Standard No.:	HAD 301/05-2021
English Name:	Safety of spent fuel reprocessing facilities
Chinese Name:	乏燃料后处理设施安全
Professional Classification:	HAD    Professional Standard - Nuclear Power
Issued on:	2021-04-22
Implemented on:	2021-4-22
Status:	valid
Language:	English
File Format:	PDF
Word Count:	26000 words
Price(USD):	500.0
Delivery:	via email in 1 business day

Safety of spent fuel reprocessing facilities (Approved and issued by the National Nuclear Safety Administration on April 22, 2021) This guide shall be implemented as of April 22, 2021. The National Nuclear Safety Administration is in charge of the interpretation of this guide. The guide is informative. Methods and schemes different from those given in this guide may be adopted in practical work, provided that those adopted are proved to be of the same safety levels as those given in this guide. Contents 1 Introduction 1 1.1 Purpose 1 1.2 Scope 1 2 General requirements for safety 1 2.1 Safety objective 1 2.2 Defense in depth 1 2.3 Quality assurance 2 2.4 Nuclear safety culture 3 2.5 Public communication 3 2.6 Other requirements 3 3 Site evaluation 4 3.1 Evaluation objective 4 3.2 Evaluation content 4 4 Design 6 4.1 General requirements 6 4.2 Design requirements for main safety functions 10 4.3 Typical initiating events 19 4.4 Instrument and control 29 4.5 Human factor engineering 33 4.6 Safety analysis 35 4.7 Radioactive waste management 38 4.8 Effluent discharge management 39 4.9 Environment monitoring and evaluation 40 4.10 Physical protection 40 4.11 Nuclear material accounting 40 4.12 On-site transport 41 4.13 Emergency preparation and response 41 5 Construction 42 6 Commissioning 43 6.1 General requirements 43 6.2 Commissioning program 45 6.3 Commissioning stage 46 6.4 Commissioning report 48 7 Operation 50 7.1 Operation management requirements 50 7.2 Facility operation 54 7.3 Safe shutdown 68 8 Decommissioning preparation 68 1 Introduction 1.1 Purpose This guide aims at providing specific suggestions and measures that comply with the Safety requirements for spent fuel reprocessing facilities (Trail) (GUOHUANGUIFUSHE [2018] No.2). Methods and schemes different from those given in this guide may be adopted in practical work, provided that those adopted are proved to be of the same safety levels as those given in this guide. 1.2 Scope This guide is applicable to industrial reprocessing facilities which adopt liquid-liquid extraction aqueous process to dispose spent fuel from power reactors, including main process facilities for spent fuel reprocessing, spent fuel reception and storage facilities and associated radioactive waste treatment and storage facilities, and the like. It can also serve as a reference for reprocessing facilities adopting other reprocessing aqueous process. This guide contains specific safety suggestions for reprocessing facilities, covering all important stages including site selection, design, construction, commissioning and operation. Moreover, specific suggestions for change, maintenance, calibration, test, inspection and emergency preparation are also considered. 2 General requirements for safety 2.1 Safety objective The basic safety objective of spent fuel reprocessing facilities is to protect the working personnel, the public and the environment from harmful impacts of ionizing radiation. The basic safety objective runs throughout the service life of reprocessing facilities. The main risks of spent fuel reprocessing facilities are nuclear criticality, radioactive containment failure, radiation exposure and chemical hazards, etc., so adequate technical and management measures shall be taken in site selection, design, construction, commissioning and operation of the facilities to protect the working personnel, the public and the environment. 2.2 Defense in depth The defense in depth can be applied to the prevention and mitigation of accidents in facilities, providing multi-layer protection for activities concerned with nuclear safety. Implementing defense in depth in the design and operation of reprocessing facilities can provide multiple protection for expected operational events and accident state, including events or accidents caused by equipment failures inside the facilities or human factors and external events. The purpose of implementing defense in depth lies in two points: first, to prevent accidents; second, to prevent possible radioactive and related chemical hazards in case of failure, thus preventing the change to a more serious situation. Generally, the defense in depth is divided into five levels. If any level fails, the subsequent level will act. The purpose of the first level of defense is to prevent facility from deviating from normal operation and prevent system failure. The purpose of the second level of defense is to detect and correct the facility from deviating from normal operation. The purpose of the third level of defense is to control the accident within the design datum. The purpose of the fourth level of defense is to control the design development conditions, including preventing the development of accidents and mitigating the accident consequences. The purpose of the fifth level of defense is to mitigate the radiological consequences of the massive release of radioactive substances. The design features, measures and devices required for defense in depth shall be determined mainly through deterministic analysis during design and operation (which may be supplemented by probability study). This deterministic analysis, once reasonably proved by comprehensive engineering research practice and operating experience, can be regarded as the safety analysis conducted in the design stage for meeting regulatory requirements. Grading method shall be adopted in implementing the defense in depth. When determining the number and degree of layers required for defense (independence, diversity, redundancy, etc.), the quantity and type of radioactive substances, the possibility of diffusion, the possibility of nuclear, chemical or thermal reactions and the dynamics of such events shall be considered. The application degree of defense in depth at each level shall be consistent with the potential hazards of the facility, and shall be specified in the permit documents of the facility. 2.3 Quality assurance The operating unit shall formulate and effectively implement the quality assurance program and executive program in various stages of site selection, design, construction, commissioning and operation. The quality assurance program shall include the activities necessary for the items or services to meet the specified quality requirements, as well as those necessary for verifying whether the required quality has been reached and whether the objective evidence has been effectively obtained. The reliability of process equipment and the operation safety of process system shall be ensured through adequate design, manufacturing, storage (if necessary), installation, commissioning, operation and maintenance as well as facility management including quality assurance and quality control, and inspection and testing shall be carried out according to clear and established executive standards and expectations. 2.4 Nuclear safety culture The operating unit and the units providing equipment, engineering and services for it shall actively cultivate and construct nuclear safety culture and integrate it into various links such as production, management, scientific research and management. 2.5 Public communication The operating unit shall establish a sound public communication mechanism and equip it with necessary professional strength to coordinate information disclosure, popularization of scientific knowledge, understanding of public opinion, responses to social concerns and the like. 2.6 Other requirements The hazardous situations and potential events that may be largely affected by the reprocessing facilities shall be considered in safety analysis to ensure that adequate prevention, detection and mitigation measures are taken. Proven processes and engineering technologies shall be adopted for the design, construction and operation of reprocessing facilities. The engineering scheme used to ensure the safety of reprocessing facilities shall be of high quality, verified or proved by rigorous test, R&D or operating experience of prototype facilities. For components that are difficult or cannot be replaced, special consideration shall be given to the aging failure of safety-class buildings (structures), systems and components. In the design and type selection of safety-class buildings (structures), systems and components, the process that may cause structural material aging shall be considered. During the facility operation, the work outline for detecting and monitoring aging failure shall be formulated and implemented in consideration of the actual situation, which shall include measures for monitoring, inspection, sampling, monitoring and testing as well as additional design measures to be taken for inaccessible safety-class buildings (structures), systems and components where necessary. The reliability of the public system and its components used to maintain the operation of safety system shall be ensured. If possible, the safety system shall be designed to be free of unacceptable consequences even if losing normal power and standby power simultaneously. The power loss consequences of equipment such as fans, pumps and valves shall be evaluated, and relevant items shall be designed as fail-safe mode as possible. 3 Site evaluation Spent fuel reprocessing facilities are Class I nuclear facilities, which shall meet the requirements of site selection and evaluation of Class I nuclear facilities. When referring to the specifications related to the site selection of nuclear power plants, the applicability analysis and adjustment shall be carried out in combination with the characteristics of reprocessing facilities and the requirements for the plant site. For multi-facility sites, interactions between facilities shall be considered during facility design, construction and operation. 3.1 Evaluation objective The main objective of reprocessing facility site selection is to minimize the impact of radioactive release on the public and the environment, and to ensure that the impact on local residents will be reduced to an acceptable level during construction and operation. For site evaluation, not only the nuclear safety issues, but also the impact of non-radioactive contamination on the environment, shall be considered. 3.2 Evaluation content The site evaluation shall determine the impact of natural factors and human factors on the selected site; wherein, natural factors include serious displacement (such as slope instability, ground collapse, settlement or upheaval) cause by surface fracture of site area and earthquake (such as tsunami, lake surge and wave caused by earthquake); floods caused by rainfall and other causes; tide and dam break; meteorological, hydrological, geological and geographical conditions such as foundation soil liquefaction and tornado; human factors include population density, small aircraft impact and chemical explosion, etc. Engineering geological, regional geological and seismic evaluation shall be conducted for the recommended site. The design reference ground motion of the site, including standard response spectrum, site-related response spectrum and corresponding time-history curve of seismic motion, shall be determined and regarded as the seismic input items required for seismic design. Floods caused by earthquakes and occurrences of destroying phenomena such as ground subsidence, upheaval and collapse shall also be determined. The waves, tsunamis, lake surges and dam breaks caused by earthquakes shall be evaluated. Other potential dangerous phenomena related to earthquakes, such as soil liquefaction and slope instability, shall also be evaluated. The current and foreseeable future population data and its distribution shall be investigated and evaluated, and the impact of the site on surrounding residents shall be evaluated from the perspective of radioactive release. Priority shall be given to areas far away from residential centers and those with low population density. Under operating conditions or accident conditions, the impact on residents shall comply with the requirements of national laws and regulations and follow the principle of reasonable, feasible and as low as reasonably achievable. If the site is characterized by active faults, karst phenomena, slope instability, foundation soil liquefaction and ground subsidence, it is considered as unacceptable. The environmental impact assessment shall be carried out according to the determined source term of site selection, so that it does not exceed the level specified by relevant national regulations. The site shall be provided with good atmospheric dispersion conditions and located on the upwind side of the perennial minimum frequency wind direction at the residential center, and the coastal site shall also be provided with good waterbody diffusion conditions. The possibility of debris flow, landslide and runoff flood caused by rainfall, flood caused by natural or artificial reservoir flood discharge or other causes shall be evaluated. The design reference water level of riverside or coastal reprocessing facilities shall comply with the national nuclear safety regulations. The reprocessing facilities shall be located away from aircraft routes. The following factors shall be specially considered during the site selection of reprocessing facilities: (a) the bearing capacity of the site to release radioactive substances into the environment during operation, including physical factors affecting the diffusion and accumulation of released radioactive substances, and radiation risks to the working personnel, the public and the environment; (b) the capability of the site to meet the requirements of engineering and infrastructure facilities, including: ——waste treatment and storage at all stages during the service life of the facility; ——reliable assurance of public system; ——capability of safety and security of spent fuel, other radioactive substances and chemical substances transported inside and outside the plant; (c) for the requirements for the feasibility of emergency response plan, important site-related factors shall be considered, including the population density and distribution in the area, the distance between the site and the population center, special resident groups that are difficult to evacuate or hide (such as hospitals or prisons), use characteristics of land and water, special geographical features (such as peninsulas, mountains and rivers), characteristics of local transportation and communication networks, industrial facilities with potential hazardous activities, agricultural activities sensitive to possible emission of radionuclides, possible simultaneous external events and possible impact of local economic and social development planning on nuclear emergency response in the site area, etc.; (d) external hazards, such as: ——impact of external natural events, for example, floods may lead to the failure of criticality or necessary utilities; earthquakes may affect the containment structure of spent fuel, high-level liquid and fissile materials; ——impact of external human events, such as small aircraft impact and chemical explosion; (e) nuclear security requirements, etc. Particular attention shall be paid to the following aspects throughout the service life of reprocessing facilities: (a) monitoring and system evaluation of site characteristics; (b) regular evaluation of site parameters of natural events and human events in the design basis; (c) foreseeable changes in all site evaluation data (such as new or planned important industrial development, infrastructure or urban development); (d) during regular safety evaluation, on-site and off-site changes that may have an impact on safety shall be included in the safety evaluation report, and all existing site evaluation data and the development of scientific knowledge and evaluation methods shall be considered at the same time; (e) consideration of the expected future changes of site characteristics, consideration of the measures that may have an impact on the emergency arrangement and the capability of taking emergency response actions. 4 Design 4.1 General requirements 4.1.1 Main safety functions Main safety functions of reprocessing facilities are as follows: (a) preventing nuclear criticality; (b) containing radioactive substances; (c) shielding from radiation; (d) discharging decay heat; (e) preventing fire and explosion, including dilution of radiolysis gas. 4.1.2 General design The reuse of reagents such as acid, water and extractant shall be considered for reprocessing facilities to reduce waste discharge. During normal operation, the protection of the public and the environment depends on conservative facility design, especially effluent minimization, radioactive waste pretreatment, accident prevention, etc. The protection of the public and the environment mainly depends on accident prevention. Once an accident occurs, it is possible to take defense in depth measures to alleviate the consequences of the accident through reasonable safety classification and conservative design. At the same time, on-site and off-site emergency preparation at the fifth level of defense in depth is adopted to protect people's lives, health and property and the environment. The following design measures shall be adopted to ensure safety: (a) during normal operation, static and dynamic containment and appropriate zoning methods shall be adopted to avoid excessive exposure of personnel, and minimize the dependence on personal protective equipment according to the requirements of radiation protection optimization; (b) all thermal loads and related processes shall be fully considered in the design, and special attention shall be paid to whether sufficient cooling function is provided. If necessary, passive cooling may be considered under accident conditions; (c) hydrogen eliminators shall be arranged in places with obvious hydrogen produced from radiolysis, or measures for providing diluted air flow shall be adopted by applying the concept of defense in depth. For the above design, fans or compressors shall not be adopted if possible, and the safety function can also be realized in case of an accident; (d) in order to protect the working personnel, the requirements on limitation, shielding, distance and time of radioactive sources shall be considered comprehensively, and special attention shall be paid to the protection requirements of maintenance in the design; (e) measures for preventing nuclear criticality shall be considered in combination with actual conditions for all processes involving fissile materials; (f) the decommissioning design shall take into account the large amount of radioactive substances that may be accumulated during the long-term operation of the reprocessing facilities and various cumulative effects. Maintenance measures for main equipment shall be considered in the design of reprocessing facilities. As for the design, remote maintenance shall be considered, corresponding special maintenance equipment shall be arranged, the operation space of remote maintenance equipment shall be reserved, and the three-dimensional design data information of equipment shall be saved as much as possible. 4.1.3 Design basis and safety analysis Facility states are divided into operating state (including normal and expected operation events) and accident condition (including design basis accidents and design development conditions). Safety analysis of facility shall be carried out by deterministic, engineering judgment and risk analysis to identify the initiating events, and give causes, consequences and preventive measures for each type of initiating events. Design basis for safety-class items shall be determined based on the safety analysis. The following hazards shall be specially considered in the analysis of design basis accidents and initiating events of reprocessing facilities: (a) loss of cooling; (b) loss of power; (c) nuclear criticality accident; (d) internal and external fires; (e) exothermic chemical reactions; (f) internal and external explosions; (g) internal and external flooding; (h) drop and related operational events; (i) natural disasters; (j) small aircraft impact. The operating state and accident conditions of each process shall be evaluated one by one. If the event may simultaneously threaten several facilities at the same site, site-level evaluation shall also be carried out in addition to the evaluation of impact on each facility. 4.1.4 Buildings (structures), systems and components The possibility of design basis accidents shall be minimized as far as possible, and the related radiation consequences shall be controlled by the classification of buildings (structures), systems and components. The safety class determination of reprocessing facilities is mainly based on the safety functions and importance of items, and such items are classified into safety class and non-safety class based on deterministic theory, supplemented by risk analysis and engineering judgment. For the safety classification of items, factors such as the safety function performed by items, the type, quantity, toxicity and state of radioactive substances contained in items, the replaceability (repairability) of items, the consequences and possibility after item failure, the operation timeliness and duration of items, etc., shall be comprehensively considered. The safety class of the system shall be determined first. The equipment (or components) that perform or support system safety functions shall belong to the same safety class as the system, and the unspecified equipment (or components) shall be considered to be consistent with the system safety class. Appropriate interface design shall be provided between buildings (structures), systems and components of different safety classes to ensure that any function failure of lower-class items will not impact the safety functions of higher-class items. At the same time, items used to monitor and inspect the safety system and equipment (or components) in performing relevant safety functions, as well as items monitored after accidents or items that play an important role in the performance recovery of the safety system and components, shall belong to the same safety class as the items being monitored and inspected. For the design of buildings (structures), systems and components of each safety class, the design basis related to structure and mechanics shall be determined accordingly, including load combinations under various working conditions. The load combination shall include the following loads: static load, dynamic load, stress load, thermal load (including fire), wind load, earthquake, tornado, projectile and abnormal load in explosion state, etc. The safety-class buildings (structures) shall be designed to be able to perform their safety functions under operation state and design basis accident conditions. Corresponding quality assurance requirements shall be specified for all activities related to nuclear safety functions, and the quality assurance of safety-class items shall run through the whole process of various works affecting the quality of items, including design, purchase, processing, manufacturing, handling, transportation, storage, cleaning, assembly, installation, inspection, test, commissioning, operation, maintenance, overhaul and improvement, etc. In principle, high safety class means high quality assurance level, and factors such as manufacturing process complexity, design and manufacturing experience, process maturity, supply history and standardized production shall be comprehensively considered. In addition to the safety-class buildings (structures), systems and components determined in the safety analysis, other instruments and control systems used in normal operation are also related to the overall safety of reprocessing facilities. These systems include display and recording instruments, control components and alarm and communication systems. Although they are used to limit process fluctuations and events, they are not identified as safety items. These buildings (structures), systems and components shall be of high quality, and adequate and reliable control and appropriate instruments shall be provided to keep the parameters within the specified range and start the automatic safety function where necessary. For the use of computers or programmable equipment of these systems, it shall be proved that the hardware and software have been properly designed, manufactured, installed and tested according to the established management system. For software, validation and verification shall be included. The reprocessing facilities shall be equipped with alarm system to start partial or complete evacuation in emergency events (such as criticality, fire and high radiation level exceeding the design value). 4.2 Design requirements for main safety functions 4.2.1 Nuclear criticality prevention 4.2.1.1 General requirements The reprocessing facilities shall be subjected to criticality safety control through engineering measures as far as possible. When credible criticality risks cannot be eliminated, the method of double contingency principle shall be preferred to prevent criticality in design. According to the criticality safety limit, sufficient safety margin shall be reserved in the process design. Reliable detection means and timely corrective measures shall be provided for any process conditions affecting criticality safety, and safety-class instruments related to criticality safety shall meet the single failure criterion. Special evaluation shall be made on the system interface for the change of fissile material state or criticality control method. Attention shall be paid to the gradual change state, intermediate state or instantaneous state that occurs or may occur under all operation state and accident conditions. In the design, reagents that may cause precipitation or hydrolysis shall be prevented from accidentally entering the equipment containing more fissile materials, so as to prevent precipitation or hydrolysis of fissile materials in the feed liquid and avoid criticality risks. Criticality safety control parameters shall be comprehensively considered in the design of reprocessing facilities, such as mass, concentration, moderation, geometry, nuclide composition, enrichment, density, reflection, interaction, and neutron absorption. Geometric control shall be preferred as the main criticality control method. In the design, it shall be considered to provide a receiving container with criticality safety for possible leakage, so as to ensure that the leaked liquid is discharged into or enters the criticality safety container through the emptying path. If neutron poison control is adopted among criticality safety control measures, sufficient margin shall be provided in design, and the possible loss of neutron poison due to aging, degradation and other factors during the service life shall be fully considered. Where necessary, measures for monitoring and evaluating the poison performance shall be taken to prevent the effectiveness of neutron poison from reducing or losing. If burnup credit is adopted for criticality safety analysis, the fuel enrichment degree and its corresponding minimum burnup limit shall be strictly controlled. In the design, the possibility of diversion, accumulation, overflow and carrying of the fissile materials shall be considered. Emphasis shall be placed on the possible evaporation and crystallization of leaked feed liquid on heat containers or thermal pipes, and whether the following measures shall be taken: (a) set up a liquid receiving tray (or pit) to recover the leaked liquid, keep the leaked liquid away from the heat container, and guide it into a geometrically favorable collection container; (b) set up a liquid level measuring device or liquid detector in the liquid receiving tray (or pit); (c) regular inspection, uninterrupted CCTV surveillance and adequate lighting. Additional design measures shall be fully considered to detect leakage or abnormality of feed liquid or solid (powder) conveying system containing fissile solids (slurry), and appropriate criticality control measures shall be taken. Combined with the criticality safety analysis, instruments for detecting the accumulation and stock of fissile materials shall be arranged where necessary, and these instruments may also be used to verify the stock of fissile materials in equipment during decommissioning. 4.2.1.2 Nuclear criticality safety evaluation The purpose of nuclear criticality safety evaluation is to demonstrate the design and operation conditions of the equipment in the reprocessing facilities, so as to keep the control parameters within the subcriticality range. Criticality safety evaluation shall be conducted for any system and equipment containing fissile materials. The nuclear criticality safety evaluation shall be closely combined with the process flow of facilities, and the changes of criticality safety conditions caused by the physical and chemical properties of fissile materials and other abnormal events in each process shall be discriminated, and the system interfaces with changes in the fissile material state and criticality control methods shall be evaluated emphatically. The nuclear criticality safety evaluation shall include analysis and evaluation of all operation states and the subcriticality state in case of a design basis accident. The criticality safety analysis shall identify external and internal hazards and determine radioactive consequences. For the criticality safety analysis, conservative methods shall be adopted and the following aspects shall be considered: (a) the uncertainty of physical parameters, the possibility of the best moderating conditions and the heterogeneous distribution of moderators and fissile materials; (b) expected operational events, for which the combination of events shall be considered if the events cannot be proved to be independent; (c) changes in the state of facilities that may be caused by internal and external hazards. The computer program for criticality safety analysis shall be qualified, verified and confirmed. All programs shall be properly used within their applicable scope, and a suitable nuclear reaction cross-section database shall be selected. The criticality safety limits of physical parameters such as mass, volume, concentration or geometry dimension may be specified as a part of the criticality safety analysis. For safety limits, conservative values (or worst-case values) of other parameters shall be considered, such as the optimal moderation or the actual minimum value of neutron poisons. The evaluation shall demonstrate that all parameters are always within the safety limits under all normal, abnormal and design basis accident conditions. 4.2.1.3 Mitigation measures According to the national standards and considering the process and layout, a sensitive and reliable criticality accident detection and alarm system shall be set through criticality safety analysis in the places where criticality accident may occur. Additional shielding, remote operation and other design measures to mitigate the consequences of criticality accident shall be evaluated according to the requirements of defense in depth. 4.2.2 Containment of radioactive substances 4.2.2.1 Static and dynamic containment Characteristics of alpha sealing shall be fully considered for the reprocessing facilities, with appropriate sealing system arranged according to the principles of independence, complementarity and redundancy to provide reliable sealing function and sufficient containment capacity, so as to limit radioactive substances to specified parts or places and minimize the possibility of exposure to radioactive substances outside the specified parts or places under operation state and accident conditions. It shall also be guaranteed that the contamination caused by release of any radioactive substance is below the specified limit under operation state and below the acceptable limit under accident conditions. Three static barriers shall be arranged for the reprocessing facilities, additional ones may also be arranged according to the safety analysis results. The first static barrier usually consists of process equipment, containers, pipes, glove boxes or working boxes, etc. The second static barrier usually consists of the hot cell (equipment room) around the process equipment or the room around the glove box (when the glove box is the first barrier). The last static barrier is the building itself. For the design of static sealing system, the interfaces between various containment areas (such as door openings, mechanical equipment, instruments and pipe penetrations) shall be considered, and it shall ensure radioactive containment under all operation state, especially under maintenance state (such as providing fixed or temporary additional barriers), and keep containment under accident conditions as much as possible. Each static barrier shall be supplemented by one or more dynamic containment systems. The dynamic containment system shall establish a pressure gradient between the environment outside the building and contaminants inside the building, and between all containment systems passing through the building. The design of dynamic containment system shall prevent contaminants from moving or diffusing to low-contamination areas through interfaces between containment areas. The design of dynamic containment system shall pay attention to: (a) operation state and accident conditions; (b) maintenance that may cause local changes (such as opening the access door and removing the access cover plate); (c) in places where multiple ventilation systems are used, protective measures shall be taken to prevent reverse pressure difference and airflow caused by low-pressure (high contamination) system failure; (d) it shall be ensured that all static barriers, including filters or other air flow control equipment, can withstand the maximum pressure difference and air flow generated by the system. The reprocessing facilities shall be designed to be able to timely detect and collect the leaked liquid of process equipment, containers and pipes, and return it to the first barrier (equipment or pipe). This is particularly important for design and operation, especially when the first static barrier also performs other safety functions, such as being geometrically favorable to avoid criticality and carrying out air isolation for flammable liquids, etc. Special attention shall be paid to overflow or leakage of liquid flow with high fissile material content, and the influence of crystallization caused by evaporation of cooling or leaked liquid shall be considered. The chemical compatibility between materials shall be considered in design to prevent crystallization or precipitation. The pressure of the heating and cooling medium of the heat exchanger shall be greater than that of the heated radioactive medium, so as to prevent radioactive substances from escaping into the non-radioactive system caused by leakage; the cooling system is generally equipped with two circuits; online dose monitoring shall be carried out for the cooling water in one circuit to prevent the radioactive substances from being discharged into the environment without restriction. Special consideration shall be given to parts of reprocessing facilities dealing with radioactive, fissile and other hazardous solids (powder). Because it is very difficult to detect the powder leakage and its accumulation and return it to the sealed area or process system, it shall be ensured that the design of such equipment is based on verification and has undergone strict inspection. The ventilation system shall at least include the ventilation system of buildings (hot cells, equipment rooms and rooms) and the process tail gas system (such as dissolved tail gas, exhaust gas from equipment storage tanks, etc.). For the evaluation and design of building ventilation system (including subsystems, filtration devices and other emission control equipment, etc.), the following contents shall be considered: (a) type and design of static barriers (hot cells, glove boxes and buildings); (b) area division according to the hazards involved; (c) characteristics of potential aerosols (i.e. expected or actual normal levels of aerosols); (d) surface contamination level and risk of higher pollution level; (e) maintenance requirements. The process tail gas system in the facility has the lowest pressure, which is used to collect and treat most radioactive steam, radioactive gas and aerosol generated by the process. Attention shall be paid to the arrangement of effective washing, emptying and collecting systems to reduce contamination and accumulation of radioactive substances and facilitate decommissioning. All levels of filtration of ventilation system shall be designed according to relevant standards, and shall undergo filtration performance test. For the process involving powder operation, the primary filter shall be as close to the contamination source as possible to reduce the possible accumulation of powder in the ventilation pipe. Special attention shall be paid to the accumulation of fissile materials in the form of powder in geometrically unfavorable ventilation pipes. Whether a standby fan is needed shall be judged according to the safety evaluation result, and the fan shall be equipped with pressure difference or fault alarm system. Unless the probability of fire occurrence is very small or the consequences of fire hazards are acceptable, fire dampers shall be arranged to prevent fire from spreading through ventilation pipes and maintain the integrity of fire compartments. 4.2.2.2 Working personnel protection The design shall ensure the integrity and effectiveness of the sealing barrier and facilitate maintenance. In the design, attention shall be paid to the technical requirements of welding, material selection, sealing performance (including the sealing of electrical and mechanical penetrations) and the bearing capability of seismic loads. For items requiring regular maintenance or operation, according to the radiation type and level of the treated materials, they shall be arranged in the shielding box or glove box adjacent to the process hot cell and equipment room, so as to reduce the stock of radioactive substances on site and allow special cleaning and decontamination operations. Glove box scheme shall be preferred in the design of places where diffusive radioactive substances are treated and where the main risk is contamination caused by containment failure or internal exposure caused by personnel intake. The sealing performance of glove box and window shall be tested, and gloves shall be replaced without breaking the seal. Negative pressure shall be kept in the glove box, and the negative pressure level of box shall be determined according to the hazard level of contaminants. Reliable radioactive aerosol detection equipment shall be installed according to the design of static and dynamic containment systems to minimize the use of protective equipment for working personnel under normal working conditions. The installation of aerosol monitoring equipment shall be considered in the design stage. The following factors shall be considered in the design of the system and the selection of monitoring points: (a) the most likely position of the working personnel; (b) the air flow in the facility; (c) the evacuation area and evacuation route; (d) temporary control area during overhaul, etc. In order to avoid contamination dispersion through working personnel, the control points of the working personnel contamination monitoring equipment shall be located at the airlock outlet and at the barrier between the airlock outlet and the potentially contaminated area. As far as practicable, they shall be located close to the working area with contamination hazard. Tools and equipment shall not be relocated through airlocks or barriers as much as possible. When it must be relocated, tools and equipment shall be tested. In the design, special storage places shall be considered for light contamination tools and equipment; items with high contamination shall be decontaminated and reused, or sent directly to the waste outlet. 4.2.2.3 Protection of the public and the environment For the ventilation system equipment used to reduce aerosol, its working state under normal operation and accident conditions shall be determined according to the results of safety classification. The reprocessing facilities shall continuously monitor chimney emissions and monitor the surrounding environment of the facilities. In order to realize the early detection of leakage as much as possible, the transfer of waste liquid generated by the process to waste liquid treatment facilities shall be designed as batch transfer. Monitoring means for equipment sealing barrier damage shall be adopted (such as aerosol detection and pit detection in equipment room, liquid level detection and sampling in collection container, etc.). The effluent discharge monitoring system, which consists of on-line monitoring and sampling monitoring, shall meet the requirements for effluent discharge control and accident release source terms monitoring in normal operation. The effluent discharge monitoring system shall meet the sample representativeness requirement and operate with the lowest possible detection limit. It shall also be capable of monitoring the major radioactive nuclide in the gaseous and liquid effluents. According to the characteristics of the receiving water body, the appropriate discharge mode of liquid effluent shall be selected. 4.2.3 Radiation shielding The purpose of shielding radiation is to keep the dose below the limit specified in relevant national laws, regulations and standards by using the following measures alone or in combination: (a) limit radiation source terms during operation and maintenance as much as possible through process control and management as well as decontamination or cleaning; (b) take appropriate shielding measures to shield radiation sources; (c) increase the distance between the radiation source and the working personnel by designing the working position reasonably or adopting remote control operation; (d) limit the time and population exposed to radiation; (e) control access to areas with risk of external exposure; (f) use personal radiation protection equipment, such as body shielding and organ shielding. The design shall minimize the need for personal protective equipment under normal operating conditions. For the optimization of safety protection in design, the limitation on maintenance operation by the maintenance personnel shall be considered. The limitation of operation time shall not be used as the main dose management method as possible. In places with high external exposure, the radiation source intensity, radiation type and position shall be considered in the shielding design. In other places, the combination of radiation source intensity, radiation type and position, exposure time and shielding shall be comprehensively utilized to protect the working personnel, so as to reduce the whole body dose and local organ and tissue dose. The shielding shall be arranged in appropriate areas. For the design of equipment installed in high-level hot cell (equipment room), the maintenance requirements shall be considered, including inspection and testing activities, especially the radiation level and contamination level throughout the service life. (a) For mechanical and electrical components of highly radioactive units, the design and layout of equipment shall allow remote maintenance, such as using "master-slave" manipulator. (b) The conveying equipment shall be selected according to the process requirements and the radioactivity and physical characteristics of liquid, and maintenance-free conveying equipment, such as air lift, compressed air ejector and steam jet pump, shall be preferred in design. Any mechanical equipment adopted, such as pumps and valves, shall be designed to be remotely repaired or replaced. For the radioactive substance stock used in design and safety evaluation calculation, the deposition of radioactive substances and their decay daughters in equipment and pipes shall be considered, such as radioactive material particles and scaling in pipes (parts containing high-level radioactive substances) and glove boxes. The process control of reprocessing facilities depends on sample analysis data. In order to minimize occupational exposure, automatic and remote operation shall be preferred for the sampling device, sample transmission network to the laboratory and laboratory analysis. According to relevant laws, regulations and safety evaluation, the radiation protection monitoring system shall mainly include the following contents: (a) stationary photon and neutron radiation monitoring equipment and instruments in the workplace, and stationary aerosol monitoring equipment and instruments in the workplace; (b) movable photon and neutron radiation monitoring equipment and instruments in the workplace as well as movable aerosol monitoring equipment and instruments and air samplers; (c) personal dosimeter for the working personnel which is consistent with the radiation type. 4.2.4 Cooling and discharge of decay heat Radioactive decay heat release, chemical reaction heat release and physical heat release as well as cooling and evaporation processes may result in the following working conditions: (a) solution boiling; (b) state change related to radiation or criticality safety (such as melting, concentration, crystallization, water content changes, etc.); (c) chemical reactions turning to autocatalysis (such as the formation of red oil that may explode), or other chemical reactions and fires that may be accelerated; (d) components damaging the containment barrier; (e) performance degradation of radiation protection shielding; (f) performance degradation of neutron absorber materials or neutron decoupling devices. The cooling system shall be designed to prevent uncontrolled release of radioactive substances to the environment, radiation exposure to working personnel and the public, and nuclear criticality accident, especially in the high-level liquid waste storage tank and plutonium dioxide container. The cooling capacity of the cooling system used to discharge decay heat and chemical reaction heat shall be determined through safety analysis, and the effectiveness and reliability of the cooling system and the corresponding emergency power supply shall be evaluated. An effective cooling system to discharge decay heat, reaction heat, etc., and corresponding power supply shall be arranged. The cooling capacity, effectiveness and reliability of the cooling system shall be evaluated. The passive system shall be adopted for cooling in design as far as possible. 4.2.5 Preventing radiolysis gases and other explosives or flammable substances from reaching hazard concentration levels

1 Introduction 1.1 Purpose 1.2 Scope 2 General requirements for safety 2.1 Safety objective 2.2 Defense in depth 2.3 Quality assurance 2.4 Nuclear safety culture 2.5 Public communication 2.6 Other requirements 3 Site evaluation 3.1 Evaluation objective 3.2 Evaluation content 4 Design 4.1 General requirements 4.2 Design requirements for main safety functions 4.3 Typical initiating events 4.4 Instrument and control 4.5 Human factor engineering 4.6 Safety analysis 4.7 Radioactive waste management 4.8 Effluent discharge management 4.9 Environment monitoring and evaluation 4.10 Physical protection 4.11 Nuclear material accounting 4.12 On-site transport 4.13 Emergency preparation and response 5 Construction 6 Commissioning 6.1 General requirements 6.2 Commissioning program 6.3 Commissioning stage 6.4 Commissioning report 7 Operation 7.1 Operation management requirements 7.2 Facility operation 7.3 Safe shutdown 8 Decommissioning preparation