Waste, Fuel Cycle & Decommissioning · C-WD-007
Nuclear Criticality Safety — Eight Parameters That Keep keff Below 1 Outside the Core, and the Double Contingency Principle
Mass, geometry, moderation, reflection, concentration, interaction, enrichment and absorbers keep keff of fissile material outside the core below 0.95 at 95/95.
Nuclear criticality safety is the set of activities that prevent an unintended self-sustaining chain reaction — a criticality accident — when fissile material is handled, processed, stored or transported outside a reactor core, and that mitigate the consequences if one should occur. IAEA SSG-27 Rev.1 (2022) excludes from its scope systems such as reactor cores that are deliberately operated critical. It is therefore a different subject from the shutdown margin of the core.
In short: criticality safety means keeping keff of fissile material outside the core sufficiently below 1, including biases and uncertainties, by controlling mass, geometry, moderation, reflection, concentration, interaction, enrichment and absorbers, with the design based on the double contingency principle.
Principle and mechanism
Three ways to lower keff
keff = production ÷ (absorption + leakage)
Subcriticality can be secured only by reducing production, increasing absorption or increasing leakage. In one-group form keff = k∞/(1 + M²B²); the smaller or thinner the geometry, the larger Bg² and the greater the leakage.
Eight control parameters
The ANSI/ANS-8.1 family of documents lists the following parameters as subjects of control. Some textbooks count volume separately and give nine.
| Parameter | Toward subcriticality | Example of application |
|---|---|---|
| Mass | Mass limit per unit | Process batch mass limits |
| Geometry | Thin cylinders, thin slabs | Safe-geometry vessels, rack cells |
| Moderation | Avoid optimum moderation, H/X limits | Dry storage of fresh fuel |
| Reflection | Evaluate reflection conservatively | Water, concrete, the human body |
| Concentration | Below validated concentration limits | Conversion and reprocessing solutions |
| Interaction | Maintain spacing between units | Rack pitch, transport CSI |
| Enrichment | Set an upper limit | LWR example: 5.0 wt% or less |
| Neutron absorbers | Fixed and soluble absorbers | Boral and Metamic plates, borated water |
H/X is the ratio of hydrogen atoms to fissile atoms; CSI is the criticality safety index of a package.
Besides these controllable parameters, some properties are intrinsic to the material and cannot be changed during the process: the fissile nuclide and isotopic composition (cross sections, ν), chemical and physical form (metal, oxide, solution), density and heterogeneity (rod lattice, particles). Neutron poisons, i.e. absorbers, are the last parameter in the table.
Moderation has an optimum
The graph on the left of this figure comes from an educational modified one-group calculation for a homogeneous ²³⁵U–water mixture as a bare sphere, assuming 2200 m/s cross sections, τ = 27 cm² and L²(water) = 8.1 cm². As the H/²³⁵U atom ratio increases, the critical radius keeps growing. The critical mass, however, reaches a minimum of about 1.8 kg at H/U ≈ 600 (about 43 g/L) and rises again on the over-moderated side. At H/U ≈ 2,180 (about 12 g/L) k∞ = 1, so in this homogeneous model there is no finite critical size for more dilute solutions. In real processes precipitation, evaporation or loss of homogeneity can raise local concentrations, so concentration control is used together with validated limits. Actual values differ because of reflection, temperature and fast effects. The minimum critical mass of a water-reflected solution is known to be about 0.8 kg of ²³⁵U. This is why mass limits are set under the worst credible moderation and reflection conditions.
The double contingency principle
ANSI/ANS-8.1 recommends that process designs incorporate sufficient factors of safety "to require at least two unlikely, independent, and concurrent changes in process conditions before a criticality accident is possible". US 10 CFR 70.64(a)(9) makes this principle a requirement for new fuel cycle facilities. Each contingency must be independent and unlikely in itself, so counting an "unlikely event" itself as one leg is not accepted.
What it means in a plant
keff limits for the spent fuel pool and their basis
US 10 CFR 50.68(b) is a criterion for nuclear power plants that may be chosen instead of the criticality accident alarm of 70.24.
- (b)(4) spent fuel racks: without boron credit, keff ≤ 0.95 in unborated water. With boron credit, keff ≤ 0.95 in borated water and also keff < 1.0 in unborated water.
- (b)(2), (b)(3) fresh fuel racks: keff ≤ 0.95 when flooded with unborated water, and keff ≤ 0.98 under optimum moderation by low-density hydrogenous fluid (mist, foam).
- (b)(7): the nominal enrichment of fresh fuel is 5.0 wt% or less.
- All values are calculated at a 95 % probability and 95 % confidence level (95/95), adding calculational bias and uncertainties (manufacturing tolerances, depletion calculations, etc.).
The basis for 0.95 is as follows. The 5 % margin covers the limits of code validation and effects that are not modelled. A single event such as boron dilution does not by itself lead to criticality. When abnormal conditions such as misloading are analysed, credit for soluble boron may be accepted on the basis of the double contingency principle: misloading and boron dilution are independent low-probability events, so they are not assumed to occur together. This credit is not automatic, however; it requires a licensing basis such as boron concentration monitoring and a dilution analysis.
Design criteria and analysed cases
The design criteria for a spent fuel pool can be summarized as follows.
- Criticality prevention: rack pitch, neutron absorber panels (B-10 areal density and surveillance coupons), borated water, burnup credit
- Analysed cases: assembly misloading, assembly drop or an assembly lying horizontally on top of the rack, boron dilution, pool temperature range, rack displacement by an earthquake
- Other functions: seismic Category I, cooling and makeup water, shielding water level, prevention of heavy-load drops
Burnup credit credits the reactivity reduction due to burnup. The minimum burnup for each initial enrichment is set by a loading curve, and the pool is divided into Region I (fresh and low-burnup fuel) and Region II (high-burnup fuel). The NRC accepts 5 % of the burnup-related reactivity decrement as the default depletion uncertainty. DSS-ISG-2010-01 (2011) requires the fission product validation uncertainty to be quantified separately.
Transport and criticality alarms
Under IAEA SSR-6 Rev.1 (2018), single packages and arrays must be subcritical assuming water in-leakage and optimum reflection. The number of packages is controlled with the criticality safety index CSI = 50/N. In US reviews, keff + 2σ + bias ≤ 0.95 is commonly used as the acceptance criterion.
10 CFR 70.24 requires a criticality accident alarm system at facilities possessing more than 700 g of ²³⁵U, 520 g of ²³³U or 450 g of Pu. It must detect a criticality that produces an absorbed dose in soft tissue of 20 rad (neutron + gamma) within one minute at an unshielded distance of 2 m, cover all areas with two detectors, and be backed by evacuation procedures.
Related accident — JCO Tokai-mura (1999)
On 30 September 1999, at the JCO conversion facility in Japan, about 16 kg U of 18.8 %-enriched uranyl nitrate solution was poured by bucket directly into a precipitation tank (45 cm in diameter, with a cooling-water jacket) that did not have a safe geometry. The work departed from the approved procedure and the batch mass limit. The criticality continued intermittently for about 20 hours. It was stopped by draining the cooling water, which acted as a reflector, and adding boric acid. Two of the three workers died, and the event was rated INES Level 4. It shows that the double contingency principle fails when mass, geometry and reflection control and administrative controls all break down together.
Regulatory and design criteria
- United States (example): 10 CFR 50.68, 70.24 and 70.64(a)(9); GDC 61, 62 and 63; SRP 9.1.1 and 9.1.2; DSS-ISG-2010-01; NUREG-2216 and NUREG-2215
- Standards and IAEA: ANSI/ANS-8.1-2014 (R2023), ANS-8.3 (alarms), IAEA SSG-27 Rev.1 (2022), SSR-6 Rev.1 (2018)
- Trend: the 50.68 values (0.95, 0.98, 5 wt%) have not changed. Since 2011 the review of pool analyses has become stricter, taking account of biases, depletion uncertainty and absorber degradation (Boraflex, GL 96-04).
Easily confused pairs
| Item | Criticality safety | Shutdown margin |
|---|---|---|
| Subject | Outside the core (storage, handling, transport, processing) | The core |
| Measure | keff ≤ 0.95 etc. (95/95) | Reactivity (%Δk/k) |
| Basis | e.g. 10 CFR 50.68, ANSI/ANS-8.1 | Technical specifications |
| Item | Boron credit | Burnup credit |
|---|---|---|
| What is credited | Soluble boron in the pool | Reactivity reduction from burnup |
| Condition | Unborated keff < 1.0 also required | Loading curve, burnup verification |
Key points at a glance
- Definition: preventing unintended criticality of fissile material outside the core.
- Control parameters: mass, geometry, moderation, reflection, concentration, interaction, enrichment, neutron absorbers.
- Engineered means: safe-geometry equipment, fixed absorbers, rack spacing.
- Administrative means: mass and batch limits, procedures and independent verification, training.
- Design principle: double contingency (ANSI/ANS-8.1); passive and engineered controls preferred.
- Pool criteria: keff ≤ 0.95 in unborated water (95/95); with boron credit, unborated < 1.0; fresh fuel under optimum moderation ≤ 0.98.
- Credits: boron credit, burnup credit (loading curve).
- Monitoring: criticality alarm (2 m, 1 minute, 20 rad).
