DOE-HDBK-1163-2003, Integration of Multiple Hazard Analysis Requirements and Activities

NOT MEASUREMENT SENSITIVE DOE-HDBK-1163-2003 October 2003 DOE HANDBOOK INTEGRATION OF MULTIPLE HAZARD ANALYSIS REQUIREMENTS AND ACTIVITIES U.S. Department of Energy AREA SAFT Washington, D.C. 20585 DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. TS DOE-HDBK-1163-2003 ii This document has been reproduced directly from the best available copy. It is available to DOE and DOE contractors from ES&H Technical Information Services, U.S. Department of Energy, (800) 473-4375, fax: (301) 903-9823. Available to the public from the U.S. Department of Commerce, Technology Administration, National Technical Information Service, Springfield, VA 22161; (703) 605-6000. DOE-HDBK-1163-2003 iii FOREWORD 1. This Department of Energy (DOE) standard is approved for use by all DOE Components and their contractors. 2. Constructive comments (recommendations, additions, deletions) and any pertinent data that may improve this document should be sent to Office of Worker Protection Policy and Programs (EH-52) U.S. Department of Energy Washington, DC 20585 by letter or by using the self-addressed Document Improvement Proposal Form (DOE F 1300.3) appearing at the end of this document. 3. DOE technical standards, such as this standard, do not establish requirements. However, all or part of the provisions in a DOE standard can become requirements under the following circumstances: (1) they are explicitly stated to be requirements in a DOE requirements document; or (2) the organization makes a commitment to meet a standard in a contract or in an implementation plan or program plan required by a DOE requirements document. Throughout this standard, the word "shall" is used to denote actions, which must be performed if the objectives of this standard are to be met. If the provisions in this standard are made requirements through one of the two ways discussed above, then the "shall" statements would become requirements. It is not appropriate to consider that "should" statements would automatically be converted to "shall" statements, as this action would violate the consensus process used to approve this standard. DOE, wishes to advance the level of understanding and capability of performing integrated hazard analysis. DOE, in developing this handbook, is placing emphasis on the efficiencies and advantages that may be obtained by integrating the numerous hazard analysis methodologies performed under various requirements. DOE encourages data exchange among the various analysis methodologies under multiple standards and requirements where practicable. This handbook is intended to be a step in promoting further discussion and hands-on experience in promoting the concept of integration of hazards analysis. Experience gained in the use of the approaches suggested in this handbook will be used to further the integration concept and strengthen the overall analysis performed. DOE-HDBK-1163-2003 iv ACKNOWLEDGEMENTS This Department of Energy Handbook was prepared by Mr. Jeff Woody, Link Technologies, Inc. and Mr. Jim Goss, Y-12 Site Office, National Nuclear Security Administration under the sponsorship of the DOE Office of Worker Protection Policy and Programs (EH-52) and the Chemical Safety Topical Committee. No one group of individuals, however, can appropriately take sole credit or responsibility for an undertaking of this magnitude. The preparers would like to gratefully acknowledge the specific authors whose works are referenced in this document. This broad thanks extends likewise to the large number of individuals who have provided comments on the handbook.

Beyond the formal comment process used for documents of this type, the following individuals provided valuable technical insights and/or specific reviews of this document in its various stages of development: Dave Pegram DOE-HQ/EH Roger Rollins DOE/SRO Ed Branagan DOE-HQ/NE George Schlossnagle DOE-HQ/EH Gail Kleiner DOE-HQ/EH Kelly Seidel YMP J. C. Laul LANL Vicki Wheeler DOE/SRO Bill McArthur DOE-HQ/EH Rob Vrooman NNSA/NA-53 Ingle Paik WSMS Cory Wilkinson LLNL Howard Wong LLNL DOE-HDBK-1163-2003 v Table of Contents 1.0 Introduction.................................................................................................................................1 2.0 Purpose of Handbook .................................................................................................................1 3.0 Comparison of Hazard Analysis Requirements .......................................................................2 3.1 Facility-Level Hazard Analysis Requirements .......................................................................3 3.2 Requirements Related to Analysis of Specific Hazards..........................................................5 3.3 Activity-Level Hazard Analysis Requirements ......................................................................7 4.0 Best Management Practices .......................................................................................................9 4.1 Multi-Disciplinary Teams......................................................................................................9 4.2 Collection and Integration of Hazards Information ..............................................................10 4.3 Screening of Multiple Hazard Types ....................................................................................12 4.4 Evaluation of Facility Hazards and Accidents.....................................................................14 4.5 Coordination of Annual Updates to Hazard Analysis Documents.......................................15 4.6 Streamlining Activity-Level Hazard Analysis ......................................................................16 5.0 References .................................................................................................................................16 Appendix A: Summary Comparison of Hazard Analysis Requirements ................................................A-1 Appendix B: White Paper on Fire Hazards Analysis...............................................................................B-1 LIST OF FIGURES Figure 1 Relationship of Hazard Analysis Activities and Requirements..............................................3 LIST OF TABLES Table 1 Key Topics of the Handbook ................................................................................................. 2 Table 2 Typical Subject Matter Experts Available to Support HA Team Leader .............................. 10 Table 3 Sample Criteria for Determining Hazards Beyond Standard Industrial Hazards................... 13 DOE-HDBK-1163-2003 vi Acronyms and Abbreviations

ANSI American National Standards Institute AHA Activity Hazard Analysis1 CCPS Center for Chemical Process Safety CERCLA Comprehensive Environmental Response, Compensation, and Liability Act of 1980 (CERCLA, the “Superfund” Law) CFR Code of Federal Regulations CSE Criticality Safety Evaluation CSTC Chemical Safety Topical Committee DBE Design Basis Earthquake DiD Defense in Depth DSA Documented Safety Analysis EIS Environmental Impact Statement EPA U. S. Environmental Protection Agency EPHA Emergency Preparedness Hazard Assessment ERPGs Emergency Response Planning Guidelines FHA Fire Hazard Analysis FMEA Failure Mode and Effects Analysis HA Hazard Analysis HASP Health and Safety Plan HAZWOPER Hazardous Waste Operations and Emergency Response HDBK A U.S. Department of Energy Handbook IDLH Immediately Dangerous to Life or Health INEEL Idaho National Engineering and Environmental Laboratory ISA Integrated Safety Analysis LEL Lower Explosive Limit MPFL Maximum Possible Fire Loss NCSE Nuclear Criticality Safety Evaluation NEPA National Environmental Policy Act of 1969 NFPA National Fire Protection Association NIOSH National Institute for Occupational Safety and Health NUREG A U.S. Nuclear Regulatory Commission regulatory report NPH Natural Phenomena Hazard OSHA Occupational Safety and Health Administration OSRs Operational Safety Requirements PAGs Protective Action Guides P&IDs Piping and Instrumentation Diagrams PPE Personal Protection Equipment PrHA Process Hazards Analysis PSHA Probabilistic Seismic Hazard Analysis PSM Process Safety Management 1 For the purposes of this document the term Activity Hazard Analysis (AHA) is a general term for Hazard Analysis at the activity level and includes Job Hazard Analysis (JHA). DOE-HDBK-1163-2003 vii RMP Risk Management Plan RQs Reportable Quantities SSC Structures, Systems, and Components TPQ Threshold Planning Quantities TQ Threshold Quantity DOE-HDBK-1163-2003 1 1.0 INTRODUCTION During Fiscal Year 2001, the joint DOE/EFCOG Chemical Safety Topical Committee (CSTC) formed a team consisting of representatives from several sites and DOE headquarters to evaluate possible methods for integrating hazard analysis activities with potential overlap such as radiological, chemical, emergency preparedness, environmental and others. The CSTC Team identified and reviewed hazard analysis requirements and issues, collected numerous sources of good practices information and evaluated possible methods for integrating hazard analysis activities. This Handbook captures many of the CSTC Hazard Analysis Team’s insights based on interactions with industry and DOE field personnel. Specifically, the Handbook provides an overview of current DOE directives and federal regulations, highlights opportunities for integrating hazard analysis activities, and provides approaches that can improve effectiveness of hazard analysis while improving cost performance. This Handbook does not introduce any new or additional requirements. The concepts presented in this Handbook are supportive of an integrated safety management system (ISM) as addressed in DOE G 450.4-1B, Integrated Safety Management System Guide, and can be applied to nuclear or hazardous non-nuclear facilities that are either operating, shutdown, or actively conducting facility disposition activities. The underlying premise is that hazard analysis is applied to all levels of work activities and includes an evaluation of potential impacts to workers, the public and the environment.

Table 1 provides a convenient reference for locating selected topics contained within this Handbook. 2.0 PURPOSE AND SCOPE OF THIS HANDBOOK This Handbook is intended to provide DOE and contractor safety personnel with a resource to support the planning, technical review, or conduct of hazard analysis activities. Clarifications of requirements and discussions of best practices can be used to help improve cost effectiveness, clarify organizational roles and responsibilities, and provide a basis for enhancing the technical quality of hazard analysis activities. The term “hazard” as used in this Handbook is intended to mean a source of danger with the potential to cause illness, injury, or death to a person or damage to a facility or to the environment (without regard to the likelihood or credibility of accident scenarios or consequence mitigation). Hazards may involve radioactive or chemically hazardous materials, energy sources, or other potentially adverse conditions found in the workplace. This Handbook can be applied to a broad set of activities conducted at DOE facilities, including nuclear or non-nuclear related processing, waste management, and laboratory and decommissioning operations. It is not intended to apply to DOE facilities engaged in developing, manufacturing, handling, storing, transporting, processing, or testing of explosives, pyrotechnics and propellants, or assemblies containing these materials. These activities represent a small sector of DOE’s current missions and facilities, and are specifically covered by DOE M 440.1-1, DOE Explosives Safety Manual. DOE-HDBK-1163-2003 2 Table 1. Key Topics of the Handbook Integrated Hazard Analysis Topics Section Activity-Level Hazard Analysis 3.3, 4.6 Annual Updates 4.5 Chemical Process Hazard Analysis 3.1, Appendix A Collection of Hazards Information 4.2 Documented Safety Analysis 3.1, Appendix A Emergency Preparedness Hazard Analysis 3.1 Appendix A Environmental Impact Statements 3.1, Appendix A Facility-Level Hazard Analysis 3.1, 4.4 Fire Hazards Analysis 3.2, Appendix A, B Hazards Screening 4.3 HAZWOPER Risk Assessment 3.3, Appendix A Activity Hazards Analysis 3.3, Appendix A Multi-Disciplinary Teams 4.1 Natural Phenomena Hazards Assessment 3.2, Appendix A Nuclear Criticality Safety Evaluation 3.2, Appendix A Radiation Hazards Survey 3.3 3.0 COMPARISON OF HAZARD ANALYSIS REQUIREMENTS DOE contractors conduct multiple hazard analysis activities in accordance with ISM and various DOE orders, rules and federal regulations. This Handbook identifies numerous requirements having direct reference to hazard identification, hazard analysis, hazard evaluation, hazard assessment, accident analysis, and risk analysis or risk assessment. These requirements may be found in the following primary source documents: • 48 CFR 970.5204-2 (c)(2), “DOE Acquisition Regulations” • 10 CFR 830, Subpart B, “Nuclear Safety Management” • 10 CFR 835, “Occupational Radiation Protection” • 10 CFR 850, “Chronic Beryllium Disease Prevention Program” • 10 CFR 1021, “National Environmental Policy Act Implementing Procedures” • 29 CFR 1910.119 and 1926.54, “Process Safety Management” • 29 CFR 1910.120 and 1926.65, “Hazardous Waste Operations and Emergency Response” • 40 CFR 68, “Chemical Accident Prevention Provisions” • 40 CFR Parts 1500-1508, “Council on Environmental Quality” • DOE O 151.1, “Comprehensive Emergency Management System” • DOE 420.1, “Facility Safety” • DOE O 440.1A, “Worker Protection Management” • Various other OSHA regulations as found in 29 CFR 1910 and 1926 [NOTE: environmental regulations related to hazardous waste management and cleanup are not included at this time]

The primary requirement for hazard analysis is found in the DOE Acquisition Regulations (DEAR, ES&H Clause), which requires an identification and evaluation of hazards associated with work as part of an overall documented safety management system (i.e., ISM). Other hazard analysis requirements support this paradigm and share a similar basic intent that is to identify and http://www.explorer.doe.gov/ http://tis.eh.doe.gov/nsps/ourdocs/rules.html http://www.gpo.gov/nara/cfr/index.html http://tis.eh.doe.gov/be/webdoc4.html-ssi http://tis.eh.doe.gov/nepa/tools/REGULATE/NEPA_REG/1021/Sub-C.htm http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=STANDARDS&p_id=9760&p_text_version=FALSE http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=STANDARDS&p_id=9765&p_text_version=FALSE http://www.access.gpo.gov/nara/cfr/cfrhtml_00/Title_40/40cfr68_00.html http://ceq.eh.doe.gov/nepa/regs/ceq/1508.htm http://www.directives.doe.gov/ http://www.directives.doe.gov/ http://www.directives.doe.gov/ DOE-HDBK-1163-2003 3 analyze potential dangers to workers, the public or the environment so that effective controls can be established to minimize or prevent adverse impacts. A comparison of the purpose and expectations of hazard analysis requirements is summarized in Appendix A. Each requirement source has a different focus such as emergency management, nuclear safety, chemical safety, or worker protection. However, common objectives are found among certain groups of requirements that can be characterized as addressing either (1) facility-level safety, (2) task-level safety, or (3) protection against a specific hazard or hazardous condition (e.g., beryllium, fire, criticality, natural phenomena). All of the identified hazard analysis requirements addressed in this guide fit into one of these three areas. The relationship of these hazard analyses and examples of the requirements is shown in Figure 1 and described in Section 2. Figure 1. Relationship of Hazard Analysis Activities and Requirements 3.1 Facility-Level Hazard Analysis Requirements Certain hazard analysis requirements are concerned with the impacts that hazardous or radiological materials may have on the safety of nuclear or non-nuclear facility operations or dispositioning. These requirements involve an evaluation of worker, public and environmental hazards associated with a facility’s operations (e.g., material processing, waste management, research, deactivation, or static conditions). This “facility-level” emphasis can be found in the following requirements: DOE-HDBK-1163-2003 4 • EPA’s Chemical Process Hazard Analysis (40 CFR 68, “Chemical Accident Prevention Provisions,” and 29 CFR 1910.119 [and 1926.64], “Process Safety Management”), • DOE’s nuclear facility safety analysis (10 CFR 830, Subpart B, “Nuclear Safety Management”), • Emergency Preparedness Hazard Assessment (DOE O 151.1, “Comprehensive Emergency Management System”, and • EPA’s Environmental Impact Statements (40 CFR Parts 1500-1508, “Council on Environmental Quality” and DOE’s 10 CFR 1021, “National Environmental Policy Act Implementing Procedures”).

Chemical/Nuclear Hazard Analysis. Chemical process hazard analysis (PrHA) is required by both OSHA (29 CFR 1910.119, and 29 CFR 1926.64) and EPA (40 CFR 68) for facilities exceeding established hazardous chemical threshold quantities. These two chemical safety regulations have essentially the same hazards analysis requirements (i.e., scope, techniques, and required documentation), although there are slight variances in the threshold quantities for various chemicals listed in each of these regulations. Both regulations also share similarity to 10 CFR 830, Subpart B that requires that a documented safety analysis (DSA) be prepared for certain DOE nuclear facilities. The PrHA and the DSA serve as the primary analysis of facility- level hazards, and both involve (1) identification of hazardous material or radionuclide inventories; (2) implementation of formal hazard analysis techniques that are commensurate with facility complexity; (3) identification of systems and equipment vital to safety; (4) formal documentation of findings; and (5) periodic updates of hazard analysis information. This overlap is recognized in DOE-STD-3009-94, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports, which points out that many of the requirements addressed in the OSHA PSM standard are directly parallel to DOE nuclear safety analysis topics. Because of the apparent similarities, it is reasonable to conduct one integrated hazard analysis at nuclear facilities at which all three regulations apply. However, DOE goes beyond the PrHA requirements of OSHA/EPA by requiring DSAs to evaluate potential consequences and estimation of the likelihood of accidents, both with and without the aid of protective features (e.g., physical barriers, engineered controls, etc). Since a DSA is more encompassing, it should be used as the primary vehicle for conveying the results of an integrated chemical/nuclear hazard analysis at nuclear facilities. Emergency Preparedness Hazard Assessment. The purpose of an Emergency Preparedness Hazard Assessment (EPHA) is to help define a facility’s emergency management plan and the associated Emergency Planning Zone. The EPHA requires an evaluation of traditionally defined "accidents" as well as those arising from external causes and malevolent acts. An analysis of challenges to, and failures of, barriers protecting hazardous or radioactive materials is used to determine the events and conditions that could result in the release of each hazardous material and the magnitudes of those possible releases. An EPHA is required by DOE O 151.1A, Comprehensive Emergency Management System, for facilities exceeding certain chemical or radiological hazard thresholds. For hazardous chemicals, this includes the lowest of Threshold Quantities (TQs) in 29 CFR 1910.119 (and 1926.64) or 40 CFR 68.130, or the Threshold Planning Quantities (TPQs) listed in 40 CFR 355. For chemicals not listed, the Reportable Quantities (RQs) for hazardous substances listed in 40 CFR 302.4 may be used. For radioactive materials, the limits are listed in 10 CFR 30.72, Schedule C. Because of these thresholds, an EPHA is required for a broad set of facilities that encompass (1) nuclear facilities subject to 10 CFR 830, Subpart B; (2) non-nuclear facilities subject to OSHA

http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=STANDARDS&p_id=9760&p_text_version=FALSE http://tis.eh.doe.gov/nsps/ourdocs.html http://www.directives.doe.gov/ http://ceq.eh.doe.gov/nepa/regs/ceq/1508.htm http://tis.eh.doe.gov/nepa/tools/REGULATE/NEPA_REG/1021/Sub-C.htm http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=STANDARDS&p_id=9760&p_text_version=FALSE http://www.access.gpo.gov/nara/cfr/cfrhtml_00/Title_40/40cfr68_00.html http://tis.eh.doe.gov/nsps/ourdocs.html http://tis.eh.doe.gov/nsps/ourdocs.html http://tis.eh.doe.gov/techstds/standard/appframe.html http://www.directives.doe.gov/ http://tis.eh.doe.gov/nsps/ourdocs.html DOE-HDBK-1163-2003 5 PSM and EPA RMP requirements; and (3) other facilities not subject to these regulations but containing hazardous/radioactive materials exceeding emergency management thresholds. The first two cases present the primary opportunity for hazard analysis integration since they involve applicability of multiple hazard analysis requirements. DOE G 151.1-1 V2, Hazardous Survey and Hazards Assessments, acknowledges similarities between the EPHA and safety analyses that are compliant with 10 CFR 830, Subpart B. This includes the use of common baseline hazards information, equivalency of many accident initiators and similarity in consequence assessment models. This similarity also extends to some aspects of PrHA performed for hazardous non-nuclear operations subject to the PSM and/or RMP requirements. However, there are also additional features of the EPHA, such as consideration of malevolent acts, or perhaps, some external hazards (e.g., site-wide chlorine release), which go beyond the scope of DSAs and PrHAs. Further, the EPHA involves the determination of protective action criteria based on the level of radiological and chemical releases to environs surrounding a facility. Hazards analysis data and results from DSAs, or PrHAs in the case of a non-nuclear hazardous facility may be useful as a primary basis for conducting EPHAs (alternatively, if EPHAs already exist, they can be used as source data for DSAs). This includes the use of baseline assumptions for material inventories (location, quantity and form), energy sources and accident initiators/scenarios needed in the EPHA to determine emergency management needs and establish emergency planning zones. This will help minimize the efforts needed to complete an EPHA. Environmental Impact Statements. The National Environmental Policy Act (NEPA) of 1969 [Section 102(2)(c) in 40 CFR 1502] requires that environmental impacts be evaluated for proposed activities that could harm the environment. An Environmental Impact Statement (EIS) is the vehicle for this analysis and is required by NEPA for certain classes of DOE activities as defined in 10 CFR 1021, National Environmental Policy Act Implementing Procedures (see Subpart D, Appendix D). Some examples of activities requiring an EIS include siting, construction, operation and decommissioning of nuclear fuel reprocessing facilities, waste disposal facilities, and incinerators. [NOTE: NEPA requirements related to “environmental assessments” do not explicitly require a hazard analysis and are therefore not presented in this section.]

For each of the alternatives considered in an EIS, an analysis of facility accidents must be prepared. This should involve a review of available hazard and accident analysis information from previous safety analysis documents, environmental assessment documents, or other available risk assessments such as a PrHA. Data that is common to these analyses and the EIS includes hazard assumptions such as source term estimates, accident initiators, and release scenarios. However, the EIS is somewhat different in the methods and targets chosen to evaluate potential consequences. For example, an EIS includes a broad focus on impacts to the “human environment” that involves consideration of long-term health and socio- economic impacts to populations (e.g., potential cancer fatality risks to workers and the public) from events such as groundwater contamination, as well as consideration of impacts to other natural resources. DSA and PrHA efforts primarily evaluate a range of accidents with the potential to significantly impact workers, the public and environment over a relatively short period of time. In spite of these differences, many of the basic assumptions supporting EIS- related hazard identification, hazard analysis, and accident analysis activities are consistent with nuclear safety analysis or chemical PrHA activities. http://www.directives.doe.gov/ DOE-HDBK-1163-2003 6 3.2 Requirements Related to Analysis of Specific Types of Hazards A second group of hazard analysis activities can be characterized as having in common a focus on specific types of hazards or hazardous conditions. Hazard analyses that fall into this category include the following: • Fire Hazards Analysis (DOE 420.1) • Nuclear Criticality Safety Evaluation (DOE 420.1) • Natural Phenomena Hazards Assessment (DOE 420.1) • Various Hazard Specific Regulations (e.g., Beryllium Hazards Assessment (10 CFR 850), OSHA regulations for asbestos and lead (1910.1001 and 1910.1025) Since each of these analyses is focused on a generically different hazard, there is little apparent overlap among requirements in this group. However, there are some basic links among these hazard analysis activities that should be considered, as well as a need for integration with nuclear safety analysis or PrHA activities. Fire hazards analysis (FHA), is required for all nuclear facilities or facilities that present unique or significant fire risks. This involves a comprehensive evaluation of fire hazards, including postulation of fire accident scenarios and estimates of potential consequences (i.e., maximum credible fire loss). DOE O 420.1, Facility Safety, requires that conclusions of the FHA be integrated into safety analysis reports (or DSAs per 10 CFR830). The DOE Implementation Guide G-420.1/B-0 (G-440.1/E-0) addresses this integration as follows: “When both an FHA and a SAR are developed for a facility, the developmental effort should be coordinated to the maximum extent possible to avoid duplication of effort. It is recognized, however, that because an FHA is based on the premise that a fire will occur and considers fire safety issues (property loss and program discontinuity potential) that are not normally considered in the SAR, the conclusions of the FHA may be more conservative than would normally be developed by a SAR alone. Nevertheless, the FHA and its conclusions should be addressed in the facility SAR in such a manner as to reflect all relevant fire safety objectives as defined in Paragraph 4.2.0.1 of DOE 420.1 and Section 2 of Attachment 1 of DOE 440.1.”

Although not stated, this same principle would apply to PrHA efforts at non-nuclear hazardous facilities that are subject to DOE 420.1. The Defense Nuclear Facilities Safety Board has noted several instances at DOE sites where FHAs are inconsistent with accident assumptions found in nuclear safety analysis (e.g., fire barriers were assumed in the safety analysis where they weren’t present). FHAs should be coordinated and integrated through teaming of fire safety personnel with hazard/accident analysts, and any conflicts related to FHAs and DSAs should be resolved prior to the approval of the DSA. A white paper on the topic of FHAs and safety analysis efforts has been prepared by members of the DOE fire safety community, and is provided in Attachment 3. Nuclear Criticality Safety Evaluations. DOE O 420.1 also requires a Nuclear Criticality Safety Evaluation (NCSE). An NCSE is an evaluation focused on facility piping, vessels and design features to identify the parameters, limits, and controls needed to prevent an inadvertent criticality. While this activity is not duplicative of safety analysis efforts, coordination and http://www.directives.doe.gov/ http://www.directives.doe.gov/ http://www.directives.doe.gov/ http://tis.eh.doe.gov/be/webdoc4.html-ssi DOE-HDBK-1163-2003 7 integration is necessary. The NCSE provides important assumptions and conclusions that must be reflected within DSAs regarding the initiators for a criticality event, as well as the necessary controls. Natural Phenomena Hazard Assessment. DOE O 420.1 also requires a Natural Phenomena Hazard Assessment (NPH). NPH assessments involve an assessment of the likelihood of future natural phenomena occurrences and the response of facility systems, structures and components to a design basis NPH event. The resulting information is used as important assumptions within safety analysis or PrHA to evaluate accident scenarios and consequences. Therefore, NPH assessments should be coordinated through teaming efforts with hazard/accident analysts. Various Regulations on Specific Hazards (e.g., Beryllium Hazards Assessment). A number of regulations have hazard analysis requirements that are specific to certain activities, hazardous conditions or specific substances. Appendix A lists several of these regulations. One example is the Chronic Beryllium Disease Prevention Program Plan as required by 10 CFR 850. This requires identification of the quantity and form of beryllium materials and their locations, as well as an assessment of possible beryllium exposures from planned activities. Much of the hazards information needed to meet hazard-specific regulations may be available in existing safety analysis, PrHA documents, airborne monitoring data, or other previous hazard assessments conducted at a facility. 3.3 Activity-Level Hazard Analysis Requirements A third group of hazard analysis activities can be characterized as focusing on worker related hazards associated with specific activity tasks. These include the following sources: • Worker Hazard and Risk Analysis of Hazardous Waste Cleanup Activities (29 CFR 1910.120 and 1926.55, “Hazardous Waste Operations and Emergency Response”) • Activity Hazard Analyses (DOE O 440.1A, “Worker Protection Management”) • Analysis of Occupational Radiation Hazards (10 CFR 835, “Occupational Radiation Protection”)

Each of the hazard analysis requirements reflected in this group is an integral part of work planning, which feeds into the preparation of hazardous and radiation work permits, Health and Safety Plans, Industrial Hygiene Plans and overall work packages and documentation. These activities have a different emphasis than facility-level hazard analysis, since they are primarily focused on worker protection. As such, activity-level hazard analysis addresses the hazards associated with individual job functions and tasks. In spite of these differences, there is an important link between facility and activity level hazard analysis requirements in terms of the flow of hazards information and data. For example, facility- level information and assumptions related to hazardous material inventory (e.g., quantity, form and location) feed into activity hazards analysis in order to help identify the range of potential hazards a worker may encounter while carrying out his/her duties (e.g., valve maintenance on a high pressure liquid hazardous waste line). Conversely, assessment of work-related hazards from activity-level analysis may yield insights into hazards that have not been adequately covered within facility-level analysis and as such may warrant further evaluation by a PrHA or DSA. HAZWOPER Risk Assessment. OSHA (29 CFR 1910.120) requires that a health and safety plan (HASP) be prepared for hazardous waste cleanup operations. The HASP must involve a hazard/risk assessment of planned activities to identify any conditions that pose significant http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=STANDARDS&p_id=9765&p_text_version=FALSE http://www.directives.doe.gov/ http://www.gpo.gov/nara/cfr/index.html DOE-HDBK-1163-2003 8 hazards to workers. A thorough hazard characterization provides the primary basis for the hazard/risk assessment and typically includes a facility walk down, visual inspections, air monitoring and sampling, and a review of facility records. Activity hazards analysis and radiation hazards surveys are important inputs to this process and form a basis for preparing a HASP. Activity Hazard Analysis. DOE 440.1A requires an analysis of design activities for new facilities or modifications to existing ones, operations and procedures, equipment, product and services. Impacts from exposure to chemical, physical, biological, or ergonomic hazards must be accomplished through the hazards analysis and exposure monitoring activities. The hazards analysis techniques used to accomplish these objectives shares some overlap with facility-level hazards analysis. For example, as discussed in DOE G 440.1-1, Worker Protection Management for DOE Federal and Contractor Employees Guide for Use with DOE Order 440.1, hazard analysis methodologies that may be employed to evaluate worker hazards could include preliminary hazards analysis, process hazard analysis, or a simple safety review. These methods are similar to what may be used in accomplishing facility-level hazards analysis and therefore may be coordinated to accomplish facility safety objectives, as well as ensure an adequate worker safety evaluation.

A key element of DOE 440.1A that is specifically relevant to individual job tasks is the performance of an activity hazards analysis. One type of Activity hazards analysis (AHA) is the JHA. A JHA involves a breakdown of work tasks and assessment of the hazards associated with each step of a work task. AHAs should be conducted during the planning stage for new operations and procedures, as well as prior to implementation of changes to existing operations and procedures. Information and insights gained from facility-level hazard analysis should be used as a primary input to AHAs. Examples include type, location and quantities of hazardous or radioactive materials, important assumptions and information regarding facility systems and processes, and facility controls that may need to be protected during performance of maintenance or other work activities. Radiation Hazards Survey. 10 CFR 835 requires sampling and monitoring of individuals and work areas in order to identify radiological hazards and potential sources of worker exposures. These activities are conducted routinely, as well as prior to authorization of work in a given area that has radioactive materials or contamination. This information is also key input to hazards analyses, since it provides important information regarding radiological hazards and helps determine when radiation control measures will need to be factored into planning of job tasks. DOE-HDBK-1163-2003 9 4.0 GOOD PRACTICES Good practices identified in this section are supportive of an integrated evaluation of hazards and when collectively implemented can improve effectiveness of hazard analysis and overall cost performance. These practices are based on observations by the CSTC working group and interactions with various DOE and industry organizations. A discussion of each practice is provided, along with additional sources of information that can be consulted for further explanation. 4.1 Multi-Disciplinary Teams Multi-disciplinary teams are needed to support all functions of an integrated safety management system, including hazard analysis. Teaming of safety, environmental, and line management disciplines is an effective way to help reduce uncertainties and redundancy of analysis activities. A team can be used to perform various hazard analysis activities such as identifying hazards and validating facility assumptions, screening of hazards, implementing hazard analysis techniques, establishing controls, and preparing safety documents. The size and composition of the team will vary depending on the combination, magnitude, and type of hazards involved, and the facility life cycle phase and complexity. A team leader should be appointed to organize, plan and lead each team that is performing a facility hazards analysis. This individual should have expertise in hazard and accident analysis. The team leader should ensure that DOE and contractor facility/project managers participate in hazard analysis activities. Individuals have valuable knowledge about the scope of operations, as well as specific knowledge of facility systems and layouts. Subject matter experts may be needed on a part- or full-time basis to support the team leader. These may include disciplines such as criticality engineers, fire protection specialists, health physicists, structural engineers, industrial hygienists, etc. For additional HA support for the team leader, Table 2 provides examples of potential subject matter experts based on the type work activities or hazardous conditions present in the facility. (NOTE: The table only provides a sampling of SMEs. Examples of disciplines not listed could include facility safety or emergency management personnel who would be involved in any HA activity, and would serve as the HA team leader cadre.)

The cross-section of various team member disciplines participating in a hazard analysis effort should begin communicating early in the process. Ideally, this should occur during the initial stages of work planning. This will permit ample scoping and identification of safety and technical disciplines needed to participate in preliminary hazard analysis activities. This early involvement will facilitate an integrated effort in which common hazard assumptions can be formulated as a collective group. Communication between team members should continue during the entire hazard analysis process to ensure that changes in work planning assumptions or new hazard discoveries will be appropriately evaluated. The team should also involve DOE or stakeholder counterparts where future review and approval of hazard analysis results is anticipated. This will help in preparing HA documents that meet stakeholder concerns. DOE-HDBK-1163-2003 10 Selection of team members must include facility workers for facility- and task-level analysis, and especially during activity hazards analysis (AHA). These individuals are a valuable source of facility knowledge, particularly when facility-operating records are sparse or not available. Additionally, workers bring skill-of-the-craft perspectives to activities such as AHA. Worker input should be solicited regarding present facility configuration, hazard uncertainties, and clarifications on facility history not available through facility documents. Table 2. Typical Subject Matter Experts Available to Support HA Team Leader Subject Matter Expert Support Work and Hazard Characteristics S IH RAD ENG ENV FP CRIT The activity presents a potential to release a hazardous substance to a space in a quantity sufficient to exceed IDLH conditions (e.g., O2 deficiency, release of toxic gases). X X The facility involves systems that contain flammable or combustible gases at positive pressure. X X X Work involves uncharacterized or unknown chemical hazards (abandoned equipment, unlabeled containers). X X X The work modifies or affects HVAC flow or local exhaust systems used to control exposures to radiological substances X X X X The work activity will involve or generate wastes X X The work could potentially affect the capability of an engineered safety feature or administrative control to prevent or mitigate a criticality accident X X X X X X Legend: CRIT-Criticality Safety ENG-Engineering (system or discipline) ENV-Environmental Engineer/Scientist FP-Fire Protection IH-Industrial Hygiene RAD-Radiological Control S-Industrial Safety NOTE: Workers should also be involved in hazard analysis activities. Also, medical surveillance staff help to ensure worker protection through evaluation of worker health and potential impacts associated with workplace hazards. Sources of Information on Multi-Disciplinary Teams: • DOE/EH-0506, Worker Involvement Lessons Learned and Good Practices from INEEL Facility Disposition Activities • DOE/EH-0486, Integrating Safety and Health During Facility Disposition, with Lessons Learned from PUREX • DOE/EH-413-0002, Facility Disposition: Principles for Accelerated Project Management DOE-HDBK-1163-2003 11 4.2 Collection and Integration of Hazards Information The OSHA PSM Rule requires that up-to-date chemical process safety information be collected and maintained before conducting a PrHA. Likewise, nuclear safety information and process knowledge is required to support safety analysis activities. The approach used to collect hazards information should be inclusive of all hazard types to support a balanced evaluation of hazards and necessary controls.

An integrated approach to information collection is a requirement for commercial nuclear operations subject to 10 CFR 70. This requires that process safety information be collected to support an integrated safety analysis and should be inclusive of information pertaining to the hazards of the materials used or produced in the process, information pertaining to the technology of the process, and information pertaining to the equipment in the process. Although not a requirement for DOE operations, this approach provides a good model that is also consistent with OSHA PSM requirements and DOE nuclear safety requirements. Hazardous Material Data Information about hazardous substances used in a process must be comprehensive enough for an accurate assessment of fire and explosion characteristics, reactivity hazards, criticality hazards, corrosion or other adverse effects on process equipment and various safety and health hazards. Information should include, as appropriate: (1) toxicity information; (2) permissible exposure limits; (3) physical data such as boiling point, freezing point, liquid/vapor densities, vapor pressure, flash point, auto ignition temperature, flammability limits (LFL and UFL), solubility, appearance, and odor; (4) reactivity data, including potential for ignition or explosion; (5) corrosivity data, including effects on metals, building materials, and organic tissues; (6) identified incompatibilities and dangerous contaminants; (7) thermal data (heat of reaction, heat of combustion); and (8) quantities, locations and forms of both hazardous and radioactive materials. Where applicable, process chemistry information should also be included about potential runaway reactions, overpressure hazards, and hazards arising from the inadvertent mixing of incompatible chemicals. Sources of these data should be indicated (e.g., MSDS) Process Technology Data Where facility processing of radiological or hazardous chemicals is conducted, process information should be collected and should include at least: (1) block flow diagrams; (2) process chemistry (including mixtures and intermediates); (3) established criteria for maximum inventory levels for process chemicals or radioactive materials; (4) process limits that, when exceeded, are considered an upset condition; and (5) qualitative estimates of the consequences of deviations that could occur if established process limits are exceeded. Facility Process Equipment Information Facility and process equipment information should include at least: (1) materials of construction; (2) piping and instrumentation diagrams (P&IDs); (3) electrical classification; (4) relief system design and design basis; (5) ventilation system design; (6) design codes and standards; (7) material and energy balances for processes; (8) safety systems; (9) major energy sources; and (10) interfaces with other facilities. DOE-HDBK-1163-2003 12 Sources Requiring the Collection of Hazards Information: • 10 CFR 70.62 (Domestic Licensing of Special Nuclear Material) • NUREG-1520, Chapter 3, Integrated Safety Analysis and ISA Summary (http://techconf.llnl.gov/cgi-bin/downloader/Part_70_lib/073-0161.pdf) • DOE HDBK-1100-96, Chemical Process Hazard Analysis • 29 CFR 1910.119, Process Safety Management 4.3 Screening of Multiple Hazard Types

Hazard screening is a useful process that can help pinpoint the presence of certain hazard types and does not require comprehensive or formalized analysis to develop a control strategy. Many DOE sites use screening processes in conjunction with collection of hazard baseline information to make decisions on the rigor of hazard analysis, safety documentation that may be required and the processes required for work authorization. Screening is also routinely incorporated into work planning activities through the use of checklists as a part of activity hazards analysis. In most cases, hazard screening helps to identify standard industrial hazards (SIH) that are routinely encountered. This includes hazards that (1) are well understood, (2) have adequate safety guidance relative to their use, and (3) may be adequately controlled by compliance with OSHA regulations or consensus standards. Examples of SIHs include small quantities of hazardous materials (e.g., radiological or chemical) and occupational hazards typically associated with mechanical presses, machine shops, forklifts, and heavy equipment operation. The key to an effective screening process is that it encompasses a comprehensive listing of multiple hazard types and has a basis linked to regulatory requirements. A composite list of sample screening criteria is provided in Table 3, based on observed practices from various DOE sites. These criteria are for information purposes only. Site-specific definitions should take precedence over those used in the table. While screenings are useful tools, users should bear in mind that SIHs must still be considered as initiators for accidents involving other hazards. For example, flammable materials may be screened out as an SIH, however, if the flammable materials could potentially cause a fire that releases toxic or radiological materials, the flammable materials must be considered as a potential initiator for a toxic material release. Additionally, SIHs can result in significant injury to workers and, although well understood, may need to be further analyzed by a AHA. http://www.nrc.gov/reading-rm/doc-collections/cfr/part070/part070-0062.html http://www.nrc.gov/materials/fuel-cycle-fac/regs-guides-comm.html http://tis.eh.doe.gov/techstds/standard/appframe.html http://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=STANDARDS&p_id=9760&p_text_version=FALSE DOE-HDBK-1163-2003 13 Table 3. Sample Criteria for Determining Hazards Beyond Standard Industrial Hazards (SIH) Type of Hazard Thresholds Below Which SIHs can be defined Radioactive material Any radioisotope meeting or exceeding the Table A1, DOE-STD-1027-92 TQ criteria; or exceeding the Appendix B, 40 CFR 302 RQ criteria. The inventory/RQ or Inventory/TQ ratios should be added when making this evaluation. Radioactive surface contamination Measurements of fixed, removable, or both exceed values in 10 CFR835 Radioactive waste >0.002µCi per gram of waste Toxic material (including combustion products) Any toxic chemical or combustion products or any other known toxic material (e.g., NIOSH Pocket Guide to Chemical Hazard lists an IDLH) Carcinogen Any known carcinogen Biohazard Any known biohazard where special controls are required Asphyxiant Any asphyxiant that could affect workers Flammable Material > 5000lb. of a liquid with a flash point < 100o F or > 3000 standard ft3 of a gas with an established lower explosive limit (LEL)

Reactive Material > 10 lb of a substance with an NFPA reactivity hazard level > 2 Explosive Material Any 49 CFR 173 Division 1.1, 1.2, or 1.3; or > 10 oz of Division 1.4 Electrical Energy Unusual application not adequately controlled by OSHA (e.g., soil vitrification); > 800 volts and 24 ma output; or stored energy > 50 joules at 600 volts Kinetic Energy High energy (e.g., flywheel or centrifuge-type equipment) High Pressure 3,000 psig or 0.1 lb TNT (1.4 x 105 ft-lbf) equivalent energy Lasers Any Class IV, any Class III with non-enclosed beam per American National Standards Institute Z-136.1 Potential Energy Elevated mass with “high” potential energy Accelerators Keep (Classify based on DOE Order 420.2A) X-ray Machines Any not meeting ANSI N537/NBS123 requirements DOE-HDBK-1163-2003 14 4.4 Evaluation of Facility Hazards and Potential Accidents (Facility Level) As discussed in Section 3 and shown in Figure 1, there are several opportunities for integrating HA activities at the facility-level. In particular, activities related to the performance of PrHA and nuclear facility safety analysis serve as the primary baseline for establishing a “safe envelope” under which a facility can operate. These HA activities share much in common and present an opportunity for streamlining HA activities. This practice is recognized and encouraged by DOE- STD-3009 and DOE-HDBK-1100-96, DOE Handbook on Chemical Process Hazard Analysis, where both are required at a particular facility. Integration can be achieved through a single set of hazard/accident analyses and documentation, assuming DOE contractors work with local site management during the initial planning process and agree on the approach and expectations. More generally, there are several practices related to all facility-level HA activities that can improve cost-effectiveness and reduce technical inconsistencies among HA efforts. The practice addressed in Section 3.1, as related to the use of Teams, is of primary importance. Improving communication among safety disciplines, analysts and facility/project management cannot be overemphasized as the most important element to ensuring team performance and integration of HA activities. Not adhering to the practice will result in duplicative efforts and possibly inconsistent assumptions on consequences and necessary controls related to the same set of hazards. This applies to both contractor and DOE organizations and is necessary to ensure that goals and expected HA outcomes are commonly understood and shared among all participants. This practice also must be extended to worker involvement. Another important practice that improves cost effectiveness of HA activities is the standardization and appropriate use of HA tools and techniques used at a given facility or site. HA techniques vary in sophistication and cost of implementation, and users should ensure techniques are appropriately selected for the condition being analyzed. For example, a Hazard and Operability Study may be excessive for a non-complex operation such as a waste storage facility. Instead, a qualitative technique such as a hazards checklist may be sufficient. The application of a wide variety of HA techniques and tools translate into additional personnel training and procedures that must be provided on their use. The Center for Chemical Process Safety provides useful guidelines (see reference) on selecting and grading HA techniques.

It is also important to select appropriate methods and models for estimating consequences from hazardous material releases. As encouraged by DOE G-151-1, Emergency Management Guide: Hazards Surveys and Hazards Assessments, and similar consequence assessment models should be used for emergency planning and response purposes, as well as safety analysis activities. Where dispersion and consequence models are necessary, they should be appropriate for the material being released, the physical characteristics of the site and its atmospheric dispersion conditions. Additional recommendation on selection of consequences modeling can be found in DOE G-151-1. Sources of Information on Integration of Facility Accident Analysis: • DOE HDBK-1100-96, “Chemical Process Hazard Analysis” • DOE-STD-3009, “Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports” • Center for Chemical Process Safety (CCPS), “Guidelines for Hazard Evaluation Procedures, Second Edition with Worked Examples” http://tis.eh.doe.gov/techstds/standard/appframe.html http://tis.eh.doe.gov/techstds/standard/standfrm.html http://www.aiche.org/ccps DOE-HDBK-1163-2003 15 • DOE G-151-1, “Emergency Management Guide: Hazards Surveys and Hazards Assessments” 4.5 Coordination of Annual Updates to Hazard Analysis Documents Hazard analyses should be maintained to ensure they are reflective of the current facility work scope and hazards. This can be important as operations, facility configuration, work activities, or hazardous material inventories may change. Many of these changes are controlled through formal change control processes and mechanisms that are applied to DOE nuclear operations. Nuclear facilities are required to use the Unreviewed Safety Question (USQ) process (10 CFR 830.203) that provides a level of review and control for safety basis documents; however, the USQ process will not maintain current the safety basis documents and those supporting documents (such as FHAs, process descriptions, etc.) upon which the safety basis is founded. A comprehensive change control process that incorporates the USQ process is still needed. These same concepts must also be applied to non-nuclear facilities to maintain accurate hazard analysis and supporting facility documents. Several DOE directives require that hazard analyses and associated documents be updated and submitted to DOE on an annual basis. Primarily affected are Documented Safety Analyses required by 10 CFR 830, Emergency Planning Hazard Analyses required by DOE O 151.1, and Fire Hazards Analysis required by DOE O 420.1. Since all of these documents are closely related for a particular facility, they are similarly affected by facility changes. Resource utilization can be improved through the coordination of annual updates for these hazard analysis documents. Participants responsible for each hazard analysis should work together on the potential changes that need to be reflected within annual updates. There should be consistency in how changes are noted and addressed and a collective agreement on their significance. This can best be achieved by scheduling updates on the same annual basis and the institution of a comprehensive and integrated change control process within the plant or facility. [NOTE: Significant changes such as a proposed new activity or a positive USQ are considered to be outside of this recommended practice and would potentially require a new hazard analysis that is irrespective of the annual update.]

Sources of Information on Annual Updates: • DOE G 421.1-2, “Implementation Guide for Use in Developing Documented Safety Analyses to Meet Subpart B of 10 CFR 830” • DOE G-151-1, “Emergency Management Guide: Hazards Surveys and Hazards Assessments” http://www.directives.doe.gov/ http://www.directives.doe.gov/ DOE-HDBK-1163-2003 16 4.6 Streamlining Activity-Level Hazard Analysis An analysis of individual work activities/tasks (i.e., maintenance, equipment upgrades, etc) is needed in order to understand the potential dangers that workers face during the course of their duties. This evaluation should rely on hazards information collected, as well as findings from facility-level analysis, and should be inclusive of all sources of hazards including hazardous chemicals, excessive physical stresses, radioactive materials, or other potential dangers. Activity-level hazard analysis should be integrated with work planning and control processes and institutionalized within procedures. An effective approach used at many DOE sites is a work screening process that considers the complexity of work to be performed, personnel experience and potential hazards associated with job tasks. These factors determine the necessary safety disciplines that should be involved in the activity hazards analysis process, the level of analysis required, and the documentation (e.g., work permits) required to authorize work. Several DOE sites have saved considerable resources by using computer-based tools to help automate activity-level hazard screening and analysis. Most of these systems provide electronic linkages to standards, regulations and required permits, as well as specific facility and hazards information. Some systems go even further by providing checklists or questions that help guide planners and safety professionals through the hazard analysis process. While these systems can be valuable tools, they must be used with care so as not to replace sound human judgment and analytical thinking. However, used properly, these systems can enhance communication among various safety disciplines, work planners, and other decision makers. Sources of Information on Activity-Level Hazard Analysis: • DOE-STD-1120-98, Integration of Environment, Safety and Health into Facility Disposition Activities • DOE/EH-0486, Integrating Safety and Health During Facility Disposition, with Lessons Learned from PUREX • Hanford Automated Job Hazards Analysis Tool (http://tis.eh.doe.gov/ewp/sites/hanford/AJHA_description0801.pdf) 5.0 References 10 CFR 70, “Domestic Licensing of Special Nuclear Material” 10 CFR 830, “Nuclear Safety Management” 10 CFR 835, “Occupational Radiation Protection” 10 CFR 835, Chronic Beryllium Disease Prevention Program” 10 CFR 1021, “National Environmental Policy Act Implementing Procedures” 29 CFR 1910.119 and 1926.64, “Process Safety Management of Highly Hazardous Chemicals” 29 CFR 1910.120 and 1926.55, “Hazardous Waste Operations and Emergency Response” http://tis.eh.doe.gov/techstds/standard/standfrm.html http://tis.eh.doe.gov/ewp/sites/hanford/AJHA_description0801.pdf DOE-HDBK-1163-2003 17 29 CFR 1910, Subpart Z, “Toxic and Hazardous Substances” 40 CFR 68, “Chemical Accident Prevention Provisions” 40 CFR 260 et seq, “Hazardous Waste Management System” (RCRA) 40 CFR 1500-1508, “Council on Environmental Quality” 40 CFR Subchapter J, “Superfund, Emergency Planning and Community Right-to-Know Programs”

NUREG-1520, Chapter 3, Integrated Safety Analysis and ISA Summary (http://techconf.llnl.gov/cgi-bin/downloader/Part_70_lib/073-0161.pdf) DOE HDBK-1100-96, Chemical Process Hazard Analysis DOE-STD-1120-98, Integration of Environment, Safety and Health into Facility Disposition Activities DOE-STD-3009-94, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Documented Safety Analysis DOE/EH-0506, Worker Involvement Lessons Learned and Good Practices from INEEL Facility Disposition Activities DOE/EH-0486, Integrating Safety and Health During Facility Disposition, with Lessons Learned from PUREX DOE O 151.1A, Comprehensive Emergency Management System DOE O 420.1A, Facility Safety DOE G 420.1-1, Nonreactor Nuclear Safety Design Criteria and Explosive Safety Criteria Guide for use with DOE O 420.1 Facility Safety DOE G 420.1-2, Guide for the Mitigation of Natural Phenomena Hazards for DOE Nuclear Facilities and NonNuclear Facilities DOE G 420.1/B-0 and 440.1/E-0 (DOE G 440.1-5), Implementation Guide for Use with DOE Orders 420.1 and 440.1 Fire Safety Program DOE G 421.1-2, Implementation Guide for Use in Developing Documented Safety Analyses to Meet Subpart B of 10 CFR 830 DOE O 440.1A, Worker Protection Management for DOE Federal and Contractor Employees DOE G 440.1-1, Worker Protection Management for DOE Federal and Contractor Employees Guide DOE M 440.1-1, DOE Explosives Safety Manual DOE-HDBK-1163-2003 18 DOE G 450.4-1B, Integrated Safety Management System Guide Center for Chemical Process Safety (CCPS), Guidelines for Hazard Evaluation Procedures, Second Edition with Worked Examples, 1992, American Institute of Chemical Engineers, New York, NY Defense Nuclear Facilities Safety Board, Technical Report-16, Integrated Safety Management DOE-HDBK-1163-2003 A-1 Appendix A, Summary Comparison of Hazard Analysis Requirements DOE-HDBK-1163-2003 A-2 Hazard Analysis Requirements Purpose Expectations Thresholds for Applicability Safety Documentation Integration with Other HA Requirements 48 CFR 970.5204-2 (c)(2), DOE Acquisition Regulations (ES&H Clause) FOCUS: Safety in all Aspects of Work Requires an identification and evaluation of hazards associated with work as part of an overall documented safety management system Identify hazards associated with planned work No restrictions on applicability • Documented Safety Management System The DEAR ES&H Clause requires that contractors have a documented safety management system that dictates an evaluation of hazards as a prerequisite to performing work 29 CFR 1910.119, Process Safety Management of Highly Hazardous Chemicals; and 40CFR68.67, Chemical Accident Prevention Provisions- Process Hazards Analysis FOCUS: Worker Safety Establish process safety management programs for facilities with hazardous chemicals exceeding established thresholds • Review previous incidents with potential for catastrophic consequences • Identify/analyze chemical process hazards using hazard evaluation technique appropriate for facility complexity (What-If/Checklist, HAZOP, FMEA, or equivalent) • Identify engineering and administrative controls applicable to hazards • Document findings and recommendations and prepare a written schedule for corrective actions • Update PrHA every 5 years Chemical inventories that exceed OSHA PSM Threshold Quantities and EPA RMP Threshold Quantities • Process Hazard Analysis Document • Corrective Action Plan • Risk Management Plan

Integration between process hazard analysis and nuclear facility safety analysis is discussed and encouraged in DOE-STD-1027-92, DOE-STD- 3009-94, EM-STD-5502, DOE- STD1120-98 and DOE-HDBK- 1100-96. Much similarity in EPA, OSHA and nuclear safety analysis requirements. One hazard analysis could satisfy all three requirements 10 CFR 830, Nuclear Safety Management (Note: Also covers DOE Order 5480.23) FOCUS: Worker, Onsite Population, Public and Environment • Prevent or mitigate potential consequences from hazardous/radiologica l material releases • Ensure defense in depth and worker protection measures • Provide a technical basis for authorizing safe operation of nuclear facilities • Identify inventory of facility hazardous/radiological materials • Perform hazard analysis and classification • Analyze potential accidents and establish engineering and administrative controls • Identify safety-class and safety- significant SSCs • Prepare a Documented Safety Analysis • Update annually Radiological inventories that exceed Hazard Category 1, 2, or 3 thresholds of DOE-STD- 1027-92 • Documented Safety Analysis, and • Technical Safety Requirements See comments above (WHICH?). • Other potential integration points: • Assumptions and findings from fire hazard analysis • Safety analysis provides sound basis for EIS and emergency management hazard analysis accident assumptions http://www.explorer.doe.gov/ DOE-HDBK-1163-2003 A-3 Hazard Analysis Requirements Purpose Expectations Thresholds for Applicability Safety Documentation Integration with Other HA Requirements 29 CFR 1910.120, Hazardous Waste Operations and Emergency Response FOCUS: Worker Safety Ensure worker risks associated with hazardous wastes are evaluated and communicated to employees at hazardous waste cleanup sites • Identify any suspected condition that may be immediately dangerous to life and health or other conditions that may cause death or serious harm • Calculate worker risks associated with hazardous substances and inform employees • Determine appropriate site controls and PPE • Prepare health and safety plan (HASP) Applies to facility/site cleanup activities that are regulated (e.g., 29 CFR 1910.120, 29 CFR 1926.65, CERCLA) and pose a “reasonable possibility for exposure” to workers HASP Document The DOE Handbook for Occupational Health and Safety During Hazardous Waste Activities, June 1996, encourages analysts to review safety analysis and process hazard analyses and use data as input to preparing Health and Safety Plans. DOE O 151.1, Comprehensive Emergency Management System FOCUS: Public and Onsite Population Obtain hazards information in order to identify resources, personnel and equipment for emergency hazardous materials program and define a facility’s emergency management plan and Emergency Planning Zones • Identify and screen hazardous chemicals and radiological materials • Develop emergency response plans • Analyze potential accident events • Estimate consequences • Update annually Chemicals: Lowest of threshold quantities in 29 CFR 1910.119, 40 CFR 68.130, or TPQ in 40 CFR 355 (Use 40CFR302.4 for chemicals not found in stated regulations) Radiological: Thresholds given in 10 CFR 30.72, Schedule C Emergency Planning Hazard Assessment DOE G 151.1-1 encourages the hazard assessment to make use of facility description and accident scenarios from safety analysis, as well as hazardous material estimates used for other purposes

DOE-HDBK-1163-2003 A-4 Hazard Analysis Requirements Purpose Expectations Thresholds for Applicability Safety Documentation Integration with Other HA Requirements Fire Hazards Analysis. Identify the potential for fire loss (life, monetary and mission) and justify the appropriate fire protection programs and systems to meet the DOE fire protection goals established in DOE Order 420.1. • Identify fire hazards (e.g., energy sources, building construction, combustibles) • Postulate possible fire accident scenarios • Estimate potential consequences (e.g., maximum credible and possible fire loss) and assess adequacy of controls • Provide recommendations related to any deficiencies Required for all nuclear facilities, significant new facilities and facilities that present unique or significant fire safety risks FHA Document DOE O 420.1 requires that conclusions of the FHA be integrated into the safety analysis. This practice should also apply to chemical operations within the scope of DOE O 420.1 Natural Phenomena Assessment. Ensure that NPH impacts on facility safety are assessed and adequately controlled • Conduct NPH site investigation using DOE-STD-1022 • Conduct Probabilistic Seismic Hazard Analysis (PSHA) to produce a seismic hazard curve to be used in selecting the design basis earthquake (DBE) for PC-3 and PC-4 SSCs. • Choose DBE and analyze SSC response and necessary controls Applied on a graded approach depending on facility and system, structure or component Performance Category (see DOE -STD-1021- 93) NPH Document NPH assessment results must be integrated into safety analysis and evaluated as an accident initiator DOE O 420.1, Facility Safety (Note: Requires a fire hazards analysis, natural phenomena assessment, and a criticality safety evaluation) FOCUS: Public, Onsite Population, and Worker Safety Criticality Safety Program Evaluation. Document the parameters, limits, and controls needed to prevent inadvertent nuclear criticality • Perform nuclear criticality safety evaluations for normal and abnormal credible accident conditions Applies when a facility has fissionable nuclides of concern as addressed in Table 4.3-1 of DOE 420.1 CSE Document Integration is only at issue with nuclear safety analysis activities DOE O 440.1A, Worker Protection Management FOCUS: Worker Safety Ensure that workplace hazards and risk of associated worker injury or illness are adequately controlled • Analyze designs for new facilities and modifications to existing ones, operations and procedures, and equipment, product and services. • Assess worker exposure to chemical, physical, biological, or ergonomic hazards. None. Applies to all DOE and contractor activities, where present within management and operating contracts • Activity Hazards Analysis • Health and Safety Plan • Work Permits • Chemical Hygiene Plan • HA for substance specific standards, i.e., Oriented primarily at the task or activity level. Facility-level analysis such as process hazard analysis or nuclear safety analysis should be used a major input to worker hazard analysis activities. Conversely, worker DOE-HDBK-1163-2003 A-5 Hazard Analysis Requirements Purpose Expectations Thresholds for Applicability Safety Documentation Integration with Other HA Requirements • Evaluate workplace activities through activity hazards analysis Asbestos, lead, etc. hazards analysis may provide insights into facility hazards not adequately analyzed in existing safety analysis or process hazard analysis.

DOE O 451.1A, National Environmental Policy Act Compliance Program, and 40 CFR 1502, Environmental Impact Statement; 10 CFR 1021, DOE NEPA Procedures FOCUS: Environment, Public Provide the regulators and public with maximum potential environmental and health effects associated with planned work activities or accidents • Evaluate direct and indirect environmental effects and their significance from proposed DOE actions EIS required for classes of actions as described in Appendix D to Subpart D of 10 CFR 1021 Environmental Impact Statement An EIS should rely on analytical assumptions from DSAs or process hazard analyses 10 CFR 850, Chronic Beryllium Disease Prevention Program FOCUS: Worker Safety Ensure that beryllium hazards and potential exposure pathways are identified and controlled • Analyze existing facility conditions, exposure data, medical surveillance trends, • Identify quantities and forms of beryllium • Identify locations of beryllium materials • Assess exposure potential of planned activities Presence of beryllium materials or residues • Chronic Beryllium Disease Prevention Plan • Hazard Assessment Report Existing hazard analysis documents such as safety analysis should be used as input in surveying beryllium hazard potential Various Hazard or Activity Specific OSHA Regulations. Note: DOE O 440.1A requires the Ensure that worker hazards are controlled and appropriate personal protective equipment used when appropriate • Analyze health hazards associated with specific job activities • Measure worker exposures to chemical substances • Provide appropriate engineering and administrative controls to Substance or operation- specific, such as: • Lead • Asbestos • Beryllium • Chemical Hygiene Plan • Job safety analysis • Work permits • Work packages • Health and Safety Plan Compliance with applicable OSHA regulations is required by DOE O 440.1A. Activities prescribed by the order are consistent with, and should not be duplicative of OSHA DOE-HDBK-1163-2003 A-6 Hazard Analysis Requirements Purpose Expectations Thresholds for Applicability Safety Documentation Integration with Other HA Requirements implementation of 29 CFR 1910 and 1926. Examples include: 29 CFR 1910.146, Permit-required Confined Spaces; 29 CFR 1910.132, Personal Protective Equipment; 29 CFR 1910.94, Ventilation; 29 CFR 1910.1450, Occupational Exposure to Hazardous Chemicals in Laboratories FOCUS: Worker Safety minimize and control worker exposures • Identify hazards that can only be controlled by personal protective equipment • Work performed in confined spaces, • Laboratory operations, • Blasting operations requirements DOE-HDBK-1163-2003 B-1 Appendix B. White Paper on Fire Hazards Analysis DOE-HDBK-1163-2003 B-2 THE PRACTICAL IMPLEMENTATION OF INTEGRATED SAFETY MANAGEMENT FOR NUCLEAR SAFETY ANALYSIS AND FIRE HAZARD ANALYSIS DOCUMENTATION M. T. Collopy, M.S. and C. P. Christenson, P.E. U.S. Department of Energy 825 Jadwin Ave. (A5-55) Richland, WA 99352 Michael_t_mike_collopy@rl.gov (509) 376-6284 Craig_p_christenson@rl.gov (509) 376-5367 Abstract In 1995 Mr. Joseph DiNunno of the Defense Nuclear Facilities Safety Board issued an approach to describe the concept of an integrated safety management program, which incorporates hazard and safety analysis to address a multitude of hazards affecting the public, worker, property, and the environment. Since then the U.S. Department of Energy (DOE) has adopted a policy to systematically integrate safety into management and work practices at all levels so that missions can be completed while protecting the public, worker, and the environment.

While the DOE and its contractors possessed a variety of processes for analyzing fire hazards at a facility, activity, and job; the outcome and assumptions of these processes have not always been consistent for similar types of hazards within the safety analysis and the fire hazard analysis. Although the safety analysis and the fire hazard analysis are driven by different DOE Orders and requirements, these analyses should not be entirely independent and their preparation should be integrated to ensure consistency of assumptions, consequences, design considerations, and other controls. Under the DOE policy to implement an integrated safety management system, identification of hazards must be evaluated and agreed upon to ensure that the public, the workers, and the environment are protected from adverse consequences. The DOE program and contractor management need a uniform, up-to-date reference with which to plan, budget, and manage nuclear programs. It is crucial that DOE understand the hazards and risks necessary to authorize the work needed to be performed. If integrated safety management is not incorporated into the preparation of the safety analysis and the fire hazard analysis, inconsistencies between assumptions, consequences, design considerations, and controls may occur that affect safety. Furthermore, confusion created by inconsistencies may occur in the DOE process to grant authorization of the work. In accordance with the integrated safety management system approach for having a uniform and consistent process, a method has been suggested by the U.S. Department of Energy at Richland and the Project Hanford Procedures when fire hazard analyses and safety analyses are required. This process provides for a common basis approach in the development of the fire hazard analysis and the safety analysis. This process permits the preparers of both documents to jointly participate in the development of the hazard analysis process. This paper presents this method to implement the integrated safety management approach in the development of the fire hazard analysis and safety analysis that provides consistency of assumptions, consequences, design considerations, and other controls necessary to protect workers, the public, and the environment. DOE-HDBK-1163-2003 B-3 Background A problem often encountered in facilities handling radioactive and hazardous materials is the lack of both a consistent understanding and a consistent analysis of the many hazards affecting the environment, public, workers, and property. This can happen for a variety of reasons. It may be due to individuals with different academic backgrounds (scientific, engineering, legal) and professional experiences (operators, regulators, management, enforcement personnel). All of these individuals may interpret a vast array of Department of Energy (DOE) requirements in disparate ways1. One area where analysts, managers, and engineering professionals often find inconsistencies is in the development and understanding of fundamental fire hazards that may be encountered in a nuclear facility. DOE nuclear facilities to demonstrate that the objectives of the DOE fire protection program are being met by these facilities requires a comprehensive fire hazard analysis. These objectives include • Providing fire protection features so as to minimize the potential for the occurrence of a fire or fire-related event; • Ensuring that a fire does not cause an unacceptable on-site or off-site release of hazardous or

radiological material that will threaten the environment, the public, or the health and safety of employees; • Ensuring that there will not be unacceptable interruptions as a result of fire and related hazards in vital DOE programs; • Ensuring that property losses from a fire and related events will not exceed defined limits established by DOE; and • Ensuring that critical process controls and safety class systems will not be damaged as a result of a fire and related events.2 Similarly there are objectives for safety authorization basis documentation for DOE nuclear facilities. These objectives include • Providing DOE a basis for approval of design, construction, operation, decontamination, or decommissioning of the facility; • Providing the defining and controlling safety bases and commitments; • Providing support to DOE and contractor management safety oversight of the facility and operations; and • Providing the analytical rationale for the facility to operate safely in terms of health, safety, and other potential radiological impacts to on-site workers and the public.3 Certainly there are commonalties between the objectives of both the safety analysis documentation and the fire hazard analysis documentation. In terms of safety both are interested in describing the hazards and risks. Both are interested in determining engineering and administrative practices necessary to protect the environment, public, workers, and property. Both must be meticulously interested in • Preventing exposure to certain hazards (in this case fire); • Preserving functions associated with structures, systems, and components; • Mitigating the release of hazardous or radiological materials; and • Determining functions necessary to execute these safety functions. DOE-HDBK-1163-2003 B-4 So why is it so often that -- in terms of fire hazards -- when one compares the safety analysis documentation to the fire hazard analysis for the same facility; we often find dissimilar analyses, different mitigation methods, and inconsistencies in the area of fire-related hazards? Perhaps the answer is that the DOE objectives of the two are similar in some ways but different in other ways. Are the analytical techniques, which are acceptable for the safety hazard analysis, not acceptable for the fire hazard analysis? Could it be that the fire protection engineer just doesn’t understand the safety analyst or vice versa? DOE and its contractors possess a variety of processes for analyzing fire hazards at a facility, activity, and job. The outcome and assumptions of these processes have not always been consistent for similar types of hazards within the safety analysis and the fire hazard analysis. Perhaps the root cause lies in the fact that we have yet to embrace the challenge to integrate and institutionalize work planning in the development of these two documents4. While the safety analysis and the fire hazard analysis are driven by different DOE Orders and requirements, these analyses should not be entirely independent and their preparation should be integrated to ensure consistency of assumptions, consequences, design considerations, and other controls.

Under the DOE policy to implement an integrated safety management system, identification of hazards must be evaluated and agreed upon to ensure that the environment, the public, and the workers are protected from adverse consequences.5 The DOE program and contractor management need a uniform, up-to-date reference with which to plan, budget, and manage nuclear programs. It is crucial that the DOE understands the hazards and risks necessary to authorize the work, which needs to be performed. If integrated safety management is not incorporated into the preparation of the safety analysis and the fire hazard analysis, inconsistencies between assumptions, consequences, design considerations, and controls may occur that affect safety. Furthermore, confusion created by inconsistencies may occur in the DOE process to grant authorization of the work. The Department of Energy is committed to conducting work efficiently and in a manner that ensures protection of the environment, the public, and its workers. Hazards and safety functions of both the safety and fire hazard analyses documentation should be consistent so that there is no confusion to both contractor and DOE operations and management. Take the integrated safety management system challenge and utilize integrated safety management in the preparation of the safety analysis and the fire hazard analysis. Overview of one methodology to integrate safety management into safety and fire hazard analysis documentation In accordance with the integrated safety management system approach for having a uniform and consistent process, a process has been suggested by the U.S. Department of Energy at Richland and the Project Hanford Procedures for any case when fire hazard analyses and safety analyses are required.6 This process provides for a common basis approach to develop both fire hazard analyses and the safety analyses. This process permits the preparers of both documents to jointly participate in the development of the hazard analysis process. The process assists in ensuring that the accident analyses for fire and explosion events are consistent in both the fire hazard analysis and facility safety documentation. In accordance with the Integrated Safety Management System approach for having "similar and consistent processes for dealing with different types of hazards" the following process is utilized to ensure consistency: DOE-HDBK-1163-2003 B-5 1. The fire hazard analysis author and the safety analyst jointly identify fire-related hazards and evaluate the postulated fire scenario(s). At this stage, the hazardous conditions evaluated must not reflect prevention or mitigation by engineered barriers, facility systems, manual intervention, or administrative controls. 2. All credible initiating events, which can cause one or more fires and define or influence their characteristics and severity, are identified. 3. The postulated fire(s) using the analytical methods selected are evaluated. It is recognized that a variety of hazardous conditions may require evaluation to ensure that all of the objectives of the DOE Orders are met. 4. The safety analyst follows the criteria for the nuclear safety documentation to report the risk to the health and safety of the public and onsite workers and to identify engineered features and controls that prevent or mitigate the progression of the postulated fire event(s). 5. The fire hazard analysis uses the postulated fire(s) to identify fire protection design

features. The fire hazard analysis assesses the fire loss, identifies protection and life safety features required in the facility, and addresses program interruption to the facility. 6. The fire hazard analysis addresses the impact of fire and explosion on essential safety functions as identified by the nuclear safety documentation. The fire hazard analysis must consider protection of structures, systems and components (SSCs) important to safety and evaluate the need for fire separation of redundant SSCs. 7. The final fire hazard analysis is referenced by the facility nuclear safety authorization basis documentation, that is, either the final safety analysis report, basis for interim operation report, or interim safety basis report. References 1. J. J., DiNunno, “Fundamentals for Understanding Standards-Based Safety Management of Department of Energy Defense Nuclear Facilities,” Defense Nuclear Facilities Safety Board, DNFSB/TECH-5, May 31, 1995. 2. DOE 420.1, “Facility Safety,” U.S. Department of Energy, October 13, 1995. 3. DOE 5480.23, “Nuclear Safety Analysis Reports,” U.S. Department of Energy, April 10, 1992. 4. J. J., DiNunno, “Integrated Safety Management,” Defense Nuclear Facilities Safety Board, DNFSB/TECH-16, June 1997. 5. DOE P 450.4, “Safety Management System Policy,” U.S. Department of Energy, October 15, 1996. 6. RLID 420.1, “Fire Protection,” U.S. Department of Energy Richland Operations Office, March 1999. DOE-HDBK-1163-2003 B-6 CONCLUDING MATERIAL Review Activity: Preparing Activity: DOE Field Offices DOE-EH-52 DP AL EH ID Project Number: EM SR SAFT-0085 NE Fernald SC National Laboratories BNL LLNL LANL PNL Sandia Area Offices Amarillo Area Office Kirtland Area Office Princeton Area Office Rocky Flats Area Office Table of Contents