP criteria provide an acceptable method of complying 

23 with the relevant NRC requirements identified in subsection 5.4.

24

25 5.5.1 Acceptance Review

26

27 During the acceptance review of a license application, the reviewer should examine the 

28 submittals to identify major deficiencies in the information provided for each area of review 

29 specified in SRP Section 5.3. Reviewers must decide whether they have enough information to 

30 proceed with a detailed review. Less significant errors or deficiencies that can be addressed in 

31 a request for additional information should be accepted. However, before the NRC performs a 

32 detailed review, the applicant should correct major deficiencies that would require several 

33 requests for additional information to resolve.

34

35 Reviewers should record whether each area of review is adequately addressed in the 

36 application, is adequately addressed in a cited document, is not applicable to the application, or 

37 has a major deficiency.

38 5.5.2 Safety Evaluation

39

40 After the application has been accepted for review, the reviewer should conduct a complete 

41 review of the license application and a sampling review of the ISA summary to determine 

42 whether it meets the criteria specified in Section 5.4 of this SRP. The reviewer should consult 

43 with supporting reviewers, as appropriate, and coordinate with the reviewers for SRP 

44 Chapters 1, 2, 3, 8, and 11 to confirm the adequacy of all aspects of the application pertinent to 

45 NCS. The reviewer should also coordinate with the reviewers for other technical areas, and 

46 especially SRP Chapters 6 and 7, to ensure appropriate consideration of any cross-cutting 

47 issues. During the initial review, the reviewer should draft the safety evaluation report (SER) 

48 described below. A request for additional information (RAI) will be prepared when clarification 

49 and additional information are needed to determine whether the licensee’s submittals comply 

50 with the regulations. The primary reviewer should coordinate with the licensing project manager 

51 in preparing RAIs. Additional information submitted by the applicant will be evaluated and a 

52 final SER will be provided to the licensing project manager.
May 2014 5-29 NUREG-1520, Revision 2

1

2 5.5.2.1 License Application

3

4 The reviewer should review the pertinent sections of the license application for completeness 

5 and adequacy with respect to the requirements of 10 CFR 70.22, 70.23, 70.24, 70.61, 70.62, 

6 70.64, and 70.65. The acceptance criteria in Section 5.4 provide a standard for acceptability 

7 with regard to the regulations. There may be some criteria that do not apply to the applicant’s 

8 proposed activities. In other cases, the applicant may propose alternatives that provide an 

9 equivalent assurance of safety. In addition, a mere restatement of the acceptance criteria in the 

10 application may not be sufficient without an explanation of how the applicant intends to 

11 implement the criteria to achieve the underlying safety goals. Therefore, the reviewer should 

12 not review the application to verify compliance with the acceptance criteria, but should rather 

13 review the application to determine whether the program as a whole provides for a reasonable 

14 assurance of safety and meets the regulatory requirements, and should be guided by the 

15 acceptance criteria.

16

17 If, during the review, the reviewer identifies the need for additional information, the reviewer 

18 should coordinate development of a request for additional information with the licensing project 

19 manager. The purpose of a request for additional information is to identify information needed 

20 to make a regulatory decision (approval, denial, or conditional approval). The reviewer should 

21 also ascertain that the criticality safety approach is consistent with other sections of the license 

22 application, including those addressed by SRP Chapters 1, 2, 3, 4, 6, 7, 8, and 11.

23

24 For an existing facility, the reviewer should consult with NCS inspectors to identify any ongoing 

25 issues that could impact the licensing review. For a new facility, the reviewer should identify 

26 any issues that should be inspected during an operational readiness review, if such a review is 

27 to be performed. These items could include confirming that commitments made in the license 

28 application are properly implemented through procedures and training. For a new facility or a 

29 major new process at an existing facility, the reviewer should, if feasible, observe the actual 

30 operations under design and construction, or existing processes similar to the process under 

31 review. The reviewer should also review a sampling of criticality analysis applicable to the 

32 process under review, including calculations and supporting documentation (process-hazard 

33 analyses, piping and instrumentation diagrams, drawings, etc.). The reviewer may, if it helps 

34 him or her in reaching a licensing decision, perform independent analysis to verify the 

35 applicant’s criticality evaluations. The depth and scope of such analyses should be 

36 commensurate with an area’s importance to safety.

37

38 The reviewer will prepare input for the safety evaluation report (SER) during the review and 

39 provide it to the licensing project manager upon completion of the review. The SER should 

40 describe what aspects of the applicant’s submittals were reviewed, how they were reviewed, 

41 and the basis for the reviewer’s approval, denial, or conditional approval of the application.

42

43 5.5.2.2 ISA and ISA Summary

44

45 The reviewer should review the pertinent sections of the applicant’s ISA summary, including a 

46 sampling of the criticality hazards, scenarios, and items relied on for safety together with their 

47 management measures. The ISA summary provides a supplemental demonstration of the 

48 adequacy of the criticality safety basis described in the CSEs. The reviewer should evaluate the 

49 applicant’s ISA methodology, ISA documentation, and ISA summary to determine whether they 

50 demonstrate an acceptable level of safety that is consistent with the safety basis in the CSEs 

51 and whether they meet the regulatory requirements of 10 CFR 70.61, 70.62, 70.64, and 70.65.

52

53 In reviewing the ISA documentation and ISA summary, the reviewer may identify the need for 

54 additional information, as described in the previous section. For a new facility or a major new 
May 2014 5-30 NUREG-1520, Revision 2

1 process at an existing facility, the reviewer should, in general, perform an onsite vertical slice 

2 review of the ISA documentation, including primarily the CSEs. The reviewer should ensure 

3 that any commitments necessary to make a “reasonable assurance” finding are included in the 

4 license application. The reviewer should document the ISA review as part of the SER.

5

6 5.5.2.3 Emergency Plan

7

8 The reviewer should first determine whether an Emergency Plan is required for the facility. If an 

9 Emergency Plan is required, the reviewer should review its pertinent sections to determine 

10 whether it provides for adequate protection of workers and the public against the consequences 

11 of an accidental criticality. During the review, the reviewer may identify the need for additional 

12 information, as discussed above. The reviewer should ensure that any commitments necessary 

13 to make a “reasonable assurance” finding are included in the license application. The reviewer 

14 should document the review as part of the SER.

15

16 5.6 Evaluation Findings

17

18 The regulations in 10 CFR 70.23 and 70.66 state that an application for a license will be 

19 approved if the Commission can make the general findings listed in those sections. The basis 

20 for the general findings is an evaluation of whether the application adequately addresses all of 

21 the applicable regulatory requirements. More specifically, the staff’s evaluation should 

22 determine whether the licensing submittals provide sufficient information to satisfy the regulatory 

23 requirements listed in Section 5.4.1 of this SRP and whether the applicant has appropriately 

24 addressed the regulatory acceptance criteria in SRP Section 5.4.3. The SER should state how 

25 the applicable regulatory requirements have or have not been met based on the acceptance 

26 criteria described in this chapter of the SRP. If the applicant chooses to use an alternative 

27 approach, the reviewer should discuss in the SER whether the proposed approach satisfies the 

28 applicable regulatory requirements. The reviewers should use the following approach to 

29 document their evaluation:

30

31 1. State a specific regulatory requirement that applies to the application. Detailed 

32 acceptance criteria may be included where appropriate or necessary to clarify the 

33 requirement.

34

35 2. Identify the areas where the regulatory requirement is addressed in the application, 

36 including the areas where the specific acceptance criteria described in this SRP are 

37 addressed.

38

39 3. Describe your evaluation of the application, the basis for your conclusion, and whether it 

40 meets the regulatory requirement.

41

42 4. Repeat these steps for every regulatory requirement that applies to the application.

43

44 There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

45 application or amendment request, (2) denial of the application or request, or (3) approval with 

46 conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

47 reviewer may consider proposing a license condition. Absent an NRC order, license conditions 

48 must be agreed upon with the licensee or applicant before becoming part of the license.

49 A license condition should only be proposed if there is reasonable assurance that, if the 

50 licensee meets the condition, all regulatory requirements will be satisfied. Thus, license 

51 conditions should not be used to cover major deficiencies in an application. License conditions 

52 should be unambiguous, inspectable, and enforceable. They should only require those actions 
May 2014 5-31 NUREG-1520, Revision 2

1 necessary to ensure compliance with applicable regulations. The basis for license conditions 

2 must be documented in the SER.

3

4 If the staff’s review verifies that the NCS Program provides for a reasonable assurance of safety 

5 and meets the applicable regulatory requirements of 10 CFR Part 70, the staff will document its 

6 findings to that effect. The NRC staff may include statements and conclusions similar to those 

7 described below if appropriate to the review:

8

9 The staff has reviewed the applicant’s NCS Program, ISA, and ISA summary [or “...ISA, 

10 ISA Summary, and Emergency Plan”, if appropriate] in ways consistent with SRP 

11 Chapter 5. Based on its review, the staff has reasonable assurance of the following:

12

13 • The applicant will have in place an NCS Program that will be developed, 

14 implemented, and maintained to ensure that fissile material is possessed, stored, 

15 and used safely and in accordance with the requirements of 10 CFR 70.61(b) 

16 and (d) and 70.64(a)(9).

17

18 • The applicant’s conduct of operations will be based on NCS technical practices 

19 that will ensure that fissile material will be possessed, stored, and used safely 

20 and in accordance with the requirements of 10 CFR 70.61(b) and (d) and 

21 70.64(a)(9).

22

23 • The applicant will develop, implement, and maintain a criticality accident alarm 

24 system and emergency procedures in accordance with the requirements of 

25 10 CFR 70.24.

26

27 • The applicant will establish and implement NCS controls, and maintain them 

28 through the application of facility management measures, to ensure that nuclear 

29 processes will be subcritical under normal and credible abnormal conditions and 

30 will provide for double contingency protection, in accordance with 

31 10 CFR 70.61(d).

32

33 Based on these conclusions, the staff has determined that the applicant’s NCS Program 

34 meets the requirements of 10 CFR Part 70 and provides reasonable assurance of safety 

35 against the consequences of an accidental criticality.

36

37 The staff should recognize that this is an example only, and that the specific conclusions to be 

38 reached will vary depending on the results of the licensing review. For a denial, the reviewer 

39 may state: “Based on its review, the staff does not have reasonable assurance of safety...” and 

40 then summarize the reasons why. For a conditional approval, the reviewer may state: “Based 

41 on its review, the staff has reasonable assurance of safety, subject to the following conditions.” 

42 The staff may make other such conclusions as appropriate.

43

4445 5.7 References

46

47 U.S. Code of Federal Regulations, “Domestic Licensing of Special Nuclear Material,” Part 70, 

48 Chapter I, Title 10, “Energy.”

49 American National Standards Institute (ANSI)/American Nuclear Society (ANS), “Nuclear 

50 Criticality Safety in Operations with Fissionable Materials Outside Reactors,” 

51 ANSI/ANS-8.1-1998 (R2007), La Grange Park, IL, 2007.

52

53 ANSI/ANS, “Criticality Accident Alarm System,” ANSI/ANS-8.3-1997 (R2003), La Grange 

54 Park, IL, 2003.

55
May 2014 5-32 NUREG-1520, Revision 2

1 ANSI/ANS, “Use of Borosilicate-Glass Raschig Rings as a Neutron Absorber in Solutions of 

2 Fissile Material,” ANSI/ANS-8.5-1996 (R2007), La Grange Park, IL, 2007.

3

4 ANSI/ANS, “Safety in Conducting Subcritical Neutron-Multiplication Measurements in Situ,” 

5 ANSI/ANS-8.6-1983 (R2010), La Grange Park, IL, 2010.

6

7 ANSI/ANS, “Nuclear Criticality Safety in the Storage of Fissile Materials,” ANSI/ANS-8.7-1998 

8 (R2007), La Grange Park, IL, 2007.

9

10 ANSI/ANS, “Criteria for Nuclear Criticality Safety Controls in Operations with Shielding and 

11 Confinement,” ANSI/ANS-8.10-1983 (R2005), La Grange Park, IL, 2005.

12

13 ANSI/ANS, “Nuclear Criticality Control and Safety of Plutonium-Uranium Fuel Mixtures Outside 

14 Reactors,” ANSI/ANS-8.12-1987 (R2002), La Grange Park, IL, 2002.

15

16 ANSI/ANS, “Use of Soluble Neutron Absorbers in Nuclear Facilities Outside Reactors,” 

17 ANSI/ANS-8.14-2004, La Grange Park, IL, 2004.

18

19 ANSI/ANS, “Nuclear Criticality Control of Special Actinide Elements,” ANSI/ANS-8.15-1981 

20 (R2005), La Grange Park, IL, 2005.

21

22 ANSI/ANS, “Criticality Safety Criteria for the Handling, Storage, and Transportation of LWR Fuel 

23 Outside Reactors,” ANSI/ANS-8.17-2004 (R2009), La Grange Park, IL, 2009.

24

25 ANSI/ANS, “Administrative Practices for Nuclear Criticality Safety,” ANSI/ANS-8.19-2005, 

26 La Grange Park, IL, 2005.

27

28 ANSI/ANS, “Nuclear Criticality Safety Training,” ANSI/ANS-8.20-1991 (R2005), La Grange 

29 Park, IL, 2005.

30

31 ANSI/ANS, “Use of Fixed Neutron Absorbers in Nuclear Facilities Outside Reactors,” 

32 ANSI/ANS-8.21-1995 (R2001), La Grange Park, IL, 2001.

33

34 ANSI/ANS, “Nuclear Criticality Safety Based on Limiting and Controlling Moderators,” 

35 ANSI/ANS-8.22-1997 (R2006), La Grange Park, IL, 2006.

36

37 ANSI/ANS, “Nuclear Criticality Accident Emergency Planning and Response,” 

38 ANSI/ANS-8.23-2007, La Grange Park, IL, 2007.

39

40 ANSI/ANS, “Validation of Neutron Transport Methods for Nuclear Criticality Safety Calculations,” 

41 ANSI/ANS-8.24-2007, La Grange Park, IL, 2007.

42

43 ANSI/ANS, “Criticality Safety Engineer Training and Qualification Program,” 

44 ANSI/ANS-8.26-2007, La Grange Park, IL, 2007.

45

46 ANSI/ANS, “Burnup Credit for LWR Fuel,” ANSI/ANS-8.27-2008, La Grange Park, IL, 2008.

47

48 Carter, R.D., G.R. Kiel, and K.R. Ridgway, “Criticality Handbook,” ARH-600, Atlantic Richfield 

49 Hanford Company, Richland, WA, 1968.

50

51 International Organization for Standardization (ISO), “Nuclear Energy—Fissile Materials—

52 Principles of Criticality Safety in Storing, Handling, and Processing,” ISO 1709:1995, Geneva, 

53 Switzerland, 1995.

54
May 2014 5-33 NUREG-1520, Revision 2

1 ISO, “Nuclear Energy—Performance and Testing Requirements for Criticality Detection and 

2 Alarm Systems,” ISO 7753:1987, Geneva, Switzerland, 1987.

3

4 Knief, R.A., “Nuclear Criticality Safety—Theory and Practice,” American Nuclear Society, 

5 La Grange Park, IL, 1985.

6

7 Los Alamos National Laboratory, “A Review of Criticality Accidents: 2000 Revision,” LA-13638, 

8 Los Alamos, NM, 2000.

9

Paxton, H.C., and N.L. Pruvost, “Critical Dimensions of Systems Containing 235U, 239 10 Pu, and 

233 11 U,” LA-10860-MS, Los Alamos National Laboratory, Los Alamos, NM, 1987.

12

13 U.S. Nuclear Regulatory Commission, “Nuclear Criticality Safety Performance Requirements 

14 and Double-Contingency Principle,” FCSS-ISG-03, February 2005.

15

16 U.S. Nuclear Regulatory Commission, “Justification for Minimum Margin of Subcriticality for 

17 Safety,” FCSS-ISG-10, June 2006.

18

19 U.S. Nuclear Regulatory Commission, “Integrated Safety Analysis Guidance Document,” 

20 NUREG-1513, May 2001.

21

22 U.S. Nuclear Regulatory Commission, “Criticality Benchmark Guide for Light-Water-Reactor 

23 Fuel in Transportation and Storage Packages,” NUREG/CR-6368, March 1997.

24

25 U.S. Nuclear Regulatory Commission, “Nuclear Fuel Cycle Facility Accident Analysis 

26 Handbook,” NUREG/CR-6410, March 1998.

27

28 U.S. Nuclear Regulatory Commission, “Guide for Validation of Nuclear Criticality Safety 

29 Calculational Methodology,” NUREG/CR-6698, January 2001.

30

31 U.S. Nuclear Regulatory Commission, “Nuclear Criticality Safety Standards for Fuels and 

32 Material Facilities,” Regulatory Guide 3.71, October 2005.

33
1
May 2014 5-A-1 NUREG-1520, Revision 2

APPENDIX A

NUCLEAR CRITICALITY SAFETY PERFORMANCE REQUIREMENTS 

AND DOUBLE-CONTINGENCY PRINCIPLE

1 Purpose

2

3 This appendix provides additional guidance on nuclear criticality safety performance 

4 requirements and the double-contingency principle. The purpose of this appendix is to clarify 

5 the relationship between the requirements in Title 10, Energy,” of the Code of Federal 

6 Regulations (10 CFR) Part 70, “Domestic Licensing of Special Nuclear Material,” Subpart H, 

7 “Additional Requirements for Certain Licensees Authorized To Possess a Critical Mass of 

8 Special Nuclear Material,” to ensure nuclear criticality safety. These requirements are

9 described in 10 CFR 70.61(b), 70.61(d), and 70.64(a)(9).

10

11 Introduction

12

13 The regulations in Subpart H of 10 CFR Part 70 contain three separate requirements to ensure 

14 nuclear criticality safety. One requirement, 10 CFR 70.64(a)(9), requires that the design of new 

15 facilities and processes provide for criticality control including adherence to the double 

16 contingency principle. A second requirement, 10 CFR 70.61(b), requires that high consequence 

17 events (which typically will include criticality accidents) be highly unlikely. A third requirement, 

18 10 CFR 70.61(d), requires that nuclear criticality accidents be limited by assuring that under 

19 normal and abnormal conditions all nuclear processes are subcritical, including use of an 

20 approved margin of subcriticality, and also requires that the primary means of criticality 

21 protection be prevention. 

22

23 Discussion

24

25 There are three separate requirements in 10 CFR Part 70 for ensuring nuclear criticality safety.

26 The first requirement of 10 CFR 70.64(a)(9) is more prescriptive and deterministic than the 

27 performance requirements of 10 CFR 70.61. 10 CFR 70.64 establishes baseline design criteria 

28 for new facilities and processes, similar to general design criteria in 10 CFR Part 50. One of 

29 these baseline design criteria applies directly to criticality safety. Specifically, 10 CFR 

30 70.64(a)(9) requires that the design “provide for criticality control including adherence to the 

31 double contingency principle.” Section 70.64(b) further specifies that new facilities or processes 

32 must incorporate defense-in-depth practices, which is defined as a “design philosophy, applied 

33 from the outset and through completion of the design, that is based on providing successive 

34 levels of protection such that health and safety will not be wholly dependent upon any single 

35 element of the design, construction, maintenance, or operation of the facility.” Section 

36 70.64(b)(1) specifically mentions preference for the selection of engineered controls over 

37 administrative controls to increase overall system reliability.

38

39 Another more risk-informed and performance-based requirement is contained in 10 CFR 70.61. 

40 In short, this regulation stipulates that credible high consequence events shall be made “highly 

41 unlikely” or be mitigated (10 CFR 70.61(b)) and that intermediate consequences shall be made 

42 “unlikely” or be mitigated (10 CFR 70.61(c)). High and intermediate consequence thresholds for 

43 workers and members of the public are established for both chemical and radiological events. 

44 Under this risk-informed and performance-based regulation a criticality accident would typically
May 2014 5-A-2 NUREG-1520, Revision 2

1 be considered a high consequence event to the worker since the worker could receive a dose in 

2 excess of 100 rem TEDE (total effective dose equivalent). 

3

4 In addition, there is a separate provision within 10 CFR 70.61 that specifically addresses 

5 criticality safety. Section 70.61(d) states that, in addition to meeting the requirements above for 

6 high and intermediate consequence events, the “risk of nuclear criticality accidents must be 

7 limited by assuring that under normal and credible abnormal conditions, all nuclear processes 

8 are subcritical, including use of an approved margin of subcriticality for safety. Preventive 

9 controls and measures must be the primary means of protection against nuclear criticality 

10 accidents.” The purpose of this is to preclude a situation where nuclear criticality would be 

11 permitted as long as the dose thresholds of § 70.61(b) and § 70.61(c) are not exceeded.

12

13 Thus, 10 CFR Part 70 contains three separate and distinct requirements related to precluding 

14 nuclear criticality (10 CFR 70.64(a)(9), 10 CFR 70.61(b), and 10 CFR 70.61(d)), besides 

15 provisions in § 70.24 and § 70.52, which pertain to mitigating the consequences of a criticality 

16 accident and reporting its occurrence.

17

18 Section 70.61(d) of 10 CFR Part 70

19

20 Section 70.61(d) requires that under normal and credible abnormal conditions all nuclear 

21 processes are subcritical including use of an approved margin of subcriticality for safety. In 

22 addition, preventive controls and measures must be the primary means of protection against 

23 criticality. Meeting this performance requirement entails a number of factors. First, all normal 

24 and credible abnormal conditions must be identified. There are many different methods that 

25 may be employed to do this, but a systematic methodology should be used to provide 

26 reasonable assurance that the complete spectrum of credible conditions has been identified. 

27

28 Normal conditions are those specifically allowed for as part of the normal modes of operation in 

29 the facility design (i.e., conditions that may occur without the failure of any items relied on for 

30 safety (IROFS)). Abnormal conditions are those events not planned for as a regular occurrence 

31 in the facility or operation design. They include those undesirable conditions that are the result 

32 of external events and process deviations, including those resulting from the failure of identified 

33 IROFS. Credible abnormal events include both credible single events (e.g., an external event or 

34 failure of a single IROFS) and credible sequences of events. Credible sequences of events 

35 include, but may not be limited to, chains of independent but not unlikely process deviations 

36 (i.e., not precluded by IROFS) and chains of related failures of IROFS (i.e., failures that are not 

37 independent). Some judgment must be employed in determining what constitutes a credible 

38 abnormal condition. It is not necessary to include multiple independent failures of IROFS within 

39 the spectrum of credible abnormal conditions. Additional guidance on what is considered not 

40 credible is contained in NUREG-1520, Section 3.4.3.2:

41

42 a. “An external event for which the frequency of occurrence can conservatively be 

43 estimated as less than once in a million years.”

44

45 b. “A process deviation that consists of a sequence of many unlikely human actions or 

46 errors for which there is no reason or motive....”

47

48 c. “Process deviations for which there is a convincing argument, given physical laws, that 

49 they are not possible, or are unquestionably extremely unlikely....”
May 2014 5-A-3 NUREG-1520, Revision 2

1 The requirement that nuclear processes be subcritical is satisfied if the licensee or applicant 

2 demonstrates that the most reactive credible conditions are subcritical. To provide adequate 

3 assurance of subcriticality, this must include margin. There are several different ways to 

4 demonstrate sub-criticality, as discussed below:

5

6 • If subcriticality is demonstrated using an appropriately validated calculation method, then 

7 keff (K effective) (including calculation’s uncertainties) must be less than the approved 

8 upper subcritical limit (USL), as specified in the license. Meeting this requires that 

9 models bound actual anticipated conditions (e.g., tolerances and uncertainties 

10 appropriately taken into account, most reactive credible system parameters allowed are 

11 assumed), as specified in the license. Additional guidance is provided in the criticality 

12 chapter of NUREG-1520, “Standard Review Plan for the Review of a License Application 

13 for a Fuel Cycle Facility,” (Sections 5.4.3.4.1, 5.4.3.4.2, and 5.4.3.4.4).

14

15 • Subcritical margin may also be expressed in terms of system parameters rather than 

system keff 16 . An example would be where the licensee or applicant has committed to use 

17 mass or dimensional limits that are some specified fraction of the critical values of those 

18 parameters. In such cases, the approach used must be approved by the NRC.

19

20 • Subcriticality may be demonstrated on the basis of subcritical limits included in the 

21 license, U.S. Nuclear Regulatory Commission (NRC) endorsed American National 

22 Standards Institute (ANSI) standards, or other documents that have been approved or 

23 endorsed by NRC. Approval or endorsement by the NRC implies that the Agency has 

24 found these references to include an acceptable margin of subcriticality for safety.

25

26 • Industry handbooks of criticality data may also be used if widely accepted in the nuclear 

27 industry and if used in accordance with any limitations of that data. The NRC, however, 

28 reserves the right to evaluate the use of such handbooks on a case-by-case basis.

29

30 The requirement that preventive controls and measures be the primary means of protection 

31 against criticality is satisfied if engineered or administrative controls relied on to meet § 70.61(d) 

32 are designed to prevent occurrence of the critical excursion rather than mitigate its 

33 consequences. By stating that prevention should be the primary means of protection, it is 

34 recognized that there may be extraordinarily rare occasions when prevention alone is not 

35 sufficient to meet § 70.61(d). Such cases require convincing demonstration that there is no 

36 practicable way to meet § 70.61(d) with solely preventive measures.

37

38 Some examples where the § 70.61(d) requirement has not been met:

39

40 • A process in which the most reactive credible conditions have not been modeled and 

have not been shown to have keff 41 less than the approved USL.

42

43 • A process in which subcriticality is based on criticality calculations, but the model is 

44 outside the area of applicability of the calculation method.

45

46 • A process for which there is an unanalyzed or unanticipated credible abnormal condition 

47 (e.g., unanticipated failure of an IROFS or unanticipated external event).

48

49 • A process for which there is a credible common-mode event that can result in the failure 
May 2014 5-A-4 NUREG-1520, Revision 2

1 of all criticality controls such that it can lead to a critical configuration.

2

3 • A process in which the designated IROFS are not sufficient to limit the system to a 

4 subcritical configuration.

5

6 Relationship of 10 CFR 70.61(b) to 10 CFR 70.61(d)

7

8 Section 70.61(b) states “. . . the risk of each credible high consequence event must be 

9 limited. . . . Controls . . . shall be applied to the extent needed to reduce the likelihood of 

10 occurrence of the event so that . . . the event is highly unlikely . . . .”

11

12 Section 70.61(d) states “. . . the risk of nuclear criticality accidents must be limited by assuring 

13 that under normal and credible abnormal conditions, all nuclear processes are subcritical, 

14 including an approved margin of subcriticality . . . .”

15

16 As written, the rule language requires both provisions (i.e., § 70.61(b) and § 70.61(d)) be met, 

17 since § 70.61(d) states “In addition to complying with paragraphs (b) and (c) of this section . . . .” 

18 However, during the 10 CFR Part 70 rulemaking, regulated industry representatives met with 

19 NRC and submitted letters in which they expressed their desire that NRC not consider criticality 

20 accidents high consequence events and not associate quantitative likelihoods with double 

21 contingency. As discussed in the release notes issued with the 10 CFR Part 70 rulemaking, in 

22 response to industry arguments accidental criticality was explicitly removed from the high 

23 consequence (§ 70.61(b)) category and a separate performance requirement for criticality (§ 

24 70.61(d)) was created. The staff felt that in so doing, both the industry’s desires as well as the 

25 staff’s needs would be met. Further, the staff felt that the § 70.61(d) requirement required the 

26 same information as that required by § 70.61(b). Saying all nuclear processes must be 

27 subcritical in § 70.61(d) implies that criticality events must be prevented. Moreover, since 

28 likelihood is never zero, some non-zero likelihood must be assumed; the highly unlikely 

29 requirement in § 70.61(b) is appropriate for this. Therefore, the staff felt that by removing 

30 criticality explicitly from § 70.61(b) and creating § 70.61(d) during the rulemaking, the staff still 

31 retained its desired outcome–to prevent criticality accidents from occurring. The final rule 

32 Statement of Considerations (SOC) stated that “...the NRC believes that a separate 

33 performance requirement for nuclear criticality prevention is appropriate. The staff recognizes 

34 that many (but not all) nuclear criticality accidents would reasonably be expected to result in 

35 worker doses that exceed the high- and intermediate-consequence standards in 10 CFR 

36 70.61(b) or (c). However, regardless of the dose directly resulting from the accident, an 

37 inadvertent nuclear criticality should be avoided. This is consistent with the Commission’s goal 

38 to prevent inadvertent criticalities, as reflected in the NRC Strategic Plan (NUREG-1614) . . . .” 

39 However, there remained ambiguity regarding the relationship between § 70.61(b) and 

40 § 70.61(d). While the staff’s intent was to have a single performance requirement for criticality 

41 accidents, this cannot be substantiated by a literal examination of the final rule.

42

43 Comparing the language in § 70.61(b) and (d), one concludes that § 70.61(d) is actually more 

44 restrictive than § 70.61(b). Section 70.61(d) essentially requires that there be no criticality 

45 accidents, with a high degree of assurance, whereas § 70.61(b) essentially requires that deaths 

46 and injuries (as implemented through a dose limit) be precluded (i.e., be made to be highly 

47 unlikely). If criticality accidents are prevented, then deaths and injuries are also prevented. 

48 However, the converse is not necessarily true; if deaths and injuries are prevented, criticality 

49 accidents are not necessarily prevented. Therefore, if one meets § 70.61(d), then one also 

50 automatically meets § 70.61(b); and if one meets § 70.61(b) through preventive means, and 
May 2014 5-A-5 NUREG-1520, Revision 2

1 also meets the additional requirements specified in § 70.61(d), then one also meets § 70.61(d) 

2 in full. Thus, if a licensee chooses to address criticality event sequences under 10 CFR 70.61(b) 

3 with a preventive strategy and has an approved margin of subcriticality for safety, then the 

4 licensee will have also met the requirements under 10 CFR 70.61(d). However, if the licensee 

5 chooses to address criticality event sequences under 10 CFR 70.61(b) with a mitigative 

6 strategy, then the licensee will not have met the requirements under 10 CFR 70.61(d) and 

7 additional controls will have to be identified to ensure subcriticality.

8

9 Another consideration is that both § 70.61(b) and § 70.61(d) set the standard that must be met 

10 (i.e., the performance requirements), but not the methodology. Methodology requirements are 

11 contained in § 70.62. One cannot look at § 70.61 in a vacuum. All other 10 CFR Part 70 

12 provisions must also be met, including the § 70.62(c) provision that requires the integrated 

13 safety analysis (ISA) to include radiological hazards, facility hazards, potential accident 

14 sequences, and identification of IROFS as well as the assumptions and conditions under which 

15 the IROFS are relied upon to support compliance with § 70.61 performance requirements. It 

16 also requires that the ISA team include a person with experience in criticality safety. These 

17 requirements must be met regardless of whether the licensee attempts to meet the performance 

18 requirements starting from § 70.61(b) or § 70.61(d). The three options below can be seen to be 

19 equivalent when one considers that § 70.62 must also be met for all cases.

20

21 To meet the regulations and prevent criticalities, an applicant/licensee may use one of the three 

22 approaches below (in conjunction with other 10 CFR Part 70 requirements, including those in 

23 § 70.62):

24

25 1. Demonstrate compliance with § 70.61(d); or 

26

27 2. Demonstrate compliance with § 70.61(b), considering only preventive controls and 

28 including an approved margin of subcriticality; or

29

30 3. Separately demonstrate compliance with both § 70.61(d) and § 70.61(b).

31

32 Use of any of the above three approaches will satisfy the regulations. 

33

34 That both § 70.61(b) and § 70.61(d) apply to criticality is supported by this SRP. In addition, 

35 there are several references to the requirement to make criticality highly unlikely.

36

37 Double Contingency Principle § 70.64(a)(9)

38

39 In addition to complying with the performance requirement in § 70.61, new facilities and 

40 processes are required to comply with the baseline design criteria in § 70.64. 

41 Section 70.64(a)(9) requires that the design provide for criticality control, including adherence to 

42 the double contingency principle (DCP). In addition to this requirement for new facilities and 

43 processes, many existing facilities and processes have license commitments to meet the DCP 

44 for licensed activities. Although Subpart H of 10 CFR Part 70 is relatively new, this conceptual 

45 framework is not new. Licensees have historically committed to ANSI/American Nuclear 

46 Society -8.1 (ANSI/ANS-8.1). This standard also requires that nuclear processes be ensured to 

47 be subcritical under normal and credible abnormal conditions. By contrast, the DCP is stated as 

48 a recommendation of ANSI/ANS-8.1. Therefore, the standard recognizes that adherence to the 

49 DCP can be one means, but is not necessarily the only means of meeting the underlying 
May 2014 5-A-6 NUREG-1520, Revision 2

1 subcriticality requirement. The conditions under which compliance with the DCP ensures that 

2 § 70.61(d) is met are discussed below.

3 The double contingency principle is a design principle intended to be used in designing a facility 

4 that meets the performance requirements of § 70.61. The definition in § 70.4 (“...process 

5 designs should incorporate sufficient factors of safety...”) implicitly recognizes that there may be 

6 some cases in which a strict adherence to the double contingency principle is not practicable. 

7 This should be an exceedingly rare situation and should be accompanied by a convincing 

8 demonstration that a strict adherence to the double contingency principle is not practicable. 

9 Section 70.64(a) allows for this in stating that licensees must maintain the application of this 

10 criterion unless the integrated safety analysis (ISA) demonstrates that it is not relied on for 

11 safety or otherwise does not require adherence. 

12

13 The presence of two controls may not be necessary, or may not be sufficient, to meet the DCP. 

14 The DCP does not necessarily require two controls; it requires “at least two...changes in 

15 process conditions” be needed before criticality is possible. Meeting this may necessitate one, 

16 two, or more than two controls depending on the possible conditions that can lead to criticality. 

17 In general, there will be many pathways to criticality and, therefore, more than two controls 

18 required to meet the DCP for an entire process.

19

20 In addition, § 70.64(b)(1) requires that the design must incorporate, whenever practicable, 

21 preference for the selection of engineered over administrative controls to increase overall 

22 system reliability. Passive engineered controls are generally preferable to active engineered 

23 controls, and engineered to administrative controls. In addition, process design should rely on 

24 geometry control as opposed to control of other parameters whenever practicable, and on 

25 diverse means of control (e.g., reliance on two different criticality parameters or different means 

26 of controlling one parameter) whenever practicable, to minimize the potential for common-mode 

27 failure. Cases in which these preferences cannot be complied with will generally require more 

28 justification to show adherence with the DCP. For example, one cannot claim that the double 

29 contingency principle is met with only two controls (regardless of type) if the resulting 

30 configuration fails to protect against all credible pathways to criticality or limit the risk of 

31 inadvertent criticality as required in 10 CFR 70.61(d).

32

33

34 Relationship between § 70.61 and § 70.64(a)(9)

35

36 As stated above, adherence to the DCP can be one means of meeting the performance 

37 requirements of § 70.61(d) (and, therefore, also § 70.61(b)). Historically, a number of different 

38 approaches to double contingency have been used. Some cases that have been used in the 

39 past may not be sufficiently robust to satisfy the performance requirements of § 70.61. 

40 Typically, this has been due to a reliance on controls that were not sufficiently robust (e.g., weak 

41 administrative controls). The purpose of this guidance is not to promote a new standard for all 

42 applications but rather to clarify when adherence to the DCP will establish a sufficient basis for 

43 meeting the performance requirements. To facilitate this, the following guidance is provided on 

44 the various terms in the definition of the DCP:

45

46 Unlikely changes in process conditions should be expected to occur rarely, or not at all, during 

47 the lifetime of the facility. Operational events that occur regularly should not be credited as a 

48 contingency relied on to meet the DCP (although they may constitute part of a contingency if a 

49 combination of events may be considered unlikely). Therefore, the occurrence of any such 
May 2014 5-A-7 NUREG-1520, Revision 2

1 event generally reveals a deficiency in the design that should result in corrective action. 

2 Determination that a contingency is unlikely should be based on objective attributes of the 

3 criticality controls, rather than on subjective judgment alone. Examples of such attributes are 

4 environmental factors that can degrade the reliability and availability of controls, margin, and 

5 redundancy and diversity of controls. (Guidance on some of the availability and reliability 

6 qualities that should be considered is provided in Section 3.4.3.2(9) of this SRP and NUREG7 1718, “Standard Review Plan for the Review of a License Application for a Mixed Oxide (MOX) 

8 Fuel Fabrication Facility,” Section 5.4.3.2(B)(vii).) Management measures should be provided, 

9 as needed, to ensure that the failure of the criticality controls is an unlikely contingency. (NOTE: 

10 Usage of the term “unlikely” in the DCP is not equivalent to the term as used in § 70.61(c) for 

11 intermediate consequence events.)

12

13 Independent changes in process conditions are such that one contingency neither causes 

14 another contingency nor increases its likelihood of occurrence. The existence of any credible 

15 common-mode failure of both contingencies means that it is not valid to consider them

16 independent. For example, related actions performed by the same individual or using the same 

17 equipment will not generally be sufficiently independent to meet the DCP.

18

19 Concurrent does not mean that the two changes in process conditions must occur 

20 simultaneously, but that the effect of the first contingency persists until the second contingency 

21 occurs. Prompt detection and correction of abnormal conditions should thus be provided to 

22 restore double contingency protection. The time required to detect and correct failures should 

23 be significantly shorter than the anticipated time between failures in order for there to be 

24 significant risk reduction provided from failure detection.

25

26 Changes in process conditions do not imply that reliance on two different parameters is 

27 mandatory to meet the DCP. Reliance on two different parameters is preferable to reliance on 

28 two controls on a single parameter, however, because of the difficulty in achieving complete 

29 independence when controlling one parameter. In those cases in which single parameter 

30 control is unavoidable, great care should be taken to ensure that no common-mode failures 

31 exist.

32

33 In addition to meeting the above, the following guidance is provided to illustrate the conditions 

34 under which adherence to the double contingency principle (in terms of the guidance above) is 

35 sufficient to meet the performance requirement of 10 CFR 70.61:

36 • Controls are established on system parameters to preclude changes in process 

37 conditions, and these controls are designated as IROFS in accordance with § 70.61(e). 

38 (Reliance should be based on items that are designated as IROFS in the ISA Summary 

39 and not on random factors that may or may not be maintained.)

40

41 • The condition resulting from the failure of a leg of double contingency has been shown to 

be subcritical with an acceptable margin (e.g., keff 42 is less than USL, parameters are 

43 within subcritical limits specified in the license or endorsed standards).

44

45 • Controls are sufficiently reliable to ensure that each change in process conditions 

46 necessary for criticality is “unlikely.” Management measures are established to ensure 

47 that they are available and reliable to perform their safety function.

48

49 Because the DCP is only one means of meeting the performance requirements, it is possible to

50 meet the DCP without meeting the conditions above (including designating criticality controls as 
May 2014 5-A-8 NUREG-1520, Revision 2

1 IROFS in the ISA Summary). In this case, however, another method must be relied on to meet 

2 the § 70.61 performance requirements. However, in order to use compliance with the DCP as 

3 part of the demonstration of meeting the § 70.61 performance requirements, these conditions 

4 should be met.

5 Some specific examples of control systems that meet § 70.61(d) through use of the DCP follow:

6

7 A passive geometry control in which no credible failure mode (e.g., bulging, corrosion, or 

8 leakage) exists and which has been placed under configuration management:

9

10 • A favorable geometry vessel in a benign environment in which corrosion or other 

11 material degradation is not credible. In addition, the vessel is of such robust 

12 construction (e.g., thick stainless steel, steel surrounded by concrete) that it is 

13 unquestionably not going to leak, and there is no credible mechanism for the material to 

14 accumulate in an unfavorable configuration.

15

16 • A tank that is not authorized to contain fissile material is located far outside the fissile 

17 material handling areas and is physically isolated from fissile liquid processes by a blank 

18 flange or siphon break, such that backflow is not credible.

19

20 Two passive controls in which there is a credible failure mode, and there are sufficient 

21 management measures to ensure the controls continue to perform their safety functions (e.g., 

22 periodic surveillance to detect corrosion/bulging):

23

24 • A favorable geometry solution column, in which leakage of the tank is a credible upset. 

25 In addition, the column is in an area in which the solution would leak into a favorable 

26 geometry dike, and the leakage would be self-revealing (i.e., column is in a continually 

27 manned area) or the column and dike would be subject to periodic surveillance.

28

29 • A double-sleeved solution line in which leakage of the inner pipe would be quickly 

30 detected (e.g., by conductivity probe between the pipes or by transparent baffling).

31

32 • A storage array in which fissile material is stored in fixed geometry containers, and the 

33 spacing between containers is fixed by birdcages or other fixed devices, and geometry 

34 and spacing controls are ensured by configuration management and periodic 

35 walkthroughs.

36

37 One passive control under configuration management and one active engineered control whose 

38 reliability is ensured by periodic functional testing, maintenance, and an alarm to automatically 

39 indicate its failure:

40

41 • A calciner relying on geometry and moderation control in which geometry control is 

42 provided by limiting the calciner interior to the height of a single layer of pellet boats, and 

43 moderation control is provided by monitoring of the calciner temperature. Temperature 

44 control is ensured by thermocouples that alarm if the temperature drops below a 

45 minimum set-point.

46

47 • A down-blending tank that is subcritical for uranium solutions with less than a limiting 

48 enrichment in which volume control is provided by the design of the tank and enrichment 
May 2014 5-A-9 NUREG-1520, Revision 2

1 control is provided using mass flow totalizers and a mechanical stirrer. The failure of 

2 these active devices automatically stops the transfer of solution and actuates an alarm.

3

4 • A large geometry tank relying on raschig rings for criticality control in which the raschig 

5 rings are only approved up to a limiting concentration, and the concentration is controlled 

6 by an in-line sodium iodide detector that closes an isolation valve when actuated.

7

8 One engineered and one enhanced administrative control in which the instrumentation and 

9 devices included in the administrative control are subject to periodic functional testing and 

10 maintenance, and the operator action is performed routinely or reinforced by periodic drills and 

11 training:

12

13 • A powder handling glovebox relying on moderator and mass control in which moderator 

14 control is provided by the glovebox design (e.g., airtight, dry nitrogen atmosphere, 

15 sloped ventilation ductwork) and mass is procedurally controlled by limiting batch size. 

16 In addition, mass transfers must be logged into a computer tracking system that alarms if 

17 mass limits are exceeded.

18

19 • A vessel in which the volume of fissile solution is controlled by the diameter of the tank 

20 and by procedurally limiting the solution height. In addition, operator actions are backed 

21 up with a high-level switch equipped with an alarm.

22

23 One engineered control and one simple administrative control in which the reliability of the 

24 administrative control is subject to a high degree of redundancy:

25

26 • Solution transfer from favorable to unfavorable geometry relying on two controls on 

27 concentration. Two different operators are required to draw separate samples which are 

28 then analyzed in the laboratory by two different methods and shown to be within 

29 concentration limits before transfer is authorized. In addition, the area supervisor 

30 maintains control of a key to the transfer pump so that the procedure may not be 

31 inadvertently bypassed. This is backed up with an in-line sodium iodide detector that 

32 automatically closes an isolation valve if concentration limits are exceeded.

33

34 (NOTE: Use of two independent samples is generally not considered adequate for both legs 

35 of double contingency because of the difficulty in ensuring complete independence between 

36 the samples.)

37

38 Two administrative controls that are independent (e.g., performed by different individuals or 

39 verified by a supervisor), for which human factors have been considered in the design of the 

40 process such that the operation is not prone to error, and there is sufficient margin to require 

41 multiple failures before the criticality control limit can be exceeded:

42

43 • A glovebox relying on dual mass control in which two operators or an operator and a 

44 supervisor must confirm that placing material into the glovebox will not result in the mass 

45 limit being exceeded. In addition, criticality would require the mass limit to be exceeded 

46 multiple times, which would be difficult to achieve and would be readily apparent.

47

48 • A drum storage array limited to a vertical stack of four drums in which there are no 

49 forklifts in the area capable of raising a drum above this height. In addition, the drums 
May 2014 5-A-10 NUREG-1520, Revision 2

1 are very heavy and violating the stack height limit would require an immense physical 

2 effort.

3

4 • A planar storage array in which mass-controlled containers are procedurally limited to 

5 not less than 24 inches center-to-center, and in which criticality would require 

6 assembling a very large number of containers into a spherical heap and reflecting them 

7 intimately with water.

8 Other considerations ensuring that there is no credible event leading to criticality:

9

10 • A facility handling uranium enriched to no more than 1 weight percent (wt%) uranium235 (235 11 U).

12

13 • A facility in which the site-wide limit is less than a minimum critical mass.

14

15 • A facility storing contaminated soil or equipment with a very low uranium concentration in 

16 which there is no known concentration mechanism that can lead to a critical 

17 configuration.

18

19 Some examples of control systems that would not meet § 70.61(d) through use of the DCP:

20

21 Double contingency consisting of two single operator actions without any supervisor verification 

22 or redundancy:

23

24 • Solution transfers that rely only on two operators drawing separate samples or in which 

25 a single procedural deviation could cause an unauthorized transfer.

26

27 • A mass controlled system in which triple batching (i.e., two successive batching errors) 

28 could result in criticality when the mass transfers are done by a single operator.

29

30 • A storage array in which two violations on administrative spacing requirements could 

31 credibly lead to criticality.

32

33 A leg of double contingency consisting of an administrative control for which correct 

34 performance of the action cannot be readily confirmed or is subjective:

35

36 • A solution vessel in which the operator is required to confirm concentration or chemical 

37 form by visually observing a color change in the solution.

38

39 • A tank in which the operator is required to verify prior to operation that the tank is 

40 “essentially empty.”

41

42 A leg of double contingency consisting of complex administrative tasks composed of multiple 

43 steps that are susceptible to error:

44

45 • A glovebox in which the operator is required to calculate the mass of plastic, paper, and 

46 other miscellaneous materials in order to comply with moderator control.

47

48 • A solution transfer operation in which one leg consists solely on a single sample being 
May 2014 5-A-11 NUREG-1520, Revision 2

1 correctly drawn, labeled, analyzed, recorded, and read.

2

3 • Maintenance on a dissolution process in which criticality safety relies on the correct 

4 performance of a procedure to replace an in-line filter. The procedure requires that the 

5 filter be removed, flushed, and re-installed in a multi-step process that has several 

6 opportunities for failure.

7 A leg of double contingency consisting of an administrative control with insufficient margin to 

8 ensure that the safety limit will not be exceeded:

9

10 • A glovebox in which mass is controlled administratively, and in which the normal mass 

11 limit is almost equal to the minimum critical mass.

12

13 • A planar storage array in which spacing between containers is administratively limited to 

14 be less than 24 inches center-to-center, and in which criticality will result if a few 

15 containers are placed 23 inches apart.

16

17 A leg of double contingency consisting of an engineered control in which there is no reasonable 

18 means to detect and correct the failure within a given time.

19

20 • A solution process in which it is plausible for concentrated solution to be allowed to 

21 accumulate undetected over a long period of time in an unfavorable geometry.

22

23 • A vessel in which geometry control is provided by a double wall, but there is no means of 

24 detecting leakage between the walls. In addition, the vessel is of a type known to have a 

25 history of leakage (e.g., heat exchanger).

26

27 A leg of double contingency consisting of a control in an environment where its safety function is 

28 degraded.

29

30 • A solution vessel relied on for geometry control, but which is subject to pressure 

31 fluctuations that can cause the vessel to bulge beyond a favorable diameter.

32

33 • Instrumentation whose performance is degraded under conditions that can be 

34 reasonably expected during normal operations (e.g., temperature, pressure, presence of 

35 corrosive gases, or loss of essential utilities such as electricity, plant air, or water).

36

37 A leg of double contingency consisting of a control where its behavior under adverse conditions 

38 is uncertain.

39

40 • An unfavorable geometry pump in which mass control relies on the presumption that the 

41 pump will malfunction before an unsafe volume of uranium accumulates in the pump oil, 

42 and for which no failures of this type have been observed.

43

44 A leg of double contingency consisting of undeclared design features or process conditions that 

45 are not precluded by being explicitly controlled.

46

47 • A powder blending operation in which uranium oxide density that is less than the 

48 theoretical density is assumed, but the process variables affecting density (e.g., 
May 2014 5-A-12 NUREG-1520, Revision 2

1 calcinations temperature, mechanical pressure of the pellet press) are not specifically 

2 controlled and there is no confirmatory sampling.

3

4 • A solvent extraction process in which nominal concentration of uranyl nitrate is assumed, 

5 but there is no in-line monitoring or confirmatory sampling.

6

7 • A vault in which the mass limit is not controlled by procedure or license limit, but is 

8 merely based on current inventory.

9

10 • A process relying on the favorable geometry of passive equipment, but for which the 

11 dimensions and/or material composition are not specifically identified as criticality 

12 controls.

13

14 This list is merely illustrative and not meant to be exhaustive. However, these examples 

15 demonstrate that double contingency that satisfies the performance requirements can be based 

16 on one, two, or more than two passive engineered, active engineered, or administrative 

17 controls, and that reliability and availability of those controls depends on management 

18 measures, safety margins, environmental conditions, human factors, and other process and 

19 control characteristics. Not every application similar to these examples will be found 

20 acceptable—determination must be made on the totality of the information available, and an 

21 analyst should consider all factors that may degrade the robustness of the controls.

22

23 Technical Review Guidance

24

25 Relationship of 10 CFR 70.61(b) and 10 CFR 70.61(d)

26

27 The reviewer needs to assure that all applicable 10 CFR Part 70 criticality provisions (including 

28 § 70.62(c)) are met. To meet the regulations and prevent criticalities an applicant/licensee may 

29 use one of the three approaches below (in conjunction with other 10 CFR Part 70 requirements, 

30 including those in § 70.62):

31

32 1. Demonstrate compliance with § 70.61(d); or 

33

34 2. Demonstrate compliance with § 70.61(b), considering only preventive controls and 

35 including an approved margin of subcriticality; or

36

37 3. Separately demonstrate compliance with both § 70.61(d) and § 70.61(b).

38

39 Use of any of the above three approaches will satisfy the regulations. 

40

41 Staff should not dictate which of the above three options must be met; rather, staff should 

42 assure that the applicant/licensee has met one of these options. 

43

44 Double Contingency Principle

45

46 One way, but not the only way, of meeting 10 CFR 70.61 is by applying the double contingency 

47 principle (defined in 10 CFR 70.4) to accident sequences leading to criticality that are required 

48 to be developed per § 70.62. Adherence to the DCP will satisfy the performance requirement of 

49 § 70.61(d) (and therefore also § 70.61(b)) provided the following conditions are met:
May 2014 5-A-13 NUREG-1520, Revision 2

12

3 • Controls are established on system parameters to preclude changes in process 

4 conditions, and these controls are designated as IROFS in accordance with § 70.61(e). 

5 (Reliance should be based on items that are designated as IROFS in the ISA Summary 

6 and not on random factors that may or may not be maintained.)

7

8 • The condition resulting from the failure of a leg of double contingency has been shown to 

be subcritical with an acceptable margin (e.g., keff 9 is less than USL, parameters are 

10 within subcritical limits specified in the license or endorsed standards).

11

12 • Controls are sufficiently reliable to ensure that each change in process conditions 

13 necessary for criticality is “unlikely.” Management measures are established to ensure 

14 that they are available and reliable to perform their safety function.

15

16 In the absence of meeting these conditions, an alternate demonstration of compliance with the 

17 performance requirements should be provided.

May 2014 5-B-1 NUREG-1520, Revision 2

APPENDIX B

JUSTIFICATION FOR MINIMUM MARGIN OF SUBCRITICALITY FOR 

SAFETY

1 Purpose

2

3 This appendix provides additional guidance for the minimum margin of subcriticality for safety. 

4 These evaluations are used in demonstrating compliance with the performance requirements of 

5 Title 10 of the Code of Federal Regulations (10 CFR) 70.61, “Performance Requirements.”

6

7 Introduction

8

9 The regulation in 10 CFR 70.61(d) requires, in part, that licensees or applicants (henceforth to 

10 be referred to as “licensees”) demonstrate that “under normal and credible abnormal conditions, 

11 all nuclear processes are subcritical, including use of an approved margin of subcriticality for 

12 safety.” There are a variety of methods that may be used to demonstrate subcriticality, including 

13 use of industry standards, handbooks, hand calculations, and computer methods. Subcriticality 

14 is assured, in part, by providing margin between actual conditions and expected critical 

15 conditions. This appendix, however, applies only to margin used in those methods that rely on 

16 calculation of keff, including deterministic and probabilistic computer methods. The use of other 

17 methods (e.g., use of endorsed industry standards, widely accepted handbooks, certain hand 

18 calculations), containing varying amounts of margin, is outside the scope of this appendix.

19

20 For methods relying on calculation of keff, margin may be provided either in terms of limits on 

21 physical parameters of the system (of which keff is a function), or in terms of limits on keff directly, 

22 or both. For the purposes of this appendix, the term margin of safety will be used to refer to the 

23 margin to criticality in terms of system parameters, and the term margin of subcriticality (MoS) 

24 will refer to the margin to criticality in terms of keff. A common approach to ensuring subcriticality 

25 is to determine a maximum keff limit below which the licensee’s calculations must fall. This limit 

26 will be referred to in this appendix as the Upper Subcritical Limit (USL). Licensees using 

27 calculational methods perform validation studies, in which critical experiments similar to actual 

28 or anticipated facility applications are chosen and then analyzed to determine the bias and 

29 uncertainty in the bias. The bias is a measure of the systematic differences between 

30 calculational method results and experimental data. The uncertainty in the bias is a measure of 

31 both the accuracy and precision of the calculations and the uncertainty in the experimental data. 

32 A USL is then established that includes allowances for bias and bias uncertainty as well as an 

33 additional margin, to be referred to in this appendix as the minimum margin of subcriticality

34 (MMS). The MMS is variously referred to in the nuclear industry as minimum subcritical margin, 

35 administrative margin, and arbitrary margin, and the term MMS should be regarded as 

36 synonymous with those terms. The term MMS will be used throughout this appendix, and has 

37 been chosen for consistency with the rule. The MMS is an allowance for any unknown (or 

38 difficult to identify or quantify) errors or uncertainties in the method of calculating keff that may 

39 exist beyond those which have been accounted for explicitly in calculating the bias and its 

40 uncertainty.

41

42 There is little guidance in the fuel facility Standard Review Plans (SRPs) as to what constitutes 

43 sufficient technical justification for the MMS. NUREG-1520, “Standard Review Plan for the 

44 Review of a License Application for a Fuel Cycle Facility,” Section 5.4.3.4.4, states that there 
May 2014 5-B-2 NUREG-1520, Revision 2

1 must be margin that includes, among other uncertainties, “adequate allowance for uncertainty in 

2 the methodology, data, and bias to assure subcriticality.” An important component of this overall 

3 margin is the MMS. However, there has been almost no guidance on how to determine an 

4 appropriate MMS. Partly due to the lack of historical guidance, and partly due to differences 

5 between facilities’ processes and methods of calculation, there have been significantly different 

6 MMS values approved for the various fuel cycle facilities over time. In addition, the different 

7 ways licensees have of defining margins and calculating keff limits have made a consistent 

8 approach to reviewing keff limits difficult. Recent licensing experience has highlighted the need 

9 for further guidance to clarify what constitutes an acceptable justification for the MMS. 

10

11 The MMS can have a substantial effect on facility operations (e.g., storage capacity, throughput) 

12 and there has, therefore, been considerable recent interest in decreasing margin in keff below 

13 what has been licensed previously. In addition, the increasing sophistication of computer codes 

14 and the ready availability of computing resources means that there has been a gradual move 

15 towards more realistic (often resulting in less conservative) modeling of process systems. The 

16 increasing interest in reducing the MMS and the reduction in modeling conservatism make 

17 technical justification of the MMS more risk-significant than it has been in the past. In general, 

18 consistent with a risk-informed approach to regulation, a smaller MMS requires a more 

19 substantial technical justification.

20

21 This appendix is only applicable to fuel enrichment and fabrication facilities licensed under 10 

22 CFR Part 70.

23

24 Discussion

25

26 This guidance is applicable to evaluating the MMS in methods of evaluation that rely on 

27 calculation of keff. The keff value of a fissionable system depends, in general, on a large number 

28 of physical variables. The factors that can affect the calculated value of keff may be broadly 

29 divided into the following categories: (1) the geometric configuration; (2) the material 

30 composition; and (3) the neutron distribution. The geometric form and material composition of 

31 the system–together with the underlying nuclear data (e.g., ν, χ(E), cross section data)–

32 determine the spatial and energy distribution of neutrons in the system (flux and energy 

33 spectrum). An error in the nuclear data or the geometric or material modeling of these systems 

34 can produce an error in the neutron flux and energy spectrum, and thus in the calculated value 

35 of keff. The bias associated with a single system is defined as the difference between the 

36 calculated and physical values of keff, by the following equation:

37

β = kcalc − kphysical

38

39 Thus, determining the bias requires knowing both the calculated and physical keff values of the 

40 system. The bias associated with a single critical experiment can be known with a high degree 

41 of confidence, because the physical (experimental) value is known a priori (kphysical ~1). However, 

42 for calculations performed to demonstrate subcriticality of facility processes (to be referred to as 

43 “applications”), this is not generally the case. The bias associated with such an application (i.e., 

44 not a known critical configuration) is not typically known with this same high degree of 

45 confidence, because the actual physical keff of the system is usually not known. In practice, the 

46 bias is determined from the average calculated keff for a set of experiments that cover different 

47 aspects of the licensee’s applications. The bias and its uncertainty must be estimated by 

48 calculating the bias associated with a set of critical experiments having geometric forms, 

49 material compositions, and neutron spectra similar to those of the application. Because of the 
May 2014 5-B-3 NUREG-1520, Revision 2

1 large number of factors that can affect the bias, and the finite number of critical experiments 

2 available, staff should recognize that this is only an estimate of the true bias of the system. The 

3 experiments analyzed cannot cover all possible combinations of conditions or sources of error 

4 that may be present in the applications to be evaluated. The effect on keff of geometric, material, 

5 or spectral differences between critical experiments and applications cannot be known with 

6 precision. Therefore, an additional margin (MMS) must be applied to allow for the effects of any 

7 unknown uncertainties that may exist in the calculated value of keff beyond those accounted for 

8 in the calculation of the bias and its uncertainty. As the MMS decreases, there needs to be a 

9 greater level of assurance that the various sources of bias and uncertainty have been taken into 

10 account, and that the bias and uncertainty are known with a high degree of accuracy. In 

11 general, the more similar the critical experiments are to the applications, the more confidence 

12 there is in the estimate of the bias and the less MMS is needed.

13

14 In determining an appropriate MMS, the reviewer should consider the specific conditions and 

15 process characteristics present at the facility in question. However, the MMS should not be 

16 reduced below 0.02. The nuclear cross sections are not generally known to better than -1-2%. 

17 While this does not necessarily translate into a 2% Δkeff, it has been observed over many years 

18 of experience with criticality code validation that biases and spreads in the data of a few percent 

19 can be expected. As stated in NUREG-1520, MoS should be large compared to the uncertainty 

20 in the bias. Moreover, errors in the criticality codes have been discovered over time that have 

21 produced keff differences of roughly this same magnitude of 1-2% (e.g., Information Notice 2005-

22 13, “Potential Non-Conservative Error in Modeling Geometric Regions in the KENO-V.a 

23 Criticality Code”). While the possibility of having larger undiscovered errors cannot be entirely 

24 discounted, modeling sufficiently similar critical experiments with the same code options to be 

25 used in modeling applications should minimize the potential for this to occur. However, many 

26 years of experience with the typical distribution of calculated keff values and with the magnitude 

27 of code errors that have occasionally surfaced support establishing 0.02 as the minimum MMS 

28 that should be considered acceptable under the best possible conditions.

29

30 Staff should recognize the important distinction between ensuring that processes are safe and 

31 ensuring that they are adequately subcritical. The value of keff is a direct indication of the degree 

32 of subcriticality of the system, but is not fully indicative of the degree of safety. A system that is 

33 very subcritical (i.e., with keff «1) may have a small margin of safety if a small change in a 

34 process parameter can result in criticality. An example of this would be a UO2 powder storage 

35 vessel, which is subcritical when dry, but may require only the addition of water for criticality. 

36 Similarly, a system with a small MoS (i.e., with keff ~1) may have a very large margin of safety if 

37 it cannot credibly become critical. An example of this would be a natural uranium system in light 

38 water, which may have a keff value close to 1 but will never exceed 1. Because of this, a 

39 distinction should be made between the margin of subcriticality and the margin of safety. 

40 Although a variety of terms are in use in the nuclear industry, the term margin of subcriticality 

41 will be taken to mean the difference between the actual (physical) value of keff and the value of 

42 keff at which the system is expected to be critical. The term margin of safety will be taken to 

43 mean the difference between the actual value of a parameter and the value of the parameter at 

44 which the system is expected to be critical. The MMS is intended to account for the degree of 

45 confidence that applications calculated to be subcritical will be subcritical. It is not intended to 

46 account for other aspects of the process (e.g., safety of the process or the ability to control 

47 parameters within certain bounds) that may need to be reviewed as part of an overall licensing 

48 review.

49
May 2014 5-B-4 NUREG-1520, Revision 2

1 There are a variety of different approaches that a licensee could choose in justifying the MMS. 

2 Some of these approaches and means of reviewing them are described in the following 

3 sections, in no particular preferential order. Many of these approaches consist of qualitative 

4 arguments, and therefore there will be some degree of subjectivity in determining the adequacy 

5 of the MMS. Because the MMS is an allowance for unknown (or difficult to identify or quantify) 

6 errors, the reviewer must ultimately exercise his or her best judgement in determining whether a 

7 specific MMS is justified. Thus, the topics listed below should be regarded as factors the 

8 reviewer should take into consideration in exercising that judgement, rather than any kind of 

prescriptive checklist.1 9

10

11 The reviewer should also bear in mind that the licensee is not required to use any or all of these 

12 approaches, but may choose an approach that is applicable to its facility or a particular process 

13 within its facility. While it may be desirable and convenient to have a single keff limit or MMS 

14 value (and single corresponding justification) across an entire facility, it is not necessary for this 

15 to be the case. The MMS may be easier to justify for one process than for another, or for a 

16 limited application versus generically for the entire facility. The reviewer should expect to see 

17 various combinations of these approaches, or entirely different approaches, used, depending on 

18 the nature of the licensee’s processes and methods of calculation. Any approach used must 

19 ultimately lead to a determination that there is adequate assurance of subcriticality.

20

21

22 (1) Conservatism in the Calculational Models

23

24 The margin in keff produced by the licensee’s modeling practices, together with the MMS, 

25 provide the margin between actual conditions and expected critical conditions. In terms of the 

26 subcriticality criterion taken from ANSI/ANS-8.17-2004, “Criticality Safety Criteria for the 

27 Handling, Storage, and Transportation of LWR Fuel Outside Reactors” (as explained in 

28 Appendix A): 

MoS ≥ ∆km + ∆ksa

29

30 where Δkm is the MMS and Δksa is the margin in keff due to conservative modeling of the system 

31 (i.e., conservative values of system parameters).

32

33 Two different applications for which the sums on the right hand side of the equation above are 

34 equal to each other are equally subcritical. Assurance of subcriticality may thus be provided by 

35 specifying a margin in keff (Δkm), or specifying conservative modeling practices (Δksa), or some 

36 combination thereof. This principle will be particularly useful to the reviewer evaluating a 

37 proposed reduction in the currently approved MMS; the review of such a reduction should prove 

38 straightforward in cases in which the overall combination of modeling conservatism and MMS 

39 has not changed. Because of this straightforward quantitative relationship, any modeling 

40 conservatism that has not been previously credited should be considered before examining 

41 other factors. Cases in which the overall MoS has decreased may still be acceptable, but would 

42 have to be justified by other means.

43

 1

 In the discussion of these factors, the purpose is not to impose any new requirements or standards for acceptability on 

licensees. However, in many cases it will be necessary to go beyond the minimum requirements for a given factor, if that 

factor is being used as part of the technical basis for justifying a smaller MMS than would otherwise be acceptable.
May 2014 5-B-5 NUREG-1520, Revision 2

1 In evaluating justification for the MMS relying on conservatism in the model, the reviewer should 

2 consider only that conservatism in excess of any manufacturing tolerances, uncertainties in 

3 system parameters, or credible process variations. That is, the conservatism should consist of 

4 conservatism beyond the worst-case normal or abnormal conditions, as appropriate, including 

5 allowance for any tolerances. Examples of this added conservatism may include assuming 

6 optimum concentration in solution processes, neglecting neutron absorbers in structural 

7 materials, or assuming minimum reflector conditions (e.g., at least a 1-inch, tight-fitting reflector 

8 around process equipment). These technical practices used to perform criticality calculations 

9 generally result in conservatism of at least several percent in keff. To credit this as part of the 

10 justification for the MMS, the reviewer should have assurance that the modeling practices 

11 described will result in a predictable and dependable amount of conservatism in keff. In some 

12 cases, the conservatism may be process-dependent, in which case it may be relied on as 

13 justification for the MMS for a particular process. However, only modeling practices that result in 

14 a global conservatism across the entire facility should be relied on as justification for a sitewide 

15 MMS. Ensuring predictable and dependable conservatism includes verifying that this 

16 conservatism will be maintained over the facility lifetime, such as through the use of license 

17 commitments or conditions.

18

19 If the licensee has a program that establishes operating limits (to ensure that subcritical limits 

20 are not exceeded) below subcritical limits determined in nuclear criticality safety evaluations, the 

21 margin provided by this (optional) practice may be credited as part of the conservatism. In such 

22 cases, the reviewer should credit only the difference between operating and subcritical limits 

23 that exceeds any tolerances or process variation, and should ensure that operating limits will be 

24 maintained over the facility lifetime, through the use of license commitments or conditions.

25

26 Some questions that the reviewer may ask in evaluating the use of modeling conservatism as 

27 justification for the MMS include:

28

29 • How much margin in keff is provided due to conservatism in modeling practices?

30

31 • How much of this margin exceeds allowance for tolerances and process variations?

32

33 • Is this margin specific to a particular process or does it apply to all facility processes?

34

35 • What provides assurance that this margin will be maintained over the facility lifetime?

36

37 (2) Validation Methodology and Results

38

39 Assurance of subcriticality for methods that rely on the calculation of keff requires that those 

40 methods be appropriately validated. One of the goals of validation is to determine the method’s 

41 bias and the uncertainty in the bias. After this has been done, an additional margin (MMS) is 

42 specified to account for any additional uncertainties that may exist. The appropriate MMS 

43 depends, in part, on the degree of confidence in the validation results. Having a high degree of 

44 confidence in the bias and bias uncertainty requires both that there be sufficient (for the 

45 statistical method used) applicable benchmark-quality experiments and that there be a rigorous 

46 validation methodology. Critical experiments that do not rise to the level of benchmark-quality 

47 experiments may also be acceptable, but may require additional margin. If either the data or the 

48 methodology is deficient, a high degree of confidence in the results cannot be attained, and a 

49 larger MMS may need to be employed than would otherwise be acceptable. Therefore, although 
May 2014 5-B-6 NUREG-1520, Revision 2

1 validation and determining the MMS are separate exercises, they are related. The more 

2 confidence one has in the validation results, the less additional margin (MMS) is needed. The 

3 less confidence one has in the validation results, the more MMS is needed.

4

5 Any review of a licensing action involving the MMS should involve examination of the licensee’s 

6 validation methodology and results. While there is no clear quantifiable relationship between the 

7 validation and MMS (as exists with modeling conservatism), several aspects of validation should 

8 be considered before making a qualitative determination of the adequacy of the MMS.

9

10 There are four factors that the reviewer should consider in evaluating the validation: (1) the 

11 similarity of critical experiments to actual applications; (2) sufficiency of the data (including the 

12 number and quality of experiments); (3) adequacy of the validation methodology; and (4) 

13 conservatism in the calculation of the bias and its uncertainty. These factors are discussed in 

14 more detail below.

15

16 Similarity of Critical Experiments

17

18 Because the bias and its uncertainty must be estimated based on critical experiments having 

19 geometric form, material composition, and neutronic behavior similar to specific applications, the 

20 degree of similarity between the critical experiments and applications is a key consideration in 

21 determining the appropriateness of the MMS. The more closely critical experiments represent 

22 the characteristics of applications being validated, the more confidence the reviewer has in the 

23 estimate of the bias and the bias uncertainty for those applications.

24

25 The reviewer must understand both the critical experiments and applications in sufficient detail 

26 to ascertain the degree of similarity between them. Validation reports generally contain a 

27 description of critical experiments (including source references). The reviewer may need to 

28 consult these references to understand the physical characteristics of the experiments. In 

29 addition, the reviewer may need to consult process descriptions, nuclear criticality safety 

30 evaluations, drawings, tables, input files, or other information to understand the physical 

31 characteristics of applications. The reviewer must consider the full spectrum of normal and 

32 abnormal conditions that may have to be modeled when evaluating the similarity of the critical 

33 experiments to applications.

34

35 In evaluating the similarity of experiments to applications, the reviewer must recognize that 

36 some parameters are more significant than others to accurately calculate keff. The parameters 

37 that have the greatest effect on the calculated keff of the system are those that are most 

38 important to match when choosing critical experiments. Because of this, there is a close 

39 relationship between similarity of critical experiments to applications and system sensitivity. 

40 Historically, certain parameters have been used to trend the bias because these are the 

41 parameters that have been found to have the greatest effect on the bias. These parameters 

include the moderator-to-fuel ratio (e.g., H/U, H/X, vm/vf 42 ), isotopic abundance (e.g., uranium-235 

(

235U), plutonium-239 (239 43 Pu), or overall Pu-to-uranium ratio), and parameters that characterize 

44 the neutron energy spectrum (e.g., energy of average lethargy causing fission (EALF), average 

45 energy group (AEG)). Other parameters, such as material density or overall geometric shape, 

46 are generally considered to be of less importance. The reviewer should consider all important 

47 system characteristics that can reasonably be expected to affect the bias. For example, the 

48 critical experiments should include any materials that can have an appreciable effect on the 

49 calculated keff, so that the effect due to the cross sections of those materials is included in the 

50 bias. Furthermore, these materials should have at least the same reactivity worth in the 
May 2014 5-B-7 NUREG-1520, Revision 2

1 experiments (which may be evidenced by having similar number densities) as in the 

2 applications. Otherwise, the effect of any bias from the underlying cross sections or the 

3 assumed material composition may be masked in the applications. The materials must be 

4 present in a statistically significant number of experiments having similar neutron spectra to the 

5 application. Conversely, materials that do not have an appreciable effect on the bias may be 

6 neglected and would not have to be represented in the critical experiments.

7

8 Merely having critical experiments that are representative of applications is the minimum 

9 acceptance criterion, and does not alone justify having any particular value of the MMS. There 

10 are some situations, however, in which there is an unusually high degree of similarity between 

11 the critical experiments and applications, and in these cases, this fact may be credited as 

12 justification for having a smaller MMS than would otherwise be acceptable. If the critical 

13 experiments have geometric forms, material compositions, and neutron spectra that are nearly 

14 indistinguishable from those of the applications, this may be justification for a smaller MMS than 

15 would otherwise be acceptable. For example, justification for having a small MMS for finished 

16 fuel assemblies could include selecting critical experiments consisting of fuel assemblies in 

17 water, where the fuel has nearly the same pellet diameter, pellet density, cladding materials, 

18 pitch, absorber content, enrichment, and neutron energy spectrum as the licensee’s fuel. In this 

19 case, the validation should be very specific to this type of system, because including of the 

20 types of critical experiments could mask variations in the bias. Therefore, this type of 

21 justification is generally easiest when the area of applicability (AOA) is very narrowly defined.

22 The reviewer should pay particular attention to abnormal conditions. In this example, changes in 

23 process conditions such as damage to the fuel or partial flooding may significantly affect the 

24 applicability of the critical experiments.

25

26 There are several tools available to the reviewer to ascertain the degree of similarity between 

27 critical experiments and applications. Some of these are listed below:

28

29 1. NUREG/CR-6698, “Guide to Validation of Nuclear Criticality Safety Calculational Method,” 

30 Table 2.3, contains a set of screening criteria for determining the applicability of critical 

31 experiments. As is stated in the NUREG, these criteria were arrived at by consensus among 

32 experienced nuclear criticality safety specialists and may be considered to be conservative. The 

33 reviewer should consider agreement on all screening criteria to be justification for demonstrating 

34 a very high degree of critical experiment similarity. (Agreement on the most significant screening 

35 criteria for a particular system should be considered as demonstration of an acceptable degree 

36 of critical experiment similarity.) Less conservative (i.e., broader) screening criteria may also be 

37 acceptable, if appropriately justified.

38

39 2. Analytical methods that systematically quantify the degree of similarity between a set of 

40 critical experiments and applications in pair-wise fashion may be used. One example of this is 

41 the TSUNAMI code in the SCALE 5 code package. One strength of TSUNAMI is that it 

42 calculates an overall correlation that is a quantitative measure of the degree of similarity 

43 between an experiment and an application. Another strength is that this code considers all the 

44 nuclear phenomena and underlying cross sections and weights them by their importance to the 

45 calculated keff (i.e., sensitivity of keff to the data). The NRC staff currently considers a correlation 

46 coefficient of ck ~ 0.95 to be indicative of a very high degree of similarity. This is based on the 

47 staff’s experience comparing the results from TSUNAMI to those from a more traditional 

48 screening criterion approach. The NRC staff also considers a correlation coefficient between 

49 0.90 and 0.95 to be indicative of a high degree of similarity. However, owing to the amount of 

50 experience with TSUNAMI, in this range use of the code should be supplemented with other 
May 2014 5-B-8 NUREG-1520, Revision 2

1 methods of evaluating critical experiment similarity. Conversely, a correlation coefficient less 

2 than 0.90 should not be used as a demonstration of a high or very high degree of critical 

3 experiment similarity. Because of limited use of the code to date, all of these observations 

4 should be considered tentative and thus the reviewer should not use TSUNAMI as a “black 

5 box,” or base conclusions of adequacy solely on its use. However, it may be used to test a 

6 licensee’s statement that there is a high degree of similarity between experiments and 

7 applications.

8

9 3. Traditional parametric sensitivity studies may be employed to demonstrate that keff is highly 

sensitive or insensitive to a particular parameter. For example, if a 50% reduction in the 10 10 B 

11 cross section is needed to produce a 1% change in the system keff, then it can be concluded that 

12 the system is highly insensitive to the boron content, in the amount present. This is because a 

credible error in the 10 13 B cross section of a few percent will have a statistically insignificant effect 

14 on the bias. Therefore, in the amount present, the boron content is not a parameter that is 

15 important to match in order to conclude that there is a high degree of similarity between critical 

16 experiments and applications.

17

18 4. Physical arguments may demonstrate that keff is highly sensitive or insensitive to a particular 

19 parameter. For example, the fact that oxygen and fluorine are almost transparent to thermal 

20 neutrons (i.e., cross sections are very low) may justify why experiments consisting of UO2F2 may 

21 be considered similar to UO2 or UF4 applications, provided that both experiments and 

22 applications occur in the thermal energy range.

23

24 The reviewer should ensure that all parameters which can measurably affect the bias are 

25 considered when assessing critical experiment similarity. For example, comparison should not 

be based solely on agreement in the 235 26 U fission spectrum for systems in which the system keff is 

highly sensitive to 238U fission, 10B absorption, or 1 27 H scattering. A method such as TSUNAMI 

28 that considers the complete set of reactions and nuclides present can be used to rank the 

29 various system sensitivities, and to thus determine whether it is reasonable to rely on the fission 

30 spectrum alone in assessing the similarity of critical experiments to applications.

31

32 Some questions that the reviewer may ask in evaluating reliance on critical experiment similarity 

33 as justification for the MMS include:

34

35 • Do the critical experiments adequately span the range of geometric forms, material 

36 compositions, and neutron energy spectra expected in applications?

37

38 • Are the materials present with at least the same reactivity worth as in applications?

39

40 • Do the licensee’s criteria for determining whether experiments are sufficiently similar to 

41 applications consider all nuclear reactions and nuclides that can have a statistically 

42 significant effect on the bias?

43

44 Sufficiency of the Data

45

46 Another aspect of evaluating the selected critical experiments for a specific MMS is evaluating 

47 whether there is a sufficient number of benchmark-quality experiments to determine the bias 

48 across the entire AOA. Having a sufficient number of benchmark-quality experiments means

49 that: (1) there are enough (applicable) critical experiments to make a statistically meaningful 
May 2014 5-B-9 NUREG-1520, Revision 2

1 calculation of the bias and its uncertainty; (2) the experiments somewhat evenly span the entire 

2 range of all the important parameters, without gaps requiring extrapolation or wide interpolation; 

3 and (3) the experiments are, preferably, benchmark-quality experiments. The number of critical 

4 experiments needed is dependent on the statistical method used to analyze the data. For 

5 example, some methods require a minimum number of data points to reliably determine whether 

6 the data are normally distributed. Merely having a large number of experiments is not sufficient 

7 to provide confidence in the validation result, if the experiments are not applicable to the 

8 application. The reviewer should particularly examine whether consideration of only the most 

9 applicable experiments would result in a larger negative bias (and thus a lower USL) than that 

10 determined based on the full set of experiments. The experiments should also ideally be 

11 sufficiently well-characterized (including experimental parameters and their uncertainties) to be 

12 considered benchmark experiments. They should be drawn from established sources (such as 

13 from the International Handbook of Evaluated Criticality Safety Benchmark Experiments 

14 (IHECSBE), laboratory reports, or peer-reviewed journals). For some applications, benchmark 

15 quality experiments may not be available; when necessary, critical experiments that do not rise 

16 to the level of benchmark-quality experiments may be used. However, the reviewer should take 

17 this into consideration and should evaluate the need for additional margin.

18

19 Some questions that the reviewer may ask in evaluating the number and quality of critical 

20 experiments as justification for the MMS include:

21

22 • Are the critical experiments chosen all high-quality benchmarks from reliable (e.g., peer23 reviewed and widely-accepted) sources?

24

25 • Are the critical experiments chosen taken from multiple independent sources, to 

26 minimize the possibility of systematic errors?

27

28 • Have the experimental uncertainties associated with the critical experiments been 

29 provided and used in calculating the bias and bias uncertainty?

30

31 • Is the number and distribution of critical experiments sufficient to establish trends in the 

32 bias across the entire range of parameters?

33

34 • Is the number of critical experiments commensurate with the statistical methodology 

35 being used?

36

37 Validation Methodological Rigor

38

39 Having a sufficiently rigorous validation methodology means having a methodology that is 

40 appropriate for the number and distribution of critical experiments, that calculates the bias and 

41 its uncertainty using an established statistical methodology, that accounts for any trends in the 

42 bias, and that accounts for all apparent sources of uncertainty in the bias (e.g., the increase in 

43 uncertainty due to extrapolating the bias beyond the range covered by the experimental data.) 

44 Examples of deficiencies in the validation methodology may include: (1) using a statistical 

45 methodology relying on the data being normally distributed about the mean keff to analyze data 

46 that are not normally distributed; (2) using a linear regression fit on data that has a non-linear 

47 dependence on a trending parameter; (3) use of a single pooled bias when very different types 

48 of critical experiments are being evaluated in the same validation. These deficiencies serve to 
May 2014 5-B-10 NUREG-1520, Revision 2

1 decrease confidence in the validation results and may warrant additional margin (i.e., a larger 

2 MMS). Additional guidance on some of the more commonly observed deficiencies is provided 

3 below. The assumption that data is normally distributed is generally valid, unless there is a 

4 strong trend in the data or different types of critical experiments with different mean calculated 

5 keff values are being combined. Tests for normality require a minimum number of critical 

6 experiments to attain a specified confidence level (generally 95%). If there is insufficient data to 

7 verify that the data are normally distributed, or the data are shown to be not normally distributed, 

8 a non-parametric technique should be used to analyze the data.

9

10 The critical experiments chosen should ideally provide a continuum of data across the entire 

11 validated range, so that any variation in the bias as a function of important system parameters 

12 may be observed. The presence of discrete clusters of experiments having a calculated keff

13 lower than the set of critical experiments as a whole should be examined closely to determine if 

14 there is some systematic effect common to a particular type of calculation that makes use of the 

15 overall bias non-conservative. Because the bias can vary with system parameters, if the 

16 licensee has combined different subsets of data (e.g., solutions and powders, low- and high17 enriched, homogeneous and heterogeneous), the bias for the different subsets should be 

18 analyzed. In addition, the goodness-of-fit for any function used to trend the bias should be 

19 examined to ensure it is appropriate to the data being analyzed.

20

21 If critical experiments do not cover the entire range of parameters needed to cover anticipated 

22 applications, it may be necessary to extend the AOA by making use of trends in the bias. Any 

23 extrapolation (or wide interpolation) of the data should be done by means of an established 

24 mathematical methodology that takes into account the functional form of both the bias and its 

25 uncertainty. The extrapolation should not be based on judgement alone, such as by observing 

26 that the bias is increasing in the extrapolated range, because this may not account for the 

27 increase in the bias uncertainty that will occur with increasing extrapolation. The reviewer 

28 should independently confirm that the derived bias is valid in the extrapolated range and should 

29 ensure that the extrapolation is not large. NUREG/CR-6698 states that critical experiments 

30 should be added if the data must be extrapolated more than 10%. There is no corresponding 

31 guidance given for interpolation; however, if the gap represents a significant fraction of the total 

32 range of the data (e.g., more than 20% of the range of the data), then the reviewer should 

33 consider this to be a wide interpolation. If the extrapolation or interpolation is too large, new 

34 factors that could affect the bias may be introduced as the physical phenomena in the system 

35 change. The reviewer should not view validation as a purely mathematical exercise, but should 

36 bear in mind the neutron physics and underlying physical phenomena when interpreting the 

37 results.

38

39 Discarding an unusually large number of critical experiments as outliers (i.e., more than 1-2%) 

40 should also be viewed with some concern. Apparent outliers should not be discarded based 

41 purely upon judgement or statistical grounds (such as causing the data to fail tests for 

42 normality), because they could be providing valuable information on the method’s validity for a 

43 particular application. The reviewer should verify that there are specific defensible reasons, 

44 such as reported inconsistencies in the experimental data, for discarding any outliers. If any of 

45 the critical experiments from a particular data set are discarded, the reviewer should examine 

46 other experiments included to determine whether they may be subject to the same systematic 

47 errors. Outliers should be examined carefully especially when they have a lower calculated keff

48 than the other experiments included.

49
May 2014 5-B-11 NUREG-1520, Revision 2

1 NUREG-1520 states that the MoS should be large compared to the uncertainty in the bias. The 

2 observed spread of the data about the mean keff should be examined as an indicator of the 

3 overall precision of the calculational method. The reviewer should ascertain whether the 

4 statistical method of validation considers both the observed spread in the data and the 

5 experimental and calculational uncertainty in determining the USL. The reviewer should also 

6 evaluate whether the observed spread in the data is consistent with the reported uncertainty 

7 (e.g., whether χ2/N ~1). If the spread in the data is larger than, or comparable to, the MMS, then 

8 the reviewer should consider whether additional margin (i.e., a larger MMS) is needed.

9

10 As a final test of the code’s accuracy, the bias should be relatively small (i.e., bias ~2 percent), 

11 or else the reason for the bias should be determined. No credit should be taken for positive bias, 

12 because this would result in making changes in a non-conservative direction without having a 

13 clear understanding of those changes. If the absolute value of the bias is very large–and 

14 especially if the reason for the large bias cannot be determined–this may indicate that the 

15 calculational method is not very accurate, and a larger MMS may be appropriate.

16

17 Some questions that the reviewer may ask in evaluating the rigor of the validation methodology 

18 as justification for the MMS include:

19

20 • Are the results from use of the methodology consistent with the data (e.g., normally 

21 distributed)?

22

23 • Is the normality of the data confirmed prior to performing statistical calculations? If the 

24 data does not pass the tests for normality, is a non-parametric method used?

25

26 • Does the assumed functional form of the bias represent a good fit to the critical 

27 experiments? Is a goodness-of-fit test performed?

28

29 • Does the method determine a pooled bias across disparate types of critical experiments, 

30 or does it consider variations in the bias for different types of experiments? Are there 

31 discrete clusters of experiments for which the bias appears to be non-conservative?

32

33 • Has additional margin been applied to account for extrapolation or wide interpolation? Is 

34 this done based on an established mathematical methodology?

35

36 • Have critical experiments been discarded as apparent outliers? Is there a valid reason 

37 for doing so?

38

39 Performing an adequate code validation is not by itself sufficient justification for any specific 

40 MMS. The reason for this is that the validation analysis determines the bias and its uncertainty, 

41 but not the MMS. The MMS is added after the validation has been performed to provide added 

42 assurance of subcriticality. However, having a validation methodology that either exceeds or 

43 falls short of accepted practices for validation may be a basis for either reducing or increasing 

44 the MMS.

45

46 Statistical Conservatism

47
May 2014 5-B-12 NUREG-1520, Revision 2

1 In addition to having conservatism in keff due to modeling practices, licensees may also provide 

2 conservatism in the statistical methods used to calculate the USL. For example, NUREG/CR3 6698 states that an acceptable method for calculating the bias is to use the single-sided 

4 tolerance limit approach with a 95/95 confidence (i.e., 95% confidence that 95% of all future 

5 critical calculations will lie above the USL). If the licensee decides to use the single-sided 

6 tolerance limit approach with a 95/99.9 confidence, this would result in a more conservative USL 

7 than with a 95/95 confidence. This would be true of other methods for which the licensee’s 

8 confidence criteria exceed the minimum accepted criteria. Generally, the NRC has accepted 

9 95% confidence levels for validation results, so using more stringent confidence levels may 

10 provide conservatism. In addition, there may be other reasons a larger bias and/or bias 

11 uncertainty than necessary has been used (e.g., because of the inclusion of inapplicable critical 

12 experiments that have a lower calculated keff).

13

14 The reviewer may credit this conservatism towards having an adequate MoS if: (1) the licensee 

15 demonstrates that this translates into a specific Δkeff; and (2) the licensee demonstrates that the 

16 margin will be dependably present, based on license or other commitments.

17

18 (3) Additional Risk-Informed Considerations

19

20 Besides modeling conservatism and the validation results, other factors may provide added 

21 assurance of subcriticality. These factors should be considered in evaluating whether there is 

22 adequate MoS and are discussed below.

23

24 System Sensitivity and Uncertainty

25

26 The sensitivity of keff to changes in system parameters can be used to assess the potential effect 

27 of errors on the calculation of keff. If the calculated keff is especially sensitive to a given 

28 parameter, an error in that parameter could have a correspondingly large contribution to the 

29 bias. Conversely, if keff is very insensitive to a given parameter, then an error may have a 

30 negligible effect on the bias. This is of particular importance when assessing whether the 

31 chosen critical experiments are sufficiently similar to applications to justify a small MMS.

32

33 The reviewer should not consider the sensitivity in isolation, but should also consider the 

34 magnitude of uncertainties in the parameters. If keff is very sensitive to a given parameter, but 

35 the value of that parameter is known with very high accuracy (and its variations are well36 controlled), the potential contribution to the bias may still be very small. Thus, the contribution to 

37 the bias is a function of the product of the the keff sensitivity with the uncertainty. To illustrate 

38 this, suppose that keff is a function of a large number of variables, x1, x2,..., xN. Then the 

39 uncertainty in keff may be expressed as follows, if all the individual terms are independent:

40

δk2 = ��

∂k

∂xi

�

2

δxi

2

N

i=1

41

42 where the partial derivatives ∂k/∂xi are proportional to the sensitivity and the terms δxi represent 

43 the uncertainties, or likely variations, in the parameters. (If not all variables are dependent, then 

44 there may be additional terms.) Each term in this equation then represents the contribution to 

45 the overall uncertainty in keff.

46
May 2014 5-B-13 NUREG-1520, Revision 2

1 There are several tools available to the reviewer to ascertain the sensitivity of keff to changes in 

2 the underlying parameters. Some of these are listed below:

3

4 1. Analytical tools that calculate the sensitivity for each nuclide-reaction pair present in the 

5 problem may be used. One example of this is the TSUNAMI code in the SCALE 5 code 

6 package. TSUNAMI calculates both an integral sensitivity coefficient (i.e., summed over all 

7 energy groups) and a sensitivity profile as a function of energy group. The reviewer should 

8 recognize that TSUNAMI only calculates the keff sensitivity to changes in the underlying nuclear 

9 data, and not to other parameters that could affect the bias and should be considered. (See 

10 section on Critical Experiment Similarity for caveats about using TSUNAMI.)

11

12 2. Direct sensitivity calculations may be used, in which system parameters are perturbed and 

13 the resulting impact on keff determined. Perturbation of atomic number densities can also be 

14 used to confirm the sensitivity calculated by other methods (e.g., TSUNAMI). Such techniques 

15 are not limited to considering the effect of the nuclear data.

16

17 There are also several sources available to the reviewer to ascertain the uncertainty associated 

18 with the underlying parameters. For process parameters, these sources of uncertainty may 

19 include manufacturing tolerances, quality assurance records, and experimental and/or 

20 measurement results. For nuclear data parameters, these sources of uncertainty may include 

21 published data, uncertainty data distributed with the cross section libraries, or the covariance 

22 data used in methods such as TSUNAMI.

23

24 Some systems are inherently more sensitive to changes in the underlying parameters than 

25 others. For example, high-enriched uranium systems typically exhibit a greater sensitivity to 

26 changes in system parameters (e.g., mass, moderation) than low-enriched systems. This has 

been the reason that HEU (i.e., >20wt% 235 27 U) facilities have been licensed with larger MMS 

values than LEU (≤10wt% 235 28 U) facilities. This greater sensitivity would also be true of weapons29 grade Pu compared to low-assay mixed oxides (i.e., with a few percent Pu/U). However, it is 

30 also true that the uncertainties associated with measurement of the 235U cross sections are 

31 much smaller than those associated with measurement of the 238U cross sections. Both the 

32 greater sensitivity and smaller uncertainty would need to be considered in evaluating whether a 

33 larger MMS is needed for high-enriched systems.

34

35 Frequently, operating limits that are more conservative than safety limits determined using keff 

36 calculations are established to prevent those safety limits from being exceeded. For systems in

37 which keff is very sensitive to the system parameters, more margin between the operating and

38 safety limits may be needed. Systems in which keff is very sensitive to the process parameters

39 may need both a larger margin between operating and safety limits and a larger MMS. This is

40 because the system is sensitive to any change, whether it be caused by normal process

41 variations or caused by unknown errors. Because of this, the assumption is often made that the 

42 MMS is meant to account for variations in the process or the ability to control the process

43 parameters. However, the MMS is meant only to allow for unknown (or difficult to quantify)

44 uncertainties in the calculation of keff. The reviewer should recognize that determination of an

45 appropriate MMS is not dependent on the ability to control process parameters within safety

46 limits (although both may depend on the system sensitivity).

47

48 Some questions that the reviewer may ask in evaluating the system sensitivity as justification for 

49 the MMS include:

50
May 2014 5-B-14 NUREG-1520, Revision 2

1 • How sensitive is keff to changes in the underlying nuclear data (e.g., cross sections)?

2

3 • How sensitive is keff to changes in the geometric form and material composition?

4 • Are the uncertainties associated with these underlying parameters well-known?

5

6 • How does the MMS compare to the expected magnitude of changes in keff resulting from 

7 uncertainties in these underlying parameters?

8

9 Knowledge of the Neutron Physics

10

11 Another important consideration that may affect the appropriate MMS is the extent to which the 

12 physical behavior of the system is known. Fissile systems which are known to be subcritical with 

13 a high degree of confidence do not require as much MMS as systems where subcriticality is less 

14 certain. An example of a system known to be subcritical with high confidence is a light-water 

15 reactor fuel assembly. The design of these systems is such that they can only be made critical 

16 when highly thermalized. Due to extensive analysis and reactor experience, the flooded isolated 

17 assembly is known to be subcritical. In addition, the thermal neutron cross sections for materials 

18 in finished reactor fuel have been measured with a very high degree of accuracy (as opposed to 

19 cross sections in the resonance region). Other examples of systems in which there is 

20 independent corroborating evidence of subcriticality may include systems consisting of very 

21 simple geometric shapes, or other idealized situations, in which there is strong evidence that the 

22 system is subcritical based on comparison with highly similar systems in published sources 

23 (e.g., standards and handbooks). In these cases, the MMS may be significantly reduced due to 

24 the fact that the calculation of keff is not relied on alone to provide assurance of subcriticality.

25

26 Reliance on independent knowledge that a given system is subcritical necessarily requires that 

27 the configuration of the system be fixed. If the configuration can change from the reference 

28 case, there will be less knowledge about the behavior of the changed system. For example, a 

29 finished fuel assembly is subject to strict quality assurance checks and would not reach final 

30 processing if it were outside specifications. In addition, it has a form that has both been 

31 extensively studied and is highly stable. For these reasons, there is a great deal of certainty that 

32 this system is well-characterized and is not subject to change. A typical solution or powder 

33 system (other than one with a simple geometric arrangement) would not have been studied with 

34 the same level of rigor as a finished fuel assembly. Even if they were studied with the same 

35 level of rigor, these systems have forms that are subject to change into forms whose neutron 

36 physics has not been as extensively studied.

37

38 Some questions that the reviewer may ask in evaluating the knowledge of the neutron physics 

39 as justification for the MMS include:

40

41 • Is the geometric form and material composition of the system fixed and very unlikely to 

42 change?

43

44 • Is the geometric form and material composition of the system subject to strict quality 

45 assurance, such that tolerances have been bounded?

46
May 2014 5-B-15 NUREG-1520, Revision 2

1 • Has the system been extensively studied in the nuclear industry and shown to be 

2 subcritical (e.g., in reactor fuel studies)?

3

4 • Are there other reasons besides criticality calculations to conclude that the system will 

5 be subcritical (e.g., handbooks, standards, published data)?

6 • How well-known is the nuclear data (e.g., cross sections) in the energy range of 

7 interest?

8

9 Likelihood of the Abnormal Condition

10

11 Some facilities have been licensed with different sets of keff limits for normal and abnormal 

12 conditions. Separate keff limits for normal and abnormal conditions are permissible, but are not 

13 required. There is some low likelihood that processes calculated to be subcritical will, in fact, be 

14 critical, and this likelihood increases as the MMS is reduced (though it cannot in general be 

15 quantified). NUREG-1718, “Standard Review Plan for the Review of an Application for a Mixed 

16 Oxide (MOX) Fuel Fabrication Facility,” states that abnormal conditions should be at least 

17 unlikely from the standpoint of the double contingency principle. Then, a somewhat higher 

18 likelihood that a system calculated to be subcritical is, in fact, critical is more permissible for 

19 abnormal conditions than for normal conditions, because of the low likelihood of the abnormal 

20 condition being realized. The reviewer should verify that the licensee has defined abnormal 

21 conditions such that achieving the abnormal condition requires at least one contingency to have 

22 occurred, that the system will be closely monitored so that it is promptly detected, and that it will 

23 be promptly corrected upon detection. Also, there is generally more conservatism present in the 

24 abnormal case, because the parameters that are assumed to have failed are analyzed at their 

25 worst-case credible condition.

26

27 The increased risk associated with having a smaller MMS for abnormal conditions should be 

28 commensurate with, and offset by, the low likelihood of achieving the abnormal condition. That 

29 is, if the normal case keff limit is judged to be acceptable, then the abnormal case limit will also 

30 be acceptable, provided the increased likelihood (that a system calculated to be subcritical will 

31 be critical) is offset by the reduced likelihood of realizing the abnormal condition because of the 

32 controls that have been established. Note that if two or more contingencies must occur to reach 

33 a given condition, there is no requirement to ensure that the resulting condition is subcritical. If a 

34 single keff limit is used (i.e., no credit for unlikelihood of the abnormal condition), then the limit 

35 must be found acceptable to cover both normal and credible abnormal conditions. The reviewer 

36 should always make this finding considering specific conditions and controls in the process(es) 

37 being evaluated.

38

39 (4) Statistical Justification for the MMS

40

41 The NRC does not consider statistical justification an appropriate basis for a specific MMS. 

42 Previously, some licensees have attempted to justify specific MMS values based on a 

43 comparison of two statistical methods. For example, the USLSTATS code issued with the 

44 SCALE code package contains two methods for calculating the USL: (1) the Confidence Band 

45 with Administrative Margin approach (calculating USL-1), and (2) the Lower Tolerance Band 

46 approach (calculating USL-2). The value of the MMS is an input parameter to the Confidence 

47 Band approach, but is not included explicitly in the Lower Tolerance Band approach. In this 

48 particular justification, adequacy of the MMS is based on a comparison of USL-1 and USL-2 
May 2014 5-B-16 NUREG-1520, Revision 2

1 (i.e., the condition that USL-1, including the chosen MMS, is less than USL-2). However, the 

2 reviewer should not accept this justification.

3

4 The condition that USL-1 (with the chosen MMS) is less than USL-2 is necessary, but is not 

5 sufficient, to show that an adequate MMS has been used. These methods are both statistical 

6 methods, and a comparison can only demonstrate whether the MMS is sufficient to bound any 

7 statistical uncertainties included in the Lower Tolerance Band approach but not included in the 

8 Confidence Band approach. There may be other statistical or systematic errors in calculating keff 

9 that are not included in either statistical treatment. Because of this, an MMS value should be 

10 specified regardless of the statistical method used. Therefore, the reviewer should not consider 

11 such a statistical approach an acceptable justification for any specific value of the MMS.

12

13 (5) Summary

14

15 Based on a review of the licensee’s justification for its chosen MMS, taking into consideration 

16 the aforementioned factors, the staff should make a determination as to whether the chosen 

17 MMS provides reasonable assurance of subcriticality under normal and credible abnormal 

18 conditions. The staff’s review should be risk-informed, in that the review should be 

19 commensurate with the MoS and should consider the specific facility and process 

20 characteristics, as well as the specific modeling practices used. As an example, approving an 

21 MMS value greater than 0.05 for processes typically encountered in enrichment and fuel 

22 fabrication facilities should require only a cursory review, provided that an acceptable validation 

23 has been performed and modeling practices at least as conservative as those in NUREG-1520 

24 have been utilized. The approval of a smaller MMS will require a somewhat more detailed 

25 review, commensurate with the MMS that is requested. However, the MMS should not be 

26 reduced below 0.02 due to inherent uncertainties in the cross section data and the magnitude of 

27 code errors that have been discovered. Quantitative arguments (such as modeling 

28 conservatism) should be used to the extent practical. However, in many instances, the reviewer 

29 will need to make a judgement based at least partly on qualitative arguments. The staff should 

30 document the basis for finding the chosen MMS value to be acceptable or unacceptable in the 

31 Safety Evaluation Report (SER), and should ensure that any factors upon which this 

32 determination rests are ensured to be present over the facility lifetime (e.g., through license 

33 commitment or condition).

34

35 Technical Review Guidance

36

37 Determination of an adequate MMS is strongly dependent upon specific processes, conditions, 

38 and calculational practices at the facility being licensed. Judgement and experience must be 

39 employed in evaluating the adequacy of the proposed MMS. In the past, an MMS of 0.05 has 

40 generally been found acceptable for most typical low-enriched fuel cycle facilities without a 

41 detailed technical justification. A smaller MMS may be acceptable but will require some level of 

technical review.2 42 However, for reasons stated previously, the MMS should not be reduced 

43 below 0.02.

44

 2

 For high-enriched and plutonium or other fuel cycle facilities, no general guidance on the appropriate MMS 

is given. The reviewer should consider any relevant differences between these facilities and low-enriched 

uranium facilities (e.g., generally increased sensitivity of keff, generally reduced cross section uncertainty) on 

a case-by-case basis.
May 2014 5-B-17 NUREG-1520, Revision 2

1 An MMS of 0.05 should be found acceptable for low-enriched fuel cycle processes and facilities 

2 if:

3

4 1. A validation has been performed that meets accepted industry guidelines (e.g., meets 

5 the requirements of ANSI/ANS-8.1-1998, NUREG/CR-6361, and/or NUREG/CR-6698).

6 2. There is an acceptable number of critical experiments with similar geometric forms, 

7 material compositions, and neutron energy spectra to applications. These experiments 

8 cover the range of parameters of applications, or else margin is provided to account for 

9 extensions to the AOA.

10

11 3. The processes to be evaluated include materials and process conditions similar to those 

12 that occur in low-enriched fuel cycle applications (i.e., no new fissile materials, unusual 

13 moderators or absorbers, or technologies new to the industry that can affect the types of 

14 systems to be modeled).

15

16 The reviewer should consider any factors, including those enumerated in the discussion above, 

17 that could result in applying additional margin (i.e., a larger MMS) or may justify reducing the 

18 MMS. The reviewer must then exercise judgement in arriving at an MMS that provides for 

19 adequate assurance of subcriticality.

20

21 Some of the factors that may serve to justify reducing the MMS include:

22

23 1. There is a predictable and dependable amount of conservatism in modeling practices, in 

24 terms of keff, that is assured to be maintained (in both normal and abnormal conditions) 

25 over the facility lifetime.

26

27 2. Critical experiments have nearly identical geometric forms, material compositions, and 

28 neutron energy spectra to applications, and the validation is specific to this type of 

29 application.

30

31 3. The validation methodology substantially exceeds accepted industry guidelines (e.g., it 

32 uses a very conservative statistical approach, considers an unusually large number of 

33 trending parameters, or analyzes the bias for a large number of subgroups of critical 

34 experiments).

35

36 4. The system keff is demonstrably much less sensitive to uncertainties in cross sections or 

37 variations in other system parameters than typical low-enriched fuel cycle processes.

38

39 5. There is reliable information besides results of calculations that provides assurance that

40 the evaluated applications will be subcritical (e.g., experimental data, historical evidence, 

41 industry standards or widely-accepted handbooks).

42

43 6. The MMS is only applied to abnormal conditions, which are at least unlikely to be 

44 achieved, based on credited controls.

45

46 Some of the factors that may necessitate increasing (or not approving) the MMS include:
May 2014 5-B-18 NUREG-1520, Revision 2

1

2 1. The technical practices employed by the licensee are less conservative than standard 

3 industry modeling practices (e.g., do not adequately bound reflection or the full range of 

4 credible moderation, do not take geometric tolerances into account).

5 2. There are few similar critical experiments of benchmark quality that cover the range of 

6 parameters of applications.

7

8 3. The validation methodology substantially falls below accepted industry guidelines (e.g., it 

9 uses less than a 95% confidence in the statistical approach, fails to consider trends in 

10 the bias, fails to account for extensions to the AOA).

11

12 4. The validation results otherwise tend to cast doubt on the accuracy of the bias and its 

13 uncertainty (i.e., the critical experiments are not normally distributed, there is a large 

14 number of outliers discarded (≳2%), there are distinct subgroups of experiments with 

15 lower keff than the experiments as a whole, trending fits do not pass goodness-of-fit tests, 

16 etc.).

17

18 5. The system keff is demonstrably much more sensitive to uncertainties in cross sections or 

19 other system parameters than typical low-enriched fuel cycle processes.

20

21 6. There is reliable information that casts doubt on the results of the calculational method 

22 or the subcriticality of evaluated applications (e.g., experimental data, reported concerns 

23 with the nuclear data).

24

25 The purpose of asking the questions in the individual discussion sections is to ascertain the 

26 degree to which these factors either provide justification for reducing the MMS or necessitate 

27 increasing the MMS. These lists are not all-inclusive, and any other technical information that 

28 demonstrates the degree of confidence in the calculational method should be considered.
May 2014 5-AB-1 NUREG-1520, Revision 2

ANNEX TO APPENDIX B

ANSI/ANS-8.17 Calculation of Maximum keff

1 American National Standards Institute (ANSI)/American Nuclear Society (ANS)-8.17-2004, 

2 “Criticality Safety Criteria for the Handling, Storage, and Transportation of LWR Fuel Outside 

3 Reactors,” contains a detailed discussion of the various factors that should be considered in 

4 setting keff limits. This is consistent with, but more detailed than, the discussion in ANSI/ANS5 8.1-1998.

6

7 The subcriticality criterion from Section 5.1 of ANSI/ANS-8.17-2004 is:

8

ks ≤ kc − ∆ks − ∆kc − ∆km 9

10 where ks is the calculated keff corresponding to the application, Δks is its uncertainty, kc is the 

11 mean keff resulting from the calculation of critical experiments, Δkc is its uncertainty, and Δkm is 

12 the MMS. The types of uncertainties included in each of these “delta” terms is provided, and 

13 includes the following:

14

15 Δks = (1) statistical uncertainties in computing ks; (2) convergence uncertainties in computing ks, 

16 (3) material tolerances; (4) fabrication tolerances; (5) uncertainties due to limitations in the 

17 geometric representation used in the method; and (6) uncertainties due to limitations in the 

18 material representations used in the method.

19

20 Δkc = (7) uncertainties in the critical experiments; (8) statistical uncertainties in computing kc; (9) 

21 convergence uncertainties in computing kc; (10) uncertainties due to extrapolating kc outside the 

22 range of experimental data; (11) uncertainties due to limitations in the geometric representations 

23 used in the method; and (12) uncertainties due to limitations in the material representations 

24 used in the method.

25

26 Δkm = an allowance for any additional uncertainties (MMS).

27

28 To the extent that not all 12 sources of uncertainty listed above have been explicitly taken into 

29 account, they may be allowed for by increasing the value of Δkm. The more of these sources of 

30 uncertainty that have been taken into account, the smaller the necessary additional margin Δkm. 

31 As a general principle, however, the MMS should be large compared to known uncertainties in 

32 the nuclear data and limitations of the methodology. However, a value of the MMS below 0.02 

33 should not be used.

34

35 Frequently, the terms in the above equation relating to the application are grouped on the left36 hand side of the equation, so that the equation is rewritten as follows:

37

ks + ∆ks ≤ kc − ∆kc − ∆km 38

39

40 where the terms on the right-hand side of the equation are often lumped together and termed 

41 the Upper Subcritical Limit (USL), so that the USL = kc - Δkc - Δkm.
May 2014 5-AB-2 NUREG-1520, Revision 2

1 Relation to the Minimum Subcritical Margin (MMS)

2

3 The MoS has been defined as the difference between the actual value of keff and the value of keff 

4 at which the system is expected to be critical. The expected (best estimate) critical value of keff is 

5 the mean keff value of all critical experiments analyzed (i.e., kc), including consideration of the 

6 uncertainty in the bias (i.e., Δkc). The calculated value of keff for an application generally exceeds 

7 the actual (physical) keff value due to conservative assumptions in modeling the system. In terms 

8 of the above USL equation, the MoS may be expressed mathematically as:

9

MoS = kc − ∆kc − (ks − ∆ksa) − ∆ks 10

11 where the term in parentheses is equal to the actual (physical) keff of the application, ksa. A term, 

12 Δksa, has been added to represent the difference between the actual and calculated value of keff 

13 for the application (i.e., Δksa = change in keff resulting from modeling conservatism). In terms of 

14 the USL:

15

MoS = USL + ∆km − ks + ∆ksa − ∆ks

16

17 The minimum allowed value of the MoS is reached when the calculated keff for the application, ks 

18 + Δks, is equal to the USL. When this occurs, the minimum value of the MoS is:

19

MoS ≥ ∆km + ∆ksa

20

21 Thus, adequate margin (MoS) may be assured either by conservatism in modeling practices or 

22 in the explicit specification of Δkm (MMS). This is discussed in the appendix section on modeling 

23 conservatism.

24
May 2014 5-C-1 NUREG-1520, Revision 2

APPENDIX C

EXAMPLE PROCEDURE FOR SUBCRITICALITY EVALUATION

1 Purpose

2

3 This appendix provides the U.S. Nuclear Regulatory Commission (NRC) reviewer with an 

4 example of one method for licensees to perform an integrated safety analysis (ISA) for a nuclear 

5 process that meets the requirements of Title 10, “Energy,” of the Code of Federal Regulations

6 (10 CFR) 70.61, “Performance Requirements,” for criticality safety hazards. The purpose of this 

7 appendix is to provide an example of an acceptable method to perform this evaluation of 

8 subcriticality. It employs a conservative, deterministic method for demonstrating that a process 

9 will be subcritical under normal and credible abnormal conditions. This example is an 

10 illustration of the use of the criticality hazard evaluation method discussed in Appendix 5-A to 

11 this SRP. This method is applicable only to criticality safety, whereas other hazards at facilities, 

12 such as chemical hazards, may be evaluated in accordance with the risk-index method of 

13 Appendix A to Chapter 3 of this SRP.

14

15 Introduction

16

17 The appendix presents an example of how the deterministic method can be applied to a 

18 uranium solvent-extraction process. It describes one method of evaluating compliance with the 

19 subcriticality requirement of 10 CFR 70.61(d) and discusses the 10 CFR 70.64(a)(9) 

20 baseline-design criterion, under which the designs of new facilities, and the design of new 

21 processes at existing facilities, must provide for 6criticality control by adherence to the 

22 double-contingency principle. In this regard, the method described here of evaluating 

23 compliance with these requirements is intended to show how subcriticality may be 

24 demonstrated in accordance with use of the double-contingency principle. This method should 

25 not be interpreted as a requirement that the applicant use any particular methodology to meet 

26 the regulatory requirements. Note that most existing fuel facilities have committed to follow the 

27 double-contingency principle as the historically preferred means of ensuring subcriticality under 

28 normal and credible abnormal conditions.

29

30 This appendix is not a “format and content guide” for either the criticality safety evaluation (CSE) 

31 or the ISA summary. It simply presents one method of analysis of credible abnormal conditions 

32 leading to criticality. If the applicant evaluates normal and abnormal conditions using a different 

33 method, the method should produce similar results in terms of conditions identified. However, 

34 once the upset conditions are identified, the applicant has choices as to (a) which of the various 

35 parameters (as listed in Section 5.4.3.1.7.3) are most advantageous to control, (b) the means of 

36 controlling those parameters and (c) to what values to control those parameters. Therefore, the 

37 specific controls and limits associated with a similar solvent-extraction process may differ 

38 significantly from those provided in this example. The example should be regarded as 

39 illustrative of the method, and not as a definitive statement of the adequacy of a particular set of 

40 controls for a similar solvent-extraction operation.

41

42 Process Description

43

44 Solvent-extraction processes are frequently used in uranium recovery operations to recover 

45 purified uranyl nitrate for fuel-fabrication purposes. The main process control used in this 

46 example is geometry control, normally by means of favorable geometry process equipment.

47

48 The process for this example is pictured below.
May 2014 5-C-2 NUREG-1520, Revision 2

1

2

3

4

5

6

7

8

9

10

11

12

13

14 A single-pass solvent-extraction process typically consists of a set of three favorable geometry 

15 column: an extraction column, a scrubbing column, and a stripping column. Uranium is 

16 dissolved (e.g., in tray dissolvers) with nitric acid (HNO3) and piped into the extraction process, 

17 in which it is mixed with an organic and diluent mixture (such as tributyl phosphate (TBP) and 

18 kerosene) to separate any impurities from the uranium. This process does not exist in isolation, 

19 but rather is connected to both upstream and downstream processes, utilities, and waste 

20 processes. These include:

21

Connected processes: Utilities: Waste processes:

• Tray dissolution

• Wet conversion

• Electrical power

• Process water

• Nitric acid supply

• Chemical makeup

• Organic conditioning

• Raffinate storage

• Wastewater storage

22 NOTE: This list is not meant to be exhaustive, and neither is the list of upset conditions or 

23 controls; it is merely illustrative of the approach.

24

25 Criticality Safety Hazard Identification

26

27 As the first step in performing an ISA for the solvent-extraction process described above, an 

28 applicant typically determines the extent of the system to be analyzed. As stated above, the 

29 process does not exist in isolation, but interacts with connected processes through the flow of 

30 matter and energy, and possibly through neutron interaction, between adjacent systems. The 

31 part of the process to be covered by the CSE is pictured above, and consists of a set of three 

32 columns, the connected piping, and the surrounding room. The floor of the room is sloped and 

33 drains to a favorable geometry collection tank. The process is neutronically isolated from other 

34 processes by thick concrete walls.

35

36 Next, an applicant typically considers the initial process design and identifies an initial set of 

37 controlled parameters and criticality controls. This is only the initial set of controls because, in 

38 general, the performance of the CSE is an iterative process. The columns individually have 

39 diameters less than the subcritical diameter limits in ANSI/ANS-8.1, so they are considered to 

40 have favorable geometry. However, the entire system should be shown to be subcritical and so 

41 the columns cannot be considered only in isolation, because of the possibility of neutron 

42 interaction. An applicant would therefore construct a normal condition of the three columns 

43 together with the floor and walls. Under normal conditions, the material in the columns consists 

44 of uranyl nitrate solution (consisting of uranyl nitrate, water, and nitric acid) at various 

45 concentrations, TBP, and kerosene, in various proportions. The applicant may choose to model 

Drain to 

safe 

geometry 

Level 

sensor

Extractio

n 
May 2014 5-C-3 NUREG-1520, Revision 2

1 the fissionable material without consideration for the TBP and kerosene, based on a sensitivity 

2 study showing that a pure uranyl nitrate solution is the most reactive. The applicant may then 

3 perform another sensitivity study to determine the optimal concentration of the uranyl nitrate

4 solution (~1100 gU/l (grams of uranium per liter) for low-enriched solution and ~500 gU/l for high 

5 enriched solution).

6

7 Having decided on the fissionable material involved, the applicant may then make several 

8 choices about how to model the geometric configuration of the system. Initially, the applicant 

9 may model the three columns with solution to the outer diameter, taking tolerances in diameter 

10 and spacing between columns into account. The columns may also be modeled as infinitely 

11 long columns resting on a concrete floor 60 cm thick, 12 inches away from concrete walls that 

12 are 30 cm thick. The model will also necessarily make certain simplifying assumptions, such as 

13 ignoring small-diameter piping, flanges on the columns, the roughness of the concrete walls, 

14 etc. Small piping in particular is typically ignored, based on an analyst’s professional judgment 

15 and experience and the fact that the piping is less than 1⁄2 inch in diameter and runs at right 

16 angles to the axis of each column, so neutron interaction is negligible. The applicant may 

17 perform a sensitivity analysis for interstitial moderation and determine that a 50% water density 

18 is the most reactive. The applicant may perform a calculation using this model and determine 

that it cannot meet the keff 19 limit submitted in its license application.

20

21 An applicant may choose to construct the most conservative model it can, which generally 

22 minimizes the number of process characteristics that need to be controlled as well as the 

23 number of IROFS. In this example, however, it is assumed that the applicant is unable to 

24 demonstrate subcriticality for the system as originally envisioned. The applicant now has 

25 several choices, such as taking credit for the borosilicate glass in the columns, taking credit for 

26 concentration or excess acid in the solution, taking credit for the distance of the column from the 

27 floor, etc. In this example, it is supposed that the applicant then decides to shorten the column, 

28 raise the column off the floor, and model the solution to the inner diameter which maintaining an 

29 optimal material composition (modeling the void between the inner and outer diameter). It is 

30 then supposed that the resulting model is indeed subcritical.

31

32 An applicant then generally determines what parameters need to be controlled and what the 

33 controls on those parameters should be, to ensure subcritical for the normal condition. One 

34 common way to do this is to go through the list of controlled parameters, as in the following list 

35 (for illustrative purposes):

36

37 Concentration and density: not controlled, because the columns have been demonstrated to be 

38 subcritical with an optimal mixture.

39

40 Mass and volume: not controlled, because the columns have sufficient mass and volume to 

41 attain criticality (if geometry control is lost).

42

43 Enrichment: if solution is high-enriched, enrichment is not controlled; if solution is low-enriched, 

44 it might technically be being controlled, but if the maximum facility enrichment is used, this will 

45 be a global limit and there might be no credible way of exceeding it (especially in a 

46 non-enrichment facility). It is therefore generally unnecessary for an applicant to identify 

47 enrichment as a separate contingency in a non-enrichment facility.

48

49 Geometry: several of the dimensions included in the model are evaluated for whether they 

50 should be turned into geometry controls. The most crucial of these is the inner diameter of the 

51 column, which is controlled by specifying a maximum outer diameter and minimum thickness. 

52 The length of the columns, while shortened in the model, is such that their height-to-diameter 
May 2014 5-C-4 NUREG-1520, Revision 2

1 (H/D) ratio is ~15, and therefore effectively infinite (keff being insensitive to the actual length). 

2 Thus, it is not necessary in this example to designate the column height as a control.

3

4 Interaction: the spacing between columns, the distance between the columns and the floor, and 

5 the distance of the columns from the concrete walls are all used in the normal-condition model 

6 and therefore are potentially interaction controls. The most significant of these is spacing 

7 between the columns, which is identified as a criticality control. By professional judgment, the 

8 applicant may consider the distance of the columns from the walls to be the more significant, 

9 and the distance from the floor to most likely be insignificant. The applicant could choose to 

10 make these all criticality controls, but instead it is supposed that the applicant performs a 

11 sensitivity analysis showing that there is a minimum distance from the walls necessary for 

12 subcriticality, but that the columns are subcritical even when resting on the floor. Therefore, the 

13 spacing between columns and distance of the columns from the walls are designated as 

14 criticality controls in this example.

15

16 Reflection: not controlled. Rather than model each column with a one-inch tight-fitting water 

17 reflector, the applicant chooses to model the entire space surrounding the columns with varying 

18 densities of water, from a void to fully flooded conditions. Assuming the flooded condition is 

19 subcritical, it is not necessary to control water reflection. The concrete walls also provide some 

20 reflection. The floor thickness is not significant because keff has been shown to be insensitive to 

21 the columns’ distance from the floor and 60-cm of concrete provides full reflection. The wall 

22 thickness is not significant based on the sensitivity analysis for interaction.

23

24 Moderation: not controlled. The applicant models the solution as an optimal mixture, and the 

25 columns are subcritical with optimal interstitial moderation.

26

27 Absorber: not controlled, because the applicant is presumed to have demonstrated 

28 subcriticality without taking credit for the material composition of the glass columns. If the 

29 applicant had explicitly modeled the glass, it would then have had to determine whether the 

30 glass should be a neutron-absorber control. Not making the glass a neutron-absorber control 

31 could be justified based on whether a sensitivity analysis demonstrated that none of the glass is 

32 needed for subcriticality. If only half the glass were needed, the applicant would then have to 

33 either make the glass an absorber control or decide whether it is credible that the composition 

34 could be reduced by such a large proportion.

35

36 Heterogeneity: not controlled, if the solution is highly enriched. If the solution is low-enriched, 

37 consideration would be given to flocculation and precipitation. Precipitation in this example is 

38 not a concern, because it will only result in achieving a less-reactive under-moderated condition. 

39 Suspended flocculates could result in a modest increase in reactivity, but the applicant 

40 determined that the margin of safety resulting from use of a higher-than-normal concentration 

41 and neglecting free acid is sufficient to account for any uncertainty caused by the homogeneity 

42 of the fissile mixture.

43

44 Physicochemical form: While the solution as modeled is presumed to have the most reactive 

45 composition for a uranyl nitrate solution, a change to a more reactive form needs to be 

46 considered. The applicant is presumed to have determined that a UO2-water mixture is the 

47 most reactive physicochemical form that could exist in the columns (there being no credible way 

48 to form a metal-water mixture). Process deviations resulting from incomplete dissolution could 

49 lead to such a condition. In this example, the applicant therefore identified two upstream filters 

50 between the dissolution and extraction processes as criticality controls. No chemical reagents 

51 resulting in a more reactive form are presumed to have been identified.
May 2014 5-C-5 NUREG-1520, Revision 2

1 Process variables: These mainly control the efficiency of the extraction process. Incomplete 

2 extraction could lead to the presence of concentrated uranium in the raffinate stream. Process 

3 variables that can affect extraction efficiency include temperature, acidity (pH), flow rate of TBP, 

4 power output of the pulsing pump, etc. For simplicity, because there is a downstream sodium 

5 iodide detector between the favorable geometry raffinate columns and wastewater tanks, it is 

6 assumed there are no additional process variable controls are needed.

7

8 Based on the above consideration of parameters associated with the normal-condition model, 

9 the applicant is presumed to have identified the following controlled parameters: geometry, 

10 interaction, and physicochemical form (and possibly enrichment). Not controlling other 

11 parameters is justified in the CSE. Based on the normal-condition model, the following criticality 

12 controls could be identified:

13

GEOMETRY: INTERACTION: PHYSICOCHEMICAL FORM:

• Outer column diameter

• Column wall thickness

• Column spacing

• Distance between 

columns and walls

• Upstream dual filters

14 NOTE: This list of controls is for illustrative purposes only and should not be considered an 

15 exhaustive list.

16

17 Criticality Safety Hazard Evaluation

18

19 The applicant must also demonstrate subcriticality under credible abnormal conditions. Once 

20 the initial suite of criticality controls is determined, an applicant should have demonstrated that 

21 all foreseeable ways they could fail so as to result in criticality have been considered. The 

22 following contingencies were identified. Again, this is an illustrative and not an exhaustive list. 

(Other scenarios 1 23 have already been discussed and dismissed above, such as precipitation, 

24 and are not considered further below.)

25

26 GEOMETRY

27

28 GEO-01: A column or pipe leaks, ruptures, corrodes, or overflows onto the floor

29

30 GEO-02: A column leaks into the recirculation pumps

31

32 GEO-03: A column bulges beyond a safe diameter

33

34 GEO-04: A column overflows to unfavorable supply tanks

35

36 GEO-05: A transfer of solution to raffinate columns and unfavorable wastewater tanks

37

38 INTERACTION

39

40 INT-01: A seismic event reduces spacing between columns or between columns and walls

 1 The term “scenario” is deliberately chosen, to distinguish the concept here from the idea of identifying an 

“accident sequence.” A “scenario” is a hypothetical event that could result in a change in process conditions 

(i.e., a “contingency”); a “sequence” is a string of events that eventually can result in an accident. The 

former is focused on the conditions achieved, while the latter is focused on how such conditions may be 

achieved.
May 2014 5-C-6 NUREG-1520, Revision 2

1 INT-02: A container bearing fissile material is placed adjacent to a column

2

3 PHYSICOCHEMICAL FORM

4

5 PC-01: Incomplete upstream dissolution of scrap material

6

7 ENRICHMENT

8

9 [No identified scenarios that can credibly lead to criticality]

10

11 Each of these possible scenarios would typically be considered in turn, and the conditions 

12 resulting therefrom shown to be subcritical, in accordance with the double-contingency principle. 

13 (An alternate but equally permissible approach is to combine some or all of these abnormal 

14 conditions into a single conservative model, which is then shown to be subcritical. As in the 

15 selection of how detailed a model to construct, the tradeoff is between analytic simplicity and 

16 safety margin.) The following table provides the results of an example evaluation and several 

17 additional controls that could be identified during this iterative process. Some of these controls 

18 (e.g., siphon breaks) may result in a design change, whereas others (e.g., floor drains) may 

19 result in existing features now being credited as controls.

20

Double-Contingency Discussion Associated Criticality Controls

GEOMETRY Scenarios

Normal-condition controls: Configuration (dimensions, spacing, and arrangement) of 

process equipment as modeled ensures subcriticality under normal conditions. Specific 

geometry attributes are the column outer diameter and wall thickness.

GE0-01: Column or pipe leaks, ruptures, corrodes, or overflows onto the floor

If the column’s ability to contain fissile 

material within safe dimensions is 

compromised, solution will drain to the 

floor. The floor is sized in such a way that 

the full volume of any single column and 

all associated piping will accumulate to 

less than a safe depth. The floor is sloped 

and drains to a favorable geometry 

collection tank. In addition, a level sensor 

will alarm and alert operators that the 

solution level is unacceptably low; the 

operators are required to stop the process.

1st Control: Outer diameter and wall 

thickness of the columns.

2nd Control: Area and slope of the floor, 

diameter of the drain and collection tank.

Defense-in-Depth (DID): Level sensors 

with alarms
May 2014 5-C-7 NUREG-1520, Revision 2

Double-Contingency Discussion Associated Criticality Controls

GEO-02: Column leaks into recirculation pumps

The recirculation pumps have been 

evaluated to be subcritical when filled with 

optimally moderated solution.

1st Control: Outer diameter and wall 

thickness of the columns.

2nd Control: Oil reservoir of pumps is safe 

volume, pumps are separated by

18 inches center-to-center.

Additional Safety Margin (SM): Pump 

internals displace some of the pump 

volume.

GEO-03: Column bulges beyond a safe diameter

Based on sensitivity analysis, there is no 

credible way that a column will bulge 

sufficiently to exceed the keff limit. 

Columns are hydrostatically tested to 

ensure they will not bulge to beyond the 

subcritical diameter. There are also no 

credible ways of pressurizing a column 

because the columns are vented.

1st Control: Outer diameter of the column;

column composed of stainless steel of 

specified minimum thickness; verified by 

hydrostatic testing.

2nd Control: Columns are vented; vents 

consist of 1-inch diameter transparent 

tubing.

DID: Operators are frequently if not 

continuously present in the area, and 

would notice conditions leading to column 

bulging within one shift. Braces and other 

supports credited for seismic events also 

would protect against column bulging.

GEO-04: Column overflows to unfavorable supply tanks

As stated for Scenario GEO-03, no 

credible means of pressurizing a column 

have been identified. If such 

pressurization occurs, solution will spill to 

the floor through overflows, which has 

been shown to be subcritical. In addition, 

a siphon break has been installed on each 

column.

1st Control: Columns are vented; vents 

consist of 1-inch diameter transparent 

tubing.

2nd Control: Siphon breaks on all columns.

GEO-05: Transfer to raffinate columns and unfavorable wastewater tanks
May 2014 5-C-8 NUREG-1520, Revision 2

Double-Contingency Discussion Associated Criticality Controls

The chemistry of the extraction process 

primarily protects against getting 

concentrated uranium in the raffinate 

storage columns. Dual independent 

samples are taken on the storage columns 

before authorization is granted to transfer 

their contents to unfavorable geometry 

wastewater treatment tanks. In the event, 

concentrated solution is inadvertently 

transferred, an active interlock making use 

of a sodium iodide detector will close 

valves on the transfer line and trip the 

transfer pump before an unsafe mass can 

be transferred.

1st Control: Dual independent sampling of 

raffinate storage columns before transfer 

may be granted.

2nd Control: In-line sodium iodide detector 

shuts the isolation valves and trips the 

transfer pump.

DID: Chemistry of the extraction process 

is closely monitored (temperature, pH, 

TBP proportion, etc.). Operators trained to 

notice yellow liquid in raffinate storage 

columns.
May 2014 5-C-9 NUREG-1520, Revision 2

Double-Contingency Discussion Associated Criticality Controls

INTERACTION Scenarios

Normal-condition controls: Configuration of process equipment as modeled ensures 

subcriticality under normal conditions. Specific interaction attributes are the spacing 

between columns and distance between the columns and walls.

INT-01: Seismic event reduces spacing between columns or between columns 

and walls

The building is designed in accordance 

with the Uniform Building Code in effect at 

the time of its construction, so as to 

withstand a design-basis earthquake. The 

supports are reinforced and a structural 

analysis shows that they will withstand 

greater than a 100-year earthquake. In 

addition, if the column supports fail, it 

would require more than two columns to 

come to rest against each other along their 

entire length, or more than one such 

column to rest flat against the wall. It is far 

more likely that an energetic seismic event 

would cause the columns to be randomly 

arranged. In addition, moving the columns 

more than 18 inches would almost 

certainly cause the piping to break, and 

the solution would therefore likely drain to 

the floor, as analyzed in GEO-01 above. 

Sub-scenario INT-01a: Supports fail but 

columns remain intact.

External Event (EE)): A seismic event 

capable of causing structural supports of 

the columns to fail is judged to be at least 

unlikely (as used in the Double 

Contingency Principle).

1st Control: Design of column supports to 

withstand specified load is credited in IC 

likelihood.

Natural and Credible Course of Events 

(NCCE): It is at least unlikely for columns 

to come to rest in such a way as to exceed 

the keff limit.

Sub-scenario INT-01b: Supports fail and 

columns or piping leak to the floor.

Upon further evaluation, this scenario is 

bounded by GEO-01 (so same controls 

apply).

NCCE: Displacement of columns by 

18 inches or more would almost certainly 

result in failure of the piping and column 

connections, leading to a leak.

INT-02: Container bearing fissile material placed adjacent to a column
May 2014 5-C-10 NUREG-1520, Revision 2

Double-Contingency Discussion Associated Criticality Controls

Calculations show that a geometrically 

controlled 5-gallon mop bucket, vacuum 

cleaner, etc., placed next to a column can 

exceed the keff limit (if placed on the 

midline between two columns, or between 

a column and the wall). (Containers with 

volumes larger than 5 gallons are 

prohibited in the solution area unless 

specifically evaluated to be subcritical). 

Administrative controls prohibit the 

introduction of solution-bearing equipment 

closer than 12 inches to the columns. 

There is no reason for an operator to raise 

such a necessarily heavy container off the 

floor, and it is unlikely (because of the 

location of flanges, small-diameter piping, 

etc.) that such a container would be placed 

against a column. However, a design 

change is being made so that a mesh 

barrier will be affixed to prevent placing 

such a container between the columns or 

between a column and the wall.

1st Control: Operators are prohibited from 

placing solution-bearing equipment closer 

than 12 inches to the extraction columns.

2nd Control: Mesh barrier affixed to the 

columns to prevent placing a container 

between the columns or between a column 

and the wall.

3rd Control: Containers larger than 

5 gallons are prohibited in solution areas.

DID: Location of flanges, piping, etc., is 

such that it is very impractical to place a 

container against the columns. Columns 

are raised 12 inches above the floor, so 

the scenario would require manually lifting 

a container weighing a minimum of 40 lb 

(5 gallons of pure water) off the floor.

PHYSICOCHEMICAL Scenarios

Normal-condition controls: The nature of the process.

PC-01: Incomplete upstream dissolution of scrap material

The failure to use sufficient nitric acid, 

achieve the right temperature, properly 

agitate the scrap-acid mixture, or wait the 

required time period could result in 

incomplete dissolution, which can result in 

piping a heterogeneous UO2-water mixture 

into the extraction columns. 

Double-contingency protection is provided 

by dual filters to prevent the introduction of 

undissolved solids into the extraction 

process. The filters will be subject to 

monthly surveillance to detect degradation.

1st Control: Filter to prevent undissolved 

UO2 from reaching the extraction process.

2nd Control: Second filter to prevent 

undissolved UO2 from reaching the 

extraction process.

DID: Procedural controls on nitric acid and 

mixing time in the dissolution process. 

Temperature alarm on the acid bath. Any 

undissolved solids will tend to settle at the 

bottom of the columns.

ENRICHMENT Scenarios

Normal-condition controls: Facility-wide limit on enrichment is used in evaluating this 

process.

[There are no identified enrichment scenarios; the highest facility enrichment is used, 

and this is not an enrichment facility.]
May 2014 5-C-11 NUREG-1520, Revision 2

1

2 The example double-contingency discussion is necessarily abbreviated, because it neglects any 

3 number of complicating factors that could arise in actual plant conditions. Such an evaluation 

4 would also generally be supported by criticality calculations demonstrating abnormal-condition 

5 subcriticality, system drawings, piping and instrumentation diagrams, specifications, 

6 test/operating data, supporting technical evaluations, and other information that comprises the 

7 ISA documentation for this process. Defense-in-depth controls and additional safety margin are 

8 discussed in this table; while a good practice, they are ordinarily not tabulated along with the 

9 criticality controls but would rather be embedded in the calculations and other supporting 

10 information.

11

12 After several iterations resulting in the above double-contingency table, a final list of criticality 

13 controls for such a process is given below (new controls in italics):

14

GEOMETRY: INTERACTION: PHYSICOCHEMICAL FORM:

• Outer column diameter

• Column wall thickness

• Area of the floor/room

• Floor is sloped ≥5°

• Floor drain less than 

4 inches in diameter

• Floor drain leads to an 

8-inch collection tank

• Oil reservoirs less than 

a safe volume

• Columns composed of 

borosilicate glass 2

• Columns must be 

hydrostatically tested 

(to specified pressure)

• Columns are vented

• Columns equipped 

with siphon breaks

• Dual independent 

sampling on raffinate 

before transfer

• In-line active interlock 

on wastewater tanks

• Column spacing

• Distance between 

columns and walls

• Spacing between 

pumps

• Column supports

• Containers not to be 

placed against column

• Mesh barrier around 

columns

• Containers must be < 

5 gallons

• Upstream dual filters

15

16 The description of controls has been simplified, such as by not specifying specific associated 

17 subcritical limits or measures required to ensure that failure is unlikely (e.g., surveillance or 

18 maintenance, etc.). In addition, defense-in-depth controls have not been included in this list. 

19 The following are also noted: (1) the large number of controls needed to prevent a change in 

20 fissile-material geometry and (2) the number of choices the analyst had at several junctions as 

21 to what controls to put in place (e.g., the analyst could have credited the dissolution temperature 

22 alarm rather than two filters, could have chosen to limit interstitial moderator, or could have 

23 established an absorber control rather than install a mesh barrier around the columns). Some 

24 such choices would be made in accordance with the preferred control hierarchy—engineered 

 2 Not for, as is typically done, neutron absorption (which is not controlled), but to ensure that the materials of 

composition are consistent with the chemical environment to prevent corrosion.
May 2014 5-C-12 NUREG-1520, Revision 2

1 over administrative, passive over active—and some would typically be made out of convenience 

2 or operational necessity.

3

4 Demonstration of Satisfaction of ISA Requirements

5

6 The above evaluation of hazards associated with a hypothetical solvent extraction process was 

7 based on demonstrating subcriticality under both normal and credible abnormal conditions. The 

8 double contingency principle was applied throughout, establishing criticality controls and taking 

9 credit for process characteristics and the natural and credible course of events as needed. The 

10 choice of controls was also done largely in adherence to the preferred control hierarchy, as a 

11 majority of controls in the above list are engineered controls, and in that preference is strongly 

12 for geometry over other less desirable means of control. (It is noted that each scenario listed 

13 above contains at least one passive engineered control (e.g., fixed geometry or neutron 

14 absorption).)

15

16 As stated in Appendix 5-A to this SRP, adherence to the double-contingency principle may be 

17 presumed to meet the performance requirements of 10 CFR 70.61(b) if application of double 

18 contingency is in accordance with the guidance in Appendix 5-A and Chapter 5 of the SRP, and 

19 if controls relied on to demonstrate double contingency are designated as items relied on for 

20 safety in the ISA summary, with sufficient management measures applied to render changes in 

21 process conditions “unlikely.” Assuming that this is the complete set of criticality scenarios and 

22 necessary controls to meet double contingency, consistent with the guidance for being unlikely, 

23 independent, etc., all that remains is to designate these controls as items relied on for safety 

24 and to apply management measures appropriate to the types and characteristics of those 

25 controls. The applicant has already made the choice of what system features need to be 

26 designated as “controls”, such as in choosing to control interaction over absorption or justifying 

why keff 27 is not sensitive to certain system dimensions. Such a set would represent the minimum 

28 set of items relied on for safety required to comply with 10 CFR 70.61(e). In addition, the 

29 applicant identified no controls that are the sole item preventing or mitigating an accident 

30 sequence leading to criticality, because (1) the design adheres in all cases to the 

31 double-contingency principle, and (2) the analysis was based on a consideration of normal and 

32 abnormal conditions, rather than a consideration of individual accident sequences.

33

34 The example in this appendix illustrates the essential difference between a parameter-based 

35 and sequence-based approach to demonstrating safety and compliance with the performance 

36 requirements of 10 CFR 70.61. In a parameter-based approach—which is the traditional way of 

37 evaluating criticality safety—the normal condition is described in terms of parameters and limits 

38 on those parameters, and the focus is on whether deviations from those conditions will result in 

39 criticality. This can be thought of as a top-down approach, because one starts by asking what 

40 parameters are necessary to control to prevent criticality from occurring, and then establishing 

41 controls on those parameters. A sequence-based approach can be thought of as a bottom-up 

42 approach, because an applicant starts by considering all credible deviations from normal 

43 conditions and then determining what sequences of events result and whether they lead to 

44 criticality. Both of these approaches may in principle be used, but the parameter-based 

45 approach tends to be the most conservative and gives greater assurance with less work of 

46 having considered everything. If the most reactive credible change in a controlled parameter 

47 still results in the system being subcritical, it is not necessary for the applicant to explicitly 

48 enumerate all the possible ways that such a change in the parameter could occur. Because it is 

49 also a deterministic approach, based on assuming that the optimal or most reactive credible 

50 conditions occur, it also eliminates the uncertainty that is associated with trying to estimate the 

51 likelihood of all of the possible sequences. It recognizes the historical fact that it is not the 

52 identification of sequences or estimation of likelihood that has led to the low incidence of 
May 2014 5-C-13 NUREG-1520, Revision 2

1 criticality, but rather the defense-in-depth and safety margin associated with this very 

2 conservative approach. The difficulty with applying a sequence-based approach to criticality is 

3 two-fold: (1) the large number of physical variables upon which system reactivity depends can 

4 make the number of possible events that should be considered voluminous; and (2) many of 

5 these physical variables are interrelated to such an extent that it can be nearly impossible to 

6 identify discrete items relied on for safety.

7

8 It is this second difficulty with which an applicant must contend in designating the items relied on 

9 for safety. While pertinent column dimensions have been identified as criticality controls in the 

10 example, geometry is not independent from interaction or physicochemical form. There is no 

11 single control listed above that ensures subcriticality, but it is rather the entire interlocking 

12 system of controls that performs this overarching safety function. The individually safe columns 

13 are only subcritical because they are spaced a certain distance apart. They are only 

14 geometrically safe assuming they contain one fissile medium and not another. What ensures 

15 subcriticality is therefore the configuration of the system as a whole. As stated in Appendix 5-A, 

16 it is not the configuration of the system as it exists in the plant, but the configuration of the 

17 system as modeled, that ensures subcriticality. Further, it is not every input parameter to the 

18 model, but only those that can be shown to have a measurable effect on system reactivity 

19 (because some input parameters may be excluded based on a sensitivity analysis or other 

20 justification) to such a degree that they must be limited to demonstrate compliance with the 

license limits on keff 21 . Recognizing this distinction is the key to avoiding the extreme of labeling 

22 every section of pipe and every nut and bolt as an item relied on for safety. The list of items 

23 relied on for safety in the example therefore includes:

24

25 SX-01: Configuration of the solvent-extraction process contained in Room XYZ. The following 

26 specific dimensions of equipment shall be limited:

27

28 • Outer diameter of the extraction, scrubbing, and stripping columns shall be < 10 inches

29 • Wall thickness of the extraction, scrubbing, and stripping columns shall be > 0.25 inches

30 • Columns shall be spaced in a single row > 18 inches apart center-to-center

31 • Columns shall be spaced > 12 inches from the concrete walls

32 • The floor area of Room XYZ shall be greater than 100 square feet

33 • The floor of Room XYZ will be sloped ≥ 5° towards the corner

34 • The diameter of the floor drain shall be < 4 inches

35 • The diameter of the drain collection tank shall be < 8 inches

36 • Pumps will be spaced in a single row > 18 inches apart center-to-center

37 • Pump oil reservoirs shall have volumes of < 5 gallons

38 • Fissile solution piping shall be < 1⁄2 inch in diameter, and shall be run perpendicular to 

39 the column axes for at least a distance of 6 inches from the column surface.

40

41 No single item listed ensures subcriticality alone. Rather, these are—with the exception of the 

42 last item—the dimensions of process equipment that are included in the model and together are 

43 limited to ensure subcriticality. An applicant could also choose to define “the configuration of 

44 the system” generically as an item relied on for safety. This presents no difficulty, because the 

45 entire facility must be under configuration control. The definition of the system includes all 

46 equipment included in the model, which is the equipment in Room XYZ subject to neutron 

47 interaction. The specific attributes of this item relied on for safety are as enumerated. The 

48 safety function is to keep fissile material within specified dimensions to ensure subcriticality. 

49 The last item, restricting the configuration of the piping associated with the solvent-extraction 

50 process, was added by the hypothetical applicant in recognition that it pertains to the conditions 

51 under which something does not need to be included in the model. All of the above attributes 

52 are needed to ensure that the models demonstrating subcriticality will remain bounding. It is 
May 2014 5-C-14 NUREG-1520, Revision 2

1 noted that the configuration of the system is an item relied on for safety, but is not the sole item 

2 preventing or mitigating an accident sequence, because there is no credible failure that can lead 

3 to criticality. In addition, because minimum and maximum dimensions are specified, a change 

4 that keeps the system within the description above (e.g., a change to the outer column diameter 

5 that does not exceed 10 inches) does not alter its safety function.

6

7 Other items relied on for safety would also generally exist (e.g., restriction on portable 

8 containers, siphon break, or upstream filters). Some of these could also in principle be included 

9 in “the configuration of the system” because they ensure the conservative nature of the models 

10 demonstrating subcriticality under normal and abnormal conditions. The combining or 

11 separation into one, two, or multiple items relied on for safety is arbitrary because they all have 

12 the same underlying safety function.

13

14 The final step by an applicant is typically to specify sufficient management measures to ensure 

15 that changes in process conditions will be subcritical. Management measures appropriate to 

16 passive engineered components include configuration management, change control, and 

17 surveillance. If the columns are presumed to be composed of a material that is consistent with 

18 the chemical environment, corrosion would not be a concern and the periodic surveillance 

19 committed to as part of the NCS Program in the license application would be sufficient. This 

20 periodic surveillance would not be to ensure the reliability of any specific item relied on for 

21 safety, but rather to verify that no design changes have been made that could negatively affect 

22 criticality safety. Quality-assurance measures, such as use of procurement specifications for 

23 attributes important to criticality safety, may also be specified by an applicant. Items such as 

24 the in-line filters might need more frequent surveillance and specific maintenance instructions. 

25 For the active interlock, periodic maintenance and functional testing would also generally be 

26 required. For administrative controls (mainly restrictions on container movement), management 

27 measures would generally consist of operator training, procedures, postings, and periodic audits 

28 and inspections. Conspicuous labeling of permitted containers may also be used to enhance 

29 the reliability of this control.

30

31 For this example, the following additional items relied on for safety are presumed to have been 

32 specified, in addition to “the configuration of the system,” SX-01:

33

34 Passive Engineered

35

36 NOTE: Configuration of the raffinate storage columns (dimensions, spacing, arrangement in a 

37 line) are presumed to be covered by another CSE. They are in another room and do not 

38 interact with process equipment in Room XYZ. This is established as RAF-01 in the other CSE.

39

40 SX-02: Physical integrity of the extraction, scrubbing, and stripping columns, and associated 

41 piping. Columns will be composed of borosilicate glass, and piping of stainless steel 316, and 

42 shall be hydrostatically tested to 300 psig prior to installation.

43

44 SX-03: Each column will be equipped with transparent vents of diameter > 1 inch, at or below 

45 the elevation of piping leading to the unfavorable geometry supply or wastewater tanks.

46

47 SX-04: Piping leading to each column will be equipped with a siphon break, placed between the 

48 columns and their common supply header.

49

50 SX-05: Column supports shall be shown to be capable of withstanding a 100-year seismic 

51 event without failing catastrophically (i.e., allowing the column to become detached from its 

52 support).
May 2014 5-C-15 NUREG-1520, Revision 2

1

2 SX-06: A mesh barrier shall be affixed to the columns to prevent portable containers from being 

3 placed between the columns or between a column and the wall.

4

5 SX-07: Dual metal filters shall be installed on the header from the dissolution trays to the 

6 extraction process. They will be inspected monthly.

7

8 Active Engineered

9

10 SX-08: In-line sodium iodide detector closes isolation valves between the raffinate storage 

11 columns and unfavorable geometry wastewater treatment tanks and trips the transfer pump 

12 upon detection of > 0.05 gU/l.

13

14 Administrative

15

16 SX-09: Dual independent sampling on raffinate storage columns before authorizing transfer to 

17 wastewater treatment tanks.

18

19 SX-10: Portable containers with volumes > 5 gallons are prohibited from Room XYZ, with the 

20 exception of movable equipment with dedicated CSEs (e.g., vacuum cleaners).

21

22 SX-11: Portable containers are prohibited from being placed adjacent to a column. 

23

24 Based on the foregoing subcriticality analysis, such a system of controls may be designated as 

25 items relied on for safety in the ISA summary, with appropriate management measures 

26 specified. The performance requirements would therefore then be satisfied.

27

May 2014 6-1 NUREG-1520, Revision 2

6. CHEMICAL PROCESS SAFETY

1 6.1 Purpose of Review

2

3 The primary purpose of the review is to determine whether the applicant’s proposed facility 

4 design and operations adequately protects the health and safety of workers and the public from 

5 chemical hazards. Such hazards are those that are related to the storage, handling, and 

6 processing of licensed materials which are within the NRC’s regulatory jurisdiction. The 

7 proposed facility design and operations must adequately protect the health and safety of 

8 workers and the public from the chemical risks in the facility during normal operations and 

9 credible accident conditions. The applicant must ensure that its facility is adequately protected 

10 against conditions that could affect the safety of licensed materials and thus present an 

11 increased radiation or chemical risk (e.g., a chemical that incapacitates operators and prevents 

12 their entry into an area of the facility where licensed materials are handled). “Hazardous 

13 chemicals produced from licensed materials” is a defined term in 10 CFR 70.4, “Definitions.” As 

14 indicated in the wording of this definition, an example of such a hazardous chemical is hydrogen 

15 fluoride that is produced by the reaction of uranium hexafluoride and water. 

16

17 In certain circumstances, the NRC’s authority over chemicals may be broader than indicated 

18 above. FCSS should confer with NSIR should questions about the scope of the NRC’s authority 

19 in this area arise.

20

21 Chemical safety issues are evaluated as part of the applicant’s integrated safety analysis (ISA) 

22 summary. As required in 10 CFR 70.65, “Additional Contents of Applications,” the ISA summary 

23 must include the evaluation of credible accident sequences at the facility, identification of items 

24 relied on for safety (IROFS) where necessary to reduce the likelihood of accident occurrence or 

25 to mitigate the consequences of accidents, and identification of the management measures that 

26 provide reasonable assurance of the availability and reliability of IROFS when needed. 

27 To begin the chemical safety review, the reviewer should examine the license application, the 

28 facility and process description discussed in Chapter 1 of this standard review plan (SRP), and 

29 the ISA summary discussed in Chapter 3 of the SRP to gain familiarity with the following:

30

31 • process information and accident sequences leading to conditions that could pose 

32 chemical hazards

33

• IROFS and sole IROFS1 34 used to reduce the likelihood or consequences of accidents 

35 involving chemical hazards

36

37 • proposed procedures to protect public health and safety and the environment 

38 (e.g., a high-level programmatic description of how the licensee or applicant proposes to 

39 operate, maintain, or manage the facility)

40

41 • the definitions of “unlikely,” “highly unlikely,” and “credible” as used in the ISA 

42 evaluations 

 1

 Sole IROFS are those that are the sole item preventing or mitigating an accident for which the 

consequences could exceed the performance requirements of 10 CFR 70.61, “Performance Requirements.”
May 2014 6-2 NUREG-1520, Revision 2

1 • quantitative standards used to assess the consequences to an individual from acute 

2 chemical exposure to licensed material or a chemical produced from licensed materials 

3 that are onsite or expected to be onsite

4

5 • management measures proposed for ensuring that the IROFS will be available and 

67 reliable when required

8

9 6.2 Responsibility for Review

10

11 Primary: Chemical Process Safety Reviewer (all sections of this chapter)

12

13 Supporting: Licensing Project Manager

14 Fuel Cycle Facility Inspection Staff (as needed)

15 Health Physicist (for uranium and transuranic toxicity issues)

16 Primary Reviewers of Chapters 1, 3, 8, 9, and 11 of this SRP

17

18 6.3 Areas of Review

19

20 Regulations in 10 CFR 70.62(a) require an applicant to establish and maintain a safety program 

21 that will adequately protect worker and public health and safety and the environment from the 

22 chemical hazards from licensed material. Although it is not required to establish a separate 

23 chemical process safety program, the applicant must demonstrate that it has considered 

24 chemical hazards and accident sequences that could affect licensed material and has 

25 adequately prevented or mitigated them in accordance with 10 CFR 70.61, “Performance 

26 Requirements.” Applicants must conduct an ISA and provide an ISA summary that meets the 

27 requirements of 10 CFR 70.65.

28

29 The staff’s chemical process safety review should focus on the chemical safety-related accident 

30 sequences described in the ISA summary (SRP Chapter 3), the proposed IROFS, and the 

31 corresponding management measures (SRP Chapter 11). The review should determine 

32 whether the applicant’s equipment, facilities, and management measures are adequate to 

33 protect against releases and chemical exposures of licensed material, hazardous chemicals 

34 produced from licensed material, and chemical risks of plant conditions that affect the safety of 

35 licensed material. The review must verify that classification of IROFS important to safety or 

36 grading of management measures proposed by the applicant in accordance with 

37 10 CFR 70.62(a) is appropriate to the accident risk that the IROFS are designed to reduce.

38

39 The 2013 memorandum of understanding between the NRC and the Occupational Safety and 

40 Health Administration (OSHA) states that the NRC oversees chemical safety issues related to 

41 (1) radiation risks of licensed materials, (2) chemical risks of licensed materials, and (3) plant 

42 conditions that affect or may affect the safety of licensed materials and thus present an 

43 increased radiation risk to workers. OSHA oversees plant conditions that do not affect or 

44 involve the safety of licensed materials.

45

46 The staff’s review should cover the following topics which are required to be in the 

47 ISA summary:

4849

50 1. description of the site, facility, and chemical processes with respect to chemical safety 

51 for normal operations. The information should include a discussion of process
May 2014 6-3 NUREG-1520, Revision 2

1 chemistry, flow diagrams, discussion of major process steps, and identification of major 

2 pieces of equipment

3

4 2. chemical hazards and chemical accident sequences, including unmitigated accident 

5 sequences involving hazardous chemicals and licensed materials

6

7 3. chemical accident likelihood and consequences of accident sequence, including the 

8 applicant’s interpretation of the qualitative chemical risk levels and the assumptions, 

9 bases, and methods the applicant used to estimate the accident likelihood and 

10 consequences to workers and the public

11

12 4. IROFS and sole IROFS relied on for chemical safety and a description of their safety 

13 function 

14

15 5. management measures, including those management measures to ensure the reliability 

16 and availability of chemical safety IROFS

17

18 Review Interfaces

19

20 In addition to Chapter 6 of the application, the chemical reviewer should examine information in 

21 the following other areas to ensure that it is consistent with the information in Chapter 6:

22

23 • facility and process description applied to chemical safety, as described in Chapter 1 of 

24 this SRP

25

26 • safety program, ISA commitments, and ISA documentation applied to chemical safety 

27 under SRP Chapter 3

28

29 • emergency plan applied to chemical safety under SRP Chapter 8

30

31 • dispersion models used for consequence modeling under SRP Chapter 9 as appropriate

32

33 • configuration management, maintenance, training and qualifications, procedures, audits 

34 and assessments, incident investigations, record management, and other quality 

35 assurance elements, as described in SRP Chapter 11

36

37 6.4 Acceptance Criteria

38

39 6.4.1 Regulatory Requirements

40

41 Acceptance criteria are based on meeting the relevant requirements of the following regulations:

42

43 1. The general and additional contents of an application with respect to chemical process 

44 safety are in 10 CFR 70.22, “Contents of Applications,” and 10 CFR 70.65 respectively. 

45 General information that must be included in the license application appears in 

46 10 CFR 70.22. Information that must be included in the ISA summary appears in 

47 10 CFR 70.65.
May 2014 6-4 NUREG-1520, Revision 2

1 2. The requirements for the approval of the application are in 10 CFR 70.23, 

2 “Requirements for the Approval of Applications,” and 10 CFR 70.66, “Additional 

3 Requirements for Approval of License Application.”

4

5 3. The chemical process safety review should provide reasonable assurance of compliance 

6 with the performance requirements in 10 CFR 70.61.

7

8 4. Requirements to maintain and establish a safety program appear in 10 CFR 70.62, 

9 “Safety Program and Integrated Safety Analysis.”

10

11 5. The requirements for new facilities or new processes at existing facilities are in 

12 10 CFR 70.64, “Requirements for New Facilities or New Processes at Existing 

13 Facilities.”

14

15 6.4.2 Regulatory Guidance

16

17 The following regulatory guidance is relevant to chemical process safety:

1819

20 1. NUREG-1391, “Chemical Toxicity of Uranium Hexafluoride Compared to Acute Effects 

21 of Radiation,” February 1991

22

23 2. NUREG-1513, “Integrated Safety Analysis Guidance Document,” May 2001

24

25 3. NUREG-1601, “Chemical Process Safety at Fuel Cycle Facilities,” August 1997

26

27 4. NUREG/CR-6410, “Nuclear Fuel Cycle Facility Accident Analysis Handbook,” 

28 March 1998

29

30 5. NUREG/CR-6481, “Review of Models Used for Determining Consequences of 

31 UF6 Release,” November 1997

32

33 6.4.3 Regulatory Acceptance Criteria 

34

35 The reviewer should find the applicant’s chemical process safety information acceptable if there 

36 is reasonable assurance that it adequately addresses and satisfies the acceptance criteria 

37 presented below. The applicant may elect to incorporate some or all of the requested chemical 

38 process information in the facility and process description (SRP Section 1.1) or the 

39 ISA summary. Either approach is acceptable, as long as adequate information is presented.

40

41 6.4.3.1 Chemical Process Description

42

43 The regulation in 10 CFR 70.65(b)(3) requires the ISA summary to include a description of each 

44 process in the facility. The applicant’s descriptions of the chemical processes are acceptable if 

45 they meet the following conditions:

4647

48 1. Process descriptions are sufficiently detailed to allow an understanding of the chemical 

49 process hazards (including radiological hazards caused by or involving chemical 

50 accidents) and to allow the development of potential accident sequences.

51 2. Process descriptions are sufficiently detailed to allow an understanding of the theory of 

52 operation.
May 2014 6-5 NUREG-1520, Revision 2

1

2 6.4.3.2 Chemical Hazards and Accident Sequences

3

4 The identification of chemical hazard and accident sequences in the ISA summary is acceptable 

5 in the following circumstances:

6

7 1. The applicant identifies hazardous chemical inventory and location and describes the 

8 hazards and accident sequences involving hazardous chemicals produced from licensed 

9 material. The applicant also identifies chemical risks that could affect the safety of 

10 licensed materials.

11

12 2. The applicant identifies the chemical accident sequences that could result in a high- or 

13 intermediate-consequence event. Each accident sequence identified by the applicant 

14 should include a description of how the hazardous chemical could come in contact with 

15 facility personnel and offsite personnel. The hazard evaluation should use appropriate 

16 accepted methods.

17

18 6.4.3.3 Chemical Accident Sequence Likelihood and Consequences

19

20 A. The reviewer should consider the following criteria in evaluating whether the applicant’s 

21 chemical accident likelihood and consequence estimates are acceptable:

22

23 1. The applicant estimates the accident likelihood in a manner that is consistent 

24 with the definitions of likelihood presented in the ISA summary and reviewed 

25 under Chapter 3 of this SRP.

26

27 2. The applicant identifies and uses appropriate techniques and appropriate 

28 assumptions in estimating the concentrations of released hazardous chemicals 

29 produced from licensed material or by abnormal plant conditions that could affect 

30 the safety of licensed materials.

31

32 3. The applicant provides evidence that the dispersion models used to determine 

33 whether a release of chemicals might affect worker or public health and safety 

34 are appropriate to the process and the physical setting. The applicant should 

35 demonstrate that the models used for chemical reaction and dispersion analysis 

lead to a conservative estimate of potential consequences.2 36

37

38 4. The applicant develops consequence estimates using, where appropriate, the 

39 guidance on atmospheric and consequence modeling in NUREG/CR-6410. The 

40 applicant may also use alternative methods if accompanied by adequate 

41 supporting information.

42 5. The application describes the quantitative standards used to assess the 

43 unmitigated and mitigated consequences to an individual outside the control area 

44 (public) or to a worker from acute chemical exposure to licensed material, 

45 chemicals produced from licensed materials, or chemicals in contact with 

46 licensed materials that are onsite or expected to be onsite.

 2 Source term and vapor dispersion models used to calculate the concentration of uranium hexafluoride (UF6) 

and its reaction products conform to any relevant guidance in NUREG/CR-6481.
May 2014 6-6 NUREG-1520, Revision 2

1

2 6. Acceptable exposure standards include, but are not limited to, the Emergency 

3 Response Planning Guidelines established by the American Industrial Hygiene 

4 Association, the Acute Exposure Guideline Levels established by the National 

5 Advisory Committee for Acute Guideline Levels for Hazardous Substances, and 

6 the exposure limits established by OSHA. The applicant needs to verify that the 

7 selected standard applies to the worker or the individual outside the control area. 

8 Note that all the standards mentioned above apply to airborne exposure to 

9 gases, vapors, and particulates. Those limits are not intended to evaluate 

10 consequences for chemical exposures through other exposure paths.

11

12 7. The applicant may propose alternate exposure standards if accompanied by 

supporting documentation to justify its use.3 13 

14

15 To ensure compliance with the performance requirements in 10 CFR 70.61, consideration 

16 should be given to multiple exposure pathways (e.g., inhalation and dermal) of the hazardous 

17 chemicals. In addition to the standards mentioned above, the Material Safety Data Sheets 

18 contain useful information about toxicity and health effects as well as first aid, reactivity, 

19 protective equipment, and spill or leak procedures. Therefore, it is recommended that the the 

20 Material Safety Data Sheets of the hazardous chemicals at the facility be reviewed when 

21 accessing chemical consequences.

22

23 B. The reviewer should confirm the following:

24

25 1. Consequence categorization is consistent with the performance requirements in 

26 10 CFR 70.61(b) and 10 CFR 70.61(c).

27

28 2. The application includes definitions of “unlikely,” “highly unlikely,” and “credible,” 

29 as used in the evaluations in the ISA.

30

31 6.4.3.4 Chemical Process IROFS and Sole IROFS

32

33 The applicant must provide in the ISA summary a list of chemical process safety controls 

34 (i.e., IROFS) that are necessary to meet the performance requirements of 10 CFR 70.61. The 

35 applicant should identify IROFS for any unmitigated hazardous chemical accident sequences 

36 that would lead to consequences that exceed the performance requirements. The applicant 

37 should describe the IROFS in sufficient detail to permit an understanding of their safety 

38 functions.

39 The applicant must demonstrate, pursuant to 10 CFR 70.61(b), that any identified IROFS 

40 reduces the likelihood of each credible high-consequence event involving hazardous chemicals 

41 so that, upon implementation of IROFS, the event will be “highly unlikely” to occur. 

42 Alternatively, any such IROFS must make the event’s consequences less severe than those 

43 specified in 10 CFR 70.61(b)(4).

44

 3 Note that 10 CFR 70.61 requirements are for “acute chemical exposures,” and OSHA permissible exposure 

limits are typically time-weighted average values. Consequently, for ISA purposes, acute chemical release 

limits may not be adjusted by the time-weighted average calculation (which involves concentration and 

duration of exposure) unless the ISA summary provides a rational basis for doing so.
May 2014 6-7 NUREG-1520, Revision 2

1 The applicant must demonstrate, pursuant to 10 CFR 70.61(c), that any identified IROFS 

2 reduces the likelihood of each credible intermediate-consequence event involving hazardous 

3 chemicals so that, upon implementation of IROFS, the event will be “unlikely” to occur. 

4 Alternatively, any such IROFS must make the event’s consequences less severe than those 

5 specified in 10 CFR 70.61(c)(4).

6

7 If the applicant takes a graded approach to safety, in accordance with 10 CFR 70.62(a), the 

8 reviewer should establish that the grading of management measures applied to IROFS is 

9 appropriate and sufficient to protect against chemical process risks. For example, the applicant 

10 should consider reliance on passive controls of active systems and defense in depth, in 

11 accordance with 10 CFR 70.64(b). To reduce common-mode failures in critical safety areas, 

12 the applicant should consider the use of independent sources of motive force for items such as 

13 control actuators, jet pumps, eductors, and ejectors. The applicant should also consider fail14 safe controls wherever practical.

15

16 6.4.3.5 Chemical Process Management Measures

17

18 The applicant must describe the management measures proposed to ensure the availability and 

19 reliability of IROFS and sole IROFS when they are required to perform their safety functions. 

20 Management measures may be graded, commensurate with the safety significance of the 

21 IROFS to which they are applied.

22

23 The application should meet the following criteria:

2425

26 1. The application should describe the engineering approach, basis, or schemes employed 

27 to maintain safety during normal operations.

28

29 2. The ISA summary should identify the administrative and engineered controls selected to 

30 prevent or mitigate a chemical risk, the hazard being mitigated, and the risk category. 

31 The applicant should also explain how IROFS have been classified, how management 

32 measures have been graded, and how such classification and grading is commensurate 

33 with the reduction in risk that the IROFS are designed to achieve.

34

35 3. The application should demonstrate that the management measures ensure that IROFS 

36 are available and reliable by briefly describing the following:

3738

39 a. procedures to ensure the reliable operation of engineered controls 

40 (e.g., inspection and testing procedures and frequencies, calibration programs, 

41 functional tests, corrective and preventive maintenance programs, and criteria for 

42 acceptable test results)

43

44 b. procedures to ensure that administrative controls will be correctly implemented, 

45 when required (e.g., employee training and qualification in operating procedures, 

46 refresher training, safe work practices, development of standard operating 

47 procedures, and training program evaluation)

48

49 6.4.3.6 Requirements for New Facilities or New Processes at Existing Facilities

50

51 The application should address the baseline design criteria (BDC) for new facilities or new 

52 processes at existing facilities that require a license amendment under 10 CFR 70.72, “Facility 

53 Changes and Change Process.” The applicant must apply the BDC to the design of new 
May 2014 6-8 NUREG-1520, Revision 2

1 processes (10 CFR 70.64 (a)(5)) but is not required to retrofit existing facilities or existing 

2 processes; however, all facilities and processes must comply with the performance 

3 requirements in 10 CFR 70.61. Section 2.4 of NUREG-1601 contains a list of items that should 

4 be considered during facility design. For new facilities and new processes in existing facilities, 

5 the design must provide for adequate protection against chemical risk from licensed material, 

6 facility conditions that affect the safety of licensed material, and hazardous chemicals produced 

7 from licensed material. With respect to chemical process safety, the application should be 

8 considered acceptable if it includes the following information (or references other sections of the 

9 application that include this information):

1011

12 1. A description of how the applicant performed the ISA for the new process and how the 

13 ISA satisfies the principles of the BDC of 70.64(a) for chemical safety hazards and the 

14 performance requirements in 10 CFR 70.61. The applicant also explains how it applies 

15 defense-in-depth requirements of 70.64(b), particularly higher risk accident sequences 

16 with chemical hazards. Acceptable defense-in-depth principles for the chemical process 

17 safety design are those that support a hierarchy of controls: prevention, mitigation, and 

18 operator intervention, in order of preference.

19

20 2. A description of any proposed facility-specific or process-specific relaxations or additions 

21 to BDC, along with justifications for relaxations.

22

23 3. The ISA summary describes how the applicant applied the chemical safety BDC in 

24 establishing the design principles, features, and control systems of the new process.

25

26 6.5 Review Procedures

27

28 6.5.1 Acceptance Review

29

30 During the acceptance review of a license application, the reviewer should examine the 

31 submittals to identify major deficiencies in the information provided for each area of review 

32 specified in SRP Section 6.3. Reviewers must decide whether they have enough information to 

33 proceed with a detailed review. Less significant errors or deficiencies that can be addressed in 

34 a single request for additional information should be accepted. However, before the NRC 

35 performs a detailed review, the applicant should correct major deficiencies that would require 

36 several requests for additional information to resolve.

37

38 Reviewers should record whether each area of review is adequately addressed in the 

39 application, is adequately addressed in a referenced document, is not applicable to the 

40 application, or has a major deficiency.
May 2014 6-9 NUREG-1520, Revision 2

1 6.5.2 Safety Evaluation

2

3 During the safety evaluation, the reviewer determines whether the application comprehensively 

4 describes the chemical safety of the licensed activity, as identified in SRP Section 6.3. For 

5 deviations from the specific acceptance criteria, the staff should review the applicant’s 

6 explanation of how the proposed alternatives to the SRP criteria provide an acceptable method 

7 of complying with the relevant NRC requirements identified in Section 6.4.

8

9 During the license application and ISA summary review, the reviewer should identify and note 

10 any items or issues that should be inspected during an operational readiness review, if such a 

11 review will be performed. These items could include confirming that the applicant implemented 

12 engineered controls through procedures and operator training.

13

14 The primary reviewer will prepare input to the safety evaluation report (SER) for the licensing 

15 project manager in support of the licensing action. During the initial review, the reviewer should 

16 draft the safety evaluation report (SER) described below. A request for additional information 

17 (RAI) will be prepared when clarification and additional information are needed to determine 

18 whether the licensee’s submittals comply with the regulations. For an existing facility, the 

19 reviewer may consult NRC inspectors to identify and resolve any issues related to the licensing 

20 review. For a planned facility, the reviewers may wish to consult with the facility design team to 

21 gain a better understanding of the process, its potential hazards, and its safety approaches. 

22 The reviewers should coordinate these interactions through the licensing project manager as 

23 well as in preparing RAIs. Additional information submitted by the applicant will be evaluated 

24 and a final SER will be provided to the licensing project manager.

25

26 6.5.2.1 Chemical Process Description

27

28 The results of the ISA are the basis for the chemical process safety evaluation. The reviewer 

29 should establish that the applicant’s facility design, operations, and IROFS for chemical safety 

30 provide reasonable assurance that they will function as intended and ensure the safe handling 

31 of licensed material at the facility. The reviewer must verify that the applicant’s proposed 

32 equipment and facilities are adequate to protect public health and safety and the environment. 

33 The reviewer should examine the mechanisms that will allow the applicant to identify and 

34 correct potential problems.

35

36 6.5.2.2 Chemical Hazard and Accident Sequences

37

38 The ISA summary shall contain the potential accident sequences caused by process deviations

39 or other events internal to the facility and credible external events, including natural phenomena. 

40 Whenever possible, a licensee should use its own experience to supplement the identification of 

41 potential chemical hazards. The review may cover a selected number of lower risk chemical 

42 safety-related accident sequences not identified in the ISA summary.

43

44 6.5.2.3 Chemical Accident Likelihood and Consequences

45

46 The reviewer must verify that the estimation of event likelihood is developed in a manner that is 

47 consistent with the methods and definitions reviewed and approved under Chapter 2 of this 

48 SRP.

49 The reviewer must verify that the proposed quantitative standards used to assess the 

50 consequences to an individual from acute chemical exposure are acceptable. Events with high 
May 2014 6-10 NUREG-1520, Revision 2

1 and intermediate consequences should be identified as well as the IROFS proposed to reduce 

2 the likelihood or the consequences of the event. The reviewer needs to ensure that the 

3 selected standards are correctly applied to the worker or the member of the public.

4

5 6.5.2.4 Chemical Process IROFS and Sole IROFS

6

7 The staff reviews the chemical process safety IROFS to ensure their adequacy in protecting 

8 against all unmitigated sequences identified in the ISA summary. The reviewer should establish 

9 that the applicant’s proposed controls (IROFS) for chemical safety provide reasonable 

10 assurance that they will function as intended and ensure the safe handling of licensed material 

11 at the facility.

12

13 6.5.2.5 Chemical Process Management Measures

14

15 The staff review should verify that the application describes the management measures that the 

16 licensee will take to provide reasonable assurance that the chemical safety IRFOS are available 

17 and reliable to perform their function. The technical reviewer should verify the applicant’s 

18 commitment to retaining records for chemical-process safety compliance and reporting 

19 commitments for chemical releases. In addition, the reviewer should verify the applicant’s 

20 commitment to refer any unacceptable performance deficiency to those responsible for the 

21 facility’s corrective action function, in accordance with Chapter 11 of this SRP.

22

23 If the applicant has applied a graded approach to safety, the reviewer should establish that the 

24 grading of management measures and classification of IROFS is appropriate and sufficient to 

25 protect against chemical process risks (see Chapter 11 of this SRP).

26

27 6.5.2.6 Requirements for New Facilities or New Processes at Existing Facilities

28

29 The staff reviews the applicant’s commitments to adhere to the BDC according to 

30 10 CFR 70.64(a) and to the defense-in-depth requirements of 70.64(b) for the design of new 

31 facilities or new processes at an existing facility that require a license amendment under 

32 10 CFR 70.72.

33

34 6.6 Evaluation Findings

35

36 The regulations in 10 CFR 70.23 and 70.66 state that an application for a license will be 

37 approved if the Commission can make the general findings listed in those sections. The basis 

38 for the general findings is an evaluation of whether the application adequately addresses all of 

39 the applicable regulatory requirements. More specifically, the staff’s evaluation should 

40 determine whether the licensing submittals provide sufficient information to satisfy the regulatory 

41 requirements listed in Section 6.4.1 of this SRP, and whether the applicant has appropriately 

42 addressed the regulatory acceptance criteria in SRP Section 6.4.3. The SER should state how 

43 the applicable regulatory requirements have been met based on the acceptance criteria 

44 described in this chapter of the SRP. If the applicant chooses to use an alternative approach, 

45 the reviewer should discuss in the SER whether the proposed approach satisfies the applicable 

46 regulatory requirements. The reviewers should use the following approach to document their 

47 evaluation:

48 1. State a specific regulatory requirement that applies to the application. Detailed 

49 acceptance criteria may be included where appropriate or necessary to clarify the 

50 requirement.
May 2014 6-11 NUREG-1520, Revision 2

1 2. Identify the areas where the regulatory requirement is addressed in the application, 

2 including the areas where the specific acceptance criteria described in this SRP are 

3 addressed.

4

5 3. Describe your evaluation of the application, the basis for the your conclusion, and 

6 whether it meets the regulatory requirement.

7

8 4. Repeat these steps for every regulatory requirement that applies to the application.

9

10 There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

11 application or amendment request, (2) denial of the application or request, or (3) approval with 

12 conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

13 reviewer may consider proposing a license condition. Absent an NRC order, license conditions 

14 must be agreed upon with the licensee or applicant before becoming part of the license. 

15 A license condition should only be proposed if there is reasonable assurance that, if the 

16 licensee meets the condition, all regulatory requirements will be satisfied. Thus, license 

17 conditions should not be used to cover major deficiencies in an application. License conditions 

18 should be unambiguous, inspectable, and enforceable. They should only require those actions 

19 necessary to ensure compliance with applicable regulations. The basis for license conditions 

20 must be documented in the SER.

21

22 The SER should include a summary statement of what the NRC staff evaluated and the basis 

23 for the reviewer’s conclusions that is similar to the following:

24

25 The staff has evaluated the application using the criteria listed previously. Based 

26 on the review of the license application, the NRC staff has concluded that the 

27 applicant has adequately described and assessed accident consequences that 

28 could result from the handling, storage, or processing of licensed materials and 

29 that could have potentially significant chemical consequences and effects. The 

30 applicant has constructed a hazard analysis that identified and evaluated those 

31 chemical-process hazards and potential accidents and established safety 

32 controls to provide reasonable assurance of safe facility operation. To ensure 

33 that the performance requirements in 10 CFR Part 70, “Domestic Licensing of 

Special Nuclear Material,”4 34 are met, the applicant has provided reasonable 

35 assurance that controls are available and reliable when required to perform their 

36 safety functions. The staff has reviewed these safety controls and the applicant’s 

37 plan for managing chemical-process safety and finds them acceptable.

38

39 The staff concludes that both the applicant’s plan for managing chemical-process 

40 safety and the chemical-process safety controls meet the requirements of 

41 10 CFR Part 70 and provide reasonable assurance that the health and safety of 

42 the public will be protected.

 4 The title of 10 CFR Part 70 may be omitted if the title has already been stated in the same chapter of the 

SER.
May 2014 6-12 NUREG-1520, Revision 2

1 6.7 References

2

3 American Industrial Hygiene Association, “Emergency Response Planning Guidelines,” as 

4 revised. The latest available list of approved guidelines, dated May 31, 2013, is available at

5 http://www.aiha.org/get-involved/AIHAGuidelineFoundation/

6 EmergencyResponsePlanningGuidelines/Documents/2013ERPGValues.pdf (accessed on

7 5/12/14).

8

9 U.S. Environmental Protection Agency, “Acute Exposure Guideline Levels (AEGLs),” 

10 http://www.epa.gov/oppt/aegl/pubs/chemlist.htm (accessed on 5/12/2014).

11

12 U.S. Nuclear Regulatory Commission, “Inspection of the Nuclear Chemical Process Safety 

13 Program at Fuel Cycle Facilities,” Inspection Manual Chapter 2603, as revised.

14

15 U.S. Nuclear Regulatory Commission, “Chemical Toxicity of Uranium Hexafluoride Compared to 

16 Acute Effects of Radiation,” NUREG-1391, February 1991.

17

18 U.S. Nuclear Regulatory Commission, “Integrated Safety Analysis Guidance Document,” 

19 NUREG-1513, May 2001.

20

21 U.S. Nuclear Regulatory Commission, “Chemical Process Safety at Fuel Cycle Facilities,” 

22 NUREG-1601, August 1997.

23

24 U.S. Nuclear Regulatory Commission, “Nuclear Fuel Cycle Facility Accident Analysis 

25 Handbook,” NUREG/CR-6410, March 1998.

26

27 U.S. Nuclear Regulatory Commission, “Review of Models Used for Determining Consequences 

28 of UF6 Release,” NUREG/CR-6481, November 1997.

29

30 U.S. Nuclear Regulatory Commission/Occupational Safety and Health Administration, 

31 “Memorandum of Understanding between the U.S. Nuclear Regulatory Commission and the 

32 Occupational Safety and Health Administration,” September 6, 2013.
May 2014 7-1 NUREG-1520, Revision 2

7. FIRE SAFETY

1 7.1 Purpose of Review

2

3 The purpose of this review is to determine with reasonable assurance that the applicant has 

4 designed a facility that provides adequate protection against fires and explosions that could 

5 affect the safety of licensed materials and thus present an increased radiological or chemical 

6 risk. The review should also establish that the applicant has considered the radiological and 

7 chemical consequences of the fires and will institute suitable safety controls to protect workers, 

8 the public, and the environment.

9

10 Fire-safety issues are initially evaluated as part of the applicant’s integrated safety analysis 

11 (ISA) summary. The ISA summary must evaluate credible accident sequences at the facility; 

12 identify items relied on for safety (IROFS) to prevent the occurrence or to mitigate the 

13 consequences of accidents; and include the management measures that provide reasonable 

14 assurance of the availability and reliability of IROFS when needed. Reviewers assess the 

15 applicant’s approach to protecting against fire and explosion hazards by examining the license 

16 application and the ISA summary to gain familiarity with the following:

17

18 1. process information and accident sequences leading to conditions that could pose fire 

19 hazards

20

21 2. IROFS and sole IROFS used to prevent or mitigate such fire hazards

22

23 3. management measures applied to ensure that IROFS will be available and reliable when 

24 required

25

26 7.2 Responsibility for Review

27

28 Primary: Fire Safety Specialist

29

30 Secondary: Criticality Safety Specialist

31 Environmental Specialist

32 Chemical Safety Specialist

33 Physical Security Specialist

34

35 Supporting: Regional, Resident, and Fuel Cycle Inspection Staff

36

37 7.3 Areas of Review

38

39 Title 10 of the Code of Federal Regulations (10 CFR) 70.62(a) requires an applicant to develop, 

40 implement, and maintain a safety program that will reasonably protect public health and safety 

41 and the environment from the fire and explosive hazards associated with processing, handling, 

42 and storing licensed materials during normal operations, anticipated operational occurrences, 

43 and credible accidents. The fire protection program must address these process-specific risks 

44 and general fire prevention, protection, and management issues. Although 10 CFR Part 70, 

45 “Domestic Licensing of Special Nuclear Material,” does not require a separate fire safety 

46 program, an applicant should provide commitments pertaining to fire safety in the following 

47 areas:
May 2014 7-2 NUREG-1520, Revision 2

1 1. Fire safety management includes safety organization, engineering review, and fire 

2 prevention; inspection, testing, and maintenance; prefire plans; and personnel 

3 qualifications, drills, and training.

4

5 2. Fire risk identification includes the fire hazards analysis (FHA) and the ISA summary.

6

7 3. Facility design includes information on building construction, fire areas, life safety, 

8 ventilation, and electrical system design. The facility design should also consider 

9 competing requirements among fire safety and security, criticality, and environmental 

10 concerns.

11

12 4. Process fire safety involves design considerations to prevent an accident or to mitigate 

13 the consequences of an accident resulting from the use of process chemicals, 

14 combustible metals, flammable and combustible liquids and gases, high-temperature 

15 equipment, hot cells and glove boxes, and laboratories.

16

17 5. Fire protection systems include fire detection, alarm, and suppression systems; portable 

18 extinguishers; water supplies; and emergency response organizations.

19

20 Review Interfaces

21

22 In addition to Chapter 7 of the application, the reviewer should examine information in the 

23 following other areas to ensure that it is consistent with the information in Chapter 7:

24

25 • Review information about the facility and process descriptions related to fire safety as 

26 required under Chapter 1 of this Standard Review Plan (SRP).

27

28 • Review information on the safety program, ISA commitments, and ISA documentation 

29 applied to fire safety as required under SRP Chapter 3.

30

31 • Review information on controls applied to chemical processes for fire safety as required 

32 under SRP Chapter 6.

33

34 • Review information on configuration management, maintenance, training and 

35 qualifications, procedures, audits and assessments, incident investigations, record 

36 management, and other quality assurance (QA) elements as required under SRP 

37 Chapter 11 as related to fire safety.

38

39 7.4 Acceptance Criteria

40

41 An applicant that meets the acceptance criteria defined in this section or that has provided an

42 acceptable alternative should be considered as having provided reasonable assurance of an 

43 acceptable fire protection program.

44

45 7.4.1 Regulatory Requirements

46

47 The regulatory basis for the fire safety review should be the requirements of 10 CFR 70.22, 

48 “Contents of Applications,” and 10 CFR 70.65, “Additional Content of Applications.” In addition, 
May 2014 7-3 NUREG-1520, Revision 2

1 the fire safety review should focus on providing reasonable assurance of compliance with 

2 10 CFR 70.61, “Performance Requirements”; 10 CFR 70.62, “Safety Program and Integrated 

3 Safety Analysis”; and 10 CFR 70.64, “Requirements for New Facilities or New Processes at 

4 Existing Facilities.”

5

6 7.4.2 Regulatory Guidance

7

8 The relevant regulatory guidance for fire safety includes the following U.S. Nuclear Regulatory 

9 Commission (NRC) and industrial standards:

1011

12 1. National Fire Protection Association (NFPA) 801, “Standard for Fire Protection for 

13 Facilities Handling Radioactive Materials,” latest edition

14

15 2. NUREG-1513, “Integrated Safety Analysis Guidance Document,” May 2001

16

17 3. NUREG/CR-6410, “Nuclear Fuel Cycle Facility Accident Analysis Handbook,” 

18 March 1998

19

20 7.4.3 Regulatory Acceptance Criteria

21

22 Partial acceptability of the application and the ISA summary will be contingent on the NRC 

23 staff’s review of the applicant’s commitments to control and mitigate fire hazards. The staff will 

24 focus on whether the application is risk informed, addresses the applicant’s procedures for 

25 maintaining an acceptable level of fire safety, and demonstrates that the applicant is prepared to 

26 react quickly and safely to extinguish fires. An applicant may use a graded approach to define 

27 fire safety, but it must provide sufficient documentation and commitments to ensure that it will 

28 adequately protect workers, the public, and the environment from fire events.

29

30 The applicant may incorporate these acceptance criteria in the information supplied to satisfy 

31 SRP Chapter 3 (regarding ISA) or other SRP chapters as long as it provides clear cross32 references (information need not be repeated). The staff’s fire safety specialist will review the 

33 application, ISA summary and other documentation, as needed, regarding these acceptance

34 criteria.

35

36 The reviewer(s) will use nationally recognized codes and standards, as appropriate, in 

37 evaluating a reasonable assurance of fire safety. These codes and standards include, but are 

38 not limited to, the NFPA “National Fire Codes”; Factory Mutual Research Corporation data 

39 sheets and approval guide; Underwriters Laboratories, Inc., standards and building material 

40 directory; American National Standards Institute standards; and American Society for Testing 

41 and Materials standards. Commitments to specified standards will normally be considered an 

42 acceptable means of meeting the acceptance criteria.

43

44 The NRC staff will review the application to ensure that it meets the acceptance criteria 

45 discussed below.

46

47 7.4.3.1 Fire Safety Management Measures

48

49 An adequate application documents how the applicant will administer and ensure fire safety at 

50 the licensed facility. The application should reflect a commitment to ensure that the IROFS, as 

51 identified in the ISA Summary, are available and reliable and that the facility maintains fire 
May 2014 7-4 NUREG-1520, Revision 2

1 safety awareness among employees, controls transient ignition sources and combustibles, and 

2 maintains a readiness to extinguish the fire or limit its consequences. These measures are 

3 unique to fire safety and, therefore, are not included in the acceptance criteria for SRP 

4 Chapter 11.

5

6 An adequate application identifies a senior-level manager who has the authority and staff to 

7 ensure that fire safety receives appropriate priority. A facility safety committee or fire safety 

8 review committee staffed by managers of different disciplines should integrate facility 

9 modifications. (The facility safety committee can do the work of a fire safety review committee.) 

10 As described in the application, an individual with sufficient practical fire safety experience in 

11 nuclear facilities should supervise day-to-day fire safety.

12

13 NFPA 801 specifies the following fire safety management measures:

14

15 1. fire prevention

16

17 2. inspection, testing, and maintenance of fire protection systems

18

19 3. emergency response organization qualifications, drills, and training

20

21 4. prefire plans

22

23 An adequate application documents the fire safety management measures in sufficient detail to 

24 identify their relationship to, and functions in, normal operations, anticipated (off-normal) events, 

25 and accident safety (i.e., IROFS). The staff recognizes NFPA 801 as one acceptable standard 

26 for fire safety management measures; however, the applicant may use other nationally 

27 recognized codes and standards if appropriate.

28

29 7.4.3.2 Fire Hazards Analysis

30

31 7.4.3.2.1 Development of a Fire Hazard Analysis as a Tool for Evaluating Fire Hazards

32

33 Knowing the fire risk allows an applicant to apply the appropriate level of fire protection to 

34 ensure the safety of workers, the public, and the environment from fire-induced radiological or 

35 chemical hazards. To be risk informed, a licensee should conduct an FHA for each facility or 

36 part thereof that, if totally consumed by fire, could release special nuclear material (SNM) in 

37 quantity and form that could cause at least an intermediate consequence, as defined in 

38 10 CFR 70.61. The FHA should develop bounding credible fire scenarios for each fire area 

39 containing significant fire loading and then assess the consequences of an unmitigated fire. 

40 The staff recognizes NFPA 801 as one standard that provides guidance for conducting FHAs; 

41 however, the applicant may use other nationally recognized codes and standards if appropriate. 

42 The FHA should include a description, by fire area, of the fuel loading, fire scenarios, methods 

43 of consequence analysis, and potential consequences, as well as a description of the mitigative 

44 or preventive controls or both.

45

46 The FHA should also contain an inventory of IROFS that are susceptible to fire damage from 

47 credible fires (taking into account transient and temporary conditions) within each fire area. 

48 Loss of systems such as ventilation, cooling, or electrical power that could cause failures 

49 elsewhere in the facility should be evaluated. The FHA should also consider the improper 

50 operation of equipment and IROFS due to spurious signals induced by fire damage. In addition, 
May 2014 7-5 NUREG-1520, Revision 2

1 the effects of combustion products, manual firefighting efforts, and the activation of automatic 

2 fire suppression systems should be assessed.

3

4 The FHA is used to identify possible fire initiators and accident sequences leading to 

5 radiological consequences or toxic chemical consequences resulting from interaction with SNM. 

6 In developing accident sequences that will be reported in the ISA summary, the ISA team will 

7 consider the FHA results and assign likelihoods to the various events in the accident 

8 sequences. With respect to fire safety, the ISA summary is acceptable if it identifies the credible 

9 fire hazards (e.g., from the FHA) for each process fire and if it provides details as to how the 

10 applicant considered and addressed (i.e., the management measures and IROFS) each fire 

11 hazard for each process accident sequence whose consequence could exceed the performance 

12 requirements in 10 CFR 70.61. Thus, the FHA is a fundamental tool for evaluating fire hazards 

13 as input to the ISA evaluation.

14

15 7.4.3.2.2 Deviations from National Fire Protection Association Codes and Standards

16

17 When the applicant or licensee states that its design “meets the NFPA code(s)” or “meets the 

18 intent of the NFPA codes” and does not identify any deviations from such codes, the NRC 

19 expects that the design conforms to the codes and is subject to inspection against the NFPA 

20 code of record. A design that “meets the intent of the code” should specify those sections of the 

21 code with which it does not conform. A licensee may apply the equivalency concept in meeting 

22 the provisions of the NFPA codes or standards. Nothing in the NFPA codes or standards is 

23 intended to prevent the use of methods, systems, or devices of equivalent or superior quality, 

24 strength, fire resistance, durability, and safety as alternatives to those prescribed by the codes 

25 or standards, provided that technical documentation demonstrates equivalency and that the 

26 method, system, or device is listed or approved for the intended purpose. Recent editions of the 

27 NFPA codes require submittal of technical documentation to the “authority having jurisdiction” to 

28 demonstrate equivalency of an alternative system, method, or device. The NRC does not 

29 require review and approval of equivalency evaluations before their implementation during 

30 construction. However, the licensee should document these evaluations and make them 

31 available for NRC inspection. The NRC recognizes that fire protection systems and controls 

32 may be required to meet State or local codes and may need to be approved by code 

33 enforcement officials. Where such systems and controls are not required to meet the 

34 performance requirements of 10 CFR 70.61 (i.e., not designated as IROFS), a State or local 

35 code enforcement official may be designated as the authority having jurisdiction (as described in 

36 NFPA documents). However, the NRC must review and inspect IROFS and any code 

37 deviations relative to their effect on nuclear safety. The authority having jurisdiction refers to the 

38 NRC Director of the Office of Nuclear Material Safety and Safeguards (or his or her designee).

39 7.4.3.3 Facility Design

40

41 Building construction, fire area determination, electrical installation, life safety, ventilation, 

42 drainage, and lightning protection are all facility design features that affect fire safety. The staff 

43 recognizes NFPA 801 as one standard that specifies acceptable facility fire safety design 

44 criteria; however, the applicant may use other nationally recognized codes and standards, if 

45 appropriate. An adequate application documents the fire safety considerations used in the 

46 general design of fuel cycle facilities.

47

48 A. The NRC normally reviews the following design information related to fire safety in a 

49 license application:
May 2014 7-6 NUREG-1520, Revision 2

1

2 1. the type of construction (as required under NFPA 220, “Standard on Types of

3 Building Construction,” for a new building) and applicable building codes (for an

4 existing building) with a comparison to NFPA 220 building types

5

6 2. the identification of building material, the fire duration rating (if known), and a 

7 description of exterior openings

8

9 3. the overall description of the fire detection system, including the degree of 

10 compliance with NFPA 72, “National Fire Alarm and Signaling Code,” for design, 

11 installation, surveillance, testing, and maintenance

12

13 4. the overall description of the automatic fire suppression system, applicable 

14 design standards, the system design basis, and identification of standards for 

15 surveillance, testing, and maintenance procedures

16

17 5. the description of the water distribution system, including descriptions of fire 

18 pumps, fire mains, the location of sectionalizing valves, maximum fire demand, 

19 and compliance with applicable NFPA standards

20

21 B. In addition to standard industrial fire safety concerns, the application should also 

22 address the following nuclear safety, environmental protection, and physical security 

23 issues:

24

25 1. Criticality concerns may exclude water extinguishing systems from process 

26 areas. However, during major fire events, the fire may easily overcome the 

27 extinguishing capability of portable extinguishers, and hose lines may be needed 

28 to extinguish the fire. Consequently, applicants should consider using total 

29 flooding gaseous systems in water-exclusion areas with significant fire risks. An 

30 adequate application addresses the methodology for extinguishing fires in water31 exclusion areas. 

32

33 2. Environmental concerns include the potential for thousands of gallons of fire 

34 water to be contaminated with nuclear material during a fire event. 

35 Consequently, diked areas and drainage of process facilities may be needed. 

36 NFPA 801 provides guidance on how to calculate the potential amount of runoff 

37 to properly size drainage and containment systems. An adequate application 

38 documents any measures used to control fire water runoff.

39

40 3. Physical security concerns include the need to design buildings and facilities to 

41 provide safe egress in case of fire. Physical security requirements for SNM may 

42 inadvertently delay worker egress and firefighter access. Physical security 

43 procedures should allow offsite fire departments quick and efficient access to fire 

44 emergencies. An adequate application documents the design criteria used for 

45 worker egress and procedures for firefighter access. The staff recognizes 

46 NFPA 801 as one standard that specifies acceptable worker egress design 

47 criteria; however, the applicant may use other nationally recognized codes and 

48 standards, if appropriate.
May 2014 7-7 NUREG-1520, Revision 2

1 Design and construction of new facilities must comply with the baseline design criteria (BDC) 

2 specified in 10 CFR 70.64(a) and comply with the defense-in-depth requirements of 

3 10 CFR 70.64(b). The design and construction should be consistent with the guidance provided 

4 in NFPA 801 or other appropriate nationally recognized fire protection codes and standards.

5

6 7.4.3.4 Process Fire Safety

7

8 Many hazardous chemicals and processes used by fuel cycle facilities contribute to the fire 

9 hazards. In areas that have fire hazards that may threaten licensed material, the application 

10 should identify the hazardous chemicals, processes, and design standards used to ensure fire 

11 safety. The staff recognizes NFPA 801 as one standard that provides acceptable design criteria 

12 for radiological process areas that may contain hazardous material, laboratories, high13 temperature equipment, hot cells, and glove boxes. However, the applicant may use other 

14 nationally recognized codes and standards, if appropriate.

15

16 The following are a few of the more common hazardous materials used at fuel cycle facilities:

1718

19 1. Anhydrous ammonia is an explosive, flammable, and toxic gas used to make hydrogen.

20

21 2. Fluorine reacts violently with organic material or metal powders and water vapor.

22

23 3. Hydrogen is an explosive and flammable gas used in reduction processes.

24

25 4. Hydrogen peroxide off-gases hydrogen and oxygen and is incompatible with some 

26 extinguishers.

27

28 5. Nitric acid nitrates organic material, which lowers the ignition temperature of 

29 combustibles.

30

31 6. Sulfuric acid absorbs water from organic material in an exothermic reaction, thereby 

32 causing ignition.

33

34 7. Zirconium is a combustible metal that burns at elevated temperatures.

35

36 8. Calciners and incinerators are sources of heat that have initiated fires at fuel cycle 

37 facilities.

38 The applicant should identify fire and explosion hazards, fire and explosion parameters of 

39 hazardous materials, and the degree of compliance with applicable codes (e.g., NFPA 30, 

40 “Flammable and Combustible Liquids Code”; NFPA 69, “Standard on Explosion Prevention 

41 Systems”; and NFPA 86, “Standard for Ovens and Furnaces”).

42

43 In addition to participating in the integrated review of the ISA summary performed in accordance 

44 with Chapter 3 of this SRP, the reviewer should also examine in detail the fire-initiated release 

45 scenarios provided in the ISA summary to demonstrate compliance with 10 CFR 70.61. This

46 review should follow the guidance provided in applicable subsections of SRP Chapter 3 to 

47 include a detailed evaluation of these scenarios, including a review of fire initiators, fire-induced 

48 consequences, the likelihoods of such consequences, and IROFS chosen to prevent or mitigate 

49 those consequences.
May 2014 7-8 NUREG-1520, Revision 2

1 7.4.3.4.1 Fire-Initiated Accident Sequences

2

3 The review should consider the following factors in determining the acceptability of the 

4 applicant’s descriptions of fire-initiated accident sequences:

5

6 1. The applicant provided enough detail in its fire hazard descriptions to permit an 

7 understanding of the fire hazards sufficient to allow an evaluation of potential accident 

8 sequences.

9

10 2. The applicant adequately described the consequences and likelihoods of accident 

11 sequences identified in the ISA summary involving fire, including risks from hazardous 

12 chemicals produced from licensed material and risks from radioactive materials.

13

14 3. The applicant provided enough detail in its justification of the initiation probability for the 

15 reviewer to make an independent verification for those scenarios in which the initiation 

16 probability appears to be nonconservative. If a facility relies on controls to achieve this 

17 initiation probability, the applicant should identify these controls as IROFS, as 

18 appropriate.

19

20 4. Controls that are used to mitigate or prevent the scenario are identified as IROFS or as 

21 defense-in-depth measures. For those controls that are IROFS, reliability and 

22 associated management measures must be indicated.

23

24 5. Analyses that the applicant has performed as part of the evaluation are part of the ISA 

25 and referenced.

26

27 7.4.3.4.2 Items Relied on for Safety and the Associated Management Measures

28

29 Based on a comparison of the unmitigated fire protection accident sequence consequences with 

30 the performance criteria of 10 CFR 70.61, the applicant should identify (in the ISA summary) fire

31 protection safety controls suitable to prevent or mitigate potential accidents. If the applicant 

32 takes a graded approach to safety in accordance with 10 CFR 70.62(a), the reviewer should 

33 establish that the classification of IROFS and grading of the associated management measures 

34 are appropriate and sufficient to protect against fire-related risks. A minimum acceptable level 

35 of requirements for management measures (e.g., QA for fire protection systems) is the level that

36 NFPA codes require, such as the use of equipment listed by an acceptable organization 

37 (e.g., Underwriters Laboratories, Inc., or Factory Mutual Global). Installation and initial testing 

38 should also be that specified by the appropriate code.

39

40 The NRC staff should also review those management measures that ensure the availability and 

41 reliability of such IROFS when they are required to perform safety functions. The ISA summary

42 should demonstrate that the proposed management measures ensure that IROFS are available 

43 and reliable when required by briefly describing the following:

44

45 1. measures to ensure the reliable operation of engineered controls (e.g., inspection and 

46 testing procedures and frequencies, calibration programs, functional tests, corrective 

47 and preventive maintenance programs, and criteria for acceptable test results)

48

49 2. measures to ensure that administrative controls will be correctly implemented when 

50 required (e.g., employee training and qualification in operating procedures, refresher 
May 2014 7-9 NUREG-1520, Revision 2

1 training, safe work practices, development of standard operating procedures, and 

2 training program evaluations)

3

4 3. the compliance of IROFS with all applicable NFPA or industry consensus fire codes and 

5 standards

6

7 At minimum, IROFS should comply with those sections of the codes or standards affecting the 

8 reliability and effectiveness of the IROFS. For example, fire protection systems do not need to

9 be seismically designed beyond what is required by the applicable NFPA code if they are not 

10 intended to function during a seismic event.

11

12 7.4.3.5 Fire Protection and Emergency Response

13

14 The application should document the fire protection systems and fire emergency response 

15 organizations provided for licensed facilities. The ISA summary should identify the fire 

16 protection IROFS. An adequate application describes the fire protection for areas in which 

17 licensed material is present. The application should describe which standards the fire protection 

18 systems and equipment meet. The staff recognizes NFPA’s national fire codes as acceptable 

19 standards for the design, installation, testing, and maintenance of the fire protection systems 

20 and equipment. However, the applicant may use other nationally recognized codes and 

21 standards, if appropriate.

22

23 Facilities with the potential for rapidly developing fires that do not have an adequate nearby 

24 emergency responder may need an onsite fire emergency response team. One acceptable 

25 standard is NFPA 600, “Standard on Industrial Fire Brigades.” However, the applicant may use 

26 other nationally recognized codes and standards, if appropriate. If offsite fire departments are 

27 needed for facility fire safety, periodic training with the fire departments is necessary so that 

28 offsite departments will become familiar with facility access procedures, facility layout, and 

29 prefire plans. A memorandum of understanding between the applicant and the fire departments 

30 is recommended to define the required protection. The staff’s fire safety specialist will review 

31 the adequacy of the applicant’s fire protection and emergency response commitments.

32 7.4.3.6 Requirements for New Facilities or New Processes at Existing Facilities

33

34 The application or ISA summary or both should address the BDC as required under 

35 10 CFR 70.64 for new facilities or new processes at existing facilities that require a license 

36 amendment under 10 CFR 70.72, “Facility Changes and Change Process.” With respect to fire 

37 safety, the application should be considered acceptable if it includes the information listed below 

38 (or references other sections of the application that include this information):

39

40 1. The application should briefly describe how the ISA was performed for the new process, 

41 including its use and relationship to the performance requirements in 10 CFR 70.61, the 

42 BDC, and a defense-in-depth strategy for higher risk accident sequences. Acceptable 

43 principles for defense in depth of the fire safety design would be those that support the 

44 hierarchy of controls with preference for prevention of releases (over mitigation of 

45 consequences) and engineered controls over administrative controls.

46

47 2. The ISA summary should describe how the applicant applied 10 CFR 70.64(a)(3) in 

48 establishing the design principles, features, and control systems of the new process. 

49 This will normally involve a commitment to follow appropriate codes and standards for 
May 2014 7-10 NUREG-1520, Revision 2

1 design, testing, surveillance, and maintenance of fire protection systems, including those 

2 that are not IROFS but may involve nuclear processes or buildings housing nuclear 

3 material.

4

5 7.5 Review Procedures

6

7 7.5.1 Acceptance Review

8

9 During the acceptance review of a license application, the reviewer should examine the 

10 submittals to identify major deficiencies in the information provided for each area of review 

11 specified in SRP Section 7.3. Reviewers must decide whether they have enough information to 

12 proceed with a detailed review. Less significant errors or deficiencies that can be addressed in 

13 a request for additional information should be accepted. However, before the NRC performs a 

14 detailed review, the applicant should correct major deficiencies that would require several 

15 requests for additional information to resolve.

16

17 Reviewers should record whether each area of review is adequately addressed in the 

18 application, is adequately addressed in a referenced document, is not applicable to the 

19 application, or has a major deficiency.

20

21 7.5.2 Safety Evaluation

22

23 During the safety evaluation, the primary and secondary reviewers determine whether the 

24 application comprehensively describes the fire safety of the licensed activity as identified in SRP 

25 Section 7.3 and assess the commitments made in response to the criteria specified in 

26 SRP Section 7.4. During the initial review, the reviewer should draft the safety evaluation report 

27 (SER) described below. A request for additional information (RAI) will be prepared when 

28 clarification and additional information are needed to determine whether the licensee’s 

29 submittals comply with the regulations. The primary reviewer should coordinate with the 

30 licensing project manager in preparing a RAI. Additional information submitted by the applicant 

31 will be evaluated and a final SER will be provided to the licensing project manager.

32 Reviewers should note that NFPA 801 uses “administrative control” in a different sense than 

33 how the term is used in 10 CFR Part 70 and elsewhere in this SRP. In 10 CFR Part 70, an 

34 administrative control is an IROFS if it is the human action necessary to meet safety 

35 performance requirements and if it is supported by management measures (e.g., training, QA, 

36 and procedures) that ensure that the action will be taken if needed. In NFPA 801, 

37 “administrative controls” refer to the training, qualifications, and procedures behind the human 

38 action; however, these elements are referred to as “management measures” in 10 CFR Part 70 

39 and in this SRP.

40

41 For an existing facility, the reviewer may consult with cognizant NRC inspectors to identify and 

42 resolve any issues related to the licensing review. For a planned facility, the reviewers may 

43 wish to consult with the facility design team to gain a better understanding of the process, its 

44 potential hazards, and safety approaches.

45

46 7.5.2.1 Fire-Related Risks and Accident Sequences

47

48 The results of the ISA are the basis for the fire safety evaluation. The reviewer should assess 

49 the fire risks identified in the ISA summary and ensure that the level of safety is reflected in the 
May 2014 7-11 NUREG-1520, Revision 2

1 design and the operational plans for the facility. The reviewer should establish that the 

2 applicant’s facility design, operations, and IROFS for fire and explosion safety provide 

3 reasonable assurance that they will function as intended and will provide for the safe handling of 

4 licensed material at the facility.

5

6 7.5.2.2 Items Relied on for Safety and Management Measures

7

8 The staff reviews the fire and explosion IROFS to ensure their adequacy in protecting against all 

9 unmitigated sequences identified in the ISA summary.

10

11 If the applicant has applied a graded approach to safety, the reviewer should establish that the 

12 classification of IROFS or grading of management measures is appropriate and sufficient to 

13 protect against fire and explosion risks.

14

15 7.5.2.3 Requirements for New Facilities or New Processes at Existing Facilities

16

17 The staff reviews the applicant’s commitments as required to satisfy the BDC in 

18 10 CFR 70.64(a) for the design of new facilities or new processes at an existing facility that 

19 require a license amendment under 10 CFR 70.72.

20

21 7.6 Evaluation Findings

22

23 The regulations in 10 CFR 70.23 and 10 CFR 70.66, “Additional Requirements for Approval of 

24 License Application,” state that an application for a license will be approved if the Commission 

25 can make the general findings listed in those sections. The basis for the general findings is an 

26 evaluation of whether the application adequately addresses all of the applicable regulatory 

27 requirements. More specifically, the staff’s evaluation should determine whether the licensing 

28 submittals provide sufficient information to satisfy the regulatory requirements listed in 

29 Section 7.4.1 of this SRP and whether the applicant has appropriately addressed the regulatory 

30 acceptance criteria in SRP Section 7.4.3. The SER should state how the applicable regulatory 

31 requirements have been met based on the acceptance criteria described in this chapter of the 

32 SRP. If the applicant chooses to use an alternative approach, the reviewer should discuss in 

33 the SER whether the proposed approach satisfies the applicable regulatory requirements. The 

34 reviewers should use the following approach to document their evaluation:

35

36 1. State a specific regulatory requirement that applies to the application. Detailed 

37 acceptance criteria may be included where appropriate or necessary to clarify the 

38 requirement.

39

40 2. Identify the areas where the regulatory requirement is addressed in the application, 

41 including the areas where the specific acceptance criteria described in this SRP are 

42 addressed.

43

44 3. Describe your evaluation of the application, the basis for your conclusion, and whether it 

45 meets the regulatory requirement.

46

47 4. Repeat these steps for every regulatory requirement that applies to the application.

48

49 There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

50 application or amendment request, (2) denial of the application or request, or (3) approval with 
May 2014 7-12 NUREG-1520, Revision 2

1 conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

2 reviewer may consider proposing a license condition. Absent an NRC order, license conditions 

3 must be agreed upon with the licensee or applicant before becoming part of the license. 

4 License conditions should only be proposed if there is reasonable assurance that, if the licensee 

5 meets the condition, all regulatory requirements will be satisfied. Thus, license conditions 

6 should not be used to cover major deficiencies in an application. License conditions should be 

7 unambiguous, inspectable, and enforceable. They should only require those actions necessary 

8 to ensure compliance with applicable regulations. The basis for license conditions must be 

9 documented in the SER.

10

11 The SER should include summary statements of what was evaluated and the basis for the 

12 reviewers’ conclusions that are similar to the following:

13

14 • The applicant has established a fire-protection function meeting the acceptance 

15 criteria in SRP Chapter 7. The function includes a facility safety review 

16 committee responsible for integrating modifications to the facility and a fire-safety 

17 manager responsible for day-to-day program implementation. Fire prevention; 

18 inspection, testing, and maintenance of fire-protection systems; and the 

19 qualification, drills, and training of facility personnel are in accordance with 

20 applicable NFPA codes and standards. (Note that SER Section 11.3 describes 

21 fire-protection training requirements.)

22

23 • The applicant has conducted risk analyses in accordance with NFPA 801. The 

24 FHAs identified credible fire scenarios that bound the fire risk. The ISA used 

25 these scenarios and identified fire-protection IROFS (in particular, wet pipe 

26 sprinkling in the process areas, isolation of the high-temperature equipment 

27 within fire barriers, and a fire brigade meeting NFPA 600). A memorandum of 

28 understanding with the fire department documents the required assistance and 

29 the annual exercises. Procedures are in place to allow the fire department 

30 efficient access to process areas during fire emergencies. Worker egress is 

31 designed and maintained in accordance with NFPA 101, “Life Safety Code.”

32 • The applicant has demonstrated that it incorporated appropriate fire-safety 

33 considerations in the design of its facilities. The applicant has also demonstrated that 

34 the facility has appropriate active fire-protection systems.

35

36 • The staff concludes that the applicant’s submittals provide sufficient information in 

37 accordance with the requirements of 10 CFR 30.33 and 10 CFR 40.32, both entitled 

38 “General Requirements for Issuance of Specific Licenses,” and with the requirements of 

39 10 CFR 70.22 and 10 CFR 70.65 regarding potential fire hazards, consequences, and 

40 required controls for the proposed processes. The NRC staff determined that the 

41 applicant demonstrated compliance with the performance requirements of 10 CFR 70.61 

42 for fire protection related to postulated accident scenarios. The design that the applicant 

43 proposes also satisfies the requirements of 10 CFR 70.64(a)(3) and the 

defense-in-depth requirements of 10 CFR 70.64(b) (as required).1 44

45

 1 Add the titles of 10 CFR 70.22, 70.61, and/or 70.65 to this paragraph if this is the first time one of these 

regulatory sections is cited in this chapter of the SER.
May 2014 7-13 NUREG-1520, Revision 2

1 7.7 References

2

3 U.S. Code of Federal Regulations, “Domestic Licensing of Special Nuclear Material,” Part 70, 

4 Chapter I, Title 10, “Energy.”

5

6 National Fire Protection Association (NFPA), “Flammable and Combustible Liquids Code,” 

7 NFPA 30, Quincy, MA, 2008.

8

9 NFPA, “Standard on Explosion Prevention Systems,” NFPA 69, Quincy, MA, 2008.

10

11 NFPA, “National Fire Alarm and Signaling Code,” NFPA 72, Quincy, MA, 2010.

12

13 NFPA, “Standard for Ovens and Furnaces,” NFPA 86, Quincy, MA, 1999.

14

NFPA, “Life Safety Code® 15 ,” NFPA 101, Quincy, MA, 2007.

16

17 NFPA, “Standard on Types of Building Construction,” NFPA 220, Quincy, MA, 2009.

18

19 NFPA, “Standard on Industrial Fire Brigades,” NFPA 600, Quincy, MA, 2010.

20

21 U.S. Nuclear Regulatory Commission, “Uranium Oxide Fires at Fuel Cycle Facilities,” 

22 Information Notice 92-14, February 21, 1992.

23

24 U.S. Nuclear Regulatory Commission, “Integrated Safety Analysis Guidance Document,” 

25 NUREG-1513, May 2001.

26

27 U.S. Nuclear Regulatory Commission, “Nuclear Fuel Cycle Facility Accident Analysis 

28 Handbook,” NUREG/CR-6410, March 1998.

29

May 2014 8-1 NUREG-1520, Revision 2

8. EMERGENCY MANAGEMENT

1 8.1 Purpose of Review

2

3 The purpose of reviewing the applicant’s emergency management plan is to determine if the 

4 applicant has established, before the start of operations, adequate emergency management

5 facilities and procedures to protect workers, the public, and the environment. In preparing its 

6 emergency plan, the applicant may use either this standard review plan (SRP) or Regulatory 

7 Guide 3.67, “Standard Format and Content for Emergency Plans for Fuel Cycle and Materials 

8 Facilities,” issued January 1992. The applicant may provide the information requested for the 

9 emergency plan once and then cross-reference it in other sections.

10

11 Regulations in Title 10 of the Code of Federal Regulations (10 CFR) 70.22, “Contents of 

12 Application,” require an emergency management plan or an emergency evaluation if the 

13 licensee is authorized to possess (1) enriched uranium or plutonium for which a criticality 

14 accident alarm system is required, (2) uranium hexafluoride in excess of 50 kilograms (kg)

15 (110 pounds (lb)) in a single container or a total of 1,000 kg (2,200 lb), or (3) plutonium in 

16 excess of 2 curies in unsealed form or on foils or plated sources. A licensed facility that meets 

17 the above criteria is required to possess an emergency management plan when an evaluation 

18 (or the integrated safety analysis (ISA) summary referenced in lieu of the evaluation) shows that 

19 the maximum dose to a member of the public offsite from a release of radioactive materials 

20 would exceed 0.01-sievert (Sv) (1-rem) effective dose equivalent or an intake of 

21 2 milligrams (mg) of soluble uranium.

22

23 The baseline design criteria (BDC) of 10 CFR Part 70, “Domestic Licensing of Special Nuclear 

24 Material,” incorporate emergency capability. The criteria are intended to ensure the control of 

25 licensed material, the evacuation of personnel, and the availability of emergency facilities.

26

27 8.2 Responsibility for Review

28

29 Primary: Assigned Licensing Staff

30

31 Secondary: Licensing Project Manager

32

33 Supporting: Regional Emergency Preparedness Inspector

34 ISA Reviewer

35 Fuel Facility Inspection Staff

36

37 8.3 Areas of Review

38

39 The U.S. Nuclear Regulatory Commission (NRC) staff should review the applicant’s submittal 

40 for an acceptable level of evidence of planning for emergency preparedness directed at 

41 situations involving real or potential radiological hazards. In particular, the review should 

42 address those design features, facilities, functions, and equipment that may affect some aspect 

43 of emergency planning or the capability of an applicant to cope with facility emergencies. In

44 addition, the review should address coordination with offsite emergency response organizations. 

45 The staff should either review the emergency plan in accordance with 10 CFR 70.22(i)(1)(ii) and 

46 the guidance contained in the acceptance criteria below or review the applicant’s evaluation (or 
May 2014 8-2 NUREG-1520, Revision 2

1 the ISA summary referenced in lieu of the evaluation) that an emergency plan is not needed in 

2 accordance with 10 CFR 70.22(i)(1)(i).

3

4 The NRC staff reviewer should address the areas of review, as described in Sections 8.3.1 

5 and 8.3.2 below.

6

7 8.3.1 Emergency Plan

8

9 If the applicant submits an emergency plan, the staff should evaluate the emergency plan 

10 against 10 CFR 70.22(i)(1)(ii) and Regulatory Guide 3.67, which provides a standard format and 

11 content for an emergency plan. Elements in the emergency plan to be reviewed include the 

12 following:

13

14 1. a facility description (including both onsite and offsite emergency facilities)

15 2. the types of accidents

16 3. the severity classification of accidents (alert or site area emergency)

17 4. the detection of accidents

18 5. the mitigation of consequences (and safe shutdown)

19 6. the assessment of releases

20 7. the responsibilities of the licensee

21 8. notification and coordination

22 9. information to be communicated and parties to be contacted

23 10. training

24 11. safe shutdown (recovery and facility restoration)

25 12. exercises and drills

26 13. hazardous chemical inventories and locations

27 14. the responsibilities for developing and maintaining the emergency program and its 

28 procedures

29

30 8.3.2 Evaluation that No Emergency Plan Is Required

31

32 If the applicant submits an evaluation or references the ISA summary to demonstrate that an 

33 emergency plan is not required, the staff should review the information against 

34 10 CFR 70.22(i)(1)(i) and NUREG-1140, “A Regulatory Analysis on Emergency Preparedness 

35 for Fuel Cycle and Other Radioactive Material Licensees” dated January 1, 1988. 

36 NUREG/CR-6410, “Nuclear Fuel Cycle Facility Accident Analysis Handbook,” issued

37 March 1998, also contains useful information. Areas evaluated should include the following:

38

39 1. a description of the facility

40 2. the types of materials used, including both radioactive material and hazardous chemicals

41 3. the types of accidents

42 4. the detection of accidents

43 5. site-specific information used to support the evaluation

44 6. an evaluation of the consequences
May 2014 8-3 NUREG-1520, Revision 2

1 Review Interfaces

2

3 In addition to Chapter 8 of the application, the reviewer should examine information in the 

4 following other areas to ensure that it is consistent with the information in Chapter 8:

5

6 • Review information about the facility, process description, geography, and demographics 

7 as applied to emergency planning under SRP Chapter 1.

8

9 • Review information on the safety program, ISA commitments, and ISA documentation 

10 applied to emergency planning under SRP Chapter 3.

11

12 • Review information about radiological releases under SRP Chapter 4.

13

14 • Review information about chemical releases under SRP Chapter 6.

15

16 • Review information on configuration management, maintenance, training and 

17 qualifications, procedures, audits and assessment, incident investigations, record 

18 management, and other quality assurance elements under SRP Chapter 11.

19

20 8.4 Acceptance Criteria 

21

22 8.4.1 Regulatory Requirements 

23

24 The regulation at 10 CFR 70.22(i)(1)(i) specifies when an applicant is not required to submit an 

25 emergency plan to the NRC; if an applicant is required to submit an emergency plan, 

26 10 CFR 70.22(i)(3) describes the information that the emergency plan must include. In addition, 

27 10 CFR 70.64(a)(6) requires applicants to address the control of licensed material, the 

28 evacuation of personnel, and the availability of emergency facilities for the design of new 

29 facilities.

30

31 8.4.2 Regulatory Guidance

32

33 Regulatory guidance for preparing an emergency plan includes the following sources:

3435

36 1. Regulatory Guide 3.67

37 2. NUREG-1140

38 3. NUREG/CR-6410

39

40 8.4.3 Regulatory Acceptance Criteria

41

42 8.4.3.1 Emergency Plan

43

44 The reviewer should evaluate the adequacy of the proposed emergency plan against the 

45 requirements in 10 CFR 70.22(i)(3) and the specific acceptance criteria provided in 

46 Sections 8.4.3.1.1 through 8.4.3.1.14 of this SRP. The reviewer should find the applicant’s 

47 emergency plan acceptable if it meets the regulatory requirements and the acceptance criteria 

48 described below.

49
May 2014 8-4 NUREG-1520, Revision 2

1 8.4.3.1.1 Facility Description

2

3 The emergency plan should describe the facility and site, the area near the site, and the 

4 licensed activities. These descriptions should include the following:

5

6 1. a detailed drawing of the site showing the following features:

78

9 a. onsite and near offsite (within 1.61 kilometers (km) (1 mile (mi))) structures with 

10 building numbers and labels

11

12 b. roads and parking lots onsite and main roads near the site

13

14 c. site boundaries showing fences and gates

15

16 d. major site features

17

18 e. water bodies within approximately 1.61 km (1 mi)

1920

21 2. a general area map covering a radius of approximately 16.1 km (10 mi), a 

22 U.S. Geological Survey topographical quadrangle (71⁄2-minute series, including the 

23 adjacent quadrangle(s) if the site is located less than 1.61 km (1 mi) from the edge of the 

24 quadrangle), and a map or aerial photograph indicating onsite and near-site structures 

within a radius of approximately 1.61 km (1 mi)1 25

26

27 3. stack heights, typical stack flow rates, and efficiencies of any emission control devices

28

29 4. a general description of licensed and other major activities conducted at the facility and 

30 the type, form, and quantities of radioactive and other hazardous materials that are 

31 normally onsite, by location (use and storage) and building, and hazardous 

32 characteristics (exposure rates, pH, temperature, and other characteristics) that are 

33 important to emergency management

34

35 5. certification by the plant manager (or the individual authorized by the applicant) that the 

36 applicant has met all responsibilities under the Emergency Planning and Community 

37 Right To Know Act of 1986, Title III, Public Law 99-499, in accordance with 

38 10 CFR 70.22(i)(3)(xiii)

39

40 8.4.3.1.2 Onsite and Offsite Emergency Facilities

41

42 The emergency plan should list and describe onsite and offsite facilities that could be relied on 

43 in an emergency. The emergency plan should include the following:

4445

46 1. a list and description of both onsite and offsite emergency facilities, by location and 

47 purpose

 1 The map should include the location of sensitive facilities near the site, such as hospitals, schools, nursing 

homes, nearest residents, fire departments, prisons, environmental sampling locations, and other structures 

and facilities that are important to emergency management.
May 2014 8-5 NUREG-1520, Revision 2

1 2. a description of emergency monitoring equipment that is available for personnel and 

2 area monitoring and for assessing the release to the environment of radioactive or

3 hazardous chemicals incident to the processing of licensed material

4

5 3. a description of the onsite and offsite services that support emergency response 

6 operations, including the following:

78

9 a. decontamination facilities

10 b. medical treatment facilities

11 c. first-aid personnel

12 d. fire fighters

13 e. law enforcement assistance

14 f. ambulance services

1516

17 4. the applicant’s commitment to the following:

1819

20 a. facilities of adequate size and appropriate location that are designated, equipped, 

21 and ready for emergency use

22

23 b. adequate backup facilities required by the emergency plan and supporting 

24 documents that are available and ready for use

25

26 c. appropriate equipment and supplies necessary to support emergency response 

27 activities that are accessible during accident conditions

28

29 d. emergency equipment that is inventoried, tested, and serviced on a periodic 

30 basis to ensure accountability and reliability

31

32 e. sufficient reliable primary and backup communications channels available to 

33 accommodate emergency needs

34

35 f. offsite emergency resources and services that are identified and ready to ensure 

36 their timely mobilization and use

37

38 g. operational engineering information, such as current as-built drawings and 

39 procedures, that are readily available in the emergency facilities

40

41 h. sufficient equipment for personnel protection and monitoring

42

43 i. systems in place to alert onsite and offsite personnel in case of an emergency

44

45 8.4.3.1.3 Types of Accidents

46

47 For each general type of accident identified in the ISA summary for which protective actions 

48 may be needed, the emergency plan should describe the following:

4950

51 1. the process and physical location(s) where the accidents could occur

52
May 2014 8-6 NUREG-1520, Revision 2

1 2. complicating factors and possible onsite and offsite consequences, including releases of 

2 nonradioactive hazardous chemicals incident to the processing of licensed material that 

3 could impact emergency response efforts 

4

5 3. the accident sequence that has the potential for the greatest radiological or toxic 

6 chemical impact

7

8 4. figure(s) projecting doses and toxic substance concentrations as a function of distance 

9 and time for various meteorological stability classes, including a description of how the 

10 applicant projected such doses or concentrations (e.g., computer models and 

11 assumptions)

12

13 8.4.3.1.4 Classification of Accidents

14

15 The emergency plan should classify accidents as follows:

1617

18 1. The emergency plan classification system should include the following two 

19 classifications:

20

21 a. Alert: Events that may occur, are in progress, or have occurred that could lead to 

22 a release of radioactive material or hazardous chemicals incident to the 

23 processing of licensed material; however, the release is not expected to require a 

24 response by an offsite response organization to protect persons offsite.

25

26 b. Site area emergency: Events that may occur, are in progress, or have occurred 

27 that could lead to a significant release of radioactive material or hazardous 

28 chemicals incident to the processing of licensed material and that could require a 

29 response by offsite emergency response organizations to protect persons offsite.

30

31 2. The emergency plan should identify the classification (alert or site area emergency) 

32 expected for each accident identified in the emergency plan.

33

34 3. The emergency plan should specify emergency action levels (EALs) at which an alert or 

35 site area emergency will be declared. EALs are specific conditions that require the 

36 performance of emergency response measures. The applicant’s EALs should be 

37 consistent with Appendix A to Regulatory Guide 3.67 and should be comparable to the 

38 U.S. Environmental Protection Agency (EPA) Protective Action Guides described in 

39 EPA 400-R-92-001, “Manual of Protective Action Guides and Protective Actions for 

40 Nuclear Incidents,” issued May 1992. Transportation accidents more than 1.61 km 

41 (1 mi) from the facility should not be classified.

42

43 4. The emergency plan should designate the personnel positions and alternates with the 

44 responsibility for accident classification during normal operations and back shifts.

45

46
May 2014 8-7 NUREG-1520, Revision 2

1 8.4.3.1.5 Detection of Accidents

2

3 For each type of accident identified, the emergency plan should describe the following:

45

6 1. the means of detecting the accident

7

8 2. the means of detecting any release of radioactive material or hazardous chemicals 

9 incident to the processing of licensed material

10

11 3. the means of alerting the operating staff

12

13 4. the anticipated response of the operating staff

14

15 8.4.3.1.6 Mitigation of Consequences

1617

18 For each accident identified in the ISA summary, the emergency plan should briefly describe 

19 measures and equipment to be used for safe shutdown and the mitigation of consequences to 

20 workers onsite and offsite and to the public offsite.

21

22 8.4.3.1.7 Assessment of Releases

2324

25 The emergency plan should describe the following aspects of the applicant’s procedures to be 

26 used to promptly and effectively assess the release of radioactive material or hazardous 

27 chemicals incident to the processing of licensed material:

2829

30 1. procedures for estimating or measuring the release rate or source term

31

32 2. valid computer codes used to project doses or concentrations to the public or 

33 environment and their associated assumptions, along with adequate justifications to 

34 show the validity of the assumptions

35

36 3. types, methods, frequencies, implementation times, and other details of onsite and 

37 offsite sampling and monitoring that will be performed to assess a release of radioactive 

38 materials or hazardous chemicals incident to the processing of licensed material

39

40 4. the method for assessing collateral damage to the facility (especially items relied on for 

41 safety)

4243

44 The emergency plan should describe the applicant’s procedure for validating any code used to 

45 assess releases of radioactive material or hazardous chemicals incident to the processing of 

46 licensed material.

47

48 8.4.3.1.8 Responsibilities

49

50 The emergency plan should describe the emergency response organization and administration 

51 that ensure effective planning, implementation, and control of emergency preparedness 

52 activities. In addition, the applicant should make the following commitments:

5354

55 1. Procedures will clearly define the organizational structure and chain of command.

56
May 2014 8-8 NUREG-1520, Revision 2

1 2. Staffing and resources will be sufficient to accomplish all assigned tasks.

2

3 3. Procedures will clearly define responsibilities and authority for each management, 

4 supervisory, and professional position. Responsibility is assigned for the coordination of 

5 onsite and offsite emergency response preparedness.

6

7 4. Procedures will clearly define interfaces with supporting groups, both onsite and offsite.

8

9 5. Mutual cooperation agreements exist or will be entered into with local agencies, such as

10 fire, police, ambulance and rescue, and medical units.

11

12 6. Plant management measures will be in place through procedures to audit and assess 

13 emergency preparedness to ensure site readiness to handle emergencies and to identify 

14 and correct problems.

15

16 7. The onsite emergency response organization will provide effective command and control 

17 of the site during the assessment, mitigation, and recovery phase of an accident.

18

19 8. The emergency public information system will provide advance and ongoing information 

20 to the media and public on subjects that would be discussed during an emergency, such 

21 as radiation hazards, chemical hazards, site operation, and site emergency plans.

22

23 9. The schedule of emergency preparedness procedure development will ensure that 

24 procedures are available to support startup and operation of new processes and facilities 

25 onsite.

26

27 8.4.3.1.9 Notification and Coordination

28

29 A. The emergency plan should provide reasonable assurance that emergency notification 

30 procedures will enable the emergency organization to correctly classify emergencies, 

31 notify emergency response personnel, and initiate or recommend appropriate actions in 

32 a timely manner, on the basis of the following:

33

34 1. Emergency events are classified on the basis of the current emergency plan.

35

36 2. Notification procedures minimize distraction of shift operating personnel and 

37 include concise, preformatted messages. Appropriate followup messages to 

38 offsite authorities are issued promptly.

39

40 3. Information on the nature and magnitude of the hazards is made available to the 

41 appropriate emergency response personnel.

42

43 4. Radiological and chemical source term data are available to the command post, 

44 technical support center, emergency operation center, and appropriate State 

45 personnel in cooperation with the NRC.

46

47 5. When available, offsite field monitoring data are logged, compared with source 

48 term data, and used in the protective action recommendation process.

49
May 2014 8-9 NUREG-1520, Revision 2

1 6. Protective Action Guides are available and are used by the appropriate 

2 personnel in a timely manner.

3

4 7. The emergency public information program ensures timely dissemination of 

5 accurate, reliable, and understandable information.

6

7 8. Systems are in place, if required, to alert, notify, and mobilize onsite and offsite 

8 response personnel in case of an emergency.

9

10 9. Procedures are in place to notify and coordinate with responsible parties when 

11 some personnel, equipment, and facility components are not available.

12

13 B. The emergency plan should describe who will take the following actions and how he or 

14 she will act promptly and effectively:

15

16 1. the decision to declare an alert or site area emergency

17

18 2. the activation of the onsite emergency response organization during all shifts

19

20 3. the prompt notification of offsite response authorities that an alert or site area 

21 emergency has been declared, including the licensee’s initial recommendation 

22 for offsite protective actions (normally within 15 minutes of classification)

23

24 4. the notification to the NRC Operations Center (as soon as possible and, in any 

25 case, no later than 1 hour after a declared emergency)

26

27 5. the decision regarding which onsite protective actions to initiate

28

29 6. the decision regarding which offsite protective actions to recommend

30

31 7. the decision to request support from offsite organizations

32

33 8. the decision to terminate the emergency or enter recovery mode

34

35 8.4.3.1.10 Information To Be Communicated

36

37 The emergency plan should describe the information to be communicated during an emergency, 

38 including the following:

3940

41 1. a standard reporting checklist to facilitate timely notification

42

43 2. the types of information to be provided concerning facility status, radioactive releases or 

44 hazardous chemicals incident to the processing of licensed material, and protective 

45 action recommendations

46

47 3. a description of preplanned protective action recommendations to be made to each 

48 appropriate offsite organization

49
May 2014 8-10 NUREG-1520, Revision 2

1 4. the offsite officials to be notified as a function of the classification of the event

2

3 5. the recommended actions to be taken by offsite organizations for each accident treated 

4 in the emergency plan

5

6 8.4.3.1.11 Training

7

8 The emergency plan should describe the frequency, performance objectives, and plans for the 

9 emergency response training that the licensee will provide to workers. The plan should include 

10 the following:

1112

13 1. the topics and general content of training programs for the licensee’s onsite and offsite 

14 emergency response personnel to satisfy the objectives described above

15

16 2. the administration of the training program, including responsibility for training, the 

17 positions to be trained, the schedules for training, the frequency of retraining, the use of 

18 team training, and the estimated number of hours of initial training and retraining

19

20 3. the training to be provided on the use of protective equipment, such as respirators, 

21 protective clothing, monitoring devices, and other equipment used in emergency 

22 response

23

24 4. the training program for onsite personnel who are not members of the emergency 

25 response staff

26

27 5. any special instructions and orientation tours that the licensee would offer to fire, police, 

28 medical, and other nonlicensee emergency personnel who may be required to respond 

29 to an emergency to ensure that they know the emergency plan, assigned duties, and 

30 effective response to an actual emergency

31

32 8.4.3.1.12 Safe Shutdown (Recovery and Facility Restoration)

33

34 The emergency plan should describe the following aspects of the applicant’s plans for 

35 adequately restoring the facility to a safe status after an accident and recovery after an 

36 emergency:

3738

39 1. the methods and responsibilities for assessing the damage to and status of the facility’s 

40 capabilities to safely control radioactive material or hazardous chemicals associated with 

41 the process

42

43 2. the procedures for promptly determining the actions necessary to reduce any ongoing 

44 releases of radioactive material or hazardous chemicals incident to the processing of 

45 licensed material and to prevent further incidents

46

47 3. the provisions for promptly and effectively accomplishing required restoration actions

48

49 4. key positions in the recovery organization
May 2014 8-11 NUREG-1520, Revision 2

1 8.4.3.1.13 Exercises and Drills

2

3 The emergency plan should state the applicant’s commitment to conduct exercises and drills in 

4 a manner that demonstrates the capability of the organization to plan and perform an effective 

5 response to an emergency. An adequate plan should demonstrate the following:

6

7 1. Qualified individuals for each position in the emergency response organization 

8 demonstrate task-related knowledge through periodic participation.

9

10 2. Drill performance is assessed against specific scenario objectives using postulated 

11 accidents that adequately test personnel, equipment, and resources, including 

12 previously identified weaknesses.

13

14 3. Effective player, controller, evaluator, and observer predrill briefings are conducted.

15

16 4. Scenario data and exercise messages provided by the controllers effectively maintain 

17 the timeline and do not interfere with the emergency organization’s response to exercise 

18 scenario events, except where safety considerations are involved.

19

20 5. Trained evaluators are used to identify and record participant performance, scenario 

21 strengths and deficiencies, and equipment problems.

22

23 6. The prestaging of equipment and personnel is minimized to realistically test the 

24 activation and staffing of emergency facilities.

25

26 7. Critiques are conducted promptly and include a followup plan for correcting any 

27 identified weaknesses and improving training effectiveness.

28

29 8. Emergency drills demonstrate that resources are effectively used to control the site, 

30 mitigate further damage, control radiological releases, perform required onsite activities 

31 under simulated radiation/airborne and other emergency conditions, accurately assess 

32 the facility’s status during an accident, and initiate recovery.

33

34 9. Emergency drills demonstrate personnel protection measures, including controlling and 

35 minimizing hazards to individuals during fires, medical emergencies, mitigation activities, 

36 search and rescue, and other similar events.

37

38 10. The emergency drills demonstrate that onsite communications effectively support 

39 emergency response activities.

40

41 11. The emergency drills demonstrate that the emergency public information organization 

42 disseminates accurate, reliable, timely, and understandable information.

43

44 12. Provisions are made for conducting quarterly communications checks with offsite 

45 response organizations.

46

47 13. Offsite organizations are invited to participate in the biennial onsite exercise, which tests 

48 the major elements of the emergency plan and response organizations.

49
May 2014 8-12 NUREG-1520, Revision 2

1 8.4.3.1.14 Responsibilities for Developing and Maintaining the Emergency Program and Its 

2 Procedures

3

4 The emergency plan should describe the following aspects of the responsibilities for developing 

5 and maintaining the emergency program and its procedures:

67

8 1. the means for ensuring that revisions to the emergency plan and the procedures used to 

9 implement the emergency plan are adequately prepared, kept up to date (normally within 

10 30 days of any changes), and distributed to all affected parties, including the NRC

11

12 2. the provisions for approving the implementing emergency procedures, making and 

13 distributing changes to the procedures, and ensuring that each person responsible for an 

14 emergency response function has immediate access to a current copy of the emergency 

procedures 2 15

16

17 3. procedures for allowing offsite response organizations 60 days to comment on any new 

emergency plan or significantly updated emergency plans 3 18

19

20 8.4.3.2 Evaluation that No Emergency Plan Is Required 

21

22 The staff should review the adequacy of the evaluation (or the referenced ISA summary) that no 

23 emergency plan is required against the requirements in 10 CFR 70.22(i)(2) and the specific 

24 criteria provided in Sections 8.4.3.2.1 through 8.4.3.2.4 of this SRP. This evaluation should be 

25 acceptable if it meets the regulatory requirements and the acceptance criteria given below.

26

27 8.4.3.2.1 Facility Description

28

29 The evaluation should describe the facility and site, the area near the site, and the licensed 

30 activities conducted at the facility. To be considered sufficient to support the evaluation, these 

31 descriptions should include the following:

3233

34 1. a detailed drawing of the site showing (1) onsite and near offsite (within 1.61 km (1 mi)) 

35 structures, with building numbers and labels; (2) roads and parking lots onsite and main 

36 roads near the site; (3) site boundaries, including fences and gates; (4) major site 

37 features, (5) water bodies within approximately 1.61 km (1 mi); and (6) the location(s) of 

38 the nearest residents

39

40 2. the stack heights, typical stack flow rates, and efficiencies of any emission control 

41 devices

42

43 3. a general description of licensed and other major activities conducted at the facility and 

44 the type, form, and quantities of radioactive material used

45

 2 Provisions for approving changes to the emergency plan and the procedures and the individuals authorized 

to make those changes should be clearly stated. 3 The applicant does not need to provide offsite organizations with amendments to emergency plans that do 

not affect an organization and those allowed by 10 CFR 70.32(i) before it submits them to the NRC.
May 2014 8-13 NUREG-1520, Revision 2

1 8.4.3.2.2 Types of Accidents

2

3 The evaluation should describe or refer to each type of accident identified by the ISA summary 

4 that has maximum offsite consequences that exceed the limit specified in 10 CFR 70.22(i)(1)(i). 

5 In addition, the following information should be available for review:

67

8 1. the process and physical location where the accident could occur

9

10 2. complicating factors and offsite consequences, including the release of nonradioactive 

11 hazardous chemicals incident to the processing of licensed material

12

13 3. the accident sequence that has the potential for the greatest radiological and toxic 

14 chemical impact

15

16 8.4.3.2.3 Detection of Accidents

17

18 For each type of accident identified, the evaluation should describe the following:

1920

21 1. the means of detecting the accident

22

23 2. the means of detecting any release of radioactive or hazardous chemicals incident to the 

24 processing of licensed material

25

26 3. the means of alerting the operating staff

27

28 4. the anticipated response of the operating staff

29

30 8.4.3.2.4 Evaluation of Maximum Public Exposure

31

32 To demonstrate that no emergency plan is required, an applicant may either (1) request that its

33 total possession limit for radioactive material be reduced below the emergency plan threshold in 

34 10 CFR 70.22(i)(1) or (2) perform a site-specific evaluation (or refer to the ISA summary, as 

35 appropriate) to demonstrate that maximum public exposure is less than the limits specified in 

36 10 CFR 70.22(i)(1)(i).

37

38 The evaluation should make available the following information sufficient to allow for 

39 independent verification:

4041

42 1. the type of accident (e.g., fire, explosion, hazardous chemicals released that are incident 

43 to the processing of licensed material, or nuclear criticality)

44

45 2. the location of the accident

46

47 3. the maximum source term

48

49 4. the solubility of material

50

51 5. the facility design or items relied on for safety and the proposed release fraction

52

53 6. the location and distance of the nearest member of the public to the facility
May 2014 8-14 NUREG-1520, Revision 2

1

2 7. the dose model and process used to verify the reliability of the model and the validity of 

3 the assumptions

4

5 8. the assumed worst case weather condition

6

7 9. the maximum calculated exposure to a member of the public at the facility boundary

8

9 The evaluation should list and describe the factors in 10 CFR 70.22(i)(2) that the applicant 

10 considered in evaluating the maximum dose to members of the public. The applicant should 

11 demonstrate why the factors used in the evaluation are appropriate when compared with the 

12 factors in NUREG-1140. If the factors and evaluation show that the maximum dose to a 

13 member of the public offsite from a release of radioactive materials could not exceed a 0.01-Sv 

14 (1-rem) effective dose equivalent or the intake of 2 mg of soluble uranium, no emergency plan is 

15 required in accordance with 10 CFR 70.22(i)(1)(i).

16

17 8.4.3.3 Requirements for New Facilities or New Processes at Existing Facilities

18

19 The application should address the BDC for new facilities or new processes at existing facilities 

20 that require a license amendment under 10 CFR 70.72, “Facility Changes and Change 

21 Process.” Regulations in 10 CFR 70.64(a)(6) require that the BDC must be applied to the 

22 design of new processes but do not require retrofits to existing facilities or existing processes; 

23 however, all facilities and processes must comply with the performance requirements in 

24 10 CFR 70.61, “Performance Requirements.” The licensee or applicant should clearly state 

25 how the design of the facility or process provides for the emergency capability to maintain 

26 control of the following:

27

28 1. licensed material and hazardous chemicals produced from licensed material, including:

29

30 a. how the site, facility, or process was designed to process and store both licensed 

31 materials and hazardous chemicals either produced from licensed material or 

32 used in the process (referencing the licensee or applicant’s sitewide security plan, 

33 if desired)

34

35 b. controls on the interface of hazardous chemicals with the licensed material 

36 process safety program

37

38 2. evacuation of onsite personnel, including the criteria used designing the facility to allow 

39 personnel to evacuate (e.g., time, dose, and ease of egress)

40

41 3. onsite emergency facilities and services that facilitate the use of available offsite 

42 services, including:

43

44 a. the offsite services that will be needed in an emergency at the facility

45

46 b. the criteria used to design the facility to detect accidents

47

48 c. the criteria used to design the facility to alert facility staff of an accident

49
May 2014 8-15 NUREG-1520, Revision 2

1 d. the criteria was used to design the facility to notify and coordinate with both onsite 

2 and offsite personnel

3

4 e. the criteria used to design the facility to allow for the transportation of personnel 

5 to onsite and offsite facilities or locations

6

7 8.5 Amendments or Changes to the Emergency Plan

8

9 The applicant may make changes to the approved emergency plan without NRC approval if the 

10 changes do not decrease the effectiveness of the plan and the applicant submits copies of the 

11 changes to the NRC and appropriate organizations within 6 months of making the changes in 

12 accordance with 10 CFR 70.32(i). The applicant may not implement proposed changes that 

13 decrease the effectiveness of the emergency plan without prior application to and approval of 

14 the NRC.

15

16 8.6 Review Procedures

17

18 8.6.1 Acceptance Review

19

20 During the acceptance review of a license application, the reviewer should examine the 

21 submittals to identify major deficiencies in the information provided for each area of review 

22 specified in SRP Section 8.3. Reviewers must decide whether they have enough information to 

23 proceed with a detailed review. Less significant errors or deficiencies that can be addressed in 

24 a request for additional information should be accepted. However, before the NRC performs a 

25 detailed review, the applicant should correct major deficiencies that would require several 

26 requests for additional information to resolve.

27

28 Reviewers should record whether each area of review is adequately addressed in the 

29 application, is adequately addressed in a referenced document, is not applicable to the 

30 application, or has a major deficiency.

31

32 8.6.2 Safety Evaluation

33

34 After determining that the application is acceptable for review in accordance with Section 8.6.1 

35 above, the primary reviewer should perform a safety evaluation against the acceptance criteria 

36 described in Section 8.4 above. During the initial review, the reviewer should draft the safety 

37 evaluation report (SER) described below. A request for additional information (RAI) will be 

38 prepared when clarification and additional information are needed to determine whether the 

39 licensee’s submittals comply with the regulations. The primary reviewer should coordinate with 

40 the licensing project manager in preparing RAIs. Additional information submitted by the 

41 applicant will be evaluated and a final SER will be provided to the licensing project manager.

42

43 8.6.2.1 Emergency Plan

44

45 After the NRC staff receives an acceptable application from the applicant, the primary reviewer 

46 should conduct a complete review of the applicant’s emergency plan and assess its 

47 acceptability in accordance with Section 8.4.3.1 above. The reviewer should verify that 

48 emergency planning is consistent with the potential accident sequences described in the 

49 ISA summary. The ISA summary reviewer and emergency plan reviewer should coordinate 
May 2014 8-16 NUREG-1520, Revision 2

1 their efforts to ensure the resolution of any issues concerning the emergency plan relative to 

2 ISA summary information.

3

4 Although the section of the licensee’s submittal entitled “Emergency Management Program” 

5 should contain the bulk of this information, the primary and secondary reviewers should gain 

6 familiarity with the site, including its demography, land use, facility design and layout, and major 

7 accidents postulated by the applicant, as presented in relevant sections of the application. The 

8 primary and secondary reviewers should also become familiar with proposed radiation 

9 protection activities and other operational matters that interface with emergency plans 

10 (particularly the functions reviewed using SRP Chapters 4 and 11). The reviewers should 

11 consult draft and final environmental statements for the proposed facility. This information may 

12 be supplemented by a personal visit to the site by the reviewer and meetings with the applicant. 

13 As the final step, the primary reviewer should prepare a safety evaluation report (SER) section

14 in accordance with Section 8.7 below.

15

16 8.6.2.2 Evaluation that No Emergency Plan Is Required

17

18 The primary reviewer should verify that the evaluation is consistent with the potential accident 

19 sequences described in the ISA summary. The ISA summary reviewer and the primary 

20 reviewer should coordinate their efforts to ensure the resolution of any issues concerning the 

21 evaluation relative to ISA information. As the final step, the primary reviewer should prepare an 

22 SER section in accordance with SRP Section 8.7 that either agrees with the applicant’s 

23 conclusion that no emergency plan is required or indicates that the staff does not accept the 

24 applicant’s evaluation and recommends that an emergency plan be required.

25

26 8.7 Evaluation Findings

27

28 The regulations in 10 CFR 70.23, “Requirements for the Approval of Applications,” and 70.66, 

29 “Additional Requirements for Approval of License Application,” state that an application for a 

30 license will be approved if the Commission can make the general findings listed in those 

31 sections. The basis for the general findings is an evaluation of whether the application 

32 adequately addresses all of the applicable regulatory requirements. More specifically, the staff’s 

33 evaluation should determine whether the licensing submittals provide sufficient information to 

34 satisfy the regulatory requirements listed in Section 8.4.1 of this SRP and whether the applicant 

35 has appropriately addressed the regulatory acceptance criteria in SRP Section 8.4.3. The SER 

36 should state how the applicable regulatory requirements have or have not been met based on 

37 the acceptance criteria described in this chapter of the SRP. If the applicant chooses to use an 

38 alternative approach, the reviewer should discuss in the SER whether the proposed approach 

39 satisfies the applicable regulatory requirements. The reviewers should use the following 

40 approach to document their evaluation:

41

42 1. State a specific regulatory requirement that applies to the application. Detailed 

43 acceptance criteria may be included where appropriate or necessary to clarify the 

44 requirement.

45

46 2. Identify the areas where the regulatory requirement is addressed in the application, 

47 including the areas where the specific acceptance criteria described in this SRP are 

48 addressed.
May 2014 8-17 NUREG-1520, Revision 2

1 3. Describe your evaluation of the application and the bases for your conclusion. State 

2 whether the application meets the regulatory requirement.

3

4 4. Repeat these steps for every regulatory requirement that applies to the application.

5

6 There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

7 application or amendment request, (2) denial of the application or request, or (3) approval with 

8 conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

9 reviewer may consider proposing a license condition. Absent an NRC order, license conditions 

10 must be agreed on with the licensee or applicant before becoming part of the license. A license 

11 condition should only be proposed if there is reasonable assurance that, if the licensee meets 

12 the condition, all regulatory requirements will be satisfied. Thus, license conditions should not 

13 be used to cover major deficiencies in an application. License conditions should be 

14 unambiguous, inspectable, and enforceable. They should only require those actions necessary 

15 to ensure compliance with applicable regulations. The basis for license conditions must be 

16 documented in the SER.

17

18 The report includes a summary statement describing what was evaluated and why the reviewer 

19 finds the submittal acceptable that is similar to the following:

20

21 The staff has evaluated [insert a summary statement describing what was 

22 evaluated and why the reviewer finds the submittal acceptable]. In accordance 

23 with 10 CFR 70.22(i), the licensee commits to maintain and execute an 

24 emergency plan for responding to the radiological hazards resulting from a 

25 release of radioactive material or hazardous chemicals incident to the processing 

26 of licensed material. The NRC staff reviewed the emergency plan with respect to 

27 10 CFR 70.22(i) and the acceptance criteria in SRP Section 8.4.3. The NRC 

28 staff determined that the applicant’s emergency plan is adequate to demonstrate 

29 compliance with 10 CFR 70.22(i) in that (1) the facility is properly configured to 

30 limit releases of radioactive materials in the event of an accident; (2) a capability 

31 exists for measuring and assessing the significance of accidental releases of 

32 radioactive materials; (3) appropriate emergency equipment and procedures are 

33 provided onsite to protect workers against radiation and other chemical hazards 

34 that might be encountered after an accident; (4) a system has been established 

35 to notify Federal, State, and local government agencies and to recommend 

36 appropriate protective actions to protect members of the public; and (5) the 

37 necessary recovery actions are established to return the facility to a safe 

38 condition after an accident.

39

40 The requirements of the emergency plan are implemented through approved 

41 written procedures. Changes that decrease the effectiveness of the emergency 

42 plan may not be made without NRC approval. The NRC will be notified of other 

43 changes that do not decrease the effectiveness of the emergency plan within 

44 6 months of making the changes.

45

46 8.8 References

47

48 U.S. Code of Federal Regulations, “Domestic Licensing of Special Nuclear Material,” Part 70, 

49 Chapter I, Title 10, “Energy.”
May 2014 8-18 NUREG-1520, Revision 2

1 U.S. Environmental Protection Agency, “Manual of Protective Action Guides and Protective 

2 Actions for Nuclear Incidents,” EPA 400-R-92-001, Washington, DC, May 1992.

3

4 U.S. Nuclear Regulatory Commission, “Part 30 Statements of Consideration and Emergency 

5 Preparedness for Fuel Cycle and Other Radioactive Material Licensees,” Federal Register, 

6 Vol. 54, No. 66, April 7, 1989, pp. 14051–14059 (54 FR 14051).

7

8 U.S. Nuclear Regulatory Commission, “Response Technical Manual (RTM) 96,”

9 NUREG/BR-0150, Vol. 1, Revision 4, March 1996.

10

11 U.S. Nuclear Regulatory Commission, “Nuclear Fuel Cycle Accident Analysis Handbook,” 

12 NUREG/CR-6410, March 1998.
May 2014 9-19 NUREG-1520, Revision 2

9. ENVIRONMENTAL PROTECTION

1 9.1 Purpose of Review

2

3 The purpose of this review is to determine whether the applicant’s proposed 

4 environmental-protection measures are adequate to protect the environment and public health 

5 and safety and to comply with the regulatory requirements imposed by the U.S. Nuclear 

6 Regulatory Commission (NRC) in Title 10 of the Code of Federal Regulations (10 CFR) Part 20, 

7 “Standards for Protection against Radiation,” and 10 CFR Part 70, “Domestic Licensing of 

8 Special Nuclear Material.” If the environmental-protection information of the safety evaluation 

9 report (SER) is to be used in the preparation of an environmental document pursuant to the 

10 separate requirements of the National Environmental Policy Act (NEPA) and under the 

11 requirements of 10 CFR Part 51, “Environmental Protection Regulations for Domestic Licensing 

12 and Related Regulatory Functions,” the staff preparing the NEPA document is responsible for 

13 independently evaluating whether the information in the SER can also to be used for that 

14 independent purpose.

15

16 Accordingly, this chapter does not address the specific requirements of 10 CFR Part 51. 

17 NUREG-1748, “Environmental Review Guidance for Licensing Actions Associated with NMSS 

18 Programs,” issued August 2003, which provides general procedures for the environmental 

19 review of licensing actions regulated by the Office of Federal and State Materials and 

20 Environmental Management Programs (FSME) and the Office of Nuclear Material Safety and 

21 Safeguards (NMSS). The staff of the Division of Fuel Cycle Safety and Safeguards (FCSS) 

22 should coordinate the preparation of an environmental assessment (EA) and finding of no 

23 significant impact (FONSI) or an environmental impact statement (EIS) with FSME. If the 

24 licensee proposes that a requested action is a categorical exclusion under the provisions of 

25 10 CFR 51.22, “Criterion for Categorical Exclusion; Identification of Licensing and Regulatory 

26 Actions Eligible for Categorical Exclusion or Otherwise Not Requiring Environmental Review,” 

27 the FCSS staff should confirm that the action meets the applicable criteria in 10 CFR 51.22(c).

28

29 9.2 Responsibility for Review

30

31 Primary: Environmental Engineer/Scientist

32

33 Secondary: Licensing Project Manager

34

35 Supporting: Fuel Cycle Facility Inspector

36 Radiation Safety Reviewer

37 Integrated Safety Analysis (ISA) Primary Reviewer

38 Environmental Project Manager (FSME)

39 Fire Protection Reviewer

40 Criticality Safety Reviewer

41 Chemical Safety Reviewer

42

43 9.3 Areas of Review

44

45 The environmental safety program should address the environmental protection measures, 

46 including the control and monitoring of gaseous and liquid effluents and the management of 

47 solid waste. The environmental program should also provide for the monitoring of the facility 
May 2014 9-20 NUREG-1520, Revision 2

1 environment, including ambient air, surface water, ground water, soils, and vegetation that can 

2 be affected by facility effluents. This SRP chapter addresses the areas of review for 

3 environmental protection measures, and for environmental monitoring measures. Although 

4 information regarding environmental monitoring may be used by the staff as part of a larger set 

5 of information considered in the preparation of an EIS, this SRP chapter is not intended to 

6 satisfy the independent information needs of the staff to prepare an EIS or EA under the 

7 separate requirements of NEPA. The Environmental Project Manager or designee should 

8 coordinate its review with the FCSS safety and safeguards reviewer to assure consistency of 

9 their respective reviews and information needs from the applicant (e.g., RAIs).

10

11 If the application includes an ISA summary as required by Subpart H, “Additional Requirements 

12 for Certain Licensees Authorized To Possess a Critical Mass of Special Nuclear Material,” of 

13 10 CFR Part 70, the environmental reviewer will review the ISA summary accident sequences 

14 that could result in high or intermediate consequences to an individual located outside the 

15 controlled area or that could result in a 24-hour averaged release of radioactive material outside 

16 the restricted area in concentrations exceeding 5,000 times the values in Table 2 of Appendix B, 

17 “Annual Limits on Intake (ALIs) and Derived Air Concentrations (DACs) of Radionuclides for 

18 Occupational Exposure; Effluent Concentrations; Concentrations for Release to Sewerage,” to 

19 10 CFR Part 20. Section 9.3.2.3 below addresses areas of review for the ISA summary specific 

20 to environmental protection.

21

22 The regulatory requirements for environmental protection appear in 10 CFR Part 20, 10 CFR 

23 Part 51, and 10 CFR Part 70. The NRC staff focuses its environmental review on that part of 

24 the plant wide safety program that the applicant establishes to control and assess the level of 

25 radioactive and nonradioactive releases (gaseous, liquid, and solid) to the environment. 

26 Therefore, the staff reviews the effluent control portion of the applicant’s radiation protection 

27 program and the applicant’s effluent and environmental monitoring practices from a safety, not 

28 NEPA-related, perspective.

29

30 To receive authorization to possess a critical mass quantity of special nuclear material (SNM), 

31 an applicant must also perform an ISA and prepare an ISA summary in accordance with 

32 Subpart H of 10 CFR Part 70. SRP Chapter 3 presents guidance on the ISA. The 

33 environmental safety review of the ISA summary will examine the identified potential accident 

34 sequences that result in radiological and non-radiological releases to the environment, the items 

35 relied on for safety (IROFS) that the applicant specifies to reduce the environmental risk of 

36 those accidents, and the associated management measures that provide reasonable assurance 

37 that the IROFS will perform their designated safety functions. It is critical for SRP Chapter 3 to 

38 specify that offsite impacts of accidents have been considered in its evaluation and to provide 

39 an assessment of those impacts, if any. The environmental-specific information in Chapter 3 is 

40 to be used to support the review for Section 9.3.2 below.

41

42 Thus, environmental protection encompasses three main components, as necessary: 

43 (1) effluent and environmental controls and monitoring, (2) the ISA summary and other 

44 ISA documentation as described in Sections 9.3.1 and 9.3.2 below, and (3) management 

45 measures in the license application.

46

47 9.3.1 Effluent and Environmental Controls and Monitoring

48

49 A. The staff’s review of the environmental radiation protection program described in the 

50 application encompasses the following areas:
May 2014 9-21 NUREG-1520, Revision 2

1

2 1. as low as reasonably achievable (ALARA) goals for effluent control

3

4 2. effluent controls to maintain public doses ALARA

5

6 3. ALARA reviews and reports to management

7

8 4. waste minimization practices and, for new operations, design plans for waste 

9 minimization

10

11 B. The staff’s review of the applicant’s effluent and environmental monitoring program 

12 described in the application encompasses the following areas:

13

14 1. in-place filter-testing procedures for air-cleaning systems

15

16 2. known or expected concentrations of radionuclides in effluents

17

18 3. physical and chemical characteristics of radionuclides in discharges

19

20 4. discharge locations

21

22 5. environmental media to be monitored and the sample locations

23

24 6. sampling collection and analysis procedures, including the minimum detectable 

25 concentrations of radionuclides

26

27 7. action levels and actions to be taken when the levels are exceeded

28

29 8. permits, including air discharge and National Pollutant Discharge Elimination 

30 System permits

31

32 9. leak detection systems for ponds, lagoons, and tanks

33

34 10. pathways analysis methods to estimate public doses

35

36 11. recording and reporting procedures

37

38 12. solid waste handling and disposal programs

39

40 9.3.2 Integrated Safety Analysis Summary

41

42 The staff’s review of the applicant’s ISA summary related to environmental protection includes 

43 the following areas:

44

45 1. accident sequences (and associated facility processes) that, if unmitigated, would result 

46 in releases to the environment

47

48 2. likelihood and environmental consequences of these accident sequences
May 2014 9-22 NUREG-1520, Revision 2

1 3. controls relied on to reduce the unmitigated risk from high or intermediate risk to an 

2 acceptable level

3

4 4. availability and reliability of controls

5

6 9.3.3 Environmental Protection Management Measures

7

8 The staff’s review of the applicant’s management measures related to environmental protection 

9 includes the following areas:

10

11 1. a method for grading management measures commensurate with the reduction in risk 

12 attributable to each control or control system

13

14 2. a commitment to design, implement, and maintain the controls and control systems to 

15 ensure that they are available and reliable to perform their functions when needed

16

17 Review Interfaces

18

19 In addition to the information contained in Chapter 9 of the application, the environmental 

20 reviewer should also examine information in the following other areas to ensure that it is 

21 consistent with the information in Chapter 9. Note that the staff assessment of the information 

22 identified below is to be found in the respective chapters of the SER, not in Chapter 9:

23

24 • facility and process descriptions applied to environmental protection as described in 

25 SRP Chapter 1

26

27 • the safety program, ISA commitments, and ISA documentation applied to environmental 

28 protection as described in SRP Chapter 3

29

30 • the radiation safety program as described in SRP Chapter 4

31

32 • chemical processes applied to environmental protection as described in SRP Chapter 6

33

34 • fire-initiated accident sequences that have the potential to result in high or intermediate 

35 consequences as described in SRP Chapter 7

36

37 • configuration management, maintenance, training and qualifications, procedures, audits 

38 and assessments, incident investigations, record management, and other quality 

assurance elements as described in SRP Chapter 11 39

 1 Section 9.3.3 addresses areas of review for management measures applied to environmental protection.
May 2014 9-23 NUREG-1520, Revision 2

1 9.4 Acceptance Criteria

2

3 Sections 9.4.3.1 through 9.4.3.3 describe acceptance criteria for the effluent and environmental 

4 controls and monitoring, the ISA summary, and management measures. If the acceptance 

5 criteria for the other sections of the SER have been met, then the information is also acceptable 

6 under Chapter 9.

7

8 9.4.1 Regulatory Requirements

9

10 To be considered acceptable, the application must satisfy the following regulatory requirements 

11 for environmental protection:

1213

14 1. Subpart B, “Radiation Protection Programs”; Subpart D, “Radiation Dose Limits for 

15 Individual Members of the Public”; and Subpart F, “Surveys and Monitoring,” of 10 CFR

16 Part 20 specify the effluent control and treatment measures necessary to meet the dose 

17 limits and dose constraints for members of the public. Subpart F also states the survey 

18 requirements. Subpart K, “Waste Disposal,” specifies the waste disposal requirements; 

19 Subpart L, “Records,” specifies the records requirements; and Subpart M, “Reports,” 

20 specifies the reporting requirements.

21

22 2. 10 CFR Part 51 provides that the applicant must provide an Environmental Report which 

23 shall contain the information specified in section 51.45, as required by 10 CFR 51.60(a) 

24 “Environmental Report.”

25

26 3. 10 CFR Part 70 requires the applicant to demonstrate that proposed facilities and 

27 equipment, including measuring and monitoring instruments and devices for the disposal 

28 of radioactive effluents and wastes, are adequate to protect the environment and public 

29 health and safety, as specified in 10 CFR 70.22(a)(7).

30

31 4. 10 CFR Part 70 also provides that the applicant for a facility (as described in 

32 10 CFR 70.4, “Definitions”) must submit a safety assessment of the design basis of the 

33 principal structures, systems, and components of the plant, including provisions for 

34 protection against natural phenomena, as specified in 10 CFR 70.22(f).

35

36 5. 10 CFR Part 70 also provides that an applicant for a facility must provide an ISA 

37 summary that includes a list of the IROFS established by the applicant and other 

38 elements, as described in 10 CFR 70.65(b).

39

40 6. 10 CFR 70.59, “Effluent Monitoring Reporting Requirements,” outlines the reporting 

41 requirements for radiological-effluent monitoring for a 10 CFR Part 70 licensee.

42

43 9.4.2 Regulatory Guidance

44

45 The regulatory guidance for environmental protection appears in the following NRC and industry 

4647 documents:

4849

50 1. NRC Regulatory Guide 4.15, “Quality Assurance for Radionuclide Monitoring Programs 

51 (Inception through Normal Operations to License Termination)—Effluent Streams and 

52 the Environment,” Revision 2, July 2007
May 2014 9-24 NUREG-1520, Revision 2

1 2. NRC Regulatory Guide 4.16, “Monitoring and Reporting Radioactivity in Releases of 

2 Radioactive Materials in Liquid and Gaseous Effluents from Nuclear Fuel Processing 

3 and Fabrication Plants and Uranium Hexafluoride Production Plants,” December 1985

4

5 3. NRC Regulatory Guide 4.20, “Constraint on Releases of Airborne Radioactive Materials 

6 to the Environment for Licensees Other Than Power Reactors,” December 1996

7

8 4. NRC Regulatory Guide 8.37, “ALARA Levels for Effluents from Materials Facilities,” 

9 July 1993

10

11 5. NRC Information Notice 94-07, “Solubility Criteria for Liquid Effluent Releases to 

12 Sanitary Sewerage under the Revised 10 CFR Part 20,” January 28, 1994

13

14 6. NRC Information Notice 94-23, “Guidance to Hazardous, Radioactive, and Mixed Waste 

15 Generators on the Elements of a Waste Minimization Program,” March 25, 1994

16

17 7. American National Standards Institute (ANSI) N13.1-1982, “Guide to Sampling Airborne 

18 Radioactive Materials in Nuclear Facilities”

19

20 8. ANSI N42.18-1980, “Specification and Performance of On-Site Instrumentation for 

21 Continuously Monitoring Radioactive Effluents”

22

23 9. National Council on Radiation Protection and Measurements (NCRP) Report No. 123, 

24 “Screening Models for Releases of Radionuclides to Atmosphere, Surface Water, and 

25 Ground,” Volumes I and II, January 1996

26

27 10. NUREG-1513, “Integrated Safety Analysis Guidance Document,” May 2001

28

29 11. NUREG-1748, “Environmental Review Guidance for Licensing Actions Associated with 

30 NMSS Programs,” August 2003

31

32 12. NUREG/CR-6410, “Nuclear Fuel Cycle Accident Analysis Handbook,” March 1998

33

34 9.4.3 Regulatory Acceptance Criteria

35

36 9.4.3.1 Environmental Report or Categorical Exclusion

37

38 An environmental report is required for actions listed in 10 CFR 51.60(b). NUREG-1748 

39 discusses the acceptance criteria for the environmental report to satisfy NEPA requirements.

40

41 An environmental report is not required for licensing actions that meet the requirements for a 

42 categorical exclusion, as defined in 10 CFR 51.22(c). However, if under 10 CFR 51.22(c)(11) 

43 the action involves an amendment to licenses for fuel cycle plants, radioactive waste disposal 

44 sites, and other materials licenses identified in 10 CFR 51.60(b)(1) for changes in process 

45 operations or equipment, the applicant must demonstrate that the action will not result in 

46 significant effects on the environment. NUREG-1748 gives the acceptance criteria for this 

47 categorical exclusion.

48

49 If a license application indicates a significant increase in the potential for, or consequences of, 

50 radiological accidents, then the licensing action is NOT categorically excluded from review 
May 2014 9-25 NUREG-1520, Revision 2

1 under the National Environmental Policy Act. The application must include an environmental 

2 report and the staff must prepare an EA.

3

4 9.4.3.2 Effluent and Environmental Controls and Monitoring

5

6 An applicant’s proposed environmental protection measures are acceptable if they provide for 

7 qualified and trained staff, effluent control, and effluent and environmental monitoring in 

8 accordance with the NRC’s requirements. Using the acceptance criteria defined in Standard 

9 Review Plan (SRP) Chapter 11, the NRC staff will review qualifications and training that the 

10 applicant has established for plant personnel who are associated with environmental protection. 

11 This review will include the qualification and training of managers, supervisors, technical staff, 

12 operators, technicians, and maintenance personnel whose levels of knowledge are important to 

13 the environment and protect public health and safety. The NRC will expect managers and staff 

14 to have levels of education and experience commensurate with the responsibilities of their 

15 positions.

16

17 9.4.3.2.1 Effluent Controls and Waste Minimization

18

19 In accordance with 10 CFR 20.1101, “Radiation Protection Programs,” each licensee must 

20 implement a radiation protection program, which is discussed in detail in SRP Chapter 4. The 

21 environmental review of the radiation protection program focuses on the applicant’s methods to 

22 maintain public doses ALARA in accordance with 10 CFR 20.1101. NRC guidance on 

23 compliance with these regulations appears in Regulatory Guide 8.37.

24

25 Specifically, 10 CFR 20.1101(d) requires the applicant to establish constraints on airborne 

26 emissions of radioactive material to the environment, excluding radon-222 and its decay 

27 products. Such constraints must ensure that the individual member of the public who is likely to 

28 receive the highest dose will not be expected to receive a total effective dose equivalent (TEDE) 

29 in excess of 0.1 millisievert (10 millirem) per year from these emissions. To meet the reporting 

30 requirements of 10 CFR 20.2203, “Reports of Exposures, Radiation Levels, and Concentrations 

31 of Radioactive Material Exceeding the Constraints or Limits,” the applicant must have (and 

32 describe) procedures for reporting to the NRC when these dose constraints are exceeded and 

33 must take prompt appropriate corrective action to prevent recurrence. NRC guidance on 

34 compliance with this regulation can be found in Regulatory Guide 4.20.

35

36 The environmental review of the radiation protection program also focuses on the applicant’s 

37 waste minimization practices. Applicants for new licenses are required to comply with 

38 10 CFR 20.1406, “Minimization of Contamination,” which states that the applicant must describe 

39 how facility design procedures for operation will, to the extent practicable, minimize 

40 contamination of the facility and the environment, facilitate eventual decommissioning, and 

41 minimize the generation of radioactive waste. Applicants requesting amendment or renewal of 

42 existing licenses must minimize and control waste generation during operations as part of the 

43 radiation protection program, in accordance with 10 CFR 20.1101 (Volume 62 of the 

44 Federal Register, page 39,082 (62 FR 39082); July 21, 1997).

45

46 NRC Information Notice 94-23 offers guidance for waste minimization programs. SRP 

47 Chapter 10 offers more information on compliance with the decommissioning aspects of the 

48 waste minimization regulations.
May 2014 9-26 NUREG-1520, Revision 2

1 The proposed radiation protection program is acceptable if it satisfies the following criteria:

2

3 1. Radiological (ALARA) Goals for Effluent Control

4

5 ALARA goals are set at a modest fraction (10 to 20 percent) of the values in Table 2, 

6 Columns 1 and 2, and Table 3 of Appendix B to 10 CFR Part 20 and the external 

7 exposure limit in 10 CFR 20.1302(b)(2)(ii), or the dose limit for members of the public, if 

8 the applicant proposes to demonstrate compliance with 10 CFR 20.1301, “Dose Limits 

9 for Individual Members of the Public,” through a calculation of the TEDE to the individual 

10 likely to receive the highest dose.

11

12 An applicant’s constraint approach is acceptable if it is consistent with guidance found in 

13 Regulatory Guide 4.20 and if the applicant’s description of the constraint approach 

14 provides sufficient detail to demonstrate specific application of the guidance to proposed 

15 routine and nonroutine operations, including anticipated events.

16

17 2. Effluent Controls to Maintain Public Doses ALARA

18

19 The applicant describes and commits to the use of effluent controls (e.g., procedures, 

20 engineering controls, and process controls) to maintain public doses ALARA. Common 

21 control practices include filtration, encapsulation, adsorption, containment, recycling, 

22 leakage reduction, and storage of materials for radioactive decay. Practices for large, 

23 diffuse sources (such as contaminated soils or surfaces) include covers, wetting during 

24 operations, and the application of stabilizers. The applicant must demonstrate a 

25 commitment to reduce unnecessary exposure to members of the public and releases to 

26 the environment.

27

28 Engineering options that do not substantially reduce the collective dose and require 

29 unreasonable costs are not required. “Reasonableness” can be founded on qualitative 

30 or quantitative cost/benefit analyses. Quantitative analyses may use a value of 

31 2,000 per person-rem (person-centisievert), as discussed in NUREG-1530, 

32 “Reassessment of the NRC’s Dollar per Person-Rem Conversion Factor Policy,” issued 

33 December 1995.

34

35 3. ALARA Reviews and Reports to Management

36

37 The applicant commits to an annual review of the content and implementation of the 

38 radiation protection program, which includes the ALARA effluent control program. This 

39 review includes analysis of trends in release concentrations, environmental monitoring 

40 data, and radionuclide usage; determines whether operational changes are needed to 

41 achieve the ALARA effluent goals; and evaluates all designs for system installations or 

42 modifications. The applicant also commits to reporting the results to senior 

43 management, along with recommendations for changes in facilities or procedures that 

44 are necessary to achieve ALARA goals.

45

46 4. Waste Minimization

47

48 To comply with 10 CFR 20.1406, applications for new licenses must describe how the 

49 facility’s design procedures for operation will minimize, to the extent practicable, the 

50 contamination of the facility and the environment and the generation of radioactive 
May 2014 9-27 NUREG-1520, Revision 2

1 waste. Waste minimization programs proposed by applicants for both new and existing 

2 licenses are acceptable if the programs include the following:

34

5 a. top management support

6

7 b. the methods used to characterize waste generation (including types and 

8 amounts) and waste management costs (including costs of regulatory 

9 compliance, paperwork, transportation, treatment, storage, and disposal)

10

11 c. periodic waste minimization assessments to identify waste minimization 

12 opportunities and solicit employee or external recommendations

13

14 d. provisions for technology transfer to seek and exchange technical information on 

15 waste minimization

16

17 e. the methods used to implement and evaluate waste minimization 

18 recommendations

19

20 9.4.3.2.2 Effluent and Environmental Monitoring

21

22 A. The applicant’s effluent monitoring is considered acceptable, for purposes of the SER, if 

23 it meets the following criteria. However, the applicant’s environmental monitoring

24 program must be independently assessed to determine whether the information is also 

25 acceptable for NEPA documentation purposes:

2627

28 1. The known or expected concentrations of radioactive materials in airborne and 

29 liquid effluents are ALARA and are below the limits specified in Table 2 of 

30 Appendix B to 10 CFR Part 20 or the site-specific limits established in 

31 accordance with 10 CFR 20.1302(c).

32

33 If, in accordance with 10 CFR 20.1302(c), the applicant proposes to adjust the 

34 effluent concentrations in Appendix B to 10 CFR Part 20 to account for the actual 

35 physical and chemical characteristics of the effluents, the applicant must provide 

36 information on aerosol size distributions, solubility, density, radioactive decay 

37 equilibrium, and chemical form. This information must be complete and accurate 

38 to justify the derivation and application of the alternative concentration limits for 

39 the radioactive materials.

40

41 2. If the applicant proposes to demonstrate compliance with 10 CFR 20.1301 using 

42 a calculation of the TEDE to the individual who is likely to receive the highest 

43 dose in accordance with 10 CFR 20.1302(b)(1), it must support the calculation of 

44 the TEDE by pathway analyses with appropriate models, codes, and 

45 assumptions that accurately represent the facility, site, and the surrounding area. 

46 In addition, the assumptions must be reasonable, input data must be accurate, all 

47 applicable pathways must be considered, and the results must be interpreted 

48 correctly.

49

50 NCRP Report No. 123 provides acceptable methods for calculating the dose 

51 from radioactive effluents. The use of computer codes is acceptable for pathway 

52 analyses if the applicant can demonstrate that any code it has used has 
May 2014 9-28 NUREG-1520, Revision 2

1 undergone validation and verification to demonstrate the validity of estimates 

2 developed using the codes for established input sets. Dose conversion factors 

3 are acceptable for use in the pathway analyses if they are based on the 

4 methodology described in International Commission on Radiological 

5 Protection 30, “Limits for Intakes of Radionuclides by Workers,” 1982, as 

6 reflected in the U.S. Environmental Protection Agency’s Federal Guidance 

7 Report No. 11, “Limiting Values of Radionuclide Intake and Air Concentration and 

8 Dose Conversion Factors for Inhalation, Submersion, and Ingestion,” issued 

9 September 1988. Such methods are acceptable for determining the dose to the 

10 maximally exposed individual during normal facility operations and anticipated 

11 events.

12

13 3. The applicant identifies and monitors all liquid and airborne effluent discharge 

14 locations and identifies monitoring locations. For those effluent discharge points 

15 that have input from two or more contributing sources within the facility, sampling 

16 each contributing source is considered necessary for effective process and 

17 effluent control.

18

19 4. The applicant continuously samples airborne effluents from all routine and 

20 nonroutine operations and from anticipated events associated with the plant, 

21 including effluents from areas that are not used for processing SNM, such as 

22 laboratories, experimental areas, storage areas, and fuel element assembly 

23 areas.

24

25 Effluents are sampled unless the applicant has established (by periodic sampling 

26 or other means) that radioactivity in the effluent is insignificant and will remain so. 

27 In such cases, the effluent is sampled at least quarterly to confirm that its 

28 radioactivity is not significant. For the purposes of this SRP, radioactivity in an 

29 effluent is significant if the concentration averaged over a calendar quarter is 

30 equal to 10 percent or more of the appropriate concentration listed in Table 2 of 

31 Appendix B to 10 CFR Part 20.

3233

34 5. The sample collection and analysis methods and frequencies are appropriate for 

35 the effluent medium and the radionuclide(s) being sampled. Sampling methods 

36 ensure that the applicant obtains representative samples using appropriate 

37 sampling equipment and sample collection and storage procedures. For liquid 

38 effluents, the applicant collects representative samples at each release point to 

39 determine the concentrations and quantities of radionuclides that are released to 

40 an unrestricted area, including discharges to sewage systems. For continuous 

41 releases, the applicant collects samples continuously at each release point. For 

42 batch releases, the applicant collects a representative sample of each batch. If 

43 the applicant uses periodic sampling in lieu of continual sampling, it shows that 

44 the samples are representative of actual releases. Monitoring instruments are 

45 calibrated at least annually, or more frequently if suggested by the manufacturer.

46

47 6. The applicant performs radionuclide-specific analyses on selected composite 

48 samples unless either of the following criteria exists:

49

50 a. The gross alpha and beta activities are so low that individual 

51 radionuclides could not be present in concentrations greater than 10 
May 2014 9-29 NUREG-1520, Revision 2

1 percent of the concentrations specified in Tables 2 or 3 of Appendix B to 

2 10 CFR Part 20.

3

4 b. The radionuclide composition of the sample is known through operational 

5 data, such as the composition of the feed material. 

6

7 Monitoring reports in which the quantities of individual radionuclides are 

8 estimated on the basis of methods other than direct measurement include 

9 an explanation and justification of how the results were obtained.

10

11 Operational data may not be adequate for determining radionuclide 

12 concentration in certain cases. Such cases include, but are not limited to: 

13 (1) plants that process uranium in which extraction, ammonium diuranate 

14 precipitation, ion exchange, or other separation process could result in 

15 the concentration of thorium isotopes (principally thorium-234); (2) plants 

16 that process uranium of varying enrichments; and (3) plants that process 

17 plutonium in which significant variation in the plutonium-238/plutonium18 239 ratio among batches and the continuous ingrowth of americium-241 

19 would preclude the use of feed material data to determine the 

20 radionuclide composition of effluents.

21

22 The applicant performs radionuclide analyses more frequently than usual 

23 (1) at the beginning of the monitoring program (until it establishes a 

24 predictable and consistent radionuclide composition in effluents); 

25 (2) whenever there is a significant, unexplained increase in gross 

26 radioactivity in effluents; and (3) whenever a process change or other 

27 circumstance might cause a significant variation in the radionuclide 

28 composition.

29

30 7. The minimum detectable concentration (MDC) for sample analyses is not more 

31 than 5 percent of the concentration limits listed in Table 2 of Appendix B to 

32 10 CFR Part 20. If the actual concentrations of radionuclides in samples are 

33 known to be higher than 5 percent of the 10 CFR Part 20 limits, the analysis 

34 methods need only be adequate to measure the actual concentration. However, 

35 in such cases, the MDC must be low enough to accommodate fluctuations in the 

36 concentrations of the effluent and the uncertainty of the MDC.

37

38 8. The laboratory quality control procedures are adequate to validate the analytical 

39 results. These procedures include the use of established standards, such as 

40 those provided by the National Institute of Standards and Technology, and 

41 standard analytical procedures, such as those established by the National 

42 Environmental Laboratory Accreditation Conference.

43

44 9. The proposed action levels and actions to be taken if the action levels are 

45 exceeded are appropriate. The action levels are incremental, such that each 

46 increasing action level results in a more aggressive action to ensure effluent 

47 control. A slightly higher than normal concentration of a radionuclide in an 

48 effluent triggers an investigation into the cause of the increase. The specified 

49 action level will result in the shutdown of an operation if the specified level is 

50 exceeded. These action levels are selected on the basis of the likelihood that a 
May 2014 9-30 NUREG-1520, Revision 2

1 measured increase in concentration could indicate potential violation of the 

2 effluent limits.

3

4 10. The applicant completely and accurately describes all applicable Federal and 

5 State standards for discharges and any permits issued by Federal, State, or local 

6 governments for gaseous and liquid effluents.

7

8 11. The systems for detecting leakage from ponds, lagoons, and tanks are adequate 

9 to detect and ensure against any unplanned releases to groundwater, surface 

10 water, or soil.

11

12 12. The applicant controls and maintains releases to sewer systems to meet the 

13 requirements of 10 CFR 20.2003, “Disposal by Release into Sanitary Sewerage,” 

14 including the following:

15

16 a. The material is water soluble.

17

18 b. Known or expected discharges meet the effluent limits specified in 

19 Table 3 of Appendix B to 10 CFR Part 20.

20

21 c. The known or expected total quantity of radioactive material released into 

22 the sewer system in a year does not exceed 5 curies (Ci) (185 

23 gigabecquerels (GBq)) of hydrogen-3, 1 Ci (37 GBq) of carbon-14, and 1 

24 Ci (37 GBq) of all other radioactive materials combined.

25

26 d. Solubility is determined in accordance with the procedure described in 

27 NRC Information Notice 94-07.

28

29 13. Reporting procedures comply with the requirements of 10 CFR 70.59 and the 

30 guidance in Regulatory Guide 4.16. The applicant provides reports that include 

31 the concentrations of principal radionuclides released to unrestricted areas in 

32 liquid and gaseous effluents and the MDC for the analysis and the error for each 

33 data point.

34

35 14. The applicant’s procedures and facilities for solid and liquid waste handling, 

36 storage, and monitoring result in safe storage and timely disposition of the 

37 material.

38

39 B. The scope of the applicant’s environmental monitoring is acceptable (for purposes of the 

40 SER) if it is commensurate with the scope of activities at the facility and the expected 

41 impacts from operations as identified in the environmental report and if it meets the 

42 following criteria:

43

44 1. Background and baseline concentrations of radionuclides in environmental media 

45 have been established through sampling and analysis.

46

47 2. Monitoring includes sampling and analyses for monitoring air, surface water, 

48 groundwater, soil, sediments, and vegetation, as appropriate.

49
May 2014 9-31 NUREG-1520, Revision 2

1 3. The description of monitoring identifies adequate and appropriate sampling 

2 locations and frequencies for each environmental medium, the frequency of 

3 sampling, and the analyses to be performed on each medium.

4

5 4. Monitoring procedures employ acceptable analytical methods and 

6 instrumentation. The applicant commits to an instrument maintenance and 

7 calibration program that is appropriate to the given instrumentation. If the 

8 applicant proposes to use its own analytical laboratory for the analysis of

9 environmental samples, the applicant commits to providing third-party verification 

10 of the laboratory’s methods (such as that obtained by participation in a 

11 round-robin measurement program).

12

13 5. Appropriate action levels and actions to be taken if the levels are exceeded are 

14 specified for each environmental medium and radionuclide.

15

16 Action levels are selected on the basis of a pathway analysis that demonstrates 

17 that, below those concentrations, doses to the public will be ALARA and below 

18 the limits specified in Subpart B to 10 CFR Part 20. The action levels specify the 

19 concentrations at which an investigation would be performed and levels at which 

20 process operations would be shut down.

21

22 6. MDCs are specified for sample analyses and are at least as low as those

23 selected for effluent monitoring in air and water. MDCs for sediment, soil, and 

24 vegetation are selected on the basis of action levels to ensure that sampling and 

25 analytical methods are sensitive and reliable enough to support the application of 

26 the action levels.

27

28 7. Data analysis methods and criteria that the applicant will use to evaluate and 

29 report the environmental sampling results are appropriate and will indicate when 

30 an action level is being approached in time to take corrective actions.

31

32 8. The description of the status of all licenses, permits, and other approvals of 

33 facility operations required by Federal, State, and local authorities is complete 

34 and accurate.

35

36 9. Environmental monitoring is adequate to assess impacts to the environment from 

37 potential radioactive and nonradioactive releases, as identified in high- and 

38 intermediate-consequence accident sequences in the ISA.

39

40 9.4.3.3 Integrated Safety Analysis Summary

41

42 A. In accordance with 10 CFR 70.60, “Applicability,” applicants requesting a license to 

43 possess and process greater than a critical mass of SNM are required to perform an ISA 

44 and submit an ISA summary to the NRC for approval. The applicant’s treatment of 

45 environmental protection in the ISA is acceptable if it fulfills the following criteria:

4647

48 1. The ISA provides a complete list of accident sequences that result in radiological 

49 and nonradiological releases to the environment.

50
May 2014 9-32 NUREG-1520, Revision 2

1 2. The ISA uses acceptable methods to estimate environmental effects that may 

2 result from accident sequences and to determine whether the effects are high or 

3 intermediate consequences as defined in 10 CFR 70.61, “Performance 

4 Requirements.” NUREG/CR-6410 describes acceptable methods for estimating 

5 environmental effects from accident sequences.

6

7 3. The ISA provides a reasonable estimate of the likelihood and consequences of 

8 each accident sequence identified.

9

10 4. The ISA identifies adequate engineering or administrative controls or both for 

11 each accident sequence of environmental significance. These controls will 

12 prevent or mitigate high- and intermediate-consequence accident sequences to 

13 an acceptable level. (Consequence categories are defined in 10 CFR 70.61 and 

14 in SRP Chapter 3.) IROFS provide the indicated level of protection.

15

16 5. The ISA affords adequate levels of assurance so that IROFS will satisfactorily 

17 perform their safety functions. Configuration management, training, and 

18 maintenance activities contribute to achieving this assurance.

19

20 6. For an ISA summary of a facility that has not yet been constructed, the 

21 specifications for IROFS may not be complete at the time the ISA summary is 

22 submitted. The IROFS functions should be described in sufficient detail for the 

23 reviewer to determine their adequacy to prevent or mitigate the accident 

24 sequence. For example, the description of an in-line gamma monitor used to 

25 alert an operator of an off-normal condition should define the range of gamma 

26 activity that the monitor needs to detect. A description of a ventilation system 

27 that controls the consequences of an enclosure spill should include its air-moving 

28 capacity. The description of a stack sampler that detects excessive airborne 

29 releases should include the capacities of the sampler.

30

31 In addition to participating in the integrated review of the ISA performed in accordance 

32 with SRP Chapter 3, the reviewer should also examine, in detail, the fire-initiated release 

33 scenarios provided in the ISA summary to demonstrate compliance with 10 CFR 70.61, 

34 because fire-initiated accident scenarios have the potential for environmental 

35 consequences. This review should follow the guidance provided in applicable sections 

36 of SRP Chapter 3 to give a detailed evaluation of these scenarios, including a review of 

37 fire-induced consequences to the environment, the likelihood of such consequences, 

38 and IROFS chosen to prevent or mitigate those consequences.

39

40 B. The reviewer should consider the following factors in determining the acceptability of the 

41 applicant’s descriptions of fire-initiated accident sequences:

42

43 1. Scenario descriptions are sufficiently detailed to allow an understanding of the 

44 fire hazards that permits an evaluation of potential accident sequences.

45

46 2. The applicant has adequately described the environmental consequences and 

47 likelihood of accident sequences identified in the ISA summary involving fire, 

48 including risks from hazardous chemicals produced from licensed material and

49 risks from radioactive materials.
May 2014 9-33 NUREG-1520, Revision 2

1 3. All controls that are used to mitigate or prevent the scenario are identified as 

2 IROFS or as defense-in-depth measures. For those controls that are IROFS, 

3 reliability and associated management measures should be indicated.

4

5 4. Analyses that the applicant has performed as part of the evaluation should be 

6 part of the ISA and should be referenced or identified for potential further review 

7 by the NRC staff.

8

9 9.4.3.4 Environmental Protection Management Measures

10

11 The management measures applied to IROFS designated to prevent or mitigate accident 

12 sequences in which the IROFS are needed are acceptable for purposes of the SER if they meet 

13 the acceptance criteria in SRP Chapter 11.

14

15 9.5 Review Procedures

16

17 9.5.1 Review Procedures

18

19 The staff will review the environmental report, environmental protection measures, 

20 ISA summary, and management measures to verify that they meet the acceptance criteria 

21 defined in SRP Section 9.4. During the acceptance review of a license application, the reviewer 

22 should examine the submittals to identify major deficiencies in the information provided for each 

23 area of review specified in SRP Section 9.3. Reviewers must decide whether they have enough 

24 information to proceed with a detailed review. Less significant errors or deficiencies that can be 

25 addressed in a request for additional information should be accepted. However, before the 

26 NRC performs a detailed review, the applicant should correct major deficiencies that would 

27 require several requests for additional information to resolve.

28

29 Reviewers should record whether each area of review is adequately addressed in the 

30 application, is adequately addressed in a referenced document, is not applicable to the 

31 application, or has a major deficiency.

32

33 9.5.2 Effluent and Environmental Controls and Monitoring

34

35 An environmental specialist will review the applicant’s environmental protection measures in 

36 coordination with the Environmental Project Manager and the fuel cycle facility inspector 

37 responsible for environmental protection. Any comments or concerns that the environmental 

38 reviewer or inspector identifies will be addressed and resolved, and the safety evaluation report 

39 (SER) (described in Section 9.6) for the licensing action will contain a statement indicating 

40 whether the inspection staff has any objections to the approval of the proposed licensing action. 

41 In addition, the review will include an evaluation of inspection reports and semiannual effluent 

42 reports, submitted in accordance with 10 CFR 70.59, to ensure licensee performance in 

43 environmental protection.

44

45 9.5.3 Integrated Safety Analysis Summary

46

47 As part of the environmental protection review, the environmental specialist will review the 

48 ISA summary, including all identified accident sequences that can have significant 

49 environmental consequences, to determine whether the list completely and properly identifies all 

50 potential accidents. The environmental specialist will coordinate this review with the ISA 
May 2014 9-34 NUREG-1520, Revision 2

1 reviewer who is responsible for assuring that the required information is contained in Chapter 3 

2 of the SER. A detailed review will be conducted of (1) the accident sequences that, when left 

3 unmitigated, are rated as “high” consequence to an individual located outside the controlled 

4 area, (2) approximately 10 percent of the “intermediate” consequence sequences, and (3) a 

5 smaller number of accident sequences in which the consequences are less than intermediate. 

6 However, additional intermediate and low consequence sequences may be evaluated on the 

7 basis of the results of the initial review.

8

9 An evaluation of the ISA summary requires coordination with other technical reviewers. The 

10 environmental review of the IROFS will be coordinated with the reviewers for the specific 

11 assurance functions, such as training and maintenance. The review of the ISA summary may 

12 require the examination of the ISA and of detailed supporting ISA documents located at the 

13 facility. On the basis of these reviews, the reviewer should decide what supporting documents 

14 need to be reviewed. The reviewer will clearly identify in the SER either the materials examined 

15 and the descriptions and commitments considered and relied on or the basis for the staff’s 

16 safety decision.

17

18 9.5.4 Management Measures

19

20 The environmental reviewer should review the classification assigned to the IROFS to ensure 

21 that the management measures described in SRP Chapter 11 are used to determine whether 

22 the licensee has established adequate management measures to apply to all IROFS designated 

23 to prevent or mitigate high or intermediate accident consequences to a member of the public or 

24 intermediate consequences to the environment in accordance with 10 CFR 70.61(b)(2), 

25 10 CFR 70.61(c)(2), and 10 CFR 70.61(c)(3). The environmental reviewer should review the 

26 classification assigned to the IROFS to ensure that the management measures are graded 

27 commensurate with the reduction of risk attributable to the IROFS.

28

29 During the application and ISA summary review, the reviewer should identify and communicate 

30 to the inspection staff any items or issues that should be inspected during an operational 

31 readiness review, if such a review will be performed. These items could include confirming that 

32 the engineered controls installed in the process actually meet the capabilities described in the 

33 ISA summary and that administrative controls are implemented through procedures and 

34 operator training.

35

36 9.6 Evaluation Findings

37

38 An SER documents the evaluation findings of the environmental protection review of the 

39 application, including the review of the environmental protection program and the ISA summary.

40

41 The regulations in 10 CFR 70.23, “Requirements for the Approval of Applications,” and 70.66, 

42 “Additional Requirements for Approval of License Application,” state that an application for a 

43 license will be approved if the Commission can make the general findings listed in those 

44 sections. The basis for the general findings is an evaluation of all the detailed regulatory 

45 requirements that apply to application. The staff’s evaluation should verify that the license 

46 application provides sufficient information to satisfy the regulatory requirements of Section 9.4.1 

47 of this SRP and that the applicant has appropriately considered the regulatory acceptance 

48 criteria in Section 9.4.3 in satisfying the requirements. The staff reviewers will verify that the 

49 information submitted by the applicant is in accordance with 10 CFR Part 20, 10 CFR Part 51, 

50 and 10 CFR Part 70 and is consistent with the guidance in this SRP as it applies to 
May 2014 9-35 NUREG-1520, Revision 2

1 environmental protection. The SER should state how the applicable regulatory requirements 

2 have been met based on the acceptance criteria described in this chapter. If the applicant 

3 chooses to suggest an alternative approach, the reviewer should identify in the SER how the 

4 proposed approach satisfies the applicable regulatory requirements. The reviewers should use 

5 the following approach to document their evaluation:

6

7 1. State a specific regulatory requirement that applies to the application. Detailed 

8 acceptance criteria may be included where appropriate or necessary to clarify the 

9 requirement.

10

11 2. Identify the areas where the regulatory requirement is addressed in the application, 

12 including the areas where the specific acceptance criteria described in this SRP are 

13 addressed.

14

15 3. Describe your evaluation of the application, basis for your conclusion, and whether the 

16 application meets the regulatory requirement.

17

18 4. Repeat these steps for every regulatory requirement that applies to the application.

19

20 Environmental protection is often reviewed and evaluated in conjunction with the environmental 

21 report, and the EA or EIS summarizes the environmental protection function. However, the EA 

22 or EIS does not become part of the license. The SER should briefly discuss issues identified 

23 during the review, and any recommended license conditions based on the analysis in the EA or 

24 EIS should be added to the license. However, the information in this chapter is not intended to 

25 address issues under NEPA. Although the staff may consider such information in its 

26 preparation of an EIS, the staff will independently evaluate and be responsible for all information 

27 used in the EIS.

28

29 If an EA or EIS is prepared for the licensing action prior to issuing the SER, then the 

30 environmental safety section of the SER should report the date the NEPA document was 

31 issued. If the EA results in a FONSI, the SER should include the publication date of the FONSI 

32 in the Federal Register. If an EIS is prepared, the SER would include the Federal Register

33 publication date for the record of decision. When applicable, the SER will also document the 

34 determination that an action meets the requirements for a categorical exclusion.

35

36 As discussed in Section 3.4.9 of NUREG-1748, the environmental PM should consult with the

37 affected State before the final EA is prepared. Appendix D to NUREG-1748 contains a 

38 suggested procedure to follow in consulting with the State. After the State has been consulted, 

39 the EA is finalized with text noting that the State was consulted along with a summary of the 

40 State’s comments.

41

42 In certain circumstances, a draft EA and FONSI may be prepared. Circumstances include those 

43 where a FONSI appears warranted for the proposed action but the proposed action is similar to 

44 one which normally requires an EIS, the proposed action is without precedent, or the 

45 appropriate NRC staff director determines preparation of a draft FONSI will further the purposes 

46 of NEPA [10 CFR 51.33(b)]. The draft FONSI should be clearly marked "draft" and should be 

47 published in the Federal Register and distributed as described in 10 CFR 51.74(a). The Federal 

48 Register notice must include a request for comments and specify where the comments should 

49 be submitted and when the comment period ends (10 CFR 51.119(a)).
May 2014 9-36 NUREG-1520, Revision 2

1 The following language would be appropriate for a licensing action that requires an 

2 environmental review:

3

4 The applicant has committed to adequate environmental-protection measures, 

5 including (1) environmental and effluent monitoring and (2) effluent controls to 

6 maintain public doses ALARA as part of the radiation protection program. The 

7 NRC staff concludes, with reasonable assurance, that the applicant’s 

8 conformance to the application and license conditions is adequate to protect the 

9 environment and public health and safety and to comply with the regulatory 

10 requirements imposed by the Commission in 10 CFR Part 20, 10 CFR Part 51, 

11 and 10 CFR Part 70. The bases for these conclusions are as follows:

12

13 [State the bases for the conclusion, including any recommended license 

14 conditions.]

15

16 If the action requires preparation of an EIS, the SER should include the following language:

17

18 The NRC staff prepared [or is preparing] an environmental impact statement (EIS)

19 [publication date, if available] for this licensing action as required by 10 CFR 51.20. On 

20 the basis of the EIS, the NRC stated in its record of decision [publication date in the 

21 Federal Register] that the preferred option was [state preferred option here]. 

22

23 If the action requires preparation of an EA and results in a FONSI, the SER 

24 should include the following language:

25

26 The NRC staff prepared an environmental assessment (EA) for this action 

27 as required by 10 CFR 51.21. On the basis of the EA, the staff has 

28 reached a finding of no significant impact, published in the Federal 

29 Register on [publication date and FR citation]. If staff published a draft 

30 EA for public comment, the SER should include the FR citation and 

31 publication date of the draft EA. The final EA should contain a list of 

32 significant comments received on the draft EA and how they were 

33 addressed in the final EA. 

34

35 If the staff determines that the action was categorically excluded from environmental review 

36 under 10 CFR 51.22, the SER should include the following language:

37

38 The staff has determined that the amended actions are administrative, 

39 organizational, or procedural in nature. Based on this evaluation, there is no 

40 significant impact to the environment, and the action of amending the license is 

41 eligible for categorical exclusion. Therefore, in accordance with 

42 10 CFR 51.22(c)(11), neither an environmental assessment nor an 

43 environmental impact statement is required for this action. The regulation at 

44 10 CFR 51.22(c)(11) allows for a categorical exclusion if the following four 

45 requirements have been satisfied:

46

47 (1) There is no significant change in the types or significant increase in the 

48 amounts of any effluents that may be released offsite.

49
May 2014 9-37 NUREG-1520, Revision 2

1 (2) There is no significant increase in individual or cumulative occupational 

2 radiation exposure.

3

4 (3) There is no significant construction impact.

5

6 (4) There is no significant increase in the potential for, or consequences 

7 from, radiological accidents.

8

9 The changes made in this licensing action do not pose a significant change or 

10 increase in parameters (1) through (4) above. There are no changes in the types 

11 or increases in the amounts of effluents. Occupational exposure is expected to 

12 remain the same. These changes involve no additional construction activity. 

13 The potential for, and consequences from, radiological accidents are expected to 

14 be the same.

15

16 [State the bases for the conclusion, including any recommended license 

17 conditions.]

18

19 The NRC staff prepared an environmental impact statement (EIS) [publication 

20 date] for this licensing action as required by 10 CFR 51.20. On the basis of the 

21 EIS, the NRC stated in its record of decision [publication date in the Federal 

22 Register] that the preferred option was [state preferred option here].

23

24 9.7 References

25

26 U.S. Code of Federal Regulations, “Standards for Protection against Radiation,” Part 20, 

27 Chapter I, Title 10, “Energy.”

28

29 U.S. Code of Federal Regulations, “Environmental Protection Regulations for Domestic 

30 Licensing and Related Regulatory Functions,” Part 51, Chapter I, Title 10, “Energy.”

31

32 U.S. Code of Federal Regulations, “Domestic Licensing of Special Nuclear Material,” Part 70, 

33 Chapter I, Title 10, “Energy.”

34

35 American National Standards Institute (ANSI), “Specification and Performance of On-Site 

36 Instrumentation for Continuously Monitoring Radioactivity in Effluents,” ANSI N42.18-1980, 

37 Washington, DC, 1980 (reaffirmed 2004).

38

39 American National Standards Institute (ANSI)/Health Physics Society (HPS), “Sampling and 

40 Monitoring Releases of Airborne Radioactive Substances from the Stacks and Ducts of Nuclear 

41 Facilities,” ANSI/HPS N13.1-2011, McLean, VA, 2011.

42

43 National Council on Radiation Protection and Measurements, “Screening Models for Releases 

44 of Radionuclides to Atmosphere, Surface Water, and Ground,” NCRP Report No. 123, 

45 Volumes I and II, Bethesda, MD, January 1996.

46

47 U.S. Environmental Protection Agency, “Limiting Values of Radionuclide Intake and Air 

48 Concentration and Dose Conversion Factors for Inhalation, Submersion, and Ingestion,” Federal 

49 Guidance Report No. 11, Washington, DC, September 1988.
May 2014 9-38 NUREG-1520, Revision 2

1 U.S. Nuclear Regulatory Commission, “Solubility Criteria for Liquid Effluent Releases to Sanitary 

2 Sewerage under the Revised 10 CFR Part 20,” Information Notice 94-07, January 28, 1994.

3

4 U.S. Nuclear Regulatory Commission, “Guidance to Hazardous, Radioactive, and Mixed Waste 

5 Generators on the Elements of a Waste Minimization Program,” Information Notice 94-23, 

6 March 25, 1994.

7

8 U.S. Nuclear Regulatory Commission, “Integrated Safety Analysis Guidance Document,” 

9 NUREG-1513, May 2001.

10

11 U.S. Nuclear Regulatory Commission, “Environmental Review Guidance for Licensing Actions 

12 Associated with NMSS Programs,” NUREG-1748, August 2003.

13

14 U.S. Nuclear Regulatory Commission, “Nuclear Fuel Cycle Accident Analysis Handbook,” 

15 NUREG/CR-6410, March 1998.

16

17 U.S. Nuclear Regulatory Commission, “Quality Assurance for Radiological Monitoring Programs 

18 (Inception through Normal Operations to License Termination)—Effluent Streams and the 

19 Environment,” Regulatory Guide 4.15, Revision 2, July 2007.

20

21 U.S. Nuclear Regulatory Commission, “Monitoring and Reporting Radioactivity in Releases of 

22 Radioactive Materials in Liquid and Gaseous Effluents from Nuclear Fuel Cycle Facilities,” 

23 Regulatory Guide 4.16, Revision 2, December 2010.

24

25 U.S. Nuclear Regulatory Commission, “Constraint on Releases of Airborne Radioactive 

26 Materials to the Environment for Licensees Other Than Power Reactors,” Regulatory 

27 Guide 4.20, Revision 1, April 2012.

28

29 U.S. Nuclear Regulatory Commission, “ALARA Levels for Effluents from Materials Facilities,” 

30 Regulatory Guide 8.37, July 1993.

31
May 2014 10-1 NUREG-1520, Revision 2

10. DECOMMISSIONING

1 10.1 Purpose of Review

1

2 The purpose of the review of the applicant’s decommissioning plans is to determine with 

3 reasonable assurance that the applicant will be able to decommission the facility safely and in 

4 accordance with the requirements of the U.S. Nuclear Regulatory Commission (NRC).

5

6 At the time of the initial application and at license renewal, the applicant or licensee should 

7 discuss its conceptual approach for meeting the decommissioning requirements in Title 10, 

8 “Energy,” of the Code of Federal Regulations (10 CFR) Part 20, “Standards for Protection 

9 against Radiation,” Subpart E, “Radiological Criteria for License Termination.” The applicant or 

10 licensee should discuss its plans for minimizing contamination.

11

12 At the time of the initial license application and again at license renewal, the applicant or 

13 licensee may be required to submit a decommissioning funding plan (DFP) in accordance with 

14 10 CFR 70.25(b). The purpose of the NRC’s evaluation of the DFP is to determine whether the 

15 applicant or licensee has taken the following actions:

16

17 1. considered decommissioning activities that may be needed in the future

18 2. performed a credible site-specific cost estimate for those activities

19 3. presented the NRC with financial assurance to cover the cost of those activities in the 

20 future

21

22 Therefore, the DFP should contain the following:

23

24 a. an overview of the proposed decommissioning activities

25 b. the methods used to determine the cost estimate

26 c. the financial assurance mechanism

27

28 This overview must contain sufficient detail to enable the reviewer to determine whether the 

29 decommissioning cost estimate is reasonably accurate.

30

31 In the application, the applicant or licensee should discuss its plans for meeting the 

32 decommissioning recordkeeping requirements in 10 CFR 70.25(g). Under the regulations, a 

33 licensee must keep records important for decommissioning. These records include records of 

34 spills or unusual occurrences involving the spread of contamination, as-built drawings and 

35 modifications to structures and equipment in restricted areas, a list of areas designated or 

36 formerly designated as restricted areas, and records pertaining to the financial-assurance 

37 requirements.

38

39 If required by 10 CFR 70.38(g), the licensee must also submit, for NRC approval, a 

40 decommissioning plan (DP) before beginning its decommissioning actions. The DP must detail 

41 the specific decommissioning activities that the licensee will perform and describe the 

42 radiation-protection procedures that the licensee will use to protect workers, the public, and the 

43 environment during decommissioning.
May 2014 10-2 NUREG-1520, Revision 2

1 This information must be sufficient to enable the reviewer to assess the appropriateness of the 

2 decommissioning activities and the adequacy of the procedures to protect the health and safety 

3 of workers, the public, and the environment. It must also update the cost estimate originally 

4 presented in the DFP to undertake the facility decommissioning. The licensee can generally 

5 obtain approval of a DP by submitting an application for a license amendment. The reviewer 

6 must determine that the applicant understands the decommissioning requirements and 

7 procedures and that it commits to protecting the health and safety of workers, the public, and 

8 the environment during decommissioning.

9

10 10.2 Responsibility for Review

11

12 Primary: Health Physics Reviewer

13

14 Secondary: Environmental Reviewer

15 Technical and Financial Specialists in the Division of Waste Management and

16 Environmental Protection

17

18 Supporting: Fuel Facility Inspection Staff

19

20 10.3 Areas of Review

21

22 Before beginning to review the DFP or DP, the reviewer should first evaluate the applicant’s 

23 proposed environmental protection measures (see Chapter 9 of this standard review plan 

24 (SRP)) and, specifically, the commitments to minimize waste associated with decommissioning. 

25 In addition, the reviewer should evaluate the applicant’s radiation-protection program (see SRP 

26 Chapter 4) as it applies to radiological decontamination and the management of radiological 

27 effluents.

28

29 The staff review should cover the following areas:

30

31 1. conceptual decontamination and decontamination plan, including the decommissioning 

32 program and steps, management and organization, health and safety, radiological 

33 decommissioning criteria, waste management, security and nuclear-material control, 

34 recordkeeping, the decontamination process, and the minimization of contamination

35

36 2. decommissioning costs and financial assurance (i.e., the decommissioning cost 

37 information should be consistent with the recommendations in NUREG-1757, 

38 “Consolidated Decommissioning Guidance,” issued September 2006)

39

40 The reviewer will evaluate the applicant’s DFP or DP or both in accordance with NUREG-1757.

41

42 10.4 Acceptance Criteria

43

44 10.4.1 Regulatory Requirements

45

46 The following NRC regulations require planning, financial assurance, and recordkeeping for 

47 decommissioning, as well as procedures and activities to minimize waste and contamination:

48

49 1. Subpart E of 10 CFR Part 20
May 2014 10-3 NUREG-1520, Revision 2

1 2. 10 CFR 30.35, “Financial Assurance and Recordkeeping for Decommissioning”

2

3 3. 10 CFR 30.36, “Expiration and Termination of Licenses and Decommissioning of Sites 

4 and Separate Buildings or Outdoor Areas”

5

6 4. 10 CFR 40.14, “Specific Exemptions”

7

8 5. 10 CFR 40.36, “Financial Assurance and Recordkeeping for Decommissioning”

9

10 6. 10 CFR 40.42, “Expiration and Termination of Licenses and Decommissioning of Sites 

11 and Separate Buildings or Outdoor Areas”

12

13 7. 10 CFR 70.17, “Specific Exemptions”

14

15 8. 10 CFR 70.22(a)(9)

16

17 9. 10 CFR 70.25, “Financial Assurance and Recordkeeping for Decommissioning”

18

19 10. 10 CFR 70.38, “Expiration and Termination of Licenses and Decommissioning of Sites 

20 and Separate Buildings or Outdoor Areas”

21

22 10.4.2 Regulatory Guidance

23

24 NUREG-1757 is relevant to the decommissioning of fuel cycle facilities.

25

26 10.5 Review Procedures

27

28 During the acceptance review of a license application, the reviewer should examine the 

29 submittals to identify major deficiencies in the information provided for each area of review 

30 specified in SRP Section 10.3. Reviewers must decide whether they have enough information 

31 to proceed with a detailed review. Less significant errors or deficiencies that can be addressed 

32 in a request for additional information should be accepted. However, before the NRC performs 

33 a detailed review, the applicant should correct major deficiencies that would require several 

34 requests for additional information to resolve.

35

36 Reviewers should record whether each area of review is adequately addressed in the 

37 application, is adequately addressed in a referenced document, is not applicable to the 

38 application, or has a major deficiency.

39

40 The primary reviewer will evaluate the application against the NRC requirements and 

41 acceptance criteria identified in NUREG-1757. A detailed review of any contamination- and 

42 waste minimization plans that the applicant submits in response to 10 CFR 20.1406, 

43 “Minimization of Contamination,” will supplement this review (as appropriate). The reviewer will 

44 also coordinate with the principal reviewers for environmental protection listed in SRP 

45 Chapter 9 to confirm the review of a new applicant’s plans to minimize waste and the plans for 

46 existing licensees to minimize contamination and reduce exposures and effluents as part of the 

47 radiation protection program established under 10 CFR Part 20. The purpose of this 

48 coordination is to ensure that any issues that are relevant to the environmental review are 
May 2014 10-4 NUREG-1520, Revision 2

1 properly conveyed to the primary reviewer for consideration and resolution as part of the review 

2 discussed in SRP Chapter 9 and that any decommissioning issues that arise in the 

3 environmental review that are best suited for review using guidance in this chapter are 

4 conveyed to the primary reviewer for consideration and resolution.

5

6 If the decommissioning review identifies the need for the applicant to submit information that 

7 has not already been included in the application, the reviewer will document these additional 

8 information needs in a request for additional information (RAI). The RAI transmitted to the 

9 applicant will specify a reasonable amount of time (e.g., 30 to 60 days) for the applicant to reply. 

10 Failure of the applicant to provide the requested information by the specified date, or on an 

11 alternative schedule that is mutually agreeable, could be grounds for terminating or suspending 

12 the application review.

13

14 The primary reviewer should coordinate with the Division of Waste Management and 

15 Environmental Protection to obtain the appropriate technical assistance in reviewing proposed 

16 DPs and financial assurance measures. The primary reviewer will coordinate with reviewers 

17 assigned by the Division of Waste Management and Environmental Protection to incorporate, as 

18 appropriate, RAIs and review findings in licensing correspondence and safety evaluation reports 

19 (SERs) related to decommissioning.

20

21 The reviewer should perform a safety review using the acceptance criteria in NUREG-1757 to 

22 ensure that the proposed decommissioning methodology, principal remediation activities, and 

23 worker and environmental radiation protection programs are acceptable.

24

25 10.5.1 Safety Evaluation

26

27 The primary reviewer will perform a safety evaluation with respect to the acceptance criteria in 

28 Section 10.4. During the initial review, the reviewer should draft the safety evaluation report 

29 (SER) described below. A request for additional information (RAI) will be prepared when 

30 clarification and additional information are needed to determine whether the licensee’s 

31 submittals comply with the regulations. The primary reviewer should coordinate with the 

32 licensing project manager in preparing RAIs. Additional information submitted by the applicant 

33 will be evaluated and a final SER will be provided to the licensing project manager.

34

35 10.6 Evaluation Findings

36

37 The regulations in 10 CFR 70.23, “Requirements for the Approval of Applications,” and 70.66, 

38 “Additional Requirements for Approval of License Application,” state that an application for a 

39 license will be approved if the Commission can make the general findings listed in those 

40 sections. The basis for the general findings is an evaluation of whether the application 

41 adequately addresses all of the applicable regulatory requirements. More specifically, the staff’s 

42 evaluation should determine whether the licensing submittals provide sufficient information to 

43 satisfy the regulatory requirements listed in Section 4.4 of this SRP and whether the applicant 

44 has appropriately addressed the regulatory acceptance criteria also described in SRP 

45 Section 4.4. This SER should address each topic area reviewed and discuss why the NRC has 

46 reasonable assurance that the DFP or DP should be considered acceptable, explaining the 

47 bases for the reviewers’ conclusions. The SER should state how the applicable regulatory 

48 requirements have been met based on the acceptance criteria described in this chapter of the 

49 SRP. If the applicant chooses to use an alternative approach, the reviewer should discuss in 
May 2014 10-5 NUREG-1520, Revision 2

1 the SER whether the proposed approach satisfies the applicable regulatory requirements. The 

2 reviewers should use the following approach to document their evaluation:

3

4 1. State a specific regulatory requirement that applies to the application. Detailed 

5 acceptance criteria may be included where appropriate or necessary to clarify the 

6 requirement.

7

8 2. Identify the areas where the regulatory requirement is addressed in the application, 

9 including the areas where the specific acceptance criteria described in this SRP are 

10 addressed.

11

12 3. Describe your evaluation of the application, the basis for your conclusion, and whether it 

13 meets the regulatory requirement.

14

15 4. Repeat these steps for every regulatory requirement that applies to the application.

16

17 There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

18 application or amendment request, (2) denial of the application or request, or (3) approval with 

19 conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

20 reviewer may consider proposing a license condition. Absent an NRC Order, license conditions 

21 must be agreed upon with the licensee or applicant before becoming part of the license. A 

22 license condition should only be proposed if there is reasonable assurance that, if the licensee 

23 meets the condition, all regulatory requirements will be satisfied. Thus, license conditions 

24 should not be used to cover major deficiencies in an application. License conditions should be 

25 unambiguous, inspectable, and enforceable. They should only require those actions necessary 

26 to ensure compliance with applicable regulations. The basis for license conditions must be 

27 documented in the SER.

28

29 If the submittal is acceptable, the final SER input should conclude with a statement similar to the 

30 following:

31

32 The NRC staff has evaluated the applicant’s/licensee’s plans and financial 

33 assurance for decommissioning in accordance with NUREG-1757, “Consolidated 

34 Decommissioning Guidance,” issued September 2006. On the basis of this 

35 evaluation, the NRC staff has determined that the applicant’s/licensee’s plans 

36 and financial assurance for decommissioning comply with the NRC’s regulations 

37 and provide reasonable assurance of protection for workers, the public, and the 

38 environment.

39

40 10.7 References

41

42 U.S. Code of Federal Regulations, “Standards for Protection against Radiation,” Part 20, 

43 Chapter I, Title 10, “Energy.”

44

45 U.S. Code of Federal Regulations, “Rules of General Applicability to Domestic Licensing of 

46 Byproduct Material,” Part 30, Chapter I, Title 10, “Energy.”

47

48 U.S. Code of Federal Regulations, “Domestic Licensing of Source Material,” Part 40, Chapter I, 

49 Title 10, “Energy.”
May 2014 10-6 NUREG-1520, Revision 2

1

2 U.S. Code of Federal Regulations, “Domestic Licensing of Special Nuclear Material,” Part 70, 

3 Chapter I, Title 10, “Energy.”

4

5 U.S. Nuclear Regulatory Commission, “Consolidated Decommissioning Guidance,” 

6 NUREG-1757, September 2006.
May 2014 11-1 NUREG-1520, Revision 2

11. MANAGEMENT MEASURES

1 11.1 Purpose of Review

2

3 Management measures are activities performed by a licensee, generally on a continuing basis, 

4 that are applied to IROFS to provide reasonable assurance that the items relied on for safety 

5 (IROFS) will perform their intended safety function when needed to prevent accidents or 

6 mitigate the consequences of accidents to an acceptable level. The purpose of management 

7 measures is to provide reasonable assurance of compliance with Title 10 of the Code of Federal 

8 Regulations (10 CFR) 70.61, “Performance Measures.” Reasonable assurance is established 

9 by considering factors such as necessary maintenance, operating limits, common-cause 

10 failures, and the likelihood and consequences of failure or degradation of the IROFS and the 

11 measures. As defined in 10 CFR 70.4, “Definitions,” management measures include 

12 configuration management (CM), maintenance, training and qualification, procedures, audits 

13 and assessments, incident investigations, records management, and other quality assurance 

14 (QA) elements. 

15

16 11.2 Responsibility for Review

17

18 Primary: Quality Assurance Reviewer

19

20 Supporting: Primary Reviewers of Chapters 3 through 10 of this Standard review plan (SRP)

21 Fuel Cycle Facility Inspector 

22

23 11.3 Areas of Review

24

25 In accordance with 10 CFR 70.62(d), each applicant must establish management measures to 

26 ensure that IROFS, as documented in the integrated safety analysis (ISA) summary, provide 

27 reasonable assurance that they will be designed, implemented, and maintained in such a way 

28 as to ensure that they are available and reliable to perform their intended functions, when 

29 needed, to comply with the performance requirements of 10 CFR 70.61. The degree to which 

30 measures are applied may be a function of the item’s importance in meeting the performance 

31 requirements. 

32

33 If a “graded” application of a particular management measure is used for IROFS of differing 

34 importance, the applicant should describe the variations and the reviewer should determine 

35 whether the measures are commensurate with the importance to safety of the IROFS. The 

36 guidance contained in this Chapter may be used in the development of a graded management 

37 measures program, or alternate graded controls may be proposed by the applicant. Exceptions 

38 and alternatives to these acceptance criteria may be adopted provided the applicant or licensee 

39 can demonstrate that it satisfies the management measures requirements in 10 CFR Part 70. A 

40 program of graded management measures may be implemented by new applicants, licensees 

41 proposing new facilities or new processes at existing facilities, or by existing licensees provided 

42 that the applicant or licensee describes the application of the ranking system and graded 

43 management measures in a license application or license amendment that is reviewed and 

44 approved by the NRC staff. Guidance for graded management measures in this chapter will 

45 refer to the “applicant,” to include applicants for new licenses or applicants for license 

46 amendments.
May 2014 11-2 NUREG-1520, Revision 2

1 The specific areas of review are as follows:

2

3 1. Configuration Management—The U.S. Nuclear Regulatory Commission (NRC) staff 

4 review will determine whether the applicant has proposed a CM program that ensures 

5 consistency in the facility design and operational requirements, the physical 

6 configuration, and the facility documentation. The review should determine that the 

7 applicant’s CM program captures formal documentation governing the design and 

8 continued modification of the site, structures, processes, systems, components, 

9 computer programs, personnel activities, and supporting management measures. The 

10 review should also ensure that the CM program is adequately coordinated and 

11 integrated with other management measures.

12

13 The NRC staff should review the applicant’s descriptions and commitments for CM, 

14 including descriptions of the organizational structure responsible for CM activities; 

15 descriptions of the process, procedures, and documentation required by the applicant for 

16 modifying the site; and descriptions of the various levels of CM to be applied to IROFS 

17 designated in the ISA summary. The staff’s review should focus on the applicant’s CM 

18 measures that provide reasonable assurance of the documentation of engineering, 

19 procurement, installation, and modifications; the training and qualification of affected 

20 staff; the revision and distribution of operating, test, calibration, surveillance, and 

21 maintenance procedures and drawings; and the postmodification testing. The review of 

22 the overall approach to implementing CM should include the evaluation of the CM 

23 program, design requirements, document control, change control, assessments, and 

24 design reconstitution for existing facilities.

25

26 2. Maintenance—The NRC staff’s review should evaluate the applicant’s description of its 

27 maintenance program. The staff will examine the applicant’s commitments to inspect, 

28 calibrate, test, and maintain IROFS to a level commensurate with the items’ importance 

29 to safety. The staff will review the applicant’s description of how the site organization 

30 implements (1) corrective maintenance, (2) preventive maintenance (PM), 

31 (3) surveillance and monitoring, and (4) functional testing. Not every aspect of each of 

32 the four maintenance functions is necessarily required. The applicant should justify the 

33 assignment of differing degrees of maintenance to individual IROFS based on the item’s 

34 contribution to risk reduction.

35

36 3. Training and Qualification—The regulations at 10 CFR Part 70, “Domestic Licensing of 

37 Special Nuclear Material,” require that all personnel who perform activities relied on for 

38 safety be trained and tested so as to provide reasonable assurance that they 

39 understand, recognize the importance of, and are qualified to perform these activities in 

40 a manner that adequately protects public health and safety and the environment. As 

41 appropriate for their authority and responsibilities, these personnel should have the 

42 knowledge and skills necessary to design, operate, and maintain the facility safely. 

43 Therefore, the application should describe the training, testing, and qualification of these 

44 personnel, and the NRC staff should review this description. The review should examine 

45 the applicant’s experience and capabilities to provide this training for its personnel who 

46 will perform activities relied on for safety. The review of the training and qualification 

47 should address the following areas:

48

49 a. organization and management of the training function
May 2014 11-3 NUREG-1520, Revision 2

1 b. analysis and identification of functional areas requiring training 

2

3 c. position training requirements

4

5 d. development of the basis for training, including objectives 

6

7 e. organization of instruction and use of lesson plans and other training guides 

8

9 f. evaluation of trainee learning

10

11 g. conduct of on-the-job training

12

13 h. evaluation of training effectiveness

14

15 i. personnel qualification

16

17 j. provisions for continuing quality assurance, including the needs for retraining or 

18 reevaluation of qualification

19

20 4. Procedures—The NRC staff review should examine the applicant’s process for the 

21 preparation, use, and management control of written procedures. This process should 

22 include the basic elements of identification, development, verification, review and 

23 comment resolution, approval, validation, issuance, change control, and periodic review. 

24

25 5. The actual operating procedures are not part of the license, and the NRC staff would not 

26 normally review them for technical adequacy since the inspection function addresses 

27 this aspect. The NRC staff should review the license application to ensure that the 

28 applicant’s process for establishing procedures adequately addresses the following 

29 areas:

30

31 a. method for identifying procedures that are needed plantwide

32

33 b. essential elements that are generic to all procedures

34

35 c. method for creating and controlling procedures within plant management control 

36 systems

37

38 d. method for verifying and validating procedures before use

39

40 e. method for periodically reverifying and revalidating procedures

41

42 f. method for ensuring that current procedures are available to personnel and those 

43 personnel are qualified to use the latest procedure

44

45 g. the commitments to audit and assessment activities

46

47 h. the use of qualified and independent audit and assessment personnel

48

49 i. the general structure of typical audits and assessments
May 2014 11-4 NUREG-1520, Revision 2

1 j. the facility procedures to be used to direct and control the audit and assessment 

2 activities

3

4 k. the planned use of the results of the audit and assessment activities

5

6 l. the documentation to record and distribute the findings and recommendations of 

7 these audits and assessments

8

9 m. the planning and implementation of corrective actions based on the findings and 

10 recommendations 

11

12 6. Incident Investigations—The NRC staff should review the applicant’s program, 

13 procedures, and management structure for investigating abnormal events and 

14 completing appropriate corrective actions. The review should include the provisions for 

15 establishing investigating teams, the methods for determining root causes, and the 

16 procedures for tracking and completing corrective actions and for documenting the 

17 process for the purpose of applying the “lessons learned” to other operations. The 

18 applicant may describe a corrective action program, which includes the functions of 

19 audits and assessment as well as incident investigations. This approach is acceptable 

20 and the reviewer should, in that case, review the applicant’s description and 

21 commitments with regard to the acceptance criteria in this SRP chapter for audits and 

22 assessments as well as incident investigations.

23

24 7. Records Management—The requirements for the management of records vary 

25 according to the nature of the facility and the hazards and risks it poses. The staff 

26 should review areas related to the handling and storage of health and safety records and 

27 the records generated or needed in the design, construction, operation, and 

28 decommissioning phases of the facility. The review should provide reasonable 

29 assurance that the records management function is adequately coordinated and 

30 integrated with other management measures. The staff should review the following:

3132

33 a. the process whereby records (i.e., training records, dosimetry records, effluents 

34 records, records of classified information, records concerning facility IROFS and 

35 their failures) are created, selected, verified, categorized, indexed, inventoried, 

36 protected, stored, maintained, distributed, deleted, or preserved 

37

38 b. the handling and control of various kinds of records (including contaminated and 

39 classified records) and the media in which the records are captured

40

41 c. the physical characteristics of the records storage area(s) with respect to the 

42 preservation and protection of the records for their designated lifetimes

43

44 8. Other Quality Assurance Elements—The application should address other QA elements 

45 that will be applied to IROFS and other management measures. The NRC staff should 

46 evaluate whether the application of other QA elements is adequately described. The 

47 staff’s review objective is to obtain reasonable assurance that the design, procurement, 

48 construction, operation, maintenance, inspection, testing, and modification phases of a 

49 facility’s life cycle implement accepted QA principles. The NRC staff should examine the 

50 applicant’s commitment to overall QA, the selection of quality criteria and quality level, 

51 and the proposed method for implementation. Application of graded QA and quality 
May 2014 11-5 NUREG-1520, Revision 2

1 levels commensurate with the risk involved should parallel the same risk levels 

2 established for maintenance and other management measures. 

3

4 The reviewer should recognize that facility safety may not be the only area at a fuel cycle 

5 facility requiring QA elements. The applicant’s customers and the NRC, under 

6 10 CFR Part 50, “Domestic Licensing of Production and Utilization Facilities,” may 

7 impose product-related QA criteria. This SRP limits the focus of the review of QA 

8 measures to ensuring the safety of workers and the public and protecting the 

9 environment (i.e., in relation to the performance requirements of 10 CFR 70.61).

10

11 Review Interfaces

12

13 Other sections of the license application may include information on CM, maintenance, training 

14 and qualification, procedures, audits and assessments, incident investigations, record 

15 management, or other QA elements applied to management measures. The NRC staff should 

16 focus its review activities on management measures associated with IROFS of high risk 

17 importance. The reviewer of this SRP chapter should coordinate with the reviewers of SRP 

18 Chapters 3 through 10 to inform the selection of management measures for more detailed 

19 review. 

20

21 11.4 Acceptance Criteria

22

23 11.4.1 Regulatory Requirements 

24

25 Acceptance criteria are based on meeting the relevant requirements of the regulations 

26 described in this section.

27

28 The regulatory basis for the review is 10 CFR 70.22, “Contents of Applications,” and 

29 10 CFR 70.65, “Additional Content of Applications.” In addition, the management measures 

30 review should provide reasonable assurance of compliance with the following regulations: 

31

32 1. 10 CFR 70.4 states that management measures include CM, maintenance, training and 

33 qualification, procedures, audits and assessments, incident investigations, records 

34 management, and other QA elements.

35

36 2. 10 CFR 70.22(a)(8) requires that each application for a license must contain proposed 

37 procedures to protect health and minimize danger to life or property. 

38

39 3. 10 CFR 70.62(a)(3) states that records must be kept for all IROFS failures, describes 

40 required data to be reported, and sets time requirements for updating the records.

41

42 4. 10 CFR 70.62(d) requires an applicant to establish management measures for 

43 engineered and administrative controls and control systems that are identified as IROFS, 

44 in accordance with 10 CFR 70.61(e), so that they are available and reliable to perform 

45 their functions when needed.

46

47 5. 10 CFR 70.64(a)(1) states that new facilities or new processes at existing facilities must 

48 develop and implement designs, in accordance with management measures, to provide 

49 reasonable assurance that IROFS will be designed, implemented, and maintained to 

50 ensure that they are available and reliable to perform their safety function when needed. 
May 2014 11-6 NUREG-1520, Revision 2

1 6. 10 CFR 70.64(a)(1) states that the licensee must maintain or control appropriate records 

2 of IROFS throughout the life of the facility. 

3

4 7. 10 CFR 70.64(a)(8) states that the design of IROFS must provide for inspection, testing, 

5 and maintenance adequate to ensure their availability and reliability to perform their 

6 function when needed. 

7

8 8. Facility change and change processes must conform to 10 CFR 70.72, “Facility Changes 

9 and Change Process.”

10

11 9. 10 CFR 70.74(a) and 10 CFR 70.74(b) require incident investigation and reporting.

12

13 11.4.2 Regulatory Guidance 

14

15 Regulatory guidance for compliance with Appendix B to 10 CFR Part 50 appears in American 

16 National Standards Institute/American Society of Mechanical Engineers (ANSI/ASME) NQA-1-

17 2008 and the NQA-1a-2009 Addenda, “Quality Assurance Requirements for Nuclear Facility 

18 Applications,” as endorsed by Regulatory Guide 1.28, “Quality Assurance Program 

19 Requirements (Design and Construction),” Revision 4, issued June 2010. This guidance 

20 applies to applications for plutonium processing and fuel fabrication facilities because these 

21 facilities are required to comply with Appendix B in order to comply with the requirements of 10 

22 CFR 70.23(b). 

23

24 11.4.3 Regulatory Acceptance Criteria 

25

26 The reviewer should find the applicant’s management measures acceptable if the applicant has 

27 met the acceptance criteria described in the following sections or has identified and justified an 

28 alternative approach. 

29

30 Applicants may propose a system of management measures that are graded commensurate 

31 with the safety significance of the IROFS to which they are applied. In proposing to reduce 

32 controls, however, certain acceptance criteria must be met: (1) the system of graded 

33 management measures must be sufficient to ensure the IROFS’ design integrity and the ability 

34 and reliability of an IROFS to successfully perform its safety function, and (2) applicants 

35 choosing to apply a graded system of management measures must describe how the proposed 

36 graded system will ensure that the performance requirements of §70.61 will be met and that 

37 public health and safety will be protected. This description should include an explanation of the 

38 process used to assign IROFS to categories based on their safety significance as well as a 

39 description of how each management measure will be graded for the defined categories. 

40

41 When considering the application of graded management measures, applicants should consider 

42 the essential elements of the process (such as assigning IROFS to categories based on their 

43 safety significance and identification of graded management measures) to be high safety44 significant activities that are not subject to grading. Consequently, applicants should note that it 

45 is necessary to consider feedback information from performance monitoring mechanisms (such 

46 as surveillances performed as part of the maintenance function) and corrective action elements 

47 that may necessitate the reinstatement of controls that had been previously relaxed. Due to the 

48 importance of the performance monitoring and corrective action elements in assuring the 

49 effectiveness of graded management measures, these activities should be treated as highly 
May 2014 11-7 NUREG-1520, Revision 2

1 safety-significant and should not be subject to graded controls. As described in this NUREG, 

2 the following management measures may be subject to grading: maintenance, training and 

3 qualification, procedures, audits and assessments, incident investigations, records 

4 management, and other QA elements. The following management measure is not amenable to 

5 grading: configuration management.

6

7 The Quality Assurance Reviewer will review the graded controls based on the categorization of 

8 IROFS using the review guidance in this SRP Chapter. The categorization process developed 

9 to enable the ranking of IROFS according to their significance will be reviewed by technical staff 

10 using the guidance in Chapter 3 of this SRP. The reviewer should coordinate with the Chapter 

11 3 reviewer as needed to evaluate the applicant’s selection of IROFS for the application of 

12 graded management measures. Criteria that should be considered include: function or end use 

13 of the IROFS; consequence of failure of the IROFS to public health and safety or worker 

14 protection; reliability of the IROFS; complexity of the design or fabrication of the IROFS; 

15 uniqueness of the item, and/or history of supply and performance.

16

17 11.4.3.1 Configuration Management

18

19 The regulation at 10 CFR 70.4 defines CM as a management measure that provides oversight 

20 and control of design information, safety information, and records of modifications that might 

21 impact the ability of IROFS to perform their functions when needed. The applicant’s description 

22 of CM is acceptable if it meets the following conditions: 

23

24 1. The application describes the CM program, design requirements, document control, 

25 change control, assessments, and design reconstitution (for existing facilities only). 

26

27 2. The application describes the CM program and defines the specific attributes of CM that 

28 will be applied to select IROFS.

29

30 3. The ISA summary clearly defines the IROFS to be listed under CM along with the 

31 assignment of any grades or quality levels. The applicant should indicate in the ISA 

32 summary the CM attributes that will be applied to a particular IROFS. However, in the 

33 ISA summary, this indication may consist of only an index or category designation. 

34

35 4. The application describes a design process leading to drawings and other statements of 

36 requirements that proceeds logically from the design basis. 

37

38 5. The application describes how design requirements and associated design bases are 

39 established and are maintained through control of the design process. It also describes 

40 technical management review and approval functions. 

41

42 6. The application describes an acceptable method to create and control documents that 

43 are relied on for safety. These documents include design requirements, ISAs, as-built 

44 drawings, specifications, all procedures that are IROFS, procedures involving training, 

45 QA, maintenance, audits and assessments, emergency operating procedures, 

46 emergency response plans, system modification documents, assessment reports, and 

47 others that the applicant deems part of CM. 

48

49 7. The application describes how the CM function will maintain strict consistency among 

50 the design requirements, the physical configuration, and the facility documentation. 
May 2014 11-8 NUREG-1520, Revision 2

1 8. The application contains a commitment to evaluate, implement, and track each change 

2 to the site, structures, processes, systems, equipment, components, computer 

3 programs, and activities of personnel. 

4

5 9. The application describes an acceptable process for providing reasonable assurance 

6 that the ISA is systematically reviewed and modified to reflect design or operational 

7 changes from an established safety basis and that all documents outside the ISA that 

8 are affected by safety-basis changes are properly modified, authoritatively approved, 

9 and made available to personnel. 

10

11 10. The application describes the documentation process following changes made in 

12 accordance with 10 CFR 70.72. Changes to the affected onsite documentation should 

13 be made promptly to avoid inadvertent access by facility personnel to outdated design 

14 and other specifications for IROFS.

15

16 11. The application confirms that initial and periodic assessments of the CM function are 

17 conducted to determine the program’s effectiveness and to correct deficiencies. The 

18 application indicates that such assessments are systematically planned and conducted 

19 in accordance with an overall facility audit and assessment function.

20

21 12. For existing facilities, the application may describe whatever design reconstitution has 

22 been done for the purpose of the application. The applicant has available the current 

23 design bases, including design requirements, supporting analyses, and documentation 

24 supporting all IROFS. 

25

26 13. For new facilities or new processes at existing facilities, the application describes facility 

27 and system design and facility layout based on defense-in-depth practices, in 

28 accordance with 10 CFR 70.64, “Requirements for New Facilities or New Processes at 

29 Existing Facilities.” Defense-in-depth practices should be applied early through the 

30 completion of design by providing successive levels of protection such that health and 

31 safety will not wholly depend on any single element of the design, construction, 

32 maintenance, or operation of the facility.

33

34 The process of evaluating facility changes through the configuration management program is 

35 important to ensure the availability and reliability of IROFS, all of which must be described in 

36 the ISA summary pursuant to 10 CFR 70.65(b)(6). Therefore, it is expected that elements of 

37 configuration management will be applied in a consistent manner to all IROFS regardless of 

38 their safety significance. 

39

40 11.4.3.2 Maintenance

41

42 As required by 10 CFR 70.62(d), engineered and administrative controls that are identified as 

43 IROFS must be designed, implemented, and maintained to ensure that they are available and 

44 reliable when needed.

45

46 The regulation at 10 CFR 70.64(a)(8) requires that IROFS for new facilities or new processes at 

47 existing facilities receive adequate inspection, testing, and maintenance to ensure their 

48 availability and reliability when needed. 
May 2014 11-9 NUREG-1520, Revision 2

1 A. The reviewers should find the applicant’s submittal acceptable if the application includes 

2 the following information:

3

4 1. descriptions of corrective maintenance, PM, surveillance and monitoring, and 

5 functional testing 

6

7 2. description of how the maintenance function will be designed to ensure that the 

8 objective of preventing failures through maintenance is appropriately balanced

9 against the objective of minimizing unavailability of IROFS because of monitoring 

10 or PM

11

12 3. discussion of how the maintenance function uses, interfaces with, or is linked to 

13 the various management measures

14

15 4. justifications for assignment of differing degrees of maintenance to individual 

16 IROFS, based on the item’s contribution to the reduction of risk

17

18 5. for IROFS identified in the ISA summary, description of the surveillance function 

19 and its conduct at a specified frequency

20

21 6. description of how the surveillance activity supports the determination of 

22 performance trends for IROFS, thus providing data useful in determining PM 

23 frequencies 

24

25 7. description of the applicant’s retention of records of the current surveillance 

26 schedule, performance criteria, and test results for all IROFS

27

28 8. for surveillance tests that can be done only while IROFS are out of service, 

29 description of the proper compensatory measures that will be prescribed for the 

30 continued normal operation of a process

31

32 9. description of how the results of incident investigations, the review of failure 

33 records required by 10 CFR 70.62(a)(3), and identified root causes are used to 

34 modify the affected maintenance function and eliminate or minimize the root 

35 cause 

36

37 10. documentation of the approach to performing corrective actions or repairs on 

38 IROFS 

39

40 11. description of how the maintenance function provides a planned, systematic, 

41 integrated, and controlled approach for the repair and replacement activities 

42 associated with identified unacceptable performance deficiencies of IROFS

43

44 12. description of the PM function that demonstrates a commitment to conducting 

45 preplanned and scheduled periodic refurbishing, or partial or complete overhaul, 

46 of IROFS to minimize occurrences of their unanticipated losses

47

48 13. description of the applicant’s retention of records showing the PM schedule and 

49 results for all IROFS subject to this maintenance component 
May 2014 11-10 NUREG-1520, Revision 2

1 14. general description of the methods used and the commitment to perform 

2 functional testing, as needed, of IROFS after PM or corrective maintenance

3

4 15. as necessary, a commitment to conduct functional tests designed to include all 

5 operational aspects of the IROFS that are important to safety during startup of 

6 new processes

7

8 16. description of how the applicant will maintain records showing the functional test 

9 schedule and results for all IROFS subject to this maintenance component 

10

11 17. general discussion of how the applicant will verify that the administrative controls 

12 identified as IROFS are available and reliable to perform their intended safety 

13 function over extended periods of operation

14

15 B. Applicants choosing to apply a graded system of management measures for 

16 maintenance activities must describe elements of maintenance that will be applied in a 

17 graded manner to IROFS based on their safety significance. 

18

19 Grading of maintenance activities may include elements such as the following:

20

21 1. Reduced frequency for surveillance and monitoring activities used to ensure the 

22 continued integrity and functionality of the IROFS;

23

24 2. Implementation of preventative maintenance activities commensurate with the 

25 reliability of the item (lower importance of the item to safety and lower 

26 susceptibility of the item to failure allows reduced frequency or rigor for PM); and

27

28 3. Extended calibration intervals (not to exceed manufacturer recommendations or 

29 accepted industry standards or practice).

30

31 11.4.3.3 Training and Qualification

32

33 The application should be acceptable regarding personnel training and qualification if it satisfies 

34 the criteria described below. In addition to the regulatory acceptance criteria, the SRP provides 

35 additional specific criteria for (1) training and qualification for radiation safety personnel in 

36 Section 4.4.5, (2) criticality safety in Section 5.4.3.2, and (3) emergency planning in 

37 Section 8.4.3.1.11. Similarly, some of the information specified below may appear in other 

38 sections of the application and may be incorporated by reference. 

39

40 A. Review criteria include the following:

41

42 1. The application should include the following commitments regarding organization 

43 and management of training:

4445

46 a. Line management is responsible for the content and effective conduct of 

47 the training. 

48

49 b. The application clearly defines job function, responsibility, authority, and 

50 accountability of personnel involved in managing, supervising, and 

51 implementing training.
May 2014 11-11 NUREG-1520, Revision 2

1 c. The applicant uses performance-based training as the primary 

2 management tool for analyzing, designing, developing, conducting, and 

3 evaluating training. 

4

5 d. The applicant documents and implements procedures to provide 

6 reasonable assurance that all phases of training are conducted reliably 

7 and consistently. 

8

9 e. The applicant ensures that training documents are linked to the CM 

10 system to provide reasonable assurance that the training reflects design 

11 changes and modifications.

12

13 f. The applicant grants exemptions from training to trainees and incumbents 

14 only when justified, documented, and approved by management.

15

16 g. The applicant maintains both programmatic and individual training 

17 records. These records support management information needs and 

18 provide required data on each individual’s training and qualification.

19

20 2. The applicant should provide formal training for each position or activity that is 

21 relied on for safety. Training may be classroom or on-the-job training or both. 

22 The application should state what training will be conducted and which personnel 

23 will be required to complete it. The application should also demonstrate the 

24 following: 

25

26 a. The applicant ensures that each activity selected for training (initial or 

27 continuing) from the facility-specific activities is correlated with supporting 

28 procedures and training materials. 

29

30 b. The applicant reviews facility-specific activities selected for training and 

31 compares training materials on an established schedule, updating them 

32 as necessitated by changes in procedures, facility systems and 

33 equipment, or job scope. The applicant monitors and evaluates change 

34 actions (e.g., procedure changes, equipment changes, facility 

35 modifications) for their impact on the development or modification of initial 

36 and continuing training and incorporates such change actions in a timely 

37 manner. 

38

39 3. The application should contain commitments regarding personnel qualification for 

40 managers, supervisors, designers, technical staff, construction personnel, facility 

41 operators, technicians, maintenance personnel, and other staff who perform 

42 regulated activities. 

43

44 4. The application should contain commitments regarding minimum qualifications 

45 for personnel. Minimum qualifications should be commensurate with the 

46 assigned functional responsibility and authority of the respective personnel as 

47 detailed below: 
May 2014 11-12 NUREG-1520, Revision 2

1 a. Managers should have a bachelor of science (B.S.), bachelor of art 

2 (B.A.), or equivalent degree. Each manager should have either 

3 management or technical experience in a facility similar to the facility 

4 identified in the application.

5

6 b. Supervisors should have at least the qualifications required of personnel 

7 being supervised.

8

9 c. Technical professional staff whose actions or judgments are critical to 

10 satisfying the performance requirements identified in 10 CFR Part 70 

11 should have a B.S., B.A., or equivalent degree in the appropriate 

12 technical field.

13

14 d. Construction personnel, facility operators, technicians, maintenance 

15 personnel, and other staff whose actions are required to comply with NRC 

16 regulations should have completed the applicant’s training process or 

17 have equivalent experience or training.

18

19 e. The applicant should require candidates for process operators to meet 

20 the minimum qualifications described in the application. The applicant 

21 should require candidates for job functions other than process operators 

22 to meet minimum qualifications, but the application need not describe 

23 these minimum qualifications.

24

25 5. Training objectives should state the knowledge, skills, and abilities that the 

26 trainee should acquire; the conditions under which required actions will take 

27 place; and the standards of performance the trainee should achieve upon 

28 completion of the training activity.

29

30 6. Lesson plans and other training guides should provide guidance to ensure the 

31 consistent conduct of training activities and should be based on required learning 

32 objectives derived from specific job performance requirements. 

33

34 7. The applicant should use lesson plans or guides for all training, and these lesson 

35 plans or guides should include standards for evaluating acceptable trainee 

36 performance. The evaluation of trainee accomplishment is acceptable if the 

37 applicant evaluates trainees periodically during training to determine their 

38 progress toward full capability to perform the job requirements and at the 

39 completion of training to determine their capability to perform the job 

40 requirements. 

41

42 8. The applicant should establish review and approval requirements for all lesson 

43 plans or guides and other training materials before their issue and use. 

44

45 9. The application should describe any on-the-job training used for activities relied 

46 on for safety. 

47

48 10. The applicant should conduct on-the-job training using well-organized and 

49 current training materials. Designated personnel who are competent in the 

50 program standards and training methods should conduct the training. 
May 2014 11-13 NUREG-1520, Revision 2

1 11. Completion of on-the-job training should be by actual task performance. When 

2 the actual task cannot be performed and is, therefore, “walked down,” the 

3 conditions of task performance, references, tools, and equipment should reflect 

4 the actual task to the extent possible.

5

6 12. Provisions for continuing assurance of personnel training and qualification are 

7 acceptable if the application addresses periodic requalification of personnel by 

8 training or testing or both, as necessary, to provide reasonable assurance that 

9 personnel continue to understand, recognize the importance of, and be qualified 

10 to perform activities that are relied on for safety.

11

12 13. An evaluation of training effectiveness and its relation to job performance is 

13 acceptable if it provides reasonable assurance that the training conveys all 

14 required skills and knowledge and is used to revise the training, where 

15 necessary, based on the performance of trained personnel in the job setting. 

16 The application should also demonstrate the following:

17

18 a. Qualified individuals should periodically conduct a comprehensive 

19 evaluation of individual training to identify strengths and weaknesses. 

20 The applicant should use feedback from trainee performance during 

21 training and from former trainees and their supervisors to evaluate and 

22 refine the training. 

23 b. The applicant should initiate, evaluate, track, and incorporate 

24 improvements and changes to initial and continuing training to correct 

25 training deficiencies and performance problems.

26

27 B. Applicants choosing to apply a graded system of management measures for training and 

28 qualification activities must describe the elements of training and qualification that will be 

29 applied in a graded manner to IROFS based on their safety significance. 

30

31 Grading of training and qualification activities may include elements such as the 

32 following:

33

34 1. Qualifications for personnel performing activities associated with graded IROFS 

35 may be subject to a different set of minimum training, education, and/or 

36 qualification requirements compared to personnel performing activities 

37 associated with IROFS determined to be of high significance.

38

39 Graded training and qualification requirements should be designated commensurate with 

40 the functional responsibility and authority assigned to personnel and the importance of 

41 the skill or activity to safety. Training and qualification activities, even when applied in a 

42 graded manner, should be documented; performed in accordance with procedures, 

43 lesson plans, and/or written guidance; assessed periodically to determine continued 

44 effectiveness; and should include measures for evaluating trainee performance.
May 2014 11-14 NUREG-1520, Revision 2

1 11.4.3.4 Procedures 

2

3 The regulation at 10 CFR 70.22(a)(8) requires that the application contain procedures to protect 

4 public health and safety. The application is acceptable in this regard if it describes the 

5 applicant’s process for developing and implementing procedures and satisfies the following:

6

7 1. The applicant provides information regarding the procedure categories used at the 

8 facility. The categories typically include management control, operating, maintenance, 

9 and emergency procedures.

1011

12 2. The applicant writes or plans procedures for the operation of IROFS and for all 

13 management measures supporting those IROFS. 

14

15 3. The applicant includes the following commitment regarding procedure adherence: 

16 “Activities involving licensed SNM and/or IROFS will be conducted in accordance with 

17 approved procedures.”

18

19 4. The applicant develops procedures for sitewide safe work practices to control processes 

20 and operations with licensed special nuclear material (SNM) and/or IROFS and/or 

21 hazardous chemicals incident to the processing of licensed material.

22

23 5. The applicant has existing or planned procedures to direct the following activities: 

24 (1) design, (2) CM, (3) procurement, (4) construction, (5) radiation safety, 

25 (6) maintenance, (7) QA elements, (8) training and qualification, (9) audits and 

26 assessments, (10) incident investigations, (11) records management, (12) criticality 

27 safety, (13) fire safety, (14) chemical process safety, and (15) reporting requirements.

28

29 6. Procedures are required for operator actions that are necessary to prevent or mitigate 

30 accidents identified in the ISA summary. The applicant provides a listing of the types of 

31 activities that are covered, or are planned to be covered, by written procedures. The 

32 listing includes the topics of administrative procedures; system procedures that address 

33 startup, operation, and shutdown; abnormal operation or alarm response; maintenance 

34 activities that address system repair, calibration, inspection, and testing; and emergency 

35 procedures. Appendix A to this SRP chapter provides an acceptable listing of the items 

36 to be included under each topic.

37

38 7. The applicant describes the method for identifying, developing, approving, implementing, 

39 and controlling operating procedures as follows: 

40

41 a. The applicant considers the ISA in identifying needed procedures. 

42

43 b. The procedure specifies operating limits and IROFS. 

44

45 c. Procedures include required actions for off-normal conditions of operation, as 

46 well as normal operations.

47

48 d. If needed, procedures identify safety checkpoints, as appropriate.

49

50 e. The applicant uses field tests to validate procedures.
May 2014 11-15 NUREG-1520, Revision 2

1 f. The management personnel who are responsible and accountable for the 

2 operation approve the procedures.

3

4 g. The applicant specifies a mechanism for revising and reissuing procedures in a 

5 controlled manner.

6

7 h. QA elements and CM functions at the facility provide reasonable assurance that 

8 current procedures are available and used at all work locations.

9

10 i. The training program instructs the required personnel in the use of the latest 

11 procedures.

12

13 8. Procedures should incorporate the following elements:

14

15 a. title and identifying information, such as number, revision, and date

16

17 b. statement of applicability and purpose

18

19 c. prerequisites

20

21 d. precautions (including warnings, cautions, and notes)

22

23 e. important human actions

24

25 f. limitations and actions

26

27 g. acceptance criteria

28

29 h. checkoff lists

30

31 i. reference material

32

33 9. Maintenance procedures involving IROFS commit to the topics listed below for corrective 

34 and preventive maintenance and functional testing after maintenance and surveillance 

35 activities:

3637

38 a. Premaintenance activities involve reviews of the work to be performed, including 

39 procedure reviews for accuracy and completeness.

40

41 b. Steps require notification of all affected parties (operators and supervisors) 

42 before performance of work and on completion of maintenance work. The 

43 discussion includes potential degradation of IROFS during the planned 

44 maintenance.

45

46 c. Control of work is ensured by comprehensive procedures to be followed by 

47 maintenance technicians. The various safety disciplines, including criticality, fire, 

48 radiation, industrial, and chemical process safety, review maintenance 

49 procedures. The procedures describe the following:

50
May 2014 11-16 NUREG-1520, Revision 2

1 i. qualifications of personnel authorized to perform the maintenance 

2 or surveillance

3

4 ii. controls on and specification of any replacement components or materials 

5 to be used (should be controlled by the CM function to ensure like-kind 

6 replacement and adherence to 10 CFR Part 21, “Reporting of Defects 

7 and Noncompliance”)

8

9 iii. postmaintenance testing to verify operability of the equipment

10

11 iv. tracking and records management of maintenance activities

12

13 v. safe work practices (e.g., moderation control or exclusion area; radiation 

14 or hot work permits; and criticality, fire, chemical, and environmental 

15 issues)

16

17 10. The applicant has formal requirements governing the use of temporary procedures. 

18 Temporary procedures may be issued only when permanent procedures do not exist to 

19 (1) direct operations during testing, maintenance, and modifications, (2) provide 

20 guidance in unusual situations not within the scope of permanent procedures, and 

21 (3) provide assurance of orderly and uniform operations for short periods when the 

22 facility, system, or component is performing in a manner not covered by permanent 

23 procedures. The discussion establishes a timeframe for use of the temporary procedure 

24 and sets the same level of review and approval as for permanent procedures. 

25

26 11. The applicant verifies that the procedures are technically accurate and can be performed 

27 as written. The applicant periodically reviews the procedures to ensure their continued 

28 accuracy and usefulness and establishes the timeframe for reviews of the various types 

29 of procedures. 

30

31 12. The applicant describes the use and control of procedures. Provisions allow for 

32 operations to stop and place the process in a safe condition if a step of a procedure 

33 cannot be performed as written. 

34

35 13. The applicant reviews procedures after unusual incidents, such as an accident, 

36 unexpected transient, significant operator error, or equipment malfunction, or after any 

37 modification to a system and revises procedures as needed.

38

39 14. The applicant need not control program and administrative procedures and other 

40 nonoperational procedures that do not impact IROFS or other environmental, safety, and 

41 health concerns with the stringency applied to operating procedures or management 

42 control procedures associated with IROFS specified by the ISA summary. The applicant 

43 should specify the applicability of less stringent procedure control to avoid 

44 misunderstandings in implementation.

45

46 Applicants choosing to apply a graded system of management measures for activities 

47 associated with the development, implementation, and maintenance of procedures must 

48 describe the elements of procedure-related activities that will be applied in a graded manner to 

49 IROFS based on their safety significance. Because activities involving licensed SNM and/or 

50 IROFS must be conducted in accordance with approved procedures, no detailed guidance is 
May 2014 11-17 NUREG-1520, Revision 2

1 provided on grading procedures. Procedures and written guidance should be sufficiently 

2 detailed in nature to describe expectations for the conduct of activities associated with IROFS to 

3 ensure their availability and reliability. Such procedures should be subject to a review and 

4 approval process and periodic reviews to ensure their continued effectiveness and suitability for 

5 the activities to which they apply.

6

7 11.4.3.5 Audits and Assessments

8

9 A. The NRC reviewers should find the application acceptable in terms of audits and 

10 assessments if it provides reasonable assurance that the following are adequately 

11 addressed and satisfied:

12

13 1. The application describes program directives covering the audit and assessment 

14 function (i.e., the activities to be audited, audit frequency, guidance in conducting 

15 the audit or assessment, assigned responsibilities for each phase of the work, 

16 and procedures for recording the results and recommending actions to be taken).

1718

19 2. The application contains a commitment to conduct internal audits and 

20 independent assessments of activities significant to facility safety and 

21 environmental protection.

22

23 3. The application states that audits will be performed to verify that operations are 

24 being conducted in accordance with regulatory requirements and license 

25 commitments.

26

27 4. The application states that independent assessments will be conducted by offsite 

28 groups or individuals not involved in the licensed activity to verify that the health, 

29 safety, and environmental compliance functions are effectively achieving their 

30 designed purposes.

31

32 5. The application states that audits and assessments will be conducted for the 

33 areas of radiation safety, nuclear criticality safety, chemical safety, fire safety, 

34 environmental protection, emergency management, QA, CM, maintenance, 

35 training and qualification, procedures, incident investigation, and records 

36 management.

37

38 6. The application states that qualified personnel without direct responsibility for the 

39 function and area being audited or assessed will perform the audits and 

40 assessments. The application specifies the staff positions and committees 

41 responsible for audits and assessments and describes the levels of management 

42 to which results are reported. The systems to provide corrective actions are also 

43 described.

44

45 B. Applicants choosing to apply a graded system of management measures for audit and 

46 assessment activities must describe the elements of audits and assessments that will be 

47 applied in a graded manner to IROFS based on their safety significance. 

48

49 Grading of audits and assessments may include elements such as the following:

50

51 1. Reduced audit and assessment frequency for graded IROFS; and
May 2014 11-18 NUREG-1520, Revision 2

1 2. Performance of assessment activities associated with graded IROFS by 

2 personnel knowledgeable of the trade or skill involved in conduct of the activity in 

3 lieu of personnel with specific training in the conduct of assessments.

4

5 11.4.3.6 Incident Investigations 

6

7 The applicant’s description of its incident investigations activities and commitments in the 

8 application will be acceptable if the reviewer finds reasonable assurance of the following:

9

10 1. The applicant will establish a formal procedure to investigate abnormal events that may 

11 occur during operation of the facility to determine their specific or generic root cause(s), 

12 generic implications, and risk significance; to recommend corrective actions; and to 

13 report to the NRC as required by 10 CFR 70.50, “Reporting Requirements,” and 

14 10 CFR 70.74, “Additional Reporting Requirements.” Appendix B to this SRP chapter 

15 presents guidance regarding the contents of an incident investigation program or 

16 procedure.

17

18 2. The applicant will monitor and document corrective actions through completion and 

19 ensure that corrective actions are taken within a reasonable period to resolve findings 

20 from abnormal event investigations.

21

22 3. The applicant will maintain documentation related to abnormal events for the life of the 

23 operation so that “lessons learned” may be applied to future operations of the facility. 

24 Details of the event sequence will be compared with accident sequences already 

25 considered in the ISA, and the ISA summary will be modified to include evaluation of the 

26 risk associated with accidents of the type actually experienced.

27

28 Applicants choosing to apply a graded system of management measures for incident 

29 investigation activities must describe the elements of incident investigations that will be applied 

30 in a graded manner to IROFS based on their safety significance. Because it is important to 

31 investigate abnormal events occurring at a licensed facility to ensure that reporting requirements 

32 are met and public health and safety is ensured, no detailed guidance is provided on grading 

33 incident investigation activities. Rather, the management measures program should take into 

34 account risk significance of an incident as part of the investigation process, thereby providing a 

35 means of grading the incident investigation process in relation to the IROFS significance.

36

37 11.4.3.7 Records Management

38

39 The reviewer will find the applicant’s records management system acceptable if the application 

40 describes the following criteria:

41

42 1. The applicant prepares, verifies, characterizes, and maintains records. 

43

44 2. The applicant ensures that records are legible, identifiable, and retrievable for their 

45 designated lifetimes. 

46

47 3. The applicant categorizes records by relative safety importance to identify record 

48 protection and storage needs and to designate the retention period for individual kinds of 

49 records. 
May 2014 11-19 NUREG-1520, Revision 2

1 4. The applicant protects records against tampering, theft, loss, unauthorized access, 

2 damage, or deterioration while in storage. 

3

4 5. The applicant establishes and documents procedures specifying the requirements and 

5 responsibilities for record selection, verification, protection, transmittal, distribution, 

6 retention, maintenance, and disposition.

7

8 6. The applicant implements procedures that (1) assign responsibilities for records 

9 management, (2) specify the authority needed for records retention or disposal, 

10 (3) specify which records must have controlled access and provide the controls needed, 

11 (4) provide for the protection of records from loss, damage, tampering, and theft or 

12 during an emergency, and (5) specify procedures for ensuring that the records 

13 management system remains effective.

14

15 7. The applicant puts procedures in place to promptly detect and correct any deficiencies in 

16 the records management system or its implementation. 

17

18 8. The applicant must maintain and update records of IROFS failures in accordance with 

19 10 CFR 70.62(a)(3). The applicant must make record revisions necessitated by 

20 postfailure investigation conclusions promptly after completion of the investigation. 

21

22 9. For computer codes and computerized data used for activities relied on for safety, as 

23 specified in the ISA summary, the applicant establishes procedure(s) for maintaining 

24 readability and usability of older codes and data as computing technology changes. The 

25 procedures could include transfer of the older forms of information and codes for older

26 computing equipment to contemporary computing media and equipment. 

27

28 Appendix C to this SRP chapter lists the types of records that the system should include. 

29

30 Applicants choosing to apply a graded system of management measures for records 

31 management activities must describe the elements of records management will be applied in a 

32 graded manner to IROFS based on their safety significance. It is expected that records 

33 management functions will be applied to all IROFS regardless of their safety significance. 

34 Further, the preparation, issuance, and modification of quality-affecting documents must be 

35 performed in accordance with a controlled system for all IROFS. However, certain aspects of 

36 recordkeeping may be subject to grading for IROFS of low safety significance. For example, 

37 unless required by other regulation, record retention times may be lower for IROFS of lower 

38 safety significance. Similarly, design and procurement records may be less detailed for IROFS 

39 with less complex designs and low safety significance. 

40

41 In all cases, measures for the designation, protection, storage, maintenance, and retention of 

42 records should be applied to IROFS in a manner appropriate to ensure the capability to (1) 

43 maintain plant design and configuration control, and (2) evaluate failures, perform root cause 

44 analyses, and determine appropriate corrective actions.
May 2014 11-20 NUREG-1520, Revision 2

1 11.4.3.8 Other Quality Assurance Elements

2

3 To be acceptable, the applicant’s QA elements should be structured to apply appropriate 

4 measures to IROFS. The NRC staff expects applicant and licensee QA elements to differ 

5 based on the purpose and complexity of the facility and processes.

6

7 A. Other QA may include some or all of the following elements:

8

9 1. Organization—The applicant may describe the organizational structure, 

10 functional responsibilities, lines of authority, and lines of communication for 

11 control of activities affecting quality. The organization responsible for ensuring 

12 that appropriate QA has been established should have sufficient authority, 

13 access to work areas, and organizational independence to perform its 

14 responsibilities. 

15

16 2. QA Program—The applicant may describe its application of QA elements in the 

17 form of a QA program, in which the applicant commits to meet the relevant 

18 requirements of applicable standards. The commitment may describe the 

19 applicant’s graded approach to QA, in which measures are implemented 

20 commensurate with an item’s importance to safety, or the commitment may 

21 describe a QA program applied to all IROFS. The applicant should fully 

22 document, plan, implement, and maintain QA elements to provide reasonable 

23 assurance that, together with other management measures, IROFS will be 

24 available and reliable when needed. 

25

26 3. Design Control—The applicant should define, control, and verify its design 

27 controls. The applicant should specify and correctly translate design inputs to 

28 design documents. Controlled measures, commensurate with those applied to 

29 the original design, should govern the adequacy of design and design changes. 

30 (See Sections 11.3, 11.4.3.1, 11.5.1, and 11.6.1 of this SRP for details on CM.) 

31

32 4. Procurement Document Control—Documents associated with the procurement of 

33 items and services include or reference the applicable 10 CFR Part 21 

34 (“Reporting of Defects and Noncompliance”) reporting requirements, and other 

35 technical, regulatory, and administrative requirements, (such as specifications, 

36 codes, standards, tests, inspections, and special processes) necessary to ensure 

37 adequate quality. Procurement documents identify requirements applicable to 

38 suppliers of items and services relied on for safety, such as QA program 

39 requirements. 

40

41 5. Instructions, Procedures, and Drawings—The applicant should ensure that 

42 activities affecting the quality of IROFS are prescribed by and performed in 

43 accordance with documented instructions, procedures, or drawings appropriate 

44 for the circumstances and reference appropriate quantitative or qualitative 

45 acceptance criteria. (See Sections 11.3, 11.4.3.4, 11.5.4, and 11.6.4 of this SRP 

46 for details on procedures.)

47

48 6. Document Control—The applicant’s document control system describes the 

49 preparation, issuance, and modification of documents that specify quality 

50 requirements or prescribe activities affecting quality. The document control 
May 2014 11-21 NUREG-1520, Revision 2

1 system is controlled in a manner that ensures that authorized personnel review 

2 documents and changes thereto for adequacy and approve them for release. 

3 (See Sections 11.3, 11.4.3.1, 11.5.1, and 11.6.1 of this SRP for details on CM 

4 and Sections 11.3, 11.4.3.4, 11.5.4, and 11.6.4 for details on procedures.)

5

6 7. Control of Purchased Material, Equipment, and Services—The applicant may 

7 describe controls for the procurement of items and services. Descriptive controls 

8 of purchased items and services include, as appropriate, source evaluation and 

9 selection, source inspection, audit, the examination of items or services upon 

10 delivery or completion, mechanisms for control of changes in items or services, 

11 commercial-grade item requirements, and control of supplier nonconformance.

12

13 8. Identification and Control of Items—The applicant establishes controls to ensure 

14 that only the correct items are used or installed. The applicant may describe 

15 provisions to identify and maintain traceability of items.

16

17 9. Control of Special Processes—The applicant establishes controls of processes 

18 affecting the safety of IROFS or related services. Qualified personnel using 

19 qualified procedures in accordance with specified requirements perform special 

20 processes that control activities, such as welding, heat treating, and 

21 nondestructive examination. 

22

23 10. Inspection—When inspections are used to verify conformance of an IROFS item 

24 or activity, the applicant should specify the characteristics to be inspected and 

25 the inspection methods to be used and plan and execute the inspection. The 

26 applicant should then document the inspection results. Qualified personnel other 

27 than those who performed or directly supervised the work being inspected should 

28 perform the inspections. (See Sections 11.3, 11.4.3.4, 11.5.4, and 11.6.4 of this 

29 SRP for details on procedures and Sections 11.3, 11.4.3.3, 11.5.3, and 11.6.3 for 

30 details on training and qualification.)

31

32 11. Test Control—The applicant should conduct tests performed to verify 

33 conformance of an IROFS or computer program to specified requirements and 

34 demonstrate availability and reliability of performance. The applicant should 

35 specify the characteristics to be tested and test methods to be used. Test results 

36 should be documented and evaluated against the test requirements and 

37 acceptance criteria. (See Sections 11.3.1, 11.4.3.4, 11.5.4, and 11.6.4 of this 

38 SRP for details on procedures and Sections 11.3, 11.4.3.3, 11.5.3, and 11.6.3 for 

39 details on training and qualification.)

40

41 12. Control of Measuring and Test Equipment—The applicant should establish 

42 controls for tools, gauges, instruments, and other measuring and test equipment 

43 used for IROFS and activities affecting IROFS. Controls of measuring and test 

44 equipment should consider methods and frequency of calibration, and the 

45 applicant should adjust such controls to maintain accuracy within specified limits.

46

47 13. Handling, Storage, and Shipping—The applicant should consider methods to 

48 ensure that handling, storage, cleaning, packaging, shipping, and preservation of 

49 IROFS are controlled to prevent damage or loss and to minimize deterioration. 

50
May 2014 11-22 NUREG-1520, Revision 2

1 14. Inspection, Test, and Operating Status—The applicant should identify the status 

2 of inspection and test activities for IROFS, either in the item or in documents 

3 traceable to IROFS. The applicant should specify the use of status-indicating 

4 devices such as tags, markings, shop travelers, stamps, and inspection records. 

5 The applicant should establish provisions to ensure that required inspections and 

6 tests are performed and ensure that items that have not passed the required 

7 inspections and tests are not inadvertently installed, used, or operated. 

8

9 15. Control of Nonconforming Items—The applicant should describe provisions that 

10 specify when IROFS do not conform to specified requirements. The applicant 

11 should control items that do not conform to prevent inadvertent installation or use 

12 of nonconforming material, parts, equipment, or services. The applicant should 

13 specify provisions for identification, documentation, evaluation, segregation, and 

14 disposition of nonconforming IROFS and for appropriate notification to affected 

15 organizations.

16

17 16. Corrective Action—The applicant should specify provisions for promptly 

18 identifying conditions adverse to quality and correcting them as soon as 

19 practicable. (See Sections 11.3, 11.4.3.5, 11.5.5, and 11.6.5 of this SRP for 

20 details on audits and assessments and Sections 11.3, 11.4.3.6, 11.5.6, and 

21 11.6.6 for details incident investigations.) 

22

23 17. Quality Assurance Records—QA records and records management systems may 

24 be used in lieu of or in conjunction with each other. In either case, the applicant 

25 should describe the methods used to document, prepare, maintain, and manage 

26 records. The applicant should describe the methods used to protect records 

27 against damage, deterioration, or loss. In addition, the applicant should establish 

28 and document the requirements and responsibilities for record transmittal, 

29 distribution, retention, maintenance, and disposition. (See Sections 11.3, 

30 11.4.3.7, 11.5.7, and 11.6.7 of this SRP for details on records management.)

31

32 18. Audits—The applicant should plan and schedule audits and assessments to 

33 verify compliance with, and to determine the effectiveness of, its QA elements. 

34 The applicant should identify responsibilities and procedures for assessing, 

35 auditing, documenting, and reviewing results. (See Sections 11.3, 11.4.3.5, 

36 11.5.5, and 11.6.5 of this SRP for details on audits and assessments.)

37

38 Pursuant to 10 CFR 70.65(b)(6), the ISA summary must briefly describe each IROFS in 

39 sufficient detail to understand its functions relative to the 10 CFR 70.61 performance 

40 requirements. In this regard, the ISA summary should identify the IROFS, the degree of their 

41 importance to safety, and related activities that are required for safety. An applicant may 

42 choose to apply all QA elements at the highest level to all IROFS or may grade the application 

43 in proportion to the item’s importance to the achievement of safety. The application should 

44 describe quality assurance elements that will be applied in a graded manner to IROFS based on 

45 their safety significance. 

46

47 B. Grading of other quality assurance elements for IROFS determined to be of lower 

48 significance may include features such as the following:

49
May 2014 11-23 NUREG-1520, Revision 2

1 1. QA Program – An applicant’s description of their QA program may describe a 

2 program in which quality assurance elements and management measures are 

3 applied to IROFS in a manner commensurate with the IROFS’ safety 

4 significance.

5

6 2. Control of Purchased Material, Equipment, and Services – For IROFS of lower 

7 safety significance, procurement-related activities such as auditing, qualifying 

8 suppliers, and receipt inspection may be graded as appropriate. Within this area, 

9 compliance with 10 CFR Part 21 is mandatory for items designated as basic 

10 components and not subject to grading; however, certain activities performed in 

11 relation to procurement and commercial grade dedication may be graded. This 

12 would exclude the designation of critical characteristics but may include grading 

13 of verification activities (e.g., by use of reduced sampling plans or alternative 

14 testing techniques). If grading is applied to procurement activities, licensees 

15 should be vigilant in ensuring that they adequately evaluate the ability of graded 

16 controls to ensure the availability and reliability of IROFS, the quality of procured 

17 services affecting quality, and the extent to which items and activities are 

18 credited in preventing common cause failures. 

19

20 3. Inspection— When inspections are used to verify conformance of an IROFS item 

21 or activity, the applicant may apply graded controls for IROFS of lower safety 

22 significance. Graded application of inspection activities may include reduced 

23 frequency or scope of inspections paired, as appropriate, with use of monitoring 

24 or surveillance to demonstrate IROFS availability and reliability, and use of peer 

25 inspectors. It is noted that, although the use of peer inspectors may be 

26 acceptable for lower safety significant IROFS, the inspectors must still be 

27 qualified to perform inspections and be independent of the work activity being 

28 inspected. Additionally, periodic oversight of peer inspectors is necessary in 

29 order to ensure their capability to perform inspection activities to the appropriate 

30 skill level. Documented guidance should specify the characteristics to be 

31 inspected and the inspection methods to be used. The results of any inspections 

32 performed to verify conformance or acceptability of IROFS must be documented.

33

34 4. Corrective Action— Corrective actions may be applied to IROFS in a graded 

35 manner and prioritized commensurate with the safety significance of the IROFS 

36 and the adverse condition. The applicant’s corrective action program or process 

37 should result in the prompt identification of conditions adverse to quality, 

38 regardless of the IROFS significance. The correction of adverse conditions may 

39 be graded to allow the application of corrective actions in a timeframe 

40 commensurate with the significance of the IROFS to safety. Documentation 

41 associated with corrective actions should be sufficiently detailed to describe the 

42 condition(s) and action(s) taken to enable appropriate follow-up, regardless of 

43 significance.

44

45 5. Audits—The applicant should plan and schedule audits and assessments to 

46 verify compliance with, and to determine the effectiveness of, its QA elements. 

47 For IROFS of lower significance, audit activities may be graded by reducing the 

48 frequency of audit activities as appropriate. The applicant may also develop a 

49 program in which surveillances, performance monitoring, assessments, and trend 

50 data are used in lieu of or in combination with periodic audits. The applicant 
May 2014 11-24 NUREG-1520, Revision 2

1 should ensure that the results of audit, assessment, and other oversight activities 

2 are evaluated periodically to determine if the frequency, scope, or depth of the 

3 oversight needs to be adjusted to ensure the availability and reliability of IROFS. 

4

5 6. Design Control – Design inputs must be correctly selected and incorporated into 

6 the design for all IROFS, and changes to final designs (including field changes 

7 and modifications) and dispositions of nonconforming items to use-as-is or repair 

8 are subject to design control measures commensurate with those applied to the 

9 original design for all IROFS. However, IROFS of lower safety significance may 

10 lend themselves to a greater reliance on nationally accepted codes and 

11 standards as part of the design input selection or use of certain accredited bodies 

12 as input to the design verification process.

13

14 7. Procurement Document Control – Procurement documents issued for items and 

15 services must contain all applicable technical, regulatory, administrative, and 

16 reporting requirements necessary to ensure the quality of the item or service; for 

17 IROFS of lower safety significance, there may be a smaller population of 

18 requirements needed in procurement documents to ensure the quality of the item 

19 or service.

20

21 8. Instructions, Procedures, and Drawings – It is necessary to develop and 

22 implement documented guidance for the conduct of activities affecting the quality 

23 of IROFS. The level of detail in instructions, procedures, and drawings should be 

24 commensurate with the complexity of the IROFS or activity being described.

25

26 9. Control of Measuring and Test Equipment—The applicant should establish 

27 controls to ensure that the accuracy of tools, gauges, instruments, and other 

28 measuring and test equipment used for IROFS and activities affecting IROFS is 

29 maintained regardless of the risk significance of the IROFS. However, the 

30 frequency of periodic activities such as calibration may be adjusted as 

31 appropriate, but not to exceed manufacturer’s specifications or accepted industry 

32 practices, in a graded management measures program. Graded programs may 

33 entail the use of commercial-grade calibration services based, in part, on a 

34 supplier’s accreditation status (i.e., accreditation from laboratory accreditation 

35 programs administered by the National Institute of Standards and Technology 

36 and by the American Association for Laboratory Accreditation, as recognized 

37 through the mutual recognition arrangement of the International Laboratory 

38 Accreditation Program (ILAC) (See NRC Safety Evaluation (Accession No. 

39 ML052710224).

40

41 10. Quality Assurance Records— Records associated with IROFS should be 

42 sufficiently detailed in order to provide a complete record of the facility design 

43 and to enable effective configuration management. QA records associated with 

44 IROFS of lower risk significance may be less detailed than those records 

45 associated with IROFS of higher significance due to the nature of the items 

46 (lower complexity, less failure mechanisms, etc.); however, the applicant should 

47 ensure that appropriate records are maintained to enable the evaluation of 

48 failures and determination of corrective actions. The applicant’s records 

49 management program should describe (1) the methods used to protect records 

50 against damage, deterioration, or loss; (2) the requirements and responsibilities 
May 2014 11-25 NUREG-1520, Revision 2

1 for record transmittal, distribution, retention, maintenance, and disposition; and 

2 (3) the extent to which graded controls will be applied to these activities. 

3

4 C. There are some QA elements that are not conducive to grading due to their 

5 programmatic nature or generic applicability to all IROFS. Examples include:

6

7 1. Organization – It is unlikely that multiple organizational structures would be 

8 applied to activities based on the significance of IROFS associated with the 

9 activities.

10

11 2. Document Control – The preparation, issuance, and modification of quality12 affecting documents must be performed in accordance with a controlled system 

13 for all IROFS.

14

15 3. Identification and Control of Items - The applicant must establish controls to 

16 ensure that only the correct items (e.g., equipment, components) are used or 

17 installed. These controls must be applied to all IROFS in order to provide 

18 reasonable assurance that the performance requirements of §70.61 will be met.

19

20 4. Control of Special Processes - Where used, special processes such as welding, 

21 heat treating, and nondestructive examination should be performed by qualified 

22 personnel using qualified procedures. Given the specialized nature of these 

23 activities, grading is not appropriate in this area due to the need to use specially 

24 trained personnel and procedures appropriate to the task.

25

26 5. Test Control—Tests should be performed as appropriate on all IROFS, 

27 regardless of quality level, to verify that IROFS conform to specified requirements 

28 and will be available and reliable to perform their safety function when called 

29 upon. The applicant should specify the characteristics to be tested and test 

30 methods to be used. Test results should be documented and evaluated against 

31 the test requirements and acceptance criteria. Identification of characteristics to 

32 be tested, delineation of test methods, and documentation recorded in 

33 association with tests should be adequate to ensure suitable testing of items is 

34 performed and sufficient documentation is available to attest to test methods and 

35 results.

36

37 6. Handling, Storage, and Shipping—The applicant should control the handling, 

38 storage, cleaning, packaging, shipping, and preservation of all IROFS to prevent 

39 damage or loss and to minimize deterioration. 

40

41 7. Inspection, Test, and Operating Status—The status of inspection and test 

42 activities for each IROFS should be clearly indicated either on the item or in 

43 documents traceable to the item. 

44

45 8. Control of Nonconforming Items—The applicant should establish measures to 

46 control items that do not conform to specified requirements in order to prevent 

47 inadvertent installation or use of nonconforming material, parts, equipment, or 

48 services. Because it is necessary to appropriately control any IROFS that does 

49 not conform to specified requirements, this element is not conducive to grading 
May 2014 11-26 NUREG-1520, Revision 2

1 because relaxed controls may be less effective in ensuring the availability and 

2 reliability of IROFS. 

3

4 11.5 Review Procedures

5

6 11.5.1 Acceptance Review

7

8 During the acceptance review of a license application, the reviewer should examine the 

9 submittals to identify major deficiencies in the information provided for each area of review 

10 specified in SRP Section11.3. Reviewers must decide whether they have enough information to 

11 proceed with a detailed review. Less significant errors or deficiencies that can be addressed in 

12 a request for additional information should be accepted. However, before the NRC performs a 

13 detailed review, the applicant should correct major deficiencies that would require several 

14 requests for additional information to resolve. 

15

16 Reviewers should record whether each area of review is adequately addressed in the 

17 application, is adequately addressed in a referenced document, is not applicable to the 

18 application, or has a major deficiency. 

19

20 11.5.2 Safety Evaluation

21

22 For each area of review specified in Section 11.3, the review procedure is identified below. 

23 These review procedures are based on the identified SRP acceptance criteria. For deviations 

24 from these specific acceptance criteria, the staff should review the applicant’s evaluation of how 

25 the proposed alternatives to the SRP criteria provide an acceptable method of complying with 

26 the relevant NRC requirements identified in Section 11.4.

27

28 During the review of the license application and ISA summary for a planned facility, the reviewer 

29 should identify and note any items or issues that should be inspected during an operational 

30 readiness review, if such a review will be performed. These items could include confirming that 

31 the engineered controls are implemented through procedures and operator training. 

32

33 For an existing facility, the reviewer may consult NRC inspectors to identify and resolve any 

34 issues related to the licensing review. For a planned facility, the reviewer may wish to consult 

35 with the facility design team to gain a better understanding of the process, its potential hazards, 

36 and safety approaches. The reviewer should coordinate these interactions through the licensing 

37 project manager.

38

39 The primary reviewer will prepare safety evaluation report (SER) input for the licensing project 

40 manager in support of the licensing action.

41

42 11.5.3 Configuration Management

43

44 The reviewer should evaluate the six areas of CM described in the next sections.

45

46 11.5.3.1 Configuration Management Program

47

48 The reviewer should consider whether the CM plan acceptably states management 

49 commitments, gives the program directive, and defines key responsibilities, terminology, and 

50 equipment scope. 
May 2014 11-27 NUREG-1520, Revision 2

1 The reviewer should determine whether the applicant’s description of overall CM functions 

2 covers the following topics: (1) the scope of the IROFS and management measures to be 

3 included (coordinating with the reviewer of Chapter 3 of this SRP as necessary), (2) the 

4 description and objectives of each CM activity, and (3) the organizational structure and staffing 

5 interfaces. 

6

7 The reviewer should determine that IROFS identified in the ISA summary are subject to the CM 

8 function. 

9

10 The reviewer should check for appropriate interfaces both within the CM function and with 

11 external organizations and functions. In particular, the review should examine functional 

12 interfaces with QA, maintenance, and training (including qualification). 

13

14 The reviewer should look for the applicant’s identification of necessary databases and the rules 

15 for their maintenance.

16

17 11.5.3.2 Design Control Requirements

18

19 The reviewer should confirm that the design process leading to drawings and other statements 

20 of requirements proceeds logically from the design basis. The design basis is a set of facts 

21 about the systems covered by CM which an appropriate authority within the organization has 

22 reviewed and approved. 

23

24 The reviewer should verify that specific personnel are assigned the responsibility for maintaining 

25 the design bases and requirements. 

26

27 The reviewer should verify that the requirements documents clearly define the IROFS to be 

28 listed under CM, along with the assignment of any grades or quality levels. The reviewer should 

29 coordinate this part of the review with the ISA primary reviewer. 

30

31 Note that the reviewer, in conjunction with the appropriate technical reviewers, is responsible for 

32 determining the adequacy of the reduced levels the applicant would apply to IROFS for accident 

33 sequences with lesser consequences. 

34

35 11.5.3.3 Document Control

36

37 The reviewer should evaluate the application to determine whether the CM system captures 

38 documents that are relevant and important to safety. These documents should include the 

39 design requirements, the ISA, the ISA summary, as-built drawings, specifications, all operating 

40 procedures important to safety, procedures involving training, maintenance, audits and 

41 assessments, emergency operating procedures, emergency response plans, system 

42 modification documents, assessment reports, and other documents that the applicant deems 

43 pertinent to the CM function. 

44

45 The reviewer should examine information describing a controlled document database used to 

46 control documents and track document change status. 

47

48 The reviewer should confirm that rules of storage for originals or master copies of documents 

49 within the scope of the CM function follow the guidance of records management. 
May 2014 11-28 NUREG-1520, Revision 2

1 11.5.3.4 Change Control

2

3 The reviewer should verify that the description of change control within the CM function commits 

4 to acceptable methods for (1) the identification of changes in configurations that are IROFS, 

5 (2) technical and management review of changes, and (3) tracking and implementing changes, 

6 including placement of documentation in a document control center and dissemination to 

7 affected functions such as training, engineering, operations, maintenance, and other QA 

8 elements.

9

10 11.5.3.5 Assessments

11

12 The reviewer should verify that both document assessments and physical assessments (system 

13 walk-downs) will be conducted periodically to check the adequacy of the CM functions. The 

14156 reviewer should also confirm that the applicant will document all assessments and followups. 

17

18 11.5.3.6 Design Reconstitution (Existing Facilities Only) 

19

20 Design reconstitution may be necessary for existing facilities if current design information is not 

21 adequate. 

22

23 The reviewer should examine the applicant’s description of work to establish, organize, and 

24 document design requirements and design bases for items for which design information was not 

25 available before the application was submitted. This includes the methods used to evaluate, 

26 verify, and validate reconstituted design data for IROFS. 

27

28 The reviewer will seek evidence that the applicant (1) investigated the need for design-bases 

29 reconstitution, (2) accomplished reconstitution as necessary, and (3) properly incorporated the 

30 new or revised documentation into the CM function. 

31

32 11.5.4 Maintenance

33

34 The reviewer will evaluate the applicant’s description of how the maintenance function will 

35 coordinate with and use the other management measures listed in this chapter. The primary 

36 reviewer should consult with supporting reviewers to identify common weaknesses in the 

37 applicant’s approach and consider these in the review.

38

39 11.5.5 Training and Qualification

40

41 Recognizing that the training objectives and methods and the required personnel qualifications 

42 may be graded to correspond to the hazard potential of the facility, the reviewer performs a 

43 safety evaluation against the acceptance criteria described in Section 11.4. In particular, the 

44 review should accomplish the following:

45

46 1. The review should evaluate the adequacy of training and qualification on the basis of 

47 how well it fulfills the applicant’s training objectives, especially when human factors are 

48 relied on for safety. 

49

50 2. The review should determine whether the applicant has adequately planned for the 

51 training and personnel qualification to be accomplished and whether necessary policies, 
May 2014 11-29 NUREG-1520, Revision 2

1 procedures, and instructions will be in place and appropriate training and qualification 

2 will be accomplished before personnel begin activities relied on for safety. 

3

4 3. The reviewer should focus on the training and qualification of personnel who will perform 

5 activities relied on for safety.

6

7 4. The supporting reviewers should become familiar with the applicant’s personnel training 

8 and qualification commitments and determine whether ongoing activities correspond to 

9 them.

10

11 5. The review should determine whether there is reasonable assurance that the applicant’s 

12 personnel training and qualification will result in only properly trained and qualified 

13 personnel performing activities relied on for safety.

14

15 11.5.6 Procedures

16

17 The reviewer will evaluate whether the applicant has adequately addressed the acceptance 

18 criteria listed in Section 11.4. The reviewer will document in an SER that the applicant has 

19 committed to the following:

20

21 1. The applicant includes a statement to follow approved procedures while processing 

22 licensed SNM.

23

24 2. Procedures important to safety are independently verified and validated before use, and 

25 this is documented in a program on procedures.

26

27 3. Procedures exist for the notification of operations personnel before and after 

28 maintenance is performed on IROFS, and procedures are in place to control activities.

29

30 4. An independent, multidisciplinary safety review team reviews and approves changes to 

31 operating, management measure, or maintenance procedures controlled by the CM 

32 function.

33 

34 11.5.7 Audits and Assessments

35

36 The reviewer will determine whether the applicant has adequately planned for audits and 

37 assessments to be accomplished and whether necessary programs, personnel, and procedures 

38 will be established.

39

40 If the applicant refers to other sections of the application when describing its audits and 

41 assessments, the reviewer should examine these other sections of the application to determine 

42 the applicant’s overall commitment to audits and assessments and the proposed method for 

43 implementation. The reviewer should confirm that the applicant’s audit and assessment 

44 commitments are consistent with other sections of the submittal. 

45

46 11.5.8 Incident Investigations

47

48 The reviewer will verify that the applicant has described a comprehensive incident investigation 

49 function based on the areas of review in Section 11.3 and the acceptance criteria in 

50 Section 11.4 of this SRP. For existing facilities, the reviewer should consult with the NRC 
May 2014 11-30 NUREG-1520, Revision 2

1 inspection staff and review any historical information regarding the adequacy of the applicant’s 

2 incident investigation process. 

3

4 11.5.9 Records Management

5

6 The review should determine whether the applicant has adequately implemented a records 

7 management system. For fuel cycle facilities that are parts of larger organizations, certain 

8 documents may be retained or stored at a site other than the facility site. For example, master 

9 drawings for structures might be kept in the engineering department of the headquarters of the 

10 parent company. The reviewer may choose to review the physical characteristics of these 

11 offsite record storage areas, particularly the storage areas for records related to IROFS for high12 consequence accident sequences. 

13

14 11.5.10 Other Quality Assurance Elements

15

16 The reviewer should evaluate the applicant’s submittal with regard to QA elements against the 

17 acceptance criteria in Section 11.4. Supporting reviewers should determine whether IROFS 

18 within their areas of review are specified to be within the appropriate QA elements and level. 

19 The reviewer should measure the effectiveness of the QA elements design, rather than just 

20 verifying the existence of appropriate QA elements. 

21

22 The reviewer will document in the SER the results of the following: 

23

24 1. The reviewer should determine whether there is reasonable assurance that the 

25 applicant’s QA elements, maintenance, and CM are coordinated and that the QA 

26 elements are an integral part of everyday work activities. 

27

28 2. The reviewer should determine whether there is reasonable assurance that the applicant 

29 will be able to monitor the effectiveness of the implementation of QA elements and will 

30 make needed adjustments promptly.

31

32 3. The reviewer should determine that the applicant has specified the QA elements criteria, 

33 the basis for choosing the criteria, and the proposed method for implementation. 

34

35 4. If the applicant refers to other sections of the application when describing its QA 

36 elements, the reviewer should examine these sections to determine the applicant’s 

37 commitment to the QA elements and the proposed method for implementation. 

38

39 11.6 Evaluation Findings

40

41 The regulations in 10 CFR 70.23 and 70.66 state that an application for a license will be 

42 approved if the Commission can make the general findings listed in those sections. The basis 

43 for the general findings is an evaluation of whether the application adequately addresses all of 

44 the applicable regulatory requirements. More specifically, the staff’s evaluation should 

45 determine whether the licensing submittals provide sufficient information to satisfy the regulatory 

46 requirements of Section 11.4.1 of this SRP and whether the applicant has appropriately 

47 addressed the regulatory acceptance criteria in SRP Section 11.4.3. On the basis of this 

48 information, the reviewers should write material suitable for inclusion in the SER prepared for 

49 the entire application. The SER should state how the applicable regulatory requirements have 

50 or have not been met based on the acceptance criteria described in this chapter of the SRP. If 
May 2014 11-31 NUREG-1520, Revision 2

1 the applicant chooses to use an alternative approach, the reviewer should discuss in the SER 

2 whether the proposed approach satisfies the applicable regulatory requirements. The 

3 reviewers should use the following approach to document their evaluation:

4

5 1. State a specific regulatory requirement that applies to the application. Detailed 

6 acceptance criteria may be included where appropriate or necessary to clarify the 

7 requirement.

8

9 2. Identify the areas where the regulatory requirement is addressed in the application, 

10 including the areas where the specific acceptance criteria described in this SRP are 

11 addressed. 

12

13 3. Describe your evaluation of the application, the basis for your conclusion, and whether it 

14 meets the regulatory requirement.

15

16 4. Repeat these steps for every regulatory requirement that applies to the application.

17

18

19 Where the graded application of management measures has been requested by the applicant or 

20 licensee, the staff’s evaluation findings should include a comprehensive assessment of the 

21 graded controls, the basis for the controls, provisions for adjusting the graded controls based on 

22 implementation feedback, and the extent and limitations of the graded measures. The staff’s 

23 evaluation should also include a comprehensive assessment of the IROFS categorization 

24 process and its basis, which will be performed by reviewers in accordance with SRP Chapter 3. 

25 Applications seeking to apply graded QA controls without sufficient basis should not be granted.

26

27 There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

28 application or amendment request, (2) denial of the application or request, or (3) approval with 

29 conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

30 reviewer may consider proposing a license condition. Absent an NRC order, license conditions 

31 must be agreed upon with the licensee or applicant before becoming part of the license. A 

32 license condition should only be proposed if there is reasonable assurance that, if the licensee 

33 meets the condition, all regulatory requirements will be satisfied. Thus, license conditions 

34 should not be used to cover major deficiencies in an application. License conditions should be 

35 unambiguous, inspectable, and enforceable. They should only require those actions necessary 

36 to ensure compliance with applicable regulations. The basis for license conditions must be 

37 documented in the SER. 

38

39 If the submittal is acceptable, the final SER input should conclude with statements similar to the 

40 following: 

41

42 11.6.1 Configuration Management 

43

44 The staff has reviewed the CM function for [name of facility] according to Chapter 11 of 

45 the SRP (NUREG-1520). [Insert a summary statement of what was evaluated and why 

46 the reviewer finds the submittal acceptable.]

47

48 The applicant has suitably and acceptably described its commitment to a proposed CM 

49 system, including the method for managing changes in procedures, facilities, activities, 

50 and equipment for IROFS. Management-level policies and procedures, including an 
May 2014 11-32 NUREG-1520, Revision 2

1 analysis and independent safety review of any proposed activity involving IROFS, are 

2 described and will provide reasonable assurance that consistency among design 

3 requirements, physical configuration, and facility documentation is maintained as part of 

4 a new activity or change in an existing activity involving licensed material. The 

5 management measures will include (or do include) the following elements of CM:

6

7 1. Configuration Management

8

9 The applicant has put in place or committed to the organizational structure, 

10 procedures, and responsibilities necessary to implement CM.

11

12 2. Design Control Requirements

13

14 The applicant has documented, and supported by analysis, design requirements 

15 and bases. Furthermore, the applicant has ensured that the documentation 

16 remains current.

17

18 3. Document Control

19

20 The applicant has stored documents, including drawings, in an appropriate and 

21 accessible manner. Drawings and related documents captured by the system 

22 are those necessary and sufficient to adequately describe IROFS.

23

24 4. Change Control

25

26 Responsibilities and procedures adequately describe how the applicant will 

27 achieve and maintain strict consistency among the design requirements, the 

28 physical configuration, and the facility documentation. The applicant has put in 

29 place methods for suitable analysis, review, approval, and implementation of 

30 identified changes to IROFS. This includes appropriate CM controls to ensure 

31 configuration verification, functional tests, and accurate documentation for 

32 equipment or procedures that have been modified.

3334

35 5. Assessments

36

37 The applicant has committed to an adequate function that includes both initial 

38 and periodic assessments, as described in the acceptance criteria in the SRP. 

39 The assessments are expected to verify and ensure the adequacy of the CM 

40 function.

41

42 6. Design Reconstitution (Existing Facilities Only)

43

44 The applicant has adequately described the design reconstitution performed. 

45 Current design bases are available and verified for all IROFS, such that the 

46 configuration is consistent with the as-built facility documentation.

47

48
May 2014 11-33 NUREG-1520, Revision 2

1 11.6.2 Maintenance 

2

3 The applicant has committed to maintenance of IROFS. The applicant’s maintenance 

4 commitments contain the basic elements to maintain availability and reliability: 

5 corrective maintenance, PM, functional testing, equipment calibration, and work control 

6 for maintenance of IROFS. The applicant’s maintenance function is proactive, using 

7 maintenance records, PM records, and surveillance tests to analyze equipment 

8 performance and to seek the root causes of repetitive failures.

9

10 The surveillance and monitoring, PM, and functional testing activities described in the 

11 license application provide reasonable assurance that the IROFS identified in the ISA 

12 summary will be available and reliable to prevent or mitigate accident consequences.

13

14 The maintenance function (1) is based on approved procedures, (2) employs work 

15 control methods that properly consider personnel safety, awareness of facility operating 

16 groups, QA, and the rules of CM, (3) uses the ISA summary to identify IROFS that 

17 require maintenance and determine the level of maintenance needed, (4) justifies the 

18 PM intervals in terms of the equipment reliability goals, (5) provides for training that 

19 emphasizes the importance of IROFS identified in the ISA summary, regulations, codes, 

20 and personnel safety, and (6) creates documentation that includes records of all 

21 surveillance, inspections, equipment failures, repairs, and replacements of IROFS.

22

23 The staff concludes that the applicant’s maintenance functions meet therequirements of 

24 10 CFR Part 70 and provide reasonable assurance of public health and safety and the 

25 protection of the environment.

26

27 11.6.3 Training and Qualification 

28

29 Based on its review of the license application [insert a summary statement of what was 

30 evaluated and why the reviewer finds the submittal acceptable], the NRC staff concludes 

31 that the applicant has adequately described and assessed its personnel training and 

32 qualification in a manner that satisfies the regulatory requirements and is consistent with 

33 the guidance in this SRP. 

34

35 Reasonable assurance exists that implementation of the described training and 

36 qualification will result in personnel who are qualified and competent to design, 

37 construct, start up, operate, maintain, modify, and decommission the facility safely. The 

38 staff concludes that the applicant’s plan for personnel training and qualification meets 

39 the requirements of 10 CFR Part 70.

40

41 11.6.4 Procedures 

42

43 The application describes a suitably detailed process for the development, approval, and 

44 implementation of procedures. It has addressed IROFS, as well as items important to 

45 the health of facility workers and the public and to the protection of the environment. 

46 The staff concludes that the applicant’s plan for procedures meets the requirements of 

47 10 CFR Part 70.
May 2014 11-34 NUREG-1520, Revision 2

1 11.6.5 Audits and Assessments 

2

3 Based on its review of the license application [insert a summary statement of what was 

4 evaluated and why the reviewer finds the submittal acceptable], the NRC staff concludes 

5 that the applicant has adequately described its audits and assessments. The staff has 

6 reviewed the applicant’s plan for audits and assessments and finds it acceptable. 

7

8 The staff concludes that the applicant’s plan for audits and assessments meets the 

9 requirements of 10 CFR Part 70 and provides reasonable assurance of protection of the 

10 health and safety of the public, workers, and the environment. 

11

12 11.6.6 Incident Investigations 

13

14 The applicant has committed to and established an organization responsible for 

15 (1) performing incident investigations of abnormal events that may occur during 

16 operation of the facility, (2) determining the root cause(s) and generic implications of the 

17 event, and (3) recommending corrective actions for ensuring a safe facility and safe 

18 facility operations, in accordance with the acceptance criteria of Section 11.4 of the SRP. 

19

20 The applicant has committed to monitoring and documenting corrective actionsthrough 

21 to completion.

22

23 The applicant has committed to the maintenance of documentation so that “lessons 

24 learned” may be applied to future operations of the facility.

25

26 Accordingly, the staff concludes that the applicant’s description of the incident 

27 investigation process complies with applicable NRC regulations and is adequate. 

28

29 11.6.7 Records Management 

30

31 The staff has reviewed the applicant’s records management system against the 

32 acceptance criteria and concludes that the system (1) will be effective in collecting, 

33 verifying, protecting, and storing information about the facility and its design, operations, 

34 and maintenance and will be able to retrieve the information in readable form for the 

35 designated lifetimes of the records, (2) will provide a records storage area(s) with the 

36 capability to protect and preserve health and safety records that are stored there during 

37 the mandated periods, including protection of the stored records against loss, theft, 

38 tampering, or damage during and after emergencies, and (3) will provide reasonable 

39 assurance that any deficiencies in the records management system or its

40 implementation will be detected and corrected promptly.

41

42 11.6.8 Other Quality Assurance Elements 

43

44 The SER should include a summary statement of what the NRC evaluated and the basis for the 

45 reviewer’s conclusions. The review should demonstrate the adequacy of the applicant’s use of 

46 other QA elements, as applied to IROFS, for design, construction, and operations. The SER 

47 should include statements like the following:
May 2014 11-35 NUREG-1520, Revision 2

1 The NRC staff concludes that the applicant has adequately described the application of 

2 other QA elements (and the applicable QA elements of its principal contractors). The 

3 staff also concludes the following:

4

5 • The applicant has established and documented a commitment to an organization 

6 responsible for developing, implementing, and assessing the management 

7 measures for providing reasonable assurance of safe facility operations, in 

8 accordance with the criteria in Section 11.4 of the SRP.

9

10 • The applicant has established and documented a commitment to QA elements, 

11 and the administrative measures for staffing, evaluating performance, assessing 

12 findings, and implementing corrective action are in place.

13

14 • The applicant has developed a process for preparation and control of written 

15 administrative plant procedures, including procedures for evaluating changes to 

16 procedures, IROFS, and tests. The applicant has committed to implement and 

17 maintain a process for review, approval, and documentation of procedures.

18

19 • The applicant has established and documented surveillances, tests, and 

20 inspections to provide reasonable assurance of satisfactory in-service 

21 performance of IROFS. 

22

23 • The applicant will ensure that periodic independent audits are conducted to 

24 determine the effectiveness of the management measures. Management 

25 measures will provide for documentation of audit findings and implementation of 

26 corrective actions.

27

28 • The applicant has established and documented training requirements to provide 

29 employees with the skills to perform their jobs safely. The applicant has also

30 provided management measures for the evaluation of the effectiveness of 

31 training against predetermined objectives and criteria.

32

33 • The organizations and persons performing QA element functions have the 

34 required independence and authority to effectively carry out their QA element 

35 functions without undue influence from those directly responsible for process 

36 operations.

37

38 • QA elements cover the IROFS, as identified in the ISA summary, and the 

39 applicant has established measures to prevent hazards from becoming pathways 

40 to higher risks and accidents.

41

42 Accordingly, the staff concludes that the applicant’s use of other QA elements meets the 

43 requirements of 10 CFR Part 70 and provides reasonable assurance that public health 

44 and safety and the environment are protected.
May 2014 11-36 NUREG-1520, Revision 2

1 11.7 References 

23

4 American National Standards Institute/American Society of Mechanical Engineers Standard, 

5 “Quality Assurance Requirements for Nuclear Facility Applications,” ANSI/ASME NQA-1a-2009.

6

7 U.S. Code of Federal Regulations, Chapter I, Title 10, “Energy,” Part 50, “Domestic Licensing of 

8 Production and Utilization Facilities.”

9

10 U.S. Code of Federal Regulations, Chapter I, Title 10, “Energy,” Part 70, “Domestic Licensing of 

11 Special Nuclear Material.”

12

13 U.S. Code of Federal Regulations, Chapter I, Title 10, “Energy,” Part 21, “Reporting of Defects 

14 and Noncompliance.”

15

16 U.S. Nuclear Regulatory Commission, “Guidance on Management Controls/Quality Assurance, 

17 Requirements for Operation, Chemical Safety, and Fire Protection for Fuel Cycle Facilities,” 

18 Federal Register, Vol. 54, No. 53, pp. 11590−11598, March 21, 1989.

19

20 U.S. Nuclear Regulatory Commission, “Suggested Guidance Relating to Development and 

21 Implementation of Corrective Action,” Information Notice 96-28, May 1966.

22

23 U.S. Nuclear Regulatory Commission, “Human Factors Engineering Program Review Model,” 

24 NUREG-0711, Revision 2, February 2004.
May 2014 11-A-1 NUREG-1520, Revision 1

APPENDIX A

CHECKLIST FOR PROCEDURES

1 Written procedures should cover all activities listed below. This list is not intended to be all2 inclusive or to imply that procedures must be developed with the same titles as those on the list. 

3

4 1. Management Control Procedures

5

6 • training

7 • audits and assessments

8 • incident investigation

9 • records management

10 • configuration management

11 • quality assurance

12 • equipment control (lockout/tagout)

13 • shift turnover

14 • work control

15 • procedure management

16 • nuclear criticality safety

17 • fire protection

18 • radiation protection

19 • radioactive waste management

20 • maintenance

21 • environmental protection

22 • chemical process safety

23 • operations

24 • calibration control

25 • preventive maintenance

26

27 2. Operating Procedures

28

29 • system procedures that address startup, operation, shutdown, control of process 

30 operations, and recovery after a process upset

31

32 – ventilation

33 – criticality alarms

34 – shift routines, shift turnover, and operating practices

35 – decontamination operations

36 – uranium recovery

37 – facility utilities (air, other gases, cooling water, fire water, steam)

38 – temporary changes in operating procedures

39

40 • abnormal operation/alarm response

41

42 – loss of cooling water

43 – loss of instrument air
May 2014 11-A-2 NUREG-1520, Revision 1

1 – loss of electrical power

2 – loss of criticality alarm system

3 – fires

4 – chemical process releases

5

6 3. Maintenance Activities That Address System Repair, Calibration, Surveillance, and 

7 Functional Testing

8

9 • repairs and preventive repairs of items relied on for safety (IROFS)

10 • testing of criticality alarm units

11 • calibration of IROFS

12 • high-efficiency particulate air filter maintenance

13 • functional testing of IROFS

14 • relief valve replacement/testing

15 • surveillance/monitoring

16 • pressure vessel testing

17 • nonfired pressure vessel testing

18 • piping integrity testing

19 • containment device testing

20

21 4. Emergency Procedures

22

23 • response to a criticality

24 • hazardous process chemical releases (including uranium hexafluoride)

25
May 2014 11-B-1 NUREG-1520, Revision 2

APPENDIX B

INCIDENT INVESTIGATION PROGRAMS AND PROCEDURES

1 The following eight items are good practices to incorporate in incident investigation programs or 

2 procedures or both:

3

4 (1) The investigation of an abnormal event should begin as soon as possible after the event 

5 has been brought under control.

6

7 (2) The incident investigation program contains a documented procedure for investigating 

8 an abnormal event. This procedure is separate from any required emergency plan. 

9

10 (3) The program includes a description of the functions, qualifications, and responsibilities of 

11 the manager who would lead the investigative team and those of the other team 

12 members; the scope of the team’s authority and responsibilities; and an assurance of 

13 management cooperation.

14

15 (4) Qualified internal or external investigators are appointed to serve on investigating teams 

16 when required. The teams should include at least one process expert and at least one 

17 team member trained in root cause analysis.

18

19 (5) The program contains guidance for personnel conducting the investigation on how to 

20 apply a reasonable, systematic, structured approach to determine the specific or generic 

21 root cause(s) and generic implications of the problem. The level of investigation should 

22 be based on a graded approach relative to the severity of the incident.

23

24 (6) The incident investigation team has assurance of the team’s authority to obtain all 

25 information considered necessary and is independent from the functional area involved 

26 in the incident under investigation.

27

28 (7) The investigation process and investigating teams are independent of the line 

29 management.

30

31 (8) Auditable records and documentation related to abnormal events, investigations, and 

32 root cause analysis are maintained. For each abnormal event, the incident report should 

33 include a description, contributing factors, a root cause analysis, and findings and 

34 recommendations. Relevant findings are reviewed with all affected personnel.

35

May 2014 11-C-1 NUREG-1520, Revision 2

APPENDIX C

RECORDS

1 The requirements for records management vary according to the nature of the facility 

2 and the hazards and risks it poses. Examples of the records required by Title 10 of the 

3 Code of Federal Regulations (10 CFR) Part 19, “Notices, Instructions and Reports to 

4 Workers: Inspection and Investigations”; 10 CFR Part 20, “Standards for Protection 

5 against Radiation”; 10 CFR Part 21, “Reporting of Defects and Noncompliance”; 

6 10 CFR Part 25, “Access Authorization”; and 10 CFR Part 70, “Domestic Licensing of 

7 Special Nuclear Material,” are listed below. The records are listed under the chapter 

8 headings of the Standard Review Plan (SRP). The list is not intended to be exhaustive 

9 or prescriptive. Different or additional records may be required in certain 

10 circumstances. The applicant may also choose to organize the records in other ways.

11

12 Examples of Records

13

14 SRP Chapter

15

16 1. General Information

17

18 • construction records

19

20 • facility and equipment descriptions and drawings

21

22 • design criteria, requirements, and bases for items relied on for safety 

23 (IROFS), as specified by the facility configuration management (CM) 

24 function

25

26 • records of facility changes and associated integrated safety analyses, as 

27 specified by the facility CM function

28

29 • safety analyses, reports, and assessments

30

31 • records of site characterization measurements and data

32

33 • records pertaining to onsite disposal of radioactive or mixed wastes in 

34 surface landfills

35

36 • procurement records, including specifications for IROFS

37

38 2. Organization and Administration

39

40 • administrative procedures with safety implications

41
May 2014 11-C-2 NUREG-1520, Revision 2

1 • change control records for material control and accounting program

2

3 • organization charts, position descriptions, and qualification records

4

5 • safety and health compliance records, medical records, personnel 

6 exposure records

7

8 • quality assurance records

9

10 • safety inspections, audits, assessments, and investigations

11

12 • safety statistics and trends

13

14 3. Integrated Safety Analysis

15

16 4. Radiation Safety

17

18 • bioassay data

19 • exposure records

20 • radiation protection (and contamination control) records

21 • radiation training records

22 • radiation work permits

23

24 5. Nuclear Criticality Safety

25

26 • nuclear criticality control written procedures and statistics

27

28 • nuclear criticality safety analyses

29

30 • records pertaining to nuclear criticality inspections, audits, investigations, 

31 and assessments

32

33 • records pertaining to nuclear criticality incidents, unusual occurrences, or 

34 accidents

35

36 • records pertaining to nuclear criticality safety analyses

37

38 6. Chemical Safety

39

40 • chemical process safety procedures and plans

41

42 • records pertaining to chemical process inspections, audits, investigations, 

43 and assessments

44

45 • diagrams, charts, and drawings
May 2014 11-C-3 NUREG-1520, Revision 2

1

2 • records pertaining to chemical process incidents, unusual occurrences, or 

3 accidents

4

5 • chemical process safety reports and analyses

6

7 • chemical process safety training

8

9 7. Fire Safety

10

11 • fire hazard analysis

12

13 • fire prevention measures, including hot-work permits and fire watch records

14

15 • records pertaining to inspection, maintenance, and testing of fire protection 

16 equipment

17

18 • records pertaining to fire protection training and retraining of response 

19 teams

20

21 • prefire emergency plans

22

23 8. Emergency Management

24

25 • emergency plan(s) and procedures

26

27 • comments on emergency plan from outside emergency response 

28 organizations

29

30 • emergency drill records

31

32 • memoranda of understanding with outside emergency response 

33 organizations

34

35 • records of actual events

36

37 • records pertaining to the training and retraining of personnel involved in 

38 emergency preparedness functions

39

40 • records pertaining to the inspection and maintenance of emergency 

41 response equipment and supplies

42

43 9. Environmental Protection

44

45 • environmental release and monitoring records
May 2014 11-C-4 NUREG-1520, Revision 2

1 • environmental report and supplements to the environmental report, as 

2 applicable

3

4 10. Decommissioning

5

6 • decommissioning records

7 • financial assurance documents

8 • decommissioning cost estimates

9 • site characterization data

10 • final survey data

11 • decommissioning procedures

12

13 11. Management Measures

14

15 11.1 Configuration Management

16

17 • safety analyses, reports, and assessments that support the physical 

18 configuration of process designs and changes to those designs

19

20 • validation records for computer software used for safety analysis or 

21 material control and accounting

22

23 • integrated safety analysis documents, including process descriptions, plant 

24 drawings and specifications, and purchase specifications for IROFS

25

26 • approved current operating procedures and emergency operating 

27 procedures

28

29 11.2 Maintenance

30

31 • record of IROFS failures (required by 10 CFR 70.62, “Safety Program and 

32 Integrated Safety Analysis”)

33

34 • preventive maintenance records, including trending and root cause 

35 analysis

36

37 • calibration and testing data for IROFS

38

39 • corrective maintenance records

40

41 11.3 Training and Qualification

42

43 • personnel training and qualification records

44 • procedures

45
May 2014 11-C-5 NUREG-1520, Revision 2

1 11.4 Procedures

2

3 • standard operating procedures

4 • functional test procedures

5

6 11.5 Audits and Assessments

7

8 • audits and assessments of safety and environmental activities

9

10 11.6 Incident Investigations

11

12 • investigation reports

13 • changes recommended by investigation reports and how and when 

14 implemented

15 • summary of reportable events for the term of the license

16 • incident investigation policy

17

18 11.7 Records Management

19

20 • policy

21 • material storage records

22 • records of receipt, transfer, and disposal of radioactive material

23

May 2014 12-1 NUREG-1520, Revision 2

12. MATERIAL CONTROL AND ACCOUNTING

1 12.1 Purpose of Review

2

3 The purpose of this review is to determine whether the applicant’s material control and 

4 accounting (MC&A) program is adequate to detect and protect against the loss, theft, or 

5 diversion of special nuclear material (SNM) that the applicant will possess, store, and utilize at 

6 its facility, and to comply with the regulatory requirements in Title 10 of the Code of Federal 

7 Regulations (10 CFR) Part 74, “Material Control and Accounting of Special Nuclear Material,” 

8 and 10 CFR Part 70, “Domestic Licensing of Special Nuclear Material.”

9

10 The MC&A regulations in 10 CFR Part 74 distinguishes between licensees authorized to 

11 possess different types and quantities of SNM. These designations are also used to describe 

12 the facilities at which the licensees may possess the material. The categories of licensees or 

13 facilities are:

14

15 1. Category I – Fuel facilities/licensees authorized to possess 5 formula kilograms, or more, 

16 of strategic special nuclear material (SSNM), as defined in 10 CFR 74.4, “Definitions.”

17

18 2. Category II – Fuel facilities/licensees authorized to possess SNM of moderate strategic 

19 significance, as defined in 10 CFR 74.4.

20

21 3. Category III – Fuel facilities/licensees authorized to possess SNM of low strategic 

22 significance, as defined in 10 CFR 74.4. This category includes low-enriched 

23 fuel-fabrication facilities and enrichment facilities. 

24

25 Correspondingly greater (graded) MC&A program capabilities are required for activities and 

26 processes involving categories of SNM of increasing strategic significance, from Category III to 

27 Category II and Category I, depending on the amounts and forms of SNM under safeguards. 

28 Therefore, this chapter will discuss the review required by safeguards category and facility type.

29

30 As indicated above, for applications regarding Category I facilities, the reviewer will need to 

31 become familiar with the terms “strategic special nuclear material,” “formula kilogram,” “formula 

32 quantity,” and “category 1A material,” each of which is defined in 10 CFR 74.4. For applications 

33 regarding Category II facilities, the reviewer will need to become familiar with the term “special 

34 nuclear material of moderate strategic significance.” For applications regarding Category III 

35 facilities, the reviewer will need to become familiar with the term “special nuclear material of low 

36 strategic significance.”

37

38 There are additional defined terms in part 74 that are more generally applicable. These include 

39 “special nuclear material,” “low enriched uranium,” “high enriched uranium,” “item,” 

40 “measurement,” and “physical inventory.”
May 2014 12-2 NUREG-1520, Revision 2

1 12.2 Responsibility for Review

2

3 Primary: MC&A License Reviewer

4

5 Secondary: MC&A Technical Staff

6

7 Supporting: Project Manager

8

9 Fuel Cycle Facility MC&A Inspector

10

11 12.3 Areas of Review

12

13 As specified in 10 CFR 70.22(b), an applicant must submit a full description of its program for 

14 control and accounting of the SNM in its possession under license to demonstrate how 

15 compliance with the requirements in 10 CFR Part 74 will be accomplished. This MC&A program 

16 description is provided to the U.S. Nuclear Regulatory Commission (NRC) in the form of a 

17 Fundamental Nuclear Material Control (FNMC) plan. Guidance for the format and content of an 

18 FNMC plan is provided in the following documents, depending on the safeguards category and 

19 facility type:

20

21 1. Category I Facility – NUREG-1280, “Standard Format and Content Acceptance Criteria 

22 for the Material Control and Accounting (MC&A) Reform Amendment.” [Note: 

23 NUREG-1280 is being revised as part of a proposed rulemaking for 10 CFR Part 74. 

24 The draft guidance has been noticed for public comment in the Federal Register (FR) at 

25 78 FR 67224, dated November 8, 2013.]

26

27 2. Category II Facility – [Note: There are presently no Category II facilities, and there is no 

28 guidance for a Category II facility. Draft NUREG-2159, “Acceptable Standard Format 

29 and Content for the Material Control and Accounting (MC&A) Plan Required for Special 

30 Nuclear Material of Moderate Strategic Significance,” has been developed as part of a 

31 proposed rulemaking for 10 CFR Part 74. The new draft guidance has been noticed for 

32 public comment in 78 FR 67224, dated November 8, 2013.]

33

34 3. Category III Fuel Fabrication Facility – NUREG-1065, “Acceptable Standard Format and 

35 Content for the Fundamental Nuclear Material Control (FNMC) Plan Required for 

36 Low-Enriched Uranium Facilities.” [Note: NUREG-1065 is being revised as part of a 

37 proposed rulemaking for 10 CFR Part 74. The draft guidance has been noticed for 

38 public comment in 78 FR 67224, dated November 8, 2013.]

39

40 4. Category III Enrichment Facility – NUREG/CR-5734, “Recommendations to the NRC on 

41 Acceptable Standard Format and Content for the Fundamental Nuclear Material Control 

42 (FNMC) Plan Required for Low-Enriched Uranium Enrichment Facilities.” [Note: 

43 NUREG/CR-5734 is being revised as part of a proposed rulemaking for 10 CFR Part 74. 

44 The draft guidance has been noticed for public comment in 78 FR 67224, dated 

45 November 8, 2013.]

46

47 The guidance documents listed above are also used by the MC&A license reviewer to 

48 determine the acceptability of the applicant’s proposed MC&A program. The specific areas of 

49 review are different depending on the type of facility and safeguards category. These areas are 

50 listed in Sections 12.3.1 through 12.3.4 below.

51

52 12.3.1 Category I Facility
May 2014 12-3 NUREG-1520, Revision 2

1

2 For a Category I facility, the staff will review the applicant’s commitments regarding the following 

3 MC&A program areas:

4

5 10. abrupt loss detection from process units (Process Monitoring)

6

78 11. timely detection of loss of items (Item Monitoring)

9

10 12. timely resolution of MC&A alarms (Alarm Resolution)

11

12 13. management structure and personnel qualification and training

13

14 14. measurements systems

15

16 15. measurement-control system

17

18 16. use of statistics to ensure requirements are met

19

20 17. conduct of periodic physical inventories and reconciliation of book records to the results 

21 of the physical inventories

22

23 18. identification and measurement of shipments and receipts

24

25 19. scrap-control program

26

27 20. independent assessment of the MC&A program

28

29 21. designation of material balance areas, item-control areas, and custodians

30

31 22. tamper-safing

32

33 23. resolving indications of loss, theft, diversion, or misuse of SNM/SSNM

34

35 24. assisting in the investigation and recovery of missing SNM/SSNM

36

37 25. recordkeeping system

38

39 12.3.2 Category II Facility

40

41 For a Category II facility, the staff will review the applicant’s commitments regarding the 

42 following MC&A program areas:

43

44 1. management structure and personnel qualification and training

45

46 2. measurements systems

47

48 3. measurement-control system

49

50 4. use of statistics to ensure requirements are met

51

52 5. conduct of periodic physical inventories and reconciliation of book records to the results 

53 of the physical inventories
May 2014 12-4 NUREG-1520, Revision 2

1

2 6. item-control system

3

4 7. shipper/receiver comparisons

5

6 8. independent assessment of the MC&A program

7

8 9. tamper-safing

9

10 10. designation of material balance areas, item-control areas, and custodians

11

12 11. resolving indications of loss, theft, diversion, or misuse of SNM

13

14 12. assisting in the investigation and recovery of missing SNM

15

16 13. recordkeeping system

17

18 12.3.3 Category III Fuel Fabrication Facility

19

20 For a Category III fuel-fabrication facility, the staff will review the applicant’s commitments 

21 regarding the following MC&A program areas:

22

23 1. management structure and personnel qualification and training

24

25 2. measurements systems

26

27 3. measurement-control system

28

29 4. use of statistics to ensure requirements are met

30

31 5. conduct of periodic physical inventories and reconciliation of book records to the results 

32 of the physical inventories

33

34 6. item-control system

35

36 7. shipper/receiver comparisons

37

38 8. independent assessment of the MC&A program

39

40 9. tamper-safing

41

42 10. designation of material balance areas, item-control areas, and custodians

43

44 11. resolving indications of loss, theft, diversion, or misuse of SNM

45

46 12. assisting in the investigation and recovery of missing SNM

47

48 13. recordkeeping system

49

50
May 2014 12-5 NUREG-1520, Revision 2

1 12.3.4 Category III Enrichment Facility

2

3 For a Category III enrichment facility, the staff will review the applicant’s commitments regarding 

4 the following MC&A program areas:

5

6 1. management structure and personnel qualification and training

7

8 2. measurements systems

9

10 3. measurement-control system

11

12 4. use of statistics to ensure requirements are met

13

14 5. conduct of periodic physical inventories and reconciliation of book records to the results 

15 of the physical inventories

16

17 6. program for precluding and detecting unauthorized production of enriched uranium

18

19 7. item-control system

20

21 8. shipper/receiver comparisons

22

23 9. independent assessment of the MC&A program

24

25 10. tamper-safing

26

27 11. designation of material balance areas, item-control areas, and custodians

28

29 12. resolving indications of missing uranium and of unauthorized production of enriched 

30 uranium

31

32 13. assisting in the investigation and recovery of missing uranium or the investigation of 

33 unauthorized enrichment

34

35 14. recordkeeping system

36

37 Review Interfaces

38

39 In addition to the MC&A Plan, the reviewer should examine information in the following other 

40 areas to ensure that it is consistent with the information in the MC&A Plan:

41

42 • physical security plan applicable to physical protection under SRP Chapter 13

43

44 12.4 Acceptance Criteria

45

46 The acceptance criteria for an applicant’s MC&A program are contained in the NUREGs listed in 

47 Section 12.3 above. A separate NUREG has been developed for each safeguards category 

48 and facility type. Specifics for each safeguards category and facility type are described below.

49

50
May 2014 12-6 NUREG-1520, Revision 2

1 12.4.1 Category I Facility

2

3 12.4.1.1 Regulatory Requirements

4

5 Regulations in Subpart B, “General Reporting and Recordkeeping Requirements,” and 

6 Subpart E, “Formula Quantities of Strategic Special Nuclear Material,” of 10 CFR Part 74 apply 

7 to the establishment of an MC&A program for Category I facilities. The Subpart E requirements 

8 contain the specific MC&A program capabilities needed to establish an acceptable MC&A 

9 program.

10

11 12.4.1.2 Regulatory Guidance

12

13 The NRC regulatory guidance for an acceptable MC&A program applicable to Category I 

14 facilities is NUREG-1280, “Standard Format and Content Acceptance Criteria for the Material 

15 Control and Accounting (MC&A) Reform Amendment.” In addition to the specific guidance in 

16 NUREG-1280, general reporting and recordkeeping guidance for all facilities is contained in:

17

18 1. NUREG/BR-0006, “Instructions for Completing Nuclear Material Transaction Reports.”

19

20 2. NUREG/BR-0007, “Instructions for the Preparation and Distribution of Material Status 

21 Reports.”

22

23 3. NUREG/BR-0096, “Instructions and Guidance for Completing Physical Inventory 

24 Summary Reports.”

25

26 12.4.1.3 Regulatory Acceptance Criteria

27

28 Acceptance criteria are contained in NUREG-1280. This NUREG is divided into separate 

29 chapters for each of the program areas listed in Section 12.3.1 above, and commitments and 

30 acceptance criteria are listed for each program area. The applicant’s MC&A program is 

31 acceptable if the license application provides data and information that meet the commitments 

32 and acceptance criteria listed in NUREG-1280 for each of the program areas.

33345

36 12.4.2 Category II Facility

37

38 12.4.2.1 Regulatory Requirements

39

40 Regulations in Subpart B and Subpart D, “Special Nuclear Material of Moderate Strategic 

41 Significance,” of 10 CFR Part 74 apply to the establishment of an MC&A program for Category II 

42 facilities. The Subpart D requirements contain the specific MC&A program capabilities needed 

43 to establish an acceptable MC&A program.
May 2014 12-7 NUREG-1520, Revision 2

1 12.4.2.2 Regulatory Guidance

2

3 There is currently no specific guidance for Category II facilities. [Note: As part of a proposed 

4 rulemaking for 10 CFR Part 74, draft regulatory guidance has been developed for an acceptable 

5 MC&A program applicable to Category II facilities. Draft NUREG-2159, “Acceptable Standard 

6 Format and Content for the Material Control and Accounting (MC&A) Plan Required for Special 

7 Nuclear Material of Moderate Strategic Significance,” has been noticed for public comment in 

8 78 FR 67224, dated November 8, 2013.] In addition to the specific guidance being developed in 

9 NUREG-2159, general reporting and recordkeeping guidance for all facilities is contained in:

10

11 1. NUREG/BR-0006.

12

13 2. NUREG/BR-0007.

14

15 3. NUREG/BR-0096.

16

17 12.4.2.3 Regulatory Acceptance Criteria

18

19 There are currently no specific acceptance criteria for Category II facilities. [Note: Specific 

20 acceptance criteria have been developed for Category II facilities and are contained in draft 

21 NUREG-2159. This draft NUREG is divided into separate chapters for each of the program 

22 areas listed in Section 12.3.2 above, and commitments and acceptance criteria are listed for 

23 each program area. The applicant’s MC&A program is acceptable if the license application 

24 provides data and information that meet the commitments and acceptance criteria listed in 

25 NUREG-2159 for each of the program areas.]

26

27 12.4.3 Category III Fuel Fabrication Facility

28

29 12.4.3.1 Regulatory Requirements

30

31 Regulations in Subpart B of 10 CFR Part 74 and in 10 CFR 74.31, “Nuclear Material Control and 

32 Accounting for Special Nuclear Material of Low Strategic Significance,” apply to the 

33 establishment of an MC&A program for Category III fuel fabrication facilities. The requirements 

34 in 10 CFR 74.31 cover the specific MC&A program capabilities needed to establish an 

35 acceptable MC&A program.

36

37 12.4.3.2 Regulatory Guidance

38

39 The NRC regulatory guidance for an acceptable MC&A program applicable to Category III fuel 

40 fabrication facilities is NUREG-1065, “Acceptable Standard Format and Content for the 

41 Fundamental Nuclear Material Control (FNMC) Plan Required for Low-Enriched Uranium 

42 Facilities.” In addition to the specific guidance in NUREG-1065, general reporting and 

43 recordkeeping guidance for all facilities is contained in:

44

45 1. NUREG/BR-0006.

46

47 2. NUREG/BR-0007.

48

49 3. NUREG/BR-0096.
May 2014 12-8 NUREG-1520, Revision 2

1 12.4.3.3 Regulatory Acceptance Criteria

2

3 Acceptance criteria are contained in NUREG-1065. This NUREG is divided into separate 

4 chapters for each of the program areas listed in Section 12.3.3 above, and commitments and 

5 acceptance criteria are listed for each program area. The applicant’s MC&A program is 

6 acceptable if the license application provides data and information that meet the commitments 

7 and acceptance criteria listed in NUREG-1065 for each of the program areas.

8

9 12.4.4 Category III Enrichment Facility

10

11 12.4.4.1 Regulatory Requirements

12

13 Regulations in Subpart B of 10 CFR Part 74 and in 10 CFR 74.33, “Nuclear Material Control and 

14 Accounting for Uranium Enrichment Facilities Authorized to Produce Special Nuclear Material of 

15 Low Strategic Significance,” apply to the establishment of an MC&A program for Category III 

16 enrichment facilities. The requirements in 10 CFR 74.33 contain the specific MC&A program 

17 capabilities needed to establish an acceptable MC&A program.

18

19 12.4.4.2 Regulatory Guidance

20

21 The NRC regulatory guidance for an acceptable MC&A program applicable to Category III 

22 enrichment facilities is NUREG/CR-5734, “Recommendations to the NRC on Acceptable 

23 Standard Format and Content for the Fundamental Nuclear Material Control (FNMC) Plan 

24 Required for Low-Enriched Uranium Enrichment Facilities.” In addition to the specific guidance 

25 in NUREG/CR-5734, general reporting and recordkeeping guidance for all facilities is contained 

26 in:

27

28 1. NUREG/BR-0006.

29

30 2. NUREG/BR-0007.

31

32 3. NUREG/BR-0096.

33

34 12.4.4.3 Regulatory Acceptance Criteria

35

36 Acceptance criteria are contained in NUREG/CR-5734. This NUREG is divided into separate 

37 chapters for each of the program areas listed in Section 12.3.4 above, and commitments and 

38 acceptance criteria are listed for each program area. The applicant’s MC&A program is 

39 acceptable if the license application provides data and information that meet the commitments 

40 and acceptance criteria listed in NUREG/CR-5734 for each of the program areas.

41

42 12.5 Review Procedures

43

44 12.5.1 Acceptance Review

45

46 During the acceptance review of a license application, the reviewer should examine the 

47 submittals to identify major deficiencies in the information provided for each area of review 

48 specified in SRP Section 12.3. Reviewers must decide whether they have enough information 

49 to proceed with a detailed review. Less significant errors or deficiencies that can be addressed 

50 in a request for additional information should be accepted. However, before the NRC performs 

51 a detailed review, the applicant should correct major deficiencies that would require several 

52 requests for additional information to resolve. 
May 2014 12-9 NUREG-1520, Revision 2

1 Reviewers should record whether each area of review is adequately addressed in the 

2 application, is adequately addressed in a referenced document, is not applicable to the 

3 application, or has a major deficiency.

4

5 12.5.2 Safeguards Evaluation

6

7 During the safeguards evaluation, the reviewer determines whether the application 

8 comprehensively describes the MC&A program areas/capabilities, as identified in SRP 

9 Section 12.3, and whether the program meets the objectives and capabilities specified in 

10 10 CFR Part 74. For deviations from the specific acceptance criteria, the staff should review the 

11 applicant’s explanation of how the proposed alternatives to the SRP criteria provide an 

12 acceptable method of complying with the relevant NRC requirements identified in Section 12.4. 

13 During the initial review, the reviewer should draft the safety evaluation report (SER) described 

14 below. A request for additional information (RAI) will be prepared when clarification and 

15 additional information are needed to determine if the licensee’s submittals comply with the 

16 regulations. The primary reviewer should coordinate with the licensing project manager in 

17 preparing RAIs. Additional information submitted by the applicant will be evaluated and a final 

18 SER will be provided to the licensing project manager.

19

20 For an existing facility, the reviewer may consult NRC MC&A inspectors to identify and resolve 

21 any issues related to the licensing review. For a planned facility, the reviewer may wish to 

22 consult with the facility MC&A team to gain a better understanding of the process and its MC&A 

23 program. The reviewer should coordinate these interactions through the licensing project 

24 manager.

25

26 The reviewer will prepare a safeguards evaluation report (SER) for the licensing project 

27 manager in support of the licensing action.

28

29 12.6 Evaluation Findings

30

31 The regulations in 10 CFR 70.23, “Requirements for the Approval of Applications,” and 70.66, 

32 “Additional Requirements for Approval of License Application,” state that an application for a 

33 license will be approved if the Commission can make the general findings listed in those 

34 sections. The basis for the general findings is an evaluation of whether the application 

35 adequately addresses all of the applicable regulatory requirements. More specifically, the staff’s 

36 evaluation should determine whether the licensing submittals provide sufficient information to 

37 satisfy the regulatory requirements listed in SRP Section 12.4, and that the applicant has 

38 appropriately addressed the regulatory acceptance criteria discussed there. The SER should 

39 state how the applicable regulatory requirements have or have not been met based on the 

40 acceptance criteria. If the applicant chooses to use an alternative approach, the reviewer should 

41 discuss in the SER whether the proposed approach satisfies the applicable regulatory 

42 requirements. The reviewers should use the following approach to document their evaluation:

43

44 1. State a specific regulatory requirement that applies to the application. Detailed 

45 acceptance criteria may be included where appropriate or necessary to clarify the 

46 requirement.

47

48 2. Identify the areas where the regulatory requirement is addressed in the application, 

49 including the areas where the specific acceptance criteria described in this SRP are 

50 addressed. 
May 2014 12-10 NUREG-1520, Revision 2

1 3. Describe your evaluation of the application, the basis for your conclusion, and whether it 

2 meets the regulatory requirement.

3

4 4. Repeat these steps for every regulatory requirement that applies to the application.

5

6 There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

7 application or amendment request, (2) denial of the application or request, or (3) approval with 

8 conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

9 reviewer may consider proposing a license condition. Absent an NRC order, license conditions 

10 must be agreed upon with the licensee or applicant before becoming part of the license. 

11 A license condition should only be proposed if there is reasonable assurance that, if the 

12 licensee meets the condition, all regulatory requirements will be satisfied. Thus, license 

13 conditions should not be used to cover major deficiencies in an application. License conditions 

14 should be unambiguous, inspectable, and enforceable. They should only require those actions 

15 necessary to ensure compliance with applicable regulations. The basis for license conditions 

16 must be documented in the SER. 

17

18 The SER should include a summary statement of what the NRC staff evaluated and the basis 

19 for the reviewer’s conclusions similar to the following (this is an example for a Category III 

20 facility):

21

22 The staff has evaluated the application using the criteria listed previously. Based 

23 on the review of the license application, the NRC staff concludes that the 

24 applicant provided an acceptable FNMC plan for the proposed facility, and that 

25 the 10 CFR 70.23(a)(6) requirement for approving applications has therefore 

26 been met. The FNMC plan describes acceptable methods for achieving the 

27 performance objectives in 10 CFR 74.31(a) and the system capabilities of 

28 10 CFR 74.31(c). As a result, the staff has determined that the applicant meets 

29 the MC&A requirements in 10 CFR Part 74. The staff therefore finds there is 

30 reasonable assurance that the MC&A program will detect and protect against the 

31 loss, theft, or diversion of SNM that the applicant will possess, store, and utilize 

32 at its facility.

33

34 In accordance with 10 CFR 70.32(c), each license authorizing the use of uranium 

35 source material at a uranium enrichment facility, or authorizing the use of special 

36 nuclear material in a quantity exceeding one effective kilogram, must contain a 

37 license condition to ensure that such material is adequately controlled and 

38 accounted for within the licensed facility. The license will therefore contain the 

39 following license condition:

40

41 “The licensee shall follow its FNMC plan with respect to all activities involving 

42 special nuclear material. The approved plan consists of [identify revision], or as it 

43 may be further revised pursuant to 10 CFR 70.32(c).

44

45 12.7 References

46

47 U.S. Code of Federal Regulations, “Domestic Licensing of Special Nuclear Material,” Part 70, 

48 Chapter I, Title 10, “Energy.”

49

50 U.S. Code of Federal Regulations, “Material Control and Accounting of Special Nuclear 

51 Material,” Part 74, Chapter I, Title 10, “Energy.”
May 2014 12-11 NUREG-1520, Revision 2

1 U.S. Nuclear Regulatory Commission, “Instructions for Completing Nuclear Material Transaction 

2 Reports,” NUREG/BR-0006.

3

4 U.S. Nuclear Regulatory Commission, “Instructions for the Preparation and Distribution of 

5 Material Status Reports,” NUREG/BR-0007.

6

7 U.S. Nuclear Regulatory Commission, “Instructions and Guidance for Completing Physical 

8 Inventory Summary Reports,” NUREG/BR-0096.

9

10 U.S. Nuclear Regulatory Commission, “Acceptable Standard Format and Content for the 

11 Fundamental Nuclear Material Control (FNMC) Plan Required for Low-Enriched Uranium 

12 Facilities,” NUREG-1065.

13

14 U.S. Nuclear Regulatory Commission, “Standard Format and Content Acceptance Criteria for 

15 the Material Control and Accounting (MC&A) Reform Amendment,” NUREG-1280.

16

17 U.S. Nuclear Regulatory Commission, “Acceptable Standard Format and Content for the 

18 Material Control and Accounting (MC&A) Plan Required for Special Nuclear Material of 

19 Moderate Strategic Significance,” Draft NUREG-2159. [Note: Draft NUREG-2159 has been 

20 developed as part of a proposed rulemaking for 10 CFR Part 74. The new draft guidance has 

21 been noticed for public comment in 78 FR 67224, dated November 8, 2013.]

22

23 U.S. Nuclear Regulatory Commission, “Recommendations to the NRC on Acceptable Standard 

24 Format and Content for the Fundamental Nuclear Material Control (FNMC) Plan Required for 

25 Low-Enriched Uranium Enrichment Facilities,” NUREG/CR-5734.

26

May 2014 13-1 NUREG-1520, Revision 2

13. PHYSICAL PROTECTION

1 13.1 Purpose of Review

2

3 The purpose of this review is to determine if the applicant has committed to establish and 

4 maintain a physical protection system, as required by Title 10, “Energy,” of the Code of Federal 

5 Regulations (10 CFR) Part 73, “Physical Protection of Plants and Materials,” and 10 CFR 

6 Part 70, “Domestic Licensing of Special Nuclear Material.” The review should establish that the 

7 applicant’s physical protection system provides reasonable assurance that its activities involving 

8 the protection of special nuclear material (SNM) are not inimical to the common defense and 

9 security and do not constitute an unreasonable risk to the public health and safety. Certain 

10 10 CFR Part 73 requirements, such as the 10 CFR 73.20(a) general performance objectives, 

11 require “high assurance” that licensed activities involving formula quantities of strategic special 

12 nuclear material (SSNM) are not inimical to the common defense and security and do not 

13 constitute an unreasonable risk to the public health and safety.

14

15 13.2 Responsibility for Review

16

17 Primary: Physical Protection Specialist

18

19 Secondary: Licensing Project Manager

20

21 Supporting: Regional Physical Protection Inspector

22

23 The licensing project manager will receive information from the applicant and coordinate the 

24 review by the various technical disciplines involved. The physical protection specialist is 

25 responsible for reviewing all materials submitted in response to 10 CFR Part 73 requirements 

26 and determining the adequacy of the proposed physical protection system.

27

28 13.3 Areas of Review

29

30 As specified in 10 CFR 70.22, “Contents of Application,” an applicant may need to submit one or 

31 more plans to demonstrate compliance with physical security requirements. The specific 

32 physical security requirements for the contents of applications for facilities regulated under 

33 10 CFR Part 70 include the following:

34

35 • 10 CFR 70.22(g)—Physical Protection of SNM in Transit

36

37 • 10 CFR 70.22(h)—Physical Security Plan for Formula Quantities

38

39 • 10 CFR 70.22(j)—Safeguards Contingency Plan for Formula Quantities

40

41 • 10 CFR 70.22(k)—Physical Security Plan for SNM of Moderate Strategic Significance 

42 and Low Strategic Significance

43

44 Each of the requirements listed above references more detailed requirements in 10 CFR 

45 Part 11, “Criteria and Procedures for Determining Eligibility for Access to or Control over Special 

46 Nuclear Material,” and 10 CFR Part 73 regarding the physical security of SNM at fixed sites and 

47 in transit. The application must contain or reference the plans which demonstrate compliance 

48 with all of the requirements that apply to the authorization being requested in the license 

49 application.
May 2014 13-2 NUREG-1520, Revision 2

Table 13.1 Categories of Materials

Material Isotopic

Composition

Category I

Formula 

Quantities

Category II

Moderate Strategic 

Significance

Category III

Low Strategic 

Significance

Plutonium

All plutonium 

(element)

2,000 gram

s or more

Less than 

2,000 grams, but 

more than 500 grams

500 grams or 

less, but more 

than 15 grams

Uranium-233 All U-233 

enrichments

2,000 gram

s or more

Less than 

2,000 grams, but 

more than 500 grams

500 grams or 

less, but more 

than 15 grams

Uranium-235

Uranium 

enriched to 

20% or more 

in isotope 

U-235

5,000 gram

s or more

Less than 

5,000 grams, but 

more than 

1,000 grams

1,000 grams or 

less, but more 

than 15 grams

Uranium 

enriched to 

10%, but less 

than 20%, in 

isotope U-235

N/A 10,000 grams or 

more

Less than 

10,000 grams, 

but more than 

1,000 grams

Uranium 

enriched 

above 0.711%, 

but less than 

10%, in 

isotope U-235

N/A N/A 10,000 grams or 

more

1 13.3.1 Formula Quantity of Strategic Special Nuclear Material

2

3 For a Category I facility, the staff will review the applicant’s physical protection plan in 

4 accordance with the applicable regulations. The applicant may choose to have one physical 

5 protection plan addressing all the applicable requirements or have separate plans for each 

6 specific area described in the regulations. When applicable, the reviewer will review the 

7 applicant’s commitments regarding the following physical protection program areas:

8

9 1. Plan for Protection of Formula Quantities in Transit—The license application includes a 

10 plan addressing the detailed requirements in 10 CFR Part 73 (including those in 

11 10 CFR 73.1, “Purpose and Scope”; 73.20, “General Performance Objective and 

12 Requirements”; 73.25, “Performance Capabilities for Physical Protection of Strategic 

13 Special Nuclear Material in Transit”; and 73.26, “Transportation Physical Protection 

14 Systems, Subsystems, Components, and Procedures”). Note that 10 CFR 73.6(d) 

15 exempts licensees from transportation security requirements if the SNM is transported 

16 by the United States Department of Energy (DOE) transport system. Most high enriched 

17 uranium is moved by the DOE system. If the application states that the DOE transport 

18 system is used, no transportation security plan is required.

19
May 2014 13-3 NUREG-1520, Revision 2

1 2. Plan for Protection of Formula Quantities at Fixed Sites—The license application 

2 includes a plan addressing the detailed access authorization requirements in 10 CFR 

3 Part 11 (including those in 10 CFR 11.11, “General Requirements”; and 11.15, 

4 “Application for Special Nuclear Material Access Authorization”) and the applicable 

5 10 CFR Part 73 requirements (including those in 10 CFR 73.1; 73.20; 73.45, 

6 “Performance Capabilities for Fixed Site Physical Protection Systems”; and 73.46, “Fixed 

7 Site Physical Protection Systems, Subsystems, Components, and Procedures”).

8

9 3. Security Training and Qualification Plan—The license application includes a plan 

10 addressing the detailed training and qualification requirements in Part 73 for security 

11 personnel (see Appendix B, “General Criteria for Security Personnel,” to Part 73). 

12 Applicants often address these requirements in a separate training and qualification 

13 plan.

14

15 4. Safeguards Contingency Plan—The application must include a plan addressing how the 

16 licensee will engage and impede adversaries. Such plans are subject to the 

17 requirements in Appendix C, “Nuclear Power Plant Safeguards Contingency Plans,” to 

18 Part 73, unless 10 CFR 73.55 (“Requirements for Physical Protection of Licensed 

19 Activities in Nuclear Power Reactors against Radiological Sabotage”) is applicable, in 

20 which case those requirements are applicable.

21

22 Associated guidance and reference documents are listed in SRP Section 13.4.

23

24 13.3.2 Moderate Strategic or Low Strategic Special Nuclear Material

25

26 For Category II and Category III facilities, the staff will review the applicant’s physical-protection 

27 plan in accordance with the applicable regulations and will review the applicant’s physical 

28 protection program commitments associated with moderate strategic or low strategic SNM.

29

30 Review Interfaces

31

32 The reviewer should examine information in the following other areas to ensure that it is 

33 consistent with the information provided for physical protection:

34

35 • Coordinate with the reviewer of the Material Control and Accounting plan applicable to 

36 physical protection under SRP Chapter 12.

37

38 • Proposed quantities of SNM to be possessed, used or produced by the applicant as 

39 stated in the Part 70 application or existing license.

40

41 13.4 Acceptance Criteria

42

43 Acceptance criteria for an applicant’s physical security plan are based on meeting the relevant 

44 requirements of the regulations described in this section. Separate NUREGs have been 

45 developed for each facility type.
May 2014 13-4 NUREG-1520, Revision 2

1 13.4.1 Formula Quantity of Strategic Special Nuclear Material

2

3 13.4.1.1 Regulatory Requirements

4

5 Acceptance criteria are based on meeting the relevant physical protection requirements of the 

6 following regulations:

7

8 1. 10 CFR 73.1 defines the design basis threat a safeguards system must be designed to 

9 protect against.

10

11 2. 10 CFR 73.20 defines the general performance objective and requirements for fixed-site 

12 physical protection systems.

13

14 3. 10 CFR 73.45 defines the performance capabilities for fixed-site physical protection 

15 systems.

16

17 4. 10 CFR 73.46 describes the specific measures for fixed-site physical protection systems, 

18 subsystems, components, and procedures.

19

20 5. Appendices B; C; G, “Reportable Safeguards Events”; and H, “Weapons Qualification 

21 Criteria,” to Part 73 provide additional requirements applicable to applicants possessing 

22 formula quantities of SSNM.

23

24 6. 10 CFR 73.1; 73.20; 73.25; 73.26; and 73.70, “Records,” describe in detail the 

25 requirements for transportation of formula quantities of SSNM.

26

27 13.4.1.2 Regulatory Guidance

28

29 The following documents contain some of the regulatory guidance that is relevant to physical 

30 protection of formula quantities of SSNM:

31

32 1. International Atomic Energy Agency (IAEA), “The Physical Protection of Nuclear Material 

33 and Nuclear Facilities,” Information Circular 225, Rev. 5 (corrected), Vienna, Austria,

34 June 1999.

35

36 2. U.S. Nuclear Regulatory Commission, “User's Guide to Physical Protection Documents 

37 Published by the NRC,” NUREG/BR-0252, November 1998.

38

39 3. U.S. Nuclear Regulatory Commission, “Standard Review Plan for Training and 

40 Qualifications Plans for Security Personnel at Category I Fuel Facilities,” 

41 NUREG/CR-6668, May 2000.

42

43 4. U.S. Nuclear Regulatory Commission, “Training, Equipping, and Qualifying of Guards 

44 and Watchmen,” Regulatory Guide (RG) 5.20, September 2011.

45

46 5. U.S. Nuclear Regulatory Commission, “Perimeter Intrusion Alarm Systems,” RG 5.44, 

47 October 1997.

48

49 6. U.S. Nuclear Regulatory Commission, “Standard Format and Content of a Licensee 

50 Physical Protection Plan for Strategic Special Nuclear Material at Fixed Sites (Other than 

51 Nuclear Power Plants),” RG 5.52, Rev. 3, December 1994.
May 2014 13-5 NUREG-1520, Revision 2

1 7. U.S. Nuclear Regulatory Commission, “Standard Format and Content of Safeguards 

2 Contingency Plans for Fuel Cycle Facilities (for Comment),” RG 5.55, March 1978.

3

4 8. U.S. Nuclear Regulatory Commission, “Standard Format and Content of Safeguards 

5 Contingency Plans for Transportation (for Comment),” RG 5.56, March 1978.

6

7 9. U.S. Nuclear Regulatory Commission, “Shipping and Receiving Control of Strategic 

8 Special Nuclear Material,” RG 5.57, June 1980.

9

10 10. U.S. Nuclear Regulatory Commission, “Standard Format and Content of a Licensee 

11 Physical Protection Plan for SSNM in Transit,” RG 5.60, September 2011.

12

13 13.4.1.3 Regulatory Acceptance Criteria

14

15 The primary reviewer will find the applicant's physical protection system acceptable if the 

16 applicant’s commitments are consistent with the regulations identified above and with security 

17 orders issued by the Commission. With respect to any physical-protection plan regarding 

18 formula quantities of SSNM, the primary reviewer will confirm that such a plan contains

19 inspectable commitments.

20

21 13.4.2 Moderate Strategic or Low Strategic Special Nuclear Material

22

23 13.4.2.1 Regulatory Requirements

24

25 Acceptance criteria for possession, use, or transport of moderate strategic or low strategic SNM 

26 are based on meeting the relevant requirements of the following regulations:

27

28 1. 10 CFR 73.67(a) contains the general performance objectives that are applicable to 

29 applicants who plan to possess, use, or transport SNM of moderate or low strategic 

30 significance.

31

32 2. 10 CFR 73.67(d) through (g) contain the requirements for a security plan for each

33 applicant who plans to possess, use, or transport SNM of moderate strategic 

34 significance, or who plans to possess, use, or transport 10 kilograms or more of SNM of 

35 low strategic significance.

36

37 3. 10 CFR 73.67(d) through (e) contain the fixed-site and in-transit requirements applicable 

38 to SNM of moderate or low strategic significance.

39

40 4. Compliance with Commission-issued orders, if applicable.

41

42 13.4.2.2 Regulatory Guidance

43

44 The following documents contain some of the regulatory guidance that is relevant to physical 

45 protection of moderate- or low-significance SSNM:

46

47 1. IAEA, “The Physical Protection of Nuclear Material and Nuclear Facilities,” Information 

48 Circular 225, Rev. 5 (corrected), Vienna, Austria, June 1999.

49

50 2. U.S. Nuclear Regulatory Commission, “User's Guide to Physical Protection Documents 

51 Published by the NRC,” NUREG/BR-0252, November 1998.
May 2014 13-6 NUREG-1520, Revision 2

1 3. U.S. Nuclear Regulatory Commission, “Standard Format and Content for a Licensee 

2 Physical Security Plan for the Protection of Special Nuclear Material of Moderate or Low 

3 Strategic Significance,” RG 5.59, Rev. 1, February 1983.

4

5 13.4.2.3 Regulatory Acceptance Criteria

6

7 The reviewer will find the applicant's physical protection system acceptable if the physical 

8 protection plan meets the requirements of 10 CFR 73.67, “Licensee Fixed Site and In-Transit 

9 Requirements for the Physical Protection of Special Nuclear Material of Moderate and Low 

10 Strategic Significance,” as well as the requirements of any Commission security orders. The 

11 physical protection plan for applicants possessing moderate- or low-significance quantities of 

12 SNM should contain inspectable commitments that shall be the basis for the NRC 

13 physical-protection inspection program. Therefore, it is imperative that commitments be 

14 expressed in unambiguous terms. Specific topics required by regulation are delineated in more 

15 detail in the current version of Regulatory Guide 5.59.

16

17 13.5 Review Procedures

18

19 13.5.1 Acceptance Review

20

21 The applicant is expected to provide one or more plans to demonstrate compliance with 

22 the physical-security requirements specified in 10 CFR 70.22, “Contents of 

23 Applications.” During the acceptance review of a license application, the reviewer 

24 should examine the submittals to identify major deficiencies in the information provided 

25 for each area of review specified in SRP Section 13.3. Reviewers must decide whether 

26 they have enough information to proceed with a detailed review. Less significant errors 

27 or deficiencies that can be addressed in a single request for additional information 

28 should be accepted. However, before the NRC performs a detailed review, the 

29 applicant should correct major deficiencies that would require several requests for 

30 additional information to resolve.

31

32 Reviewers should record whether each area of review is adequately addressed in the 

33 application, is adequately addressed in a referenced document, is not applicable to the 

34 application, or has a major deficiency.

35

36 13.5.2 Safety Evaluation

37

38 During the safety evaluation, the reviewer determines whether the physical security plan (or 

39 “plans” if the applicant chose to separate them) included in the application establishes physical 

40 protection systems meeting the objectives and capabilities specified in 10 CFR 70.22, 10 CFR 

41 Part 73, and applicable security orders. The primary reviewer will perform a safety evaluation 

42 with respect to the acceptance criteria in Section 13.4. During the initial review, the reviewer 

43 should draft the safety evaluation report (SER) described below. A request for additional 

44 information (RAI) will be prepared when clarification and additional information are needed to 

45 determine whether the licensee’s submittals comply with the regulations. The primary reviewer 

46 should coordinate with the licensing project manager in preparing RAIs. Additional information 

47 submitted by the applicant will be evaluated and a final SER will be provided to the licensing 

48 project manager.

49 13.6 Evaluation Findings
May 2014 13-7 NUREG-1520, Revision 2

1

2 The regulations in 10 CFR 70.23, “Requirements for the Approval of Applications,” and 70.66, 

3 “Additional Requirements for Approval of License Application,” state that an application for a 

4 license will be approved if the Commission can make the general findings listed in those 

5 sections. The basis for the general findings is an evaluation of whether the application 

6 adequately addresses all of the applicable regulatory requirements. More specifically, the staff’s 

7 evaluation should determine whether the licensing submittals provide sufficient information to 

8 satisfy the regulatory requirements referenced in this SRP Chapter. The SER should state how 

9 the applicable regulatory requirements have or have not been met based on the acceptance 

10 criteria described in this chapter of the SRP. If the applicant chooses to use an alternative 

11 approach, the reviewer should discuss in the SER whether the proposed approach satisfies the 

12 applicable regulatory requirements. The reviewers should use the following approach to 

13 document their evaluation:

14

15 1. State a specific regulatory requirement that applies to the application. Detailed 

16 acceptance criteria may be included where appropriate or necessary to clarify the 

17 requirement.

18

19 2. Identify the areas where the regulatory requirement is addressed in the application, 

20 including the areas where the specific acceptance criteria described in this SRP are 

21 addressed. 

22

23 3. Describe your evaluation of the application, the basis for your conclusion, and whether it 

24 meets the regulatory requirement.

25

26 4. Repeat these steps for every regulatory requirement that applies to the application.

27

28 There are three possible outcomes to the staff’s licensing review: (1) approval of the applicant’s 

29 application or amendment request, (2) denial of the application or request, or (3) approval with 

30 conditions. If the reviewer cannot make a finding of a reasonable assurance of safety, the 

31 reviewer may consider proposing a license condition. Absent an NRC order, license conditions 

32 must be agreed upon with the licensee or applicant before becoming part of the license. 

33 A license condition should only be proposed if there is reasonable assurance that, if the 

34 licensee meets the condition, all regulatory requirements will be satisfied. Thus, license 

35 conditions should not be used to cover major deficiencies in an application. License conditions 

36 should be unambiguous, inspectable, and enforceable. They should only require those actions 

37 necessary to ensure compliance with applicable regulations. The basis for license conditions 

38 must be documented in the SER.

39

40 If the submittal is acceptable, the final SER security input should conclude with a statement 

41 similar to the following:

42

43 Based on the evaluation described above, the NRC staff finds that the 

44 plan(s) for physical protection of SNM provide reasonable assurance [or 

45 “high assurance” if the application pertains to formula quantities of 

46 strategic SNM] that the licensee will provide adequate protection during 

47 the term of the license. The staff concludes that the applicant provided an 

48 acceptable physical protection plan for the proposed facility that will meet 

49 the applicable requirements specified in 10 CFR Part 73.

50
May 2014 13-8 NUREG-1520, Revision 2

1 13.7 References

2

3 U.S. Code of Federal Regulations, “Criteria and Procedures for Determining Eligibility for 

4 Access to or Control over Special Nuclear Material,” Part 11, Chapter I, Title 10, “Energy.”

5

6 U.S. Code of Federal Regulations, “Access Authorization for Licensee Personnel,” Part 25, 

7 Chapter I, Title 10, “Energy.”

8

9 U.S. Code of Federal Regulations, “Physical Protection of Plants and Materials,” Part 73, 

10 Chapter I, Title 10, “Energy.”

11

12 U.S. Code of Federal Regulations, “Security Facility Approval and Safeguarding of National 

13 Security Information and Restricted Data,” Part 95, Chapter I, Title 10, “Energy.”

14

15 U.S. Nuclear Regulatory Commission, “Entry/Exit Control for Protected Areas, Vital Areas, and 

16 Material Access Areas,” Regulatory Guide (RG) 5.7, Rev. 1, May 1980.

17

18 U.S. Nuclear Regulatory Commission, “Perimeter Intrusion Alarm Systems,” RG 5.44, Rev. 3, 

19 October 1997.

20

21 U.S. Nuclear Regulatory Commission, “Standard Format and Content of a Licensee Physical 

22 Protection Plan for Strategic Special Nuclear Material at Fixed Sites (Other than Nuclear Power 

23 Plants),” RG 5.52, Rev. 3, December 1994.

24

25 U.S. Nuclear Regulatory Commission, "Standard Format and Content of Safeguards 

26 Contingency Plans for Fuel Cycle Facilities," RG 5.55, March 1978.



UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON, DC 20555-0001

------------------

OFFICIAL BUSINESS
NUREG-1520, Rev. 2

Draft

Standard Review Plan for License Applications for Fuel Cycle Facilities