Double contingency

Double contingencies which have some remote interrelationship and which could develop pressures or temperatures sufficient to cause catastrophic failure. 

Generally the moderation in powder area is limited. For each unit, one makes a choice of the criticality control mode (1) mass in process equipment (interlinks and administrative measures) or (2) shape and size in storage areas (hardware). The double contingency principle will be applied. Calculations will be done using fixed conservative values for densities of products, a water reflector, and as acceptance criteria a K-eff. below 0.95 or the safety factors given in Table 4. 

For criticality hazards, the double contingency approach is employed, and in some cases probabilistic techniques are employed to demonstrate that a limiting criterion can be met. However, the minimal amounts of fissile material in waste vitrified product mean that no detailed criticality assessments are required. 

One remaining barrier to significant injury, electric shock (>50 volts AC), radiation exposure (one event >1000 mr uptake, intake or Committed Effective Dose Equivalent [CEDE]) or Industrial Hygience Exposure (>3 times OSHA limits), exceed criticality limit or double contingency is not maintained... 

Table 6.4-3 Double Contingency Analysis for HCF Operations with Fissile Material.6-6...

A CSA (Mitchell and Romero, 1999) has been prepared and approved in accordance with the ES H Manual Supplement to evaluate the criticality concerns and document the basis, for operating limitations for planned uses of fissile materials in the HCF. Both engineered features and administrative limits are used to prevent inadvertent criticality in the HCF. These features and limits are based on physical principals of mass, geometry, and neutron moderation to provide high confidence that criticality cannot occur in the HCF under all normal, abnormal, and accident conditions. They provide the basis for an assessment of the application of the double-contingency principle implemented in the HCF. 

A CSA is required for operations that involve total amounts of fissile material in excess of the threshold amount for non-aqueous forms (700 g U) where formal criticality safety evaluations and controls are required [Philbin, 1998, Criticality Safety Supplement to the SNL ES H Manual, Applicability Section]. The CSA requires that process designs incorporate a double-contingency principle so that at least two unlikely, independent, and concurrent changes in process conditions must occur before an accidental nuclear criticality is possible. Table 6.4-3 is a qualitative summary of the double contingency analysis from the CSA for isotope processing [Mitchell and Romero, 1999 (draft). Section 5]. 

The Double Contingency Principle has been, employed for many years as a convenient and reasonably uniform method determining acceptability of proposed fissionable materials processes and activities. 

As an adjunct to the Double Contingency Principle, it is advisable to adopt additional safeguards if impact on productivity and costs is negligible. 

Within the Central Electricity Generating Board (CEGB), the "double contingency" principle is adopted in considering criticality in the CAGR fuel routes. Thus, at least two Independent low-probability events must occur before criticality can be reached. For clearances based on calculations a criterion is adopted that if one such event takes place, the cMculated Keff plus an appropriate allowance for uncertainties should be <0.95. This uncertainty allowance includes a systematic component and a random component, statistics plus data, etc., taken at the three standard deviation levels. Two computer codes are employed, the lattice code WIMS (Ref. 1) for survey work and the Monte Carlo cbcle MONK (Ref. 2) for... 

Fault tree methods were used to analyze this complex facility to reduce the required assay points and to ensure full coverage of the facility by the double-contingency principle. Tliat principle states that defense against a criticality accident must incorporate sufficient barriers so that no single failure can by itself produce the accident. 

Coverage by the double-contingency principle is ensured when every pathway from basic cause to final outcome goes through at least one AND gate. Sometimes events are not true faults in the sense that conservative safety philosophy demands that worst-case conditions be assumed as normal operating conditions in the absence of controls. 

An AND gate that joins such an event with just one other fault must be ignored in the analysis for double-contingency coverage. 

DOE Order 5480.24 defined the criteria that were to be used to develop the criticality safety program. In general, the order referenced the Accreditation process for developers of American National Standards (ANS/ANSl) as the criteria for an adequate nuclear criticality safety program. Two levels of verification of acceptable nuclear risks were identified. The first is the "double contingency" process. To be double contingent means that two unlikely process events are required before a criticality is possible. 

Double Contingency Principle. Process designs should incorporate sufficient factors of safety to require at least two unlikely, independent, and concurrent changes in process... 

Based on this double contingency principle, the normal case and each of the contingencies— considered one at a time—must be determined to be subcritical to establish the safety of the operation. The method that is best used to establish this subcriticality depends on the complexity of the parametric case. 

---