DOE-HDBK-1163-2020, Integration of Hazard Analyses

DOE-HDBK-1163-2020 October 2020 DOE HANDBOOK INTEGRATION OF HAZARD ANALYSES U.S. Department of Energy AREA SAFT Washington, D.C. 20585 DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. TS NOT MEASUREMENT SENSITIVE DOE-HDBK-1163-2020 ii AVAILABLE TO THE PUBLIC ON THE DOE TECHNICAL STANDARDS PROGRAM WEBSITE AT HTTPS://WWW.STANDARDS.DOE.GOV DOE-HDBK-1163-2020 iii FOREWORD 1. This Department of Energy (DOE) Handbook (HDBK) has been approved to be used by DOE, including the National Nuclear Security Administration (NNSA), and their contractors. 2. This Handbook provides good practices and lessons learned from performing and integrating Hazard Analysis at DOE facilities. 3. The Handbook addresses the following topics: • Hazard Analysis Process; • Integrated Safety Management (ISM) System; • Regulatory Drivers for Different Hazard Types; • Integration of Facility Hazard Analyses; • Good Practices and Lessons Learned; and • Documentation and Maintenance of Facility Hazard Analyses. 4. DOE Order (O) 252.1A, Chg. 1, Technical Standards Program, states that DOE handbooks provide “a compilation of good practices, lessons-learned, or reference information that serve as resources on specific topics.” The guidance provided in this Handbook is not mandatory and may be used at the discretion of DOE contractors and field offices. 5. Beneficial comments (recommendations, additions, and deletions), as well as any pertinent data that may be of use in improving this document, should be emailed to james.dillard@hq.doe.gov or addressed to: Office of Health and Safety (AU-10) Office of Environment, Health, Safety and Security U.S. Department of Energy 19901 Germantown Road Germantown, MD 20874 Phone: (301) 903-2996 Facsimile: (301) 903-6172 DOE-HDBK-1163-2020 iv Table of Contents 1.0 Introduction ........................................................................................................................ 1 1.1 Purpose ........................................................................................................................... 1 1.2 Scope .......................................................................................................................... 1 1.3 Objectives and Expectations .......................................................................................... 2 1.4 Should and May ............................................................................................................. 2 2.0 Hazard Analysis Process .................................................................................................... 3 2.1 Hazard Identification ...................................................................................................... 4 2.2 Hazard Evaluation .......................................................................................................... 6 2.3 Hazard Control Selection ............................................................................................... 7 2.4 Hazard Analysis Levels ............................................................................................... 10 3.0 Integrated Safety Management System .......................................................................... 14 3.1 Regulatory Drivers ....................................................................................................... 14

3.2 Role of Facility Managers ............................................................................................ 15 3.3 Role of ISM Program in Integrating HA Efforts ......................................................... 16 4.0 Hazard Types ..................................................................................................................... 18 4.1 Worker Safety and Health Hazards .............................................................................. 18 4.2 Chemical Hazards ......................................................................................................... 25 4.3 Radiological Hazards from Nuclear Facilities ............................................................. 31 4.4 Other Hazards .............................................................................................................. 38 5.0 Lessons Learned ................................................................................................................ 41 5.1 Identification of all HA Efforts – a First Step in Integration ....................................... 41 5.2 Hazard Analysis Teams – Integration of Expertise ...................................................... 41 5.3 Collection and Integration of Hazard Information ....................................................... 42 5.4 Standardization of HA Tools and Techniques ............................................................. 44 5.5 Facility Categorization – Effective Grouping of Facilities to Aid Integration and Grading ........................................................................................................................ 45 5.6 Graded Approach to Facility-Level HA Documentation and Integration .................... 47 5.7 Knowledgeable Facility Managers – Essential Role in Facility Safety ....................... 48 5.8 Hazard Analyses Maintained Current and Updates Coordinated ................................. 48 6.0 Maintaining the Hazard Analysis .................................................................................... 50 7.0 References .......................................................................................................................... 52 DOE-HDBK-1163-2020 v Appendix A: Hazard Identification Checklist and Screening Criteria ................................... A-1 Appendix B: Hazard Evaluation Techniques ............................................................................ B-1 Appendix C: Risk Assessment Methodology ............................................................................. C-1 Appendix D: Summary of Hazard Analysis Requirements...................................................... D-1 Appendix E: Protective Action Criteria ..................................................................................... E-1 Appendix F: Integrated Chemical Hazard Analysis at HC-1, 2, and 3 Nuclear Facilities .... F-1 Appendix G: Example Facility Hazard Summary ................................................................... G-1 DOE-HDBK-1163-2020 vi List of Figures Figure 1. General Hazard Analysis Process ………………….………………………...……..…...3 Figure 2. Hazard Control Types……………………………………………………….......…...…..9 Figure 3. Hazard Analysis Levels and Examples…………….………………………...…….…...11 Figure 4. Facility-Level Integrated Safety Management ….…………………………...….….......17 Figure 5. Worker Safety Hazard Analysis Process ……………………………………………….24

Figure 6. Chemical Hazard Management Process ………………………………....……………..30 Figure 7. Summary of Regulatory Drivers by Facility Types ………………………...….……....33 Figure A-1. Example Standard Industrial Hazard Screening Criteria.………………………......A-1 Figure A-2. Example Hazard Identification Checklist………….......…………………………...A-6 Figure C-1. Example Qualitative Consequence Matrix ……………………………….…...…....C-3 Figure C-2. Example Qualitative Likelihood Matrix ………………………….…………......….C-5 Figure C-3. Example Qualitative Risk Matrix ……………………………………………….….C-5 Figure D-1. Summary of Hazard Analysis Requirements ……………………...…………...…..D-1 Figure D-2. Summary of Key Hazard Analysis Guidance……………………...………….…..D-14 Figure E-1. Definitions of PACs……….……………………………………………...….……...E-2 Figure F-1. Chemical Hazard Evaluation and Control Strategy...……………………….………F-1 Figure G-1. Facility Hazard Summary Template….………………………….………………....G-1 List of Tables Table 1. Hierarchy of Controls.………………….………………………...….…………..……......8 Table 2. Examples of Engineered Facility Safety Controls …………………………...….……....21 Table 3. Hazard Analysis Report Contents for Below HC-3 Nuclear Facilities………...….….....35 Table 4. Facility Categories for Graded Approach Application……………………...….…..........46 Table B-1. Hazard Evaluation Technique Comparison……….......……………………………..B-1 DOE-HDBK-1163-2020 vii ACRONYMS AND ABBREVIATIONS AC Administrative Control AEGL Acute Exposure Guideline Level ALARA As Low As Reasonably Achievable ANSI/ANS American National Standards Institute/American Nuclear Society ASE Accelerator Safety Envelope C.F.R. Code of Federal Regulation CSE Criticality Safety Evaluation DEAR Department of Energy Acquisition Regulation DOE Department of Energy DSA Documented Safety Analysis EIS Environmental Impact Statement EM Environmental Management EPA Environmental Protection Agency EPHA Emergency Planning Hazards Assessment ERPG Emergency Response Planning Guideline FHA Fire Hazards Analysis G Guide (DOE Directive) HA Hazard Analysis HAR Hazard Analysis Report HASP Health and Safety Plan HAZOP Hazard and Operability Study HAZWOPER Hazardous Waste Operations and Emergency Response HC Hazard Category HDBK Handbook HE Hazard Evaluation HI Hazard Identification ISM Integrated Safety Management ISMS Integrated Safety Management System JHA Job Hazards Analysis NEPA National Environmental Policy Act of 1969 NFPA National Fire Protection Association NIOSH National Institute for Occupational Safety and Health NNSA National Nuclear Security Administration NPH Natural Phenomena Hazards O Order (DOE Directive) OSHA Occupational Safety and Health Administration PAC Protective Action Criteria PPE Personal Protective Equipment DOE-HDBK-1163-2020 viii PrHA Process Hazard Analysis PSM Process Safety Management QA Quality Assurance RMP Risk Management Program SAC Specific Administrative Control SAD Safety Assessment Document SHA Stand-Alone Hazard Analysis SIH Standard Industrial Hazard SME Subject Matter Expert SMP Safety Management Program SMS Safety Management System SSC Structures, Systems, and Components STD Standard TEEL Temporary Emergency Exposure Limit U.S.C. United States Code DOE-HDBK-1163-2020 ix DEFINITIONS

The definitions presented below are provided for understanding and consistency among the hazard analysis methods and for the purpose of promoting integration of hazard analyses. The relevant regulations, directives, and standards sometimes provide different but similar definitions. In some cases, a synthesized definition is provided below that captures the basic concept and is largely consistent with the relevant regulations and guidance. In other cases, definitions can be taken from existing documents that are suitable to be broadly applied. In these cases, the origins of the definitions are indicated by references shown in square brackets [ ]. Accelerator. A device employing electrostatic or electromagnetic fields to impart kinetic energy to molecular, atomic or sub-atomic particles and capable of creating a radiological area. [DOE O 420.2C] Accelerator Facility. The accelerator and associated roads within site boundaries, plant and equipment utilizing, or supporting the production of, accelerated particle beams and the radioactive material created by those beams to which access is controlled to protect the safety and health of workers, the public, or the environment. The term facilities includes injectors, targets, beam dumps, detectors, experimental halls, non-contiguous support and analysis facilities, experimental enclosures and experimental apparatus utilizing the accelerator, etc., regardless of where that apparatus may have been designed, fabricated, or constructed, including all systems, components and activities that are addressed in the Safety Analysis. [DOE O 420.2C] Accident. An unplanned event or sequence of events that results in undesirable consequences. A hazardous event scenario, especially one that results in significant consequences. Activity-Level Work. Any job, task, or sub-task performed where hazards are present; are introduced by the work, such as Research and Development, Deactivation & Decommissioning, construction, operations, and maintenance; or are introduced by the work environment (regardless of who is performing the work or the organization with which they are affiliated). The hazards involved could be potentially adverse to worker health and safety, the public, the environment, or safeguards or security. [DOE-HDBK-1211-2014] Contractor. Any entity, including affiliated entities, such as a parent corporation, under contract with DOE, or a subcontractor at any tier, that has responsibilities for performing work at a DOE site in furtherance of a DOE mission. [10 Code of Federal Regulation (C.F.R.) Part 851.3] Chemical Facility. A DOE facility with potentially releasable chemicals or chemical hazardous materials in quantities that exceed the reportable quantities in Table 302.4 of 40 C.F.R. 302. Documented Safety Analysis (DSA). A documented analysis of the extent to which a nuclear facility can be operated safely with respect to workers, the public, and the environment, including a description of the conditions, safe boundaries, and hazard controls that provide the basis for ensuring safety. [10 C.F.R. Part 830.3] DOE-HDBK-1163-2020 x Emergency Planning Hazards Assessment (EPHA). A quantitative analysis identifying hazards and the potential consequences from unplanned releases of (or loss of control over) hazardous materials, using accepted assessment techniques. [DOE O 151.1D] Exposure. The state of being exposed to a hazard resulting in risk of an adverse consequence to workers, the public, the environment, or a facility.

Facility. The buildings, structures, utilities, and any related area associated with a DOE activity or operation that are grouped together to facilitate safe, effective, and efficient performance of common DOE missions. Fire Hazards Analysis (FHA). A comprehensive assessment of the hazards and potential damage from fire in a building or group of buildings, which takes one of the following forms: (a) Building/Facility FHA that establishes the fire safety of the facility at the time it is issued; (b) Preliminary/Project FHA which establishes the fire protection requirements for a new building or a modification to an existing building; or, (c) Transitional FHA which evaluates the minimum fire protection needs during a major transition from an operating status to some other status. [DOE- Standard (STD)-1066-2016] Graded Approach. The process of ensuring that the level of analysis, documentation, and actions are commensurate with: • The relative importance to safety, safeguards, and security; • The magnitude of any hazards involved; • The life cycle stage of a facility; • The programmatic mission of a facility; • The particular characteristics of a facility; • The relative importance of radiological and non-radiological hazards; and • Any other relevant factor. [10 C.F.R. Part 830.3] Hazard. A source of danger (material, energy source, or operation) with the potential to cause harm to a person (workers or public), a facility, or to the environment (without regard to the likelihood or credibility of hazard or accident scenarios or consequence mitigation). Hazard Analysis (HA). The identification of materials, systems, processes, and facility characteristics that can produce undesirable consequences (hazard identification), followed by the assessment of hazardous situations associated with a process or activity (hazard evaluation). Qualitative techniques are usually employed to pinpoint weaknesses in design or operation of the facility that could lead to hazardous scenarios. The hazard evaluation (HE) includes an examination of the complete spectrum of potential hazardous event scenarios that could expose members of the public, onsite workers, facility workers, and the environment to hazardous materials. DOE-HDBK-1163-2020 xi Hazard Category (HC). One of four classes of DOE nuclear facilities (HC-1, HC-2, HC-3, and below HC-3) determined consistent with the hazard categorization methodology of DOE-STD- 1027-92, Chg. 1, Hazard Categorization and Accident Analysis Techniques for Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports. Hazard Controls. Physical, design, structural, and engineering features; operating limits; and administrative or safety practices, processes, or procedures to prevent, control, or mitigate hazards. Hazard Identification (HI). The structured process by which a hazard is identified reflecting the pinpointing of material, system, process and facility characteristics that can initiate or produce undesirable consequences. Hazard Scenario. A real or postulated progression of causally related events or occurrences that begins with an initiating event and results in undesirable exposure to hazards or hazardous materials. Hierarchy of Controls. A system of preferences for hazard controls prioritized by anticipated effectiveness of the controls. Traditionally, the following hierarchy of controls is used: (1) elimination of the hazard or substitution with a less hazardous alternative, (2) minimization of the hazardous material, (3) engineering controls, (4) administrative controls (ACs), and (5) personal protective equipment (PPE).

Industrial Facility. A DOE facility that has industrial safety hazards, and is not a nuclear facility, an accelerator facility, or a chemical facility. Integrated Safety Management System (ISMS). A systematic process and framework to integrate safety into management and work practices at all levels in the planning and execution of work at DOE. [Department of Energy Acquisition Regulation (DEAR) 48 C.F.R. Section 970.5223–1] Job Hazards Analysis (JHA). A documented analysis for specific activity-level work that (a) identifies activity-wide, task- or step-specific, and work environment/location safety and health hazards and (b) defines controls to eliminate or mitigate hazards to protect personnel and the environment. Another common term in industry is “job safety analysis.” [DOE-HDBK-1211- 2014] Mitigative control. Any structure, system, component, or administrative control that serves to mitigate the consequences of a release of radioactive or other hazardous materials in a hazard or accident scenario. [DOE-STD-3009-2014] Nonreactor Nuclear Facility. Nonreactor nuclear facility means those facilities, activities or operations that involve, or will involve, radioactive and/or fissionable materials in such form and quantity that a nuclear or a nuclear explosive hazard potentially exists to workers, the public, or the environment, but does not include accelerators and their operations and does not include activities involving only incidental use and generation of radioactive materials or radiation such as check DOE-HDBK-1163-2020 xii and calibration sources, use of radioactive sources in research and experimental and analytical laboratory activities, electron microscopes, and X-ray machines. [10 C.F.R. Part 830.3] Nuclear Facility. A reactor or a nonreactor nuclear facility where an activity is conducted for or on behalf of DOE and includes any related area, structure, facility, or activity to the extent necessary to ensure proper implementation of the requirements established by 10 C.F.R. Part 830. [10 C.F.R. Part 830.3] Preventive control. Any structure, system, component, or administrative control that eliminates the hazard; terminates the hazard scenario or accident; or reduces the likelihood of a release of radioactive and/or hazardous materials. [DOE-STD-3009-2014] Public. All individuals outside a DOE site boundary. [DOE-STD-3009-2014] Receptor. The generic term assigned to workers, the public, the environment, or the facility when they represent where the consequence of exposure to the hazard would occur. Risk. The quantitative or qualitative expression of possible loss that considers both the likelihood that an event will occur and the consequences of that event. [DOE-STD-3009-2014] Safety Assessment Document (SAD). A document containing the results of a safety analysis for an accelerator facility pertinent to understanding the risks of operating the accelerator facility. [DOE O 420.2C] Safety Class structures, systems, and components (SSCs). Structures, systems, or components, including portions of process systems, whose preventive or mitigative function is necessary to limit radioactive hazardous material exposure to the public, as determined from safety analyses. [10 C.F.R. Part 830.3]

Safety Management Program (SMP). A program designed to ensure that a facility is operated in a safe manner that adequately protects workers, the public, and the environment by covering a topic such as quality assurance (QA); maintenance of safety systems; personnel training; conduct of operations; inadvertent criticality protection; emergency preparedness; fire protection; waste management; or radiological protection of workers, the public, and the environment. [10 C.F.R. Part 830.3] Safety Significant structures, systems, and components. Structures, systems, and components which are not designated as safety class SSCs, but whose preventive or mitigative function is a major contributor to defense-in-depth and/or worker safety as determined from safety analyses. [10 C.F.R. Part 830.3] Safety structures, systems, and components. Both safety class structures, systems, and components, and safety significant structures, systems, and components. [10 C.F.R. Part 830.3] DOE-HDBK-1163-2020 xiii Site. A DOE-owned or-leased area or location or other area or location controlled by DOE where activities and operations are performed at one or more facilities or places by a contractor in furtherance of a DOE mission. [10 C.F.R. Part 851.3] Worker. A worker is anyone who performs assigned activity-level work tasks. Examples of workers include crafts, researchers, scientists, engineers, technicians, operators, and maintenance and test personnel. Workers can be federal, contractor, or subcontractor personnel who either normally work at the facility where the work is being performed or who normally work elsewhere at the site or offsite and are present at the facility to perform or support ongoing work activities. [DOE-HDBK-1211-2014] DOE-HDBK-1163-2020 1 1.0 INTRODUCTION DOE is dedicated to providing a safe and healthful work environment, protecting the workers, protecting the public, and preserving DOE assets and property. Hazards exist at DOE facilities, as they do at many facilities, that require control measures to prevent adverse outcomes. Rules, directives, and standards apply to DOE facilities for the identification and evaluation of hazards, and the selection of controls to protect workers, the public, the environment, and the facilities. This Handbook provides good practices and lessons learned from performing and integrating Hazard Analyses (HAs) at DOE facilities. It supports mission success by describing good practices in integrating HA resources, data, evaluations, and results for DOE nuclear facilities (including below HC-3 nuclear facilities), chemical facilities, industrial facilities, and other facilities in the DOE complex. The Handbook provides an overview of current DOE directives and Federal regulations, highlights opportunities for integrating HA activities, and provides approaches that can improve the effectiveness of HA activities and cost performance. It does not introduce any new or additional requirements. 1.1 Purpose The Handbook provides DOE and contractor personnel with a resource to support the effective and efficient planning, conduct, review, and integration of HA activities. It describes the regulatory and policy drivers for conducting an HA within DOE facilities, and identifies common features and contrasts different HA activities, as appropriate. It also describes how HA activities can be streamlined, documented, and integrated across the many types of HA activities performed at DOE facilities. HAs can be integrated through sharing of resources, data, evaluations, and results.

The focus of this Handbook is mainly on HA integration at the facility level. This Handbook provides facility managers with a comprehensive understanding of the process for identifying and evaluating facility hazards. For a detailed discussion of integrated activity-level HA practices, see DOE-HDBK-1211-2014, Activity-Level Work Planning and Control Implementation. As described in this Handbook, lessons learned can be used to help fill gaps in existing HA documentation, improve cost effectiveness, facilitate coordination of HA functions, clarify organizational roles and responsibilities, and enhance the technical quality of HA activities. 1.2 Scope This Handbook is relevant to each phase of the facility lifecycle, including design, construction, testing, commissioning, operations, and decommissioning. The contents of this Handbook may be applied to integrating HAs at many types of DOE sites and facilities: industrial, chemical, accelerators, nuclear, waste management, laboratory, and on-site transportation. It is not intended for application with off-site transportation activities. DOE-HDBK-1163-2020 2 1.3 Objectives and Expectations Effective integration and implementation of HA activities will result in the following desirable outcomes: (1) HA activities are identified and integrated such that hazards are identified and evaluated, and appropriate hazard controls are selected and put in place to prevent or mitigate exposure to those hazards. (2) HA efforts share resources, data, and results, where feasible, to ensure that HA efforts are complete, effective, and efficient. (3) ISMS coordinates HA efforts to ensure effective integration is accomplished and ensures that each designated facility has a documented, up-to-date HA. (4) Facility managers are knowledgeable of facility hazards, hazard controls, and available HA resources including subject matter experts (SMEs). (5) Facility-level HAs are documented with rigor based on a graded approach and updated periodically to ensure hazard controls are effective and maintained in place. This Handbook describes methods for achieving these outcomes. 1.4 Should and May The word “should” denotes a recommendation. These recommendations are based on experience and lessons learned and capture good practices effectively implemented within the DOE complex and elsewhere. The word “may” denotes permission, neither a requirement nor a recommendation. The word “shall” denotes a requirement and is not used in this Handbook unless directly quoting from a requirement source. DOE-HDBK-1163-2020 3 2.0 HAZARD ANALYSIS PROCESS The primary purpose of an HA is to provide a systematic approach for identifying and evaluating hazards and for developing control strategies to prevent or mitigate risks associated with the hazards. The HA identifies and evaluates the complete spectrum of hazards and hazardous event scenarios. This largely qualitative effort forms the basis for analyzing and identifying hazard controls to prevent harm to workers, the public, the environment, and the facility. The generalized HA process consists of the following steps: (1) establish the scope of the HA, (2) identify the hazards, (3) evaluate the hazards, and (4) select the hazard controls needed. Figure 1 depicts the generalized HA process. Figure 1. General Hazard Analysis Process

The focus of HAs will differ based on their scope and purpose, the requirements and regulations the HAs satisfy, the evaluation techniques used, and the level of risk involved. For example, an emergency management HA will typically consider deliberate sabotage whereas an HA for a nuclear facility will not include this type of hazard. Defining the purpose, scope, boundaries, receptors, use, and output for the HA is essential for any successful HA application. Different HAs may focus on protecting one or many potential receptors. Examples of potential receptors include facility workers, onsite (co-located) workers, members of the public, the environment, and the facility. A large-scale facility or process-level HA typically groups process areas or components into nodes and sub-nodes for ease of analysis. An activity-level HA or exposure assessment typically groups the analysis by steps or hazards. HAs typically require multiple SMEs. For some facilities with simple and routine hazards, a single analyst is sometimes sufficient. HA efforts typically evaluate DOE-HDBK-1163-2020 4 hazards in the unmitigated state (without preventive and mitigative hazard controls). Some HAs also evaluate hazards with preventive and mitigative controls. The formality of HA efforts varies based on the intent of the analysis. Another HA approach used by industrial hygienists and focused on the activity-level work is the “exposure assessment process.” This process is a qualitative and quantitative analysis that uses basic characterization (workplace, workforce, agents), exposure assessment (grouping of workers, exposure potential, and judgment of acceptability of exposure), further information gathering (sampling or modeling), and hazard control (implementation of the hierarchy of controls for unacceptable exposures). Reassessment, communication, and documentation are also included in the process. This approach is generally consistent with the approach displayed in Figure 1. For more information, see American Industrial Hygiene Association’s A Strategy for Assessing and Managing Occupational Exposures. Although HAs can vary significantly, they have many common features and methods which allow for effective integration. Subsequent sections of this chapter describe the general HA process with discussion on identifying hazards, commonly used evaluation techniques, and control selection. DOE-HDBK-1224-2018, Hazard and Accident Analysis Handbook, provides comprehensive guidance, lessons learned, and practical examples for developing HAs for DOE nuclear facilities. Commercial industry practices for HA, such as those described in the Center for Chemical Process Safety’s Guidelines for Hazard Evaluation Procedures (Third Edition, Wiley/American Institute of Chemical Engineers, 2008), sometimes called the “Red Book,” may be used. The “Red Book” is widely recognized as an authoritative reference for performing HAs. 2.1 Hazard Identification The methodology used for HI ensures comprehensive identification of the hazards associated with the full scope of facility processes and associated operations. The HI methodology includes characterization of radiological and non-radiological hazardous materials and energy sources, in terms of quantity, form, and location. The HI process involves hazard data gathering, summarizing hazard data in tables or data sheets, and screening hazards needing further evaluation. HI should integrate with the record requirements found in 10 C.F.R. Part 851.26 (a)(1); contractor steps to meet this requirement are a foundation for identifying hazards inventories.

Regardless of the HA scope, the analysis should be broken into manageable pieces called nodes. Nodes are composed of sections of equipment with definite boundaries (e.g., a line between two vessels) within which process parameters are investigated for deviations. Nodes may also be used to define like areas or similar exposure groups (e.g., maintenance shop or organic chemistry laboratory) when performing an HA for a facility, operation, or activity. A systematic approach for performing a formal HI includes the use of HI checklists. HI checklists systematically identify hazards for each node being analyzed. Initial input to HI checklists is usually based on existing documentation review and SME input. HI checklists provide the input and basis for review of steps and operational hazards. HI checklists are then verified by walkthroughs. Depending on the level of analysis, each node evaluated may be documented on a DOE-HDBK-1163-2020 5 separate HI checklist. A quality assurance check or peer review should be performed on the information gathered and compiled, as HI checklists are a key component to conducting a complete and accurate HA. Blindly using HI checklists has disadvantages including the potential to miss hazards and inhibit creative thinking. A checklist should be used in a thoughtful manner by experienced and trained personnel and updated as new information becomes available about hazards. Bounding inventory values of hazardous materials should be consistent with the maximum quantities of material allowed or planned for storage and operations. Inventory data may be obtained from sources including flowsheets, vessel sizes, planning documentation, contamination analyses, and maximum historical inventories. Other HI sources include fire hazards analyses, emergency planning hazards assessments, hazardous waste site health and safety plans (HASPs), written worker safety and health programs, job hazard analyses, and facility/industry occurrence reporting data. Technical bases and assumptions about inventory values should be clearly stated, documented, and understood before the values are used. The HI process output is a comprehensive list of hazards from which hazard scenarios are subsequently developed. The overall quality of hazard scenario definition is dependent on the accuracy and completeness of the HI. Comprehensive identification of hazards is best accomplished by a team composed of hazard analysts, system engineers, process engineers, operational and support staff, industrial hygienists, fire protection SMEs, occupational safety SMEs, and other SMEs, as needed. A hazard analyst should work with SMEs (including applicable operations and maintenance representatives) to gather relevant data. Multiple checklists from each facility, operation, process, or area node can be compiled into a master or summary HI table. The HA team should review the table or checklist for each process or node. Team review of a compiled summary is more efficient than having the entire HA team discuss each item for every process or area node.

A potential integration point for hazards analyses, the comprehensive list of hazards can be used for connecting facility-level analysis, process-level analysis, and activity-level of analysis. The identification of hazards is common to the various levels of analyses as well as common to analyses completed for different regulatory requirements. Producing and subsequently maintaining a facility-level HI supports the effective integration and implementation of HA activities. 2.1.1 Standard Industrial Hazards (SIHs) and Screening Hazard screening is a useful tool that helps identify hazards that do not require separate or additional integrated analyses to develop hazard controls. Most DOE sites use a screening process to accomplish two functions: (1) at the activity-level, to screen out low-level hazards from further consideration, and (2) at the activity-level and the facility-level, to identify SIHs routinely encountered in day-to-day work activities. SIHs are hazards that are generally well understood and covered by codes, regulations, or other consensus standards (e.g., National Fire Protection Agency, National Electric Code, and American Conference of Governmental Industrial Hygienists). When SIHs are identified, DOE contractors are required to address identified SIHs and establish appropriate hazard controls in accordance with the rule provisions of 10 C.F.R. Part 851, Worker DOE-HDBK-1163-2020 6 Safety and Health Program. Activity-level screening is routinely incorporated into work planning activities through checklists when planning activity-level work. For many facility-level HAs, an SIH screening tool is used to exclude SIHs from further evaluation when (a) the hazard is adequately controlled according to established safety and health standards and (b) the hazard is not considered an initiating event for exposure to another hazard. In these cases, the hazards are being addressed by the general worker safety and health program, just not specifically identified and addressed within the facility-specific HAs. Facility-level worker safety reviews for initial construction and capital modifications would be an exception where these facility-level worker hazards are considered as part of the project design. The keys to an effective screening process are: (1) pre-established screening criteria agreed upon by relevant stakeholders, (2) a comprehensive listing of multiple hazard types, and (3) a basis clearly linked to applicable regulatory requirements. Example SIH screening criteria are shown in Figure A-1 of Appendix A. The SIH screening criteria in Figure A-1 may be modified for site-specific or facility-specific hazards and criteria. While screening is a useful tool, users should consider whether screened-out SIHs might be initiators for hazardous event scenarios or accidents involving other hazards. For example, flammable materials could potentially be screened out as an SIH based on limited quantities. However, flammable materials that could cause a fire resulting in the release of hazardous or radiological materials would need to be considered as a potential initiator.

Unique worker hazards differ from traditional industrial hazards (or SIHs) because of unique DOE applications that are not typically seen or anticipated in traditional industrial use (see DOE-STD- 3009-2014 for more information). If these unique hazards can cause significant harmful effects, they should not be screened out. An SIH screening tool may also be used with the HI checklist to help guide the analyst and document the decision process. The example integral HI checklist and SIH screen provided in Figure A-2 of Appendix A are most appropriate for an HA focused on operational, process, facility or site-level hazards with co-located workers, the public, environment, and mission. The integral HI checklist and SIH screen in Figure A-2 may be modified for site-specific or facility-specific hazards, criteria, and receptors. 2.2 Hazard Evaluation This section provides a general description of several commonly used HE techniques along with the benefits and limitations of each technique. The HE is the starting point for control set selection. The initial HE consists of the following actions: • Verify the scope of the HA is established and the applicable hazards are identified; • Develop a comprehensive list of postulated hazard scenarios (linking hazards with initiators and undesirable consequences through a progression of causally-related events or occurrences); • Evaluate circumstances that could affect the initiation and progression of the postulated hazard scenarios or hazardous event scenarios; and DOE-HDBK-1163-2020 7 • Review applicable safety documentation, process history, occurrence reports, and other information sources to identify postulated or historical hazardous events and accidents. The facilities, operations, or activities within the determined boundaries of the evaluation are considered as part of the HE. The HA team defines where these boundaries, processes, or area nodes start and stop. Typical hazard scenarios associated with DOE facilities are: fire; explosion; loss of confinement, spills, or energetic releases of chemical or radiological hazards; direct shine of radiation, criticality, external events, and natural phenomenon hazards. The HE develops a set of hazard scenarios from these types, as appropriate, to envelop the credible and representative hazard scenarios. See DOE-HDBK-1224-2018, Hazard and Accident Analysis Handbook, for a comprehensive discussion of anticipated hazard scenarios. A graded approach should be applied to the selection of HE techniques and the development of the hazard scenarios for evaluation. The selection of appropriate techniques is based on several factors, including the complexity and size of the operation being analyzed, the type of operation, and the inherent nature of hazards being evaluated. The “Red Book” (Center for Chemical Process Safety’s Guidelines for Hazard Evaluation Procedures) discusses techniques commonly used in HEs. The discussion in the “Red Book,” which is oriented toward the chemical industry, provides the basic strengths and weaknesses of each method and an industry standard and documented technique. The common methods vary in both complexity and focus. Depending on the scope of the HA, multiple HE techniques may be used. Regardless of the HE technique selected, plausible hazard scenarios are evaluated in unmitigated form which means assuming the absence of preventive (likelihood reducing) controls and mitigative (consequence reducing) controls, and considering the physical realities of the hazard scenario phenomena at a given facility, activity, or operation. Appendix B provides a summary of hazard evaluation techniques and methods.

The use of multiple HE techniques in an integrated HA is the most effective application. The use of a broad-brush technique, such as the What-If/Checklist, should be performed initially because it provides the structure and flexibility required to identify and evaluate hazards of the process and derive controls. The use of a What-If/Checklist helps to identify areas where more rigorous and prescriptive HE techniques are necessary to further dissect hazard scenarios, derive controls, and develop surveillances. 2.3 Hazard Control Selection The control selection process facilitates the selection of hazard controls to prevent or mitigate a hazard scenario or accident based on formal hazards and accident analyses. The process organizes and evaluates the initial identification of hazard controls from the HE portion of the HA, then provides supplemental or specific controls that are effective in preventing or mitigating postulated hazard scenarios or accidents. The output is a compilation of controls that are essential for protection of the workers, the public, the environment, or the facility, and for defense-in-depth. DOE-HDBK-1163-2020 8 Preventive and mitigative controls are selected using a judgment-based process that employs a hierarchy of controls, using the order of preference shown in Table 1 below1. Table 1. Hierarchy of Controls • Elimination or substitution of radioactive material or hazardous material without adversely impacting the required processes • Minimization of radioactive material or hazardous material without adversely impacting the required processes • Engineered Controls to prevent or mitigate hazardous exposures o Preventive preferred over mitigative o Passive preferred over active • Administrative Controls and work practices to minimize exposures o Preventive preferred over mitigative • PPE based on activity-level HA Preventive controls provide protection to the largest population because preventing a hazard from release is independent of the receptor. Controls “closest” to the hazard typically provide protection to the largest population, including workers and the public. Controls, such as a fire suppression system, that are effective for multiple hazards can be more resource effective. Warning signs, audible alarms, and visual alarms are methods to warn individuals of a (potential) hazardous event. PPE is the last form of protection – PPE is always a mitigative control and is an indication that there is a potential for additional analysis to evaluate risk reduction with engineering or more effective ACs. Even when other controls are provided, PPE is required to be provided and used for worker protection when determined to be necessary based on a workplace hazard assessment2. Generally, for a facility-level HA, warnings and PPE types of controls are not selected for a risk reduction. Selection of preventive controls over mitigative controls is an important concept. With more complex and more hazardous events, there are initiating events or causes that lead to an accident or loss event. Events of this type are generally associated with facility-level analysis rather than activity-level analysis. The accident or loss event is the point when an irreversible physical event occurs that has a potential for impacts to the receptor. Figure 2 provides a visual depiction from the “Red Book” (Center for Chemical Process Safety’s Guidelines for Hazard Evaluation Procedures) of different hazard control types in relation to the hazard scenario or accident

1 The Hierarchy of Controls presented in this Handbook represents a melding of different sources for a combined single-use table. Hierarchy of Controls is required by 10 C.F.R. 851.22 for worker safety and includes PPE. Hierarchy of Controls is also required by DOE O 420.1C and DOE-STD-3009-2014 for nuclear facilities; it does not include PPE and includes preferences within categories (such as passive before active engineered controls). These different sets of hierarchies are fundamentally similar and do not conflict. The Hierarchy of Controls presented in Table 1 above will work for both nuclear and non-nuclear facilities. 2 PPE is required by 10 C.F.R. 851, which invokes 29 C.F.R. 1910.132. DOE-HDBK-1163-2020 9 progression. Figure 2. Hazard Control Types The distinction between preventive and mitigative controls becomes more apparent when the impact of the controls on the risks of the adverse event are examined. Preventive controls reduce the likelihood that an adverse event will occur, and mitigative controls reduce the potential consequences of such an event. Controls are credited for a reduction in either likelihood or consequence until reasonable assurance of adequate protection is achieved. These derived controls establish the layers of protection. Defense-in-depth is a fundamental strategy (required by DOE O 420.1C, Facility Safety, for HC-1, 2, and 3 nuclear facilities) and provides layers of defense against the release of hazardous materials so that no one layer is completely relied upon. All safety activities (organizational, behavioral, or equipment-related) are subject to layers of overlapping provisions where if a failure occurs, it would be compensated for or corrected without causing harm to workers or the public at large. When properly applied, the defense-in-depth strategy ensures that no single human or mechanical failure would lead to injury to workers or the public, or even combinations of failures that are only remotely possible would lead to little or no injury. The strategy for defense-in-depth is twofold: (1) to prevent accidents, and (2) if prevention fails, to limit the potential consequences of accidents and to prevent evolution to more serious conditions. Initial conditions are identified throughout the HE process to reflect the physical design and process design aspects in the context of specific events. Each initial condition is considered when assigning unmitigated frequencies and consequences for corresponding hazard events. The initial conditions and assumptions carry forward as controls into the HA and need to be protected to maintain the quality of the evaluation. Initial conditions are derived to support the context of the HA and the derivation of controls. DOE-HDBK-1163-2020 10 Risk assessment is a tool used to support derivation of the controls necessary to prevent or mitigate a loss event. Risk is the combination of the likelihood that a hazardous event or condition will occur and the consequences of the event. When applying a risk assessment methodology, each hazard scenario is first evaluated in unmitigated form (without controls), and then in mitigated form (with controls). Appendix C describes a typical risk assessment methodology and provides sample matrices for assessing risks. 2.4 Hazard Analysis Levels DOE contractors conduct multiple HA activities in accordance with ISM and DOE orders, rules, and Federal regulations.

The over-arching requirement for HA is found in DEAR, 48 C.F.R. Section 970.5223-1, “Integration of environment, safety, and health into work planning and execution,” which requires an identification and evaluation of hazards associated with work as part of an overall documented safety management system (SMS). This requirement is expanded upon in DOE directives, standards, and guidance documents. A summary of hazard analysis requirements is presented in a tabular format in Appendix D, including potential integration points. Each requirement source has a different focus such as emergency management, fire protection and life safety, explosive safety, nuclear safety, onsite transportation safety, chemical safety, or worker protection. However, common objectives are found among certain groups of requirements that can be characterized as addressing either (1) site-level safety, (2) facility-level safety, (3) activity-level safety, or (4) protection against a specific hazard (e.g., beryllium, fire, criticality, natural phenomena). The identified HA requirements addressed in this Handbook fit into one of these areas or levels of analysis. The practice of effective communication among safety disciplines, analysts, and facility and project management is an important element for ensuring team performance and integration of HA activities. Not adhering to this practice will often result in duplicative efforts and possible inconsistent assumptions on consequences and necessary controls related to the same set of hazards. This practice is necessary to ensure that goals and expected HA outcomes are commonly understood and shared among the participants. The practice of effective communication applies to both contractor and DOE organizations, including both HA preparers and reviewers, and the workers potentially affected by the hazardous activity. Another important practice that improves cost effectiveness of HA activities is the standardization and appropriate use of HA tools and techniques. Standardization can be improved through development of procedures and training and sharing of lessons learned and good practices. HA techniques vary in sophistication and cost of implementation, and users should ensure techniques are appropriately selected for the condition being analyzed. Figure 3 provides types of HAs performed at different levels of analysis and examples of specific analyses at these levels. These levels and examples are discussed in more detail below. DOE-HDBK-1163-2020 11 Figure 3. Hazard Analysis Levels and Examples 2.4.1 Site-Level HA Depending on the complexity of the site, a site-level HA can be beneficial to provide a unified understanding of the hazards of the site. A site-level HA can prove helpful in establishing memorandums of agreement with local jurisdictions in the event of a large-scale site-wide emergency and/or provide a hierarchy of command for response to events. A site-level analysis might be required in accordance with the following regulatory drivers3: • 10 C.F.R. Part 1021, National Environmental Policy Act of 1969; • DOE O 460.1D, Hazardous Materials Packaging and Transportation Safety; and • DOE O 151.1D, Comprehensive Emergency Management System. A site-level HA might not be useful or necessary at some DOE sites. Often, site-level analyses are compilations or summations of facility-level analyses, where each facility on a site is identified and analyzed, and the results are combined or rolled-up for the entire site. Site-level analyses can

3 The term “Regularly Driver” is a general term used in this Handbook to encompass applicable statutes, regulations, rules, and requirements from the directives and technical standards, which may be required, acceptable, or committed contractually to meet regulation requirements. DOE-HDBK-1163-2020 12 provide useful communication information based on facility-level HAs. 2.4.2 Facility-Level HA A facility includes any equipment, structure, system, process, or activity that fulfills a specific purpose. Examples include accelerators, storage areas, fusion research devices, nuclear reactors, production or processing plants, coal conversion plants, magnetohydrodynamics experiments, windmills, radioactive waste disposal systems and burial grounds, environmental restoration activities, testing laboratories, research laboratories, transportation activities, and accommodations for analytical examinations of irradiated and unirradiated components. Certain HA requirements are concerned with the impacts that hazardous materials can have on the safety of nuclear or non-nuclear facility operations or dispositioning. These requirements involve an evaluation of worker, public, and environmental hazards associated with a facility’s operations (e.g., material processing, waste management, research, deactivation, or static conditions). Facility-level analysis should cover all sources of hazards including hazardous chemicals, excessive physical stresses, radioactive materials, or other potential dangers. Facility-level HA documentation is usually the result of one or many of the following regulatory drivers: • 10 C.F.R. Part 830, Nuclear Safety Management, Subpart B, Safety Basis Requirements; • 10 C.F.R. Part 851, Worker Safety and Health Program; • 29 C.F.R. Part 1910.119, Process Safety Management of Highly Hazardous Chemicals; • 29 C.F.R. Part 1910.120, Hazardous Waste Operations and Emergency Response; • DOE O 151.1D, Comprehensive Emergency Management System; • 40 C.F.R. Part 68, Chemical Accident Prevention Provisions; • DOE O 420.1C, Facility Safety; • DOE O 420.2C, Safety of Accelerator Facilities; and • DOE O 470.3C, Design Basis Threat (DBT) Order. A comprehensive Stand-Alone Hazard Analysis (SHA) is recommended to consolidate facility- specific requirements and provide a common location for references. The SHA is developed with input from each of the facility-level documents including a rollup of the activity-level work activities (for example, ongoing operations, processes, and experimentation and testing) conducted at the facility. The HA should be developed and documented, based on the graded approach, and updated periodically to ensure hazard controls are effective and maintained in place. The term “process-level” is sometimes used in reference to HAs. For example, the Occupational Safety and Health Administration's (OSHA’s) Process Safety Management (PSM) rule focuses on systematically identifying, analyzing, preventing, and mitigating hazards in complex chemical processes. In basic terms, a process encompasses a series of steps or actions taken to accomplish a result. A process involves multiple pieces of equipment. A process-level analysis is similar in complexity to a facility-level analysis. A facility is made up of one or more processes. DOE-HDBK-1163-2020 13

2.4.3 Activity-Level HA Activity-level HAs are focused on worker-related hazards associated with a specific activity or tasks. Each of the HA requirements reflected in this group is an integral part of work planning, which feeds into the preparation of JHAs, hazardous and radiation work permits, HASPs, industrial hygiene exposure assessments and overall work packages and documentation. These activities have an emphasis different from a facility-level HA because they are primarily focused on worker protection. As such, activity-level HA addresses the hazards associated with individual job functions and tasks. Despite these differences, there is an important link between facility and activity-level HA requirements in terms of the flow of hazards information and data. For example, facility-level information and assumptions related to hazardous material inventory (e.g., quantity, form and location) feed into a JHA to help identify the range of potential hazards a worker can encounter while carrying out duties such as valve maintenance. Conversely, assessments of work-related hazards, such as chemical exposures, could yield insights into hazards not adequately covered in facility-level analysis. Such insights might warrant further evaluation by a process hazard analysis (PrHA), DSA, or SHA. Regulatory drivers for an activity-level HA include: • 10 C.F.R. Part 851, Worker Safety and Health Program; and • 10 C.F.R. Part 835, Occupational Radiation Protection. Activity-level HAs are integrated with work planning and control processes and institutionalized within procedures. An effective approach used at many DOE sites is a work screening process that considers the complexity of work to be performed, personnel experience, and potential hazards associated with job tasks. These factors determine the necessary safety disciplines that should be involved in the JHA process, the level of analysis required, and the documentation required to authorize work. 2.4.4 Hazard-Specific Analysis Some HAs are driven by hazard-specific requirements because the hazards and the expertise to address them are unique. Results of a hazard-specific analysis should be integrated into each level to support an efficient approach to and provide a comprehensive hazards analysis. The regulatory drivers for hazard-specific analyses, include: • DOE O 420.1C, Attachment 2, Chapter II, “Fire Protection;”10 C.F.R. Part 851, Worker Safety and Health Program (hazard-specific analysis requirements such as safe use of lasers and beryllium); • 29 C.F.R. Part 1910.120, Hazardous Waste Operations and Emergency Response; • DOE O 420.1C, Attachment 2, Chapter III, “Nuclear Criticality Safety;” • DOE O 420.1C, Attachment 2, Chapter IV, “Natural Phenomena Hazards Mitigation;” and • DOE-STD-1212-2019, Explosives Safety. DOE-HDBK-1163-2020 14 3.0 INTEGRATED SAFETY MANAGEMENT SYSTEM DOE’s policy is that work is conducted safely and efficiently and in a manner that ensures protection of workers, the public, and the environment. DOE has established requirements for systematic identification and evaluation of hazards and development of appropriate hazard controls. These requirements include systematic identification and adoption of applicable national and international consensus standards, and where necessary, the use of DOE technical standards to address unique conditions.

3.1 Regulatory Drivers The Department and its contractors are required to establish and implement ISMS to systematically integrate safety into management and work practices at all levels (i.e., site-level, facility-level, and activity-level) in the planning and execution of work. Implementing ISM requirements for contractor organizations are established through contract clauses (DEAR 970.5223-1, Integration of environment, safety, and health into work planning and execution, and DEAR 970.5204-2, Laws, Regulations, and DOE Directives) and for federal organizations through directives (DOE O 450.2, Chg. 1, Integrated Safety Management, supported by DOE Guide (G) 450.4-1C, Integrated Safety Management System Guide). 48 C.F.R. Section 970.5223-1, Integration of environment, safety, and health into work planning and execution. This DEAR clause, sometimes called the “ISM DEAR Clause,” applies to DOE management and operating contractors4 and is required to be flowed down to subcontractors. Contractor organizations are required to develop, maintain, and implement ISMS for their operations and work practices, based upon the ISM guiding principles and core functions. To improve effectiveness and efficiency, contractor organizations are required to tailor their ISMS to the hazards and risks associated with the work activities supporting the mission. The following key points are valid for all DOE facilities, regardless of hazard types: (1) In the performance of work, line management is responsible for the protection of employees, the public, and the environment; (2) The contractor manages and performs work in accordance with a documented ISMS that describes how the contractor meets the ISM core functions: (a) Define the scope of work; (b) Identify and analyze hazards associated with the work; (c) Develop and implement hazard controls; (d) Perform work within controls; and (e) Provide feedback on adequacy of controls and continue to improve safety management. (3) Before work is performed, the associated hazards are evaluated and an agreed-upon set of safety standards and requirements is established which, if properly implemented, will provide 4 The ISM DEAR Clause is not applicable to every DOE contractor. While the functions and principles of ISM are consistent throughout DOE, some contracts have tailored contract clauses (H Clauses) to address these elements. DOE-HDBK-1163-2020 15 adequate assurance that the workers, the public, and the environment are protected from adverse consequences; and (4) Administrative and engineering controls to prevent and mitigate hazards are tailored to the work being performed and associated hazards. DEAR 970.5204-2, Laws, Regulations, and DOE Directives. This DEAR Clause, sometimes called the “Laws Clause,” establishes a requirement for DOE management and operating contractors to follow DOE directives and standards identified in a contract in List B, “List of Applicable Directives.” It also allows DOE to apply changes to these DOE directives using a process that involves evaluation and approval of the impact of changes. Further, the Laws Clause allows for environmental, safety, and health requirements to be tailored through a DOE-approved ISMS. When such a process is used, the set of tailored requirements, as approved by DOE, is incorporated into List B of the contract.

DOE facilities encounter many different types of hazards. These hazards are evaluated and controlled based on regulatory requirements. Some DOE sites use ISM to provide the central framework for HA and hazard control selection. To demonstrate effective ISM implementation, identification and control of hazards at each DOE facility needs to be demonstrated. A facility-level HA is supported by the core functions of ISM identified in the ISM DEAR Clause, and demonstrates, if properly done, that ISM is being effectively implemented. The underlying premise of ISM is that HA is applied to all levels of work activities. When facility-level HAs are well documented and maintained, a facility-level HA will help ensure that facility managers are knowledgeable of facility hazards and hazard controls. Figure 4 depicts the flow-down of ISM requirements into the contract, site-level programs, and facility-level HA documents. 3.2 Role of Facility Managers The contractor’s facility managers play an essential role in the control of hazards at DOE facilities. Facility managers need to be aware of significant hazards and hazard controls at their facilities. They also need to understand the hazard analysis processes and expertise that support their facility operations. This awareness is necessary to effectively manage ongoing operations and activities at the DOE facility. As a priority, facility managers should be briefed at least annually on facility hazards, changes in hazards and control measures, and sources for further information and assistance. This is an expectation and a good practice for effectively integrating hazard analysis and ensuring operational awareness of hazard analysis and controls. More frequent briefings may be provided, as appropriate and when requested, such as during periods of significant changes. Some contractor organizations have not assigned clear facility managers. In such cases, the contractor senior manager who is responsible for facility operations and safety should be considered the facility manager for purposes of implementing this Handbook. DOE-HDBK-1163-2020 16 3.3 Role of ISM Program in Integrating HA Efforts ISM requires that hazards are identified and evaluated for all DOE facilities. ISM requires that hazard controls are developed and maintained for all DOE facilities. HA and controls are tailored based on the type and significance of the hazards. At most, DOE sites and facilities, contractors have assigned managers responsible for coordinating ISM system descriptions and ISM program implementation. These ISM program managers are typically in the best position for the role of overall integration of facility HA across multiple disciplines, particularly for less hazardous facilities. They are also typically in the best position to coordinate periodic briefings for facility managers on overall facility hazards and controls. For facilities, such as highly hazardous facilities, other programs may take the lead in integrating HA efforts. Regardless of which program takes the lead, the ISM program should confirm that this integration occurs. The ISM program should carry out or confirm the following integration activities across HA efforts: (1) Identify and integrate HA efforts such that hazards are identified and evaluated, and appropriate hazard controls are selected and in place; (2) Share resources, data, and results across HA efforts, where feasible, to ensure that HA efforts are complete, effective, and efficient; and

(3) On an annual basis, brief facility managers on facility hazards, changes in hazards, control measures, and sources for further information and assistance. DOE-HDBK-1163-2020 17 Figure 4. Facility-Level Integrated Safety Management DOE-HDBK-1163-2020 18 4.0 HAZARD TYPES This section is organized by major types of hazards: worker safety and health hazards, chemical hazards, and radiological hazards. Worker safety and health hazards are present at all DOE facilities. Chemical hazards are present at most DOE facilities. Radiological hazards are present at DOE nuclear facilities. Other hazards, such as fire hazards and explosive hazards, are also discussed. For each major type of hazard, the following are summarized: (1) key regulatory drivers, which vary based on hazard, (2) HA documentation, which often follows from regulatory requirements, and (3) integration practices, which provide discussion on effective HA integration across hazard types and regulations. 4.1 Worker Safety and Health Hazards An HA is conducted in various forms by contractors throughout the process of reviewing hazards during various stages of the work process. An integrated HA considers all hazards and the potential exposures they present in each possible form. A worker can encounter hazards in normal or abnormal conditions. These hazards can take the form of chemicals or other types of hazards such as biological (legionella, mold, and plants), physical (thermal, non-ionizing radiation, and ergonomics), explosives, and emerging hazards, where the hazards and their effects are not fully understood, such as nanoparticles or unmanned aerial vehicles. The HA may be qualitative or quantitative, but it is important that any analysis includes the actual and potential hazards that would be encountered by the workers during an activity. The analysis should evaluate all hazards, whether the hazard is part of the process or activity, part of the facility, or potentially created by the activity. Worker safety hazard analysis encompasses the following functional areas: construction safety, worker fire protection, explosive safety, pressure safety, firearms safety, industrial hygiene, biological safety, occupational medicine, motor vehicle safety, electrical safety, and nanotechnology safety. 4.1.1 Regulatory Drivers Integrated worker safety HAs are performed in accordance with requirements from multiple DOE regulations. Contractors have flexibility to perform HAs using multiple techniques and methods, including those identified in Section 2 of this Handbook and the recommendations in the American Industrial Hygiene Association’s A Strategy for Assessing and Managing Occupational Exposures. Title 10 C.F.R. Part 851, Worker Safety and Health Program. The requirements of 10 C.F.R. Part 851 apply to all hazards that could be encountered by workers, except for radiological hazards or nuclear explosives operations to the extent regulated by 10 C.F.R. Parts 20, 820, 830 or 835. Part 851 is a broad and encompassing regulation. Part 851 requires contractors to evaluate and control all worker hazards. Section 851.21 states that contractors have a responsibility to: (1) identify existing hazards, (2) assess the risk to the workers which explicitly require the development of methods to assess worker exposures to chemical, physical, biological, or safety workplace hazards, (3) document those assessments, (4) analyze designs of new facilities and modifications to existing facilities and equipment for potential workplace hazards, and (5) evaluate operations, procedures, and facilities to identify workplace hazards. Part 851 also includes

DOE-HDBK-1163-2020 19 requirements to address the interaction between workplace hazards and other hazards, and to review site safety and health experience information. Part 851 does not apply to some DOE activities; see Part 851 and supporting guidance for applicability. Part 851 incorporates by reference many regulatory and consensus standards. DOE contractors covered by Part 851 are obligated to comply with the standards applicable to the hazards at their workplaces. Part 851, Appendix A is arranged by functional area and includes specific requirements for evaluating and controlling workplace hazards. When worker safety hazard controls are being developed, the compatibility with other hazard controls (such as radiological controls, environmental controls, fire protection controls, and transportation controls) needs to be considered before establishing the controls. Much of Part 851 implementation is focused at the activity level, such as workplace monitoring, exposure assessments, and activity-level hazard analysis. However, Part 851.21 includes requirements for facility-level hazard analysis. In particular, section 851.21(a)(4) requires analysis of designs of new facilities and modifications to existing facilities, and section 851.21 (a)(5) requires evaluation of operations, procedures, and facilities. Guidance for implementing these requirements is provided in DOE G 440.1-1B, Worker Safety and Health Program for DOE (Including the National Nuclear Security Administration) Federal and Contractor Employees. This Guide discusses the need to have worker protection professionals be assigned to review and provide input throughout project design and construction, including during conceptual design, preliminary design, final design, and inspection. Review during the conceptual design phase, the earliest phase of the project, is critical. Preliminary HAs review the types of operations that will be performed in the proposed facility and identify the hazards associated with these types of operations and facilities. The results of the preliminary HA may be used for multiple purposes such as determining the need for additional, more detailed analysis, serving as a precursor to document further analysis if deemed necessary, and serving as a baseline HA where further analysis is not required. Preliminary HAs should include a systematic review of each facility component and task and should consider: • Facility design characteristics (such as electrical installations, platform heights, and egress concerns); • Proposed equipment including types of equipment, location of equipment relative to the other operations and workers, and required equipment interfaces; • Proposed operations including related hazardous substances and potential exposures, potential energy sources, locations of operations and required interfaces; and • Anticipated facility and equipment maintenance needs, including confined space concerns, electrical hazards, and inadvertent equipment startup or operations hazards. The Preliminary HA should be conducted to identify hazards and establish a baseline for future evaluations. The Preliminary HA should consist of a comprehensive “wall-to-wall” evaluation. Table 2 provides examples of engineered safety controls to improve worker safety. DOE-HDBK-1163-2020 20

Biological Hazards. For biological hazards in the workplace, 10 C.F.R. 851 requires contractors to establish and implement a biological safety program to review use of biological agents (toxins, bacteria, viruses, fungi, and other microorganisms). Biosafety reviews include assessment of risk group level, facilities, procedures, practices, and training and expertise of personnel as well as a traditional hazards analysis/risk assessment for identifying additional controls. As a support to the biosafety review, the biological risk assessment details the potential release mechanisms together with potential impacts on the worker, co-located worker, public, and the environment. A written biosafety plan may be completed that is commensurate with the risk of the select agent or toxic, given the intended use. Risk groups are classifications that describe the relative hazard posed by infectious agents or toxins in the laboratory. The risk group to which an infectious agent or toxin is assigned is the primary, but not only, consideration used in a biological risk assessment to determine the appropriate biosafety level in which a worker can handle the infectious agent or toxin. Biosafety Levels (which correlate with but do not equate with risk group classifications) define a set of hazard controls appropriate to isolate dangerous biological agents based on the risk they present. The primary reference for biosafety is Centers for Disease Control and Prevention (CDC) 21-112, Biosafety in Microbiological and Biomedical Laboratories (BMBL), Fifth Edition, which defines the Biosafety Levels as follows: Biosafety level 1 (BSL-1) is the basic level of protection and is appropriate for agents that are not known to cause disease in normal, healthy humans. Biosafety level 2 (BSL-2) is appropriate for handling moderate-risk agents that cause human disease of varying severity by ingestion or through percutaneous or mucous membrane exposure. Biosafety level 3 (BSL-3) is appropriate for agents with a known potential for aerosol transmission, for agents that may cause serious and potentially lethal infections and that are indigenous or exotic in origin. Exotic agents that pose a high individual risk of life-threatening disease by infectious aerosols and for which no treatment is available are restricted to high containment laboratories that meet biosafety level 4 (BSL-4) standards. DOE-P-434.1B, Conduct and Approval of Select Agent and Toxin Work at Department of Energy Sites, establishes DOE expectations for the establishment and operation of DOE research laboratories using select agents and toxins. DOE does not authorize any Biosafety Level-4 activities or operations to be conducted at DOE facilities or on DOE sites. Any new line item construction of Biosafety Level-3 Labs is conducted in accordance with DOE O 413.3B, Program and Project Management for the Acquisition of Capital Assets, which includes completion of a hazard analysis and DOE approval. Title 29 C.F.R Part 1910, Occupational Safety and Health Standards, and Title 29 C.F.R Part 1926, Safety and Health Regulations for Construction. Worker safety at DOE facilities is generally regulated by DOE, except where a Memorandum of Agreement has been established to allow for regulation by OSHA. DOE’s worker safety rule (10 C.F.R. Part 851) broadly relies upon and specifically invokes a number of OSHA regulations and standards, including 29 C.F.R. Parts 1910 and 1926. DOE-HDBK-1163-2020 21

OSHA regulations for general industry and the construction industry cover a wide range of health and safety hazards. Several of the standards have requirements for specific activity-level HAs and in the case of 29 C.F.R. Part 1910.119, a process-level HA of process chemicals. The level of an HA review can range from a high-level review of large quantities of process chemicals to the lowest level at the worker activity-level. Table 2. Examples of Engineered Facility Safety Controls • Ventilation Systems o Filtration o Scrubbers o Impingers o Granular Activated Carbon Beds • Interlocks (doors) o Lasers o Accelerators o Energy Sources • Noise Dampening • Shielding/Blast Walls • Fire Suppression o Sprinkler o Halon o Smoke Detectors o Flame Detectors o Heat Detectors • Pressure Systems o Vessels o Piping o Boilers • Safety Shower/Eyewash • Firing Range Berms • Handrail/Guardrails • Uniform Traffic and Pedestrian Devices and Road Signs o Bollards/Barriers o Traffic Lights o Crosswalks/Sidewalks OSHA requires that hazards to workers are evaluated, documented, and controlled regardless of the degree of the hazard or the quantity of material of the hazard. Title 10 C.F.R. Part 850, Chronic Beryllium Disease Prevention Program. The safety and protection of workers from beryllium hazards is covered in 10 C.F.R. Part 850. This rule requires contractors to establish a Chronic Beryllium Disease Prevention Program for applicable sites. The rule includes requirements for the identification, evaluation, and control of beryllium. Part 850 discusses the criteria for HEs that include personal monitoring, swipe sampling (to include housekeeping), and release criteria of material from a beryllium area. DOE-HDBK-1163-2020 22 Title 10 C.F.R Part 835, Occupational Radiation Protection. Title 10 C.F.R. Part 835 provides requirements for worker safety hazards involving radiation exposure. This Part is primarily relevant at DOE nuclear facilities, including below HC-3 nuclear facilities. Radiation protection is primarily an activity-level HA and control method that should be integrated with job hazard analysis and work planning at the activity-level. This Part is discussed further in Section 4.3.1 of this Handbook. Some worker hazards involve both radiological and toxicological components; in such cases, integration between radiation protection and industrial safety is necessary. Title 10 C.F.R Part 830, Nuclear Safety Management, Subpart B, Safety Basis Requirements. Title 10 C.F.R. Part 830, Subpart B, only applies to HC-1, 2, and 3 nuclear facilities. However, for these facilities, worker hazards are within the required scope of analysis. Hazard controls to protect facility workers and co-located workers are included in DSAs where needed. Many worker hazards fall into the category of SIHs and are not addressed in the DSAs, in accordance with the safe harbor methodologies that are identified in the rule. These safe harbor methodologies allow most SIHs to be addressed in the worker safety and health programs. This Part is discussed further in Section 4.3.1 of this Handbook. DOE O 420.2C, Safety of Accelerator Facilities. DOE O 420.2C applies only to DOE accelerator facilities. For these facilities, worker hazards are required to be analyzed and hazard controls established based on this analysis, as documented in the SAD. The SAD provides sufficient descriptive information and analytical results pertaining to specific hazards and risks identified during the safety analysis process to provide an understanding of risks presented by the proposed operations. The SAD also provides detailed descriptions of engineered controls (e.g., interlocks and physical barriers) and administrative measures (e.g., training) taken to eliminate, control, or mitigate hazards from operation.

DOE O 456.1A, The Safe Handling of Unbound Engineered Nanoparticles. The creation and use of unbound engineered nanoparticles pose unique hazards. Nanoparticles can be free and dispersible, or they can be suspended in a gas or a liquid or embedded in a matrix. The potential health consequences of a potential exposure to the nanoparticles are not fully understood at this time. DOE O 456.1A establishes requirements and assigns responsibilities for activities involving nanoparticles. Contractors are required to conduct an exposure assessment for the safe handling and control of the nanoparticles. DOE O 440.1B, Worker Protection Program for DOE (Including the National Nuclear Security Administration) Federal Employees. DOE O 440.1B establishes the framework for an effective worker protection program for DOE federal employees to reduce or prevent injuries, illnesses, and accidental losses. DOE O 440.1B discusses the need to have worker protection professionals be assigned to review and provide input during facility design through operation. DOE O 440.1B largely parallels the contents of 10 C.F.R. 851 which applies to contractors. 4.1.2 Documentation Types Within the scope of OSHA and DOE standards, multiple instances require an HA focused on worker related hazards associated with specific activity tasks. Hazardous Waste Operations and Emergency Response (HAZWOPER) Risk Assessment. The HAZWOPER regulation (Title 29 C.F.R Part 1910.120) requires that a HASP be prepared for DOE-HDBK-1163-2020 23 hazardous waste cleanup operations. The HASP requires a hazard/risk assessment of planned activities to identify any conditions posing significant hazards to workers. A thorough hazard characterization usually includes a facility walkdown, visual inspections, air monitoring and sampling, and a review of facility records. Activity-level HA and radiation hazards surveys are important inputs to this process. Activity Hazard Analysis. Title 10 C.F.R. Part 851.21 (a)(4) requires an analysis of design activities for new facilities or modifications to existing ones, operations and procedures, equipment, products, and services. Impacts from exposure to chemical, physical, biological, or ergonomic hazards are evaluated through the HA process. Exposure monitoring activities help to validate exposure assessment classifications and potential similarly-exposed groups. The HA techniques used to accomplish these objectives may overlap with facility-level hazard analysis. For example, HA techniques used to evaluate worker hazards could include preliminary hazard analysis, PrHA, or a simple safety review. These techniques are similar to those often used in accomplishing facility-level HA and, therefore, would need to be coordinated to accomplish facility safety objectives, as well as ensure an adequate worker safety evaluation. The primary type of activity-level HA used across the DOE complex is the JHA. A JHA involves a breakdown of work tasks and assessment of the hazards associated with each step of a work task. The preparation of a JHA can generate information from sampling, modeling, document reviews, walkdowns, or interviews.

Activity-level HAs are conducted during the planning stage for new operations and procedures, as well as prior to the implementation of changes to existing operations and procedures. Information and insights gained from a facility-level HAs should be used as a primary input to activity-level HAs. Examples include type, location, and quantities of hazardous or radioactive materials, important assumptions and information regarding facility systems and processes, and facility controls that need to be protected. 4.1.3 Integration with Other Programs and Regulations Activity-level HAs support fulfillment of facility-level HA requirements. To the extent practicable, the HA processes should be consistent across an entire site to facilitate common practices and decisions with respect to integration. Communication is key for successful integration to ensure there are no conflicting controls, hazard controls do not create hazards, malfunctions, or accidents of a different type, and to ensure all hazards are accurately characterized and controlled. Work control documents should include elements of the activity- level HAs to ensure hazards are assessed and controls for worker safety are implemented. Within worker safety programs, HAs and controls need to be integrated across program elements for the following specific hazard types: beryllium, asbestos, and lead. A potentially false assumption when conducting an activity-level HA is that the public, co-located workers, and the environment are protected if the facility workers are protected. This assumption holds true in many cases, such as, for example, when a non-hazardous chemical is substituted for a hazardous one, or when the amount of a hazardous chemical is significantly reduced. In some cases, however, the assumption can be false, such as some incidents involving radiological or chemical releases from a building stack. A fume hood, glovebox, local ventilation system can be DOE-HDBK-1163-2020 24 very effective in providing a layer of protection between the facility worker and the hazard. However, if not mitigated in some way, worker hazards can become potential hazards to co- located workers, the environment, and the public. Additional controls such as scrubber systems, incinerators, bag houses, high-efficiency particulate air filtration, blast walls, and other air quality controls might be needed to provide layers of protection to receptors other than the worker. This is also true for the transportation of hazardous chemicals and materials to different locations within the facility footprint. When designing facility-level controls, a thorough understanding of the activity-level work which will be performed in the facility is needed. Some facilities are dedicated to a single mission, while other facilities support multiple missions operating under a single roof. Through integration and evaluation of activity-level HA, JHAs, exposure assessments, hazards and activities supporting concurrent missions can be analyzed for potential interactions. The roll-up of activity-level work at a given facility provides a summary on areas with common hazards or can be used as a planning tool to structure space. The roll-up of activity-level HAs at a facility-level will enable the hazard analyst to identify, evaluate, and control concurrent and contiguous activities with potential incompatibilities both in operational and accident conditions. Figure 5 provides the worker safety HA process.

Figure 5. Worker Safety Hazard Analysis Process DOE-HDBK-1163-2020 25 4.2 Chemical Hazards Chemical hazards are ubiquitous at DOE facilities. Many types of hazardous chemicals exist. In many cases, a chemical or chemical product poses more than one type of hazard. Hazardous chemicals are categorized by the type of chemical or by the effects from exposure. SMEs evaluate the effects (hazard and risk) that a chemical could have on the facility, workers, public, or the environment including hazard scenarios involving chemicals or chemical products. The following chemical types are typically identified and included in chemical management programs: • Combustible and flammable solids, liquids, gases, and aerosols; • Toxic substances, per 15 United States Code (U.S.C.) Chapter 53 definitions; • Poisons (including metals) and blood agents; • Herbicides and pesticides; • Reactive substances; • Oxidizers; • Caustics and acids; • Organic solvents; • Choking/lung/pulmonary agents; • Asphyxiates; • Hazardous air pollutants; • Carcinogens and mutagens; • Dusts and powders; • Explosives and their initiators are a unique subset of chemicals that have separate handling and control requirements (see DOE-STD-1212-2019, Explosives Safety, or successor); and • Regulated substances with unique regulatory requirements (may include the above types). Formalized use of a chemical management program is an efficient management tool for addressing the hazards of chemicals throughout the chemical lifecycle. A chemical management program is an integrated effort to ensure chemical hazards are controlled effectively. The purpose of a chemical hazard management program is to protect workers, the public, and the environment. A chemical hazard management program does not typically include hazardous waste, high explosives, or radioactive materials, because these are addressed in separate, targeted programs. 4.2.1 Regulatory Drivers Many of the hazard analysis requirements for chemical facilities crosscut one another. Facility managers can greatly facilitate the hazard analysis process by understanding the relationship of requirements to assure a coordinated approach. Practitioners recognize hazard analysis requirements flow down through the site, facility, and activity-levels. DOE-HDBK-1163-2020 26 The ability to communicate and exchange information regarding the various levels of hazards and risk analysis data is important. The establishment of clear, direct lines of communication and exchange of information among those who conduct and use hazard analyses, provide results that support other needed analyses (engineering, operations, and work planning), help resolve conflicts, eliminate duplication of efforts, and more importantly, ensure the comprehensive evaluation and control of hazards at the site, facility, and activity-levels. Title 10 C.F.R. Part 851, Worker Safety and Health Program. Part 851 requires DOE contractors to evaluate and control workplace hazards, including facilities with chemical hazards. Traditionally, 10 C.F.R. 851 is a worker-level regulatory driver applicable to all DOE facilities. Hazard analysis requirements are specifically addressed by Section 851.21, Hazard Identification, and Section 851.22, Assessment and Hazard Prevention and Abatement.

Title 29 C.F.R. Part 1910.119, Process Safety Management for Highly Hazardous Chemicals. The purpose of OSHA PSM, which is required by 10 C.F.R. Section 851.23(a)(3), is to prevent releases of highly hazardous chemicals with the potential to cause catastrophic fires, explosions, or toxic exposures. Traditionally, 29 C.F.R. Part 1910.119 is a facility-level or a process-level regulatory driver applicable to all DOE facilities exceeding regulatory thresholds. While PSM has a very limited applicability to only those DOE facilities that exceed thresholds for highly hazardous chemicals, the PSM process is an excellent methodology for managing chemical processing hazards including the performance of HAs and selection of controls. This process is used by best performers in the chemical industry even when hazards are below regulatory thresholds. The PSM methodology should be applied to DOE non-PSM facilities using a graded approach. OSHA PSM integrates fourteen elements required to manage facilities, technology, and personnel. One of the elements is a PrHA that includes the identification of hazards, application of specific hazard evaluation techniques, and selection of controls. Many of the PSM elements are routinely implemented at DOE facilities in accordance with ISM systems and other safety management programs such as Conduct of Operations. Supporting elements to the PrHA include a pre-startup safety review and management of change. DOE-HDBK-1101-2004, Process Safety Management for Highly Hazardous Chemicals, provides information necessary to determine if a chemical process is covered by PSM, provides an interpretation of the PSM elements, and describes DOE programs that may, with or without modification, satisfy the requirements of PSM. For specific guidance on the PrHA element, refer to DOE-HDBK-1100-2004, Chemical Process Hazards Analysis. Title 40 C.F.R. Part 68, Chemical Accident Prevention Provisions. Title 40 C.F.R. Part 68 requires implementation of a Risk Management Program (RMP) for facilities with chemicals exceeding regulatory thresholds. As required, the RMP includes preparation of a worst-case hazardous material release scenario analysis together with a complete five-year accident history. In contrast to OSHA PSM, which addresses worker hazards, Environmental Protection Agency's (EPA's) RMP requirements address potential off-site impacts. For facilities with offsite impacts from accidental releases of chemicals or chemical physical hazards (e.g., explosions, fires), alternative release scenarios are required. Hazards identification with subsequent hazards evaluation is inherent in the development of an RMP. Typically, facilities subject to PSM DOE-HDBK-1163-2020 27 integrate the hazard analysis efforts as part of the RMP process. RMP has very limited applicability to DOE facilities because few facilities or activities meet the high chemical thresholds. Title 10 C.F.R Part 830, Nuclear Safety Management, Subpart B, Safety Basis Requirements. Title 10 C.F.R. Part 830, Subpart B, only applies to HC-1, 2, and 3 nuclear facilities. However, for these facilities, chemical hazards are within the required scope of analysis. This rule specifically requires DSAs to address: “identification of energy sources or processes that might contribute to the generation or uncontrolled release of radioactive and other hazardous materials.” Integration of chemical hazard analysis into nuclear DSAs is addressed in more detail in Section 4.3.3.

DOE O 151.1D, Comprehensive Emergency Management System. DOE O 151.1D requires the development of an EPHA for facilities exceeding certain chemical or radiological hazard thresholds. The EPHA is a quantitative analysis identifying hazards and the potential consequences from unplanned releases of (or loss of control over) hazardous materials using accepted assessment techniques. The EPHA is considered at a site-level or a facility-level. DOE O 413.3B, Program and Project Management for the Acquisition of Capital Assets. DOE O 413.3B establishes hazard analysis requirements for capital asset projects and facilities including both non-nuclear and nuclear facilities with chemicals. Requirements include the development of preliminary hazard analyses to ensure incorporation of safety into the design process as well as the development of a comprehensive hazard analysis. The required hazards analyses identify facility hazards and subsequent safety controls. These hazards analyses focus on facility-level hazards. DOE O 420.1C, Facility Safety. DOE O 420.1C establishes facility-level and programmatic safety requirements for DOE facilities. While many of the DOE O 420.1C requirements are focused on HC-1, 2, and 3 nuclear facilities, several key topical areas are applicable to all DOE facilities: building code, fire protection, and natural phenomena hazard protection. Performance of hazard analysis is inherent for each of the DOE O 420.1C program areas. Integration of the differing hazard analysis for facilities with chemical hazards analyses is preferred. DOE O 420.2C, Safety of Accelerator Facilities. DOE O 420.2C applies only to DOE accelerator facilities. Chemical hazards are present in accelerator facilities (e.g., asphyxiates like He or SF6) and are within the scope of analysis. For these facilities, chemical hazards are required to be analyzed and hazard controls established based on this analysis, as documented in the SAD. The SAD provides descriptions of engineered controls (e.g., interlocks and physical barriers) and administrative measures (e.g., training) taken to eliminate, control, or mitigate hazards from operation. DOE-HDBK-1139-2018, Chemical Management, Volume 3. DOE-HDBK-1139 consolidates existing core safety and health requirements for sites engaged in chemical-related activities to eliminate the confusion of overlapping and duplicative chemical-related safety and health requirements. Volume 3 of DOE-HDBK-1139 also consolidates requirements found in National Fire Protection Association (NFPA) codes, American National Standards Institute (ANSI) standards, Compressed Gas Association publications, OSHA rules, EPA rules, and DOE directives and standards. The Handbook also provides guidance on protection of workers from chemical hazards. DOE-HDBK-1163-2020 28 4.2.2 Documentation Types Site, facility, process, and activity-level HAs are necessary to identify and evaluate chemical hazards. These HAs are completed as part of a robust chemical management program, which is an efficient management tool for effectively controlling chemicals throughout their lifecycle. Before chemical acquisition, the chemical management program should first evaluate if substitution with a less hazardous alternative is feasible and ensure that any existing inventory of a hazardous chemical is repurposed.

Chemical acquisition and use follow a path that requires specific HAs at a minimum of two specific timeframes: acquisition and use. The initial step for analysis happens before the chemical arrives on site. Prior to or during the acquisition process, an analysis of acquisition impacts should be performed to ensure hazards are appropriately identified and controlled. This analysis should include an integrated team of SMEs for industrial hygiene, fire protection, nuclear safety, and facility management, as appropriate. Other SMEs might also be needed, depending on the chemical, such as quality, security, transportation, environmental management (EM), and emergency management. This analysis will determine impacts to and possible actions regarding: • RMP and PSM thresholds to determine whether these apply; • Hierarchy of controls; • Fire protection controls or needs for changes; • Industrial hygiene planning; • Reporting and entry into the inventory and tracking system; • Environmental permits, as applicable; • Hazard communication rule (29 C.F.R. Part 1910.1200); • Radiological control; • Area-specific restrictions; • Inspection process and schedule; • Training needs; • Nuclear safety/DSA impacts; • Emergency plan impacts; and • Pollution prevention steps needed or warranted. These initial analyses will result in either verifying that the current controls are sufficient or identifying additional controls needed before the chemical arrives on site. The next trigger point requiring an HA is a planned operation with the chemical, such as transportation to a new location, operational use, or both. Though often an activity-level evolution, these operations can have facility-level impacts to be considered. This is an excellent opportunity for integration of activity-level and facility-level HA efforts. DOE-HDBK-1163-2020 29 Facility managers (chemical owners) are responsible for establishing a system for the evaluation of planned use of chemicals. Use of an integrated multi-disciplinary SME team is often needed to make sure the full range of hazards and controls is considered. For example, a facility HA owner could be primarily interested in the additional fire hazard that the welding operation would bring, whereas the industrial hygiene group is more interested in evaluating potential chemical exposures to chromium and establishing needed ventilation, PPE, and medical surveillance. Both the facility- level and the activity-level HAs need to be valid. This activity-related evaluation will result in controls and actions needed for that specific use and in that location (i.e., what is being done with the chemical and where the operation is located). A chemical management system can be employed to screen initial levels of analysis needed, to determine which SMEs need to be involved in this process and at which points, or to determine classifications of chemicals that can fit into already existing analyses and controls. For example, some chemicals have little facility impact potential, regardless of use, and can be screened out to only require health and safety analysis for the secondary evaluation during operational use. The chemical management system should have a way to track and dispose of, or otherwise disposition, residual chemical product. If this residual is to be relocated, the process starts over again. Chemicals may be returned to inventory within existing controls or relocated, in which case, the evaluation process begins again.

HA documents at below HC-3 nuclear facilities, chemical facilities, and industrial facilities are handled in a similar manner. An appropriate chemical hazard management process is used to identify and analyze each of the chemical hazards, then controls are identified, and the results documented in an HA document, as described in Figure 6. This process focuses on two points: (1) when chemicals are procured, received, and put into inventory, and (2) when chemicals are taken from inventory and used in planned facility operations. DOE-HDBK-1163-2020 30 Figure 6. Chemical Hazard Management Process This process would also apply to HC-1, 2, and 3 nuclear facilities. Appendix F provides additional information on the recommended process for identifying and analyzing chemical hazards at HC-1, 2, and 3 nuclear facilities. 4.2.3 Integration with other Programs/Regulations At the integration and implementation level, multiple programs have specific elements that work together to ensure proper treatment of chemical hazards. Key among these programs are industrial hygiene and emergency planning. Notably, emergency planning includes a detailed hazard survey. Information from these programs should be shared to prevent duplication of effort or inconsistencies from developing between the inventories of hazards. Two important considerations regarding ensuring proper treatment of chemical hazards are design and operations/maintenance. Compliance with applicable codes and standards, design hazard analysis, change control processes, and preparation and upkeep of system design descriptions help to ensure chemical hazards are adequately addressed in the design of the facility. From an operations and maintenance perspective, procedures, work packages, training programs, event investigations, and lessons learned work together to ensure the proper treatment of chemical hazards. Design, operations and maintenance, change control, configuration management, and DOE-HDBK-1163-2020 31 process flow sheet development are important parts of ensuring proper treatment of chemical hazards. The HAs completed for chemicals can be utilized for other program and/or regulations. The information collected for chemical HAs can be used to support development of DSAs, SADs, EPHAs, and PrHAs, as well as for activity-level HAs. Onsite (i.e., co-located worker) and offsite (i.e., public) releases are evaluated as a part of site, facility, and/or process-level HAs. Typically, activity-level HAs focus on worker impacts. Onsite and offsite releases of hazardous chemicals are evaluated with the use of Protective Action Criteria (PAC) values. PAC values are developed and maintained by DOE’s Office of Emergency Planning. Appendix E provides further explanation of PAC values. Understanding the topic of PACs and their derivation is important because PACs are generally used as the authoritative chemical threshold values, particularly at the facility-level. At the worker level, PACs have limitations and other values need to be used such as threshold limit values and/or permissible exposure levels.

4.3 Radiological Hazards from Nuclear Facilities A variety of hazards are present at DOE HC-1, 2, and 3 nuclear facilities and below HC-3 nuclear facilities, including radiological and non-radiological hazardous materials, SIHs, and hazards resulting from fire, natural phenomena, or criticality events. Nuclear facilities are unique, in that, in addition to the regulation of hazards common at industrial and chemical facilities, nuclear facilities are regulated to control potential hazards from radioactive and fissionable materials that could impact the workers, the public, and the environment. 4.3.1 Regulatory Drivers Title 10 C.F.R Part 830, Nuclear Safety Management, Subpart B, Safety Basis Requirements. The safety of DOE nuclear facilities is regulated by 10 C.F.R. Part 830, Nuclear Safety Management. Title 10 C.F.R Part 830, Subpart B, establishes safety basis requirements for HC-1, 2, and 3 DOE nuclear facilities and requires systematically analyzing facility hazards to develop controls. The safety basis is established by (1) defining the scope of the work to be performed; (2) identifying and analyzing the hazards associated with the work; (3) categorizing the facility consistent with DOE-STD-1027-925 Chg. 1, Hazard Categorization and Accident Analysis Techniques for compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports, September 1997; (4) preparing a DSA for the facility; and (5) establishing the hazard controls upon which the contractor will rely to ensure adequate protection of workers, the public, and the environment. The DSA required by 10 C.F.R. Part 830 serves as the primary analysis of facility-level hazards for HC-1, 2, and 3 nuclear facilities. Title 10 C.F.R Part 835, Occupational Radiation Protection. Title 10 C.F.R. Part 835 requires sampling and monitoring of individuals and work areas to identify radiological hazards and 5 DOE-STD-1027-2018, Chg. 1, Hazard Categorization of DOE Nuclear Facilities, provides an updated and acceptable methodology to “[c]ategorize the facility consistent with DOE-STD-1027-92 (“Hazard Categorization and Accident Analysis Techniques for compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports,” Change Notice 1, September 1997),” as required by 10 C.F.R. Section 202(b)(3). DOE-HDBK-1163-2020 32 potential sources of worker exposures and requires documentation of a radiation hazards survey. These activities are conducted routinely, as well as prior to authorization of work in a given area that has radioactive materials or contamination. This information is also a key input to hazards analyses, since it provides data regarding radiological hazards and helps determine when radiation control measures will be needed. Radiation protection is primarily an activity-level HA and control method, although it can be important in identifying the need for permanent facility design features to allow for ongoing facility access that shields workers from radiation. Nuclear facilities are designed based on As Low As Reasonably Achievable (ALARA) principles. DOE O 420.1C, Facility Safety. DOE O 420.1C establishes facility-level and programmatic safety requirements for both DOE nuclear and non-nuclear facilities. DOE O 420.1C provides requirements in multiple safety topical areas: design codes and standards, nuclear safety design criteria, fire protection, criticality safety, natural phenomena hazards mitigation, and systems engineering. This Order invokes multiple DOE technical standards and industry standards that are required for use to ensure safety of DOE facilities. Many of the nuclear safety design criteria and safety codes and standards rise to the level of inclusion in nuclear DSAs.

One type of hazard unique to DOE nuclear facilities and addressed in DOE O 420.1C is inadvertent nuclear criticality. DOE O 420.1C requires development and approval of a criticality safety program, which uses DOE-STD-3007-2017 and the ANSI/American Nuclear Society (ANS)-8 series of standards to perform the hazard analysis. Use of DOE-STD-3007-2017 and ANSI/ANS-8 series of standards are identified by DOE-STD-3009-2014, for example, as an acceptable method to use for performing Criticality Safety Evaluations (CSEs). While preparation of a CSE is not duplicative of safety analysis efforts, coordination and integration is necessary. The CSE process, compliant with ANSI/ANS-8.1, evaluates the normal and credible abnormal conditions associated with a fissionable material operation, and identifies the controls necessary for the operation to remain safely subcritical. The functional classification of criticality controls is part of the DSA process (in accordance with DOE-STD-3009-2014). DOE O 413.3B, Program and Project Management for the Acquisition of Capital Assets. For below HC-3 nuclear facilities, a preliminary Hazard Analysis Report (HAR) is required prior to approval of conceptual safety design for such facilities. This document is finalized as a HAR during the evolution of facility design and prior to startup of the facility. For HC-1, 2, and 3 nuclear facilities, the DOE O 413.3B requirements for preliminary and final hazard analysis are completely consistent with 10 C.F.R. Part 830, DOE O 420.1C, and related implementation standards; the inclusion of these requirements in DOE O 413.3B helps to ensure they are effectively integrated into capital projects. Figure 7 depicts the primary regulatory drivers by facility type. DOE-HDBK-1163-2020 33 Figure 7. Summary of Regulatory Drivers by Facility Types DOE-HDBK-1163-2020 34 4.3.2 Documentation Types Documented Safety Analysis. The DSA, required by 10 C.F.R. Part 830, Subpart B, serves as the primary analysis of facility-level hazards. The DSA documents how a HC-1, 2, or 3 nuclear facility can be operated safely with respect to workers, the public, and the environment. The DSA includes a description of the conditions, safe boundaries, and hazard controls that provide the basis for ensuring safety. Facility hazard categorization consistent with the methodology in DOE-STD- 1027-92, Hazard Categorization and Accident Analysis Techniques for compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports, Chg. 1, is documented in the DSA to confirm applicability of 10 C.F.R. Part 830, Subpart B. DOE-STD-3009-2014, Preparation of Nonreactor Nuclear Facility Documented Safety Analysis, and DOE-STD-3009-94, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports, are safe harbor methodologies under 10 C.F.R. Part 830 and are commonly used to document the facility safety analysis. Since the DSA is broadly encompassing, it should be used as the primary vehicle for conveying the results of an integrated HA at HC-1, 2, and 3 nuclear facilities. DSAs often include top-level results of design calculations and analyses and may reference these underlying design documents that support DSA conclusions. DOE-HDBK-1224-2018, Hazard and Accident Analysis Handbook, provides comprehensive guidance, lessons learned, and practical examples for developing hazard and accident analyses for DOE nuclear facilities.

DOE-STD-1228-2019, Preparation of Documented Safety Analysis for Hazard Category 3 DOE Nuclear Facilities, describes an acceptable methodology for preparing HC-3 nuclear facility DSAs, and includes guidance for addressing chemical hazards at HC-3 nuclear facilities. Hazard Analysis Reports for Below HC-3 Nuclear Facilities. A documented HAR is required by DOE O 413.3B for capital asset projects meeting the applicability threshold of that Order. Other historical DOE requirements have led to establishment of facility-level HARs for existing below HC-3 nuclear facilities6. Experience shows that establishing and maintaining documented facility-level HARs are needed and beneficial for many below HC-3 nuclear facilities. These HARs should be developed and maintained, using a graded approach, and address the contents in Table 3 below. HARs often include top-level results of design calculations and analyses and may reference these underlying design documents that support HAR conclusions. This HAR format may be used for a comprehensive SHA, as described in Section 2.4.2. 6 For example, DOE-EM-STD-5502-94, Hazard Baseline Documentation, required development and maintenance of “Auditable Safety Analysis” for below HC-3 nuclear facilities. DOE O 5481.1B, Safety Analysis and Review System, required safety analysis for all DOE activities, including those with low hazards. DOE-HDBK-1163-2020 35 Table 3. Hazard Analysis Report Contents for Below HC-3 Nuclear Facilities (1) Facility Description (a) Physical description of the facility (b) Scope of work at the facility (c) Operational boundaries, including hazardous material limits, fissionable material limits (2) Hazard Identification (a) Identification of hazards (b) Hazardous material inventories (and comparison to HC-3 threshold levels in DOE-STD-1027) (3) Hazard Evaluation (a) Analysis of the hazards and the impact to the workers, public, and the environment (b) Identification of controls to prevent or mitigate the identified hazards 4.3.3 Integration with Other Programs/Regulations Integration with Fire Hazards Analysis. DOE O 420.1C, Facility Safety, requires the integration of FHA results into safety basis documents. FHAs should be coordinated and integrated through teaming of fire safety personnel with hazard/accident analysts, and any conflicts related to FHAs and DSAs/HARs should be resolved prior to the approval of the DSA/HAR. DOE-STD-1066-2016 provides guidance on integrating FHAs and safety basis documents: “When both a FHA and a safety basis document (such as a DSA) are developed for a facility, the developmental effort should be coordinated to the maximum extent possible to ensure technical consistency.” “FHAs and DSAs should be coordinated to avoid duplication of effort. It is recognized, however, that because a FHA is based on the premise that a fire will occur and considers a variety of fire issues (property loss and program interruption potential) that are not normally considered in the DSA, the conclusions of the FHA may be more conservative for the facility as a whole, while the DSA may be more conservative for a specific process…. the FHA and its conclusions should be addressed in the facility DSA in such a manner as to reflect the relevant fire safety objectives, as defined in DOE O 420.1C. As a general rule, the FHA should be developed so as to provide input into the DSA. Thus, some portions of the FHA may be developed early in the safety basis development process, and, in some cases concurrently with the safety basis development process. In no case should the FHA be back-fitted so that results of the FHA correspond to results of the safety basis documentation. However, the FHA is required… to address DSA design basis fire scenarios and the protection of [Safety Class] and [Safety Significant] features.”

DOE-HDBK-1163-2020 36 Integration with Natural Phenomena Hazards (NPH) Assessments. DOE O 420.1C, Chg. 3, requires that the NPH analysis, supporting design and construction of facilities and safety SSCs, to be documented and include an evaluation of: (1) potential damage to and failure of safety SSCs resulting from both direct and indirect NPH events; and, (2) common cause/effect and interactions resulting from failures of other nearby facilities or other SSCs in the same facility caused by or induced by an NPH event. Therefore, NPH assessments should be coordinated through teaming efforts with hazard/accident analysts. Integration with Chemical Hazard Analysis. For HC-1, 2, and 3 nuclear facilities, DOE-STD-3009-2014 clarifies that certain chemicals are not expected to be addressed in DSAs; chemicals that may be screened during a comprehensive hazard identification include: • Chemicals with no known or suspected toxic properties; • Materials that have a health rating of 0 or 1 based on NFPA-704; • Materials that are commonly available and used in the general public; • Small-scale use of quantities of chemicals, such as in laboratories; and • Chemicals that can be safely handled by implementation of a hazardous material protection program (chemical SMP) described in the DSA. Screening of standard industrial hazards is discussed in more detail in DOE-STD-3009-2014, Appendix A.1. Screening of toxic chemical hazards is discussed in DOE-STD-3009-2014, Appendix A.2. These exclusions are focused on chemicals that do not represent a significant hazard or that are routinely encountered in general industry and construction and are adequately addressed by provisions of 10 C.F.R. 851, Worker Safety and Health Program. For HC-1, 2 and 3 nuclear facilities where a hazardous material protection program is an important element of adequate protection for worker safety (because of the type and quantity of hazardous chemicals that could cause harm to workers if not adequately controlled), these programs should be identified and described as SMPs in the facility DSA. A chief advantage of clearly identifying and describing a Chemical SMP in HC-1, 2 and 3 nuclear facility DSAs is that the administrative burden of identifying and managing chemical hazard controls can be reduced, in a similar way as for other SMPs, such as radiation protection and criticality control. On the other hand, for some nuclear facilities, such as relatively less complex facilities with few chemical hazards and a relatively undeveloped chemical control program, fully-integrated DSA evaluation and control of chemical hazards may be the best approach. For most HC-1, 2, and 3 nuclear facilities with significant chemical hazards, a clearly identified and described chemical SMP is recommended. DSA descriptions of an adequate chemical SMP7 should address the following: (1) process for identification of hazardous chemical materials, (2) process for identification of controls for hazardous chemical materials, (3) industry standards used to identify and control hazardous 7 Another name used for a Chemical SMP is a Hazardous Material Protection Program. Chapter 8 of DOE-STD-3009- 94, Chg. 3, provides guidance on this program, using that name. DOE-HDBK-1163-2020 37 chemical materials, (4) how the hazardous inventories are maintained accurate and up-to-date, and (5) how the integrity of hazardous material controls are assured. Such descriptions should also include a summary of primary chemical hazards in the facility. Key elements of chemical SMPs should be identified and protected in the facility DSA.

The Chemical SMP should typically be described in a facility-specific or site-specific plan or program with accompanying implementation procedures. The Chemical SMP and procedures should fully address ISM program attributes such as line management responsibility, clear roles and responsibilities, competence commensurate with responsibilities, and feedback and improvement. The Chemical SMP should address both anticipated working conditions and off- normal hazard scenarios and should provide protection for both facility workers and co-located workers. The strength and integrity of the Chemical SMP is essential for the DSA to effectively rely on the Chemical SMP to establish and maintain appropriate chemical hazard controls. For HC-1, 2, and 3 nuclear facilities, 10 C.F.R. Section 830.204 requires evaluation of normal, abnormal, and accident conditions that might lead to uncontrolled release of hazardous materials. DOE-STD-3009-2014 expects that significant, uncontrolled releases of hazardous material be evaluated in the hazard evaluation and if threshold criteria are exceeded, safety SSCs and Specific Administrative Controls (SACs) are used to control these events. This evaluation applies to those chemicals that are not screened per the DOE-STD-3009-2014 screening criteria (summarized in the bullets above), and includes chemicals of concern that are present in the facility or activity and present hazard potentials outside the routine scope of the hazardous material protection program. The scope of the scenarios that require DSA hazard evaluation to meet DOE-STD-3009-2014 includes: • Chemical hazards with the potential for significant off-site consequences to the public (for example, greater than or equal to PAC-28); • Chemical hazards that initiate or worsen a significant radiological release; • Chemical hazards that adversely affect a credited nuclear safety function (for example, incapacitating a worker relied upon to perform a SAC or affecting the ability of safety SSCs to perform their safety functions); • Extraordinary chemical hazards that have a high acute toxicity and high dispersibility (for example, greater than or equal to a PAC-3 for 3 ppm or less, and highly dispersible such as compressed gases); • Uncontrolled chemical releases with the potential for significant on-site consequences to co- located workers (for example, greater than or equal to PAC-3) 9; and 8 In accordance with DOE-STD-3009-2014, Table 1, “Consequence Thresholds,” the consequences may be estimated using qualitative and/or semi-quantitative techniques. This note is applicable to all bullets on this list where a quantitative threshold is used. 9 This bullet does not include chemicals that are simply stored within the facility footprint. DOE-HDBK-1163-2020 38 • Any additional chemical hazards that are not adequately identified and controlled by an adequate Chemical SMP and could cause significant harm to facility workers or co-located workers. These specific hazard scenarios require DSA evaluation even if chemicals are addressed as a part of an adequate Chemical SMP. Appendix F provides a simple process derived from DOE-STD- 3009-2014 that can be used to determine which chemical hazard scenarios require DSA hazard evaluation. See also DOE-HDBK-1224-2018 and DOE-STD-1228-2019 for additional guidance.

If an adequate Chemical SMP has been established and is being implemented, then, in many cases, the hazard controls related to chemicals may rely on the Chemical SMP, with a small subset of chemical hazard controls designated as "safety significant" in the DSA. Key elements of chemical SMPs may be identified to protect facility workers and co-located workers, particularly, to ensure coverage of any unique chemical hazards to workers. Chemical PrHA expectations are similar to facility-level HA expectations. Many of the chemical PrHA requirements addressed in the OSHA PSM Standard are directly parallel to DOE nuclear safety analysis topics. Because of the similarities between the OSHA PSM Standard and the DOE nuclear safety analysis, it is reasonable to conduct one integrated HA at the few facilities that are required to produce chemical PrHAs. However, DOE goes beyond the PrHA requirements of OSHA/EPA by requiring DSAs to evaluate potential consequences and to estimate the likelihood of accidents, both with and without the aid of protective features (e.g., physical barriers, engineered controls). Since a DSA is more encompassing, it should be used as the primary vehicle for conveying the top-level results of the integrated chemical/nuclear HA at HC-1, 2, and 3 nuclear facilities, along with the program description and key attributes of the chemical SMP. 4.4 Other Hazards Fire Hazards Analysis. DOE O 420.1C, Facility Safety, requires that conclusions of the FHA be integrated into safety basis documentation. The site’s Fire Protection Program Plans (DOE approved, per DOE O 420.1C) detail elements of hazard protection across the facility types. Many of the requirements are prescribed, having been derived from HA perspectives with controls explicitly stated. Many of the DOE O 420.1C fire protection requirements focus on facility safety and mission preservation. These facility fire protection requirements complement and need to be integrated with worker safety fire protection requirements in 10 C.F.R. 851. The Fire Protection Program should describe this integration. Natural Phenomena Hazard Assessment. DOE O 420.1C, Chg. 3, requires an NPH Assessment for both nuclear and non-nuclear facilities. The Order establishes requirements for DOE facility design, construction, and operations to protect the public, workers, and the environment from the impact of NPH events (e.g., earthquake, wind, flood, lightning, snow and volcanic eruption). Safety Assessment Document for Accelerators. The safety of DOE accelerator facilities is governed by DOE O 420.2C, Safety of Accelerator Facilities, which directs the establishment of the following safety documents: (1) SAD, (2) Accelerator Safety Envelope (ASE); and (3) an DOE-HDBK-1163-2020 39 unreviewed safety issue process. The SAD captures the accelerator hazards and controls, and provides the basis for the ASE. The ASE defines the physical and administrative bounding conditions and controls for safe operations (similar to Technical Safety Requirements for HC-1, 2, and 3 nuclear facilities). The unreviewed safety issue process ensures the SAD and ASE are maintained accurate and up to date (similar to the Unreviewed Safety Question process for HC-1, 2, and 3 nuclear facilities). The SAD is the primary facility-level HA document for accelerators and needs to integrate with other facility HA processes. Worker safety at DOE laser facilities is governed by 10 C.F.R. 851, Worker Safety and Health Program, Technical Amendment issued in December 2018, which incorporates by reference the national consensus standard ANSI Z136.1- 2014, Safe Use of Lasers. Radiological hazards are a primary hazard from DOE accelerators; however, accelerators are not categorized as DOE nuclear facilities.

Emergency Planning Hazards Assessment. An EPHA is required by DOE O 151.1 D, Comprehensive Emergency Management System, for facilities exceeding certain chemical or radiological hazard thresholds. Based on the threshold levels, an EPHA is required for a broad set of facilities that encompass (1) nuclear facilities subject to 10 C.F.R. Part 830, Subpart B; (2) non-nuclear facilities subject to OSHA PSM and EPA RMP requirements; and (3) other facilities not subject to these regulations but containing hazardous or radioactive materials exceeding emergency management thresholds. A primary opportunity for HA integration exists because the first two cases involve applicability of multiple HA requirements. Environmental Impact Statements (EIS). An EIS is required by the 1969 National Environmental Policy Act (NEPA) for “major federal actions” that “significantly affecting the quality of the human environment.” It is used for decision-making regarding proposed Federal projects. DSA and PrHA efforts primarily evaluate a range of accidents with the potential to significantly impact workers, the public, and environment over a relatively short period of time. However, many of the basic assumptions supporting EIS-related HI, HA, and accident analysis activities are consistent with nuclear safety analysis or chemical PrHA activities. Preliminary Hazard Analysis Report for Capital Projects. DOE O 413.3B, Program and Project Management for the Acquisition of Capital Assets, establishes HA requirements for capital asset projects and facilities, with a total project cost greater than $50M (or, in some cases, a reduced threshold). For HC-1, 2, and 3 facilities, DOE O 413.3B defers to 10 C.F.R. Part 830, Subpart B, for preliminary and final DSAs. For other capital projects and facilities (below HC-3 nuclear facilities and non-nuclear facilities), a preliminary HAR is required prior to approval of conceptual safety design for such facilities. This document is finalized as HAR during the evolution of facility design and finalized prior to startup of the facility. The HAR identifies facility hazards and safety controls. Process Hazard Analysis for Explosive Operations. DOE-STD-1212-2019, Explosives Safety, establishes requirements for hazard analysis for select explosive operations. Approval of the head of the DOE Field Element (DOE/NNSA Field/Operations/Production Office) is required for Explosives Safety Site Plans. Transportation Safety Documents. DOE O 460.1D, Hazardous Materials Packaging and Transportation Safety, and DOE O 461.2, Onsite Packaging and Transfer of Materials of National Security Interest, establish requirements for preparing a Safety Analysis Report for http://www.directives.doe.gov/ http://tis.eh.doe.gov/nsps/ourdocs.html DOE-HDBK-1163-2020 40 Packaging, and a Transportation Safety Document. These directives provide requirements for satisfying Department of Transportation regulations and include methods for developing DSAs that satisfy 10 C.F.R. Part 830, Subpart B for HC-1, HC-2, and HC-3nuclear activities. Department of Transportation-compliant packaging is often used for hazardous materials such as chemicals, explosives and radioactive materials. Hazardous materials typically arrive at DOE sites and facilities in Department of Transportation-compliant packaging. These packages can be used for temporary staging, storage, movement, and possibly the removal of the hazardous materials. DOE O 460.1D also describes the hazard analysis process for the determination of non-compliant packaging (e.g., radioactive material mated with explosives, explosives mated with initiators, and explosives mated with chemicals).

DOE-HDBK-1163-2020 41 5.0 LESSONS LEARNED Good practices in this section are based on interactions with DOE and industry organizations. These good practices include approaches that are not necessarily required by a particular regulation or DOE directive. These practices can improve the effectiveness of HA activities, save resources, and facilitate appropriate hazard control at different facility and mission types. A discussion of each practice is provided, along with additional sources of information. 5.1 Identification of all HA Efforts – a First Step in Integration This Handbook describes how multiple HA efforts are conducted at each site, facility, and activity, based on different regulations, directives, and standards to protect workers, the public, the environment, and the facilities from a wide range of hazards. A critical good practice is to identify all of the ongoing HA efforts and clearly characterize them regarding the level of analysis, focus for protection, hazards analyzed, and applicable regulatory requirements. This may be done in context of the site or facility ISMS, which might, in some cases, contribute to the integration of hazard analyses. A simple presentation of the HA efforts could be provided in tabular format within the ISMS to promote integration efforts. Comparison of the HA efforts should provide the identification of overlapping efforts as well as identification of common information at the various site, facility, process, and activity-levels. Analysis of the HA efforts may identify activity-level hazards or controls that are not identified at the facility-level HA; conversely, analysis of the HA efforts may identify facility-level hazards or controls that are not identified at the activity-level HAs. This first step in integration may yield immediate positive benefits that warrant the effort. Clear identification and characterization are needed to ensure effective integration. Effective integration ensures HA efforts share resources, data, and results, where feasible, to ensure that HA efforts are complete, effective, and efficient. 5.2 Hazard Analysis Teams – Integration of Expertise Multi-disciplinary teams are needed to perform an effective HA. Teaming of safety, environmental, and line management disciplines is an effective way to help reduce uncertainties and redundancy of analysis activities. A team can be used to perform HA activities such as identifying hazards and validating facility assumptions, screening of hazards, implementing HA techniques, establishing controls, and preparing safety documents. The size and composition of the team will vary depending on the combination, magnitude, and type of hazards involved, the individual expertise of the team members, and the facility lifecycle phase and complexity. A team leader should be appointed to organize, plan and lead each team that is performing a facility HA. The team leader should have expertise in hazard and accident analysis. The team leader ensures that DOE and contractor facility/project managers, as well as individuals with knowledge about the scope of operations, facility systems, and layouts participate in HA activities. Although commonly the team leader and hazard analyst role are assigned to a single individual, the HA team leader and hazard analyst may be independent roles filled by DOE-HDBK-1163-2020 42 multiple individuals who have valuable knowledge about the scope of operations, as well as specific knowledge of facility systems and layouts.

An integrated HA effort engages a multidisciplinary team with varying tasks and responsibilities. The size of the team and the participants, including SMEs (e.g., industrial hygiene, occupational safety, fire protection, operations, maintenance, engineering, occupational medicine, and nuclear safety), should be commensurate with the complexity and hazards of the process defined within the scope of the HA development. The HA team leader is often the hazard analyst/facilitator. Generally, the scribe should have a technical background and not serve in a dual role as the analyst/facilitator or SME. The “Red Book” (Center for Chemical Process Safety’s Guidelines for Hazard Evaluation Procedures) describes three key roles: (1) facilitator, (2) team leader, and (3) dedicated scribe. OSHA's PSM Standard (29 C.F.R. Part 1910.119) identifies four types of expertise and knowledge needed on the team: (1) expertise in engineering, (2) expertise in process operations, (3) knowledge of the specific process and facility being evaluated, and (4) knowledge in the analysis methods being used. Team members of disciplines participating in the HA effort should begin communicating early in the process. Ideally, this should occur during the conceptual design for a new facility for modification, or at the initial stages of work planning for a work activity. This will permit ample scoping and identification of safety and technical disciplines needed to participate in preliminary HA activities. This early involvement will facilitate an integrated effort in which common hazard assumptions can be formulated as a collective group. Communication among team members should continue throughout the HA process to ensure that changes in work planning assumptions or new hazard discoveries are appropriately evaluated. The team should involve DOE and stakeholder counterparts where future review and approval of HA results are anticipated. This will help in preparing HA documents that meet stakeholder expectations and concerns. Multi-disciplinary teams provide the important benefits of exposure of the involved SMEs to different viewpoints, different regulatory requirements, different HA methods and techniques, and different HA references and resources. Involvement on multi-disciplinary HA teams builds knowledge and abilities, including the ability to integrate HA efforts. 5.3 Collection and Integration of Hazard Information The approach used to collect hazards information should include all hazard types to support a balanced evaluation of hazards and necessary controls. A comprehensive and shared set of hazard information is essential for accuracy and efficiency. HA efforts should work together to improve hazard information where necessary and make it readily available for use. Many opportunities exist for sharing and integrating HA information. Hazard Identification Activity-level HAs typically have a scope reflecting a given activity performed at the worker-level with potential impacts to the worker only. Facility-level HAs typically have a scope reflecting the DOE-HDBK-1163-2020 43 facility mission irrespective of specific activities performed to meet that mission. Process-level HAs are somewhere in between. However, both facility-level and activity-level HA efforts require the formal identification of hazards – traditionally using an HI checklist.

The HI checklists for facility-level HAs are used to identify the hazards for the facility. The hazards at a given facility are generally related to one or more activity-level HAs. An important lesson learned is to cross check and validate the facility-level HI (prior to screening) against the activity-level HAs in the facility. Validation of the HI may identify opportunities where hazards identified at the facility-level are not identified at an activity-level or hazards identified at the activity-level are not identified at the facility-level. A rigorous, yet simple crosscheck of information is likely to yield immediate positive benefits. Information about hazardous substances used in a process needs to be comprehensive enough for an accurate assessment of fire and explosion characteristics, reactivity hazards, criticality hazards, corrosion or other adverse effects on process equipment, and various safety and health hazards. Information should include the following, as appropriate: (1) toxicity information; (2) occupational exposure limits; (3) physical data such as boiling point, freezing point, liquid/vapor densities, vapor pressure, flash point, auto ignition temperature, flammability limits, solubility, appearance, and odor; (4) reactivity data, including potential for ignition or explosion; (5) corrosivity data, including effects on metals, building materials, and organic tissues; (6) identified incompatibilities and dangerous contaminants; (7) thermal data (heat of reaction, heat of combustion); and (8) quantities, locations and forms of both hazardous and radioactive materials. Where applicable, process chemistry information should also be included on potential runaway reactions, overpressure hazards, and hazards arising from the inadvertent mixing of incompatible chemicals (i.e., exothermic reactions). Sources of the data should be indicated. Facility and Process Information Where facility processing of radiological or hazardous chemicals is conducted, process information should be collected and include: (1) block flow diagrams; (2) process chemistry (including mixtures and intermediates); (3) established criteria for maximum inventory levels for process chemicals or radioactive materials; (4) process limits that, when exceeded, are considered an upset condition; and (5) qualitative estimates of the consequences of deviations that could occur if established process limits are exceeded. Facility and process equipment information should include: (1) materials of construction; (2) piping and instrumentation diagrams; (3) electrical classification; (4) design and design basis for relief systems; (5) ventilation system design; (6) design codes and standards; (7) material and energy balances for processes; (8) safety systems; (9) major energy sources; and (10) interfaces with other facilities. Hazard Scenarios Facility-level HAs typically use a “scenario based” hazard evaluation technique to evaluate identified hazards and to derive controls. Hundreds and potentially thousands of hazard scenarios can be generated during a typical facility-level HA effort. These hazard scenarios can include leaks/spills, sprays/aerosolization, fires, and explosions. An important lesson learned is to cross check and validate that the hazardous event scenarios at the facility-level have a corresponding activity-level HA. DOE-HDBK-1163-2020 44

Hazard Controls Both facility-level and activity-level HA efforts require the derivation of controls to ensure adequate protection from hazards. The HA efforts for facility-level HAs derive controls necessary to protect the worker, co-located worker, public, and, sometimes, the environment. Controls identified at a given facility should be subsequently derived in at least one (if not multiple) activity-level HA. Another lesson learned is to cross check and validate the facility-level HA controls against the activity-level HA controls in the facility. Validation of the controls may identify opportunities where controls identified at the facility-level are not identified as controls at activity-levels or vice versa. A rigorous, yet simple crosscheck of information can yield immediate positive benefits. Another lesson learned is to differentiate between the two types of ACs used in nuclear facility DSAs. DOE-STD-1186-2016 draws a clear distinction between SMPs and SACs, and states that only SACs and SSCs can be identified as credited safety controls. A SAC should be identified where an AC is credited to prevent or mitigate specific hazard or accident scenarios with significant consequences. An SMP should be identified where ACs will be used to provide general safety in a functional area. In one DSA, a lack of clarity existed regarding the relationship between a Prevent Movement of Vehicle Barriers control and the Traffic Control Program. Several scenarios in the HA credited the Traffic Control Program as a safety significant preventive control, but elsewhere in the DSA it was identified as an SMP. The DSA was modified to clearly credit the Prevent Movement of Vehicle Barriers control as a safety significant SAC. A lesson learned for existing nuclear facility DSAs is to identify credited controls, even if the SSC or the SAC has some deficiencies. Ideally, each credited control can fully meet its identified safety function, but, in practice, this is not always possible for some old facilities. DOE-STD- 3009-2014 states, "For existing facilities, an engineering evaluation shall be conducted to assess the performance capabilities of safety SSCs. The evaluation shall determine the adequacy of the safety SSCs and demonstrate that they meet or exceed performance criteria (i.e., operational responses and capabilities) for the SSCs to ensure designated functional requirements are met under postulated accident conditions such as elevated pressures and temperatures. If performance criteria are not met, the evaluation shall identify noted deficiencies and any compensatory measures necessary to ensure the safety function of the SSCs.” 5.4 Standardization of HA Tools and Techniques Another important practice that improves quality and cost effectiveness of HA activities is the standardization and appropriate use of HA tools and techniques used at a given facility or site. HA techniques vary in sophistication and cost of implementation, and users should ensure techniques are appropriately selected for the condition being analyzed. The “Red Book” (Center for Chemical Process Safety’s Guidelines for Hazard Evaluation Procedures) provides useful guidelines on selecting and grading HA techniques. A disciplined, structured approach to HAs is essential for producing results that will be useful for many years to come in protecting workers, the public, and the environment. Procedures and training should be developed and implemented to ensure HA techniques are consistently performed in a quality and documented manner. Personnel should be trained and qualified in use

DOE-HDBK-1163-2020 45 of HA techniques. Methods should be clearly documented to demonstrate the quality of HA results. Cross-disciplinary interactions during the development and use of procedures and training for structured HAs have proven to be highly valuable in promoting effective communication and cross-disciplinary learning and sharing. A site-level or facility-level Hazards Integration Team, made up of senior experts from various disciplines, can be useful in providing overarching direction for formalizing and standardizing HA efforts and the training and qualification for new personnel. Performing HAs is a discipline that improves with experience and mentoring by experienced experts. Senior team members can help add historical context including past decision points, identify routine problem areas, and provide mentorship to junior team members. Junior members can provide insight on new and developing technologies, help to identify new hazard scenarios, and ask questions about commonly accepted “norms.” 5.5 Facility Categorization – Effective Grouping of Facilities to Aid Integration and Grading The term “facilities” is meant to be inclusive, encompassing activities and projects as well as physical facilities. Support activities should be included as part of the facility to assure that associated hazardous activities are not overlooked. Most DOE sites have well-established facility designations, so that each major work location on a DOE site can be identified and characterized for the purposes of HA. If not, the facility and cognizant contractors, in cooperation with the responsible DOE Operations or Field Office, should identify the activities or groups of activities to be logically be grouped as a “facility” for the purpose of safety and health documentation development. The identified facilities would also provide a logical grouping for identifying applicable DOE requirements and standards. The HA regulatory drivers described in Section 4 allow for a wide range of documentation methods. Facility-level HA documents are useful for integrating multiple HA efforts related to a facility. Facility-level HA documents should be developed using a graded approach based on facility categorization. Complex and highly hazardous facilities require extensive and detailed documentations. Simple and low hazard facilities may need only a summary datasheet or summary database printout. Categorization of facilities is most helpful for facilitating a graded approach to the HA, determining the type, grading, and complexity of the HI and control documentation (and the corresponding review and approval process). Table 4 provides a sample facility category hierarchy that will allow for straightforward application of the graded approach to determine the level of facility-level HA documentation. DOE-HDBK-1163-2020 46 Table 4. Facility Categories for Graded Approach Application Facility Category Threshold HC-1, 2, and 3 Nuclear Facilities See DOE-STD-1027 Accelerator Facilities See DOE O 420.2A High Hazard Chemical Facilities Chemical facilities that exceed the PSM or RMP thresholds and other facilities designated as containing high hazard chemicals Below HC-3 Nuclear Facilities Nuclear facilities with nuclear hazards less than HC-3 per DOE-STD-1027 Chemical Facilities Remaining facilities that do not fit into one of the above categories but do contain significant chemical hazards (greater than 40 C.F.R. Part 302)

Industrial Facilities Remaining facilities that have industrial safety hazards and do not fit into one of the above categories In accordance with 10 C.F.R. Part 830, Subpart B, below HC-3 nuclear facilities are those with nuclear materials that are below the applicable DOE-STD-1027 thresholds for HC-3 nuclear facilities. For the purposes of applying the graded approach for hazard analysis integration and determining the need for facility-level HARs, the reportable quantities in 40 C.F.R. Part 302 are suitable for use as an effective lower threshold for below HC-3 nuclear facilities10. The levels in 40 C.F.R. Part 302 are based on the reportable quantities in pounds of material for hazardous substances and curies of material for radioactive substances. Reportable quantities are based on the release of materials into the environment. For combining multiple contributions, the methodologies described in 40 C.F.R. Part 302 should be applied. High hazard chemical facilities are those that meet RMP or PSM thresholds or could cause significant harm to the public (potentially exceeding PAC-2 levels). The thresholds in 29 C.F.R. Part 1910.119 are used to trigger PSM requirements; the thresholds of 40 C.F.R. 68 are used to trigger RMP requirements. Chemical facilities are those that present significant worker safety hazards from chemicals but do not exceed the threshold for high hazard chemical facilities. The remaining DOE facilities with industrial safety hazards are industrial facilities; these facilities do not present significant worker hazards from either nuclear or chemical hazards but can still cause significant harm to workers. Some facilities may have multiple facility categories that appear to apply. For example, DOE HC- 2 nuclear facilities could also have chemical and industrial hazards. Where more than one type of 10 10 C.F.R. Part 830, Subpart A applies to all facilities that involve radioactive material in such a form and quantity that a nuclear hazard potentially exists. 10 C.F.R. Part 830 does not establish a lower threshold for nuclear facilities below which Subpart A does not apply. DOE-HDBK-1163-2020 47 hazard category applies, the highest-level category to the facility should be applied, as this drives the most rigorous HA requirements. In some cases, a hybrid facility categorization might be necessary. 5.6 Graded Approach to Facility-Level HA Documentation and Integration A graded approach should be used in determining the level of hazard evaluation necessary for a particular facility. For example, facilities with large inventories of chemicals or facilities with inventories of radiological material approaching the HC-3 threshold levels (especially those with at least 50 percent of the HC-3 threshold) would be stronger candidates for a facility-level PrHA or SHA. In contrast, a facility with low inventories of hazardous material may be adequately analyzed in existing documents and may need only a summary datasheet or summary database printout. As discussed in Sections 4.2 and 4.3, there are several opportunities for integrating HA activities at the facility-level. In particular, activities related to the performance of PrHA and nuclear facility safety analysis serve as the primary baseline for establishing a “safety envelope” under which a facility can operate. These HA activities share much in common and present an opportunity for streamlining HA activities.

A complex and comprehensive facility HA document is not necessary or appropriate for every facility. At a minimum, a conscious determination should be made by line management that the safety envelope is complete by SMP implementation for each facility, and the ISM functions are positively addressed and tended to by the operating staff. The priorities placed on the development, maintenance, and implementation of safety and health HI and control need to be sufficient for providing both workers and the public the appropriate levels of protection. Where high hazard chemical facilities are also nuclear facilities, the facility-level HA (either a DSA or a HA report consistent with Table 3 of this Handbook) should serve as the primary facility-level HA. A documented facility-level HA should be developed for many below HC-3 nuclear facilities. These facilities or major modifications to them would have required a HAR to be developed to meet DOE O 413.3B requirements for new construction projects; these HARs should be maintained up to date and accurate for operating below HC-3 facilities. Operations at many of these facilities can still involve appreciable hazards that can harm facility workers or the environment. A documented facility-level HA for these situations provides systematic identification and analysis of hazards and helps ensure that an adequate set of protective measures are established to eliminate, control, or mitigate identified hazards. Section 4.3.3 and Table 3 provide contents for HA reports for below HC-3 nuclear facilities. A facility-level HAR may not be warranted for below HC-3 nuclear facilities that have low nuclear inventories (such as, less than fifty percent of DOE-STD-1027 values) or are in a surveillance and maintenance mode. Similarly, many lower-hazard DOE chemical and industrial facilities do not warrant a facility-level HAR. A facility-level HA document for these lower hazard facilities may be as simple as a hazard summary datasheet or a summary database printout. Figure G-1 of Appendix G provides the template for development of such a facility-level HA document. This DOE-HDBK-1163-2020 48 facility-level HA document, titled as a Facility Hazard Summary, records simple evidence of existing hazards identification and control in an ISMS framework. The Facility Hazard Summary is structured to consist of the five ISM functions: defining the scope of work, analyzing facility hazards, developing and implementing controls, performing work safely, and providing feedback. Implementation of ISM categorical criteria at a facility level is demonstrated by citing both site-level SMPs as well as the associated SMP-driven facility-specific documentation that meet ISM specifications. Pertinent excerpts from facility-level documents are also provided to illustrate relevancy to ISM functions. Examples of these document types are listed in Figure G-1. This method of validating that sufficient hazards and controls have been identified and implemented, respectively, for a given facility represents an appropriately graded HA approach for lower-hazard facilities. If a facility HA gap is identified in the process of developing a Facility Hazard Summary, additional HA documentation may be developed. In many cases, facility-level HA documents have been developed but have not always been consistently maintained.11 Maintaining these HA documents for at least below HC-3 nuclear and high hazard chemical facilities is beneficial and highly recommended. For lower-hazard chemical and industrial facilities, a graded approach should be used.

5.7 Knowledgeable Facility Managers – Essential Role in Facility Safety As described in Section 3.2, Facility Managers should be familiar with hazards and controls, HA documentation, and HA expertise. This awareness is necessary for them to manage ongoing operations and activities at the DOE facility. As a priority, on an annual basis, facility managers should be briefed on facility hazards, changes in hazards, control measures, and sources for further information and assistance. Knowledgeable facility managers will also be in a better position to support the maintenance of accurate HAs and effective integration across HA efforts. 5.8 Hazard Analyses Maintained Current and Updates Coordinated The HA effort is a dynamic process. New hazards can be introduced as a facility ages, as processes change, or as a project progresses, causing a need for revision of the facility's safety and health documents. When hazards are removed or inventories are reduced by cleanup, decontamination, and decommissioning activities, the hazard categorization or facility classification can be changed. Hazard baseline documents would be adjusted accordingly. For example, cleanup or decontamination of an HC-2 nuclear facility could lead to a reduction in facility hazard classification to a below HC-3 nuclear facility or industrial facility. 11 Past DOE requirements and guidance provided mixed messages regarding facility-level HA documentation for different categories of DOE facilities. For example, DOE-Environmental Management (EM)-STD-5502-94, Hazard Baseline Documentation, required development and maintenance of “Auditable Safety Analysis” for below HC-3 nuclear facilities. Other historical DOE Orders with HI and control requirements include DOE O 5481.1B, Safety Analysis and Review System, DOE O 5480.1A, Chg. 3, Environmental, Safety and Health Program for Department of Energy Operations, DOE O 5483.1A, Occupational Safety and Health Program for DOE Contractor Employees at Government-Owned, Contractor-Operated Facilities, DOE O 5480.10, Contractor Industrial Hygiene Program, and DOE O 5480.11, Radiation Protection for Occupational Workers. DOE-HDBK-1163-2020 49 Ongoing activity-level HA work can identify new information for integration into facility-level HA documents, and vice-versa. In an integrated process, HA efforts share resources, data, and results, where feasible, to ensure that efforts are complete, effective, and efficient. In particular, any new or updated hazard information and results should be shared with other ongoing HA efforts at a facility. The next section, Section 6, provides a more complete discussion of the importance of keeping HAs current and accurate through a formal change management process. DOE-HDBK-1163-2020 50 6.0 MAINTAINING THE HAZARD ANALYSIS To maintain the integrity of the HA and credited controls, a process to manage change is needed. Change management processes establish and implement written procedures to manage changes to process chemicals, technology, equipment, and procedures. Changes to facilities and procedures can affect hazard controls that are credited. Regardless of the purpose for the HA, the analyses should be treated as a “living document” and maintained to ensure they reflect the current facility work scope and hazards. This is important because operations, facility configuration, work activities, and hazardous material inventories often change over the facility lifetime. A successful HA incorporates the expertise of many SMEs and should be maintained to ensure the final product remains useful.

Many change management programs are controlled through formal change control processes and mechanisms based on the regulation from which the HA activity stems. HC-1, 2, and 3 nuclear facilities manage change, in part, by using the Unreviewed Safety Question process, outlined in 10 C.F.R. Part 830. Similarly, accelerator facilities manage change using the Unreviewed Safety Issue process, outlined in DOE O 420.2C. PSM and RMP facilities manage change using the Management of Change and Pre-Startup Safety Review processes, outlined in 29 C.F.R. Part 1910.119. One of the five ISM core functions is “feedback and improvement;” updating HA documents and controls as facility configuration and conditions change can be seen as “feedback and improvement.” Change management principles can also be found in DOE O 422.1, Chg. 3, Conduct of Operations, and DOE-STD-1073-2016, Configuration Management. A change management program for HAs should be established in a written procedure. In fact, a written procedure for controlling hazard identification and control would be identified as a quality assurance requirement for most DOE nuclear facilities to satisfy 10 C.F.R. Part 830, Nuclear Safety Management, Subpart A, Quality Assurance Requirements. Change management procedures should require considering the following factors prior to implementing any change: • The justification for the proposed change; • Applicable regulatory and contract requirements; • Technical basis; • Impact on safety, health, and the environment; • Resource needs; • Proposed schedule; and • Authorization requirements. If a change results in an alteration of the HA’s process safety information or baseline documentation, such information should be updated accordingly. Likewise, if a change is made in operating procedures or practices, the procedures or practices should be updated accordingly. Affected personnel should also be notified of the changes. Entry into a change management process should be controlled by individual contractor procedures. A formalized change management process can be initiated by: DOE-HDBK-1163-2020 51 (1) A proposed change in the radioactive material or hazardous material inventories or operational hazards, either permanent or temporary, that would exceed those currently analyzed or bounded by the HA; (2) Any change in control configuration with a potential to increase consequence, likelihood, or overall risk, or reduce the reliability or effectiveness of design features, controls, procedures, or processes used to prevent or mitigate hazards; (3) Previous analyses discovered to be inadequate (e.g., the analysis does not match the facility configuration due to a “discrepant as found” condition; or (4) Modifications to equipment or controls that alter the scope, initial conditions, or assumptions of the HA. To disposition a change management determination, the facility has three options: (a) do not make the change, (b) revise the change to fall within the established HA parameters, or (c) revise the HA documentation. DOE-HDBK-1163-2020 52 7.0 REFERENCES STATUTES 15 U.S.C. Chapter 53, Toxic Substances Control 29 U.S.C. Part 654, Duties of Employers and Employees 42 U.S.C. Chapter 55, National Environmental Policy 42 U.S.C. Parts 4321-4347, National Environmental Policy Act 42 U.S.C. Part 7403, Research, Investigation, Training, and Other Activities CODE OF FEDERAL REGULATIONS

10 C.F.R. Part 830, Nuclear Safety Management, Subpart A, Quality Assurance Requirements, and Subpart B, Safety Basis Requirements 10 C.F.R. Part 835, Occupational Radiation Protection 10 C.F.R. Part 850, Chronic Beryllium Disease Prevention Program 10 C.F.R. Part 851, Worker Safety and Health Program 10 C.F.R. Part 1021, National Environmental Policy Act Implementing Procedures 29 C.F.R. Part 1910, Occupational Safety and Health Standards 29 C.F.R. Part 1926, Safety and Health Regulations for Construction 40 C.F.R. Part 61, National Emission Standards for Hazardous Air Pollutants 40 C.F.R. Part 68, Chemical Accident Prevention Provisions 40 C.F.R. Parts 239 – 259, Non-Hazardous Waste 40 C.F.R. Parts 260 – 273, Hazardous Waste Management 40 C.F.R. Part 261, Identification and Listing of Hazardous Waste 40 C.F.R. Part 262, Standards Applicable to Generators of Hazardous Waste 40 C.F.R. Part 265, Interim Status Standards for Owners and Operators of Hazardous Waste Treatment, Storage, and Disposal Facilities 40 C.F.R. Parts 279 – 282, Other Resource Conservation and Recovery Act (RCRA) Regulations 40 C.F.R. Part 302, Designation, Reportable Quantities, and Notification 40 C.F.R. Part 355, Emergency Planning and Notification 40 C.F.R. Part 372, Toxic Chemical Release Reporting: Community Right-To-Know 40 C.F.R. Parts 1500–1508, Regulations for Implementing the Procedural Provisions of the National Environmental Policy Act 40 C.F.R. Part 1502, Environmental Impact Statement DOE-HDBK-1163-2020 53 48 C.F.R. Section 970.5223-1, Integration of Environment, Safety, and Health into Work Planning and Execution 49 C.F.R. Part 172, Hazardous Materials Table, Special Provisions, Hazardous Materials Communications, Emergency Response Information, Training Requirements, and Security Plans 49 C.F.R. Part 173, Shippers – General Requirements for Shipments and Packagings 49 C.F.R. Part 178, Specifications for Packagings CONSENSUS STANDARDS AND GUIDES ANSI/ANS-8.1-2014 (R2018), Nuclear Criticality Safety in Operations with Fissionable Materials Outside Reactors ANSI/ANS-8.15-2014 (R2019), Nuclear Criticality Control of Selected Actinide Nuclides ANSI/ASSE Z117.1-2009, Safety Requirements for Confined Spaces ANSI Z136.1-2014, Safe Use of Lasers American Industrial Hygiene Association, AIHA ERP Committee Procedures and Responsibilities, 2006, AIHA, Revised, 2006 American Industrial Hygiene Association, A Strategy for Assessing and Managing Occupational Exposures, AIHA, Fourth Edition, 2015 Center for Chemical Process Safety’s Guidelines for Hazard Evaluation Procedures (the “Red Book”), Third Edition, Wiley/American Institute of Chemical Engineers, 2008 DEPARTMENT OF ENERGY ACQUISITION REGULATIONS DEAR 970.5204-2, Laws, Regulations, and DOE Directives DEAR 970.5223-1, Integration of Environment, Safety, and Health into Work Planning and Execution DOE POLICIES DOE P 450.4A, Chg.1, Integrated Safety Management Policy DOE P 451.1, National Environmental Policy Act Compliance Program DOE ORDERS DOE O 151.1D, Chg. 1, Comprehensive Emergency Management System DOE O 226.1B, Implementation of Department of Energy Oversight Policy DOE O 252.1A, Admin. Chg. 1, Technical Standards Program DOE O 413.3B, Chg. 5, Program and Project Management for the Acquisition of Capital Assets DOE O 420.1C, Chg. 3, Facility Safety DOE O 420.2C, Safety of Accelerator Facilities DOE-HDBK-1163-2020 54 DOE O 422.1, Chg. 3, Conduct of Operations

DOE O 440.1B, Chg. 2, Worker Protection Program for DOE (Including the National Nuclear Security Administration) Federal Employees DOE O 450.2, Chg. 1, Integrated Safety Management DOE O 456.1A, The Safe Handling of Unbound Engineered Nanoparticles DOE O 458.1 Chg. 3, Radiation Protection of the Public and the Environment DOE O 460.1D, Hazardous Materials Packaging and Transportation Safety DOE O 460.2A, Departmental Materials Transportation and Packaging Management DOE O 461.2, Onsite Packaging and Transfer of Materials of National Security Interest DOE O 470.3C, Design Basis Threat (DBT) Order DOE O 5480.10, Contractor Industrial Hygiene Program (Archived) DOE O 5480.11, Radiation Protection for Occupational Workers (Archived) DOE O 5480.1A, Chg. 3, Environmental, Safety and Health Program for Department of Energy Operations (Archived) DOE O 5480.23, Chg.1, Nuclear Safety Analysis Reports (Archived) DOE O 5481.1B, Safety Analysis and Review System (Archived) DOE O 5483.1A, Occupational Safety and Health Program for DOE Contractor Employees at Government-Owned (Archived) DOE GUIDES DOE G 151.1-1A, Emergency Management Fundamentals and the Operational Emergency Base Program DOE G 151.1-2, Technical Planning Basis, Emergency Management Guide DOE G 420.1-1A, Nonreactor Nuclear Safety Design Guide for Use with DOE O 420.1C, Facility Safety DOE G 420.2-1A, Accelerator Facility Safety Implementation Guide for DOE O 420.2C, Safety of Accelerator Facilities DOE G 421.1-2A, Implementation Guide for Use in Developing Documented Safety Analyses to Meet Subpart B of 10 C.F.R. Part 830 DOE G 440.1-1B, Chg. 1, Worker Safety and Health Program for DOE (Including the National Nuclear Security Administration) Federal and Contractor Employees DOE G 440.1-7A, Implementation Guide for use with 10 C.F.R. Part 850, Chronic Beryllium Disease Prevention Program DOE G 450.4-1C, Integrated Safety Management System Guide DOE-HDBK-1163-2020 55 DOE STANDARDS DOE-EM-STD-5502-94, Hazard Baseline Documentation (Archived) DOE-STD-1020-2016, Natural Phenomena Hazard Analysis and Design Criteria for Department of Energy Facilities DOE-STD-1027-92, Chg. 1, Hazard Categorization and Accident Analysis Techniques for Compliance with DOE Order. 5480.23, Nuclear Safety Analysis Reports DOE-STD-1027-2018, Chg. 1, Hazard Categorization of DOE Nuclear Facilities DOE-STD-1066-2016, Fire Protection DOE-STD-1073-2016, Configuration Management DOE-STD-1104-2016, Review and Approval of Nuclear Facility Safety Basis and Safety Design Basis Documents DOE-STD-1186-2016, Specific Administrative Controls DOE-STD-1189-2016, Integration of Safety into the Design Process DOE-STD-1212-2019, Explosives Safety DOE-STD-1228-2019, Preparation of Documented Safety Analysis for Hazard Category 3 DOE Nuclear Facilities DOE-STD-3007-2017, Preparing Criticality Safety Evaluations at Department of Energy DOE-STD-3009-94, Chg. 3, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Safety Analysis Reports DOE-STD-3009-2014, Preparation of Nonreactor Nuclear Facility Documented Safety Analysis DOE-STD-5503-94, EM Health and Safety Plan Guidelines DOE HANDBOOKS DOE-HDBK-1046-2016, Temporary Emergency Exposure Limits: Methods and Practice DOE-HDBK-1100-2004, Chemical Process Hazards Analysis DOE-HDBK-1101-2004, Process Safety Management for Highly Hazardous Chemicals DOE-HDBK-1139/1-2006, Chemical Management, (Volume 1 of 3)

DOE-HDBK 1139/2-2006, Chemical Management, (Volume 2 of 3) Chemical Safety and Lifecycle Management DOE-HDBK 1139/3-2018, Chemical Management (Volume 3 of 3) Consolidated Chemical User Safety and Health Requirements DOE-HDBK-1211-2014, Activity-Level Work Planning and Control Implementation DOE-HDBK-1224-2018, Hazard and Accident Analysis Handbook DOE-HDBK-1163-2020 56 OTHER DOE IMPLEMENTATION GUIDANCE DOE/ESH, Recommendations for the Preparation of Environmental Assessments and Environmental Impact Statements, Second Edition, DOE Office of NEPA Policy and Compliance, December, 2004. DOE Memorandum to Distribution, Dae Chung to EM Field Office Managers, Implementation Guidance on Chemical Safety Management, March 15, 2019. CENTERS FOR DISEASE CONTROL AND PREVENTION HHS Publication No. (CDC) 21-1112, 5th Edition, Biosafety in Microbiological and Biomedical Laboratories ENVIRONMENTAL PROTECTION AGENCY Environmental Protection Agency, Standing Operating Procedures for Developing Acute Exposure Guideline Levels (AEGLs) for Hazardous Chemicals, National Research Council, 2001 Environmental Protection Agency, Technical Background Document to Support Final Rulemaking Pursuant to Section 102 of the Comprehensive, Environmental Response, Compensation, and Liability Act: Radionuclides, 1989 NATIONAL FIRE PROTECTION ASSOCIATION NFPA 204, Standard for Smoke and Heat Venting, 2018 NFPA 350, Guide for Safe Confined Space Entry and Work, 2019 NFPA 704, Standard System for the Identification of the Hazards of Materials for Emergency Response, 2017 NFPA 801, Fire Protection for Facilities Handling Radioactive Materials, 2017 DOE-HDBK-1163-2020 A-1 APPENDIX A: HAZARD IDENTIFICATION CHECKLIST AND SCREENING CRITERIA Figure A-1. Example Standard Industrial Hazard Screening Criteria Hazard Screening Criteria Reference12 Airborne Objects/Fragments • Any impact beyond 100m of facility boundary • DOE-STD-1212-2019, Explosives Safety • Defense Explosive Safety Regulation (DESR) 6055.09 (if applicable) Biological • > Risk Group 2 • HHS Publication No. CDC 21-1112, 5th Edition, Biosafety in Microbiological and Biomedical Laboratories Chemicals • Asbestos • Asphyxiants • Beryllium • Corrosives • Cryogenics • Combustibles • Flammables • Lead • Materials of Trade • Metal Powder • Nanomaterials • Oxidizers • Peroxide/Peroxidizable • Pyrophoric • Toxics/Highly Toxic General • Common Household Chemicals/Materials of Trade • > Lab-scale Quantities: o Solid: 40-lbs o Liquid: 5-gal o Gas: 10-lbs • Any Friable Asbestos • Any Beryllium • Any Lead • Any Unbound Nanoparticles • > 10-grams Metal Powder • Asphyxiant: 150-scf Quantity Per Control Area • Corrosives: o Solid: 5,000-lb o Liquid: 500-lb o Gas: 810-scf • Cryogens: 45-gal (liquid) • Combustibles (liquid): o II: 120-gal o III A: 330-gal o III B: 13,200-gal • Flammables: o Gas: 1,000-scf o Liquid (I ABC): 120-gal o Solid: 125-lbs • DOE-STD-3009-2014, Preparation of Nonreactor Nuclear Facility Documented Safety Analysis • DOE-STD-3009-94 Chg. 3, Preparation of Nonreactor Nuclear Facility Documented Safety Analysis • NFPA, NFPA 704, Standard System for the Identification of the Hazards of Materials for Emergency Response • 2003 International Fire Code13 • 2005-149, National Institute for Occupational Safety and Health (NIOSH), NIOSH Pocket Guide • American Conference of Governmental Industrial Hygienists, Threshold Limit Values (TLVs) & Biological Exposure Indices Guide

• National Oceanic and Atmospheric Administration, Emergency Response Planning Guidelines • 29 C.F.R. Part 1910.119, Process Safety Management of Highly Hazardous Chemicals • 29 C.F.R. Part 1910.1001, Asbestos • 29 C.F.R. Part 1910.1024, Beryllium • 29 C.F.R. Part 1910.1025, Lead 12 Reference list is not intended to act as an all-inclusive list for every facility. Facilities are encouraged to add/adapt references as applicable to reflect unique and newly emerging hazards/technologies while complying with current guidance/regulations. 13 Maximum Allowable Quantity per Control Area determined by 2003 IFC Table 2703.1.1(1) & 2703.1.1(2); assuming chemical is in storage; Maximum Allowable Quantity may be further increased/decreased based on associated footnotes, use, and elevation as applicable per Fire Protection Safety Management Program/Authority Having Jurisdiction. DOE-HDBK-1163-2020 A-2 Hazard Screening Criteria Reference12 • Oxidizers (solid/liquid): o Class 4: 1lb o Class 3: 10-lbs o Class 2: 250-lbs o Class 1: 4,000-lbs • Peroxides (solid/liquid): o Class I: 5-lbs o Class II: 50-lbs o Class III: 125-lbs o Class IV/V: Not Limited • Pyrophoric: o Solid/Liquid: 4-lbs o Gas: 50-scf • Toxics: o Solid: 500-lbs o Liquid: 500-gal o Gas: 810-scf • Highly Toxics: o Solid: 10-lbs o Liquid: 10-gal o Gas: 20-scf Chemical Reactions/Incompatibility • > 10-lb of a substance with an NFPA reactivity hazard level > 2 • Exothermic Reactions • Toxic Off-Gassing • National Oceanic and Atmospheric Administration Chemical Reactivity Worksheet • EPA Chemical Compatibility Matrix Combustible Materials (non-chemical) • Materials in excess of NFPA 801 requirements • NFPA 801, Fire Protection for Facilities Handling Radioactive Materials. 2003 Edition. Confined Space • Permit-Required Confined Space • ANSI/ASSE Z117.1 - 2009, Safety Requirements for Confined Spaces • NFPA 350, Guide for Safe Confined Space Entry and Work • 29 C.F.R. Part 1910.146, Permit- Required Confined Space Electrical • Unusual application not adequately controlled by OSHA • Potential initiating event • NFPA 70E, Standard for Electrical Safety in the Workplace, 2015 Edition (incorporated by reference in 10 C.F.R. 851) Explosives • Any 49 C.F.R. Part 173 Division 1.1, 1.2, or 1.3; or > 10 oz of Division 1.4 • > 0.25 psi impact beyond 100m of facility boundary • 49 C.F.R. Part 173, Shippers – General Requirements for Shipments and Packagings • DOE-STD-1212-2019, Explosives Safety • Defense Explosive Safety Regulation (DESR) 6055.09 (if applicable) • 29 C.F.R. Part 1910.95, Occupational Noise Exposure https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-and-standards/detail?code=801 http://www.bollettinoadapt.it/old/files/document/15073american_nationa.pdf https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-and-standards/detail?code=350 DOE-HDBK-1163-2020 A-3 Hazard Screening Criteria Reference12 Hot Work/Open Flame • Welding, cutting, and/or brazing in the presence of any other hazard • 29 C.F.R. Part 1910.252, Welding, Cutting, and Brazing Internal Flooding • Potential initiating event • N/A Lasers • Any Class IV, any Class IIIB with non-enclosed beam • ANSI Z136.1, Section 7, 2014 “ANSI Standard for the Safe Use of Lasers” Mechanical • Noncommercial Mechanical Equipment • 2003 International Mechanical Code • 29 C.F.R. Part 1910, Subpart O,

Machinery and Machine Guarding Noise • > 85 dBA • 29 C.F.R. Part 1910.95, Occupational Noise Exposure (incorporated by reference in 10 C.F.R. 851) • American Conference of Governmental Industrial Hygienists, Threshold Limit Values & Biological Exposure Indices Guide Noncommercial • Any noncommercial equipment • N/A Outside Manufacturers Recommendations • Any equipment used outside of manufacturers recommendations • N/A Physical Impact • Kinetic Energy • Potential Energy • Overhead Cranes • Rollup Doors • High energy (e.g., flywheel or centrifuge-type equipment) • Impact resulting in dispersion or release of any other hazard • 29 C.F.R. Part 1910, Subpart O, Machinery and Machine Guarding • 29 C.F.R. Part 1910.147, Control of Hazardous Energy • 29 C.F.R. Part 1910.179, Overhead and Gantry Cranes Pressure • 3,000 psig or 0.1 lb TNT (1.4 x 105 ft-lb) equivalent energy • Pressure release resulting in dispersion or release of any other hazard • 29 C.F.R. Part 1910, Subpart M, Compressed Gas and Compressed Air Equipment • 29 C.F.R. Part 1910.101, Compressed Gases • 29 C.F.R. Part 1910.169, Compressed Gas and Compressed Air Equipment • ANSI/ B 31.1, Power Piping • ASME, Pressure Piping Ionizing Radiation/Radiological Materials • Fissile/Fissionable Material • Ionizing Radiation • Surface Contamination • Any radioisotope meeting or exceeding the Table A1, DOE- STD-1027-92, Threshold Quantity (TQ) criteria; • Exceeding the Appendix B, 40 C.F.R. Part 302 Reportable Quantity (RQ) criteria. The inventory/RQ or Inventory/TQ ratios should be added when making this evaluation. • >0.002µCi per gram of waste • Fissile/Fissionable Material: • ANSI/ANS-8.1-2014, Nuclear Criticality Safety in Operations with Fissionable Materials Outside Reactors • ANSI/ANS-8.15-2014, Nuclear Criticality Control of Selected Actinide Nuclides • 10 C.F.R. Part 830, Nuclear Safety Management • 10 C.F.R. Part 835, Occupational Radiation Protection DOE-HDBK-1163-2020 A-4 Hazard Screening Criteria Reference12 o > ANSI/ANS-8.1-2014 o > ANSI/ANS-8.15-2014 • Ionizing Radiation o Posted Radiological Area • Surface contamination measurements of fixed, removable, or both exceed values in 10 C.F.R. Part 835 • American Conference of Governmental Industrial Hygienists, Threshold Limit Values & Biological Exposure Indices • DOE-STD-1027-92, Chg. 1, Hazard Categorization for Accident Analysis Techniques for Compliance with DOE Order 5480.23, Nuclear Safety Analysis Reports (or approved alternative) • 40 C.F.R. Part 302, Designation, Reportable Quantities, and Notification Radiation Producing Machines, Ionizing and Nonionizing • Electromagnetic Fields • Radiation Generating Device • Optical Radiation • Electromagnetic Fields:14 o Static Magnetic Fields: >2T o Sub-Radiofrequency Magnetic Fields: >30 kHz o Radiofrequency/Microwave: 16.3 MHz • Radiation Generating Device: Non-Exempt Accelerators • Optical Radiation:15 o Light and Near-Infrared:  Blue Light viewing durations >167-min (~2.8-hrs)  Infrared viewing durations >17-min  Near-Infrared viewing durations >810-seconds  Visible viewing durations >0.25-seconds o Ultraviolet: >0.003 J/cm3 • Lasers: Class IIIB and IV; and any > Class 1 Laser viewed through an optical device • 10 C.F.R. Part 835, Occupational Radiation Protection • American Conference of Governmental Industrial Hygienists, TLV & Biological Exposure Indices Guide • DOE O 420.2C, Safety of Accelerator Facilities

• 40 C.F.R. Part 302, Designation, Reportable Quantities, and Notification • ANSI/ANS Z136.1-2014, Safe Use of Lasers Thermal (not fire) • Temperatures > 75% Flashpoint • High Metabolic Workload (> 500 kcal/hr) at Ambient Temperatures > 70oF • NFPA 204, Standard for Smoke and Heat Venting • Applicable Safety Data Sheets • American Conference of Governmental Industrial Hygienists, Threshold Limit Values & Biological Exposure Indices Guide 14 Electromagnetic Field TLVs are dependent on frequency; frequency-dependent screening criteria can be found in Table 1 of the Electromagnetic Radiation and Fields section of the American Conference of Governmental Industrial Hygienists, Threshold Limit Value & Biological Exposure Indices. 15 Optical Radiation TLVs should be used as guides and should not be regarded as fine lines between safe and dangerous levels; additional guidance on determining the effective radiance of a light sources with respect to health effects and spectral regions can be found in the American Conference of Governmental Industrial Hygienists, Threshold Limit Value & Biological Exposure Indices. DOE-HDBK-1163-2020 A-5 Hazard Screening Criteria Reference12 Unmanned Aerial Vehicles • > 55-lbs • Part 107 Federal Aviation Administration Regulations, Small Unmanned Aircraft Systems Vehicles • Special and/or non-standard Department of Transportation activities • Motor Vehicle Safety Guidance (OSHA) Motor Vehicle Safety at Work (NIOSH) • DOE O460.1D, Hazardous Materials Packaging and Transportation Safety • 49 C.F.R. 301, Motor Vehicle Safety Waste • Non-Hazardous • Hazardous • Radioactive/Mixed Waste • Other (i.e., used oil and underground storage tanks) • >55-gal single container Non- Hazardous Waste • Any Hazardous Waste • Any Radioactive/Mixed Waste • Any Other Waste Item • 40 C.F.R. Part 239 – 259, Non- Hazardous Waste • 40 C.F.R. Part 260 – 273, Hazardous Waste40 C.F.R. Part 266, Storage, Treatment, Transportation, and Disposal of Mixed Waste • 40 C.F.R. Part 279 – 282, Other Resource Conservation and Recovery Act (RCRA) Regulations DOE-HDBK-1163-2020 A-6 Figure A-2. Example Hazard Identification Checklist Hazard Identification Checklist Node Name: Node # Node Description: Performer: Hazard Present16 SIH17 Initiating Event18 Carry Forward19 Airborne Objects/Fragments ☐ ☐ ☐ ☐ Biological ☐ ☐ ☐ ☐ Chemicals Asbestos ☐ ☐ ☐ ☐ Asphyxiants ☐ ☐ ☐ ☐ Beryllium ☐ ☐ ☐ ☐ Corrosives ☐ ☐ ☐ ☐ Cryogenic ☐ ☐ ☐ ☐ Combustibles ☐ ☐ ☐ ☐ Flammables ☐ ☐ ☐ ☐ Lead ☐ ☐ ☐ ☐ Materials of Trade ☐ ☐ ☐ ☐ Metal Powder ☐ ☐ ☐ ☐ Nanomaterials ☐ ☐ ☐ ☐ Oxidizers ☐ ☐ ☐ ☐ Peroxide/Peroxidizable ☐ ☐ ☐ ☐ Pyrophoric ☐ ☐ ☐ ☐ Toxics/Highly Toxic ☐ ☐ ☐ ☐ Chemical Reactions/Incompatibility ☐ ☐ ☐ ☐ Combustible Materials ☐ ☐ ☐ ☐ Confined Space ☐ ☐ ☐ ☐ Electrical ☐ ☐ ☐ ☐ Explosives ☐ ☐ ☐ ☐ External [Non-facility] Events ☐ ☐ ☐ ☐ Hot Work/Open Flame ☐ ☐ ☐ ☐ 16 Present – determine if hazard is present within given node 17 SIH – see SIH list 18 Initiating Event – determine if hazard is potential initiating event for another hazard 19 Carry Forward – not screened from HI; if not SIH, or if SIH but initiating event, then carries forward for further evaluation. DOE-HDBK-1163-2020 A-7 Hazard Present16 SIH17 Initiating Event18 Carry Forward19 Internal Flooding (Process/Water) ☐ ☐ ☐ ☐ Lasers ☐ ☐ ☐ ☐ Mechanical ☐ ☐ ☐ ☐ Natural Phenomenon Hazards ☐ ☐ ☐ ☐ Noise ☐ ☐ ☐ ☐ Noncommercial ☐ ☐ ☐ ☐ Outside Manufacturers Specifications ☐ ☐ ☐ ☐ Physical Impact/Kinetic Energy ☐ ☐ ☐ ☐ Pressure ☐ ☐ ☐ ☐ Radiation, Ionizing -- -- -- --

Fissile/Fissionable Material ☐ ☐ ☐ ☐ Ionizing Radiation ☐ ☐ ☐ ☐ Surface Contamination ☐ ☐ ☐ ☐ Radiation Producing Machines, Ionizing, and Non- Ionizing -- -- -- -- Electromagnetic Fields ☐ ☐ ☐ ☐ Radiation Generating Devices ☐ ☐ ☐ ☐ Optical Radiation ☐ ☐ ☐ ☐ Thermal ☐ ☐ ☐ ☐ Unmanned Aerial Vehicles ☐ ☐ ☐ ☐ Vehicles ☐ ☐ ☐ ☐ Waste -- -- -- -- Non-Hazardous ☐ ☐ ☐ ☐ Hazardous ☐ ☐ ☐ ☐ Radioactive/Mixed ☐ ☐ ☐ ☐ Other (i.e., used oil, underground storage tanks) ☐ ☐ ☐ ☐ Other Hazards: ☐ ☐ ☐ ☐ Notes: DOE-HDBK-1163-2020 B-1 APPENDIX B: HAZARD EVALUATION TECHNIQUES The following is a summary of hazard evaluation techniques and methods, as outlined within the “Red Book” (Center for Chemical Process Safety’s Guidelines for Hazard Evaluation Procedures). Table B-1 provides a comparison of these techniques. Table B-1: Hazard Evaluation Technique Comparison Technique Type System Life Cycle20 Difficulty Duration Results Relative Ranking Non-Scenario Limited Simple Short General Checklist Non-Scenario Broad Simple Short General What-If Scenario Full Intermediate Average Comprehensive What-If/Checklist Scenario Full Intermediate Average Comprehensive Failure Modes and Effects Analysis Scenario Specialized - Equipment Complex Long Detailed Hazard and Operability Study (HAZOP) Scenario Specialized - Process Complex Long Detailed Fault Tree Analysis Scenario Specialized- Time Complex Long Detailed Event Tree Analysis Scenario Specialized- Time Complex Long Detailed Relative Ranking. Relative Ranking is a non-scenario-based technique with limited application throughout the system lifecycle. Application of this technique is relatively simple, with a short duration yielding general results. This technique is more of an analysis strategy than a HE technique. This strategy allows hazard analysts to compare the attributes of several processes or activities to determine whether they possess hazardous characteristics significant enough to warrant further study. Relative Ranking can be used to compare different process layouts, generic design, or equipment layout options, and provides criteria for deciding best alternative options. These Relative Ranking comparisons are based on numerical values representing the relative level of significance the analyst assigns to each hazard, potential consequence, or risk depending on the approach used. Relative Ranking studies are normally preformed in the early stages of a process, before a detailed design is completed, or early in the development/update of an existing HA program. The Relative Ranking technique can also be applied to an existing process to pinpoint the hazards of different aspects of process operation. Checklist Analysis. The Checklist Analysis is a non-scenario-based technique with broad application throughout the system lifecycle. Application of this technique is relatively simple, with a short duration yielding general results. This technique uses a written list of items or procedural steps to verify the status of a system. Traditional checklists vary widely in level of detail and are frequently used to indicate compliance with standards and practices. In some cases, analysts use more general checklists in combination with another HE technique to discover common hazards that the checklist alone might miss. 20 Figure 6.1 Typical Uses for Hazard Evaluation Techniques, CCPS Guidelines Hazard Evaluation Techniques DOE-HDBK-1163-2020 B-2

What-If Analysis. The What-If Analysis is a scenario-based technique with full application throughout the system lifecycle. Application difficulty of this technique is intermediate, with an average duration yielding comprehensive results. This technique is a brainstorming approach in which a group of experienced people familiar with the subject process ask questions or voice concerns about possible undesired events. The purpose of a What-If Analysis is to identify hazards, hazardous situations, or specific event sequences that could lead to or produce undesirable consequences. What-If/Checklist Analysis. What-If/Checklist Analysis is a scenario-based technique with full application throughout the system lifecycle. Application difficulty of this technique is intermediate, with an average duration yielding comprehensive results. The What-If/Checklist Analysis technique combines the creative brainstorming features of the What-If Analysis technique with the systematic features of the Checklist Analysis technique. The purpose of a What- If/Checklist Analysis is to identify hazards, consider event sequences that could lead to or produce undesirable consequences, and determine whether the safeguards/controls against these potential hazard scenarios appear adequate. It is helpful to use the HI checklist as one of the layers in the What-If/Checklist Analysis technique. Additional checklists, such as receptors, hazard types, and locations can also be used in conjunction with the What-If/Checklist Analysis technique. Failure Modes and Effects Analysis. This technique is a specialized equipment-focused application that can be used throughout the system lifecycle. Difficulty in the application of this technique is complex, with a long duration yielding detailed results. This technique tabulates modes of equipment and their effects on a system or plant. This analysis uses guide words to identify single equipment and system failure modes and each failure mode’s potential effects on the system or plant. The analysis often generates recommendations for increasing equipment reliability, thus improving process safety. Hazard and Operability Study. The HAZOP study is a scenario-based technique with specialized process-focused application throughout the system lifecycle. Difficulty in the application of this technique is complex, with a long duration yielding detailed results. The HAZOP study was developed to identify and evaluate safety hazards in a process plant and to identify operability problems which although not hazardous, could compromise the plant’s ability to achieve optimal design productivity. HAZOP studies use guide words to carefully review a process or operation in a systematic fashion to determine whether deviations from the design or operational intent can lead to undesirable consequences. The HAZOP study team lists potential causes and consequences of the deviation and existing safeguards/controls for protecting against the deviation. This technique can also be an effective tool in developing operating procedures and evaluating human interactions with components in a process. Fault Tree Analysis. This technique is scenario-based with specialized time-focused application throughout the system lifecycle. Difficulty in the application of this technique is complex, with a long duration yielding detailed results. The Fault Tree Analysis is a deductive technique that focuses on one incident or main system failure and provides a method for determining causes of that event. The purpose of a Fault Tree Analysis is to identify combinations of equipment failures and human errors that can result in an accident. The Fault Tree Analysis is well suited for highly

DOE-HDBK-1163-2020 B-3 redundant systems and is often employed in situations where another HE technique has pinpointed an important incident of interest that requires more detailed analysis. The output of a Fault Tree Analysis is a graphical model using logic and event symbols that illustrates combinations of failures that will cause one specific failure of interest. Event Tree Analysis. This technique is scenario-based with specialized time-focused application throughout the system lifecycle. Difficulty in the application of this technique is complex, with a long duration yielding detailed results. An Event Tree Analysis graphically shows the possible outcomes following the success or failure of protective systems, given the occurrence of a specific initiating cause (equipment failure or human error). This technique can be used to study other events, such as starting at a loss event and evaluating mitigation systems. It can be used to identify the incidents that can occur in a complex process. After these individual event sequences are identified, specific combinations of failures that can lead to the incidents can then be determined using a Fault Tree Analysis. See also DOE-HDBK-1224-2018, Hazard and Accident Analysis Handbook, for additional guidance and lessons learned on hazard evaluation techniques for DOE nuclear facilities. DOE-HDBK-1163-2020 C-1 APPENDIX C: RISK ASSESSMENT METHODOLOGY The following is a description of risk assessment methodology for use in selecting hazard controls. The first step in risk assessment methodology is to identify the receptors that are considered within the scope of the HA (i.e., workers, the public, the facility, and the environment). Once receptors have been defined consequences are defined for each of the given receptors. A robust consequence matrix will include a severity parameter for each receptor to be analyzed. An example of a qualitative consequence matrix is provided as Figure C-1 below. The second step is to define the likelihood of the adverse event. Likelihood can be defined quantitatively, semi-quantitatively or qualitatively. A qualitative likelihood matrix uses words to describe the likelihood of events while a semi-quantitative likelihood relies on modeled or simulated values. Both qualitative and semi-quantitative likelihood matrices are used to develop estimates of the potential likelihood of occurrence for specific events/scenarios as they are considered over the life of the facility, process, or activity. An example of a qualitative likelihood matrix is provided as Figure C-2 below. When making unmitigated consequence and unmitigated likelihood assignments, consistency needs to be maintained using rules and guidance. Together with the unmitigated consequence, the unmitigated likelihood is used to assign an unmitigated risk using the Risk Matrix. An example of a qualitative risk matrix is provided as Figure C-3 below. When using this risk matrix, a risk value of III represents a reasonable assurance of adequate protection. Likelihood and consequence combine to yield a risk ranking defined by bin numbers (for example, I-IV). For those events with an unmitigated risk value of I or II, controls are assigned following the hierarchy of controls to either reduce the likelihood binning or the consequence binning to an acceptable level of risk (i.e., III or IV). The reduction in either likelihood or consequence level is referred to as a “bin drop.” Both unmitigated and mitigated events are ranked and evaluated using the same Risk Matrix.

To use the Risk Matrix, the unmitigated likelihood for a given event is selected together with the unmitigated consequence for each receptor to derive the corresponding unmitigated risk value (for example, I, II, III, or IV). If the risk value is acceptable (i.e., III or IV), the event is not analyzed further. If the risk value is unacceptable (i.e., I or II), the event is analyzed further. Application of the Risk Assessment assumes a single control is credited for a single “bin drop” in either likelihood (frequency) or consequence (severity); not both. The mitigated likelihood for the given event is selected together with the mitigated consequence to derive the corresponding mitigated risk value. Controls are credited until the mitigated risk value is acceptable for each receptor. The unmitigated likelihood for a given event/scenario is the same for each receptor, although the consequences differ for each receptor. With use of the Risk Matrix, generally at least two or three controls are necessary to reduce risks to acceptable levels (i.e., III or IV). Opportunities for improvement are identified if only ACs are selected for risk reduction. Recommendations could consider the potential upgrades or modification of engineered features to reduce the reliance on ACs. DOE-HDBK-1163-2020 C-2 Controls selected to provide defense-in-depth might reduce risk further but are not generally credited in the risk assessment with respect to a reduction in the overall risk (i.e., a bin-drop in risk value). Protective layers providing defense-in-depth are generally redundant and ideally independent of each other. The unmitigated risk is evaluated for a risk reduction by applying engineered controls or ACs. Screening efforts can be implemented as a part of the risk assessment process. Common risk assessment screening techniques include unmitigated consequence and acceptable risk. The subsequent sections go into greater detail on unmitigated consequence and risk threshold screening. Unmitigated Consequence Screening The unmitigated consequence screen is part of the systematic approach in the HA process. The unmitigated consequence screen streamlines the HA by focusing resources on the HE events with an undesirable consequence and ensuring only those events of concern are carried forward for consideration of controls. Consequence determinations are assigned for each of the receptors for each event; each event reflects a potential, qualitative consequence for that receptor.

Events can be screened using various rationale; however, it is important to document that rationale. A common unmitigated consequence screening practice is provided based on the narrative and subsequent logic derived from DOE-STD-3009. Events assigned high or moderate consequences to the public are carried forward for credited control derivation. Events assigned a high consequence to the co-located worker or facility worker carry forward from the risk assessment for control derivation. Events assigned low or negligible consequences to the public do not carry forward. Events assigned moderate, low, or negligible consequences to the facility worker or co-located worker are often controlled by safety management programs and do not go into detailed control derivation to identify a specific SSC or AC to prevent or mitigate the event. Only those events carried forward from the risk assessment are used to derive credited controls, although in actual practice, multiple layers of additional controls are often present. Risk Threshold Screening A risk threshold screening is typically a part of the systematic approach in the HA process. This screen further streamlines the HA by further