Double contingency principle

Generally the moderation in powder area is limited. For each unit, one makes a choice of the criticality control mode (1) mass in process equipment (interlinks and administrative measures) or (2) shape and size in storage areas (hardware). The double contingency principle will be applied. Calculations will be done using fixed conservative values for densities of products, a water reflector, and as acceptance criteria a K-eff. below 0.95 or the safety factors given in Table 4. 

A CSA (Mitchell and Romero, 1999) has been prepared and approved in accordance with the ES H Manual Supplement to evaluate the criticality concerns and document the basis, for operating limitations for planned uses of fissile materials in the HCF. Both engineered features and administrative limits are used to prevent inadvertent criticality in the HCF. These features and limits are based on physical principals of mass, geometry, and neutron moderation to provide high confidence that criticality cannot occur in the HCF under all normal, abnormal, and accident conditions. They provide the basis for an assessment of the application of the double-contingency principle implemented in the HCF. 

A CSA is required for operations that involve total amounts of fissile material in excess of the threshold amount for non-aqueous forms (700 g U) where formal criticality safety evaluations and controls are required [Philbin, 1998, Criticality Safety Supplement to the SNL ES H Manual, Applicability Section]. The CSA requires that process designs incorporate a double-contingency principle so that at least two unlikely, independent, and concurrent changes in process conditions must occur before an accidental nuclear criticality is possible. Table 6.4-3 is a qualitative summary of the double contingency analysis from the CSA for isotope processing [Mitchell and Romero, 1999 (draft). Section 5]. 

The Double Contingency Principle has been, employed for many years as a convenient and reasonably uniform method determining acceptability of proposed fissionable materials processes and activities. 

As an adjunct to the Double Contingency Principle, it is advisable to adopt additional safeguards if impact on productivity and costs is negligible. 

Within the Central Electricity Generating Board (CEGB), the "double contingency" principle is adopted in considering criticality in the CAGR fuel routes. Thus, at least two Independent low-probability events must occur before criticality can be reached. For clearances based on calculations a criterion is adopted that if one such event takes place, the cMculated Keff plus an appropriate allowance for uncertainties should be <0.95. This uncertainty allowance includes a systematic component and a random component, statistics plus data, etc., taken at the three standard deviation levels. Two computer codes are employed, the lattice code WIMS (Ref. 1) for survey work and the Monte Carlo cbcle MONK (Ref. 2) for... 

Fault tree methods were used to analyze this complex facility to reduce the required assay points and to ensure full coverage of the facility by the double-contingency principle. Tliat principle states that defense against a criticality accident must incorporate sufficient barriers so that no single failure can by itself produce the accident. 

Coverage by the double-contingency principle is ensured when every pathway from basic cause to final outcome goes through at least one AND gate. Sometimes events are not true faults in the sense that conservative safety philosophy demands that worst-case conditions be assumed as normal operating conditions in the absence of controls. 

Double Contingency Principle. Process designs should incorporate sufficient factors of safety to require at least two unlikely, independent, and concurrent changes in process... 

Based on this double contingency principle, the normal case and each of the contingencies— considered one at a time—must be determined to be subcritical to establish the safety of the operation. The method that is best used to establish this subcriticality depends on the complexity of the parametric case. 

---