Discussion of Contingencies

DOE-STD-1134-99

In other cases, where criticality is possible, the reviewer's task is to assure that no credible single

failure can result in the potential for a criticality accident. To accomplish this, all credible failure

modes known to the reviewer that are applicable to the process should be bounded by the

analysis or adequate barriers to its occurrence must be in place. The reviewer should ask, "How

bad can the situation credibly get? If it gets that bad, will it remain subcritical?" and ensure that

the documented contingency analysis considers the scenario. This contingency discussion must

contain a clear description of the process upsets (i.e., contingencies) considered by the NCS

analyst. The contingencies should be specific enough to provide a definitive boundary to the

process upset. For example, rather than stating a mass contingency as "overbatch", state "double

batching" if this has been determined to be the maximum credible overbatch. The former means

any overbatch no matter how small would have to be an "unlikely" event. The latter concludes

that while a small overbatch would be an "anticipated" event, double-batching would be an

"unlikely" event. The reviewer need not document all conceivable abnormal pathways or

scenarios, only those deemed reasonable and credible.

The second role of the reviewer is to assure that controls (administrative and physical) are

adequate, properly justified and implemented appropriately. The reviewer must be satisfied that

the controls make the identified contingency an "unlikely" event. The controls must be

implementable by operations and there must be an implementing mechanism in place (i.e.,

procedures, configuration control, postings, etc.).

There are several pitfalls to be avoided as a reviewer. First, the reviewer should not be

concerned about quantitative human failure probabilities. Failure rates for human failures exist.

For example, see Alain Swain's handbook. Quantitative equipment failure frequencies are

generally subjective and based on professional judgment because there is no compilation of

failure rates for the types of processes most commonly occurring within DOE facilities.

However, if equipment failure data exists then it should be considered. The reviewer should

simply convince himself that, in his professional judgment, "unlikely events" are unlikely and

"incredible events" are incredible. Second, the format used to document the contingency

analysis is irrelevant - any kind will do as long as it is understandable. Text, charts, fault trees,

event trees and tables are all acceptable formats. Typically, the contingency analysis is

comprised of a simple spreadsheet showing the contingencies, controls, and summary of the

subcriticality evaluations. Third, just because a reviewer conceives a mechanistic scenario that is

a variation on those documented does not necessarily mean the evaluation is incomplete or

inadequate. If the barriers imposed on the operation cover the hypothesized variation, then the

analysis should be deemed adequate. The reviewer must decide when the variation becomes a

distinct scenario that was not adequately considered or, if missing, is indicative of an incomplete

analysis. The reviewer should use discretion when drawing the conclusion that the analysis may

be incomplete in other areas because a specific, bounded and controlled scenario is not explicitly

documented. The reviewer should document his conclusions and file them with the controlled

copy of the evaluation.